Firewall rule self-learning method and device, electronic equipment and storage medium

Abstract

The invention discloses a firewall rule self-learning method and device, electronic equipment and a storage medium, and belongs to the technical field of information security, and the method comprises the steps: determining an IP segment activity record table in a preset time period in a historical activity log according to a firewall blacklist; determining an IP number threshold value and a continuous attack number threshold value according to the number of IP addresses in the IP segment activity record table and the continuous attack number, and generating an initial rule; the method comprises the following steps: acquiring a real-time activity log in a preset time period, automatically banning an IP section meeting an initial rule in the real-time activity log, determining a ratio of the number of automatically banned IP addresses in the preset time period to the number of access IPs in a corresponding time period, adjusting the initial rule according to the ratio, generating an iteration rule, and sending the iteration rule to a server. And continuing to monitor the real-time network flow according to the iteration rule. According to the method and the device, the firewall rule is adjusted by analyzing and counting the blocked IP segment, so that the self-learning adjustment of the firewall rule is realized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a firewall rule self-learning method, device, electronic equipment and storage medium. Background Art

[0002] With the popularization of the Internet and the advent of the digital age, network security issues have become increasingly prominent. As the first line of defense for network security, the importance of firewalls is self-evident. Firewall rules are the basis for firewalls to implement security strategies. By formulating sophisticated rules, firewalls can monitor, control, and even block the transmission of network traffic, thereby protecting the network from unauthorized access and attacks.

[0003] In the prior art, suspicious IP addresses are automatically blocked based on real-time monitoring and analysis of network traffic. Common methods include intrusion detection systems (IDS) and intrusion prevention systems (IPS). These systems can monitor network traffic in real time, analyze the content and behavior of data packets, and automatically block suspicious IP addresses according to preset security policies. However, this method lacks flexibility and real-time performance, and requires a certain amount of time to analyze and judge. In addition, due to the complexity and variability of the network environment, the blocking rules cannot be updated at any time according to the network environment.

[0004] Therefore, there is an urgent need for a firewall rule self-learning method that can block the corresponding IP segment in real time according to the blocking rules at the early stage of the attack, and continuously update the rules through self-learning methods, thereby achieving flexibility and real-time monitoring of network traffic. Summary of the invention

[0005] In view of this, it is necessary to provide a firewall rule self-learning method, device, electronic device and storage medium, which can block the corresponding IP segment in real time according to the blocking rules at the early stage of the attack, and continuously update the rules through self-learning methods, thereby achieving flexibility and real-time monitoring of network traffic.

[0006] In order to achieve the above object, on the one hand, the present invention provides a firewall rule self-learning method, comprising: According to the IP addresses in the firewall blacklist, determine the IP segment activity record table for the preset time period in the historical activity log; Determine the IP quantity threshold and the continuous attack number threshold according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, and generate initial rules; Monitor real-time network traffic, automatically block IP segments in real-time network traffic that meet the initial rules, determine the ratio of the number of automatically blocked IP addresses within a preset time period to the number of access IP addresses within the corresponding time period, adjust the initial rules according to the ratio, generate iterative rules, and continue to monitor real-time network traffic according to the iterative rules.

[0007] In a possible implementation, based on the IP addresses in the firewall blacklist, an IP segment activity record table for a preset time period in the historical activity log is determined, including: Get the blacklist list and historical activity log in the firewall rules; Determine the historical activity log of each IP address according to the IP addresses and historical activity logs in the blacklist; Filtering out the activity record table before each IP address is blocked from the IP address historical activity log, and generating an IP activity record table; The IP activity record tables within a preset time period are merged according to physical areas to generate an IP segment activity record table.

[0008] In a possible implementation, the IP activity record tables within a preset time period are merged according to physical areas to generate an IP segment activity record table, including: Divide the IP activity record table according to the preset activity time period to generate IP activity record tables for multiple time periods; The IP addresses in the IP activity record table of each time period are classified according to the same physical area, and the contents of the corresponding IP activity record tables are merged to generate an IP segment activity record table.

