A cloud firewall security protection method, system, storage medium and intelligent terminal

Abstract

The present application relates to a cloud firewall security protection method, system, storage medium and intelligent terminal, and relates to the field of cloud security technology, which includes obtaining target traffic; analyzing the target traffic to obtain traffic application type and traffic behavior activity; comparing based on traffic application type and threat signature; marking the target traffic as a potential threat when the match is successful; searching for normal behavior from a normal database based on traffic application type when the match is unsuccessful; matching based on traffic behavior activity and normal behavior; not performing any operation when the match is successful; performing deep-level behavior analysis to mark the target traffic as an advanced threat when the match is unsuccessful; and taking protective actions by the firewall when marked as a potential threat or an advanced threat. The present application has the effect of combining DPI technology with firewall technology, which not only improves the recognition rate of known threats, but also enhances the detection and response capabilities to unknown or complex attack patterns.

Description

Technical Field

[0001] The present application relates to the field of cloud security technology, and in particular to a cloud firewall security protection method, system, storage medium and intelligent terminal. Background Art

[0002] A firewall is a network security device used to detect the security of network traffic. It can decide whether to allow or block network traffic based on the detection results of network traffic or the preset firewall rules. With the development of cloud network technology, the use of cloud services is becoming more and more widespread, and the network security protection for cloud service scenarios is becoming more and more important. Therefore, as an important security device for cloud network boundary protection, it is particularly important for cloud firewalls to have high performance and high stability.

[0003] At present, most of the network security protection measures adopted in the market are as follows: Static rule firewall: It determines whether to allow specific traffic to pass based on pre-set black and white lists and rule sets. The advantage is that the configuration is simple and easy to understand.

[0004] The existing technology has the following problems: static rule firewalls must make judgments based on set rules. Once a message does not exist in the corresponding blacklist or whitelist or the corresponding rule, no judgment can be made. This lacks flexibility and makes it impossible to respond to location threats in a timely manner. There is still room for improvement. Summary of the invention

[0005] In order to improve the problem that once a location does not exist in the corresponding black or white list or the corresponding rule, it is impossible to make a judgment, lack flexibility, and cannot respond to location threats in a timely manner, the present application provides a cloud firewall security protection method, system, storage medium and intelligent terminal.

[0006] In a first aspect, the present application provides a cloud firewall security protection method, which adopts the following technical solution:

[0007] A cloud firewall security protection method, comprising:

[0008] Get target traffic;

[0009] Analyze the target traffic based on the preset DPI technology to obtain the traffic application type and traffic behavior activities;

[0010] Compare the threat signatures based on traffic application type and the threat signature library updated in real time;

[0011] When a match is successful, the target traffic is marked as a preset potential threat;

[0012] When the match fails, the corresponding normal behavior is found from the preset normal database based on the traffic application type;

[0013] Matching based on traffic behavior activities and normal behavior;

[0014] No operation is performed when the match is successful;

[0015] If the match fails, a preset deep behavior analysis is performed to mark the target traffic as a preset advanced threat.

[0016] Firewall takes pre-set protection actions when flagged as potential threats and advanced threats.

[0017] By adopting the above technical solutions, DPI technology is combined with firewall technology to analyze unknown traffic at the application layer to dynamically identify potential threats, and at the same time feedback is given to the firewall to take timely measures. DPI technology enhances the functions of traditional firewalls and provides more sophisticated and intelligent traffic analysis capabilities. The two together build a powerful border defense system. This combination not only improves the recognition rate of known threats, but also enhances the detection and response capabilities to unknown or complex attack patterns.

[0018] Optionally, also include:

[0019] When no traffic behavior activity is analyzed, the target traffic is sent to a preset isolation environment and the target traffic is executed, and virtual behavior is obtained;

[0020] Matching based on virtual and normal behavior;

[0021] When the match is successful, a mapping relationship between the target traffic and the virtual behavior is formed and stored;

[0022] If a match fails, the target traffic is marked as an advanced threat.

[0023] By adopting the above technical solution, if the corresponding behavior cannot be analyzed, it will be placed in a sandbox for simulation to obtain the expected behavior. On the one hand, it can prevent unknown threats from entering the system and causing attacks. On the other hand, if it is not a threat, it will be learned, thereby improving the self-learning ability.

[0024] Optionally, methods for sending target traffic to an isolated environment include:

[0025] Get the pre-utilization rate and utilization rate of the isolated environment;

[0026] Calculate the total utilization rate based on the pre-utilization rate and the utilized rate;

[0027] Determine traffic priority based on target traffic when the total usage rate is greater than the preset high load critical rate;

[0028] sorting the target traffic based on the traffic priority to obtain a target traffic priority order;

[0029] Determine the priority target traffic based on the high load critical rate and the target traffic priority order;

[0030] Send priority target traffic to the isolated environment and update the utilization rate in real time;

[0031] When the total usage rate is less than the high load critical rate, the target traffic is sent to the isolated environment.

