Malicious IP address base updating method and device

Abstract

The embodiment of the invention discloses a malicious IP address library updating method and device, and the method comprises the steps: analyzing a received network flow through electronic equipment, obtaining a source IP address in the network flow, and detecting whether the source IP address is a malicious IP address or not through a locally stored malicious IP address library according to the source IP address; if the source IP address does not exist in the malicious IP address base stored locally, the source IP address is sent to the cloud equipment, whether the source IP address is the malicious IP address or not is detected through the threat intelligence information base stored in the cloud equipment, and therefore the newly-appearing malicious IP address can be accurately recognized.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for updating a malicious IP address database. Background Art

[0002] With the rapid development of Internet technology, network security issues are becoming increasingly prominent. Network security protection is extremely important, and firewalls or intrusion detection systems are usually used to identify security issues such as network attacks and illegal activities. Firewalls or intrusion detection systems contain malicious IP address libraries, which contain malicious IP addresses. Firewalls or intrusion detection systems use malicious IP addresses in malicious IP address libraries to identify security issues such as network attacks and illegal activities, as well as to prevent network attacks. However, illegal activities such as distributed denial of service attacks (DDoS), malware, and phishing are emerging in an endless stream. Therefore, the malicious IP address library needs to be constantly updated to prevent new network attacks.

[0003] However, in the prior art, the malicious IP address database is usually updated periodically. If a new malicious IP address appears between the current update and the next update, the firewall or intrusion detection system cannot accurately identify the new malicious IP address. Therefore, how to accurately identify malicious IP addresses needs to be considered. Summary of the invention

[0004] The present application provides a method and device for updating a malicious IP address database, which are used to improve the accuracy of identifying malicious IP addresses.

[0005] The present application embodiment provides a method for updating a malicious IP address database, the method comprising:

[0006] Parsing the received network flow to obtain the source IP address in the network flow;

[0007] Determine whether the source IP address is included in the locally stored malicious IP address database;

[0008] If not, the source IP address is sent to the cloud device, and a feedback result from the cloud device is received;

[0009] If the feedback result indicates that the source IP address exists in the threat intelligence information library stored in the cloud device, the source IP address is updated to the malicious IP address library and access to the network flow is blocked.

[0010] Furthermore, the malicious IP address library includes a first cache library and a second cache library, and the determining whether the locally stored malicious IP address library contains the source IP address includes:

[0011] Determining a hash value of the source IP address;

[0012] Identify whether the hash value is stored in the first cache library or the second cache library.

[0013] Further, updating the source IP address to the malicious IP address database includes:

[0014] The hash value of the source IP address is added to the second cache library of the malicious IP address library, and the number of times the source IP address is checked is updated.

[0015] Furthermore, before adding the hash value of the source IP address to the second cache library of the malicious IP address library, the method further includes:

[0016] Determine whether the number of IP addresses in the second cache is equal to a preset value;

[0017] If so, delete the IP address with the lowest frequency in the second cache and its corresponding number of checks.

[0018] Furthermore, the method further comprises:

[0019] If the first cache library of the malicious IP address library stores the hash value, determine whether the source IP address corresponding to the hash value has not been checked according to the hit information recorded in the associative array corresponding to the hash value; if so, modify the hit information to be checked, and update the number and frequency of the source IP address being checked in the associative array; if not, update the number of the source IP address being checked in the associative array;

[0020] If the second cache library of the malicious IP address library stores the hash value, the number of times the source IP address corresponding to the hash value in the second cache library is checked is updated.

[0021] Furthermore, the method further comprises:

[0022] Determine the score of each IP address at a preset time interval based on whether it is checked for the first time, the number of times it is checked, and the frequency recorded in the associative array corresponding to each IP address in the first cache;

[0023] Determine, according to the number of IP addresses included in the second cache library, the number of IP addresses with lower scores in the first cache library to be replaced;

[0024] The replaced IP address and number of times in the first cache are replaced with the IP address and number of times in the second cache, and the corresponding frequency and hit information are updated.

[0025] Furthermore, the method further comprises:

[0026] The hit information recorded in the associative array corresponding to each IP address contained in the first cache is updated to not being checked.

[0027] The embodiment of the present application provides a device for updating a malicious IP address database, the device comprising:

[0028] A processing module, used for parsing the received network flow and obtaining the source IP address in the network flow;

[0029] A judgment module, used to judge whether the source IP address is included in the malicious IP address library stored locally;

[0030] A transceiver module, configured to send the source IP address to a cloud device and receive a feedback result from the cloud device if the judgment result of the judgment module is no;

[0031] A determination module is used to update the source IP address to the malicious IP address library and block access to the network flow if the feedback result indicates that the source IP address exists in the threat intelligence information library stored in the cloud device.

[0032] Furthermore, the determination module is specifically used to determine the hash value of the source IP address;

[0033] The determination module is specifically configured to identify whether the hash value is stored in the first cache library or the second cache library.

[0034] Furthermore, the processing module is specifically configured to add the hash value of the source IP address to the second cache library of the malicious IP address library, and update the number of times the source IP address is checked.

[0035] Furthermore, the determination module is further configured to determine whether the number of IP addresses in the second cache library is equal to a preset value;

[0036] The processing module is further configured to delete the IP address with the smallest frequency in the second cache and its corresponding number of checked times if the number of IP addresses in the second cache is equal to a preset value.

[0037] Furthermore, the judgment module is further used to judge whether the source IP address corresponding to the hash value has not been checked according to the hit information recorded in the associative array corresponding to the hash value if the first cache library of the malicious IP address library stores the hash value;

[0038] The processing module is further configured to modify the hit information to be checked if the source IP address corresponding to the hash value is not checked, and update the number of times and frequency of the source IP address being checked in the associative array; if the source IP address corresponding to the hash value is checked, update the number of times the source IP address is checked in the associative array;

[0039] The processing module is further configured to update the number of times the source IP address corresponding to the hash value in the second cache library is checked if the second cache library of the malicious IP address library stores the hash value.

