Security rule scheduling method and device and electronic equipment
By calculating the target score of security rules and optimizing their scheduling order, the problem that traditional methods cannot adapt to the dynamic network environment is solved, the efficiency and accuracy of security rules detection are improved, and the position and flow control in the rule chain are optimized.
Patent Information
- Application Number
- CN202411311179.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-19
- Publication Date
- 2024-12-31
AI Technical Summary
The traditional static security rule scheduling method cannot adapt to the dynamically changing network environment, resulting in poor detection efficiency and effectiveness, especially after the security rule is updated, the optimal rule cannot be selected reasonably, and the first match stop strategy causes subsequent rules to no longer match, which affects Detection effect.
By obtaining the network feature parameter set of each security rule in the target cycle, calculating the target score of each rule, obtaining the security rule scheduling set based on the score, and scheduling the security rules in the rule chain in sequence according to priority, optimizing the location and traffic control in the rule chain , improve detection efficiency and accuracy.
It improves the detection efficiency and accuracy of security rules, can be closer to current needs, reasonably set rules priority, optimize detection effects, and reduce false positives.
Smart Images
Figure CN119232448A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a security rule scheduling method, device and electronic device. Background Art
[0002] As one of the common means of intranet defense, firewalls can detect data packets passing through them according to a set of preset security rules to prevent illegal or unsafe data from invading the network.
[0003] In the related art, the traditional static security rule scheduling method is usually unable to adapt to the dynamically changing network environment. Specifically, for example, the AB test method is used to test the different versions of the currently existing security rules, and then the security rules with the best performance are selected based on the test results. With this method, when the security rules are updated, they need to be fully recorded and tested. When the rule base is large, it is impossible to reasonably select the optimal security rules; for another example, the first match stop strategy is used to schedule security rules. After the data packet successfully matches the first security rule and triggers an alarm event, the subsequent security rules will no longer match the data packet. This method requires a reasonable design of the position of different security rules in the rule chain, thus resulting in poor detection effect.
[0004] In view of this, there is an urgent need for a method to improve the detection efficiency and detection effect of security rules. Summary of the invention
[0005] The embodiments of the present application provide a security rule scheduling method, device and electronic device for optimizing security rule scheduling and improving detection efficiency and accuracy.
[0006] In a first aspect, the present application provides a security rule scheduling method, the method comprising:
[0007] Obtaining the network feature parameter sets corresponding to each security rule in the target period respectively; wherein each network feature parameter set includes at least: the number of alarm events, the number of false alarm events, the number of security rule calls and the total response time;
[0008] Calculate the target rule score corresponding to each target security rule based on each network feature parameter set;
[0009] Based on the scores of each target rule, a security rule scheduling set is obtained;
[0010] Based on the respective priorities of the security rules in the security rule scheduling set, the security rules in the security rule scheduling set are scheduled in sequence; wherein the calling priority is associated with the target rule score.
[0011] Through the above method, based on the priority of each security rule, each security rule is scheduled in turn, which can effectively improve the detection efficiency and accuracy of the security rules.
[0012] In an optional implementation, the calculating the target rule score corresponding to each target security rule according to each network feature parameter set includes:
[0013] For each security rule, do the following:
[0014] Based on the number of alarm events and false alarm events, the accuracy score of the target security rule is obtained; based on the number of calls and the target cycle, the execution frequency of the target security rule is obtained; and based on the total response time and the number of security rule calls, the average response time of the target security rule is obtained;
[0015] Obtain a target rule score based on accuracy score, execution frequency, and average response time.
[0016] Through the above method, the rule score corresponding to the target security rule can be accurately obtained, so that when scheduling security rules, it can be closer to the current actual needs, thereby improving the detection accuracy.
[0017] In an optional embodiment, the security rule scheduling set includes at least one of a first type of security rule, a second type of security rule, a third type of security rule, and a fourth type of security rule; wherein the first type of security rule has a higher priority than the second type of security rule, the second type of security rule has a higher priority than the third type of security rule, and the third type of security rule has a higher priority than the fourth type of security rule.