[0032] By adopting the above technical solution, if the usage rate of the sandbox is too high during the use of the sandbox, it is necessary to prioritize the simulated traffic used. The higher the priority, the earlier the sandbox simulation starts, so that the traffic simulation is orderly.

[0033] Optionally, the method of sending the target traffic to the isolated environment when the total usage rate is less than the high load critical rate includes:

[0034] Based on the traffic application type, the corresponding adaptation sandbox number and the number of adaptation sandboxes are found from the preset adaptation database;

[0035] When the number of adapted sandboxes is greater than 0, the target traffic corresponding to the traffic application type is sent to the isolated environment corresponding to the adapted sandbox number, and the number of adapted sandboxes is updated;

[0036] When the number of adapted sandboxes is equal to 0, the corresponding similar sandbox number and the number of similar sandboxes are searched from the preset similarity database based on the adapted sandbox number;

[0037] When the number of similar sandboxes is greater than 0, the target traffic corresponding to the traffic application type is sent to the isolation environment corresponding to the similar sandbox number, and the number of similar sandboxes is updated;

[0038] When the number of similar sandboxes is equal to 0, continue to search for the corresponding similar sandbox number and similar sandbox number;

[0039] After obtaining the virtual behavior, the number of adaptive sandboxes or similar sandboxes is updated in reverse.

[0040] By adopting the above technical solution, when using the sandbox, the same type of sandbox is used as much as possible to quickly and accurately obtain the corresponding results, thereby improving the accuracy and efficiency of using the sandbox.

[0041] Optional methods for the firewall to take protective actions when flagged as potential threats and advanced threats include:

[0042] Analyze the target traffic to obtain the target traffic label;

[0043] Determine the importance of target traffic based on target traffic labels;

[0044] When the importance of the target traffic is greater than the preset critical importance, the allowed traffic type is determined based on the preset whitelist rules;

[0045] Based on the preset purpose requirements, the target traffic is disassembled to obtain the target traffic type and the additional traffic type;

[0046] When the destination traffic type matches the allowed traffic type, the firewall passes the traffic corresponding to the destination traffic type.

[0047] When the destination traffic type does not match the allowed traffic type, the firewall intercepts the traffic corresponding to the destination traffic type;

[0048] When the importance of target traffic is less than the critical importance, the firewall will intercept the target traffic.

[0049] By adopting the above technical solution, when key information is contained inside, it is necessary to filter the traffic, pass some allowed traffic, and intercept some not allowed traffic, thereby ensuring that key information can be passed while ensuring the security of the system.

[0050] Optionally, when the destination traffic type does not match the allowed traffic type, the method for intercepting traffic corresponding to the destination traffic type includes:

[0051] Sending target traffic to an isolated environment and obtaining virtual behavior, and defining the virtual behavior as an important virtual behavior;

[0052] Determine the degree of virtual destruction based on important virtual behaviors and purpose requirements;

[0053] When the virtual damage level is the preset irrelevant damage level, the firewall passes the traffic corresponding to the destination traffic type;

[0054] When the virtual damage level is the preset serious damage level, the firewall intercepts the traffic corresponding to the destination traffic type.

[0055] By adopting the above technical solution, when the target traffic is quite important and there may be threats in the target, the threat level is determined in combination with sandbox simulation. If the damage caused does not involve important files, entry is allowed. If it is relatively important, entry is still not allowed, thereby improving the intelligence and flexibility of the target traffic entering the system.

[0056] Optionally, another method for intercepting traffic corresponding to the destination traffic type when the destination traffic type does not match the allowed traffic type is included, the method comprising:

[0057] Finding a preset existing clean backup from a preset reserve database based on the target traffic type;

[0058] When an existing clean backup exists, the traffic corresponding to the destination traffic type is passed and the actual degree of damage is determined;

[0059] Restore the existing clean backup when the actual damage level is significant;

[0060] If the actual damage level is irrelevant, no operation will be performed.

[0061] By using the above technical solutions, if there is a clean backup, consider restoring the affected data and system configuration from the backup, but make sure that the backup itself is not contaminated.

