Virus protection method and system based on multistage filtering

Abstract

The invention discloses a virus protection method and system based on multistage filtering. The method comprises the following steps: analyzing a service message through a service processing module to obtain service message parameter information, forming a service group combination based on the service message parameter information through a service combination module, and executing filtering control on the service group combination based on a preset filtering control strategy through a filtering control module to obtain a filtered target service message, and the virus detection module carries out virus detection on the target service message. According to the embodiment of the invention, the service processing module is used for processing the service message, and the service combination module is combined with multiple service types to form multiple service group combinations, so that the filtering control module executes multi-level filtering control based on the preset filtering control strategy, and the virus detection module only detects the filtered target service message; therefore, the security performance of the network can be improved, the risk that the network is attacked by viruses and malicious software is effectively reduced, and the virus detection efficiency and protection efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a virus protection method and system based on multi-level filtering. Background Art

[0002] With the development of the Internet, computers and networks have become an indispensable part of people's lives and work. Along with this, network attacks and network viruses are increasing, and computers and networks are facing increasingly serious security threats. Malicious codes such as viruses and Trojans have become the main means of hacker attacks, resulting in huge economic losses and security risks. Therefore, studying an efficient and reliable virus protection is of great significance to protecting computer network security.

[0003] Virus protection is a very important line of defense for computer and network security. Its performance and reliability are directly related to the security of user information and user assets. Existing virus protection has the following defects: 1. The algorithm is complex. New viruses, malware or attack methods appear every day, and virus protection does not necessarily cover all threats. A large number of algorithms need to be set to effectively identify various threats. 2. When processing large amounts of data, it is easy to affect the processing performance of the network. Summary of the invention

[0004] In view of this, the present invention provides a virus protection method, device, equipment and storage medium based on multi-level filtering, which can filter invalid traffic through multiple layers so that the virus protection engine only needs to process the virus traffic that really needs to be processed, thereby improving the security performance of the network, effectively reducing the risk of the network being attacked by viruses and malware, and improving virus detection efficiency and protection efficiency.

[0005] According to one aspect of the present invention, an embodiment of the present invention provides a virus protection method based on multi-stage filtering, which is applied to a virus protection system based on multi-stage filtering; wherein the virus protection system includes: a service processing module, a service combination module and a filtering control module;

[0006] The virus protection method comprises:

[0007] The service processing module receives the transmitted service message and parses the service message to obtain service message parameter information; wherein the service message parameter information includes at least one of the following: physical port information, service message header information, load information, application type and file type;

[0008] At least one service group combination is formed based on the service message parameter information by the service combination module; wherein the number of the service group combinations is one or at least two; and the service group combination includes one service type or at least two service types;

[0009] The filtering control module performs filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, so that the virus detection module performs virus detection on the target service message; wherein the preset filtering control strategy includes: a first filtering control strategy, a second filtering control strategy and a third filtering control strategy; wherein the first filtering control strategy includes: a forward filtering strategy and a reverse filtering strategy; the second filtering control strategy includes: a direct filtering strategy, a direct execution of virus detection strategy, and a subsequent judgment strategy; the third filtering control strategy includes: a pre-configured trained deep learning white model.

[0010] According to another aspect of the present invention, an embodiment of the present invention further provides a virus protection system based on multi-stage filtering, the virus protection system comprising: a service processing module, a service combination module and a filtering control module;

[0011] The service processing module is used to receive the transmitted service message and parse the service message to obtain service message parameter information; wherein the service message parameter information includes at least one of the following: physical port information, service message header information, load information, application type and file type;

[0012] The service combination module is used to form at least one service group combination based on the service message parameter information; wherein the number of the service group combinations is one or at least two; the service group combination includes one service type or at least two service types;

[0013] The filtering control module is used to perform filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, so that the virus detection module performs virus detection on the target service message; wherein the preset filtering control strategy includes: a first filtering control strategy, a second filtering control strategy and a third filtering control strategy; wherein the first filtering control strategy includes: a forward filtering strategy and a reverse filtering strategy; the second filtering control strategy includes: a direct filtering strategy, a direct execution of virus detection strategy, and a subsequent judgment strategy; the third filtering control strategy includes: a pre-configured trained deep learning white model.

[0014] The technical effect of the present invention is that the service message is processed by the service processing module, the service combination module forms at least one service group combination, and the filtering control module performs filtering control on at least one service group combination based on a preset filtering control strategy, so that the virus detection module only detects the filtered target service message, and can filter invalid traffic through multiple layers to achieve flexible and effective early removal of non-virus traffic, thereby improving the security performance of the network, effectively reducing the risk of the network being attacked by viruses and malware, and improving virus detection efficiency and protection efficiency.

[0015] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A flowchart of a virus protection method based on multi-stage filtering provided by an embodiment of the present invention;

[0018] Figure 2 A flowchart of another virus protection method based on multi-stage filtering provided by an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of a message flow of a virus protection method based on multi-stage filtering provided by an embodiment of the present invention;

[0020] Figure 4 A flowchart of a filtering and matching process provided by an embodiment of the present invention;

[0021] Figure 5 A structural block diagram of a virus protection system based on multi-stage filtering provided by an embodiment of the present invention;

[0022] Figure 6 An architectural diagram of a relationship diagram between a service module, a filtering service group, and a filtering control module provided in an embodiment of the present invention;

[0023] Figure 7 A typical deployment diagram of a virus protection system based on multi-stage filtering provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In one embodiment, Figure 1 A flowchart of a virus protection method based on multi-stage filtering is provided for one embodiment of the present invention. This embodiment is applicable to the situation when viruses in a network are protected and filtered. The method can be executed by a virus protection system based on multi-stage filtering.

