Firewall rule updating method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to a firewall rule updating method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring a target attack sample corresponding to a current firewall rule; under the condition that the target attack sample contains a preset attack behavior, determining attack feature information in the target attack sample; determining a new firewall rule corresponding to the target attack sample according to the attack feature information and a rule generation strategy corresponding to the preset attack behavior; and according to the newly added firewall rule, updating the current firewall rule. According to the invention, the updating efficiency of the firewall rule can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a firewall rule updating method, device, computer equipment and storage medium. Background Art

[0002] Web Application Firewall (WAF) is a common security product that performs malicious feature identification and protection strategies on Hypertext Transfer Protocol (HTTP) traffic of corporate websites or application (APP) services. WAF can provide access control and traffic auditing functions, and can strengthen key web services. Cloud WAF can also run as a reverse proxy to return normal and secure traffic to the server.

[0003] Currently, WAF relies on rule sets to filter business traffic. When updating the rule sets, professionals are required to design rules to deal with certain attack traffic.

[0004] However, due to the large scale of traffic and complex content of web services, manual maintenance efficiency is low, resulting in the issuance of firewall rules always lagging behind the occurrence of attack incidents. Therefore, improvement is urgently needed. Summary of the invention

[0005] Based on this, it is necessary to provide a firewall rule updating method, apparatus, computer equipment and storage medium that can optimize the timeliness of firewall rule updating in response to the above technical problems.

[0006] In a first aspect, the present application provides a firewall rule updating method, the method comprising:

[0007] Get the target attack samples corresponding to the current firewall rules;

[0008] In the case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample;

[0009] Generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0010] Update the current firewall rules according to the newly added firewall rules.

[0011] In one embodiment, obtaining a target attack sample corresponding to a current firewall rule includes:

[0012] Get simulated attack samples output by the adversarial generative network;

[0013] Determine the target attack sample based on the simulated attack sample and the real attack sample corresponding to the current firewall rules within the update cycle.

[0014] In one embodiment, the adversarial generative network is trained in the following manner:

[0015] Format the original attack sample into a vector;

[0016] The original attack samples after vector formatting are used as training sets;

[0017] The training set is used to train the initial network to obtain the adversarial generation network.

[0018] In one embodiment, the method further comprises:

[0019] Analyze the keywords in the target attack sample according to the feature extraction function to determine whether the target attack sample contains contextual attack behaviors and / or attack behaviors carrying special characters;

[0020] If so, it is determined that the target attack sample contains the preset attack behavior.

[0021] In one embodiment, a new firewall rule corresponding to a target attack sample is determined based on attack feature information and a rule generation strategy corresponding to a preset attack behavior, including:

[0022] If the preset attack behavior is a contextual attack behavior, a strategy is generated based on the rules corresponding to the contextual attack behavior to predict the number and location of the attack feature information in the attack sample to be identified;

[0023] According to the number and location of attack feature information in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0024] In one embodiment, a new firewall rule corresponding to a target attack sample is determined based on attack feature information and a rule generation strategy corresponding to a preset attack behavior, including:

[0025] If the preset attack behavior is an attack behavior carrying special characters, a rule generation strategy corresponding to the attack behavior carrying special characters is used to predict the number and feature content of the attack feature information appearing in the attack sample to be identified;

[0026] According to the number and feature content of the attack feature information in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0027] In a second aspect, the present application also provides a firewall rule updating device, the device comprising:

[0028] The acquisition module is used to obtain the target attack samples corresponding to the current firewall rules;

[0029] A feature extraction module, used to determine attack feature information in a target attack sample when the target attack sample contains a preset attack behavior;

[0030] A rule generation module is used to generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0031] The update module is used to update the current firewall rules according to the newly added firewall rules.

[0032] In a third aspect, the present application further provides a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0033] Get the target attack samples corresponding to the current firewall rules;

[0034] In the case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample;

[0035] Generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0036] Update the current firewall rules according to the newly added firewall rules.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0038] Get the target attack samples corresponding to the current firewall rules;

[0039] In the case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample;

[0040] Generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0041] Update the current firewall rules according to the newly added firewall rules.

