Automatic alarm banning method based on Huawei firewall

Abstract

The invention discloses an automatic alarm banning method based on a Huawei firewall, and the method comprises the steps: building an automatic alarm banning platform, and integrating alarm equipment and the Huawei firewall into the platform; creating a security policy group table and a banning record table; when an alarm is found, whether the IP address is a risk IP is judged, if the IP address is the risk IP, the platform calls a Huawei firewall interface to forbid the risk IP, and if the IP address is not the risk IP, the process is ended; and storing the forbidden IP data in a forbidden record table. According to the method, the alarm device and the firewall device are integrated, a set of automatic process of alarm banning is established, after the risk IP of the alarm device is found and the operation and maintenance personnel study and determine that the risk is a real risk, the Huawei firewall can be automatically called to complete banning operation, the attack or the risk can be processed more quickly through the automatic processing mode, and the efficiency is improved. And the processing is more accurate, and human errors are reduced.

Description

Technical Field

[0001] The invention belongs to the technical field of firewalls, and in particular is an automatic alarm blocking method based on a Huawei firewall. Background Art

[0002] Enterprise security operation refers to the process in which an enterprise, in its daily operations, ensures the security of its business and resources, prevents and manages various security risks through a series of measures and methods to protect the security of the enterprise's confidential information, assets and employees, and ensures that the enterprise can continue to operate and quickly restore business to deal with potential security incidents. Among them, the deployment of firewall equipment and alarm equipment is an important means of enterprise security operation. As the first line of defense for security protection in network deployment, firewalls can be flexibly applied to network boundaries, subnet isolation and other locations, such as enterprise network exits, internal subnet isolation of large networks, data center boundaries, etc.; and alarm equipment facilitates enterprises to promptly discover security threats and security risks. The two security products provide strong support for the enterprise's security system.

[0003] Currently, the firewall products purchased by enterprises can provide security protection for enterprises. Operation and maintenance personnel can manually block IP through the firewall, while the alarm device users can timely discover risks and issue warnings for threats, which requires security operation and maintenance personnel to judge and handle. Firewalls and alarm devices have their own responsibilities. Operation and maintenance personnel need to block the discovered risky IPs based on the risky IPs discovered by the alarm device, and then add risky IPs to the firewall and issue blocking security policies to complete the blocking of the discovered risky IPs.

[0004] When the alarm device detects an external risk IP, the operation and maintenance personnel generally need to conduct a judgment. If it is determined to be a risky IP, then the firewall system is operated to issue an instruction to ban the IP, so that the attack can be blocked. Since the firewall and alarm device are two sets of independently installed devices, they generally cannot be processed in conjunction, so the operation and maintenance personnel are required to first discover the risk through the alarm device, and then use the firewall device to block the risk. This series of operations often takes a certain amount of time and requires the operation and maintenance personnel to operate proficiently. The delayed time may pose a greater threat to enterprise security, and there is also the risk of misoperation when the operation and maintenance personnel manually ban the IP. Summary of the invention

[0005] In view of the above problems, the present invention is proposed to provide an automatic alarm blocking method based on Huawei firewall to overcome the above problems or at least partially solve the above problems.

[0006] To achieve the above object, the present invention adopts the following technical solutions:

[0007] An automatic alarm blocking method based on Huawei firewall, the method comprising:

[0008] Establish an automated alarm blocking platform and integrate alarm devices and Huawei firewalls into the platform;

[0009] Create a security policy group table and a ban record table;

[0010] When an alarm is detected, the platform determines whether the IP address is a risky IP. If it is a risky IP, the platform calls the Huawei firewall interface to block the risky IP. If it is not a risky IP, the process ends.

[0011] The banned IP data is stored in the ban record table.

[0012] Optionally, the method further includes:

[0013] By querying the security policy group table, determine whether the number of IP addresses can be placed in the existing security policy group of the Huawei firewall;

[0014] If it can be inserted, perform the following steps:

[0015] Select a security policy group that can accommodate the IP address;

[0016] All IP addresses of the security policy group are retrieved and added with the IP address that is banned this time. After deduplication, a request message for modifying the security policy group is generated, and the firewall security policy group modification interface is called;

[0017] Update security policy table information;

[0018] If it cannot be inserted, perform the following steps:

[0019] Generate a request message for creating a security policy group based on the IP list to be blocked, and call the firewall's new security policy group interface to add a new security policy group named with the policy group identifier;

[0020] Add a new record to the security policy table;

[0021] Call the security policy interface of the newly added firewall for the security policy group to complete the ban operation on all IPs in the security policy group.

