Network security management method, device and system
By identifying and matching vulnerability feature data, generating and applying target configuration instances, the limitations of existing network security management methods in detecting and responding to vulnerabilities are solved, and efficient and accurate network protection is achieved.
Patent Information
- Application Number
- CN202411817912.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-11
- Publication Date
- 2025-03-14
AI Technical Summary
The existing network security management methods have limitations in dealing with complex and changing attack methods, especially the limited ability to detect and respond to known and unknown vulnerabilities, resulting in untimely update of vulnerabilities, delayed data analysis and response, and inability to configure timely and flexibly in a multi-vulnerability environment.
By determining the configuration operations corresponding to the vulnerability feature data, identifying and matching the vulnerability features of the target access data, configuring the target vulnerability feature data based on the configuration operations, generating a target configuration instance, and managing network access based on the instance to achieve targeted vulnerability attacks.
It improves the efficiency and accuracy of system network protection, realizes timely identification and response to multiple vulnerabilities, reduces security risks, and improves overall security.
Smart Images
Figure CN119628942A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security, and in particular to a network security management method, device, system, electronic equipment and storage medium thereof. Background Art
[0002] With the rapid development of Internet technology, network security issues are becoming increasingly severe. In particular, network intrusions and vulnerability exploitation attacks have brought huge security risks to various information systems.
[0003] Since existing network security management methods often have limitations in dealing with complex and ever-changing attack methods, especially in terms of the limited ability to detect and respond to known and unknown vulnerabilities, existing network security management methods have problems such as untimely updates of vulnerability features, lags in real-time analysis and response of access data, and inability to be flexibly configured in a timely manner in a multi-vulnerability environment. Summary of the invention
[0004] The embodiment of the present invention provides a network security management method to solve the problems of the existing network security management method, such as untimely update of vulnerability features, lag in real-time analysis and response of access data, and inability to be flexibly configured in a timely manner in an environment with multiple vulnerabilities.
[0005] In a first aspect, an embodiment of the present invention provides a network security management method, the method comprising the following steps: Determine a configuration operation corresponding to the vulnerability feature data, the vulnerability feature data including confirmed vulnerability feature data and to-be-confirmed vulnerability feature data, the configuration operation being used to process the vulnerability feature data after the vulnerability feature data is detected; Determine target vulnerability feature data corresponding to target access data; Configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; Based on the target configuration instance, network access management is performed on the target access data.
[0006] Optionally, the determining of the configuration operation corresponding to the vulnerability feature data includes: Determine attack feature data corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data; Based on the attack feature data, determining a response method and a processing mode for the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data; Based on the response manner and the processing mode, configuration operations corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data are determined.
[0007] Optionally, before determining the target vulnerability feature data corresponding to the target access data, the method further includes: Obtain vulnerability feature data and corresponding attack feature data; Based on the vulnerability feature data and the corresponding attack feature data, a vulnerability attack feature description table is established, and the vulnerability attack feature description table at least includes a vulnerability number, a vulnerability name, and an attack feature identifier.
[0008] Optionally, the determining target vulnerability feature data corresponding to the target access data includes: Scan the target access data to determine corresponding network security event data; The vulnerability attack feature description table is used to match the network security event data to determine the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data.
[0009] Optionally, configuring the target vulnerability feature data based on the configuration operation to obtain a target configuration instance includes: Based on the response method and processing mode corresponding to the vulnerability feature data, the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data are configured to obtain a target configuration instance.
[0010] Optionally, the performing network access management on the target access data based on the target configuration instance includes: Based on the target configuration instance, verify the target access data to confirm whether the target access data is legal data; When the target access data is legitimate data, determining a response decision for the target access data through a configuration method in a target configuration instance; Based on the response decision, a network access operation is performed on the target access data.
[0011] In a second aspect, an embodiment of the present invention further provides a network security management device, the network security management device comprising: A first determination module is used to determine a configuration operation corresponding to vulnerability feature data, wherein the vulnerability feature data includes confirmed vulnerability feature data and to-be-confirmed vulnerability feature data, and the configuration operation is used to process the vulnerability feature data after the vulnerability feature data is detected; A second determination module is used to determine target vulnerability feature data corresponding to the target access data; A first acquisition module, configured to configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; A management module is used to perform network access management on the target access data based on the target configuration instance.
