Snort rule management method, system, equipment and medium
By analyzing and verifying the SNORT rules, the collection of rules is set and written into the local bank, which solves the problem of lack of private ownership management mechanisms in the SNORT rule management, and realizes effective management and performance optimization of the rules.
Patent Information
- Application Number
- CN202411351528.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-26
- Publication Date
- 2025-01-24
Smart Images
Figure CN119363382A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a Snort rule management method, system, equipment and medium. Background Art
[0002] As a widely used open source intrusion detection system, Snort is favored by many network security experts for its powerful analysis ability and configurability. However, one of the more obvious shortcomings of Snort is that it lacks an efficient and intelligent rule management system. In particular, the rule base officially provided by Snort currently has more than 40,000 rules and is still increasing. At the same time, enterprises also have some unique private rules written by themselves to detect some specific security events and risks, which makes it even more difficult to manage such a large number of rules.
[0003] At present, most of the public snort rule management tools are basically based on automatically pulling the latest rules from the snort official website. In essence, they tend to be a rule automatic synchronization tool, which is used to automatically and regularly update the local rule base to the official latest version. This method is basically completely dependent on the official snort rule base.
[0004] The existing methods are basically a synchronization tool for official rules, lacking systematic rule management methods, especially the lack of effective management mechanisms for privatized rules. Summary of the invention
[0005] Aiming at the problem that the existing Snort rule management method lacks a private management mechanism, the present invention proposes a Snort rule management method, system, device and medium. First, the acquired Snort rules are parsed to obtain a rule set A. Secondly, the rule set A is traversed, and the rule set A after traversal is parsed by calling a regular expression to obtain a target rule object DR. Then, according to the rule ID, rule detail information and cve field of the target rule object DR, INFO information is obtained, and a rule detail set INFOA is generated according to the INFO information. Finally, the rule set A is written into a temporary rule file F, and the temporary rule file F is checked according to the -T parameter of the snort rule. If the check passes, the rule set A is written into a local rule base, and the rule detail set INFOA is written into the local rule detail base. The integrity of the system rules and the validity of the input rules are guaranteed, and the effective management of the private rules is realized.
[0006] The present invention specifically includes the following contents:
[0007] A Snort rule management method comprises the following steps: firstly, parsing an acquired Snort rule to obtain a rule set A; secondly, traversing the rule set A, and calling a regular expression to parse the traversed rule set A to obtain a target rule object DR; then obtaining INFO information according to the rule ID, rule detail information, and cve field of the target rule object DR, and generating a rule detail set INFOA according to the INFO information; finally, writing the rule set A into a temporary rule file F, and checking the temporary rule file F according to the -T parameter of the snort rule, and if the check passes, writing the rule set A into a local rule base, and writing the rule detail set INFOA into the local rule detail base.
[0008] In order to better implement the present invention, further, the Snort rule management method specifically includes the following steps:
[0009] Step S1: According to the obtained Snort rules, determine the method of obtaining the Snort rules, and parse to obtain the rule set A;
[0010] Step S2: traverse the rule set A to obtain the original rule SR, call the regular expression to parse the rule metadata field in the original rule SR, and map the rule metadata field to the object entity to obtain the target rule object DR;
[0011] Step S3: Determine whether the target rule object DR exists in the current system rule base. If so, skip it. If not, obtain INFO information according to the rule ID, rule details information, and cve field of the target rule object DR, and generate a rule details set INFOA according to the INFO information.
[0012] Step S4: Write the rule set A into the temporary rule file F, and check the temporary rule file F according to the -T parameter of the snort rule. If the check succeeds, write the rule set A into the local rule base, and write the rule detail set INFOA into the local rule detail base.
[0013] In order to better implement the present invention, further, the specific operation of step S1 is: according to the obtained Snort rules, determine the method of obtaining the Snort rules; if the Snort rules are the latest rule base downloaded from the Snort official website interface according to the official website synchronization rules, then decompress the Snort rules, and extract the Snort rules to obtain a first rule set; if the Snort rules are manually entered private rules, then generate a second rule set; summarize the first rule set and the second rule set to obtain rule set A.