[0040] Furthermore, the determination module is further configured to determine the score of each IP address being used according to whether it is checked for the first time, the number of times it is checked, and the frequency recorded in the associative array corresponding to each IP address in the first cache library at a preset time interval; and determine the number of IP addresses with lower scores to be replaced in the first cache library according to the number of IP addresses included in the second cache library;

[0041] The processing module is further configured to replace the replaced IP address and number of times in the first cache library with the IP address and number of times in the second cache library, and update the corresponding frequency and hit information.

[0042] Furthermore, the processing module is further configured to update the hit information recorded in the associative array corresponding to each IP address contained in the first cache library to not being checked.

[0043] An embodiment of the present application further provides an electronic device, the electronic device comprising a processor, the processor being configured to implement the steps of any of the above methods when executing a computer program stored in a memory.

[0044] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0045] In an embodiment of the present application, the electronic device parses the received network flow, obtains the source IP address in the network flow, and detects whether the source IP address is a malicious IP address through a locally stored malicious IP address library; if the source IP address does not exist in the locally stored malicious IP address library, the source IP address is sent to the cloud device, and the threat intelligence information library stored in the cloud device is used to detect whether the source IP address is a malicious IP address, thereby accurately identifying newly emerging malicious IP addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 Schematic diagram of the malicious IP address database update process provided for this application;

[0048] Figure 2a A schematic diagram of a first cache data structure of a first cache library provided by the present application;

[0049] Figure 2b A schematic diagram of a second cache data structure of a second cache library provided by the present application;

[0050] Figure 3 A schematic diagram of a second cache library process for adding a source IP address and / or a hash value of a source IP address to a malicious IP address library provided by the present application;

[0051] Figure 4 A schematic diagram of a process of updating associative array information corresponding to a first cache library and a second cache library in a malicious IP address library provided by the present application;

[0052] Figure 5 A schematic diagram of a process of eliminating and updating a first cache library by a second cache library in a malicious IP address library provided by the present application;

[0053] Figure 6 A simplified schematic diagram of the malicious IP address database update process provided by this application;

[0054] Figure 7 A schematic diagram of the structure of a device for updating a malicious IP address database provided by this application;

[0055] Figure 8 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0056] In order to make the purpose and implementation method of the present application clearer, the exemplary implementation method of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0057] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0058] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0059] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0060] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0062] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0063] Embodiment 1:

[0064] Figure 1The schematic diagram of the malicious IP address database update process provided by this application includes the following steps:

[0065] S101: Parse the received network flow to obtain the source IP address in the network flow.

[0066] The malicious IP address library updating method provided in the embodiment of the present application is applied to an electronic device, which may be a firewall device, a computer (Personal Computer, PC) or a server including an intrusion detection system, etc.

[0067] A network flow refers to a sequence of packets flowing from a source IP address to a target IP address, and these packet sequences contain information about the source IP address and the target IP address. These network flows can be generated from a variety of sources, such as different applications or different devices, and the embodiments of the present application do not limit the source of the network flow.

[0068] At the same time, an electronic device may receive multiple network streams, so this application is introduced by taking any network stream as an example.

[0069] The process of parsing the network flow to obtain the source IP address can adopt the existing technology, which will not be repeated here.

[0070] S102: Determine whether the locally stored malicious IP address database contains the source IP address.

[0071] If not, go to S103; if so, go to S105.

[0072] S103: If not, the source IP address is sent to the cloud device, and a feedback result from the cloud device is received.

[0073] If the source IP address does not exist in the locally stored malicious IP address database, it is not certain whether the source IP address is a newly appeared malicious IP address. The cloud device can be used to determine whether the source IP address is a malicious IP address.

[0074] The cloud device is equipped with a threat intelligence information library, which is a database containing threat intelligence. Threat intelligence is a type of data based on real-time monitoring and analysis of network threats, used to identify and predict potential network security threats.

[0075] If the source IP address exists in the threat intelligence information database in the cloud device, it means that the source IP address has a network security problem, that is, it is a malicious IP address; otherwise, it means that the source IP address does not have a network security problem and access by the source IP address is allowed.

[0076] The feedback result may indicate whether the source IP address exists in the threat intelligence information database stored in the cloud device, or whether the source IP address does not exist. The feedback result may be indicated by 1 bit, for example, when the value of 1 bit is 1, it indicates existence, and when the value of 1 bit is 0, it indicates non-existence.

[0077] S104: If the feedback result indicates that the source IP address exists in the threat intelligence information library stored in the cloud device, the source IP address is updated to the malicious IP address library and the access of the network flow is blocked.

[0078] When the received feedback result is yes, the source IP address is a malicious IP address, and the electronic device takes the source IP address as a malicious IP address, updates it to the locally stored malicious IP address library, and blocks access to the network flow.

[0079] S105: Directly block access to the network flow.

[0080] The malicious IP address database stored locally contains one or more malicious IP addresses. For the parsed source IP address, check whether the malicious IP address database contains the source IP address. If the source IP address has been recorded in the malicious IP address database stored locally, it proves that the source IP address itself is a known malicious IP address. At this time, the access of the network flow can be directly blocked.

[0081] In an embodiment of the present application, the electronic device parses the received network flow, obtains the source IP address in the network flow, and detects whether the source IP address is a malicious IP address through a locally stored malicious IP address library; if the source IP address does not exist in the locally stored malicious IP address library, the source IP address is sent to the cloud device, and the threat intelligence information library stored in the cloud device is used to detect whether the source IP address is a malicious IP address, thereby accurately identifying newly emerging malicious IP addresses.

[0082] Embodiment 2:

[0083] The following is a possible example of step 102 (determining whether the locally stored malicious IP address library contains the source IP address): determine the hash value of the source IP address, and determine whether the malicious IP address library contains the hash value of the source IP address. If it does, it is determined that the malicious IP address library contains the source IP address; if it does not, it is determined that the malicious IP address library does not contain the source IP address.

[0084] The malicious IP address database includes hash values ​​of malicious IP addresses, and optionally, also includes some related information, such as malicious IP addresses, frequency of malicious IP addresses, frequency count of malicious IP addresses, hit flags of malicious IP addresses, etc.