[0012] In a third aspect, an embodiment of the present invention further provides a network security management system, which includes: a network security management device, a server, and a smart terminal.
[0013] In a fourth aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the network security management method provided in the embodiment of the present invention when executing the computer program.
[0014] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the network security management method provided in the embodiment of the invention are implemented.
[0015] In an embodiment of the present invention, a configuration operation corresponding to vulnerability feature data is determined, and the vulnerability feature data includes confirmed vulnerability feature data and to-be-confirmed vulnerability feature data. The configuration operation is used to process the vulnerability feature data after the vulnerability feature data is detected; determine the target vulnerability feature data corresponding to the target access data; configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; and perform network access management on the target access data based on the target configuration instance. The vulnerability features of the target access data are identified and matched by the above method, the corresponding target configuration instance is determined, and the target access data is processed according to the rules of the target configuration instance, so that the system can generate the optimal target configuration instance for the target access data, thereby enabling targeted blocking of the corresponding vulnerability attack, thereby improving the efficiency and accuracy of the system network protection. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0017] Figure 1 is an architecture diagram of a network security management system provided by an embodiment of the present invention; Figure 2 is a flow chart of a network security management method provided by an embodiment of the present invention; Figure 3 is a structural diagram of a network security management device provided in an embodiment of the present invention; Figure 4 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0019] like Figure 1 As shown, Figure 1 It is an architecture diagram of a network security management system 100 provided by an embodiment of the present invention, and the network security management system includes: a network security management device 300, a server 101, and a smart terminal 102. Among them, the network security management device 300 also includes a first determination module, which can be used to determine the configuration operation corresponding to the vulnerability feature data; a second determination module, which can be used to determine the target vulnerability feature data corresponding to the target access data; a first acquisition module, which can be used to configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; a management module, which can be used to perform network access management on the target access data based on the target configuration instance.
[0020] Specifically, the above-mentioned vulnerability feature data may include but is not limited to confirmed vulnerability feature data and to-be-confirmed vulnerability feature data. The above-mentioned confirmed vulnerability feature data may be known security vulnerabilities that can be detected when performing security checks on the system network environment of users accessing the network. Generally speaking, the confirmed vulnerability feature data may be any known feature data with network attack behaviors. For example, classic network Trojan viruses have a unified attack behavior on the system firewall. Such viruses can be used as identifiers corresponding to the above-mentioned confirmed vulnerability feature data, that is, viruses with the above-mentioned attack behaviors can be used as confirmed vulnerability feature data.
[0021] The above-mentioned vulnerability feature data to be confirmed may be known security vulnerabilities that have not been detected during security testing of the system network environment of users accessing the network. Generally speaking, the failure to detect may mean that the vulnerability feature data is detected, but the vulnerability feature data does not contain any attack behavior and is only BUG data with vulnerabilities, or it may be undetectable vulnerability feature data with potential attack behavior.
[0022] The above configuration operation can be used to process the above vulnerability feature data according to the corresponding set configured behavior after the vulnerability feature data is detected. It can be understood that the configuration operation can be understood as an action that has been configured in advance and will perform the corresponding processing operation after the system detects the above vulnerability feature data. The above configuration operation at least includes but is not limited to whether the above vulnerability feature data is enabled in the IPS system and the response method after the above vulnerability feature data is detected. Generally speaking, it can be whether to generate logs for the above vulnerability feature data, discard corresponding data packets, generate alarm warnings, and other behavioral actions after detection.
[0023] The above-mentioned target vulnerability feature data can be obtained by matching and searching the vulnerability feature data of the access network through a preset vulnerability attack feature description table, matching the vulnerability feature data of the access network according to the vulnerability number, vulnerability name and attack feature identifier, and using the matched vulnerability feature data with attack behavior and the vulnerability feature data with potential attack behavior as the above-mentioned target vulnerability feature data.