[0027] like Figure 1 As shown, the virus protection method based on multi-stage filtering in this embodiment is applied to a virus protection system based on multi-stage filtering; wherein the virus protection system includes: a service processing module, a service combination module and a filtering control module; the virus protection method, the specific steps include:

[0028] S110. Receive the transmitted service message through the service processing module and parse the service message to obtain service message parameter information.

[0029] The service message parameter information includes at least one of the following: physical port information, service message header information, load information, application type, and file type.

[0030] In this embodiment, the business processing module is used to receive the transmitted business message and process the business message to obtain corresponding physical port information, business message header information, load information, category information, file type and other information. Of course, different information can be obtained through different units contained in the business processing module. Specifically, the business message can be parsed by the business message receiving unit to obtain the corresponding physical port information, the business message can be decoded by the business message decoding unit to obtain the business message header information, the business message can be reassembled by the business message reassembly unit to obtain the original business message load, the application type of the business message can be identified by the protocol identification unit, and the file type in the business message can be restored by the file restoration unit. It should be noted that the business message receiving unit, the business message decoding unit, the business message reassembly unit, the protocol identification unit and the file restoration unit have a sequential running order. It can be understood that the packet receiving module is always the first to run, followed by the decoding module, followed by the message reassembly module and the protocol identification module, and finally the file restoration module.

[0031] S120. Form at least one service group combination based on the service message parameter information through a service combination module.

[0032] The number of service group combinations is one or at least two, and the service group combination includes one service type or at least two service types. The service type may include 7 basic types, including physical ports, protocol IP for interconnection between networks, port numbers and transport layer protocols, service message loads, application types, and file types.

[0033] In this embodiment, the service group combination can be composed of physical port, IP, port, protocol, message load, application, or file type, and these basic types can be used to form many combinations at will, and each combination corresponds to a service group. It can be understood that any combination can constitute a service group combination.

[0034] In this embodiment, one or more service group combinations are formed by matching based on the physical port, the protocol IP interconnected between networks, the port number and the transport layer protocol, the service message load, the application type and the file type and the preset service group; in some embodiments, the physical port information in the service message parameter information, the IP protocol address interconnected between networks, the port number and the transport layer protocol, the load size, the load length and the load type, the application type and the file type, or at least two of them, can be used as service types to form one or at least two service group combinations according to the service filtering requirements. Of course, this embodiment can also match at least one service in the service group in other ways to form one or more service group combinations, which is not limited in this embodiment.

[0035] S130. The filtering control module performs filtering control on at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, so that the virus detection module performs virus detection on the target service message.

[0036] Among them, the preset filtering control strategies include: a first filtering control strategy, a second filtering control strategy and a third filtering control strategy; among them, the first filtering control strategy includes: a forward filtering strategy and a reverse filtering strategy; the second filtering control strategy includes: a direct filtering strategy, a direct execution of virus detection strategy, and a subsequent judgment strategy; the third filtering control strategy includes: a pre-configured trained deep learning white model, using the trained deep learning white model to predict whether the business messages transmitted in the network contain viruses, so as to give priority to filtering.

[0037] The target service message may be understood as a service message obtained after multi-stage filtering, and the service message is subsequently subjected to virus detection by a virus detection module.

[0038] In this embodiment, the preset filtering control policy is a business message filtering control policy issued by the user, or a configured business message filtering control policy; it can be understood that one is to build in a business message filtering control policy, relying on practice and research results to filter out common virus-free traffic. For example, common virus-free traffic filters include popular short video traffic, popular audio app traffic, database traffic, etc. It is worth noting that the built-in business message filtering control policy has a switch on the web, which is turned on by default and can be turned off as a whole. The other is to issue a business group policy in a more detailed manner based on the current network situation. For example, according to the on-site situation, a specific filtering control policy is issued in a targeted manner. For example, a certain IP represents a sandbox, which does not need to be processed and is directly transmitted; for example, a certain IP represents a printer, which can be filtered out without processing.

[0039] In this embodiment, the preset filtering control strategy includes: a first filtering control strategy and a second filtering control strategy. The first filtering control strategy may include but is not limited to: a forward filtering strategy and a reverse filtering strategy; the second filtering control strategy may include but is not limited to: a direct filtering strategy, a direct virus detection strategy, and a subsequent judgment strategy; the third filtering control strategy includes: a pre-configured trained deep learning white model. In this embodiment, each business group combination corresponds to a preset filtering control strategy, and each business group combination corresponds to a corresponding preset filtering control strategy issuance time or configuration time. The issuance time of the preset filtering control strategy corresponding to each business group combination is the same or different.

[0040] In this embodiment, the filtering control module performs filtering control on at least one service group combination based on the preset filtering control strategy to obtain the filtered target service message, so as to perform virus detection on the target service message. It can be understood that the service group policy matching sets the filtering strategy, including forward filtering, reverse filtering, direct filtering strategy, direct execution of virus detection strategy, subsequent judgment strategy, matching priority of multiple strategies, etc. Among them, forward filtering is to filter out the current matching service, such as filtering out the traffic of a certain IP so that it does not enter the anti-virus detection engine. Reverse filtering is to filter out the traffic that is not this IP, and the virus protection engine only processes the traffic of this IP. The filtering method after matching in the matching method can include direct filtering, full detection and subsequent further processing, wherein direct filtering means not entering the virus detection module; full detection means entering the detection engine; and subsequent further processing means waiting for subsequent judgment. The scenarios corresponding to these three strategies are: if there is no virus, it is directly released and does not enter the virus detection engine; if it is not certain that the traffic is suspected of carrying a virus, it enters the virus detection module; if it is not certain whether there is a virus, it is placed for further processing later.