[0014] In order to better implement the present invention, further, the step S3 specifically includes the following steps:
[0015] Step S31: determine whether the target rule object DR exists in the current system rule base, if yes, skip, if no, extract the target rule object DR to obtain the rule ID;
[0016] Step S32: determine whether there is detailed information corresponding to the rule ID in the current system rule base. If there is detailed information, continue to determine whether the cve field of the target rule object DR is empty. If it is not empty, call the cnnvd interface to query the detailed information of the cve number to obtain INFO1 information. Otherwise, generate an error log and return to step S2.
[0017] Step S33: parse the INFO1 information. If the parsing fails, an error log is generated. According to the CVE number of the target rule object DR, the CVE query interface is called to query the detailed information of the CVE number to obtain the INFO2 information. The INFO2 information is parsed. If the parsing is successful, the INFO2 information is converted into the rule detail information entity used by the current system to obtain the first INFO information and add it to the rule detail set INFOA; if the parsing is successful, the INFO1 information is converted into the rule detail information entity used by the current system to obtain the second INFO information and add it to the rule detail set INFOA.
[0018] In order to better implement the present invention, further, the Snort rule management method also includes the following steps:
[0019] Step S5: according to the actual storage path PATH1 of the pcap file to be replayed, extract the rule entity from the rule list RA obtained from the local rule library, and write it into the rule temporary file to obtain the rule temporary file path PATH2;
[0020] Step S6: according to the actual storage path PATH1 of the pcap file to be replayed and the regular temporary file path PATH2, replay the playback standard output STDOUT and the alarm file FA;
[0021] Step S7: Generate a playback report according to the playback standard output STDOUT and the alarm file FA to determine whether the current rule is valid.
[0022] In order to better implement the present invention, further, step S5 specifically includes the following steps:
[0023] Step S51: Upload a pcap file to obtain the pcap file format, calculate the md5 value of the uploaded pcap file, and if the corresponding pcap file exists in the local pcap file library, generate an error log and exit; if the corresponding pcap file does not exist, save the uploaded pcap file to the local pcap file library, and record the MD5 value of the pcap file, the pcap file storage path and the pcap file description mapping information;
[0024] Step S52: Obtain the actual storage path PATH1 of the pcap file P to be played back from the local pcap file library, extract the rule entity from the rule list RA obtained from the local rule library according to the actual storage path PATH1, and write it to the rule temporary file F to obtain the rule temporary file path PATH2.
[0025] In order to better implement the present invention, further, step S7 specifically includes the following steps:
[0026] Step S71: calling a regular expression to extract playback standard output STDOUT data to obtain statistical data S;
[0027] Step S72: parse the alarm file FA to obtain alarm detail information AD;
[0028] Step S73: Generate a playback report using the performance statistics data S and the alarm details information AD as metadata, and determine whether the current rule is valid based on the playback report.
[0029] Based on the above-mentioned Snort rule management method, in order to better implement the present invention, further, a Snort rule management system is proposed, including a parsing unit, a traversal unit, a collection unit, and a verification unit;
[0030] The parsing unit is used to parse the acquired Snort rules to obtain a rule set A;
[0031] The traversal unit is used to traverse the rule set A and call the regular expression to parse the traversed rule set A to obtain a target rule object DR;
[0032] The collection unit is used to obtain INFO information according to the rule ID, rule detail information, and cve field of the target rule object DR, and generate a rule detail set INFOA according to the INFO information;
[0033] The verification unit is used to write the rule set A into the temporary rule file F, and verify the temporary rule file F according to the -T parameter of the snort rule. If the verification passes, the rule set A is written into the local rule base, and the rule detail set INFOA is written into the local rule detail base.
[0034] Based on the above-mentioned Snort rule management method, in order to better implement the present invention, further, an electronic device is proposed, including a memory and a processor; a computer program is stored on the memory; when the computer program is executed on the processor, the above-mentioned Snort rule management method is implemented.
[0035] Based on the above-proposed Snort rule management method, in order to better implement the present invention, further, a computer-readable storage medium is proposed, on which computer instructions are stored; when the computer instructions are executed on the above-proposed electronic device, the above-proposed Snort rule management method is implemented.
[0036] The present invention has the following beneficial effects:
[0037] (1) The present invention generates rule set A by judging the way of obtaining snort rules, thereby ensuring the validity of manually entered rules.
[0038] (2) The present invention uses the actual attack traffic pcap file and selects rules from the rule library for playback during playback, and obtains whether the selected rules can effectively detect the attack traffic through the alarm table, thereby realizing the validity verification of the rules.
