Traffic threat identification method and device, electronic equipment and storage medium

Abstract

The invention provides a traffic threat identification method and device, electronic equipment and a storage medium, and belongs to the technical field of computer security. The method comprises the following steps: creating a threat identification hash table; the threat identification hash table comprises a keyword of the message and a threat identification result of the message; acquiring a real-time message, and acquiring a real-time keyword of the real-time message; and traversing the threat identification hash table, and taking a threat identification result corresponding to a keyword as a real-time threat identification result when the keyword which is the same as the real-time keyword exists in the threat identification hash table. According to the method, the real-time threat identification result can be determined only by querying the keywords which are the same as the real-time keywords of the real-time messages in the threat identification hash table, and the traffic threat identification efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a flow threat identification method, device, electronic device and storage medium. Background Art

[0002] While the Internet has brought great changes and development to society, it has also suffered very severe security threats. The security of network and application vulnerabilities has become an important factor restricting the development of the Internet and affecting social development. In order to improve network security, firewall equipment came into being.

[0003] Existing firewall devices usually need to use a third-party cloud platform when performing traffic threat identification. This method requires saving message-related information locally, sending asynchronous threat identification query requests to the cloud platform, and waiting for the cloud platform to return the results. The identification is slow and occupies a lot of memory.

[0004] Therefore, there is an urgent need to provide a traffic threat identification method, device, electronic device and storage medium to improve the efficiency of traffic threat identification. Summary of the invention

[0005] In view of this, it is necessary to provide a traffic threat identification method, device, electronic device and storage medium to solve the technical problem in the prior art that a large amount of message information needs to be cached and asynchronously identified, resulting in low efficiency in identifying traffic threats.

[0006] On the one hand, in order to solve the above technical problems, the present invention provides a traffic threat identification method, comprising: Creating a threat identification hash table; the threat identification hash table includes keywords of the message and threat identification results of the message; Obtaining a real-time message and obtaining a real-time keyword of the real-time message; The threat identification hash table is traversed, and when a keyword identical to the real-time keyword exists in the threat identification hash table, a threat identification result corresponding to the keyword is used as a real-time threat identification result.

[0007] In a possible implementation, the keywords include domain names, Internet Protocol addresses, and md5 values ​​of message file contents, and the threat identification hash table includes a domain name hash table, an Internet Protocol address hash table, and an md5 hash table.

[0008] In a possible implementation, the real-time keyword includes a real-time domain name, a real-time Internet Protocol address, and a real-time MD5 value; then traversing the threat identification hash table, when there is a keyword identical to the real-time keyword in the threat identification hash table, taking the threat identification result corresponding to the keyword as the real-time threat identification result, includes: Traversing the domain name hash table to determine whether there is a domain name identical to the real-time domain name in the domain name hash table; If there is a domain name identical to the real-time domain name in the domain name hash table, taking the threat identification result corresponding to the domain name as the real-time threat identification result; If the domain name hash table does not contain a domain name identical to the real-time domain name, traverse the Internet Protocol address hash table to determine whether the Internet Protocol address hash table contains an Internet Protocol address identical to the real-time Internet Protocol address; If there is an Internet Protocol address identical to the real-time Internet Protocol address in the Internet Protocol address hash table, taking the threat identification result corresponding to the Internet Protocol address as the real-time threat identification result; If there is no internet protocol address identical to the real-time internet protocol address in the internet protocol address hash table, determining whether there is an md5 value identical to the real-time md5 value in the md5 hash table; If there is an md5 value identical to the real-time md5 value in the md5 hash table, the threat identification result corresponding to the md5 value is used as the real-time threat identification result.

[0009] In a possible implementation, the method further includes: When there is no keyword corresponding to the real-time keyword in the threat identification hash table, transmitting the real-time message to the cloud platform, and receiving a cloud platform threat identification result from the cloud platform; The cloud platform threat identification result is added to the threat identification hash table.

[0010] In a possible implementation manner, transmitting the real-time message to a cloud platform includes: Calling the platform interface of the cloud platform; Determining whether the real-time keyword is a keyword of interest for threat identification; When the keyword is a keyword of interest for threat identification, adding the real-time message to a FIFO queue; The real-time message in the FIFO queue is retrieved based on a preset retrieval time point and sent to the cloud platform.