[0041] More specifically, the business types included in the business group combination corresponding to the business message can be filtered out according to the forward filtering strategy, and other businesses except the business types included in the business group combination corresponding to the business message can be filtered out according to the reverse filtering strategy. When it is determined that the matching business in the business group combination does not carry a virus, the matching business included in the business group combination corresponding to the business message is not subjected to virus detection according to the direct filtering strategy. When it is determined that a certain business type in the business group combination carries a virus, the matching business included in the business group combination corresponding to the business message is subjected to virus detection according to the direct execution of the virus detection strategy. When it is determined that a certain business type in the business group combination is suspected of carrying a virus, the subsequent judgment strategy is executed. In other embodiments, the trained deep learning white model can also be used to perform filtering control on the business types included in the business group combination to obtain the filtered target business message.

[0042] The technical solution of the embodiment of the present invention processes the service message through the service processing module, the service combination module forms at least one service group combination, and the filtering control module performs filtering control on at least one service group combination based on a preset filtering control strategy, so that the virus detection module only detects the filtered target service message, and can form multiple service group combinations through multiple service types, so as to perform multi-level filtering under multiple strategies and priority strategies, thereby filtering out invalid traffic and realizing flexible and effective early removal of non-virus traffic, thereby improving the security performance of the network, effectively reducing the risk of the network being attacked by viruses and malware, and improving the virus detection efficiency and protection efficiency.

[0043] In one embodiment, the method further includes:

[0044] When a service message meets the preset filtering control condition, a discard mark is added to the service message, so that the service message receiving unit in the subsequent service processing module directly filters the matching service message according to the discard mark.

[0045] In this embodiment, when a service message meets the preset filtering control conditions, the service message is marked as discarded so that the subsequent packet receiving module can directly filter the matching service messages according to the discard mark. It can be understood that when the filtering conditions are met, the entire message (data traffic) is marked as discarded, and the subsequent service message receiving unit in the service processing module can directly filter the traffic according to this mark.

[0046] In one embodiment, Figure 2 A flowchart of another virus protection method based on multi-stage filtering is provided for one embodiment of the present invention. Based on the above embodiments, this embodiment receives the transmitted business message through the business processing module and parses the business message to obtain business message parameter information, forms at least one business group combination based on the business message parameter information through the business combination module; and performs filtering control on at least one business group combination based on a preset filtering control strategy through the filtering control module to obtain a filtered target business message, which is further refined.

[0047] like Figure 2 As shown, the virus protection method based on multi-stage filtering in this embodiment may specifically include the following steps:

[0048] S210: Receive the transmitted service message through the service message receiving unit, and parse the service message to obtain corresponding physical port information.

[0049] In this embodiment, the transmitted business message is received by the business message receiving unit, and the business message is parsed to obtain the corresponding physical port information. It can be understood that there is only physical port information in the business message receiving unit, so subsequent filtering can only be performed using the physical port and filtering control strategy. Based on the physical port, some links that are known to be virus-free can be filtered out, such as links in telecommunications dedicated lines, specific encrypted line networks of a VPN, etc.; some ways to filter out some links that are known to be virus-free based on the physical port include: matching strategies issued by users, and customers issue specific strategies in a targeted manner according to the situation on site. For example, if a certain IP is a sandbox, no processing is required and it can be directly transmitted. For example, if a certain IP is a printer, it can be filtered out without processing.

[0050] S220. Decode the service message by a service message decoding unit to obtain service message header information.

[0051] Among them, the business message header information includes the protocol IP address, port number and transport layer protocol for interconnection between networks.

[0052] In this embodiment, the service message is decoded by the service message decoding unit to obtain the service message header information; wherein, the service message header information includes the protocol IP address, port number and transport layer protocol interconnected between networks. It can be understood that the service message decoding unit obtains the message header information including IP, port and transport layer protocol through parsing, and uses this information to filter viruses. The filtering methods may include multiple forward filtering, reverse filtering, direct filtering, subsequent judgment and priority filtering. For example, if it is known that a certain IP definitely does not have a virus, the IP can be used for filtering control. For example, if you only want to detect the interesting traffic of a certain IP and Port, use IP and Port for reverse filtering, wherein the interesting traffic is the target traffic, which can be understood as the traffic suspected of carrying a virus.

[0053] S230. Reassemble the service message through the service message reassembly unit to obtain the original service message payload.

[0054] The original service message payload includes payload size, payload length, and payload type.

[0055] In this embodiment, the service message reassembly unit reassembles the service message to obtain the original service message payload; wherein, the original service message payload includes the payload size, the payload length and the payload type. It can be understood that after the message reassembly module is reassembled, a complete payload can be obtained, which can be filtered according to the integrity, size or file type carried in the payload; for example, if it is known that a certain audio type does not have a virus, the audio can be filtered out, or if only exe type files are to be detected, only exe file virus detection is processed.

[0056] S240. Identify the application type of the service message through the protocol identification unit.

[0057] In this embodiment, the application type of the service message is identified by the protocol identification unit. It can be understood that the protocol identification module can obtain the application type and can use the application category for filtering.

[0058] S250: Restore the file type in the service message through a file restoration unit.

[0059] In this embodiment, the file type in the service message is restored by the file restoration unit. Among them, the service message packet receiving unit, the service message decoding unit, the service message reassembly unit, the protocol identification unit and the file restoration unit have a sequential operation order. It can be understood that the file restoration module can obtain the file type in the load and can filter according to the file integrity and file type.

[0060] It should be noted that each functional unit corresponds to a business group, but the actual task is issued based on the business group. The business group in the task is an arbitrary combination of the seven basic business types and may not correspond to the business group of a certain function above.

[0061] For example, to better understand the role of each unit and the filtering content, Figure 3 The present invention provides a message flow diagram of a virus protection method based on multi-level filtering. In this embodiment, physical port filtering, IP address filtering, load and type filtering, application category filtering, and file filtering are used as examples for explanation. Figure 3 As shown, each unit corresponds to different business content.

[0062] S260. According to the service filtering requirements, the physical port information in the service message parameter information, the protocol IP address, port number and transport layer protocol for interconnection between networks, load size, load length and load type, application type and file type, or at least two of them are used as service types to form one or at least two service group combinations.