[0018] Through the above method, the scheduling priority is set for different types of security rules, which can optimize the scheduling order of security rules and optimize traffic control, thereby improving detection efficiency.
[0019] In an optional embodiment, the target security rule score corresponding to the first type of security rule is greater than the first preset threshold, the target security rule score corresponding to the second type of security rule is less than or equal to the first preset threshold and greater than the second preset threshold, the target security rule score corresponding to the third type of security rule is less than or equal to the second preset threshold and greater than the third preset threshold, the target security rule score corresponding to the fourth type of security rule is greater than or equal to the third preset threshold, the first preset threshold is greater than the second preset threshold, and the second preset threshold is greater than the third preset threshold.
[0020] Through the above method, different security rules can be divided into scheduling priorities, thereby improving detection efficiency and accuracy.
[0021] In a second aspect, the present application provides a security rule scheduling device, the device comprising:
[0022] The acquisition module is used to respectively acquire the network feature parameter sets corresponding to each security rule within the target period; wherein each network feature parameter set includes at least: the number of alarm events, the number of false alarm events, the number of security rule calls, and the total response time;
[0023] A calculation module, used to calculate the target rule score corresponding to each target security rule according to each network feature parameter set;
[0024] A processing module, used to obtain a set of security rule scheduling orders based on the scores of each target rule;
[0025] The scheduling module is used to prioritize each security rule in the security rule scheduling sequence set, and schedule each security rule in the security rule calling sequence set in sequence; wherein the calling priority is associated with the target rule score.
[0026] In an optional implementation, when calculating the target rule score corresponding to each target security rule according to each network feature parameter set, the calculation module is specifically used to:
[0027] Obtaining an accuracy score based on the number of alarm events and the number of false alarm events, obtaining an execution frequency of a target security rule based on the number of calls and the target cycle, and obtaining an average response time of the target security rule based on the total response time and the number of security rule calls;
[0028] Get a targeted security rule score based on accuracy score, execution frequency, and average response time.
[0029] In an optional embodiment, the security rule scheduling set includes at least one of a first type of security rule, a second type of security rule, a third type of security rule, and a fourth type of security rule; wherein the calling priority of the first type of security rule is higher than that of the second type of security rule, the calling priority of the second type of security rule is higher than that of the third type of security rule, and the calling priority of the third type of security rule is higher than that of the fourth type of security rule.
[0030] In an optional embodiment, the target security rule score corresponding to the first type of security rule is greater than the first preset threshold, the target security rule score corresponding to the second type of security rule is less than or equal to the first preset threshold and greater than the second preset threshold, the target security rule score corresponding to the third type of security rule is less than or equal to the second preset threshold and greater than the third preset threshold, the target security rule score corresponding to the fourth type of security rule is greater than or equal to the third preset threshold, the first preset threshold is greater than the second preset threshold, and the second preset threshold is greater than the third preset threshold.
[0031] In a third aspect, the present application provides an electronic device comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the security rule scheduling method described in the first aspect above.
[0032] In a fourth aspect, the present application provides a computer-readable storage medium comprising a program code. When the program code is executed on an electronic device, the program code is used to enable the electronic device to execute the steps of the security rule scheduling method described in the first aspect above.
[0033] In a fifth aspect, the present application provides a computer program product, which, when called by a computer, enables the computer to execute the steps of the security rule scheduling method as described in the first aspect.
[0034] In addition, other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:
[0036] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;
[0037] Figure 2 A schematic diagram of an implementation flow of a security rule scheduling method provided in an embodiment of the present application;
[0038] Figure 3 A schematic diagram of the structure of a security rule scheduling device provided in an embodiment of the present application;
[0039] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0040] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.
[0041] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. A and B are connected, which can represent two situations: A and B are directly connected and A and B are connected through C. In addition, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.
[0042] In addition, the collection, dissemination, and use of data in the technical solution of this application comply with the requirements of relevant national laws and regulations.