[0024] The target configuration instance can be a parameter instance with protection settings generated according to the vulnerability feature data and corresponding configuration operations, and the target configuration instance can be used to automatically configure and dynamically adjust the network protection of the system. Specifically, the network security management system can perform corresponding processing actions for the corresponding vulnerability feature data according to the specific target configuration instance to ensure the security of data when accessing the system network.
[0025] The above management process can be a series of behavioral operations such as controlling, monitoring and responding to data accessing the system network based on the rules contained in the target configuration instance on how to process and respond to different types of access data (including vulnerability feature data) according to network security requirements.
[0026] In a possible embodiment, the network security management system identifies and matches the vulnerability features of the target access data, determines the corresponding target configuration instance, and processes the target access data according to the rules of the target configuration instance, so that the system can generate the optimal target configuration instance for the target access data, thereby achieving targeted blocking of the corresponding vulnerability attacks, thereby improving the efficiency and accuracy of the system network protection.
[0027] like Figure 2 As shown, Figure 2 : is a flow chart of a network security management method provided by an embodiment of the present invention, the network security management method comprising the steps of: 201. Determine the configuration operation corresponding to the vulnerability feature data.
[0028] In an embodiment of the present invention, the above-mentioned network security management method can be applied to the above-mentioned network security management system, which has functions such as network security data processing, network security data transmission and reception, and network security data memory storage, and can be constructed based on a server or a server cluster. The above-mentioned server or server cluster can be an electronic device with network security data processing capabilities.
[0029] The above-mentioned vulnerability feature data may include but is not limited to confirmed vulnerability feature data and to-be-confirmed vulnerability feature data. The above-mentioned confirmed vulnerability feature data may be known security vulnerabilities that can be detected when performing security checks on the system network environment of users accessing the network. Generally speaking, the confirmed vulnerability feature data may be any known feature data with network attack behaviors. For example, classic network Trojan viruses have uniform attack behaviors on the system firewall. Such viruses can be used as identifiers corresponding to the above-mentioned confirmed vulnerability feature data, that is, viruses with the above-mentioned attack behaviors can be used as confirmed vulnerability feature data.
[0030] The above-mentioned vulnerability feature data to be confirmed may be known security vulnerabilities that have not been detected during security testing of the system network environment of users accessing the network. Generally speaking, the failure to detect may mean that the vulnerability feature data is detected, but the vulnerability feature data does not contain any attack behavior and is only BUG data with vulnerabilities, or it may be undetectable vulnerability feature data with potential attack behavior.
[0031] The above configuration operation can be used to process the above vulnerability feature data according to the corresponding set configured behavior after the vulnerability feature data is detected. It can be understood that the configuration operation can be understood as an action that has been configured in advance and will perform the corresponding processing operation after the system detects the above vulnerability feature data. The above configuration operation at least includes but is not limited to whether the above vulnerability feature data is enabled in the IPS system and the response method after the above vulnerability feature data is detected. Generally speaking, it can be whether to generate logs for the above vulnerability feature data, discard corresponding data packets, generate alarm warnings, and other behavioral actions after detection. 202. Determine target vulnerability feature data corresponding to the target access data.
[0032] The above-mentioned target vulnerability feature data can be obtained by matching and searching the vulnerability feature data of the access network through a preset vulnerability attack feature description table, matching the vulnerability feature data of the access network according to the vulnerability number, vulnerability name and attack feature identifier, and using the matched vulnerability feature data with attack behavior and the vulnerability feature data with potential attack behavior as the above-mentioned target vulnerability feature data.
[0033] 203. Configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance.
[0034] The target configuration instance can be a parameter instance with protection settings generated according to the vulnerability feature data and corresponding configuration operations, and the target configuration instance can be used to automatically configure and dynamically adjust the network protection of the system. Specifically, the network security management system can perform corresponding processing actions for the corresponding vulnerability feature data according to the specific target configuration instance to ensure the security of data when accessing the system network.
[0035] 204. Based on the target configuration instance, perform network access management on the target access data.
[0036] The above management process can be a series of behavioral operations such as controlling, monitoring and responding to data accessing the system network based on the rules contained in the target configuration instance on how to process and respond to different types of access data (including vulnerability feature data) according to network security requirements.