[0042] In a fifth aspect, the present application further provides a computer program product, the computer program product comprising a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0043] Get the target attack samples corresponding to the current firewall rules;

[0044] In the case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample;

[0045] Generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0046] Update the current firewall rules according to the newly added firewall rules.

[0047] The above-mentioned firewall rule updating method, device, computer equipment and storage medium, when it is necessary to update the current firewall rules, first verify whether the target attack sample contains the preset attack behavior, and by identifying the specific attack behavior, the attack feature information corresponding to the specific attack behavior can be extracted; the rule generation strategy corresponding to each attack behavior is adopted to generate new firewall rules corresponding to the attack feature information in a targeted manner, and on the basis of automatically generating firewall rules, each attack behavior can be processed differently, and then, based on the new firewall rules, the current firewall rules are automatically updated; compared with the traditional technology, the present application does not need to consume professional manpower to specially design the firewall rules, and realizes the update of firewall rules with low manual intervention and fast iteration, and solves the problems of huge manpower cost for updating firewall rules, delayed rule update, lack of flexibility, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flowchart of a method for updating firewall rules in one embodiment;

[0049] Figure 2 A schematic diagram of a process for determining a target attack sample in one embodiment;

[0050] Figure 3 A schematic diagram of a generator G in a generative adversarial network in one embodiment;

[0051] Figure 4 A schematic diagram of a flow chart of determining whether a preset attack behavior is included in one embodiment;

[0052] Figure 5 A schematic diagram of a firewall rule updating system in another embodiment;

[0053] Figure 6 It is a structural block diagram of a firewall rule updating device in one embodiment;

[0054] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] The firewall update method provided in the embodiment of the present application is as follows: Figure 1 As shown, a firewall rule updating method is provided, and taking the method applied to a computer device as an example, the method includes the following steps:

[0057] S101, obtaining a target attack sample corresponding to the current firewall rule.

[0058] The current firewall rules refer to the rules currently used by the firewall; it can be understood that under the preset update policy, the firewall rules are updated according to the preset update cycle.

[0059] Optionally, the target attack sample corresponding to the current firewall rule is the attack traffic collected by the firewall during the process of using the current firewall rule.

[0060] Among them, the attack traffic can be a Structured Query Language (SQL) injection attack, or a Cross Site Script (XSS) attack. Among them, the SQL injection attack refers to the attacker taking advantage of the defects of the existing application program that does not strictly check and filter the user input data, and injecting malicious SQL commands into the background database engine for execution, so as to steal data or even control the database server. XSS attack refers to the malicious attacker inserting malicious script program code into the web page. When the user browses the page, the malicious script program code embedded in the Web (page) will be executed, thereby achieving the special purpose of maliciously attacking the user. Further, this embodiment can perform desensitization processing on the above-mentioned attack traffic, specifically, the local area network address (Media Access ControlAddress, MAC address) and Internet Protocol Address (Internet Protocol Address, IP address) in the attack traffic can be desensitized, and the desensitized attack traffic is used as the target sample.

[0061] In addition, the target attack samples in this embodiment may include attack traffic that can be identified by the current firewall rules, as well as unknown attack traffic that cannot be identified by the firewall and is provided by manual review.

[0062] S102: When the target attack sample includes a preset attack behavior, determine attack feature information in the target attack sample.

[0063] The preset attack behaviors may include: 1) causing an abnormal attack behavior in the flow rate of normal protocol message data, 2) causing an abnormal attack field to be included in normal protocol message data, and 3) causing an inconsistent context of normal protocol message data.

[0064] It can be understood that 1) the attack behavior that causes abnormal traffic rate of normal protocol message data means: the attack behavior configures the starting traffic rate (script / second), the incremental rate per second, the maximum traffic rate (if the test network cannot reach the maximum traffic rate, it should reach the maximum rate that can be achieved in the network environment), the duration after reaching the maximum rate, and the interval step; 2) the attack behavior that causes abnormal attack fields to be included in normal protocol message data means: replacing the characteristic data field value in the message data with a preset abnormal value; 3) the attack behavior that causes the context of normal protocol message data to be inconsistent means: exchanging the positions of certain fields in the normal protocol message data, or filling irrelevant data before and after the normal data, or removing the content of certain fields.