[0063] The number of the service group combinations is one or at least two. The service filtering requirement is the user's service filtering requirement, which can be defined based on the requirement or experience.

[0064] In this embodiment, according to the service filtering requirements, the physical port information in the service message parameter information, the protocol IP address of the interconnection between networks, the port number and the transport layer protocol, the load size, load length and load type, the application type and the file type, or at least two of them are used as service types to form one or at least two service group combinations.

[0065] In one embodiment, when there are at least two service types included in the service group combination, the priority order of each service type is: physical port information is greater than the protocol IP interconnected between networks, protocol IP is equal to port number, port number is equal to transport layer protocol, transport layer protocol is greater than load size, load size is equal to load length, load length is equal to load type, load type is greater than application type, application type is greater than file type; after each service type in the service group combination is combined in priority order, the filtering control module performs filtering control on at least one service group combination based on the preset filtering control strategy. Exemplarily, there is a service group of IP+protocol+application, then when the system runs to the decoding module, the two services of IP+protocol are matched first, and finally the application can be matched when the system runs to the protocol identification module, and the matching of this service group is completed, and the filtering action can be performed according to the filtering control strategy at this time.

[0066] In this embodiment, the relationship between the preset filtering control policies corresponding to the service groups is an "or" relationship, and the filtering policy decision can be made as long as one preset service group is matched.

[0067] S270: When the number of service group combinations corresponding to the service message is one, perform filtering control on the service group combination according to the first filtering control strategy and the second filtering control strategy to obtain a filtered target service message.

[0068] In this embodiment, when the number of service group combinations corresponding to the service message is one, filtering control is performed on the service group combination according to the first filtering control strategy and the second filtering control strategy to obtain the filtered target service message. Specifically, different filtering strategies can filter out different service messages.

[0069] In one embodiment, performing filtering control on the service group combination according to the first filtering control policy and the second filtering control policy to obtain the filtered target service message includes at least one of the following:

[0070] Filter out at least one service type included in the service group combination according to the forward filtering strategy; wherein the service group combination is composed of one or at least two of the physical port information, the protocol IP of the interconnection between networks, the port number, the transport layer protocol, the load size, the load length, the load type, the category information and the file type;

[0071] filtering out other service types except the service types included in the service group combination according to the reverse filtering strategy; wherein the other service types are other services except the service type;

[0072] When it is determined that the service type in the service group combination does not carry a virus, the service types included in the service group combination corresponding to the service message are determined not to perform virus detection according to the direct filtering strategy;

[0073] In the case where it is determined that the service type in the service group combination carries a virus, virus detection is performed on all service types included in the service group combination corresponding to the service message according to the direct execution of the virus detection strategy;

[0074] When it is determined that the service type in the service group combination is suspected of carrying a virus, a subsequent judgment strategy is executed.

[0075] It can be understood that the business group policy matching sets a professional filtering strategy, including forward filtering, reverse filtering, and matching priorities of multiple strategies. Forward matching is to filter out the current matching business, such as filtering out the traffic of a certain IP so that it does not enter the anti-virus detection engine. Reverse filtering is to filter out traffic that is not from this IP, and the virus protection engine only processes the traffic of this IP. There are three filtering methods after matching in the present invention, namely: 1) direct filtering, not entering the virus detection engine; 2) full detection, entering the detection engine; 3) subsequent further processing, waiting for the subsequent module to judge. The scenarios corresponding to these three strategies are: if there is no virus, it will be released directly and will not enter the virus detection engine; if it cannot be determined in the traffic that is suspected of carrying a virus, it will enter the virus detection module; if it cannot be determined whether there is a virus, it will be put aside for further processing. Furthermore, the basis for determining whether a packet carries a virus is often based on some experience and observational judgment. For example, packets without a payload, traffic from well-known short video apps, traffic from popular players, and packets from specific device group IPs can be used to determine that these traffic flows do not carry viruses. The ftp protocol, smtp protocol, and http protocol are all protocols for transferring files. In particular, when these protocols transfer compressed files or exe files, these are the key traffic flows for virus detection.

[0076] For example, to better understand the business group, Figure 4 A flowchart of a filtering and matching process provided by an embodiment of the present invention is as follows: Figure 4 As shown, the first filtering control strategy and the second filtering control strategy perform filtering control, including: forward filtering strategy, reverse filtering strategy, direct filtering strategy, direct virus detection strategy, and subsequent judgment strategy.

[0077] In one embodiment, the manner of executing the subsequent decision strategy includes at least one of the following:

[0078] Determine whether other transmission files and / or attachments corresponding to the business message exceed the preset threshold. If not, directly release them without entering the detection; if so, transmit them to the virus detection module for subsequent virus detection;

[0079] The judgment is made through a linear list of preset prior knowledge; wherein the linear list includes network scenarios that do not carry viruses and network types corresponding to the network scenarios;

[0080] When a service message matches more than two filtering control policy modes, the service message is directly filtered out.

[0081] In this embodiment, it is not possible to determine whether the traffic contains viruses, that is, it cannot be judged without the above characteristics, and further processing is required. In order to reduce the processing pressure of the virus detection engine, there are multiple ways to further process. One is to wait whether there are subsequent transmission files; waiting for subsequent messages is subject to message restrictions, and the empirical value is 20 messages with loads. If more than 20 files are not detected, the flow will be directly released and will not enter the detection engine; another is to enter the list table of prior knowledge for judgment. According to the network application scenario, in some scenarios, the transmission of txt files will definitely not contain viruses, and in some scenarios, the Content-Type: application / json type of http will not contain viruses; another is to combine with the subsequent, including subsequent filtering rules, or subsequent filtering. If this traffic hits more than two filtering strategies, or hits the filtering strategy multiple times, the traffic will be directly filtered out.