[0037] In a possible embodiment, the network security management system identifies and matches the vulnerability features of the target access data, determines the corresponding target configuration instance, and processes the target access data according to the rules of the target configuration instance, so that the system can generate the optimal target configuration instance for the target access data, thereby achieving targeted blocking of the corresponding vulnerability attacks, thereby improving the efficiency and accuracy of the system network protection.
[0038] In an embodiment of the present invention, a configuration operation corresponding to vulnerability feature data is determined, and the vulnerability feature data includes confirmed vulnerability feature data and to-be-confirmed vulnerability feature data. The configuration operation is used to process the vulnerability feature data after the vulnerability feature data is detected; determine the target vulnerability feature data corresponding to the target access data; configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; and perform network access management on the target access data based on the target configuration instance. The vulnerability features of the target access data are identified and matched by the above method, the corresponding target configuration instance is determined, and the target access data is processed according to the rules of the target configuration instance, so that the system can generate the optimal target configuration instance for the target access data, thereby enabling targeted blocking of the corresponding vulnerability attack, thereby improving the efficiency and accuracy of the system network protection.
[0039] Optionally, the step of determining the configuration operation corresponding to the vulnerability feature data also includes determining attack feature data corresponding to the confirmed vulnerability feature data and the vulnerability feature data to be confirmed; based on the attack feature data, determining the response method and processing mode of the confirmed vulnerability feature data and the vulnerability feature data to be confirmed; based on the response method and processing mode, determining the configuration operations corresponding to the confirmed vulnerability feature data and the vulnerability feature data to be confirmed.
[0040] In an embodiment of the present invention, the above-mentioned attack feature data may refer to specific data or patterns used to describe network attack behaviors, and these features can be used by an intrusion protection system (IPS) or an intrusion detection system (IDS) to identify and detect potential network attacks. Specifically, the above-mentioned attack feature data usually generates specific features related to known attacks or malicious activities by analyzing network traffic, behavior patterns, data packet content, protocol anomalies, etc. For example, it may include but is not limited to feature data such as attack patterns, data packet features, traffic features, and network protocol anomalies.
[0041] More specifically, the above attack patterns can be used to describe the characteristics of how attackers launch attacks, such as SQL injection, cross-site scripting (XSS) attacks, denial of service (DoS) attacks, etc.
[0042] The above-mentioned data packet characteristics may include abnormal fields of access network data, request paths, specific headers, special characters, etc.
[0043] The above traffic characteristics can be judged based on behavioral characteristics such as a large influx of traffic into the network within a preset time or a change in the access mode of the traffic.
[0044] The above network protocol anomalies may be abnormal modes in protocols such as HTTP, DNS, and TCP.
[0045] It is understandable that different response methods and processing modes can be set according to different attack modes. For example, for attack feature data of malicious attack behavior, the access denial processing mode can be used, and response methods such as generating alarms and recording logs can be selected to mark and protect the attack feature data.
[0046] In a possible embodiment, the network security management system generates a configuration operation of corresponding vulnerability feature data by configuring different processing modes and response methods for network data with different attack feature data.
[0047] Optionally, the step before determining the target vulnerability feature data corresponding to the target access data also includes obtaining the vulnerability feature data and the corresponding attack feature data; and establishing a vulnerability attack feature description table based on the vulnerability feature data and the corresponding attack feature data.
[0048] In the embodiment of the present invention, the above attack feature data can also be a key data source used by the network security system to monitor and identify network attacks in real time. By continuously updating and analyzing these features, the IPS and IDS systems can timely discover and prevent various types of network attacks. For example, the attack features against Microsoft servers can be described as follows: sigName=Microsoft Windows NETAPI Stack Overflow sigContent=key: "|1F00|"; key: "|C8 4F 32 4B 70 16 D3 01 12 78 5A47 BF6E E1 88|" relatedID=MS08-067" Where signame is the feature identifier (Microsoft Windows NETAPI StackOverflow); sigContent is the feature content (key: ″|1F00|″; key: ″|C8 4F 32 4B 7016 D3 01 12 785A 47 BF6E E1 88|″); the vulnerability number corresponding to the feature is reatedID (MS08-067) The vulnerability attack feature description table may at least include but is not limited to the vulnerability number, vulnerability name and attack feature identifier. The attack feature identifier may be a specific data packet pattern, abnormal behavior of the request, malicious data flow, etc. For example, the feature of a SQL injection attack may be 'OR 1=1' in an HTTP request.