[0009] In a possible implementation, the IP quantity threshold and the continuous attack number threshold are determined according to the number of IP addresses and the number of continuous attacks in the IP segment activity record table, and the initial rules are generated, including: Counting the number of each IP address in the IP segment activity record table, and determining an IP quantity threshold according to the number of IP addresses; Counting the number of connection attacks before each IP address is blocked in the IP segment activity record table, and determining a continuous attack number threshold according to the number of connection attacks; The IP quantity threshold, the continuous attack number threshold and the preset time period constitute the initial rule.

[0010] In one possible implementation, automatically blocking the IP segments that meet the initial rules in the real-time network traffic includes: Obtain real-time network traffic within a preset time period, and merge IP activity logs in the same physical area to generate a target IP segment activity record table; When the activity record information of a certain IP segment in the target IP segment activity record table meets the initial rule, each IP address of the IP segment is automatically blocked.

[0011] In one possible implementation, determining the ratio of the number of IP addresses automatically blocked within a preset time period to the number of accessing IP addresses within the corresponding time period includes: Count the number of IP addresses automatically blocked during a preset time period and the number of IP addresses accessing during the corresponding time period; Calculate the ratio of automatically blocked IP addresses to the number of accessing IP addresses in the corresponding time period.

[0012] In a possible implementation, the initial rule is adjusted according to the proportion to generate an iterative rule, including: When the proportion exceeds the preset proportion threshold, the continuous attack number threshold is adjusted according to the continuous attack number of each IP segment in the preset time period to generate an iterative continuous attack number threshold; When the attack type is to attack with different IP addresses, the IP quantity threshold is adjusted according to the adjusted continuous attack number threshold to generate an iterative IP quantity threshold; The initial rule is adjusted according to the iterative continuous attack number threshold and the iterative IP number threshold to generate an iterative rule.

[0013] In a second aspect, the present invention further provides a firewall rule self-learning device, comprising: An IP segment activity record table generation module is used to determine an IP segment activity record table for a preset time period in a historical activity log based on the IP addresses in the firewall blacklist; An initial rule generation module is used to determine an IP quantity threshold and a continuous attack number threshold according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, and generate an initial rule; The rule iteration module is used to monitor real-time network traffic, automatically block the IP segments in the real-time network traffic that meet the initial rules, determine the ratio of the number of automatically blocked IP addresses in a preset time period to the number of access IP addresses in the corresponding time period, adjust the initial rules according to the ratio, generate iterative rules, and continue to monitor the real-time network traffic according to the iterative rules.

[0014] In a third aspect, the present invention also provides an electronic device comprising a memory and a processor, wherein the memory is used to store programs and data; the processor is coupled to the memory, and is used to execute the program stored in the memory, to implement the firewall rule self-learning method as described above, and / or to implement the firewall rule self-learning as described above.

[0015] In a fourth aspect, the present invention further provides a computer storage medium for storing a computer-readable program or instruction, which, when executed by a processor, can implement the firewall rule self-learning method as described above.

[0016] The beneficial effects of the present invention are as follows: first, according to the IP addresses in the firewall blacklist, the IP segment activity record table of the preset time period in the historical activity log is determined; then, according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, the IP number threshold and the continuous attack number threshold are determined to generate the initial rule; finally, the real-time network traffic is monitored, the IP segments that meet the initial rule in the real-time network traffic are automatically banned, the proportion of the number of automatically banned IP addresses in the preset time period and the number of access IPs in the corresponding time period is determined, the initial rule is adjusted according to the proportion, and iterative rules are generated, and the real-time network traffic is continuously monitored according to the iterative rule. The present invention analyzes the historical activity log, sets the time threshold, the IP address number threshold and the continuous attack number threshold as the initial rule, and then according to the real-time network traffic monitoring, the IP address or IP segment address that meets the initial rule is banned in real time, so that the attacking IP is banned in real time at the initial stage of the attack, and the proportion of banned IP addresses is analyzed, and the initial rule is adjusted and updated according to the proportion of banned IP addresses, so that the banning rules are constantly adapted to the complex and changeable network environment, and the flexibility and real-time performance of network traffic monitoring are realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of an embodiment of the firewall rule self-learning method provided by the present invention; Figure 2 For the present invention Figure 1 A schematic flow chart of an embodiment of step S101; Figure 3 For the present invention Figure 2 A flowchart of an embodiment of step S204; Figure 4 For the present invention Figure 1 A schematic flow chart of an embodiment of step S102; Figure 5 For the present invention Figure 1 A schematic flow chart of a first embodiment of step S103; Figure 6For the present invention Figure 1 A schematic flow chart of a second embodiment of step S103; Figure 7 For the present invention Figure 1 A schematic flow chart of a third embodiment of step S103; Figure 8 A schematic diagram of the structure of an embodiment of a firewall rule self-learning electronic device provided by the present invention; Fig. 9 A schematic diagram of the structure of an embodiment of the firewall rule self-learning storage medium provided by the present invention. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0020] In the description of the embodiments of the present invention, unless otherwise specified, "multiple" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone.