[0039] (3) The present invention uses a pcap file containing multiple attack flows and selects the rules of the entire rule library for playback. The interception rate and false alarm rate of the current rule library for the attack flow in the selected sample pcap file are obtained through the alarm table, thereby realizing the calculation of the rule interception rate and false alarm rate.
[0040] (4) When playback is completed, the present invention outputs performance data such as the total detection time and average detection time of each rule in the playback process, and identifies some high-occupancy rules based on the data to achieve performance optimization. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 A schematic diagram of the rule management process provided by the present invention.
[0042] Figure 2 A schematic diagram of the rule playback process provided by the present invention. DETAILED DESCRIPTION
[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be understood that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without making creative work are within the scope of protection of the present invention.
[0044] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "disposed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.
[0045] The complete English corresponding to the professional terms and English abbreviations involved in this embodiment are as follows:
[0046] Snort: Snort is a widely used open source intrusion detection system.
[0047] IDS: Intrusion Detection System, which is used to detect intrusion events in the network by matching network traffic with predefined feature rules.
[0048] pcap: Packet Capture, pcap is a network data capture file format that can record the content of each data packet transmitted on the network. This file format is often used in network protocol analysis and security auditing, and is widely used in network engineering, information security and other fields;
[0049] CNNVD: The full English name is Chinese National Vulnerability Database, which is the Chinese National Information Security Vulnerability Database. It is a national information security vulnerability database that the China Information Security Evaluation Center is responsible for building and maintaining in order to effectively perform the functions of vulnerability analysis and risk assessment, and provide basic services for my country's information security protection.
[0050] NIST: The National Institute of Standards and Technology (NIST) is directly under the U.S. Department of Commerce. It is engaged in basic and applied research in physics, biology, and engineering, as well as research in measurement technology and testing methods. It provides standards, standard reference data and related services, and enjoys a high reputation internationally.
[0051] Embodiment 1:
[0052] This embodiment proposes a Snort rule management method, which first parses the acquired Snort rules, and obtains a rule set A according to the method of obtaining the Snort rules; secondly, traverses the rule set A, and calls a regular expression to parse the traversed rule set A to obtain a target rule object DR; then obtains INFO information according to the rule ID, rule detail information, and cve field of the target rule object DR, and generates a rule detail set INFOA according to the INFO information; finally, writes the rule set A to a temporary rule file F, verifies the temporary rule file F according to the -T parameter of the snort rule, and if the verification passes, writes the rule set A to a local rule base, and writes the rule detail set INFOA to a local rule detail base, which specifically includes the following steps.
[0053] Step S1: According to the obtained Snort rules, determine the method of obtaining the Snort rules, and parse to obtain the rule set A.
[0054] Furthermore, the specific operation of step S1 is: according to the obtained Snort rules, determine the method of obtaining the Snort rules; if the Snort rules are the latest rule base downloaded from the Snort official website interface according to the official website synchronization rules, then decompress the Snort rules, and extract the Snort rules to obtain a first rule set; if the Snort rules are manually entered private rules, then generate a second rule set; summarize the first rule set and the second rule set to obtain rule set A.
[0055] Step S2: traverse the rule set A to obtain the original rule SR, call the regular expression to parse the rule metadata field in the original rule SR, and map the rule metadata field to the object entity to obtain the target rule object DR.
[0056] Step S3: Determine whether the target rule object DR exists in the current system rule base. If so, skip it. If not, obtain INFO information based on the rule ID, rule detail information, and cve field of the target rule object DR, and generate a rule detail set INFOA based on the INFO information.
[0057] Furthermore, the step S3 specifically includes the following steps:
[0058] Step S31: determine whether the target rule object DR exists in the current system rule base, if yes, skip, if no, extract the target rule object DR to obtain the rule ID;
[0059] Step S32: determine whether there is detailed information corresponding to the rule ID in the current system rule base. If there is detailed information, continue to determine whether the cve field of the target rule object DR is empty. If it is not empty, call the cnnvd interface to query the detailed information of the cve number to obtain INFO1 information. Otherwise, generate an error log and return to step S2.