[0062] In a second aspect, the present application provides a cloud firewall security protection system, which adopts the following technical solutions:

[0063] A cloud firewall security protection system, comprising:

[0064] An acquisition module is used to acquire target traffic, virtual behavior, pre-usage rate and utilization rate;

[0065] A memory, used to store a program of a control method of any of the above-mentioned cloud firewall security protection methods;

[0066] The program in the processor memory can be loaded and executed by the processor and implement the control method of any of the above-mentioned cloud firewall security protection methods.

[0067] By adopting the above technical solutions, DPI technology is combined with firewall technology to analyze unknown traffic at the application layer to dynamically identify potential threats, and at the same time feedback is given to the firewall to take timely measures. DPI technology enhances the functions of traditional firewalls and provides more sophisticated and intelligent traffic analysis capabilities. The two together build a powerful border defense system. This combination not only improves the recognition rate of known threats, but also enhances the detection and response capabilities to unknown or complex attack patterns.

[0068] In the third aspect, the present application provides a smart terminal, which adopts the following technical solution:

[0069] The intelligent terminal includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute any of the above-mentioned cloud firewall security protection methods.

[0070] By adopting the above technical solutions, DPI technology is combined with firewall technology to analyze unknown traffic at the application layer to dynamically identify potential threats, and at the same time feedback is given to the firewall to take timely measures. DPI technology enhances the functions of traditional firewalls and provides more sophisticated and intelligent traffic analysis capabilities. The two together build a powerful border defense system. This combination not only improves the recognition rate of known threats, but also enhances the detection and response capabilities to unknown or complex attack patterns.

[0071] Fourthly, the present application provides a computer storage medium that can store corresponding programs and has the characteristics of fast interaction with memory big data.

[0072] Computer readable storage medium, using the following technical solution:

[0073] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any of the above-mentioned cloud firewall security protection methods.

[0074] By adopting the above technical solutions, DPI technology is combined with firewall technology to analyze unknown traffic at the application layer to dynamically identify potential threats, and at the same time feedback is given to the firewall to take timely measures. DPI technology enhances the functions of traditional firewalls and provides more sophisticated and intelligent traffic analysis capabilities. The two together build a powerful border defense system. This combination not only improves the recognition rate of known threats, but also enhances the detection and response capabilities to unknown or complex attack patterns.

[0075] In summary, the present application includes at least the following beneficial technical effects:

[0076] By combining DPI technology with firewall technology, not only the recognition rate of known threats is improved, but also the detection and response capabilities for unknown or complex attack patterns are enhanced;

[0077] Traffic is placed in a sandbox for simulation to obtain expected behavior. On the one hand, this prevents unknown threats from entering the system and causing attacks. On the other hand, if it is not a threat, learning is performed to improve self-learning capabilities.

[0078] If a clean backup is available, consider restoring the affected data and system configuration from the backup, but make sure the backup itself is not contaminated. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 It is a flow chart of a cloud firewall security protection method in an embodiment of the present application.

[0080] Figure 2 It is a flowchart of a method for sending target traffic to an isolated environment in an embodiment of the present application.

[0081] Figure 3 It is a flowchart of a method for sending target traffic to an isolated environment when the total usage rate is less than the high load critical rate in an embodiment of the present application.

[0082] Figure 4 It is a flowchart of a method for a firewall to take protective actions when a threat is marked as a potential threat or a high-level threat in an embodiment of the present application.

[0083] Figure 5 It is a flowchart of a method for intercepting traffic corresponding to a destination traffic type when the destination traffic type and the allowed traffic type do not match in an embodiment of the present application.

[0084] Figure 6 It is a flowchart of another method for intercepting traffic corresponding to a destination traffic type when the destination traffic type and the allowed traffic type do not match in an embodiment of the present application.

[0085] Figure 7 It is a system module diagram of a cloud firewall security protection method in an embodiment of the present application. DETAILED DESCRIPTION

[0086] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1-Figure 7 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0087] The present application embodiment discloses a cloud firewall security protection method. Figure 1 , a cloud firewall security protection method includes:

[0088] Step 100: Obtain target traffic.

[0089] The target traffic is the traffic that is about to enter the system. The acquisition method is to intercept the target traffic before it enters the system through communication.

[0090] Step 101: Analyze the target traffic based on the preset DPI technology to obtain the traffic application type and traffic behavior activity.

[0091] DPI (Deep Packet Inspection) is a network packet filtering technology that can inspect the content of packets passing through the network, not just based on information such as source address, destination address or port number. DPI can view data at the application layer, so it can identify specific applications, protocols and content types, and can even read the content of traffic before encryption in some cases. Traffic application type is the content type of traffic application. Traffic behavior activity is the application behavior of the traffic. The analysis method is DPI technology can decode and understand multiple application layer protocols (such as HTTP, HTTPS, FTP, SMTP, etc.) to identify specific application behavior or abnormal activities. For example, it can distinguish between legitimate web browsing and potentially malicious web requests. DPI systems can learn and establish "normal" communication patterns as a baseline, and use machine learning algorithms to identify behaviors that deviate from these patterns. When unusual traffic patterns are detected, the system will trigger an alarm to indicate possible security incidents.