[0021] The descriptions of "first", "second", etc. involved in the embodiments of the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" or "second" may explicitly or implicitly include at least one of the features.

[0022] Reference to an "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0023] The present invention provides a firewall rule self-learning method, device, electronic device and storage medium, which are described below respectively.

[0024] Figure 1 A flowchart of an embodiment of the firewall rule self-learning method provided by the present invention is shown as follows: Figure 1 As shown, the firewall rule self-learning method includes: S101, according to the IP addresses in the firewall blacklist, determine the IP segment activity record table of the preset time period in the historical activity log; S102, determining an IP quantity threshold and a continuous attack number threshold according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, and generating an initial rule; S103, monitor the real-time network traffic, automatically block the IP segments in the real-time network traffic that meet the initial rules, determine the ratio of the number of automatically blocked IP addresses in a preset time period to the number of access IP addresses in the corresponding time period, adjust the initial rules according to the ratio, generate iterative rules, and continue to monitor the real-time network traffic according to the iterative rules.

[0025] Specifically, in this embodiment, the firewall will record all network traffic passing through it, including source IP address, destination IP address, port number, timestamp and other information. The blacklist list is read through the management interface or script tool of the firewall. The blacklist list of the firewall will contain IP addresses that are prohibited from access, and the changes in the list are monitored by polling or event triggering. The historical activity log includes the firewall log, the security management system log, etc. The activity log corresponding to the IP address in the blacklist list is extracted from the historical activity log, and the IPs in the same physical area are merged to obtain the IP segment activity record table; the activity mode of the IP in the IP segment activity record table before the ban is analyzed, the rules for banning IP are found, the IP quantity threshold and the continuous attack number threshold are formulated, and the initial rules are generated. Finally, the network traffic analysis tool is used to monitor the network traffic in real time, and the rule matching or machine learning algorithm is used to identify the activities that match the initial rules. Once the matching activity is identified, the corresponding IP or IP segment is automatically banned, and at the same time, the IP ban notification is sent to the system administrator.

[0026] This embodiment determines the IP segment activity record table of the preset time period in the historical activity log according to the IP addresses in the firewall blacklist; determines the IP number threshold and the continuous attack number threshold according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, and generates the initial rule; monitors the real-time network traffic, automatically blocks the IP segments that meet the initial rule in the real-time network traffic, counts the number of IP addresses automatically blocked in each preset time period and the proportion of the number of access IPs in the corresponding time period at the specified time point, adjusts the initial rule according to the proportion, generates the iteration rule, and continues to monitor the real-time network traffic according to the iteration rule. The present invention analyzes the historical activity log, sets the time threshold, the IP address number threshold and the contact attack number threshold as the initial rule, and then according to the real-time network traffic monitoring, blocks the IP address or IP segment address that meets the initial rule in real time, thereby blocking the attacking IP in real time at the initial stage of the attack, and analyzes the proportion of the blocked IP address, and adjusts and updates the initial rule according to the proportion of the blocked IP address, so that the blocking rule constantly adapts to the complex and changeable network environment, and realizes the flexibility and real-time performance of network traffic monitoring.