[0011] In a possible implementation, the method further includes: Obtaining the creation time of each entry in the threat identification hash table; When the creation time is longer than the preset time, the entry is deleted.

[0012] In a possible implementation, the method further includes: A threat identification log is generated based on the real-time threat identification result.

[0013] On the other hand, the present invention also provides a traffic threat identification device, comprising: A threat identification hash table creation unit, used to create a threat identification hash table; the threat identification hash table includes a keyword of the message and a threat identification result of the message; A real-time message acquisition unit, used to acquire a real-time message and acquire a real-time keyword of the real-time message; The threat identification unit is used to traverse the threat identification hash table, and when there is a keyword identical to the real-time keyword in the threat identification hash table, use the threat identification result corresponding to the keyword as the real-time threat identification result.

[0014] On the other hand, the present invention also provides an electronic device, including a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the traffic threat identification method described in any one of the possible implementations above.

[0015] On the other hand, the present invention also provides a computer-readable storage medium for storing a computer-readable program or instruction, which, when executed by a processor, can implement the steps of the traffic threat identification method described in any of the above possible implementations.

[0016] The beneficial effects of the present invention are as follows: the traffic threat identification method provided by the present invention, by creating a threat identification hash table, only needs to query the threat identification hash table for the keyword that is the same as the real-time keyword of the real-time message to determine the real-time threat identification result when performing traffic threat identification. There is no need to cache a large number of real-time messages locally, thus avoiding memory usage. Moreover, compared with the asynchronous query method on the cloud platform, the local table lookup method is faster, thereby improving the efficiency of traffic threat identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flow chart of an embodiment of the method for identifying traffic threats provided by the present invention; Figure 2 For the present invention Figure 1A schematic flow chart of an embodiment of S104; Figure 3 A schematic diagram of a flow chart of an embodiment of realizing traffic threat identification based on a cloud platform provided by the present invention; Figure 4 A schematic diagram of an embodiment of the present invention for transmitting a real-time message to a cloud platform; Figure 5 A schematic flow chart of an embodiment of deleting a timeout entry in a threat identification hash table provided by the present invention; Figure 6 A schematic diagram of the structure of an embodiment of a flow threat identification device provided by the present invention; Figure 7 A schematic structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0020] It should be understood that the schematic drawings are not drawn to scale. The flowchart used in the present invention shows the operations implemented according to some embodiments of the present invention. It should be understood that the operations of the flowchart can be implemented out of order, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art, under the guidance of the content of the present invention, can add one or more other operations to the flowchart, and can also remove one or more operations from the flowchart. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor systems and / or microcontroller systems.

[0021] Reference to an "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0022] The present invention provides a traffic threat identification method, device, electronic device and storage medium, which are described below respectively.

[0023] Figure 1 A flow chart of an embodiment of the method for identifying traffic threats provided by the present invention is shown as follows: Figure 1 As shown, the traffic threat identification method includes: S101, creating a threat identification hash table; the threat identification hash table includes keywords of the message and threat identification results of the message; S102, obtaining a real-time message, and obtaining a real-time keyword of the real-time message; S103, traversing the threat identification hash table, when there is a keyword identical to the real-time keyword in the threat identification hash table, taking the threat identification result corresponding to the keyword as the real-time threat identification result.

[0024] It should be noted that the threat identification hash table in step S101 is created by obtaining multiple threat identification results based on cloud platform identification, creating a threat identification hash table with the multiple threat identification results and their corresponding keywords, and storing it locally.

[0025] Compared with the prior art, the traffic threat identification method provided by the embodiment of the present invention creates a threat identification hash table. When performing traffic threat identification, it is only necessary to query the threat identification hash table for keywords that are the same as the real-time keywords of the real-time message to determine the real-time threat identification result. There is no need to cache a large number of real-time messages locally, thus avoiding memory usage. Moreover, compared with the asynchronous query method on the cloud platform, the local table lookup method is faster, thereby improving the efficiency of traffic threat identification.

[0026] To improve the comprehensiveness and success rate of traffic threat identification, in some embodiments of the present invention, keywords include domain names, Internet Protocol addresses (IP) and md5 values ​​of message file contents, and the threat identification hash table includes a domain name hash table, an Internet Protocol address hash table and an md5 hash table.