[0085] The source IP address is converted into a corresponding hash value. The hash value of the IP address can be used to quickly query the IP address. The method of determining the hash value based on the IP address is a prior art and will not be described in detail here.

[0086] The cache library of the malicious IP address library can be one cache database or multiple cache databases. For example, the locally stored malicious IP address library can be divided into a first cache library and a second cache library.

[0087] The electronic device periodically obtains malicious IP addresses from the threat intelligence library of the cloud device and stores the obtained malicious IP addresses in the first cache library, and the first cache library includes the malicious IP addresses periodically obtained from the threat intelligence library of the cloud device.

[0088] The electronic device periodically deletes malicious IP addresses that appear less frequently in the first cache library, and after deletion, stores the malicious IP addresses in the second cache library in the first cache library. The IP addresses of the first cache library also include malicious IP addresses that appear in the next cycle after the malicious IP addresses are obtained from the threat intelligence library of the cloud device in this cycle.

[0089] The electronic device obtains the source IP address in the network flow, and when it is determined that the source IP address is not stored in the first cache library, sends the source IP address to the cloud device, and the cloud device determines whether the source IP address is included in the threat intelligence library and sends a response to the electronic device. When the electronic device obtains that the threat intelligence library of the cloud device includes the source IP address, the electronic device stores the source IP address in the second cache library. The second cache library includes the malicious IP address that does not exist in the first cache library but exists in the threat intelligence library of the cloud device.

[0090] When determining whether the locally stored malicious IP address library contains the source IP address (i.e., step 102), specifically: identifying whether the source IP address is stored in the first cache library or the second cache library, or identifying whether the hash value of the source IP address is stored in the first cache library or the second cache library. If the source IP address and / or the hash value of the source IP address exists in the first cache library or the second cache library, it means that the locally stored malicious IP address library contains the source IP address; if the source IP address and / or the hash value of the source IP address does not exist in the first cache library and the second cache library, it means that the source IP address is not in the locally stored malicious IP address library.

[0091] The first cache library and the second cache library are provided with corresponding cache data structures, and the cache data structures contain a hash table and a corresponding associative array. The hash table records the hash value corresponding to the malicious IP address. The associative array records the malicious IP address, the frequency of the malicious IP address, the frequency of the malicious IP address, the hit flag of the malicious IP address, and other information.

[0092] In order to clearly understand the cache data structures corresponding to the first cache library and the second cache library, an explanation is given below with reference to the figures.

[0093] like Figure 2a Schematic diagram of the first cache data structure of the first cache library, which includes a first hash table and a first associative array L1 ip , used to store malicious IP addresses and related information.

[0094] 1. First Hash Table: The first hash table contains hash values ​​corresponding to malicious IP addresses, which are used to quickly query whether a malicious IP address is in the first cache library and determine the index of a malicious IP address in the first cache library, so as to quickly locate the first associative array corresponding to a malicious IP address in the first cache library.

[0095] 2. First associative array (Array): first associative array L1 ip The number of the first associative array L1 is the same as the number of hash values ​​in the first hash table. ip The information related to the malicious IP address (e.g., the malicious IP address, the frequency of the malicious IP address, the frequency of the malicious IP address, the hit flag of the malicious IP address, etc.) is stored, and any first associative array has the following structure:

[0096] L1 ip = <IP,F ip ,C1 ip ,Currenti hit >

[0097] Among them, a), IP: represents the malicious IP address, which is the unique identifier of the array element.

[0098] b) F ip : Indicates frequency. If a malicious IP address is queried for the first time within a time window, the frequency of this malicious IP address will increase by 1. Frequency can indicate how many time windows it is queried in. In a time window, even if it is queried multiple times, the frequency will only increase by 1 in that time window.

[0099] c) C1 ip : Indicates the frequency count (Count), which records the number of times this malicious IP address is queried in the first cache after a time window ends. That is, the frequency count of this malicious IP address increases by 1 each time it is queried within a time window.

[0100] A time window refers to a period of time. The time window in the embodiment of the present application can be actually set according to the specific device situation.

[0101] d) Current hit : Indicates the recent hit flag (Hit Flag), which is used to indicate whether the malicious IP address has been queried within the current time window.

[0102] For example, in the first cache library in all four time windows, there is a malicious IP address a. Then the first associative array L1 corresponding to the malicious IP address a is ip The following situations may exist:

[0103] In the first time window, the malicious IP address a is queried 5 times, then L1 ip =<a,1,5,1> ;

[0104] In the second time window, the malicious IP address a is not queried, so L1 ip =<a,1,5,0> ;

[0105] In the third time window, the malicious IP address a is queried again and queried 8 times, then L1 ip =<a,2,5+8,1> ;

[0106] In the fourth time window, the malicious IP address a is queried again and queried 7 times, then L1 ip =<a,3,5+8+7,1> .

[0107] like Figure 2b is a schematic diagram of a second cache data structure of a second cache library, which includes a second hash table and a second associative array L2 ip Among them, the second associative array L2 ip It can also be called an IP counter. The IP counter mainly records the number of times a malicious IP address is queried in the second cache.

[0108] 1. Second hash table: The second hash table contains hash values ​​corresponding to malicious IP addresses, which are used to quickly query whether a malicious IP address is in the second cache library and determine the index of a malicious IP address in the second cache library, so as to quickly locate the second associative array corresponding to a malicious IP address in the second cache library.

[0109] 2. Second associative array: second associative array L2 ip The number of associative arrays L2 is the same as the number of hash values ​​in the second hash table. ip To store information related to malicious IP addresses (e.g., malicious IP addresses, frequency of malicious IP addresses, etc.), each second associative array has the following structure:

[0110] L2 ip = <IP,C2 ip >

[0111] Among them, a), IP: represents the malicious IP address, which is the unique identifier of the array element.

[0112] b) C2 ip : Indicates the frequency count, which records the number of times the malicious IP address is queried in the second cache after a time window ends. That is, each time a malicious IP address in the second associative array is queried within a time window, the frequency count of the malicious IP address increases by 1.