[0082] S280. When the number of business group combinations corresponding to the business message is at least two, based on the filtering priorities corresponding to each business group combination, a first filtering control strategy and a second filtering control strategy corresponding to one of the at least two business group combinations are selected to preferentially execute filtering control to obtain a filtered target business message.

[0083] In this embodiment, when the number of business group combinations corresponding to the business message is at least two, the number of business group combinations corresponding to the business message is determined to be at least two business group combinations, and based on the priorities corresponding to each business group combination, one business group combination is selected from the at least two business group combinations to preferentially perform filtering control to obtain the filtered target business message.

[0084] In one embodiment, according to the filtering priorities corresponding to the service group combinations, a first filtering control strategy and a second filtering control strategy corresponding to one of the service group combinations are selected from at least two service group combinations to preferentially perform filtering control to obtain a filtered target service message, including:

[0085] If the filtering priorities of at least two service group combinations are different, the first filtering control strategy and the second filtering control strategy corresponding to the service group combination with the highest priority are selected from the at least two service group combinations according to the priorities corresponding to the at least two service group combinations, and the first filtering control strategy and the second filtering control strategy corresponding to the service group combination with the highest priority are used as the first target filtering control strategy, and the first target filtering control strategy is used to perform filtering control on the service group combination with the highest priority to obtain a filtered target service message;

[0086] If the filtering priority of at least two business group combinations is the same, then based on the policy issuance order or policy configuration order of the first filtering control policy and the second filtering control policy corresponding to the at least two business group combinations respectively, the first filtering control policy and the second filtering control policy corresponding to the business group combination with the closest policy issuance order or policy configuration order are selected, and the first filtering control policy and the second filtering control policy corresponding to the business group combination with the closest policy issuance order or policy configuration order are used as the second target filtering control policy, and the second target filtering control policy is used to perform filtering control on the business group combination with the closest issuance order to obtain the filtered target business message.

[0087] Among them, the preset filtering control policy that is issued last is the one with the latest issuance order or configuration order.

[0088] It can be understood that when there are multiple filtering control policies, the priority of the filtering control policy makes the filtering method more complete. For conflicting business group combinations, which business group combination's preset filtering control policy is executed depends on the priority. The preset filtering control policy with a higher priority is executed first. For business group combinations with the same priority but conflicting conditions, the preset filtering control policy corresponding to the last issued business group combination is executed. Business group conflict means that a business message hits multiple business group combinations, then which business group combination's corresponding preset filtering control policy is executed depends on the priority and sequence. Priority is the first judgment criterion. When the priority is the same, the order of issuing the policy is used to judge, and the policy issued later has the right to priority processing.

[0089] S290. When the number of service group combinations corresponding to the service message is one, or at least two, use the trained deep learning white model to perform filtering control on the service types included in the service group combination to obtain a filtered target service message.

[0090] In this embodiment, when the number of service group combinations corresponding to the service message is one, or at least two, the trained deep learning white model is used to perform filtering control on the service types included in the service group combination to obtain the filtered target service message. In this embodiment, the deep learning white model is a virus filtering model established by training normal service messages through a machine learning gated recurrent unit GRU algorithm, which is used to detect abnormal service types.

[0091] In this embodiment, the training goal of the deep learning white model is to further filter out normal messages, so when using the training model for detection, normal messages can be identified as abnormal messages in small quantities, but abnormal messages cannot identify normal messages. Among them, the training process of the deep learning white model includes: obtaining a training sample set, which is a normal business message in the test scenario. Based on the machine learning gated recurrent unit GRU algorithm, the cross entropy loss function and the training sample set, the deep learning white model is trained, and the cross entropy loss function is optimized until the cross entropy loss function reaches the optimization stop condition to obtain a trained deep learning white model; the optimization stop condition includes that the recognition accuracy of normal business messages is above a preset percentage, such as more than 97% of normal messages are accurately recognized to meet the requirements. In this embodiment, the machine learning gated recurrent unit GRU algorithm is an improved recurrent neural network structure in the prior art, which is used to solve the gradient vanishing and gradient explosion problems faced by traditional RNN when processing long sequences. GRU adjusts the degree of information transmission in the sequence by introducing a gating mechanism, thereby achieving better capture of long-distance dependencies. The core idea is to introduce two gating units, update gate and reset gate. These two gating units can learn how to adjust the importance of input information and hidden state information of the previous time step at each time step. To some extent, they can be regarded as selectively memorizing the input at the current moment and the hidden state at the previous moment, so that the network can capture long-distance dependencies more effectively.

[0092] It should be noted that S270, S280 and S290 may be performed in parallel or in a sequential order, which is not limited in this embodiment.

[0093] The technical solution of the embodiment of the present invention can define the superposition of multiple control strategies through forward filtering, reverse filtering, direct filtering, direct detection and subsequent judgment, and for more complex situations, when there are multiple filtering control strategies, the priority of the filtering control strategy can define the superposition of multiple control strategies. Through effective filtering methods, virus-free traffic can be cleared, so that the virus protection engine only needs to process the virus traffic that really needs to be processed, thereby fully reducing the pressure on the virus engine and improving the performance of the virus protection system.

[0094] In one embodiment, Figure 5 A structural block diagram of a virus protection system based on multi-stage filtering provided by an embodiment of the present invention, the system is suitable for protecting and filtering viruses in a network.

[0095] like Figure 5 As shown, the system comprises:

[0096] A service processing module 510, a service combination module 520 and a filtering control module 530;

[0097] The service processing module 510 is used for the service processing module to receive the transmitted service message and parse the service message to obtain service message parameter information; wherein the service message parameter information includes at least one of the following: physical port information, service message header information, load information, application type and file type;

[0098] The service combination module 520 is used to form at least one service group combination based on the service message parameter information; wherein the number of the service group combinations is one or at least two; and the service group combination includes one service type or at least two service types;

[0099] The filtering control module 530 is used to perform filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, so that the virus detection module performs virus detection on the target service message; wherein the preset filtering control strategy includes: a first filtering control strategy, a second filtering control strategy and a third filtering control strategy; wherein the first filtering control strategy includes: a forward filtering strategy and a reverse filtering strategy; the second filtering control strategy includes: a direct filtering strategy, a direct execution of virus detection strategy, and a subsequent judgment strategy; the third filtering control strategy includes: a pre-configured trained deep learning white model.