[0027] This embodiment blocks the corresponding IP segment in real time at the initial stage of the attack according to the blocking rules, and continuously updates the rules through a self-learning method, thereby achieving flexibility and real-time monitoring of network traffic.

[0028] In some embodiments of the present invention, Figure 2 As shown, Figure 2 The present invention provides Figure 1 The flowchart of an embodiment of step S101 in the embodiment includes: S201, obtaining a blacklist and historical activity log in firewall rules; S202, determining the historical activity log of each IP address according to the IP addresses and historical activity logs in the blacklist; S203, filtering out the activity record table before each IP address is blocked from the IP address historical activity log, and generating an IP activity record table; S204: Merge the IP activity record tables within a preset time period according to the physical area to generate an IP segment activity record table.

[0029] Specifically, read the firewall's blacklist through the firewall's management interface or script tool. If the firewall supports real-time update or notification functions, you can configure the firewall to send notifications when the blacklist changes so as to obtain the latest firewall blacklist. If there is no real-time update function, you can regularly check whether the blacklist has changed, traverse each IP address in the blacklist, use scripts or database query tools to read activity records related to each IP address from firewall logs and security management system logs, and ensure that the time range of the record covers all activities before the IP address is blocked, extract key information from the log records, including the IP address of the server accessed, the type of data packet sent, the type of threat caused by the activity, the degree of threat, etc., merge each IP address and its related activity records into a record table, which should contain the following fields: IP The physical area of ​​each IP address is analyzed by using an IP geolocation database or API. For example, IP addresses in a certain city or a certain district in a certain city are grouped into one physical area. The record table is traversed to group the IP addresses according to their physical area and activity time. For IP addresses in the same physical area within a preset time period, they are merged into one IP segment. In this embodiment, the preset time period is 2 hours. For each merged IP segment, the activity records of all its member IPs are summarized. When summarizing, the activity types can be counted or summed to obtain the overall activity status of the IP segment. The summarized results are organized into a record table of IP segments and their activities. The record table should contain the following fields: IP segment, physical area, activity time window, total number of activities, counts of different types of activities, etc.

[0030] This embodiment combines the historical activity logs of the IP addresses in the blacklist by physical area, thereby providing accurate data for subsequent data analysis and improving the efficiency of data analysis.

[0031] In some embodiments of the present invention, Figure 3 As shown, Figure 3 The present invention provides Figure 2 The flowchart of an embodiment of step S204 in the embodiment includes: S301, dividing the IP activity record table according to the preset activity time period to generate multiple time period IP activity record tables; S302: Classify the IP addresses in the IP activity record table of each time period according to the same physical area, merge the contents of the corresponding IP activity record table, and generate an IP segment activity record table.

[0032] Specifically, in this embodiment, the preset time period is 2 hours, the IP activity record table is divided into 2 hours, the IP addresses in the same physical area within 2 hours are merged into one IP segment, and the activity records of each IP segment within two hours are merged to generate an IP segment activity record table.

[0033] This embodiment provides accurate data for subsequent data analysis by merging IP addresses and corresponding activity records in the same physical area within a preset time period, while improving the efficiency of data analysis.

[0034] In some embodiments of the present invention, Figure 4 As shown, Figure 4 The present invention provides Figure 1 The flowchart of an embodiment of step S102 in the embodiment includes: S401, counting the number of IP addresses in the IP segment activity record table, and determining an IP quantity threshold according to the number of IP addresses; S402, counting the number of connection attacks before each IP address is blocked in the IP segment activity record table, and determining a continuous attack number threshold according to the number of connection attacks; S403, the IP quantity threshold, the continuous attack number threshold and the preset time period constitute the initial rule.