[0060] Step S33: parse the INFO1 information. If the parsing fails, an error log is generated. According to the CVE number of the target rule object DR, the CVE query interface is called to query the detailed information of the CVE number to obtain the INFO2 information. The INFO2 information is parsed. If the parsing is successful, the INFO2 information is converted into the rule detail information entity used by the current system to obtain the first INFO information and add it to the rule detail set INFOA; if the parsing is successful, the INFO1 information is converted into the rule detail information entity used by the current system to obtain the second INFO information and add it to the rule detail set INFOA.
[0061] Step S4: Write the rule set A into the temporary rule file F, and check the temporary rule file F according to the -T parameter of the snort rule. If the check succeeds, write the rule set A into the local rule base, and write the rule detail set INFOA into the local rule detail base.
[0062] Step S5: According to the actual storage path PATH1 of the pcap file to be replayed, the rule entity is extracted from the rule list RA obtained from the local rule library, and written into the rule temporary file to obtain the rule temporary file path PATH2.
[0063] Furthermore, the step S5 specifically includes the following steps:
[0064] Step S51: Upload a pcap file to obtain the pcap file format, calculate the md5 value of the uploaded pcap file, and if the corresponding pcap file exists in the local pcap file library, generate an error log and exit; if the corresponding pcap file does not exist, save the uploaded pcap file to the local pcap file library, and record the MD5 value of the pcap file, the pcap file storage path and the pcap file description mapping information;
[0065] Step S52: Obtain the actual storage path PATH1 of the pcap file P to be played back from the local pcap file library, extract the rule entity from the rule list RA obtained from the local rule library according to the actual storage path PATH1, and write it to the rule temporary file F to obtain the rule temporary file path PATH2.
[0066] Step S6: According to the actual storage path PATH1 of the pcap file to be replayed and the regular temporary file path PATH2, replay the playback standard output STDOUT and the alarm file FA.
[0067] Step S7: Generate a playback report according to the playback standard output STDOUT and the alarm file FA to determine whether the current rule is valid.
[0068] Furthermore, the step S7 specifically includes the following steps:
[0069] Step S71: calling a regular expression to extract playback standard output STDOUT data to obtain statistical data S;
[0070] Step S72: parse the alarm file FA to obtain alarm detail information AD;
[0071] Step S73: Generate a playback report using the performance statistics data S and the alarm details information AD as metadata, and determine whether the current rule is valid based on the playback report.
[0072] Working principle: First, parse the acquired Snort rules to obtain rule set A; secondly, traverse rule set A, and call regular expression to parse the traversed rule set A to obtain the target rule object DR; then obtain INFO information according to the rule ID, rule details information, and cve field of the target rule object DR, and generate rule details set INFOA according to the INFO information; finally, write rule set A to the temporary rule file F, and verify the temporary rule file F according to the -T parameter of the snort rule. If the verification passes, write rule set A to the local rule library, and write rule details set INFOA to the local rule details library; ensure the integrity of system rules and the validity of entered rules, and realize effective management of private rules. By using the actual attack traffic pcap file during playback and selecting rules in the rule library for playback, the alarm table is used to obtain whether the selected rules can effectively detect the attack traffic, thereby realizing the validity verification of the rules.
[0073] Embodiment 2:
[0074] This embodiment is based on the above embodiment 1. Figure 1 , Figure 2 As shown, a specific embodiment is described in detail.
[0075] like Figure 1 As shown in the figure, Snort rules specifically include the following steps:
[0076] Step 1: Determine the method of obtaining Snort rules. If the latest rule base is downloaded from the Snort official website interface through the official website synchronization rules, decompress it and extract all the rules from it to obtain the first rule set. Otherwise, the second rule set is generated by manually entering private rules. The first rule set and the second rule set are summarized to obtain rule set A.
[0077] Step 2: traverse the above rule set A. If the traversal of the current set A is completed, go to step 12. Otherwise, get the original rule SR currently traversed.
[0078] Step 3: Use regular expressions to parse the rule metadata fields in the rule SR and map them to the object entity to obtain the target rule object DR;
[0079] Step 4: Take out the rule ID and version number from the rule object DR, and determine whether the corresponding rule already exists in the rule base of the current system. If it does, skip the processing of this rule.
[0080] Step 5: Take out the rule ID from the rule object DR, and determine whether there is detailed information corresponding to the current rule ID in the rule detail library of the current system. If not, go to S6; otherwise, go to step 2 to continue processing the next rule.
[0081] Step 6: Determine whether the cve field in the rule object DR is empty. If it is not empty, go to S7. Otherwise, record the error log and go to S2 to continue processing the next rule.