[0043] The following is a brief introduction to the design concept of the embodiment of the present application:
[0044] As one of the common means of intranet defense, firewalls can detect data packets passing through them according to a set of preset security rules to prevent illegal or unsafe data from invading the network.
[0045] In the related art, the traditional static security rule scheduling method is usually unable to adapt to the dynamically changing network environment. Specifically, for example, the AB test method is used to test the different versions of the currently existing security rules, and then the security rules with the best performance are selected based on the test results. With this method, when the security rules are updated, they need to be fully recorded and tested. When the rule base is large, it is impossible to reasonably select the optimal security rules; for example, the first match stop strategy is used to schedule security rules. After the data packet successfully matches the first security rule and triggers an alarm event, the subsequent security rules will no longer match the data packet. This method requires a reasonable design of the position of different security rules in the rule chain, thus resulting in poor detection effect.
[0046] In view of this, an embodiment of the present application provides a security rule scheduling method, which includes: first, respectively obtaining the network feature parameter sets corresponding to each security rule within the target period; wherein each network feature parameter set includes at least: the number of alarm events, the number of false alarm events, the number of security rule calls, and the total response time; then, respectively calculating the target rule scores corresponding to each target security rule according to each network feature parameter set; further, obtaining a security rule scheduling set based on each target rule score; finally, scheduling each target security rule in the security rule scheduling set in sequence based on the priority of each security rule in the security rule scheduling set. Through the above method, the rule score corresponding to each security rule is calculated using parameters such as the number of alarm events, so that the priority order of the security rules in the rule chain can be reasonably set, security rules of different levels can be set, and the data can be detected in sequence, which can improve the detection efficiency and accuracy.
[0047] The following describes a security rule scheduling method provided by an exemplary embodiment of the present application with reference to the accompanying drawings.
[0048] See also Figure 1 , which is a schematic diagram of a possible application scenario in an embodiment of the present application. The application scenario diagram includes a server 11 and a terminal device 12 (including a terminal device 121, a terminal device 122 ... a terminal device 12n).
[0049] The server 11 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The terminal device 12 may be directly or indirectly connected to the server 11 via wired or wireless communication, which is not limited in this application.
[0050] The terminal device 120 includes but is not limited to mobile phones, tablet computers, laptop computers, desktop computers, electronic reading books, intelligent voice interaction devices, smart home appliances, car terminals and other devices; various software can be installed on the terminal device, such as applications and applets.
[0051] It should be noted that Figure 1 The figure is only an example. In fact, the number of terminal devices 12 and servers 11 is not limited and is not specifically limited in the embodiments of the present application.
[0052] See also Figure 2As shown, it is a schematic diagram of an implementation process of a security rule scheduling method provided in an embodiment of the present application. The specific implementation process of the method is as follows:
[0053] S1: Obtain the network feature parameter sets corresponding to each security rule within the target period respectively.
[0054] In an embodiment of the present application, the network characteristic parameter set includes at least: the number of alarm events, the number of false alarm events, the number of security rule calls, and the total response time.
[0055] The number of alarm events is the number of alarm events triggered by data collected from various data sources (e.g., databases, log files, network requests) that need to be monitored and matched with security rules. For example, the number of alarm events generated by security rule A is 20.
[0056] The number of false positive events is the number of times some normal data are mistakenly identified as abnormal situations.
[0057] The number of security rule calls is the frequency or number of times the system or application calls the security rule within a period.
[0058] The total response time is the total time it takes for a security rule to be executed multiple times and return results within a cycle. For example, if the first execution and return time of security rule A is 10 seconds, and the second execution and return time is 8 seconds, the total response time of the two times is 18 seconds.
[0059] Further, in an embodiment of the present application, the number of alarm events and the number of false alarm times generated within the target period can be obtained through the intrusion detection system. The number of security rule calls within the target period can be obtained through the firewall log. Network traffic analysis tools, such as probes, can be used to obtain the total response time of security rules within the target period. It should be noted that the target period can be set according to actual needs. For example, the target period can be set to the historical seven days, so as to obtain the number of alarm events, false alarm times, number of security rule calls and total response time corresponding to the security rules within the historical seven days.