[0035] Specifically, the number of IP addresses in each IP segment is counted from the IP segment activity record table, and the distribution and frequency of the number of addresses in each IP segment are analyzed. According to the statistical results and business needs, an IP number threshold is set. The IP number threshold can be determined by statistical methods such as the average value, median, and a certain percentage of the number of IP addresses in a time period. At the same time, the number of consecutive attacks for each IP segment or IP address is counted. The attack behavior is defined and collected through various network security devices and software (including traffic audit systems, security management systems, firewalls, etc.), and the distribution of the number of attacks is analyzed. According to the statistical results and network security policies, a continuous attack number threshold is set. The continuous attack number threshold is determined by the average value of the number of attacks, a fixed number (such as 5 consecutive attacks are considered abnormal), or other statistical methods, and an initial rule is finally generated. This initial rule is used to detect whether there are IPs exceeding the IP number threshold in the network traffic within a preset time period that are conducting attack activities exceeding the continuous attack number threshold.

[0036] This embodiment sets the IP quantity threshold and the continuous attack number threshold according to the number of times the IP address or IP segment appears before being banned within a preset time period and the number of continuous attacks, and obtains the initial ban rules. It can generate the initial ban rules based on the actual historical data and ban the IP segment at the beginning of the attack.

[0037] In some embodiments of the present invention, Figure 5As shown, Figure 5 The present invention provides Figure 1 The flowchart of the first embodiment of step S103 in FIG. 1 is to automatically block the IP segments in the real-time network traffic that meet the initial rules, including: S501, obtaining real-time network traffic within a preset time period, and merging IP activity logs in the same physical area to generate a target IP segment activity record table; S502: When the activity record information of a certain IP segment in the target IP segment activity record table meets the initial rule, each IP address of the IP segment is automatically blocked.

[0038] Specifically, use network traffic monitoring tools or APIs of network devices to collect real-time network traffic data, ensure that the collected data includes key information such as source IP, target IP, traffic size, timestamp, etc., merge and analyze IPs in the same physical area within a preset time period, and when it is found that an IP segment exceeding the IP quantity threshold has carried out attack behaviors exceeding the continuous attack number threshold, the IP segment will be banned for a certain period of time, such as a 24-hour ban, and the temporarily banned IP will be recorded for subsequent analysis of the ban results.

[0039] This embodiment monitors real-time network traffic and automatically blocks IP addresses that meet initial rules. It can block IP addresses in real time at the early stage of an attack, thereby achieving real-time monitoring of network traffic.

[0040] In some embodiments of the present invention, Figure 6 As shown, Figure 6 The present invention provides Figure 1 The flowchart of the second embodiment of step S103 in the embodiment of the present invention is to determine the ratio of the number of IP addresses automatically blocked within a preset time period to the number of accessing IP addresses within the corresponding time period, including: S601, counting the number of IP addresses automatically blocked within a preset time period and the number of accessing IP addresses within the corresponding time period; S602: Calculate the ratio of the number of automatically blocked IP addresses to the number of accessing IP addresses in the corresponding time period.

[0041] It should be noted that counting the proportion of banned IPs within a preset time period can effectively evaluate the rationality and effectiveness of the current ban rules, and analyze whether the current rules are too loose, resulting in a large number of malicious IPs not being effectively banned, or too strict, resulting in normal users being mistakenly blocked.

[0042] This embodiment uses statistics on the proportion of banned IP addresses as a basis for adjusting the initial rules, so that the banning rules can adapt to the changeable and complex network traffic environment, and achieve flexibility and real-time monitoring of network traffic.

[0043] In some embodiments of the present invention, Figure 7 As shown, Figure 7 The present invention provides Figure 1 The flowchart of the third embodiment of step S103 in the embodiment of FIG. 1 is to adjust the initial rule according to the proportion to generate the iterative rule, including: S701, when the proportion exceeds the preset proportion threshold, adjust the continuous attack number threshold according to the continuous attack number of each IP segment in the preset time period, and generate an iterative continuous attack number threshold; S702: When the attack type is to attack with different IP addresses, adjust the IP quantity threshold according to the adjusted continuous attack number threshold to generate an iterative IP quantity threshold; S702: Adjust the initial rule according to the iterative continuous attack number threshold and the iterative IP number threshold to generate an iterative rule.