[0092] Step 102: Compare the traffic application type with the threat signature in the threat signature library updated in real time.

[0093] The threat signature database is a database with signatures for different types of threats. The internal signatures are created based on the attack patterns discovered before. Threat signatures are signatures for different types of threats. Once a received data packet matches a signature, it can be immediately identified as an attack of that type.

[0094] Step 103: When the match is successful, the target traffic is marked as a preset potential threat.

[0095] Potential threats may not have started to attack yet, but once they enter the system, it is unknown when an attack will occur. It is known that there is a threat inside, but it is not clear how to deal with it yet.

[0096] If the match is successful, it indicates that the corresponding attack is confirmed and can be marked as a potential threat.

[0097] Step 104: When the matching fails, the corresponding normal behavior is searched from a preset normal database based on the traffic application type.

[0098] Normal behavior refers to the normal behavior of the traffic corresponding to the traffic application type in the system. The establishment of the database is done by the staff in this field to identify and record the behavior of the normal traffic corresponding to the traffic application type when it is put into the system. When the system receives the corresponding traffic application type, it automatically finds the corresponding traffic application type from the database and outputs it. When the match is unsuccessful, it means that no threat has been found on the surface for the time being, and further analysis can be performed, for example: on traffic activities.

[0099] Step 105: Match based on traffic behavior activities and normal behaviors.

[0100] The matching method can be to match the results brought about by the behavior, or to match the way the behavior is manifested.

[0101] Step 106: No operation is performed when the match is successful.

[0102] If the match is successful, it indicates normal behavior and no operation is required.

[0103] Step 107: When the match fails, a preset deep behavior analysis is performed to mark the target traffic as a preset high-level threat.

[0104] Deep behavioral analysis involves a variety of technologies and methods, aiming to determine whether it involves zero-day attacks or other advanced persistent threats (APTs) by tracking and analyzing the time series characteristics, access frequency, connection patterns, etc. of traffic, including: data collection and preprocessing, including feature extraction, denoising and normalization of data; time series analysis, trend analysis and burst detection; behavioral modeling and baseline establishment; correlation analysis; context-aware analysis, etc. Through the above multi-level and multi-angle analysis methods, the DPI system can more accurately identify those traffic that are not directly marked as threats but show abnormal behavior, and timely warn and take corresponding measures to effectively deal with zero-day attacks and other advanced persistent threats (APTs). The key is to make comprehensive use of various technologies and tools, continuously optimize and improve the analysis process, and maintain a high degree of sensitivity and rapid response capabilities to new threats.

[0105] Advanced threats are more advanced, more lurking, and less easily detected than potential threats.

[0106] Step 108: When no traffic behavior activity is analyzed, the target traffic is sent to a preset isolation environment and the target traffic is executed, and virtual behavior is obtained.

[0107] The isolated environment is an independent environment isolated from the system. This environment simulates the configuration of the target system as much as possible, including the operating system version, applications, and services, so that the virus can accurately reflect the behavior of potential threats. It can also simulate specific network conditions, such as DNS servers, HTTP proxies, etc., so that the malware thinks it is running in a real network environment.

[0108] Virtual behavior refers to the behavior that target traffic exhibits after being allowed in an isolated environment.

[0109] If no traffic behavior activities are analyzed, it means that no results can be obtained through deep behavior analysis. Therefore, sandbox analysis can be used to observe its behavior when running in a controlled environment and capture any abnormal actions, such as file creation, registry modification, network connection attempts, etc.

[0110] Step 109: Matching is performed based on the virtual behavior and the normal behavior.

[0111] The matching method is similar to step 105 and will not be described in detail here.

[0112] Step 110: When the match is successful, a mapping relationship is formed between the target traffic and the virtual behavior and stored.

[0113] The mapping relationship is the association between the target traffic and the virtual behavior. If the match is successful, it means that although the traffic behavior activity has not been identified at this time, it is expected that the behavior generated by the target traffic even if it enters the system is normal behavior. Therefore, the traffic behavior activity is stored as a virtual behavior by default, so that when the target traffic is identified in the subsequent process, the corresponding virtual behavior can be automatically found and output as a traffic behavior activity.

[0114] Step 111: When the matching fails, the target traffic is marked as a high-level threat.