[0113] The number of malicious IP addresses stored in the second cache can be preset according to actual needs. The number of malicious IP addresses in the second cache is much smaller than the number of malicious IP addresses in the first cache.

[0114] Embodiment 3:

[0115] After receiving the feedback result indicating that the source IP address information exists in the threat intelligence information library stored in the cloud device, the source IP address is updated to the malicious IP address library (i.e., step 104). The specific operation process includes: adding the source IP address and / or the hash value of the source IP address to the malicious IP address library; or, adding the source IP address and / or the hash value of the source IP address to the second cache library of the malicious IP address library, or, adding the source IP address and / or the hash value of the source IP address to the first cache library of the malicious IP address library.

[0116] Further optionally, the specific operation process of updating the source IP address to the malicious IP address database also includes: updating the number of times the source IP address is checked.

[0117] Figure 2b As shown, a certain number of newly detected malicious IP addresses and the corresponding number of times they are checked are recorded in the second cache library. If the threat intelligence information library includes the source IP address, the source IP address and / or the hash value of the source IP address are added to the second cache library of the malicious IP address library. The specific operation includes: adding the hash value of the source IP address to the second hash table. The source IP address and the number of times the source IP address is checked are updated to the second associative array of the second cache library of the malicious IP address library.

[0118] In a possible implementation, if the threat intelligence information library includes the source IP address, the source IP address and / or the hash value of the source IP address can be added to the malicious IP address library. In this case, the source IP address and / or the hash value of the source IP address can be added to the first cache library or the second cache library, without limiting the specific location.

[0119] In one possible implementation, if the threat intelligence information library includes the source IP address, the source IP address and / or the hash value of the source IP address may be added to the first cache library of the malicious IP address library. Figure 2a As shown, the hash value of the source IP address is added to the first hash table. The source IP address and the number of times the source IP address is checked are updated to the first associative array of the first cache library of the malicious IP address library, and the frequency information and Current in the first associative array are updated. hit information.

[0120] The number of times the source IP address is checked is updated, that is, the number of times it is checked is increased by 1 each time.

[0121] Embodiment 4:

[0122] The number of malicious IP addresses recorded in the second cache is preset. Therefore, before executing the above step 104 (updating the source IP address to the malicious IP address library), in order to ensure that the source IP address is successfully added to the second cache of the malicious IP address library, that is, the newly detected malicious IP address can be successfully recorded in the second cache of the locally stored malicious IP address library. Before adding the source IP address and / or the hash value of the source IP address to the second cache of the malicious IP address library, the present application also determines the number of IP addresses in the second cache.

[0123] For ease of understanding, the process of adding a source IP address to the second cache library of a malicious IP address library is explained below through a specific embodiment. Figure 3 , Figure 3 A schematic diagram of a second cache library process for adding a source IP address and / or a hash value of a source IP address to a malicious IP address library provided by the present application, the process comprising the following steps:

[0124] S301: Determine whether the number of IP addresses in the second cache is equal to a preset value.

[0125] If yes, execute S302; if no, execute S303.

[0126] S302: Delete the IP address with the lowest frequency and its corresponding number of times of being checked in the second cache, and execute step 303.

[0127] When the number of the second malicious IP addresses in the second cache has reached the maximum limit C lim , that is, the number of the second malicious IP addresses in the second cache is equal to C lim At this time, based on the frequency C2ip in the second cache data structure, the second malicious IP address with the smallest frequency in the second cache library, the corresponding hash value and the corresponding number of times it has been checked are deleted.

[0128] In one possible implementation, if there are multiple identical minimum frequencies in the second cache library, the entry time of each second malicious IP address with the minimum frequency is detected, and based on the detected time, the earliest entering second malicious IP address, the corresponding hash value, and the corresponding number of times it is checked are deleted.

[0129] S303: Add the hash value of the source IP address to the second cache library of the malicious IP address library, and update the number of times the source IP address is checked.

[0130] When adding the hash value of the source IP address to the second cache library of the malicious IP address library, it is necessary to add the hash value of the source IP address to the second hash table and also to add the source IP address to the second associative array.

[0131] Update the number of times the source IP address is checked, for example, the corresponding frequency C2 ip Set to 1. Because the source IP address has been detected within this time window and has been determined to be a malicious IP address, the corresponding number of times it has been checked needs to be updated to 1 when recording.

[0132] When the number of the second malicious IP addresses in the second cache is less than the maximum limit C lim , it can be understood that the second cache contains an empty space at this time, so for the newly detected malicious IP address, the hash value of the malicious IP address can be directly added to the hash table of the second associative array, the source IP address can be added to the second associative array, and the number of times the source IP address is checked is updated to 1.

[0133] Embodiment 5:

[0134] The electronic device will accurately record the activity of each detected malicious IP address by updating the information of the associative array of each malicious IP address, that is, during the detection process, it will correspondingly record the frequency, frequency and other information of each malicious IP address.

[0135] For ease of understanding, the process of updating the associative array information corresponding to the first cache library and the second cache library in a malicious IP address library provided by the present application is explained below through a specific embodiment.

[0136] Figure 4 A schematic diagram of a process for updating associative array information corresponding to a first cache library and a second cache library in a malicious IP address library provided in an embodiment of the present application, the process comprising the following steps:

[0137] S400: Based on the hash value of the source IP address, determine whether the source IP address exists in the first cache.

[0138] If it exists, go to S401; if it does not exist, go to S404.

[0139] S401: According to the hit information recorded in the associative array corresponding to the hash value, it is determined whether the source IP address corresponding to the hash value has not been checked.

[0140] If the source IP address is in the first cache, the corresponding L1 is found through the hash value in the hash table. ip , and check that L1 ip Current hit Is it 0? In the embodiment of the present application, if the Current in the first associative array hit =0, it proves that the source IP address has not been queried within the current time window.

[0141] If yes, go to S402; if no, go to S403.

[0142] S402: Modify the hit information to be checked, and update the number of times and frequency of the source IP address being checked in the associated array.