[0044] It should be noted that when the proportion of banned IPs exceeds the preset proportion threshold, it means that the current rules are too strict and the ban range is too large, which may cause normal users to be blocked by mistake. The threshold of the ban rule is set too low. More dangerous operations should lead to bans. At this time, the threshold of the number of consecutive attacks needs to be increased. When the proportion of banned IPs is too small, it means that the current rules are too loose and the threshold of the number of consecutive attacks needs to be reduced. In addition, some attack methods are carried out using different IPs. At this time, it is necessary to adjust the IP quantity threshold according to the proportion of banned IPs so that the IP quantity threshold is equal to the continuous attack quantity threshold. Then, use the adjusted rules, i.e., iterative rules, to monitor real-time network traffic, and during the monitoring process, continuously adjust and update the rules according to the current proportion of banned IPs and the actual network environment.

[0045] This embodiment continuously iterates and updates the initial rules according to different attack types and blocking ratios, so that the blocking rules can adapt to the changeable and complex network traffic environment, and achieve flexibility and real-time monitoring of network traffic.

[0046] In order to better implement the firewall rule self-learning method in the embodiment of the present invention, based on the firewall rule self-learning method, correspondingly, Figure 8 As shown, the embodiment of the present invention further provides a firewall rule self-learning device 800 including: The IP segment activity record table generation module 801 is used to determine the IP segment activity record table of a preset time period in the historical activity log according to the IP addresses in the firewall blacklist; An initial rule generation module 802 is used to determine an IP quantity threshold and a continuous attack number threshold according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, and generate an initial rule; The rule iteration module 803 is used to monitor real-time network traffic, automatically block the IP segments in the real-time network traffic that meet the initial rules, determine the ratio of the number of automatically blocked IP addresses within a preset time period to the number of access IP addresses within the corresponding time period, adjust the initial rules according to the ratio, generate iterative rules, and continue to monitor the real-time network traffic according to the iterative rules.

[0047] The firewall rule self-learning device 800 provided in the above embodiment can implement the technical solution described in the above firewall rule self-learning method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above firewall rule self-learning method embodiment, which will not be repeated here.

[0048] In the embodiment of the present invention, the firewall rule self-learning device may be an independent server, or a server network or server cluster composed of servers. For example, the firewall rule self-learning device described in the embodiment of the present invention includes but is not limited to a computer, a network host, a single network server, a plurality of network server sets or a cloud server composed of a plurality of servers. The cloud server is composed of a large number of computers or network servers based on cloud computing.

[0049] The present invention also provides a firewall rule self-learning electronic device, such as Fig. 9 As shown, Fig. 9 This is a structural block diagram of an embodiment of a firewall rule self-learning device provided by the present invention. The firewall rule self-learning device 900 can be a computing device such as a mobile terminal, a desktop computer, a notebook, a PDA, and a server. The firewall rule self-learning device 900 includes a processor 901 and a memory 902, wherein the memory 902 stores a firewall rule self-learning program 903.

[0050] In some embodiments, the memory 902 may be an internal storage unit of a computer device, such as a hard disk or memory of a computer device. In other embodiments, the memory 902 may also be an external storage device of a computer device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the computer device. Further, the memory 902 may also include both an internal storage unit of a computer device and an external storage device. The memory 902 is used to store application software and various types of data installed in the computer device, such as program codes installed in the computer device. The memory 902 may also be used to temporarily store data that has been output or is to be output. In one embodiment, the firewall rule self-learning program 903 may be executed by the processor 901, thereby realizing the firewall rule self-learning method, device, electronic device and storage device of each embodiment of the present invention.

[0051] In some embodiments, the processor 901 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 902, such as executing a firewall rule self-learning program.

[0052] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0053] The firewall rule self-learning method, device, electronic device and storage device provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A firewall rule self-learning method, characterized in that: include: According to the IP addresses in the firewall blacklist, determine the IP segment activity record table for the preset time period in the historical activity log; Determine the IP quantity threshold and the continuous attack number threshold according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, and generate initial rules; Monitor real-time network traffic, automatically block IP segments in real-time network traffic that meet the initial rules, determine the ratio of the number of automatically blocked IP addresses within a preset time period to the number of access IP addresses within the corresponding time period, adjust the initial rules according to the ratio, generate iterative rules, and continue to monitor real-time network traffic according to the iterative rules.