[0027] The embodiment of the present invention sets three keywords to represent real-time messages, thereby avoiding the technical problem that traffic threats cannot be fully identified by a single keyword, and improving the comprehensiveness and success rate of traffic threat identification.

[0028] It should be noted that the keyword may also be other parameters besides the domain name, Internet Protocol address and md5 value, and it only needs to be able to represent the real-time message, and will not be described in detail here.

[0029] In some embodiments of the present invention, the real-time keyword includes a real-time domain name, a real-time Internet Protocol address, and a real-time md5 value; Figure 2 As shown, step S103 includes: S201, traverse the domain name hash table to determine whether there is a domain name in the domain name hash table that is the same as the real-time domain name; S202: If there is a domain name identical to the real-time domain name in the domain name hash table, the threat identification result corresponding to the domain name is used as the real-time threat identification result; S203, if there is no domain name identical to the real-time domain name in the domain name hash table, traverse the Internet Protocol address hash table to determine whether there is an Internet Protocol address identical to the real-time Internet Protocol address in the Internet Protocol address hash table; S204. If there is an Internet Protocol address identical to the real-time Internet Protocol address in the Internet Protocol address hash table, the threat identification result corresponding to the Internet Protocol address is used as the real-time threat identification result; S205, if there is no Internet Protocol address identical to the real-time Internet Protocol address in the Internet Protocol address hash table, then determining whether there is an md5 value identical to the real-time md5 value in the md5 hash table; S206: If there is an md5 value in the md5 hash table that is the same as the real-time md5 value, the threat identification result corresponding to the md5 value is used as the real-time threat identification result.

[0030] The above embodiment describes the order of identification in the order of domain name-Internet Protocol address-md5 value. In actual applications, the traversal order of the three threat identification hash tables is not limited to the above order. It is only necessary to traverse and match each threat hash table to ensure the success rate of traffic threat identification.

[0031] Due to the diversity of traffic threat sources, there are situations where real-time messages have keywords that cannot be matched in the threat identification hash table. To achieve traffic threat identification in this situation, in some embodiments of the present invention, such as Figure 3 As shown, the traffic threat identification method also includes: S301, when there is no keyword corresponding to the real-time keyword in the threat identification hash table, transmitting the real-time message to the cloud platform, and receiving the cloud platform threat identification result from the cloud platform; S302: Add the cloud platform threat identification result to the threat identification hash table.

[0032] The embodiment of the present invention achieves comprehensive identification of traffic threats by setting a cloud platform threat identification result based on a cloud platform asynchronous identification method when there is no keyword corresponding to the real-time keyword in the threat identification hash table.

[0033] It should be noted that the embodiment of the present invention adds the cloud platform threat identification results to the threat identification hash table, which can increase the number of keywords in the threat identification hash table, and further ensure the success rate of traffic threat identification through the threat hash table next time, so as to improve the recognition efficiency of the next traffic threat identification.

[0034] In a specific embodiment of the present invention, Figure 4 As shown, the real-time message is transmitted to the cloud platform in step S301, including: S401, calling the platform interface of the cloud platform; S402, determining whether the real-time keyword is a keyword of interest for threat identification; S403, when the keyword is a keyword of interest for threat identification, the real-time message is added to a FIFO queue; S404: retrieve the real-time message in the FIFO queue based on the preset retrieval time point and send it to the cloud platform.

[0035] It should be understood that: when the keyword is not a keyword of interest for threat identification, it means that the real-time message at this time is not a message that needs to be paid attention to by threat identification, and no excessive attention is needed.

[0036] The embodiment of the present invention sets step S402 to determine whether the real-time keyword is a keyword of interest for threat identification, thereby avoiding invalid traffic threat identification and further improving the identification efficiency of traffic threat identification.

[0037] The preset calling time point in step S404 can be realized by a timer task, and the preset calling time point is set by the timer task.

[0038] Among them, the FIFO queue is a first-in-first-out queue. By setting the first-in-first-out queue to process real-time messages, traffic threats can be identified in the order of real-time messages to ensure the orderliness of traffic threat identification.