[0082] Step 7: Use the cve number in the rule object DR to call the cnnvd official website interface to query the details of the cve number and obtain the INFO1 information;
[0083] Step 8: Parse the content of INFO1. If the parsing of the content of INFO1 fails, record the error log and go to S9. Otherwise, convert INFO1 into the rule detail information entity used in this system to obtain INFO information and go to step 11.
[0084] Step 9: Use the CVE number in the rule object DR to call the NIST CVE query interface to query the details of the CVE number and obtain the INFO2 information;
[0085] Step 10: Parse the content of INFO2. If the parsing of the content of INFO2 is successful, convert INFO2 into the rule details information entity used in this system to obtain INFO and proceed to step 11. Otherwise, record the error log and proceed to step 2 to continue processing the next rule.
[0086] Step 11: Add the INFO obtained above into the rule details set INFOA;
[0087] Step 12: After the traversal is completed, the above rule set A is written to the temporary file F;
[0088] Step 13: Use the -T parameter of snort and input file F to perform snort loading verification on file F to ensure that file F can be loaded and used normally by snort. If the verification is successful, proceed to step 14; otherwise, record the error log and exit;
[0089] Step 14: Write the above rule set A into the local rule base, and write the rule detail set INFOA into the local rule detail base.
[0090] like Figure 2 As shown, the pcap management playback process is as follows:
[0091] Step A1: Get pcap by uploading pcap file;
[0092] Step A2: Calculate the md5 value of the uploaded pcap file and search it in the local pcap file library. If there is a pcap file with the same md5, record an error log and exit;
[0093] Step A3: Store the uploaded pcap file in the local pcap library and record the mapping information of the file md5, file storage path and file description;
[0094] Step A4: Select the rule list RA to be verified and the pcap file P to be played back;
[0095] Step A5: Find the actual storage path PATH1 of file P in the local pcap library mapping table;
[0096] Step A6: extract the rule entity of the rule list RA from the local rule base and write it into the temporary rule file (selected rules) and obtain the path PATH2 of the temporary rule file;
[0097] Step A7: input the pcap file PATH1 and the rule temporary file PATH2 into the snort binary program for playback to obtain the playback standard output STDOUT and the alarm file FA;
[0098] Step A8: Use a regular expression to extract data from the playback standard output STDOUT to extract performance statistical data S;
[0099] Step A9: parse the alarm file FA to obtain detailed alarm information AD;
[0100] Step A10: Generate a playback report using the above performance statistics data S and alarm detail information AD as metadata.
[0101] Let's take a specific Snort rule example to illustrate. The Snort example is as follows:
[0102] "alert http any any->any any(msg:"SERVER-WEBAPP Cisco Prime DataCenter Network Manager processImageSave.jsp directory traversal attempt";flow:to_server,established;http_uri;content:" / cues_utility / charts / processImageSave.jsp",fast_pattern,nocase;http_client_body;content:"chartid="",nocase;pcre:" / (^|&)chartid=[^&]*? (\x2e|%2e){2}([\x2f\x5c]|%2f|%5c) / i";service:http;reference:bugtraq,62484;reference:cve,2013-5486;reference:url,tools.cisco.com / security / center / content / CiscoSecurityAdvisory / cisco-sa-20130918-dcnm;rev:6;sid:29041;priority:2;classtype:directory-traversal;)",For the above rule, use regular expressions to extract the contents of each field, such as:
[0103] Using regular expressions:
[0104] “(alert|drop|rewrite|log)\s+(.*)\s+(.*)\s+(->|<-|<->))\s+(.*)\s+(.*)\s+\(” matches the rule. In the matching result, $1 is the rule action, $2 is the source IP, $3 is the source port, $4 is the traffic direction, $5 is the destination IP, and $6 is the destination port.
[0105] Use the regular expression: "msg\s*:"(.*?)"\s*;", in the matching result, $1 is the name of the rule.
[0106] This embodiment automatically crawls the corresponding numbered details from the corresponding website through the CVE ID information of the rule information, including the actual name, hazard level, event type, creation time, event details, affected platform / system, disposal suggestions and other information. At the same time, the corresponding CNNvd ID is automatically obtained from the CNNvd official website through the CVE ID to realize online query of rule details.