[0115] If the match fails, it means that the behavior after simulation is not normal at this time. By default, it is an abnormal and suspicious file or code, and is marked as an advanced threat.

[0116] Step 112: The firewall takes a preset protection action when the threat is marked as a potential threat or an advanced threat.

[0117] Protection actions are actions taken to protect against viruses, including blocking connections, redirecting traffic to a honeypot environment, limiting the rate, or completely denying service.

[0118] When there is a threat, whether it is a potential threat or an advanced threat, then DPI technology is combined with other network security tools (such as firewalls, intrusion detection / prevention systems IDS / IPS, anti-virus software, etc.) to form a multi-layer defense mechanism. In this way, even if there is a problem in one link, other lines of defense can play a complementary role and reduce the impact of false alarms.

[0119] Reference Figure 2 , methods for sending target traffic to an isolated environment include:

[0120] Step 200: Obtain the pre-utilization rate and the utilization rate of the isolation environment.

[0121] The pre-usage rate is the usage rate that is ready to be used. The used rate is the usage rate that has been used. It is calculated by the system directly based on the capacity of the isolated environment, the capacity of the isolated environment that simulates the system and observes the traffic behavior during use, and the number of isolated environments that need to be entered for simulation because the traffic behavior activities cannot be determined. For example, the number of isolated environments that simulate the system and observe the traffic behavior during use is divided by the number of isolated environments to obtain the used rate. The capacity of the isolated environment that cannot be determined and needs to be entered for simulation is divided by the capacity of the isolated environment to obtain the pre-usage rate.

[0122] Step 201: Calculate the total usage rate based on the pre-usage rate and the used rate.

[0123] The total utilization rate is the sum of the pre-utilization rate and the actual utilization rate. The calculation method is to add the two.

[0124] Step 202: Determine the traffic priority based on the target traffic when the total usage rate is greater than the preset high load critical rate.

[0125] Traffic priority is the priority of traffic, which can be set by preset rules or determined in combination with the context.

[0126] The high load critical rate is the critical value of the high load. When this value is exceeded, it means that the overall load is high and the priority traffic needs to be tested.

[0127] Step 203: Sort the target traffic based on the traffic priority to obtain a target traffic priority order.

[0128] The target traffic priority is the order obtained after the target traffic is sorted. Here, the higher the priority, the higher the order, and the lower the priority, the lower the order.

[0129] Step 204: Determine the priority target traffic based on the high load critical rate and the target traffic priority order.

[0130] Priority target traffic is the traffic that is prioritized for sandbox simulation testing. Determination method: First multiply the high load critical rate by the capacity of the isolated environment, then subtract the used rate multiplied by the number of isolated environments to get the capacity corresponding to the priority target traffic. Then extract it according to the priority order of the target traffic.

[0131] Step 205: Send the priority target traffic to the isolated environment and update the usage rate in real time.

[0132] Sending priority target traffic to an isolated environment makes it approach the high load critical rate and reach saturation. Then, the purpose of updating the utilization rate in real time is to monitor the utilization rate in real time so that it does not exceed the high load critical rate.

[0133] Step 206: Send the target traffic to the isolated environment when the total usage rate is less than the high load critical rate.

[0134] When the total usage rate is less than the high load critical rate, it means that even if all target traffic is put into the simulation, there will be no overage, so all target traffic can be safely sent to the isolated environment.

[0135] Reference Figure 3 , methods for sending target traffic to an isolated environment when the total usage rate is less than the high load critical rate include:

[0136] Step 300: Based on the traffic application type, the corresponding adaptation sandbox number and the number of adaptation sandboxes are found from a preset adaptation database.

[0137] The adaptation sandbox number is the number of the sandbox that can respond quickly to the traffic application type. The purpose of the number is to be able to quickly identify which number it is. The number of adaptation sandboxes is the number of idle sandboxes corresponding to the adaptation sandbox number, and it will be automatically updated when it is no longer idle. The database stores the mapping relationship between traffic application types, adaptation sandbox numbers, and the number of adaptation sandboxes. When designing the sandbox, the staff in this field number each sandbox type, and then place all the traffic of different traffic application types into the sandbox for simulation observation, and find that the traffic application type with the greatest adaptability and the sandbox number form a mapping relationship, and then update the corresponding number in real time in the actual process and store it in the database. When the system receives the corresponding traffic application type, it automatically finds the corresponding adaptation sandbox number and the number of adaptation sandboxes from the database for output.

[0138] Step 301: When the number of adaptation sandboxes is greater than 0, the target traffic corresponding to the traffic application type is sent to the isolation environment corresponding to the adaptation sandbox number, and the number of adaptation sandboxes is updated.