[0143] In a possible implementation, after the current time window ends, the electronic device will store all L1 ip The hit flag in is reset to 0, that is, before the next time window starts, all L1 ip The hit flag in is 0. For example, in the current time window, if the L1 corresponding to the source IP address A ip =<A,2,3,1> , then after the current time window ends, the system resets to L1 ip =<A,2,3,0> When the next preset time window is detected, if the source IP address appears again, the hit information of the source IP address needs to be modified to be checked, and the number of times and frequency of the source IP address being checked in the associated array are updated. That is, when the next time window is detected, if the hash value of the source IP address is already in the first cache and appears again, the Current hit Set to 1, F ip and C ip For example, if the L1 corresponding to the source IP address A ip =<A,2,3,0> , then update to L1 ip =<A,3,4,1> .

[0144] In one possible implementation, the electronic device periodically updates the first cache library of the malicious IP address library stored locally based on the threat intelligence information library of the cloud device. Therefore, after the threat intelligence information library based on the cloud device is updated, the first cache data structure of the first cache library needs to be fully initialized, that is, after the threat intelligence information library based on the cloud device is updated, the L1 of the first cache library ip =<IP,0,0,0> After the detection starts, if the source IP address is found in the first cache, the Current hit Set to 1, F ip and C ip For example, if the L1 corresponding to the source IP address B ip =<B,0,0,0> , then update to L1 ip =<B,1,1,1> .

[0145] S403: Update the number of times the source IP address is checked in the associative array.

[0146] If the source IP address is in the first cache, the corresponding L1 is found through the hash value in the hash table. ip , and check that L1 ip Current hit Is it 1? In the embodiment of the present application, if the first associative array L1 ip Current hit =1, it proves that the source IP address has been queried. ip For example, if the L1 corresponding to the source IP address C ip =<C,1,0,1> , then update to L1 ip =<C,1,1,1> For example, if the source IP address C corresponds to L1 ip =<C,2,3,1> , then update to L1 ip =<C,2,4,1> .

[0147] S404: Based on the hash value of the source IP address, determine whether the source IP address exists in the second cache.

[0148] If yes, go to S405; if no, go to S406.

[0149] S405: Update the number of times the source IP address corresponding to the hash value in the second cache is checked.

[0150] If the source IP address already exists in the second cache, the frequency C2 of the corresponding source IP address in the second cache is ip Increase by 1. For example, if the L2 corresponding to the source IP address D ip =<D,1> , then update to L2ip =<D,2> .

[0151] S406: Send the source IP address to the cloud device, receive feedback from the cloud device, and update the associative array information corresponding to the second cache based on the feedback.

[0152] In an embodiment of the present application, by continuously detecting whether the source IP address in the network flow received by the electronic device is a malicious IP address and recording the array information corresponding to each malicious IP address, the data of the associated array in the first cache library and the second cache library are continuously updated, thereby recording the activity of the malicious IP address, and providing an evaluation basis for the elimination and update of the malicious IP address library.

[0153] Embodiment 6:

[0154] The malicious IP addresses to be replaced in the first cache library are determined by calculating the number of malicious IP addresses in the second cache library and the score of each malicious IP address in the first cache library, and the malicious IP addresses in the second cache library are updated to the first cache library.

[0155] Figure 5 A schematic diagram of a process of eliminating and updating a first cache library by a second cache library in a malicious IP address library provided in an embodiment of the present application, the process includes the following steps:

[0156] S501: Determine the usage score of each IP address at a preset time interval according to whether it is checked for the first time, the number of times and the frequency of checking recorded in the associative array corresponding to each IP address in the first cache.

[0157] The preset time interval refers to a period of time, such as every 30 seconds, every 5 minutes, every 1 hour, etc. In actual operation, the specific preset time interval used can be set according to actual conditions.

[0158] Whether it is the first time to check, the number of times and the frequency of checking recorded in the associative array corresponding to each IP address in the first cache library can be determined by the specific values ​​updated in step 402 and step 403.

[0159] By formula Calculate the hit score S corresponding to each first malicious IP address in the first cache hit , where X1, X2, and X3 are L1 ip F ip 、C1 ip 、Current hit Corresponding values. σ1, σ2, σ3 are weight parameters corresponding to X1, X2, and X3 respectively, and the weight parameters are adjusted and determined based on the actual situation.

[0160] S502: According to the number of IP addresses contained in the second cache and the scores determined in step 501, determine the IP addresses with lower scores to be replaced in the same number of first caches.

[0161] For example, after a preset time interval, if 500 newly appeared malicious IP addresses are recorded in the second cache library, then based on the scores calculated in step 501, 500 malicious IP addresses with lower scores are correspondingly selected in the first cache library to be replaced.

[0162] In one possible implementation, the second cache library continuously records newly emerged malicious IP addresses. At each preset time interval, the number of newly emerged malicious IP addresses recorded in the second cache library is not fixed. Therefore, the number of malicious IP addresses to be replaced in the first cache library is also not fixed each time. For example, after the preset time window A ends, the second cache library contains 100 newly emerged malicious IP addresses, and at this time, 100 replaced malicious IP addresses with lower scores need to be determined in the first cache library; after the preset time window B ends, the second cache library contains 150 newly emerged malicious IP addresses, and at this time, 150 replaced malicious IP addresses with lower scores need to be determined in the first cache library.

[0163] S503: Use the IP address and frequency count in the second cache library to replace the replaced IP address and frequency count in the first cache library, and update the corresponding frequency and hit information.

[0164] The replaced IP address in the first cache library is replaced with the IP address in the second cache library, including: deleting the hash value of the replaced malicious IP address in the first hash table, and adding the hash value of the malicious IP address in the second hash table; deleting the IP address bit information in the first associative array corresponding to the replaced malicious IP address, and adding the malicious IP address in the second associative array.

[0165] Using the frequency of the IP address in the second cache library to compare the frequency of the IP address to be replaced in the first cache library, including: ip The value information of the bit is deleted and C2 in the second associative array is added ip The value information of the bit.