[0049] The vulnerability attack feature description table may be a table containing detailed information about the vulnerability and its related attack features, which is used to identify, manage and describe the features of the vulnerability in an intrusion protection system (IPS) or an intrusion detection system (IDS), and to help these systems identify attack behaviors related to the vulnerability.
[0050] In a possible embodiment, the network security management system analyzes the attack feature data corresponding to the vulnerability feature data, and then files and sorts different vulnerability feature data according to vulnerability name, vulnerability number and attack feature identifier, and constructs the vulnerability attack feature description table.
[0051] Optionally, in the step of determining the target vulnerability feature data corresponding to the target access data, it also includes scanning the target access data to determine the corresponding network security event data; matching the network security event data through the vulnerability attack feature description table to determine the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data.
[0052] In an embodiment of the present invention, the network security event data may be a record of all security-related events and activities that occur in the network environment of the access system network after the network security management system scans and analyzes the network data attribution location, including but not limited to detailed data of potential threats to the network and system, intrusion attempts, attack behaviors or other abnormal activities. Specifically, it may include event type, timestamp, event source, target data, and attack characteristics or behaviors.
[0053] In a possible embodiment, the network security management system may determine the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data after matching the event type, timestamp, event source, target data and attack features or behaviors in the network security event data through the vulnerability attack feature description table.
[0054] Through the above steps, the network security management system can detect and protect vulnerabilities efficiently and in real time, and obtain different configuration methods to deal with different vulnerabilities, thereby improving the accuracy, response speed and automation level of the network security protection system, thereby reducing potential security risks and improving overall security.
[0055] Optionally, in the step of configuring the target vulnerability feature data based on the configuration operation to obtain a target configuration instance, it also includes configuring the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data based on the response method and processing mode corresponding to the vulnerability feature data to obtain the target configuration instance.
[0056] In an embodiment of the present invention, the above-mentioned network security management system extracts the vulnerability number, vulnerability name and attack feature identifier in the target access data by matching the vulnerability attack feature description table, and configures it according to the preset response method (such as discarding malicious data packets, generating alarms, and recording logs) and processing mode (such as real-time protection and delayed response) to generate a corresponding target configuration instance.
[0057] In a possible embodiment, according to the severity and attack characteristics of different vulnerability feature data, the network security management system automatically generates a target configuration instance, including but not limited to the processing strategy for the corresponding vulnerability feature data, such as whether to enable specific protection rules, how to respond to feature matching, data packet discarding strategy, etc. Through these configurations, the security protection of the target access data can be accurately executed, ensuring that the system implements the most effective security response according to the vulnerability characteristics during actual operation, effectively preventing potential threats.
[0058] Optionally, in the step of performing network access management on the target access data based on the target configuration instance, the step also includes verifying the target access data based on the target configuration instance to confirm whether the target access data is legal data; when the target access data is legal data, determining a response decision for the target access data through the configuration method in the target configuration instance; and performing network access operations on the target access data based on the response decision.
[0059] In an embodiment of the present invention, the verification process may refer to a process of checking the target access data (such as a network request or data packet from a device) to confirm whether it complies with network security policies and specifications. Specifically, the target access data may be analyzed to verify whether it contains any malicious features, abnormal patterns, or known vulnerability feature data.
[0060] The above-mentioned legitimate data may refer to network access data that complies with predetermined security policies and does not contain malicious code or improper behavior, that is, vulnerability feature data that does not contain attack feature identifiers or does not have attack behavior.
[0061] The above-mentioned response decision may mean that after confirming that the above-mentioned target access data is legal data, the above-mentioned network security management system decides how to respond to the processing content of the above-mentioned target access data according to the configuration method defined in the above-mentioned target configuration instance.