[0139] When the number of adaptation sandboxes is greater than 0, it means that there are still sandboxes corresponding to the idle adaptation sandbox numbers, and the target traffic corresponding to the traffic application type can be put in for simulation.

[0140] Step 302: When the number of adapted sandboxes is equal to 0, the corresponding similar sandbox number and the number of similar sandboxes are searched from a preset similarity database based on the adapted sandbox number.

[0141] The similar sandbox number is the number of the sandbox that is similar to the adaptation sandbox number, where the similarity means that the function and environment are as close as possible. The number of similar sandboxes is the number of free sandboxes corresponding to the similar sandbox number, which will be automatically updated when it is no longer free. The mapping relationship between the adaptation sandbox number, the similar sandbox number and the number of similar sandboxes is stored in the database. The staff in this field associates the two sandboxes with similar functions and environments during the observation and use of the sandbox, and then updates the corresponding number in real time during the actual process. When the system receives the corresponding adaptation sandbox number, it automatically finds the corresponding similar sandbox number and the number of similar sandboxes from the database for output.

[0142] When the number of adapted sandboxes is equal to 0, it means that there is no fully adapted sandbox for simulating the target traffic corresponding to the traffic application type. At this time, only similar sandboxes can be used for simulation.

[0143] Step 303: When the number of similar sandboxes is greater than 0, the target traffic corresponding to the traffic application type is sent to the isolation environment corresponding to the similar sandbox number, and the number of similar sandboxes is updated.

[0144] When the number of similar sandboxes is greater than 0, it means that there are still sandboxes corresponding to the idle similar sandbox numbers, and the target traffic corresponding to the traffic application type can be put in for simulation.

[0145] Step 304: When the number of similar sandboxes is equal to 0, continue to search for the corresponding similar sandbox number and the number of similar sandboxes.

[0146] When the number of similar sandboxes is equal to 0, it means that similar sandboxes have been found, but the corresponding number is 0, that is, they are all in use, so you can find a new similar sandbox. It should be noted here that there is more than one similar sandbox, so when the number of one is insufficient, find a new one.

[0147] Step 305: After obtaining the virtual behavior, the number of adapted sandboxes or the number of similar sandboxes is updated in reverse.

[0148] After the virtual behavior is obtained, it means that the sandbox has been used up. In this case, the number of adapted sandboxes or similar sandboxes should be increased by one.

[0149] Reference Figure 4 The methods by which the firewall takes protective actions when flagged as potential threats and advanced threats include:

[0150] Step 400: Analyze the target traffic to obtain a target traffic label.

[0151] The target traffic label is the label attached to the target traffic. The analysis method is to directly extract the corresponding label.

[0152] Step 401: Determine the importance of target traffic based on the target traffic label.

[0153] The target traffic importance is the importance of the target traffic. The determination method here can be a method of searching a database, for example: the database contains a mapping relationship between the target traffic label and the target traffic importance. After clarifying the importance of each target traffic, the staff in this field attaches the corresponding label under the rules set by themselves and then associates it. When the system receives the corresponding target traffic label, it automatically searches for the corresponding target traffic importance from the database and outputs it.

[0154] Step 402: Determine the allowed traffic type based on a preset whitelist rule when the target traffic importance is greater than a preset critical importance.

[0155] The critical importance is the importance of the dividing line between important and unimportant, that is, if it exceeds this importance, it is relatively important, and if it is less than this importance, it is not very important. The comparison method here is numerical comparison, that is, the numerical value corresponding to the target flow importance is compared with the numerical value corresponding to the critical importance.

[0156] The allowed traffic type is the traffic type that is allowed to enter the system. The whitelist rule is that those in the whitelist can be released without confirming whether there are threats inside, while those not in the whitelist need to be confirmed. The confirmation method is to filter the content in the whitelist.

[0157] Step 403: Decompose the target traffic based on the preset purpose requirement to obtain the purpose traffic type and the additional traffic type.

[0158] The destination requirement is the required traffic type. The method of disassembly is to disassemble the content in the target traffic according to the traffic type, and then match it with the destination requirement. If the match is successful, it is the destination traffic type. If the match is unsuccessful, it is the additional traffic type.

[0159] Step 404: When the destination traffic type matches the allowed traffic type, the firewall passes the traffic corresponding to the destination traffic type.

[0160] When the destination traffic type matches the allowed traffic type, it means that the traffic corresponding to the destination traffic type belongs to the whitelist, and the firewall will pass the traffic corresponding to the destination traffic type.

