Firewall rule updating method and apparatus, computer device, and storage medium

Abstract

This application relates to the field of network security technology, and in particular to a firewall rule update method, apparatus, computer device, and storage medium. The method includes: acquiring a target attack sample corresponding to a current firewall rule; if the target attack sample contains a preset attack behavior, determining attack feature information in the target attack sample; determining a new firewall rule corresponding to the target attack sample based on the attack feature information and a rule generation strategy corresponding to the preset attack behavior; and updating the current firewall rule according to the new firewall rule. This application can improve the efficiency of firewall rule updates.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a firewall rule updating method and device, computer equipment and storage medium. BACKGROUND

[0002] Web Application Firewall (WAF) is a common security product that performs malicious feature recognition and protection policy on Hypertext Transfer Protocol (HTTP) traffic of enterprise websites or Application (APP) services. WAF can provide access control and traffic audit functions, and can reinforce key web services. Cloud WAF can also run as a reverse proxy, returning normal and safe traffic to the server.

[0003] Currently, WAF relies on rule sets to filter business traffic. When updating the rule set, professional personnel need to design rules to deal with certain attack traffic.

[0004] However, due to the characteristics of large traffic scale and complex content of web services, manual maintenance efficiency is low, resulting in that the firewall rule delivery always lags behind the occurrence of attack events. Therefore, there is an urgent need for improvement. SUMMARY

[0005] Therefore, it is necessary to provide a firewall rule updating method and device, computer equipment and storage medium capable of optimizing the timeliness of firewall rule updating in view of the above technical problems.

[0006] In a first aspect, the present application provides a firewall rule updating method, which comprises:

[0007] obtaining a target attack sample corresponding to a current firewall rule;

[0008] determining attack feature information in the target attack sample in the case that the target attack sample contains a preset attack behavior;

[0009] generating a strategy according to the attack feature information and a rule corresponding to the preset attack behavior, and determining a new firewall rule corresponding to the target attack sample;

[0010] updating the current firewall rule according to the new firewall rule.

[0011] In one of the embodiments, obtaining a target attack sample corresponding to a current firewall rule comprises:

[0012] obtaining a simulated attack sample output by a generative adversarial network;

[0013] The target attack sample is determined based on the simulated attack sample and the corresponding real attack sample of the current firewall rules within the update cycle.

[0014] In one embodiment, the adversarial generative network is trained as follows:

[0015] The original attack sample is processed into a vector format;

[0016] Use the original attack samples after vector formatting as the training set;

[0017] The initial network is trained using the training set to obtain the Generative Adversarial Network.

[0018] In one embodiment, the method further includes:

[0019] Based on the feature extraction function, the keywords in the target attack sample are analyzed to determine whether the target attack sample contains contextual attack behavior and / or attack behavior carrying special characters.

[0020] If so, then the target attack sample is determined to contain preset attack behaviors.

[0021] In one embodiment, based on attack feature information and a rule generation policy corresponding to a preset attack behavior, a new firewall rule corresponding to the target attack sample is determined, including:

[0022] If the preset attack behavior is a context attack behavior, then the attack feature information is predicted to appear in the attack sample to be identified based on the rule generation strategy corresponding to the context attack behavior.

[0023] Based on the number and location of attack signature information in the attack sample to be identified, generate new firewall rules corresponding to the target attack sample.

[0024] In one embodiment, based on attack feature information and a rule generation policy corresponding to a preset attack behavior, a new firewall rule corresponding to the target attack sample is determined, including:

[0025] If the preset attack behavior is an attack behavior that carries special characters, then based on the rule generation strategy corresponding to the attack behavior that carries special characters, the number and feature content of the attack feature information appearing in the attack sample to be identified are predicted.

[0026] Based on the number and characteristics of attack signatures appearing in the attack samples to be identified, new firewall rules corresponding to the target attack samples are generated.

[0027] Secondly, this application also provides a firewall rule updating device, which includes:

[0028] The acquisition module is used to acquire the target attack sample corresponding to the current firewall rule;

[0029] The feature extraction module is used to determine the attack feature information in the target attack sample when the target attack sample contains preset attack behaviors;

[0030] The rule generation module is used to determine the new firewall rules corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior.

[0031] The update module is used to update the current firewall rules based on newly added firewall rules.

[0032] Thirdly, this application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0033] Obtain the target attack sample corresponding to the current firewall rule;

[0034] When a target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample;

[0035] Based on the attack characteristic information and the rule generation strategy corresponding to the preset attack behavior, determine the new firewall rule corresponding to the target attack sample;

[0036] Update the current firewall rules based on the newly added firewall rules.