[0166] Update the corresponding frequency and hit information, including: replace F1 in the first associative array corresponding to the malicious IP address ip The value information of the bit is set to 1; the Current in the first associative array corresponding to the malicious IP address to be replaced hit The value information of the bit is set to 1.

[0167] At this time, all information in the second cache is cleared, that is, the second cache is initialized to prepare for starting the detection of the next time interval.

[0168] The embodiment of the present application is based on a multi-dimensional comprehensive evaluation of the frequency, frequency number, and hit information of malicious IP addresses, calculates the hit score of the malicious IP address, and replaces the corresponding malicious IP address in the first cache library through the hit score, thereby achieving the elimination of low-activity malicious IP addresses (relatively outdated malicious IP addresses). The specific operation is: at the end of each time window, remove the low-risk malicious IP addresses in the first cache library according to the hit score, and add the newly appeared malicious IP addresses in the second cache library to the first cache library, while the total number of IP addresses in the malicious IP address library remains unchanged. The newly appeared malicious IP addresses are added to the library (the freed space is used to quickly absorb and respond to the newly appeared hot malicious IP addresses), thereby achieving efficient use of storage and computing resources. This dynamic adjustment process not only ensures the continuous monitoring of newly appeared malicious IP addresses, but also avoids wasting resources on low-activity malicious IP addresses.

[0169] Embodiment 7:

[0170] After the second cache library eliminates and updates the first cache library (ie, step 503), the system updates the hit information recorded in the associative array corresponding to each IP address contained in the first cache library to not being checked.

[0171] In a possible implementation, after the current time window ends, the system will use the IP address and frequency count in the second cache library to replace the replaced IP address and frequency count in the first cache library, and update the corresponding frequency and hit information. Therefore, after the second cache library replaces and updates the first cache library, the malicious IP address in the first cache library has the malicious IP address that has been checked, that is, Current hit =1, there may be malicious IP addresses that have not been checked, that is, Current hit = 0. To ensure fairness in calculating the hit score of each malicious IP address next time, after the second cache library completes the elimination and update of the first cache library, all L1 ip The hit flag in is reset to 0, that is, before the next time window starts, all L1 ip The hit flag in is 0.

[0172] For example, in the current time window, if the L1 corresponding to the source IP address F ip =<F,2,3,1> , then before the next time window begins, the system resets to L1 ip=<F,2,3,0> For example, in the current time window, if the L1 corresponding to the source IP address G ip =<G,2,3,0> , then before the next time window starts, the system still displays L1 ip =<G,2,3,0> .

[0173] In one possible implementation, the electronic device will update the first cache library of the locally stored malicious IP address library based on the threat intelligence information library of the cloud device. At this time, the malicious IP addresses in the updated first cache library are different from the malicious IP addresses in the first cache library before the update. Therefore, after the threat intelligence information library based on the cloud device is updated, the first cache data structure of the first cache library needs to be fully initialized. Specifically, each time the threat intelligence information library based on the cloud device is updated, the first cache data structure of the first cache library is initialized once.

[0174] The specific operation of initializing the first cache library is: loading all malicious IP addresses obtained from the threat intelligence information library of the cloud device into the first associative array L1 ip IP bit in the L1 ip Medium F ip ,C ip ,Current hit All three fields are set to 0, that is, after the threat intelligence information library based on the cloud device is updated, the L1 of the first cache library ip =<IP,0,0,0> At the same time, the hash values ​​corresponding to all malicious IP addresses are loaded into the first hash table.

[0175] In the embodiment of the present application, after the current time window ends, the hit information recorded in the associative array corresponding to each malicious IP address contained in the first cache library is updated to not being checked, so that the Current in the first cache data structure of the first cache library is hit Reset; or after the threat intelligence information library based on the cloud device is updated, initialize the first cache data structure of the first cache library, and then continuously update the associative array information corresponding to each malicious IP address, based on the specific data of the associative array, so that the malicious IP address library has a multi-dimensional comprehensive evaluation mechanism for the query frequency, hit rate and frequency of the malicious IP address, and the elimination and update of the locally stored malicious IP address library is achieved according to the multi-dimensional comprehensive evaluation mechanism.

[0176] Embodiment 8:

[0177] Figure 6 A simplified schematic diagram of a malicious IP address database update process provided in an embodiment of the present application includes the following steps:

[0178] S601: Query the IP address in the malicious IP address database.

[0179] The malicious IP address library is divided into a first cache library and a second cache library. The IP address refers to the source IP address in the network flow. Querying the IP address is the above step 102, and determining whether the locally stored malicious IP address library contains the source IP address.

[0180] S602: Determine whether the IP address matches the malicious IP address database.

[0181] Based on the hash value corresponding to the IP address, it is determined whether the IP address exists in the first cache or the second cache, that is, in the above steps 400 and 404, it is determined whether the source IP address exists in the malicious IP address library based on the hash value of the source IP address. A hit here means being queried in the malicious IP address library.

[0182] If it hits, go to S603; if it misses, go to S605.

[0183] S603: Update the frequency and frequency information of the first cache hitting the IP address in the malicious IP address library, or update the frequency information of the second cache hitting the IP address.

[0184] If the IP address exists in the first cache, the frequency, the number of times and the hit flag information of the first associated value in the first cache are updated accordingly. The specific operations are as described in the above steps 402 and 403, which will not be repeated here.

[0185] If the IP address exists in the second cache, the frequency of the second associated value in the second cache is updated accordingly. The specific operation is the same as the above step 405, which will not be described again.

[0186] S604: After the current time window ends, based on the frequency and frequency information of each malicious IP address in the first cache in step 603, a corresponding hit score of each malicious IP address in the first cache is calculated.

[0187] Based on the frequency and frequency information of each malicious IP address in step 603, the formula Calculate the hit score of each malicious IP address in the first cache library. The specific operation is the above step 501, which will not be repeated here.

[0188] S605: Based on the threat intelligence information database in the cloud device, query whether the IP address is a malicious IP address.