[0107] This embodiment verifies a single or multiple rules through the snort binary program to ensure that the input rules can be normally loaded and used by snort. The specific implementation method is to first write the rules to be verified or the input rules into a temporary rule file such as tmp.rules, and then use the command "snort-TR tmp.rules-csnort.lua" to perform rule verification, where "snort" is the path location of the snort binary program, the "-T" parameter specifies that snort is started in configuration verification mode, the "-R" parameter specifies the location of the loaded rule file, and the "-c" parameter specifies the location of the snort configuration file. Here, the configuration file that comes with snort after installation can be used.
[0108] This embodiment achieves synchronization of official website rules by periodically or manually pulling the latest official snort rule base through the snort official website rule download interface and synchronizing it to the system.
[0109] This embodiment adds a series of other easy-to-use functions based on the traditional official rule base synchronization, mainly as follows:
[0110] 1. Private rule management: In addition to the official rule base, there may be some private rules. Such rules can be manually added to the system for unified management. At the same time, thanks to the rule parser, verifier, and pcap playback functions in the system, the system can ensure the validity of manually entered rules.
[0111] 2. Pcap playback: Based on this function, we can achieve the following functions:
[0112] (1) Rule validity verification function: when replaying, use the actual attack traffic pcap file and select a rule in the rule library for replay. In this way, the alarm table can be used to determine whether the selected rule can effectively detect the attack traffic;
[0113] (2) Rule interception rate / false alarm rate calculation function: when replaying, use a pcap file containing multiple attack flows and select the rules of the entire rule base for replay. In this way, the interception rate and false alarm rate of the current rule base for the attack flow in the selected sample pcap file can be obtained through the alarm table;
[0114] (3) Rule performance analysis function. This function is based on the native "profiler" function of Snort. After this function is enabled, the total detection time, average detection time and other performance data of each rule in the playback process will be output when the playback is completed. The rule writer can identify some high-occupancy rules based on this data and optimize the performance of these rules.
[0115] The other parts of this embodiment are the same as those of the above-mentioned embodiment 1, and thus will not be described in detail.
[0116] Embodiment 3:
[0117] This embodiment, based on any one of the above-mentioned embodiments 1-2, proposes a Snort rule management system, including a parsing unit, a traversal unit, a collection unit, and a verification unit;
[0118] The parsing unit is used to parse the acquired Snort rules to obtain a rule set A;
[0119] The traversal unit is used to traverse the rule set A and call the regular expression to parse the traversed rule set A to obtain a target rule object DR;
[0120] The collection unit is used to obtain INFO information according to the rule ID, rule detail information, and cve field of the target rule object DR, and generate a rule detail set INFOA according to the INFO information;
[0121] The verification unit is used to write the rule set A into the temporary rule file F, and verify the temporary rule file F according to the -T parameter of the snort rule. If the verification passes, the rule set A is written into the local rule base, and the rule detail set INFOA is written into the local rule detail base.
[0122] This embodiment further provides an electronic device, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the above-mentioned Snort rule management method is implemented.
[0123] This embodiment further provides a computer-readable storage medium, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned Snort rule management method is implemented.
[0124] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1-2, so they will not be repeated here.
[0125] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.
Claims
1. A Snort rule management method, characterized in that: First, parse the obtained Snort rules, and obtain the rule set A according to the method of obtaining the Snort rules; secondly, traverse the rule set A, and call the regular expression to parse the traversed rule set A to obtain the target rule object DR; then obtain the INFO information according to the rule ID, rule detail information, and cve field of the target rule object DR, and generate the rule detail set INFOA according to the INFO information; finally, write the rule set A to the rule temporary file F, and check the rule temporary file F according to the -T parameter of the snort rule. If the check passes, write the rule set A to the local rule library, and write the rule detail set INFOA to the local rule detail library.
2. A Snort rule management method according to claim 1, characterized in that: The specific steps include: Step S1: According to the obtained Snort rules, determine the method of obtaining the Snort rules, and parse to obtain the rule set A; Step S2: traverse the rule set A to obtain the original rule SR, call the regular expression to parse the rule metadata field in the original rule SR, and map the rule metadata field to the object entity to obtain the target rule object DR; Step S3: Determine whether the target rule object DR exists in the current system rule base. If so, skip it. If not, obtain INFO information according to the rule ID, rule details information, and cve field of the target rule object DR, and generate a rule details set INFOA according to the INFO information. Step S4: Write the rule set A into the temporary rule file F, and check the temporary rule file F according to the -T parameter of the snort rule. If the check succeeds, write the rule set A into the local rule base, and write the rule detail set INFOA into the local rule detail base.