[0037] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0038] Obtain the target attack sample corresponding to the current firewall rule;

[0039] When a target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample;

[0040] Based on the attack characteristic information and the rule generation strategy corresponding to the preset attack behavior, determine the new firewall rule corresponding to the target attack sample;

[0041] Update the current firewall rules based on the newly added firewall rules.

[0042] Fifthly, this application also provides a computer program product comprising a computer program that, when executed by a processor, performs the following steps:

[0043] Obtain the target attack sample corresponding to the current firewall rule;

[0044] When a target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample;

[0045] Based on the attack characteristic information and the rule generation strategy corresponding to the preset attack behavior, determine the new firewall rule corresponding to the target attack sample;

[0046] Update the current firewall rules based on the newly added firewall rules.

[0047] The aforementioned firewall rule update method, apparatus, computer equipment, and storage medium, when it is necessary to update the current firewall rules, first verify whether the target attack sample contains a preset attack behavior. By identifying specific attack behaviors, the attack feature information corresponding to the specific attack behavior can be extracted. A rule generation strategy corresponding to each attack behavior is adopted to specifically generate new firewall rules corresponding to the attack feature information. Based on the automatically generated firewall rules, differentiated processing can be performed for each attack behavior. Then, based on the new firewall rules, the current firewall rules are automatically updated. Compared with traditional technologies, this application does not require specialized personnel to design firewall rules, achieving low-intervention and rapid iteration of firewall rule updates, solving problems such as high manpower costs, slow rule updates, and lack of flexibility in firewall rule updates. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating a firewall rule update method in one embodiment;

[0049] Figure 2 This is a flowchart illustrating the process of determining a target attack sample in one embodiment;

[0050] Figure 3 This is a schematic diagram of generator G in an adversarial generative network in one embodiment;

[0051] Figure 4 This is a flowchart illustrating the process of determining whether a preset attack behavior is included in one embodiment.

[0052] Figure 5 This is a schematic diagram of a firewall rule update system in another embodiment;

[0053] Figure 6 This is a structural block diagram of a firewall rule update device in one embodiment;

[0054] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0056] The firewall update method provided in this application embodiment, such as Figure 1 As shown, a firewall rule update method is provided. Taking the application of this method to a computer device as an example, it includes the following steps:

[0057] S101, obtain the target attack sample corresponding to the current firewall rule.

[0058] The current firewall rule refers to the rule currently used by the firewall; it can be understood that, under the preset update policy, the firewall rules are updated according to the preset update cycle.

[0059] Optionally, the target attack sample corresponding to the current firewall rule is the attack traffic collected by the firewall during the process of using the current firewall rule.

[0060] The attack traffic can be either a Structured Query Language (SQL) injection attack or a Cross-Site Scripting (XSS) attack. SQL injection attacks exploit the lack of strict checks and filtering of user input data in existing applications to inject malicious SQL commands into the backend database engine for execution, aiming to steal data or even control the database server. XSS attacks involve malicious attackers inserting malicious script code into web pages. When a user browses the page, the embedded malicious script code is executed, achieving the user's malicious intent. Furthermore, this embodiment can perform anonymization processing on the aforementioned attack traffic. Specifically, it can anonymize the MAC address and IP address in the attack traffic and use the anonymized attack traffic as the target sample.

[0061] In addition, the target attack samples in this embodiment may include attack traffic that can be identified by the current firewall rules, as well as unknown attack traffic that the firewall cannot identify and that is provided by manual review.

[0062] S102, if the target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample.

[0063] The preset attack behaviors may include: 1) attack behaviors that cause abnormal traffic rates in normal protocol message data; 2) attack behaviors that cause abnormal attack fields to be included in normal protocol message data; and 3) attack behaviors that cause inconsistencies in the context of normal protocol message data.

[0064] It is understandable that: 1) An attack that causes abnormal traffic rates in normal protocol message data refers to configuring the initial traffic rate (script / second), the incremental growth rate per second, the maximum traffic rate (if the test network cannot reach the maximum traffic rate, it should reach the maximum rate that can be reached under the network environment), the duration after reaching the maximum rate, and the interval step size of the traffic rate; 2) An attack that causes abnormal attack fields in normal protocol message data refers to replacing the value of the characteristic data field in the message data with a preset abnormal value; 3) An attack that causes inconsistency in the context of normal protocol message data refers to swapping the positions of certain fields in the normal protocol message data, or filling the normal data with irrelevant data before and after, or removing the content of certain fields.