[0060] Usually in actual application, in order to achieve comprehensive processing of data and better discover security threats, different numbers of security rules are configured according to actual needs when configuring the security rule base.
[0061] Therefore, when obtaining the network feature parameter set corresponding to the security rule, it is necessary to obtain the network feature parameter set corresponding to each security rule, that is, to obtain the number of alarm events, number of false alarm events, number of security rule scheduling times and total response time of each security rule within the target period.
[0062] S2: Calculate the target rule score corresponding to each target security rule based on each network feature parameter set.
[0063] In an optional implementation, after obtaining the network feature parameter set corresponding to each security rule, the target rule score corresponding to each security rule can be calculated.
[0064] Specifically, in an embodiment of the present application, the accuracy score of the target security rule can be calculated based on the number of alarm events and the number of false alarm events, the execution frequency of the target security rule can be calculated based on the number of security rule calls and the target cycle, and the average response time of the target security rule can be calculated based on the total response time and the number of security rule calls.
[0065] In the embodiment of the present application, the accuracy score, execution frequency, and average response time corresponding to the target security rule can be calculated according to the following formulas:
[0066]
[0067] Among them, Acc represents the accuracy score, Fre represents the execution frequency, and Res_time represents the average response time.
[0068] In the embodiment of the present application, when calculating the accuracy score of the target security rule, if the number of false alarm events corresponding to the target security rule is relatively high, simple linear weighting may over-amplify the negative impact of the target security rule. Therefore, a logarithmic function is used when calculating the accuracy score corresponding to the target security rule. The logarithmic function can smooth extreme values to avoid distortion of the accuracy score due to individual extreme cases.
[0069] Furthermore, after obtaining the accuracy score, execution frequency and average response time corresponding to the target security rule, the target rule score corresponding to the target security rule is calculated based on the accuracy score, execution frequency and average response time corresponding to the target security rule.
[0070] Specifically, in the embodiment of the present application, the target rule score corresponding to the target security rule can be calculated using the following formula:
[0071] score=w1*Acc+w2*Fre+w3*Res_time;
[0072] Among them, score represents the target rule score, w1 is the weight corresponding to the accuracy score, w2 is the weight corresponding to the execution frequency, and w3 is the weight corresponding to the average response time.
[0073] In the embodiment of the present application, each weight can be configured according to the actual application scenario and requirements.
[0074] For example, in some applications with high precision requirements, a higher accuracy rate is required, so a higher weight needs to be set for the accuracy score.
[0075] For example, the weight w1 of the accuracy score is set to 0.6, the weight w2 of the execution frequency is set to 0.2, and the weight w3 of the average response time is set to 0.2.
[0076] In some applications with high real-time requirements, the response time of security rules needs to be faster, so a higher weight needs to be set for the average response time.
[0077] For example, the weight w1 of the accuracy score is set to 0.3, the weight w2 of the execution frequency is set to 0.2, and the weight w3 of the average response time is set to 0.5.
[0078] In some resource-constrained applications, it is necessary to balance accuracy and execution efficiency. For example, the weight w1 of the accuracy score can be set to 0.4, the weight w2 of the execution frequency can be set to 0.4, and the weight w3 of the average response time can be set to 0.2.
[0079] It should be noted that the numerical settings of the above weights are only examples. In specific application scenarios, the above weights can be specifically set according to actual needs, and the embodiments of the present application are not limited here.
[0080] Through the above method, according to the accuracy, response speed and execution efficiency requirements of the security rules, when calculating the target rule score corresponding to the target security rule, different weights are set for the accuracy score, average response time and execution frequency, which can highlight the rule score of the target security rule under different requirements in different application scenarios.
[0081] S3: Based on the scores of each target rule, a security rule scheduling set is obtained.
[0082] In an embodiment of the present application, after obtaining the target rule scores corresponding to each target security rule, each target security rule is classified.
[0083] Based on the score of each target security rule, the target security rules are classified according to different threshold intervals to obtain a security rule scheduling set.