[0100] In one embodiment, the service message processing module 510 includes: a service message receiving unit, a service message decoding unit, a service message reassembly unit, a protocol identification unit and a file restoration unit;

[0101] Correspondingly, the service processing module 510 is used to receive the transmitted service message and process the service message to obtain service message parameter information, including:

[0102] A service message receiving unit, used for receiving the transmitted service message and parsing the service message to obtain the corresponding physical port information;

[0103] A service message decoding unit, used to decode the service message to obtain service message header information; wherein the service message header information includes a protocol IP address, a port number and a transport layer protocol for interconnection between networks;

[0104] The service message reassembly unit is used to reassemble the service message to obtain the original service message load; wherein the original service message load includes the load size, load length and load type;

[0105] The protocol identification unit is used to identify the application type of the service message;

[0106] The file restoration unit is used to restore the file type in the service message.

[0107] In one embodiment, the service message header information includes: the protocol IP address, port number and transport layer protocol of the interconnection between networks; the original service message payload includes the payload size, payload length and payload type;

[0108] Accordingly, the service combination module 520 is used to form at least one service group combination based on the service message parameter information, including:

[0109] According to the service filtering requirements, the physical port information in the service message parameter information, the protocol IP address, port number and transport layer protocol for interconnection between networks, load size, load length and load type, application type and file type, or at least two of them are used as service types to form one or at least two service group combinations.

[0110] In one embodiment, the first filtering control policy and the second filtering control policy are service message filtering control policies issued by a user in real time, or pre-configured service message filtering control policies; each service group combination corresponds to a first filtering control policy and a second filtering control policy, and each service group combination corresponds to a corresponding policy issuance time or policy configuration time;

[0111] Correspondingly, the filtering control module 530 is used to perform filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, including:

[0112] When the number of service group combinations corresponding to the service message is one, performing filtering control on the service group combination according to the first filtering control strategy and the second filtering control strategy to obtain a filtered target service message;

[0113] When the number of business group combinations corresponding to the business message is at least two, based on the filtering priorities corresponding to each of the business group combinations, a first filtering control strategy and a second filtering control strategy corresponding to one of the at least two business group combinations are selected to preferentially execute filtering control to obtain the filtered target business message.

[0114] In one embodiment, the performing filtering control on the service group combination according to the first filtering control policy and the second filtering control policy to obtain the filtered target service message includes at least one of the following:

[0115] Filter out at least one service type included in the service group combination according to the forward filtering strategy; wherein the service group combination is composed of one or at least two of the physical port information, the protocol IP of the interconnection between networks, the port number, the transport layer protocol, the load size, the load length, the load type, the category information and the file type;

[0116] Filter out other service types except the service types included in the service group combination according to the reverse filtering strategy; wherein the other service types are other services except the service types;

[0117] In the case where it is determined that the service type in the service group combination does not carry a virus, determining according to the direct filtering strategy that virus detection is not performed on the service types included in the service group combination corresponding to the service message;

[0118] In the case where it is determined that the service type in the service group combination carries a virus, determining that all service types included in the service group combination corresponding to the service message are subjected to virus detection according to the direct virus detection strategy;

[0119] In the case where it is determined that the service type in the service group combination is suspected of carrying a virus, the subsequent decision strategy is executed.

[0120] In one embodiment, the method of executing the subsequent decision strategy includes at least one of the following:

[0121] Determine whether other transmission files and / or attachments corresponding to the business message exceed a preset threshold. If not, directly release them without entering the detection; if so, transmit them to the virus detection module for subsequent virus detection;

[0122] The judgment is made through a linear list of preset prior knowledge; wherein the linear list includes network scenarios that do not carry viruses and network types corresponding to the network scenarios;

[0123] In the case where the service message matches more than two filtering control policy modes, the service message is directly filtered out.

[0124] In one embodiment, when there are at least two service types included in the service group combination, the priority order of each service type is: physical port information is greater than the protocol IP for interconnection between networks, the protocol IP is equal to the port number, the port number is equal to the transport layer protocol, the transport layer protocol is greater than the load size, the load size is equal to the load length, the load length is equal to the load type, the load type is greater than the application type, and the application type is greater than the file type;

[0125] After each service type in the service group combination is combined in order of priority, the filtering control module performs filtering control on the at least one service group combination based on the preset filtering control strategy.

[0126] In one embodiment, the filtering control is performed based on the filtering priorities corresponding to the service group combinations, and the first filtering control strategy and the second filtering control strategy corresponding to one of the service group combinations are selected from at least two service group combinations to preferentially perform filtering control to obtain the filtered target service message, including:

[0127] If the filtering priorities of the at least two service group combinations are different, the first filtering control strategy and the second filtering control strategy corresponding to the service group combination with the highest priority are selected from the at least two service group combinations according to the priorities corresponding to the at least two service group combinations, and the first filtering control strategy and the second filtering control strategy corresponding to the service group combination with the highest priority are used as the first target filtering control strategy, and the first target filtering control strategy is used to perform filtering control on the service group combination with the highest priority to obtain a filtered target service message;

[0128] If the filtering priorities of the at least two business group combinations are the same, then based on the policy issuance order or policy configuration order of the first filtering control policy and the second filtering control policy corresponding to the at least two business group combinations respectively, the first filtering control policy and the second filtering control policy corresponding to the business group combination with the closest policy issuance order or policy configuration order are selected, and the first filtering control policy and the second filtering control policy corresponding to the business group combination with the closest policy issuance order or policy configuration order are used as the second target filtering control policy, and the second target filtering control policy is used to perform filtering control on the business group combination with the closest issuance order to obtain the filtered target business message.