[0062] In a possible embodiment, the above-mentioned network security management system verifies the target access data through the above-mentioned target configuration instance. When the above-mentioned target access data is confirmed to be legal data, the network security management system can generate a response decision based on the configuration method in the target configuration instance, that is, the rules and response strategies preset in the configuration method. For example, if the access data belongs to a legitimate user request and complies with the access rights, the system allows it to pass and continue to execute resource access; if there is abnormal behavior in the access data, the system takes corresponding security measures such as blocking or warning.
[0063] The above method can effectively prevent illegal access, ensure the security of network resources, and improve the processing efficiency and security of legal access data by the network security management system. Through accurate verification and response mechanisms, the method steps of this embodiment can reduce security risks and improve network protection capabilities.
[0064] like Figure 3 As shown, the embodiment of the present invention further provides a network security management device 300, the network security management device comprising: A first determination module 301 is used to determine a configuration operation corresponding to vulnerability feature data, wherein the vulnerability feature data includes confirmed vulnerability feature data and to-be-confirmed vulnerability feature data, and the configuration operation is used to process the vulnerability feature data after the vulnerability feature data is detected; The second determination module 302 is used to determine the target vulnerability feature data corresponding to the target access data; A first acquisition module 303 is used to configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; The management module 304 is used to perform network access management on the target access data based on the target configuration instance.
[0065] Optionally, the first determining module 301 includes: A first determination submodule is used to determine attack feature data corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data; A second determination submodule is used to determine a response method and a processing mode of the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data based on the attack feature data; The third determination submodule is used to determine the configuration operations corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data based on the response method and the processing mode.
[0066] Optionally, the above device further comprises: The second acquisition module is used to acquire vulnerability feature data and corresponding attack feature data; The establishment module is used to establish a vulnerability attack feature description table based on the vulnerability feature data and the corresponding attack feature data, wherein the vulnerability attack feature description table at least includes a vulnerability number, a vulnerability name, and an attack feature identifier.
[0067] Optionally, the second determining module 302 includes: A fourth determination submodule is used to scan the target access data to determine corresponding network security event data; The fifth determination submodule is used to match the network security event data through the vulnerability attack feature description table to determine the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data.
[0068] Optionally, the first acquisition module 303 includes: The processing submodule is used to configure the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data based on the response method and processing mode corresponding to the vulnerability feature data, and obtain a target configuration instance.
[0069] Optionally, the management module 304 includes: A sixth determination submodule, configured to verify the target access data based on the target configuration instance to confirm whether the target access data is legal data; a seventh determination submodule, configured to determine a response decision for the target access data by using a configuration method in a target configuration instance when the target access data is legitimate data; An operation submodule is used to perform a network access operation on the target access data based on the response decision.
[0070] like Figure 4 As shown, an embodiment of the present invention further provides an electronic device 400, including a processor, and the processor can execute any one of the above network security management methods.
[0071] Specifically, it includes a processor 401 and a memory 402, and a computer program for executing a network security management method that is stored in the memory 402 and can be run on the processor 401, wherein: The processor 401 runs the computer program of the network security management method stored in the memory 402 to perform the following steps: Determine a configuration operation corresponding to the vulnerability feature data, the vulnerability feature data including confirmed vulnerability feature data and to-be-confirmed vulnerability feature data, the configuration operation being used to process the vulnerability feature data after the vulnerability feature data is detected; Determine target vulnerability feature data corresponding to target access data; Configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; Based on the target configuration instance, network access management is performed on the target access data.
[0072] Optionally, the processor 401 performs the configuration operation corresponding to the determined vulnerability feature data, including: Determine attack feature data corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data; Based on the attack feature data, determining a response method and a processing mode for the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data; Based on the response manner and the processing mode, configuration operations corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data are determined.
[0073] Optionally, the processor 401 performs the steps before determining the target vulnerability feature data corresponding to the target access data, including: Obtain vulnerability feature data and corresponding attack feature data; Based on the vulnerability feature data and the corresponding attack feature data, a vulnerability attack feature description table is established, and the vulnerability attack feature description table at least includes a vulnerability number, a vulnerability name, and an attack feature identifier.