[0084] After the security rule types are divided according to the target security rule scores, the security rule scheduling set includes at least one of the first type of security rules, the second type of security rules, the third type of security rules, and the fourth type of security rules.
[0085] Specifically, a target security rule whose target security rule score is greater than the first preset threshold is determined as a first type of security rule, a target security rule whose target security rule score is less than or equal to the first preset threshold and greater than the second preset threshold is determined as a second type of security rule, a target security rule whose target rule score is less than or equal to the second preset threshold and greater than the third preset threshold is determined as a third type of security rule, and a target security rule whose target rule score is greater than or equal to the third preset threshold is determined as a fourth type of security rule. That is, in the embodiment of the present application, the first preset threshold is greater than the second preset threshold and greater than the third preset threshold, that is, the first preset threshold>the second preset threshold>the third preset threshold.
[0086] For example, the first preset threshold value may be set to 90, the second preset threshold value may be set to 80, and the third preset threshold value may be set to 70. For example, if the target rule score corresponding to security rule A is 95, which is greater than the first preset threshold value, then security rule A is a first type security rule; if the target rule score corresponding to security rule B is 85, which is less than the first preset threshold value and greater than the second preset threshold value, then security rule B is a second type security rule.
[0087] It is worth noting that in the embodiment of the present application, the calling priority corresponding to the first type of security rule is higher than the calling priority corresponding to the second type of security rule, the calling priority corresponding to the second type of security rule is higher than the calling priority corresponding to the third type of security rule, and the calling priority corresponding to the third type of security rule is higher than the calling priority corresponding to the fourth type of security rule. In other words, the calling priority of the first type of security rule is the highest, and the calling priority of the fourth type of security rule is the lowest.
[0088] In the embodiment of the present application, if the fourth type of security rule exists, the fourth type of security rule is stopped from being used and is set to be disabled. When external data is received, the fourth type of security rule does not need to be used for processing.
[0089] In addition, in the embodiment of the present application, a corresponding period may be set, and the target rule score of each security rule may be calculated again every corresponding period, thereby updating the security rule scheduling set.
[0090] For example, the target rule scores corresponding to each security rule are recalculated every 30 minutes to obtain an updated security rule scheduling set. In other words, security rule A corresponds to the first type of security rule in this calculation, and corresponds to the fourth type of security rule in the result of the recalculation after 30 minutes. This means that the call priority corresponding to security rule A has changed in real-time dynamic changes, and it can more effectively implement detection according to the current specific situation, improve detection efficiency and reduce false alarms.
[0091] S4: Based on the calling priority of each security rule in the security rule scheduling set, schedule each target security rule in the security rule scheduling set in turn.
[0092] It should be noted that, in the embodiment of the present application, the scheduling priority of the security rule is associated with the target rule score.
[0093] In an embodiment of the present application, after obtaining a security rule scheduling set based on the security rule scores corresponding to each security rule, when external data needs to be processed, each target security rule can be scheduled in sequence according to the calling priority of each security rule in the security rule scheduling set.
[0094] Specifically, for example, the security rule set includes security rule A, security rule B, security rule C and security rule D, security rule A is a first type of security rule, security rule B is a second type of security rule, security rule C is a third type of security rule, and security rule D is a fourth type of security rule. Further, security rule A is used to process the entire traffic, and the input traffic can be 100% at this time. Then, security rule B is used to process the entire traffic, and the input traffic can be 100% at this time. Although the traffic processed by security rule A and security rule B is 100%, the calling priority of security rule A is higher than the calling priority of security rule B. Therefore, security rule A is first used to process the entire traffic, and then security rule B is used to process the entire traffic. Further, security rule C of the third type of security rule is used to process the input traffic. At this time, the traffic input can be set to 40%, 60%, etc. according to the actual situation. Since the fourth type of security rule is in a disabled state, the input traffic is no longer processed by the fourth type of security rule after being processed by the first type of security rule, the second type of security rule, and the third type of security rule.