[0022] Optionally, when an alarm is detected, first determine whether it is a false alarm. If it is a false alarm, end the process. If it is not a false alarm, start determining whether the IP address is a risky IP.

[0023] Optionally, determining whether an IP address is a risky IP includes:

[0024] Split the IP address by carriage return and line feed, and remove duplicates;

[0025] Determine whether the IP address is a valid IP address. If it is not a valid IP address, an error message will be reported and the process will end.

[0026] Optionally, Huawei firewalls block traffic based on security policy groups. The restrictions on each security policy group include:

[0027] The same security policy group uses the same security policy;

[0028] The number of IP addresses in each security policy group is limited;

[0029] The IP addresses in the same security policy group cannot be repeated.

[0030] Optionally, the method further includes:

[0031] If the operation and maintenance personnel unblock a previously blocked IP address, they need to find the record in the blocking record and unblock it. The processing flow includes:

[0032] Query the ban policy group information to which the IP belongs based on the ban record;

[0033] Query all IP addresses under the blocking policy group according to the queried blocking policy group information;

[0034] Remove the IP to be unblocked, and determine whether the number of remaining blocked IPs is greater than zero. If it is greater than zero, call the firewall to modify the security policy group interface and update the security policy group data table record. If it is equal to zero, call the firewall to delete the security policy group interface, delete the corresponding security policy, and delete the security policy group data table record.

[0035] Delete the ban record in the ban record table.

[0036] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0037] The present invention integrates alarm devices and firewall devices, and establishes an automated process for alarm blocking. After discovering the risky IP of the alarm device, the operation and maintenance personnel can automatically call the Huawei firewall to complete the blocking operation after determining that it is a real risk. The automated disposal method can handle attacks or risks more quickly and more accurately, greatly reducing human errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A flowchart of an automatic alarm blocking method based on a Huawei firewall provided in an embodiment of the present application;

[0039] Figure 2 A process framework diagram of an automatic alarm blocking method based on a Huawei firewall provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0041] See also Figure 1 and Figure 2 This embodiment provides an automatic alarm blocking method based on Huawei firewall, and the method includes the following steps:

[0042] S1. Establish an automated alarm and blocking platform and integrate alarm devices and Huawei firewalls into the platform.

[0043] Huawei firewalls block security policy groups. The restrictions on each security policy group include:

[0044] The same security policy group uses the same security policy.

[0045] The number of IPs in each security policy group is limited. Here, it is assumed that the limit is N. If the number of IPs requested to be blocked is greater than N, a failure will be returned when calling the firewall's new or updated security policy group interface.

[0046] The IP addresses in the same security policy group cannot be repeated.

[0047] S2. Create a security policy group table and a blocking record table.

[0048] To complete the ban according to the above Huawei firewall policy, we create a local data table to record the ban information. First, create a security policy group table to record the security policy groups created by the firewall and the number of IPs that already exist in the security policy groups, and then create a ban record table to record the IPs blocked by these security policy groups and the security policy groups they belong to.

[0049] S3. When an alarm is detected, determine whether the IP address is a risky IP. If it is a risky IP, the platform calls the Huawei firewall interface to block the risky IP. If it is not a risky IP, the process ends.

[0050] When an alarm is found, first determine whether it is a false alarm. If it is a false alarm, end it. If it is not a false alarm, start to determine whether the IP address is a risky IP.

[0051] Determining whether an IP address is a risky IP includes:

[0052] The IP address is split by carriage return and line feed, and duplicates are removed.

[0053] Determine whether the IP address is a valid IP address. If it is not a valid IP address, an error message will be reported and the process will end.

[0054] S4. Check the security policy group table to determine whether the number of IP addresses can be placed in the existing security policy group of the Huawei firewall; that is, whether the number of IP addresses to be blocked this time plus the number of IP addresses already in the security policy group is less than or equal to the specified number N.

[0055] If it can be inserted, perform the following steps:

[0056] Select a security policy group that can accommodate the IP address.

[0057] All IP addresses of the security policy group are retrieved and superimposed with the IP address that is banned this time. After deduplication, a request message for modifying the security policy group is generated, and the firewall security policy group modification interface is called.