3. A Snort rule management method according to claim 2, characterized in that: The specific operation of step S1 is: according to the obtained Snort rules, determine the method of obtaining the Snort rules; if the Snort rules are the latest rule base downloaded from the Snort official website interface according to the official website synchronization rules, then decompress the Snort rules, and extract the Snort rules to obtain a first rule set; if the Snort rules are manually entered private rules, then generate a second rule set; summarize the first rule set and the second rule set to obtain rule set A.
4. A Snort rule management method according to claim 2, characterized in that: The step S3 specifically comprises the following steps: Step S31: determine whether the target rule object DR exists in the current system rule base, if yes, skip, if no, extract the target rule object DR to obtain the rule ID; Step S32: determine whether there is detailed information corresponding to the rule ID in the current system rule base. If there is detailed information, continue to determine whether the cve field of the target rule object DR is empty. If it is not empty, call the cnnvd interface to query the detailed information of the cve number to obtain INFO1 information. Otherwise, generate an error log and return to step S2. Step S33: parse the INFO1 information. If the parsing fails, an error log is generated. According to the CVE number of the target rule object DR, the CVE query interface is called to query the detailed information of the CVE number to obtain the INFO2 information. The INFO2 information is parsed. If the parsing is successful, the INFO2 information is converted into the rule detail information entity used by the current system to obtain the first INFO information and add it to the rule detail set INFOA; if the parsing is successful, the INFO1 information is converted into the rule detail information entity used by the current system to obtain the second INFO information and add it to the rule detail set INFOA.
5. A Snort rule management method according to claim 2, characterized in that: The Snort rule management method also includes the following steps: Step S5: according to the actual storage path PATH1 of the pcap file to be replayed, extract the rule entity from the rule list RA obtained from the local rule library, and write it into the rule temporary file to obtain the rule temporary file path PATH2; Step S6: according to the actual storage path PATH1 of the pcap file to be replayed and the regular temporary file path PATH2, replay the playback standard output STDOUT and the alarm file FA; Step S7: Generate a playback report according to the playback standard output STDOUT and the alarm file FA to determine whether the current rule is valid.
6. A Snort rule management method according to claim 5, characterized in that: The step S5 specifically comprises the following steps: Step S51: Upload a pcap file to obtain the pcap file format, calculate the md5 value of the uploaded pcap file, and if the corresponding pcap file exists in the local pcap file library, generate an error log and exit; if the corresponding pcap file does not exist, save the uploaded pcap file to the local pcap file library, and record the MD5 value of the pcap file, the pcap file storage path and the pcap file description mapping information; Step S52: Obtain the actual storage path PATH1 of the pcap file P to be played back from the local pcap file library, extract the rule entity from the rule list RA obtained from the local rule library according to the actual storage path PATH1, and write it to the rule temporary file F to obtain the rule temporary file path PATH2.
7. A Snort rule management method according to claim 6, characterized in that: The step S7 specifically includes the following steps: Step S71: calling a regular expression to extract playback standard output STDOUT data to obtain statistical data S; Step S72: parse the alarm file FA to obtain alarm detail information AD; Step S73: Generate a playback report using the performance statistics data S and the alarm details information AD as metadata, and determine whether the current rule is valid based on the playback report.
8. A Snort rule management system, characterized in that: It includes parsing unit, traversal unit, collection unit and verification unit; The parsing unit is used to parse the acquired Snort rules to obtain a rule set A; The traversal unit is used to traverse the rule set A and call the regular expression to parse the traversed rule set A to obtain a target rule object DR; The collection unit is used to obtain INFO information according to the rule ID, rule detail information, and cve field of the target rule object DR, and generate a rule detail set INFOA according to the INFO information; The verification unit is used to write the rule set A into the temporary rule file F, and verify the temporary rule file F according to the -T parameter of the snort rule. If the verification passes, the rule set A is written into the local rule base, and the rule detail set INFOA is written into the local rule detail base.
9. An electronic device, characterized in that: The invention comprises a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the Snort rule management method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device according to claim 9, the Snort rule management method according to any one of claims 1 to 7 is implemented.