[0065] Specifically, when a preset attack behavior is identified, a feature extraction strategy corresponding to the preset attack behavior can be used to determine the attack feature information in the target attack sample. It can be understood that the attack feature information refers to the attack feature (field) used when executing the attack behavior.

[0066] S103, generating a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determining a new firewall rule corresponding to the target attack sample.

[0067] Among them, each type of preset attack behavior corresponds to a corresponding rule generation strategy. Based on the corresponding rule generation strategy and combined with the attack feature field (i.e., attack feature information) used when executing the attack behavior, a firewall rule for filtering the attack behavior can be generated as a new firewall rule.

[0068] Optionally, after generating a firewall rule for filtering the attack behavior, the firewall rule can first be used as a pending filtering rule and stored in a pending filtering rule library; the interception effect of the pending filtering rule can be verified using test attack traffic, and the pending filtering rule that passes the verification can be used as a new firewall rule.

[0069] Exemplarily, the pending filtering rule base in this embodiment is independent of the firewall; the pending filtering rule is used to identify the arriving test attack traffic. If the firewall configured with the current firewall rule can also identify the test attack traffic, the redundancy of the pending filtering rule is judged. If it is a redundant rule, it is deleted from the pending filtering rule base. If it is a non-redundant rule, it is retained as a newly added firewall rule. If the firewall configured with the current firewall rule fails to identify the test attack traffic, the pending filtering rule is confirmed as a non-redundant rule, and the non-redundant rule is retained as a newly added firewall rule.

[0070] S104: Update the current firewall rules according to the newly added firewall rules.

[0071] Specifically, at the update time node corresponding to the update cycle, the current firewall rules are updated using the newly added firewall rules. Optionally, during the update, an update request message may be sent to the administrator, and if an update confirmation message fed back by the administrator is received, the current firewall rules are updated.

[0072] In the above-mentioned firewall rule updating method, when it is necessary to update the current firewall rules, firstly, it is verified whether the target attack sample contains the preset attack behavior, and by identifying the specific attack behavior, the attack feature information corresponding to the specific attack behavior can be extracted; the rule generation strategy corresponding to each attack behavior is adopted to generate new firewall rules corresponding to the attack feature information in a targeted manner, and on the basis of automatically generating firewall rules, each attack behavior can be processed differently, and then, based on the new firewall rules, the current firewall rules are automatically updated; compared with the traditional technology, the present application does not need to consume professional manpower to specially design the firewall rules, and realizes the update of firewall rules with low manual intervention and fast iteration, and solves the problems of huge manpower cost for updating firewall rules, delayed rule update, lack of flexibility, etc.

[0073] like Figure 2 As shown, this embodiment provides an optional method for obtaining target attack samples corresponding to the current firewall rules, that is, provides a method for refining S101. The specific implementation process may include:

[0074] S201, obtaining a simulated attack sample output by the adversarial generation network.

[0075] Specifically, the adversarial generative network is trained in the following manner: vector formatting is performed on the original attack samples; the original attack samples after vector formatting are used as training sets; and the training sets are used to train the initial network to obtain the adversarial generative network.

[0076] The original attack sample is the historical attack traffic collected during the historical time period.

[0077] Optionally, before the original attack samples are vector-formatted, data set deduplication and data set cleaning may be performed on the original attack samples; data set deduplication refers to removing redundant samples in the data set, and data set cleaning refers to removing regular communication samples in the context of historical attack traffic and samples that do not contain application layer data.

[0078] Specifically, the original attack samples are vector-formatted, including: organizing the historical attack traffic into 784 bytes, splitting the long samples, filling the short samples with byte 0x00, and then organizing them into a 128-bit 28×28 grayscale image as the adversarial generation network input vector.

[0079] Furthermore, the initial network is trained to obtain a generative adversarial network, including: using the training set to train the classic generative adversarial network (initial network) to obtain a generator G. The network structure of the generator G is as follows: Figure 3 As shown, the input of the network structure is a 100-bit random vector, and the output is a 128-bit 28×28 grayscale image; in this embodiment, the formatted output vector in the generator G is used as a simulated attack sample.