2. The firewall rule self-learning method according to claim 1, characterized in that: Based on the IP addresses in the firewall blacklist, determine the IP segment activity record table for the preset time period in the historical activity log, including: Get the blacklist list and historical activity log in the firewall rules; Determine the historical activity log of each IP address according to the IP addresses and historical activity logs in the blacklist; Filtering out the activity record table before each IP address is blocked from the IP address historical activity log, and generating an IP activity record table; The IP activity record tables within a preset time period are merged according to physical areas to generate an IP segment activity record table.

3. The firewall rule self-learning method according to claim 2, characterized in that: The IP activity record tables within a preset time period are merged according to physical areas to generate an IP segment activity record table, including: Divide the IP activity record table according to the preset activity time period to generate IP activity record tables for multiple time periods; The IP addresses in the IP activity record table of each time period are classified according to the same physical area, and the contents of the corresponding IP activity record tables are merged to generate an IP segment activity record table.

4. The firewall rule self-learning method according to claim 3, characterized in that: According to the number of IP addresses and the number of consecutive attacks in the IP segment activity record table, the IP number threshold and the consecutive attack number threshold are determined to generate initial rules, including: Counting the number of each IP address in the IP segment activity record table, and determining an IP quantity threshold according to the number of IP addresses; Counting the number of connection attacks before each IP address is blocked in the IP segment activity record table, and determining a continuous attack number threshold according to the number of connection attacks; The IP quantity threshold, the continuous attack number threshold and the preset time period constitute the initial rule.

5. The firewall rule self-learning method according to claim 4, characterized in that: Automatically block the IP segments that meet the initial rules in real-time network traffic, including: Obtain real-time network traffic within a preset time period, and merge IP activity logs in the same physical area to generate a target IP segment activity record table; When the activity record information of a certain IP segment in the target IP segment activity record table meets the initial rule, each IP address of the IP segment is automatically blocked.

6. The firewall rule self-learning method according to claim 5, characterized in that: Determine the ratio of the number of automatically blocked IP addresses in a preset time period to the number of accessing IP addresses in the corresponding time period, including: Count the number of IP addresses automatically blocked during a preset time period and the number of IP addresses accessing during the corresponding time period; Calculate the ratio of automatically blocked IP addresses to the number of accessing IP addresses in the corresponding time period.

7. The firewall rule self-learning method according to claim 6, characterized in that: The initial rules are adjusted according to the proportions to generate iterative rules, including: When the proportion exceeds the preset proportion threshold, the continuous attack number threshold is adjusted according to the continuous attack number of each IP segment in the preset time period to generate an iterative continuous attack number threshold; When the attack type is to attack with different IP addresses, the IP quantity threshold is adjusted according to the adjusted continuous attack number threshold to generate an iterative IP quantity threshold; The initial rule is adjusted according to the iterative continuous attack number threshold and the iterative IP number threshold to generate an iterative rule.

8. A firewall rule self-learning device, characterized in that: include: An IP segment activity record table generation module is used to determine an IP segment activity record table for a preset time period in a historical activity log based on the IP addresses in the firewall blacklist; An initial rule generation module is used to determine an IP quantity threshold and a continuous attack number threshold according to the number of IP addresses and the number of continuous attacks in each IP segment activity record table, and generate an initial rule; The rule iteration module is used to monitor real-time network traffic, automatically block the IP segments in the real-time network traffic that meet the initial rules, determine the ratio of the number of automatically blocked IP addresses in a preset time period to the number of access IP addresses in the corresponding time period, adjust the initial rules according to the ratio, generate iterative rules, and continue to monitor the real-time network traffic according to the iterative rules.

9. A firewall rule self-learning electronic device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the firewall rule self-learning method as claimed in any one of claims 1 to 7 are implemented.

10. A storage medium, characterized in that: The storage medium stores computer program instructions, and when the computer program instructions are executed by a computer, the computer is enabled to execute the firewall rule self-learning method according to any one of claims 1 to 7.

Images