[0065] Specifically, when a pre-defined attack behavior is identified, a feature extraction strategy corresponding to that pre-defined attack behavior can be used to determine the attack feature information in the target attack sample. It can be understood that attack feature information refers to the attack features (fields) used when executing that attack behavior.

[0066] S103, Based on the attack feature information and the rules corresponding to the preset attack behaviors, generate policies and determine the new firewall rules corresponding to the target attack sample.

[0067] Each type of preset attack behavior has a corresponding rule generation strategy. Based on the corresponding rule generation strategy and combined with the attack feature fields (i.e. attack feature information) used when executing the attack behavior, a firewall rule for filtering the attack behavior can be generated as a new firewall rule.

[0068] Optionally, after generating the firewall rule for filtering the attack, the firewall rule can be first stored as a pending filtering rule in the pending filtering rule library; the effectiveness of the pending filtering rule can be verified by testing attack traffic, and the pending filtering rule that passes the verification can be added as a new firewall rule.

[0069] For example, in this embodiment, the pending filtering rule base is independent of the firewall. The pending filtering rules are used to identify incoming test attack traffic. If the firewall with the current firewall rules can also identify the test attack traffic, the redundancy of the pending filtering rule is determined. If it is a redundant rule, it is deleted from the pending filtering rule base; if it is a non-redundant rule, it is retained as a new firewall rule. If the firewall with the current firewall rules fails to identify the test attack traffic, the pending filtering rule is confirmed as a non-redundant rule and retained as a new firewall rule.

[0070] S104. Update the current firewall rules based on the newly added firewall rules.

[0071] Specifically, at the update time point corresponding to the update cycle, the current firewall rules are updated using newly added firewall rules. Optionally, during the update, an update request can be sent to the administrator. If an update confirmation is received from the administrator, the current firewall rules are updated accordingly.

[0072] In the aforementioned firewall rule update method, when it is necessary to update the current firewall rules, the method first verifies whether the target attack sample contains a preset attack behavior. By identifying specific attack behaviors, the attack feature information corresponding to the specific attack behavior can be extracted. Then, a rule generation strategy corresponding to each attack behavior is adopted to generate new firewall rules corresponding to the attack feature information. Based on the automatic generation of firewall rules, differentiated processing can be performed for each attack behavior. Finally, based on the new firewall rules, the current firewall rules are automatically updated. Compared with traditional technologies, this application does not require professional manpower to design firewall rules, realizing low-manual intervention and rapid iteration of firewall rule updates. It solves the problems of huge manpower costs, slow rule updates, and lack of flexibility in firewall rule updates.

[0073] like Figure 2 As shown, this embodiment provides an optional method for obtaining the target attack sample corresponding to the current firewall rule, that is, a method for refining S101. The specific implementation process may include:

[0074] S201, Obtain simulated attack samples output by the adversarial generative network.

[0075] Specifically, the Generative Adversarial Network (GAN) is trained as follows: the original attack samples are processed into vectors; the original attack samples after vector formatting are used as the training set; the initial network is trained using the training set to obtain the GAN.

[0076] The original attack samples are the historical attack traffic collected within a historical time period.

[0077] Optionally, before performing vector formatting on the original attack sample, the original attack sample can also be deduplicated and cleaned. Deduplication refers to removing redundant samples from the dataset, while cleaning refers to removing regular communication samples and application layer data samples from the historical attack traffic context.

[0078] Specifically, the original attack samples are processed into vector formatting, including: organizing historical attack traffic into 784 bytes, splitting long samples, padding short samples with 0x00 bytes, and then organizing them into a 128-bit 28×28 grayscale image as the input vector for the adversarial generative network.

[0079] Furthermore, the initial network is trained to obtain an adversarial generative network, including: using the training set, training a classic adversarial generative network (the initial network) to obtain a generator G, the network structure of which is as follows: Figure 3 As shown, the input to this network structure is a 100-bit random vector, and the output is a 128-bit grayscale image of size 28×28. In this embodiment, the formatted output vector in the generator G is used as a simulated attack sample.

[0080] S202, determine the target attack sample based on the simulated attack sample and the real attack sample corresponding to the current firewall rule within the update cycle.