[0039] Since traffic threats are dynamic and real-time, in order to ensure the accuracy of traffic threat identification, in some embodiments of the present invention, Figure 5 As shown, the traffic threat identification method also includes: S501, obtaining the creation time of each entry in the threat identification hash table; S502: When the creation time is longer than the preset time, the entry is deleted.

[0040] The embodiment of the present invention can ensure the real-time performance of each entry in the threat identification hash table by deleting entries whose creation time is longer than a preset time. Therefore, the real-time performance and accuracy of the real-time threat identification results obtained based on the threat identification hash table with good real-time performance can be ensured.

[0041] In a specific embodiment of the present invention, step S501 and step S502 may be implemented by an aging check timer, and the aging check timer is used to determine and delete entries whose creation duration is greater than a preset duration.

[0042] Specifically, the aging check timer runs once every minute. When the creation time of the entry is greater than a preset time period compared with the current time, the entry can be deleted.

[0043] It should be understood that the preset duration can be set or adjusted according to the actual application scenario, for example: 10 minutes to 30 minutes.

[0044] In a specific embodiment of the present invention, the preset duration is 15 minutes.

[0045] In order to facilitate the subsequent tracing of traffic threats, the identified traffic threats need to be recorded. In a specific embodiment of the present invention, after obtaining the real-time threat identification result, it also includes: Generate threat identification logs based on real-time threat identification results.

[0046] The embodiments of the present invention can facilitate the subsequent tracing of traffic threats by generating threat identification logs, and provide reference and guidance for subsequent software development and maintenance.

[0047] In summary, the traffic threat identification method provided by the embodiment of the present invention caches the threat identification results of the cloud platform locally, establishes and saves a domain name hash table, an Internet Protocol address hash table and an md5 hash table corresponding to the Internet Protocol address, domain name or file md5, and the threat identification of subsequent messages can obtain the detection results by looking up the table, thereby avoiding the memory occupation caused by a large amount of caching of message information and the low efficiency caused by asynchronous query, and improving the identification efficiency.

[0048] In order to better implement the traffic threat identification method in the embodiment of the present invention, based on the traffic threat identification method, the embodiment of the present invention also provides a traffic threat identification device, such as Figure 6 As shown, the traffic threat identification device 600 includes: A threat identification hash table creation unit 601 is used to create a threat identification hash table; the threat identification hash table includes a keyword of a message and a threat identification result of the message; A real-time message acquisition unit 602, used to acquire a real-time message and acquire a real-time keyword of the real-time message; The threat identification unit 603 is used to traverse the threat identification hash table, and when there is a keyword identical to the real-time keyword in the threat identification hash table, use the threat identification result corresponding to the keyword as the real-time threat identification result.

[0049] The traffic threat identification device 600 provided in the above embodiment can implement the technical solution described in the above traffic threat identification method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above traffic threat identification method embodiment, which will not be repeated here.

[0050] like Figure 7 As shown, the present invention also provides an electronic device 700. The electronic device 700 includes a processor 701, a memory 702 and a display 703. Figure 7 Only some components of the electronic device 700 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0051] In some embodiments, the processor 701 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 702, such as the traffic threat identification method of the present invention.

[0052] In some embodiments of the present invention, the processor 701 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, the processor 701 may be local or remote. In some embodiments, the processor 701 may be implemented in a cloud platform. In one embodiment, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.

[0053] In some embodiments, the memory 702 may be an internal storage unit of the electronic device 700, such as a hard disk or memory of the electronic device 700. In other embodiments, the memory 702 may also be an external storage device of the electronic device 700, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 700.

[0054] Furthermore, the memory 702 may include both an internal storage unit of the electronic device 700 and an external storage device. The memory 702 is used to store application software installed in the electronic device 700 and various data.

[0055] In some embodiments, the display 703 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 703 is used to display information of the electronic device 700 and to display a visual user interface. The components 701-703 of the electronic device 700 communicate with each other via a system bus.

[0056] In some embodiments of the present invention, when the processor 701 executes the traffic threat identification program in the memory 702, the following steps may be implemented: Create a threat identification hash table; the threat identification hash table includes keywords of the message and threat identification results of the message; Obtain real-time messages and real-time keywords of the real-time messages; The threat identification hash table is traversed, and when there is a keyword identical to the real-time keyword in the threat identification hash table, the threat identification result corresponding to the keyword is used as the real-time threat identification result.