[0129] In one embodiment, the filtering control module performs filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, further comprising:

[0130] When the number of service group combinations corresponding to the service message is one, or at least two, the trained deep learning white model is used to perform filtering control on the service types included in the service group combination to obtain a filtered target service message; wherein the deep learning white model is a virus filtering model established by training normal service messages through a machine learning gated recurrent unit GRU algorithm, and is used to detect abnormal service types;

[0131] The training process of the deep learning white model includes: obtaining a training sample set, where the training sample set is a normal service message in a test scenario;

[0132] The deep learning white model is trained based on the machine learning gated recurrent unit GRU algorithm, the cross entropy loss function and the training sample set, and the cross entropy loss function is optimized until the cross entropy loss function reaches the optimization stop condition, so as to obtain a trained deep learning white model; wherein the optimization stop condition includes that the recognition accuracy rate of normal business messages is above a preset percentage.

[0133] In one embodiment, the system further includes: a marking module, which is used to mark the service message as discarded when the service message meets the preset filtering control conditions, so that the service message receiving unit in the subsequent service processing module directly filters the matching service message according to the discard mark.

[0134] The virus protection system based on multi-stage filtering provided by the embodiment of the present invention can execute the virus protection method based on multi-stage filtering provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0135] Exemplary, to facilitate a better virus protection method based on multi-stage filtering, Figure 6 The present invention provides an architecture diagram of a service module, a filtering service group, and a filtering control module relationship diagram. The service module in this embodiment is the service processing module in the above embodiment, and the service module includes a service message receiving unit, a service message decoding unit, a service message reassembly unit, a protocol identification unit, and a file restoration unit; the filtering service group is the service matching module in the above embodiment; Figure 7 A typical deployment diagram of a virus protection system based on multi-stage filtering provided by an embodiment of the present invention is shown in FIG. Figure 7 As shown in the typical deployment diagram of the virus protection system, the virus protection system is generally deployed at the exit of the enterprise park, the core node of the operator, etc. The virus protection system in the private network is generally deployed in the internal network. The virus protection system is connected to the network in series mode to protect the network traffic passing through.

[0136] For example, in order to better understand the virus protection method based on multi-level filtering, the present invention has been put into practical use in many cases, and is divided into Internet traffic and professional network traffic according to traffic components. The processed Internet traffic is mainly deployed at the enterprise park exit, operator core node, etc., and the processed professional network traffic is mainly deployed in the financial industry intranet, etc.

[0137] According to actual feedback from customers at the site, the present invention increases the performance by 20%-50% by adding multi-stage filtration and the method of the present invention. The test data is summarized in the following Table 1:

[0138] Table 1: Performance comparison after adding multi-level filtering strategy

[0139]

[0140] It can be seen that the virus protection system based on multi-level filtering of the present invention can reduce the pressure of the virus detection engine, significantly improve the performance of virus detection, effectively remove unnecessary non-target traffic, and significantly improve the processing capacity of the system. In the customer's real network environment, a good performance improvement effect was achieved, with a performance improvement of between 20% and 50%.

[0141] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0142] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A virus protection method based on multi-stage filtering, characterized in that: Applied to a virus protection system based on multi-level filtering; wherein the virus protection system includes: a business processing module, a business combination module and a filtering control module; The virus protection method comprises: The service processing module receives the transmitted service message and parses the service message to obtain service message parameter information; wherein the service message parameter information includes at least one of the following: physical port information, service message header information, load information, application type and file type; At least one service group combination is formed based on the service message parameter information by the service combination module; wherein the number of the service group combinations is one or at least two; and the service group combination includes one service type or at least two service types; The filtering control module performs filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, so that the virus detection module performs virus detection on the target service message; wherein the preset filtering control strategy includes: a first filtering control strategy, a second filtering control strategy and a third filtering control strategy; wherein the first filtering control strategy includes: a forward filtering strategy and a reverse filtering strategy; the second filtering control strategy includes: a direct filtering strategy, a direct execution of virus detection strategy, and a subsequent judgment strategy; the third filtering control strategy includes: a pre-configured trained deep learning white model.

2. The virus protection method according to claim 1, characterized in that: The service message processing module includes: a service message receiving unit, a service message decoding unit, a service message reassembly unit, a protocol identification unit and a file restoration unit; Correspondingly, receiving the transmitted service message through the service processing module and parsing the service message to obtain service message parameter information includes: The service message receiving unit receives the transmitted service message, and parses the service message to obtain physical port information; Decoding the service message by a service message decoding unit to obtain service message header information; Reassembling the service message through the service message reassembly unit to obtain the original service message load; Identifying the application type of the service message by the protocol identification unit; The file type in the service message is restored by the file restoration unit.

3. The virus protection method according to claim 1, characterized in that: The service message header information includes: the protocol IP address, port number and transport layer protocol for interconnection between networks; the load information includes load size, load length and load type; Accordingly, the forming of at least one service group combination based on the service message parameter information by the service combination module includes: According to the service filtering requirements, the physical port information in the service message parameter information, the protocol IP address, port number and transport layer protocol for interconnection between networks, load size, load length and load type, application type and file type, or at least two of them are used as service types to form one or at least two service group combinations.

4. The virus protection method according to claim 1, characterized in that: The first filtering control strategy and the second filtering control strategy are service message filtering control strategies issued by the user in real time, or pre-configured service message filtering control strategies; each service group combination corresponds to a first filtering control strategy and a second filtering control strategy, and each service group combination corresponds to a corresponding policy issuance time or policy configuration time; Correspondingly, the filtering control module performs filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, including: When the number of service group combinations corresponding to the service message is one, performing filtering control on the service group combination according to the first filtering control strategy and the second filtering control strategy to obtain a filtered target service message; When the number of business group combinations corresponding to the business message is at least two, based on the filtering priorities corresponding to each of the business group combinations, a first filtering control strategy and a second filtering control strategy corresponding to one of the at least two business group combinations are selected to preferentially execute filtering control to obtain the filtered target business message.