[0095] Further, based on the same technical concept, the embodiment of the present application provides a security rule scheduling device, which is used to implement the above method flow of the embodiment of the present application. Figure 3 As shown, the device includes: an acquisition module 301, a calculation module 302, a processing module 303 and a scheduling module 304, wherein:
[0096] The acquisition module 301 is used to respectively acquire the network characteristic parameter sets corresponding to each security rule within the target period; wherein each network characteristic parameter set includes at least: the number of alarm events, the number of false alarm events, the number of security rule calls, and the total response time;
[0097] A calculation module 302 is used to calculate the target rule score corresponding to each target security rule according to each network feature parameter set;
[0098] Processing module 303, used to obtain a security rule scheduling order set based on the scores of each target rule;
[0099] The scheduling module 304 is used to prioritize each security rule in the security rule scheduling sequence set, and schedule each security rule in the security rule calling sequence set in sequence; wherein the calling priority is associated with the target rule score.
[0100] In an optional implementation, when calculating the target rule score corresponding to each target security rule according to each network feature parameter set, the calculation module 303 is specifically used to:
[0101] Obtaining an accuracy score based on the number of alarm events and the number of false alarm events, obtaining an execution frequency of a target security rule based on the number of calls and the target cycle, and obtaining an average response time of the target security rule based on the total response time and the number of security rule calls;
[0102] Get a targeted security rule score based on accuracy score, execution frequency, and average response time.
[0103] In an optional embodiment, the security rule scheduling set includes at least one of a first type of security rule, a second type of security rule, a third type of security rule, and a fourth type of security rule; wherein the calling priority of the first type of security rule is higher than that of the second type of security rule, the calling priority of the second type of security rule is higher than that of the third type of security rule, and the calling priority of the third type of security rule is higher than that of the fourth type of security rule.
[0104] In an optional embodiment, the target security rule score corresponding to the first type of security rule is greater than the first preset threshold, the target security rule score corresponding to the second type of security rule is less than or equal to the first preset threshold and greater than the second preset threshold, the target security rule score corresponding to the third type of security rule is less than or equal to the second preset threshold and greater than the third preset threshold, the target security rule score corresponding to the fourth type of security rule is greater than or equal to the third preset threshold, the first preset threshold is greater than the second preset threshold, and the second preset threshold is greater than the third preset threshold.
[0105] Based on the same technical concept, the embodiment of the present application also provides an electronic device, which can implement the security rule scheduling method provided in the above embodiment of the present application. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 4 As shown, the electronic device may include:
[0106] At least one processor 401, and a memory 402 connected to the at least one processor 401. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiment of the present application. Figure 4 In the example, the processor 401 and the memory 402 are connected via the bus 300. The bus 400 is Figure 4 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 400 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 401 can also be called a controller, and there is no limitation on the name.
[0107] In the embodiment of the present application, the memory 402 stores instructions that can be executed by at least one processor 401. The at least one processor 401 can execute a security rule scheduling method discussed above by executing the instructions stored in the memory 402. The processor 401 can implement Figure 3 The functions of each module in the device shown.
[0108] Among them, the processor 401 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 402 and calling the data stored in the memory 402, the various functions of the device and process data, the device can be monitored as a whole.
[0109] In one possible design, the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 401. In some embodiments, the processor 401 and the memory 402 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.
[0110] Processor 401 may be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of a security rule scheduling method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.
[0111] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 402 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0112] By programming the processor 401, the code corresponding to the frequency offset estimation method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1 The steps of a security rule scheduling method of the embodiment shown are as follows: How to design and program the processor 401 is a technique known to those skilled in the art and will not be described in detail here.
[0113] Based on the same inventive concept, an embodiment of the present application also provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a security rule scheduling method discussed above.
[0114] In some possible implementations, the present application also provides various aspects of a security rule scheduling method that can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a security rule scheduling method according to various exemplary implementations of the present application described above in this specification.
[0115] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.
[0116] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.
[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0118] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0119] Program code for performing the operations of the present application may be written using any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.