[0189] The IP address is sent to the threat intelligence information library in the cloud device. The threat intelligence information library in the cloud device contains data on real-time monitoring and analysis of network threats. Based on this data on real-time monitoring and analysis of network threats, the credibility of the IP address can be analyzed. In other words, the credibility of the IP address can represent the aggressiveness of the IP address. If the credibility of the IP address is low, it means that the possibility of network attack on the IP address is high. At this time, the IP address will be judged as a malicious IP address, which can be understood as the existence of the IP address in the threat intelligence information library stored in the cloud device. The cloud device transmits the feedback result to the electronic device through a bit value. After receiving the feedback result from the cloud device, the electronic device determines whether the IP address is a malicious IP address.

[0190] S606: In the current time window, the IP address is updated in the second cache and the corresponding frequency information is updated.

[0191] If the IP address (hit IP address) is determined to be a malicious IP address, it is recorded in the second cache. ip The IP address bit in the hash table is entered into the second hash table, and the frequency corresponding to the IP address is set to 1.

[0192] S607: After the current time window ends, based on the hit scores in step 604, a batch of IP addresses with the lowest hit scores in the first cache library are eliminated, and all malicious IP addresses in the second cache library are added to the first cache library.

[0193] Eliminate a batch of IP addresses with the lowest hit scores in the first cache library, such as step 501, by formula Calculate the hit score of each malicious IP address in the first cache library, and the hit score of each malicious IP address can represent its corresponding activity. Among them, the lower the hit score, the less active the corresponding malicious IP address is. For inactive malicious IP addresses, all their information is eliminated. The specific implementation process is as described in step 502 above, which will not be repeated here.

[0194] In a possible implementation, a batch of IP addresses with the lowest hit scores in the first cache are selected, wherein the specific value of the batch of IP addresses can be determined according to the specific number of malicious IP addresses in the second cache. The specific implementation process is as described in step 502 above, which will not be repeated here.

[0195] After the current time window ends, all malicious IP addresses in the second cache library are added to the first cache library, as in step 503. When all malicious IP addresses in the second cache library are added to the first cache library, each malicious IP address, the hash value corresponding to each malicious IP address, and the corresponding frequency are added to the first cache library.

[0196] S608: Initialize the second cache bank and transfer C1 in the first cache bank to the ip Current hit Set to 0 to start the next time window detection.

[0197] After adding all malicious IP addresses in the second cache library to the first cache library, the electronic device initializes the second cache library, that is, clears all data in the second cache library to prepare for new detection and entry. ip Current hit Set to 0 to prepare for the next calculation of the hit score of the malicious IP address of the first cache library.

[0198] Embodiment 9:

[0199] Based on the same inventive concept, the embodiment of the present application provides a device for updating a malicious IP address database. Figure 7 For a schematic diagram of a device structure for updating a malicious IP address database provided in an embodiment of the present application, please refer to Figure 7 , the device comprises:

[0200] The processing module 701 is used to parse the received network flow and obtain the source IP address in the network flow;

[0201] A judgment module 702 is used to judge whether the source IP address is included in the malicious IP address database stored locally;

[0202] The transceiver module 703 is used to send the source IP address to the cloud device and receive the feedback result of the cloud device if the judgment result of the judgment module is no;

[0203] The determination module 704 is used to update the source IP address to the malicious IP address library and block access to the network flow if the feedback result indicates that the source IP address exists in the threat intelligence information library stored in the cloud device.

[0204] Further, the determination module 704 is specifically used to determine the hash value of the source IP address;

[0205] The determination module 702 is specifically configured to identify whether the hash value is stored in the first cache library or the second cache library.

[0206] Furthermore, the processing module 701 is specifically configured to add the hash value of the source IP address to the second cache library of the malicious IP address library, and update the number of times the source IP address is checked.

[0207] Furthermore, the determination module 702 is further configured to determine whether the number of IP addresses in the second cache library is equal to a preset value;

[0208] The processing module 701 is further configured to delete the IP address with the smallest frequency in the second cache and its corresponding number of checked times if the number of IP addresses in the second cache is equal to a preset value.

[0209] Furthermore, the judgment module 702 is further configured to judge whether the source IP address corresponding to the hash value has not been checked according to the hit information recorded in the associative array corresponding to the hash value if the first cache library of the malicious IP address library stores the hash value;

[0210] The processing module 701 is further configured to modify the hit information to be checked if the source IP address corresponding to the hash value is not checked, and update the number of times and frequency of the source IP address being checked in the associative array; if the source IP address corresponding to the hash value is checked, update the number of times the source IP address is checked in the associative array;

[0211] The processing module 701 is further configured to update the number of times the source IP address corresponding to the hash value in the second cache library is checked if the second cache library of the malicious IP address library stores the hash value.

[0212] Further, the determination module 704 is further configured to determine the score of each IP address being used according to whether it is checked for the first time, the number of times it is checked, and the frequency recorded in the associative array corresponding to each IP address in the first cache library at a preset time interval; and determine the number of IP addresses with lower scores to be replaced in the first cache library according to the number of IP addresses included in the second cache library;

[0213] The processing module 701 is further configured to replace the replaced IP address and number of times in the first cache library with the IP address and number of times in the second cache library, and update the corresponding frequency and hit information.

[0214] Furthermore, the processing module 701 is further configured to update the hit information recorded in the associative array corresponding to each IP address contained in the first cache library to not being checked.

[0215] Embodiment 10:

[0216] Based on the same application concept, an embodiment of the present application provides an electronic device, which can implement the steps of the malicious IP address database update method discussed above. Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, it includes: a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802, and the memory 803 communicate with each other through the communication bus 804;

[0217] The memory 803 stores a computer program. When the program is executed by the processor 801, the processor 801 performs the following steps:

[0218] Parsing the received network flow to obtain the source IP address in the network flow;

[0219] Determine whether the source IP address is included in the locally stored malicious IP address database;

[0220] If not, the source IP address is sent to the cloud device, and a feedback result from the cloud device is received;

[0221] If the feedback result indicates that the source IP address exists in the threat intelligence information library stored in the cloud device, the source IP address is updated to the malicious IP address library and access to the network flow is blocked.