[0161] Step 405: When the destination traffic type does not match the allowed traffic type, the firewall intercepts the traffic corresponding to the destination traffic type.

[0162] If the destination traffic type does not match the allowed traffic type, it means that it does not belong to the whitelist and needs to be intercepted.

[0163] Step 406: When the importance of the target traffic is less than the critical importance, the firewall intercepts the target traffic.

[0164] When the target traffic importance is less than the critical importance, it means that the target traffic is not important and dispensable, and can be directly intercepted.

[0165] Reference Figure 5 , when the destination traffic type and the allowed traffic type do not match, the method for intercepting the traffic corresponding to the destination traffic type includes:

[0166] Step 500: Send target traffic to an isolated environment and obtain virtual behavior, and define the virtual behavior as an important virtual behavior.

[0167] Step 501: Determine the degree of virtual destruction based on important virtual behaviors and purpose requirements.

[0168] The virtual damage degree is the degree of damage to the target demand caused by the important virtual behavior. The determination method here is the simulation method, and then observe whether the result affects the target demand in the end.

[0169] Step 502: When the virtual damage level is a preset irrelevant damage level, the firewall passes the traffic corresponding to the destination traffic type.

[0170] The irrelevant damage level is the level that has no impact on the target demand. When the virtual damage level is irrelevant damage level, it means that although it is a threat, it has no impact on the target demand, and the firewall can pass the traffic corresponding to the target traffic type.

[0171] Step 503: When the virtual damage level is a preset important damage level, the firewall intercepts the traffic corresponding to the destination traffic type.

[0172] The critical damage level is the level of significant impact on the target demand. If the virtual damage level is critical damage level, it means that if the threat enters the system, it will not only damage the system, but also fail to achieve the target demand. Therefore, the firewall will intercept the traffic corresponding to the target traffic type.

[0173] Reference Figure 6 , and also includes another method for intercepting traffic corresponding to the destination traffic type when the destination traffic type and the allowed traffic type do not match, the method comprising:

[0174] Step 600: Find a preset existing clean backup from a preset reserve database based on the target traffic type.

[0175] The existing clean backup is a backup of the data of the target traffic type. The mapping relationship between the target traffic type and the existing clean backup is stored in the database. It is obtained by the staff in this field after automatically associating the backup and the target traffic type updated in real time in the current system. When the system receives the corresponding target traffic type, it automatically finds the corresponding existing clean backup from the database for output.

[0176] Step 601: When an existing clean backup exists, traffic corresponding to the target traffic type is passed and the actual damage degree is determined.

[0177] The actual degree of damage is the degree of damage caused by allowing the traffic corresponding to the destination traffic type to pass through and enter the system. It is evaluated by the system itself.

[0178] When a clean backup exists, it means that even if the system is damaged, there is still a backup that can cover the current system and restore it to its original state, so the traffic corresponding to the destination traffic type is passed.

[0179] Step 602: When the actual damage level is a major damage level, restore the existing clean backup.

[0180] When the actual damage degree is a major damage degree, it means that major damage has been caused. Although the target traffic is allowed to enter to achieve the desired purpose, the damage degree is too high. If you want to stop the loss in time, use the existing clean backup for recovery.

[0181] Step 603: Do not perform any operation when the actual damage level is an irrelevant damage level.

[0182] When the actual damage degree is an irrelevant damage degree, it means that no damage is actually caused, and no measures are taken after the traffic corresponding to the destination traffic type passes.

[0183] Based on the same inventive concept, an embodiment of the present invention provides a cloud firewall security protection system.

[0184] Reference Figure 7 , a cloud firewall security protection system, comprising:

[0185] An acquisition module is used to acquire target traffic, virtual behavior, pre-usage rate and utilization rate;

[0186] A memory for storing a program of a control method of a cloud firewall security protection method;

[0187] The program in the processor memory can be loaded and executed by the processor to implement a control method of a cloud firewall security protection method.

[0188] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0189] An embodiment of the present invention provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed by a cloud firewall security protection method.

[0190] Computer storage media include, for example, various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0191] Based on the same inventive concept, an embodiment of the present invention provides an intelligent terminal, including a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute a cloud firewall security protection method.