[0074] Optionally, the processor 401 executes the step of determining target vulnerability feature data corresponding to the target access data, including: Scan the target access data to determine corresponding network security event data; The vulnerability attack feature description table is used to match the network security event data to determine the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data.
[0075] Optionally, the processor 401 performs the configuration of the target vulnerability feature data based on the configuration operation to obtain a target configuration instance, including: Based on the response method and processing mode corresponding to the vulnerability feature data, the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data are configured to obtain a target configuration instance.
[0076] Optionally, the processor 401 further executes the performing network access management on the target access data based on the target configuration instance, including: Based on the target configuration instance, verify the target access data to confirm whether the target access data is legal data; When the target access data is legitimate data, determining a response decision for the target access data through a configuration method in a target configuration instance; Based on the response decision, a network access operation is performed on the target access data.
[0077] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the computer program implements the various processes of the network security management method or the application-side network security management method provided by the embodiment of the present invention, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0078] Those skilled in the art can understand that the implementation of all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).
[0079] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.
Claims
1. A network security management method, characterized in that: include: Determine a configuration operation corresponding to the vulnerability feature data, the vulnerability feature data including confirmed vulnerability feature data and to-be-confirmed vulnerability feature data, the configuration operation being used to process the vulnerability feature data after the vulnerability feature data is detected; Determine target vulnerability feature data corresponding to target access data; Configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; Based on the target configuration instance, network access management is performed on the target access data.
2. The network security management method according to claim 1, characterized in that: The configuration operation corresponding to the vulnerability feature data is determined, including: Determine attack feature data corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data; Based on the attack feature data, determining a response method and a processing mode for the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data; Based on the response manner and the processing mode, configuration operations corresponding to the confirmed vulnerability feature data and the to-be-confirmed vulnerability feature data are determined.
3. The network security management method according to claim 1, characterized in that: Before determining the target vulnerability feature data corresponding to the target access data, the method further includes: Obtain vulnerability feature data and corresponding attack feature data; Based on the vulnerability feature data and the corresponding attack feature data, a vulnerability attack feature description table is established, and the vulnerability attack feature description table at least includes a vulnerability number, a vulnerability name, and an attack feature identifier.
4. The network security management method according to claim 3, characterized in that: The determining target vulnerability feature data corresponding to the target access data includes: Scan the target access data to determine corresponding network security event data; The vulnerability attack feature description table is used to match the network security event data to determine the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data.
5. The network security management method according to claim 2 or 3, characterized in that: The target vulnerability feature data is configured based on the configuration operation to obtain a target configuration instance, including: Based on the response method and processing mode corresponding to the vulnerability feature data, the vulnerability number, vulnerability name and attack feature identifier of the target vulnerability feature data corresponding to the target access data are configured to obtain a target configuration instance.
6. The network security management method according to claim 1, characterized in that: The performing network access management on the target access data based on the target configuration instance includes: Based on the target configuration instance, verify the target access data to confirm whether the target access data is legal data; When the target access data is legitimate data, determining a response decision for the target access data through a configuration method in a target configuration instance; Based on the response decision, a network access operation is performed on the target access data.
7. A network security management device, characterized in that: include: A first determination module is used to determine a configuration operation corresponding to vulnerability feature data, wherein the vulnerability feature data includes confirmed vulnerability feature data and to-be-confirmed vulnerability feature data, and the configuration operation is used to process the vulnerability feature data after the vulnerability feature data is detected; A second determination module is used to determine target vulnerability feature data corresponding to the target access data; A first acquisition module, configured to configure the target vulnerability feature data based on the configuration operation to obtain a target configuration instance; A management module is used to perform network access management on the target access data based on the target configuration instance.
8. A network security management system, characterized in that: The network security management system comprises: a network security management device; The network security management device is determined by a network security management method shown in claims 1-6.
9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the network security management method according to any one of claims 1 to 6 when executing the computer program.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the network security management method according to any one of claims 1 to 6 are implemented.