[0080] S202, determining a target attack sample according to the simulated attack sample and the real attack sample corresponding to the current firewall rule within the update cycle.

[0081] In this embodiment, the target attack sample is determined by simulating the attack sample and the real attack sample corresponding to the current firewall rule within the update cycle; wherein the real attack sample may include the attack traffic (provided by the administrator) that the current firewall rule fails to identify. Specifically, the administrator can feedback unknown attacks based on the intrusion prevention system, EDR or audit system.

[0082] In this embodiment, historical attack samples are learned with the help of adversarial generative network technology to generate simulated attack samples for firewall testing, which effectively promotes the passive update of rules driven by attack events to active learning updates, thereby improving the rule iteration speed and search space. Furthermore, after the attack event corresponding to the real attack sample occurs, a target attack sample can be generated, and new firewall rules can be generated in time according to the target attack sample, with faster update response, and subsequent administrators can still extract rules for research and modification. In addition, this embodiment greatly reduces the labor cost of firewall rule maintenance. It only needs to provide target attack samples, without the need to manually submit specific attack rules, which improves the automation level of the firewall reinforcement system and reduces manual intervention.

[0083] In one embodiment, Figure 4As shown in the figure, when determining that the target attack sample contains the preset attack behavior, the following methods can be used:

[0084] S401, analyzing keywords in the target attack sample according to the feature extraction function to determine whether the target attack sample contains contextual attack behaviors and / or attack behaviors carrying special characters.

[0085] The feature extraction function in this implementation includes a Delete function and a Replace function. The Delete function is shown in the following formula (1), and the Replace function is shown in the following formula (2):

[0086] (1)

[0087] (2)

[0088] Among them, st in formula (1) and formula (2) r0 , str1, str2 are any three consecutive strings in the target attack sample;

[0089] del(str1, str0, str2) is used to verify whether str0+str1+str2 has context attack features;

[0090] rp (str1, str1', str0, str2) is used to match the specific content of str1 to confirm whether the str1 string carries special characters.

[0091] Specifically, according to the feature extraction function, when verifying the attack behavior of each target attack sample, the following four types of verification results may be included. The four types of verification results are shown in the following table - Table 1:

[0092] Table 1

[0093]

[0094] The extraction result of the Delete function (or Replace function) includes 1 or 0; the extraction result is jointly given by the firewall (current firewall rule) and the administrator, 1 represents a certain attack behavior, and 0 represents no such attack behavior.

[0095] S402: If yes, determine that the target attack sample contains a preset attack behavior.

[0096] S403: If not, it is determined that the target attack sample does not include the preset attack behavior.

[0097] Further, corresponding to the above Table 1, in one embodiment, according to the attack feature information and the rule generation strategy corresponding to the preset attack behavior, determining the new firewall rule corresponding to the target attack sample may include the following two methods:

[0098] Method 1: If the preset attack behavior is a contextual attack behavior, a strategy is generated based on the rules corresponding to the contextual attack behavior to predict the number and location of the attack feature information in the attack sample to be identified; based on the number and location of the attack feature information in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0099] Method 2: If the preset attack behavior is an attack behavior carrying special characters, a rule generation strategy is generated based on the attack behavior carrying special characters to predict the number and feature content of the attack feature information in the attack sample to be identified; based on the number and feature content of the attack feature information in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0100] The attack sample to be identified is the attack traffic corresponding to the attack by the attacker attacking the firewall.

[0101] Specifically, different attack behaviors use different rule generation strategies to generate different regular expressions, and the regular expressions are the above-mentioned pending filtering rules; accordingly, the generation of pending filtering rules also includes the following four modes, and each pending filtering rule may also correspond to a priority, as shown in the following table - Table 2:

[0102] Table 2

[0103]

[0104] For example, Figure 5 As shown, based on the above embodiment, this embodiment provides a firewall rule updating system 5, which includes an attack sample generating module 51, a rule generating module 52 and a rule updating module 53, wherein:

[0105] The attack sample generation module 51 is used to adopt the adversarial generative network algorithm and use the historical attack data collected by the firewall for training to obtain the generator G in the adversarial generative network model. The generator G uses random vectors to generate simulated attack samples and then submits them to the firewall.