[0081] In this embodiment, the target attack sample is determined by comparing simulated attack samples with real attack samples corresponding to the current firewall rules within the update cycle. The real attack samples may include attack traffic that the current firewall rules fail to identify (provided by the administrator). Specifically, the administrator can report unknown attacks based on intrusion prevention systems, EDR (Electronic Data Recognition), or auditing systems.

[0082] In this embodiment, historical attack samples are learned using Generative Adversarial Network (GAN) technology to generate simulated attack samples for firewall testing. This effectively shifts rule updates from passive, attack-event-driven to proactive, learning-based updates, improving rule iteration speed and search space. Furthermore, once an attack event corresponding to a real attack sample occurs, a target attack sample can be generated. New firewall rules can be generated promptly based on the target attack sample, resulting in faster update response. Administrators can still extract and modify these rules later. Additionally, this embodiment significantly reduces the human resource costs associated with firewall rule maintenance. Only the target attack sample needs to be provided, eliminating the need for manual submission of specific attack rules, thus increasing the automation level of the firewall hardening system and reducing manual intervention.

[0083] In one embodiment, such as Figure 4As shown, when determining that a target attack sample contains preset attack behaviors, the following methods can be used:

[0084] S401, Based on the feature extraction function, analyze the keywords in the target attack sample to determine whether the target attack sample contains contextual attack behavior and / or attack behavior carrying special characters.

[0085] In this implementation, the feature extraction functions include the Delete function and the Replace function. The Delete function is shown in equation (1) and the Replace function is shown in equation (2).

[0086] (1)

[0087] (2)

[0088] Wherein, st in equations (1) and (2) r0 str1 and str2 are any three consecutive strings in the target attack sample;

[0089] del(str1, str0, str2) is used to verify whether str0+str1+str2 has context attack characteristics;

[0090] rp(str1, str1', str0, str2) is used to match specific content of str1 to determine whether the string str1 carries special characters.

[0091] Specifically, based on the feature extraction function, when verifying the attack behavior of each target attack sample, the verification results can include the following four types, as shown in Table 1 below:

[0092] Table 1

[0093]

[0094] The result extracted by the Delete function (or Replace function) includes 1 or 0; the result is jointly provided by the firewall (current firewall rules) and the administrator, 1 represents that there is a certain attack behavior, and 0 represents that there is no such attack behavior.

[0095] S402, if so, then it is determined that the target attack sample contains a preset attack behavior.

[0096] S403, if not, then it is determined that the target attack sample does not contain the preset attack behavior.

[0097] Furthermore, corresponding to Table 1 above, in one embodiment, determining the new firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior can include the following two methods:

[0098] Method 1: If the preset attack behavior is a context attack behavior, then based on the rule generation strategy corresponding to the context attack behavior, predict the number and location of attack feature information in the attack sample to be identified; based on the number and location of attack feature information in the attack sample to be identified, generate a new firewall rule corresponding to the target attack sample.

[0099] Method 2: If the preset attack behavior is an attack behavior that carries special characters, then based on the rule generation strategy corresponding to the attack behavior that carries special characters, predict the number and feature content of the attack feature information in the attack sample to be identified; based on the number and feature content of the attack feature information in the attack sample to be identified, generate a new firewall rule corresponding to the target attack sample.

[0100] Among them, the attack samples to be identified are the attack traffic corresponding to the attacker's attack on the firewall.

[0101] Specifically, different attack behaviors employ different rule generation strategies to generate different regular expressions, which are the aforementioned pending filtering rules. Correspondingly, the generation of pending filtering rules also includes the following four modes, and each pending filtering rule can also have a corresponding priority, as shown in Table 2 below:

[0102] Table 2

[0103]

[0104] For example, such as Figure 5 As shown, based on the above embodiments, this embodiment provides a firewall rule update system 5, which includes an attack sample generation module 51, a rule generation module 52, and a rule update module 53, wherein:

[0105] The attack sample generation module 51 is used to train the generator G in the adversarial generative network model by using the historical attack data collected by the firewall with the adversarial generative network algorithm. The generator G generates simulated attack samples with random vectors and then submits them to the firewall.

[0106] The rule generation module 52 is used to receive simulated attack samples identified by the firewall and unknown attack samples that the firewall could not identify, submitted by the administrator based on the actual situation. These samples are used as target attack samples. The module extracts features from the target attack samples and maintains a feature library. The module obtains the attack behavior of the target attack samples through the feature extraction function, generates regular expressions according to different rule generation strategies as pending filtering rules, and then submits them to the rule update module 53.