[0222] Further, the processor 801 is further configured to determine a hash value of the source IP address;

[0223] Identify whether the hash value is stored in the first cache library or the second cache library.

[0224] Furthermore, the processor 801 is further configured to add the hash value of the source IP address to the second cache library of the malicious IP address library, and update the number of times the source IP address is checked.

[0225] Further, the processor 801 is further configured to determine whether the number of IP addresses in the second cache library is equal to a preset value;

[0226] If so, delete the IP address with the lowest frequency in the second cache and its corresponding number of checks.

[0227] Further, the processor 801 is also used for, if the first cache library of the malicious IP address library stores the hash value, judging whether the source IP address corresponding to the hash value has not been checked according to the hit information recorded in the associative array corresponding to the hash value; if so, modifying the hit information to be checked, and updating the number and frequency of the source IP address being checked in the associative array; if not, updating the number of the source IP address being checked in the associative array;

[0228] If the second cache library of the malicious IP address library stores the hash value, the number of times the source IP address corresponding to the hash value in the second cache library is checked is updated.

[0229] Further, the processor 801 is further configured to determine the score of each IP address being used according to whether it is checked for the first time, the number of times it is checked, and the frequency recorded in the associative array corresponding to each IP address in the first cache library at a preset time interval;

[0230] Determine, according to the number of IP addresses included in the second cache library, the number of IP addresses with lower scores in the first cache library to be replaced;

[0231] The replaced IP address and number of times in the first cache are replaced with the IP address and number of times in the second cache, and the corresponding frequency and hit information are updated.

[0232] Furthermore, the processor 801 is further configured to update the hit information recorded in the associative array corresponding to each IP address contained in the first cache library to not being checked.

[0233] Since the principle of solving the problem by the above electronic device is similar to the method of updating the malicious IP address library, the implementation of the above electronic device can refer to the embodiment of the method, and the repeated parts will not be repeated.

[0234] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 802 is used for communication between the above electronic device and other devices. The memory may include a random access memory (RAM) and may also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0235] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0236] Embodiment 11:

[0237] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program is executed on the processor, the processor executes any of the methods for updating a malicious IP address library discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to the method for updating a malicious IP address library, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0238] Because in the embodiment of the present application, the electronic device parses the received network flow, obtains the source IP address in the network flow, and detects whether the source IP address is a malicious IP address through a locally stored malicious IP address library; if the source IP address does not exist in the locally stored malicious IP address library, the source IP address is sent to the cloud device, and the threat intelligence information library stored in the cloud device is used to detect whether the source IP address is a malicious IP address, thereby accurately identifying newly emerging malicious IP addresses.

[0239] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, MO (magneto-optical disks), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, NAND FLASH (non-volatile memory), SSD (solid state drive), etc.

[0240] It should be noted that, in this document, relational terms such as first and second, etc. are merely used to distinguish one entity or one operation from another entity or another operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0241] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete application embodiment, or an embodiment in combination with application and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0242] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0243] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0244] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0245] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0246] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for updating a malicious IP address database, characterized in that: The method comprises: Parsing the received network flow to obtain the source IP address in the network flow; Determine whether the source IP address is included in the locally stored malicious IP address database; If not, the source IP address is sent to the cloud device, and a feedback result from the cloud device is received; If the feedback result indicates that the source IP address exists in the threat intelligence information library stored in the cloud device, the source IP address is updated to the malicious IP address library and access to the network flow is blocked.

2. The method according to claim 1, characterized in that: The malicious IP address library includes a first cache library and a second cache library, and the determining whether the locally stored malicious IP address library includes the source IP address includes: Determining a hash value of the source IP address; Identify whether the hash value is stored in the first cache library or the second cache library.

3. The method according to claim 1 or 2, characterized in that: The updating of the source IP address to the malicious IP address database comprises: The hash value of the source IP address is added to the second cache library of the malicious IP address library, and the number of times the source IP address is checked is updated.

4. The method according to claim 3, characterized in that: Before adding the hash value of the source IP address to the second cache library of the malicious IP address library, the method further comprises: Determine whether the number of IP addresses in the second cache is equal to a preset value; If so, delete the IP address with the lowest frequency in the second cache and its corresponding number of checks.

5. The method according to claim 2, characterized in that: The method further comprises: If the first cache library of the malicious IP address library stores the hash value, determine whether the source IP address corresponding to the hash value has not been checked according to the hit information recorded in the associative array corresponding to the hash value; if so, modify the hit information to be checked, and update the number and frequency of the source IP address being checked in the associative array; if not, update the number of the source IP address being checked in the associative array; If the second cache library of the malicious IP address library stores the hash value, the number of times the source IP address corresponding to the hash value in the second cache library is checked is updated.

6. The method according to claim 5, characterized in that: The method further comprises: Determine the score of each IP address at a preset time interval based on whether it is checked for the first time, the number of times it is checked, and the frequency recorded in the associative array corresponding to each IP address in the first cache; Determine, according to the number of IP addresses included in the second cache library, the number of IP addresses with lower scores in the first cache library to be replaced; The replaced IP address and number of times in the first cache are replaced with the IP address and number of times in the second cache, and the corresponding frequency and hit information are updated.

7. The method according to claim 6, characterized in that: The method further comprises: The hit information recorded in the associative array corresponding to each IP address contained in the first cache is updated to not being checked.

8. A device for updating a malicious IP address database, characterized in that: The device comprises: A processing module, used for parsing the received network flow and obtaining the source IP address in the network flow; A judgment module, used to judge whether the source IP address is included in the malicious IP address library stored locally; A transceiver module, configured to send the source IP address to a cloud device and receive a feedback result from the cloud device if the judgment result of the judgment module is no; A determination module is used to update the source IP address to the malicious IP address library and block access to the network flow if the feedback result indicates that the source IP address exists in the threat intelligence information library stored in the cloud device.

9. An electronic device, characterized in that: The electronic device comprises a processor, and the processor is used to implement the steps of any one of the methods according to claims 1-7 when executing a computer program stored in a memory.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images