[0106] The rule generation module 52 is used to receive simulated attack samples identified by the firewall and unknown attack samples that the firewall fails to identify and that are submitted by the administrator based on actual situations, and use them as target attack samples, perform feature extraction on the target attack samples, and maintain a feature library. The attack behavior of the target attack sample is obtained through the feature extraction function, and regular expressions are generated as pending filtering rules according to different rule generation strategies, and then submitted to the rule update module 53.

[0107] The rule update module 53 is used to maintain the pending filtering rule base, which is independent of the firewall. It identifies attacks on the arriving test attack samples, updates the non-redundant policies in the rule base that match valid attacks and new policies that match unknown attacks to the firewall rule set, and completes the update of the firewall rule set.

[0108] The above-mentioned firewall rule updating system 5 runs the attack sample generation module 51, the protection rule generation module 52 and the protection rule update module 53 based on the adversarial generation network technology on an independent device to realize the automatic update of the firewall rules. First, the simulated attack sample is generated by means of the adversarial generation network technology. Then, according to the feedback results of the firewall and professionals, the protection rule generation module 52 determines the priority of the attack sample and generates a regular expression as a pending filtering rule according to the corresponding rule generation strategy. Finally, the protection rule update module 53 submits the valid and non-redundant rules to the firewall. Compared with the traditional technology, it does not need to consume manpower to specially design the firewall rules, and realizes the update of the firewall protection rules with low manual intervention and fast iteration.

[0109] It is to be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0110] Based on the same inventive concept, the embodiment of the present application also provides a firewall rule updating device for implementing the firewall rule updating method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more firewall rule updating device embodiments provided below can refer to the limitations of the firewall rule updating method above, and will not be repeated here.

[0111] In one embodiment, Figure 6 As shown, a firewall rule updating device 1 is provided, comprising: an acquisition module 11, a feature extraction module 12, a rule generation module 13 and an updating module 14, wherein:

[0112] An acquisition module 11 is used to acquire a target attack sample corresponding to the current firewall rule;

[0113] A feature extraction module 12, configured to determine attack feature information in a target attack sample when the target attack sample contains a preset attack behavior;

[0114] A rule generation module 13 is used to generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0115] The updating module 14 is used to update the current firewall rules according to the newly added firewall rules.

[0116] In one embodiment, the acquisition module 11 is further used to: acquire a simulated attack sample output by the adversarial generation network;

[0117] Determine the target attack sample based on the simulated attack sample and the real attack sample corresponding to the current firewall rules within the update cycle.

[0118] In one embodiment, the device further comprises a training module, the training module being used to: perform vector formatting processing on the original attack sample;

[0119] The original attack samples after vector formatting are used as training sets;

[0120] The training set is used to train the initial network to obtain the adversarial generation network.

[0121] In one embodiment, the device further includes a judgment module, which is used to: analyze keywords in the target attack sample according to the feature extraction function to determine whether the target attack sample contains context attack behaviors and / or attack behaviors carrying special characters;

[0122] If so, it is determined that the target attack sample contains the preset attack behavior.

[0123] In one embodiment, the rule generation module 13 is further used to: if the preset attack behavior is a context attack behavior, generate a rule strategy corresponding to the context attack behavior to predict the number and location of the attack feature information in the attack sample to be identified;

[0124] According to the number and location of attack feature information in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0125] In one embodiment, the rule generation module 13 is further used to: if the preset attack behavior is an attack behavior carrying special characters, based on the rule generation strategy corresponding to the attack behavior carrying special characters, predict the number and feature content of the attack feature information appearing in the attack sample to be identified;

[0126] According to the number and feature content of the attack feature information in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0127] Each module in the above-mentioned firewall rule updating device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0128] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data of a firewall rule updating method. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a firewall rule updating method is implemented.