[0057] It should be understood that: when the processor 701 executes the traffic threat identification program in the memory 702, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.

[0058] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 700 mentioned. The electronic device 700 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices. It should also be understood that in some other embodiments of the present invention, the electronic device 700 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (such as a touch panel).

[0059] Accordingly, an embodiment of the present invention also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, the steps or functions of the traffic threat identification method provided in the above-mentioned method embodiments can be implemented.

[0060] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0061] The above is a detailed introduction to a traffic threat identification method, device, electronic device and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for identifying traffic threats, characterized in that: include: Create a threat identification hash table; The threat identification hash table includes keywords of the message and threat identification results of the message; Obtaining a real-time message and obtaining a real-time keyword of the real-time message; The threat identification hash table is traversed, and when a keyword identical to the real-time keyword exists in the threat identification hash table, a threat identification result corresponding to the keyword is used as a real-time threat identification result.

2. The method for identifying traffic threats according to claim 1, characterized in that: The keywords include domain names, Internet protocol addresses and md5 values ​​of message file contents, and the threat identification hash table includes a domain name hash table, an Internet protocol address hash table and an md5 hash table.

3. The method for identifying traffic threats according to claim 2, characterized in that: The real-time keyword includes a real-time domain name, a real-time Internet Protocol address, and a real-time MD5 value; the traversing of the threat identification hash table, when there is a keyword identical to the real-time keyword in the threat identification hash table, taking the threat identification result corresponding to the keyword as the real-time threat identification result, includes: Traversing the domain name hash table to determine whether there is a domain name identical to the real-time domain name in the domain name hash table; If there is a domain name identical to the real-time domain name in the domain name hash table, taking the threat identification result corresponding to the domain name as the real-time threat identification result; If the domain name hash table does not contain a domain name identical to the real-time domain name, traverse the Internet Protocol address hash table to determine whether the Internet Protocol address hash table contains an Internet Protocol address identical to the real-time Internet Protocol address; If there is an Internet Protocol address identical to the real-time Internet Protocol address in the Internet Protocol address hash table, taking the threat identification result corresponding to the Internet Protocol address as the real-time threat identification result; If there is no internet protocol address identical to the real-time internet protocol address in the internet protocol address hash table, determining whether there is an md5 value identical to the real-time md5 value in the md5 hash table; If there is an md5 value identical to the real-time md5 value in the md5 hash table, the threat identification result corresponding to the md5 value is used as the real-time threat identification result.

4. The method for identifying traffic threats according to claim 1, characterized in that: The method further comprises: When there is no keyword corresponding to the real-time keyword in the threat identification hash table, transmitting the real-time message to the cloud platform, and receiving a cloud platform threat identification result from the cloud platform; The cloud platform threat identification result is added to the threat identification hash table.

5. The method for identifying traffic threats according to claim 4, characterized in that: The transmitting the real-time message to the cloud platform includes: Calling the platform interface of the cloud platform; Determining whether the real-time keyword is a keyword of interest for threat identification; When the keyword is a keyword of interest for threat identification, adding the real-time message to a FIFO queue; The real-time message in the FIFO queue is retrieved based on a preset retrieval time point and sent to the cloud platform.

6. The method for identifying traffic threats according to claim 1, characterized in that: The method further comprises: Obtaining the creation time of each entry in the threat identification hash table; When the creation time is longer than the preset time, the entry is deleted.

7. The method for identifying traffic threats according to claim 1, characterized in that: The method further comprises: A threat identification log is generated based on the real-time threat identification result.

8. A flow threat identification device, characterized in that: include: A threat identification hash table creation unit, used for creating a threat identification hash table; The threat identification hash table includes keywords of the message and threat identification results of the message; A real-time message acquisition unit, used to acquire a real-time message and acquire a real-time keyword of the real-time message; The threat identification unit is used to traverse the threat identification hash table, and when there is a keyword identical to the real-time keyword in the threat identification hash table, use the threat identification result corresponding to the keyword as the real-time threat identification result.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the traffic threat identification method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the steps of the traffic threat identification method described in any one of claims 1 to 7 above.

Images