[0192] The above are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in this specification (including the abstract and drawings), unless otherwise stated, can be replaced by other equivalent or alternative features with similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. A cloud firewall security protection method, characterized in that: include: Get target traffic; Analyze the target traffic based on the preset DPI technology to obtain the traffic application type and traffic behavior activities; Compare the threat signatures based on traffic application type and the threat signature library updated in real time; When a match is successful, the target traffic is marked as a preset potential threat; When the match fails, the corresponding normal behavior is found from the preset normal database based on the traffic application type; Matching based on traffic behavior activities and normal behavior; No operation is performed when the match is successful; If the match fails, a preset deep behavior analysis is performed to mark the target traffic as a preset advanced threat. The firewall takes pre-set protection actions when flagged as potential threats and advanced threats; When no traffic behavior activity is analyzed, the target traffic is sent to a preset isolation environment and the target traffic is executed, and virtual behavior is obtained; Matching based on virtual and normal behavior; When the match is successful, a mapping relationship between the target traffic and the virtual behavior is formed and stored; Mark the target traffic as an advanced threat if the match fails; Among them, the method for sending the target traffic to the isolated environment includes: obtaining the pre-usage rate and the used rate of the isolated environment; calculating the total usage rate based on the pre-usage rate and the used rate; determining the traffic priority based on the target traffic when the total usage rate is greater than the preset high load critical rate; sorting the target traffic based on the traffic priority to obtain the target traffic priority order; determining the priority target traffic based on the high load critical rate and the target traffic priority order; sending the priority target traffic to the isolated environment and updating the used rate in real time; sending the target traffic to the isolated environment when the total usage rate is less than the high load critical rate.

2. A cloud firewall security protection method according to claim 1, characterized in that: Methods for sending target traffic to an isolated environment when the total usage rate is less than the high load threshold rate include: Based on the traffic application type, the corresponding adaptation sandbox number and the number of adaptation sandboxes are found from the preset adaptation database; When the number of adapted sandboxes is greater than 0, the target traffic corresponding to the traffic application type is sent to the isolated environment corresponding to the adapted sandbox number, and the number of adapted sandboxes is updated; When the number of adapted sandboxes is equal to 0, the corresponding similar sandbox number and the number of similar sandboxes are searched from the preset similarity database based on the adapted sandbox number; When the number of similar sandboxes is greater than 0, the target traffic corresponding to the traffic application type is sent to the isolation environment corresponding to the similar sandbox number, and the number of similar sandboxes is updated; When the number of similar sandboxes is equal to 0, continue to search for the corresponding similar sandbox number and similar sandbox number; After obtaining the virtual behavior, the number of adaptive sandboxes or similar sandboxes is updated in reverse.

3. A cloud firewall security protection method according to claim 1, characterized in that: The methods by which the firewall takes protective action when flagged as potential and advanced threats include: Analyze the target traffic to obtain the target traffic label; Determine the importance of target traffic based on target traffic labels; When the importance of the target traffic is greater than the preset critical importance, the allowed traffic type is determined based on the preset whitelist rules; Based on the preset purpose requirements, the target traffic is disassembled to obtain the target traffic type and the additional traffic type; When the destination traffic type matches the allowed traffic type, the firewall passes the traffic corresponding to the destination traffic type. When the destination traffic type does not match the allowed traffic type, the firewall intercepts the traffic corresponding to the destination traffic type; When the importance of target traffic is less than the critical importance, the firewall will intercept the target traffic.

4. A cloud firewall security protection method according to claim 3, characterized in that: When the destination traffic type does not match the allowed traffic type, the method of intercepting the traffic corresponding to the destination traffic type includes: Sending target traffic to an isolated environment and obtaining virtual behavior, and defining the virtual behavior as an important virtual behavior; Determine the degree of virtual destruction based on important virtual behaviors and purpose requirements; When the virtual damage level is the preset irrelevant damage level, the firewall passes the traffic corresponding to the destination traffic type; When the virtual damage level is the preset serious damage level, the firewall intercepts the traffic corresponding to the destination traffic type.

5. A cloud firewall security protection method according to claim 4, characterized in that: Also included is another method for intercepting traffic corresponding to a destination traffic type when the destination traffic type does not match the allowed traffic type, the method comprising: Finding a preset existing clean backup from a preset reserve database based on the target traffic type; When an existing clean backup exists, the traffic corresponding to the target traffic type is passed and the actual degree of damage is determined; Restore the existing clean backup when the actual damage level is significant; If the actual damage level is irrelevant, no operation will be performed.

6. A cloud firewall security protection system, characterized in that: include: An acquisition module is used to acquire target traffic, virtual behavior, pre-usage rate and utilization rate; A memory, used to store a program of a control method of a cloud firewall security protection method according to any one of claims 1 to 5; The program in the processor memory can be loaded and executed by the processor and implement a control method for a cloud firewall security protection method as described in any one of claims 1 to 5.

7. Intelligent terminal, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executes a cloud firewall security protection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that A computer program is stored which can be loaded by a processor and execute a cloud firewall security protection method as described in any one of claims 1 to 5.

Images