[0129] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0131] Get the target attack samples corresponding to the current firewall rules;

[0132] In the case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample;

[0133] Generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0134] Update the current firewall rules according to the newly added firewall rules.

[0135] In one embodiment, when the processor executes the logic of the computer program to obtain the target attack sample corresponding to the current firewall rule, the following steps are specifically implemented: obtaining the simulated attack sample output by the adversarial generation network; determining the target attack sample according to the simulated attack sample and the real attack sample corresponding to the current firewall rule within the update cycle.

[0136] In one embodiment, when the processor executes the computer program, the following steps are also implemented: vector formatting the original attack sample; using the vector formatted original attack sample as a training set; and using the training set to train the initial network to obtain an adversarial generation network.

[0137] In one embodiment, when the processor executes the computer program, the following steps are also implemented: according to the feature extraction function, the keywords in the target attack sample are analyzed to determine whether the target attack sample contains contextual attack behaviors and / or attack behaviors carrying special characters; if so, it is determined that the target attack sample contains preset attack behaviors.

[0138] In one embodiment, when a processor executes a computer program to generate a strategy based on attack feature information and rules corresponding to preset attack behaviors, and determines the logic of a new firewall rule corresponding to a target attack sample, the following steps are specifically implemented: if the preset attack behavior is a contextual attack behavior, a strategy is generated based on the rules corresponding to the contextual attack behavior to predict the number and position of the attack feature information appearing in the attack sample to be identified; and a new firewall rule corresponding to the target attack sample is generated based on the number and position of the attack feature information appearing in the attack sample to be identified.

[0139] In one embodiment, when the processor executes a computer program to generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determines the logic of the newly added firewall rule corresponding to the target attack sample, the following steps are specifically implemented: if the preset attack behavior is an attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, the number and feature content of the attack feature information appearing in the attack sample to be identified are predicted; based on the number and feature content of the attack feature information appearing in the attack sample to be identified, a newly added firewall rule corresponding to the target attack sample is generated.

[0140] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0141] Get the target attack samples corresponding to the current firewall rules;

[0142] In the case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample;

[0143] Generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0144] Update the current firewall rules according to the newly added firewall rules.

[0145] In one embodiment, when the logic of the computer program for obtaining the target attack sample corresponding to the current firewall rule is executed by the processor, the following steps are specifically implemented: obtaining the simulated attack sample output by the adversarial generation network; determining the target attack sample according to the simulated attack sample and the real attack sample corresponding to the current firewall rule within the update cycle.

[0146] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: vector formatting the original attack sample; using the original attack sample after vector formatting as a training set; using the training set to train the initial network to obtain an adversarial generation network.

[0147] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: according to the feature extraction function, the keywords in the target attack sample are analyzed to determine whether the target attack sample contains contextual attack behaviors and / or attack behaviors carrying special characters; if so, it is determined that the target attack sample contains preset attack behaviors.

[0148] In one embodiment, when a computer program generates a strategy based on attack feature information and rules corresponding to preset attack behaviors and determines the logic of adding a firewall rule corresponding to a target attack sample and is executed by a processor, the following steps are specifically implemented: if the preset attack behavior is a contextual attack behavior, a strategy is generated based on the rules corresponding to the contextual attack behavior to predict the number and position of the attack feature information in the attack sample to be identified; and a new firewall rule corresponding to the target attack sample is generated based on the number and position of the attack feature information in the attack sample to be identified.

[0149] In one embodiment, when a computer program generates a strategy based on attack feature information and rules corresponding to preset attack behaviors and determines the logic of adding a firewall rule corresponding to a target attack sample and is executed by a processor, the following steps are specifically implemented: if the preset attack behavior is an attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, the number and feature content of the attack feature information appearing in the attack sample to be identified are predicted; and based on the number and feature content of the attack feature information appearing in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0150] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0151] Get the target attack samples corresponding to the current firewall rules;

[0152] In the case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample;

[0153] Generate a strategy based on the attack feature information and the rules corresponding to the preset attack behavior, and determine the new firewall rules corresponding to the target attack sample;

[0154] Update the current firewall rules according to the newly added firewall rules.