[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0121] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A security rule scheduling method, characterized in that: The method comprises: Respectively obtain the network feature parameter sets corresponding to each security rule within the target period; wherein each of the network feature parameter sets includes at least: the number of alarm events, the number of false alarm events, the number of security rule calls, and the total response time; Calculate the target rule score corresponding to each target security rule based on each network feature parameter set; Based on the scores of each target rule, a security rule scheduling set is obtained; Based on the calling priority of each of the security rules in the security rule scheduling set, each of the target security rules in the security rule scheduling set is scheduled in sequence; wherein the calling priority is associated with the target rule score.
2. The method according to claim 1, characterized in that The step of calculating the target rule score corresponding to each target security rule according to each network feature parameter set includes: Based on the number of alarm events and the number of false alarm events, the accuracy score of the target security rule is obtained, and based on the number of security rule calls and the target cycle, the execution frequency of the target security rule is obtained, and based on the total response time and the number of security rule calls, the average response time of the target security rule is obtained; The target rule score is obtained based on the accuracy score, the execution frequency, and the average response time.
3. The method according to claim 1, characterized in that The security rule scheduling set includes at least one of a first type of security rule, a second type of security rule, a third type of security rule, and a fourth type of security rule; wherein the calling priority of the first type of security rule is higher than that of the second type of security rule, the calling priority of the second type of security rule is higher than that of the third type of security rule, and the calling priority of the third type of security rule is higher than that of the fourth type of security rule.
4. The method according to claim 3, characterized in that The target security rule score corresponding to the first type of security rule is greater than a first preset threshold, the target security rule score corresponding to the second type of security rule is less than or equal to the first preset threshold and greater than the second preset threshold, the target security rule score corresponding to the third type of security rule is less than or equal to the second preset threshold and greater than the third preset threshold, the target security rule score corresponding to the fourth type of security rule is greater than or equal to the third preset threshold, the first preset threshold is greater than the second preset threshold, and the second preset threshold is greater than the third preset threshold.
5. A security rule scheduling device, characterized in that: The device comprises: An acquisition module is used to respectively acquire the network feature parameter sets corresponding to each security rule within the target period; wherein each of the network feature parameter sets includes at least: the number of alarm events, the number of false alarm events, the number of security rule calls, and the total response time; A calculation module, used to calculate the target rule score corresponding to each target security rule according to each network feature parameter set; A processing module, configured to obtain a security rule scheduling order set based on the scores of each target rule; A scheduling module is used to prioritize each security rule in the security rule scheduling sequence set, and schedule each security rule in the security rule calling sequence set in sequence; wherein the scheduling priority is associated with the target rule score.
6. The device according to claim 5, characterized in that When calculating the target rule score corresponding to each target security rule according to each network feature parameter set, the calculation module is specifically used to: Obtaining an accuracy score based on the number of alarm events and the number of false alarm events, obtaining an execution frequency of a target security rule based on the number of calls and the target cycle, and obtaining an average response time of the target security rule based on the total response time and the number of calls of the security rule; The target security rule score is obtained based on the accuracy score, the execution frequency, and the average response time.
7. The device according to claim 5, characterized in that The security rule scheduling set includes at least one of a first type of security rule, a second type of security rule, a third type of security rule, and a fourth type of security rule; wherein the calling priority of the first type of security rule is higher than that of the second type of security rule, the calling priority of the second type of security rule is higher than that of the third type of security rule, and the calling priority of the third type of security rule is higher than that of the fourth type of security rule.
8. The device according to claim 7, characterized in that The target security rule score corresponding to the first type of security rule is greater than a first preset threshold, the target security rule score corresponding to the second type of security rule is less than or equal to the first preset threshold and greater than the second preset threshold, the target security rule score corresponding to the third type of security rule is less than or equal to the second preset threshold and greater than the third preset threshold, the target security rule score corresponding to the fourth type of security rule is greater than or equal to the third preset threshold, the first preset threshold is greater than the second preset threshold, and the second preset threshold is greater than the third preset threshold.
9. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.