[0058] Update security policy table information.

[0059] If it cannot be inserted, perform the following steps:

[0060] Generate a request message for creating a security policy group based on the IP list that needs to be blocked, and call the firewall's new security policy group interface to add a new security policy group named with the policy group identifier.

[0061] Add a new record to the security policy table.

[0062] Call the security policy interface of the newly added firewall for the security policy group to complete the ban operation on all IPs in the security policy group.

[0063] S5. The banned IP data is stored in a ban record table.

[0064] S6. If the operation and maintenance personnel unblock a previously blocked IP address, they need to find the record in the blocking record and unblock it. The processing flow includes:

[0065] Query the ban policy group information to which the IP belongs based on the ban record.

[0066] Query all IP addresses under the blocking policy group based on the queried blocking policy group information.

[0067] Remove the IP to be unblocked and determine whether the remaining number of blocked IPs is greater than zero. If it is greater than zero, call the firewall to modify the security policy group interface and update the security policy group data table record. If it is equal to zero, call the firewall to delete the security policy group interface and delete the corresponding security policy and the security policy group data table record.

[0068] Delete the ban record in the ban record table.

[0069] This embodiment integrates alarm devices and firewall devices, and establishes an automated process for alarm blocking. After discovering the risky IP of the alarm device, the operation and maintenance personnel can automatically call the Huawei firewall to complete the blocking operation after determining that it is a real risk. The automated handling method can handle attacks or risks more quickly and accurately to reduce human errors.

[0070] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. An automatic alarm blocking method based on Huawei firewall, characterized in that: The method comprises: Establish an automated alarm blocking platform and integrate alarm devices and Huawei firewalls into the platform; Create a security policy group table and a ban record table; When an alarm is detected, the platform determines whether the IP address is a risky IP. If it is a risky IP, the platform calls the Huawei firewall interface to block the risky IP. If it is not a risky IP, the process ends. The banned IP data is stored in the ban record table.

2. The automatic alarm blocking method based on Huawei firewall according to claim 1, characterized in that: The method further comprises: By querying the security policy group table, determine whether the number of IP addresses can be placed in the existing security policy group of the Huawei firewall; If it can be inserted, perform the following steps: Select a security policy group that can accommodate the IP address; All IP addresses of the security policy group are retrieved and added with the IP address that is banned this time. After deduplication, a request message for modifying the security policy group is generated, and the firewall security policy group modification interface is called; Update security policy table information; If it cannot be inserted, perform the following steps: Generate a request message for creating a security policy group based on the IP list to be blocked, and call the firewall's new security policy group interface to add a new security policy group named with the policy group identifier; Add a new record to the security policy table; Call the security policy interface of the newly added firewall for the security policy group to complete the ban operation on all IPs in the security policy group.

3. The automatic alarm blocking method based on Huawei firewall according to claim 1, characterized in that: When an alarm is found, first determine whether it is a false alarm. If it is a false alarm, end it. If it is not a false alarm, start to determine whether the IP address is a risky IP.

4. The automatic alarm blocking method based on Huawei firewall according to claim 1, characterized in that: Determining whether an IP address is a risky IP includes: Split the IP address by carriage return and line feed, and remove duplicates; Determine whether the IP address is a valid IP address. If it is not a valid IP address, an error message will be reported and the process will end.

5. The automatic alarm blocking method based on Huawei firewall according to claim 1, characterized in that: Huawei firewalls block security policy groups. The restrictions on each security policy group include: The same security policy group uses the same security policy; The number of IP addresses in each security policy group is limited; The IP addresses in the same security policy group cannot be repeated.

6. The automatic alarm blocking method based on Huawei firewall according to claim 1, characterized in that: The method further comprises: If the operation and maintenance personnel want to unblock a previously blocked IP, they need to find the record in the blocking record and unblock it. The processing flow includes: Query the ban policy group information to which the IP belongs based on the ban record; Query all IP addresses under the blocking policy group according to the queried blocking policy group information; Remove the IP to be unblocked and determine whether the number of remaining blocked IPs is greater than zero. If it is greater than zero, call the firewall to modify the security policy group interface and update the security policy group data table record. If it is equal to zero, call the firewall to delete the security policy group interface and delete the corresponding security policy and the security policy group data table record. Delete the ban record in the ban record table.

Images