[0155] In one embodiment, when the logic of the computer program for obtaining the target attack sample corresponding to the current firewall rule is executed by the processor, the following steps are specifically implemented: obtaining the simulated attack sample output by the adversarial generation network; determining the target attack sample according to the simulated attack sample and the real attack sample corresponding to the current firewall rule within the update cycle.

[0156] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: vector formatting the original attack sample; using the original attack sample after vector formatting as a training set; using the training set to train the initial network to obtain an adversarial generation network.

[0157] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: according to the feature extraction function, the keywords in the target attack sample are analyzed to determine whether the target attack sample contains contextual attack behaviors and / or attack behaviors carrying special characters; if so, it is determined that the target attack sample contains preset attack behaviors.

[0158] In one embodiment, when a computer program generates a strategy based on attack feature information and rules corresponding to preset attack behaviors and determines the logic of adding a firewall rule corresponding to a target attack sample and is executed by a processor, the following steps are specifically implemented: if the preset attack behavior is a contextual attack behavior, a strategy is generated based on the rules corresponding to the contextual attack behavior to predict the number and position of the attack feature information in the attack sample to be identified; and a new firewall rule corresponding to the target attack sample is generated based on the number and position of the attack feature information in the attack sample to be identified.

[0159] In one embodiment, when a computer program generates a strategy based on attack feature information and rules corresponding to preset attack behaviors and determines the logic of adding a firewall rule corresponding to a target attack sample and is executed by a processor, the following steps are specifically implemented: if the preset attack behavior is an attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, the number and feature content of the attack feature information appearing in the attack sample to be identified are predicted; and based on the number and feature content of the attack feature information appearing in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0160] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0161] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A firewall rule updating method, characterized in that: The method comprises: Get the target attack samples corresponding to the current firewall rules; In a case where the target attack sample includes a preset attack behavior, determining attack feature information in the target attack sample; Determine a new firewall rule corresponding to the target attack sample according to the attack feature information and the rule generation strategy corresponding to the preset attack behavior; The current firewall rules are updated according to the newly added firewall rules.

2. The method according to claim 1, characterized in that The obtaining of the target attack sample corresponding to the current firewall rule includes: Get simulated attack samples output by the adversarial generative network; A target attack sample is determined according to the simulated attack sample and the real attack sample corresponding to the current firewall rule within an update period.

3. The method according to claim 2, characterized in that The adversarial generation network is trained in the following way: Format the original attack sample into a vector; The original attack samples after vector formatting are used as training sets; The training set is used to train the initial network to obtain the adversarial generation network.

4. The method according to claim 1, characterized in that The method further comprises: Analyzing keywords in the target attack sample according to a feature extraction function to determine whether the target attack sample contains contextual attack behaviors and / or attack behaviors carrying special characters; If so, it is determined that the target attack sample contains a preset attack behavior.

5. The method according to claim 4, characterized in that The step of generating a rule strategy corresponding to the target attack sample based on the attack feature information and the preset attack behavior to determine a new firewall rule corresponding to the target attack sample includes: If the preset attack behavior is the context attack behavior, then based on the rule generation strategy corresponding to the context attack behavior, predict the number and position of the attack feature information appearing in the attack sample to be identified; According to the number and position of the attack feature information appearing in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

6. The method according to claim 4, characterized in that The step of generating a rule strategy corresponding to the target attack sample based on the attack feature information and the preset attack behavior to determine a new firewall rule corresponding to the target attack sample includes: If the preset attack behavior is the attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, predict the number and feature content of the attack feature information appearing in the attack sample to be identified; According to the number and feature content of the attack feature information in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

7. A firewall rule updating device, characterized in that: The device comprises: The acquisition module is used to obtain the target attack samples corresponding to the current firewall rules; A feature extraction module, configured to determine attack feature information in the target attack sample when the target attack sample contains a preset attack behavior; A rule generation module, used to determine a new firewall rule corresponding to the target attack sample according to the attack feature information and the rule generation strategy corresponding to the preset attack behavior; An updating module is used to update the current firewall rules according to the newly added firewall rules.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images