5. The virus protection method according to claim 4, characterized in that: The performing filtering control on the service group combination according to the first filtering control policy and the second filtering control policy to obtain the filtered target service message includes at least one of the following: Filter out at least one service type included in the service group combination according to the forward filtering strategy; wherein the service group combination is composed of one or at least two of the physical port information, the protocol IP of the interconnection between networks, the port number, the transport layer protocol, the load size, the load length, the load type, the category information and the file type; Filter out other service types except the service types included in the service group combination according to the reverse filtering strategy; wherein the other service types are other services except the service types; In the case where it is determined that the service type in the service group combination does not carry a virus, determining according to the direct filtering strategy that virus detection is not performed on the service types included in the service group combination corresponding to the service message; In the case where it is determined that the service type in the service group combination carries a virus, determining that all service types included in the service group combination corresponding to the service message are subjected to virus detection according to the direct virus detection strategy; In the case where it is determined that the service type in the service group combination is suspected of carrying a virus, the subsequent decision strategy is executed.

6. The virus protection method according to claim 5, characterized in that: The method of executing the subsequent decision strategy includes at least one of the following: Determine whether other transmission files and / or attachments corresponding to the business message exceed a preset threshold. If not, directly release them without entering the detection; if so, transmit them to the virus detection module for subsequent virus detection; The judgment is made through a linear list of preset prior knowledge; wherein the linear list includes network scenarios that do not carry viruses and network types corresponding to the network scenarios; In the case where the service message matches more than two filtering control policy modes, the service message is directly filtered out.

7. The virus protection method according to claim 5, characterized in that: When there are at least two service types included in the service group combination, the priority order of each service type is: the physical port information is greater than the protocol IP for interconnection between networks, the protocol IP is equal to the port number, the port number is equal to the transport layer protocol, the transport layer protocol is greater than the load size, the load size is equal to the load length, the load length is equal to the load type, the load type is greater than the application type, and the application type is greater than the file type; After each service type in the service group combination is combined in order of priority, the filtering control module performs filtering control on the at least one service group combination based on the preset filtering control strategy.

8. The virus protection method according to claim 4, characterized in that: The method of selecting a first filtering control strategy and a second filtering control strategy corresponding to one of the at least two service group combinations according to the filtering priorities respectively corresponding to the service group combinations to preferentially perform filtering control to obtain a filtered target service message comprises: If the filtering priorities of the at least two service group combinations are different, the first filtering control strategy and the second filtering control strategy corresponding to the service group combination with the highest priority are selected from the at least two service group combinations according to the priorities corresponding to the at least two service group combinations, and the first filtering control strategy and the second filtering control strategy corresponding to the service group combination with the highest priority are used as the first target filtering control strategy, and the first target filtering control strategy is used to perform filtering control on the service group combination with the highest priority to obtain a filtered target service message; If the filtering priorities of the at least two business group combinations are the same, then based on the policy issuance order or policy configuration order of the first filtering control policy and the second filtering control policy corresponding to the at least two business group combinations respectively, the first filtering control policy and the second filtering control policy corresponding to the business group combination with the closest policy issuance order or policy configuration order are selected, and the first filtering control policy and the second filtering control policy corresponding to the business group combination with the closest policy issuance order or policy configuration order are used as the second target filtering control policy, and the second target filtering control policy is used to perform filtering control on the business group combination with the closest issuance order to obtain the filtered target business message.

9. The method according to claim 1, characterized in that: The filtering control module performs filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, further comprising: When the number of service group combinations corresponding to the service message is one, or at least two, the trained deep learning white model is used to perform filtering control on the service types included in the service group combination to obtain a filtered target service message; wherein the deep learning white model is a virus filtering model established by training normal service messages through a machine learning gated recurrent unit GRU algorithm, and is used to detect abnormal service types; The training process of the deep learning white model includes: obtaining a training sample set, where the training sample set is a normal service message in a test scenario; The deep learning white model is trained based on the machine learning gated recurrent unit GRU algorithm, the cross entropy loss function and the training sample set, and the cross entropy loss function is optimized until the cross entropy loss function reaches the optimization stop condition, so as to obtain a trained deep learning white model; wherein the optimization stop condition includes that the recognition accuracy rate of normal business messages is above a preset percentage.

10. The virus protection method according to claim 1, characterized in that: The method further comprises: When the service message meets the preset filtering control condition, the service message is marked as discarded, so that the service message receiving unit in the subsequent service processing module directly filters the matching service message according to the discard mark.

11. A virus protection system based on multi-stage filtering, characterized in that: The virus protection system includes: a business processing module, a business combination module and a filtering control module; The service processing module is used to receive the transmitted service message and parse the service message to obtain service message parameter information; wherein the service message parameter information includes at least one of the following: physical port information, service message header information, load information, application type and file type; The service combination module is used to form at least one service group combination based on the service message parameter information; wherein the number of the service group combinations is one or at least two; the service group combination includes one service type or at least two service types; The filtering control module is used to perform filtering control on the at least one service group combination based on a preset filtering control strategy to obtain a filtered target service message, so that the virus detection module performs virus detection on the target service message; wherein the preset filtering control strategy includes: a first filtering control strategy, a second filtering control strategy and a third filtering control strategy; wherein the first filtering control strategy includes: a forward filtering strategy and a reverse filtering strategy; the second filtering control strategy includes: a direct filtering strategy, a direct execution of virus detection strategy, and a subsequent judgment strategy; the third filtering control strategy includes: a pre-configured trained deep learning white model.

Images