[0107] The rule update module 53 is used to maintain the pending filtering rule base. The pending filtering rule base is independent of the firewall. It identifies attacks on incoming test attack samples, updates the non-redundant policies that match valid attacks and the new policies that match unknown attacks in the rule base to the firewall's rule set, and completes the update of the firewall rule set.

[0108] The aforementioned firewall rule update system 5 runs on a separate device, employing an attack sample generation module 51 based on Generative Adversarial Networks (GAN) technology, a protection rule generation module 52, and a protection rule update module 53 to automatically update firewall rules. First, simulated attack samples are generated using GAN technology. Then, based on feedback from the firewall and professionals, the protection rule generation module 52 determines the priority of the attack sample and generates regular expressions as pending filtering rules according to the corresponding rule generation strategy. Finally, the protection rule update module 53 submits the valid and non-redundant rules to the firewall. Compared to traditional technologies, this eliminates the need for manual design of firewall rules, achieving low-intervention and rapid iteration of firewall protection rule updates.

[0109] It is understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0110] Based on the same inventive concept, this application also provides a firewall rule updating apparatus for implementing the firewall rule updating method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more firewall rule updating apparatus embodiments provided below can be found in the limitations of the firewall rule updating method described above, and will not be repeated here.

[0111] In one embodiment, such as Figure 6 As shown, a firewall rule update device 1 is provided, comprising: an acquisition module 11, a feature extraction module 12, a rule generation module 13, and an update module 14, wherein:

[0112] Module 11 is used to obtain the target attack sample corresponding to the current firewall rule;

[0113] Feature extraction module 12 is used to determine attack feature information in a target attack sample when the target attack sample contains a preset attack behavior;

[0114] Rule generation module 13 is used to determine the new firewall rules corresponding to the target attack sample based on attack feature information and the rule generation strategy corresponding to the preset attack behavior.

[0115] Update module 14 is used to update the current firewall rules based on newly added firewall rules.

[0116] In one embodiment, the acquisition module 11 is further configured to: acquire simulated attack samples output by the adversarial generation network;

[0117] The target attack sample is determined based on the simulated attack sample and the corresponding real attack sample of the current firewall rules within the update cycle.

[0118] In one embodiment, the apparatus further includes a training module, which is configured to: perform vector formatting processing on the original attack sample;

[0119] Use the original attack samples after vector formatting as the training set;

[0120] The initial network is trained using the training set to obtain the Generative Adversarial Network.

[0121] In one embodiment, the device further includes a judgment module, which is used to: analyze the keywords in the target attack sample according to the feature extraction function to determine whether the target attack sample contains contextual attack behavior and / or attack behavior carrying special characters;

[0122] If so, then the target attack sample is determined to contain preset attack behaviors.

[0123] In one embodiment, the rule generation module 13 is further configured to: if the preset attack behavior is a context attack behavior, predict the number and location of attack feature information appearing in the attack sample to be identified based on the rule generation strategy corresponding to the context attack behavior;

[0124] Based on the number and location of attack signature information in the attack sample to be identified, generate new firewall rules corresponding to the target attack sample.

[0125] In one embodiment, the rule generation module 13 is further configured to: if the preset attack behavior is an attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, predict the number and feature content of attack feature information appearing in the attack sample to be identified.

[0126] Based on the number and characteristics of attack signatures appearing in the attack samples to be identified, new firewall rules corresponding to the target attack samples are generated.

[0127] The modules in the aforementioned firewall rule update device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0128] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores data for firewall rule update methods. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a firewall rule update method.

[0129] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0130] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0131] Obtain the target attack sample corresponding to the current firewall rule;

[0132] When a target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample;

[0133] Based on the attack characteristic information and the rule generation strategy corresponding to the preset attack behavior, determine the new firewall rule corresponding to the target attack sample;

[0134] Update the current firewall rules based on the newly added firewall rules.

[0135] In one embodiment, when the processor executes the logic of the computer program to obtain the target attack sample corresponding to the current firewall rule, it specifically implements the following steps: obtaining the simulated attack sample output by the adversarial generation network; and determining the target attack sample based on the simulated attack sample and the real attack sample corresponding to the current firewall rule within the update cycle.

[0136] In one embodiment, when the processor executes the computer program, it further performs the following steps: vector formatting of the original attack samples; using the vector formatted original attack samples as a training set; and training the initial network using the training set to obtain an adversarial generative network.

[0137] In one embodiment, when the processor executes the computer program, it further performs the following steps: according to the feature extraction function, analyzes the keywords in the target attack sample to determine whether the target attack sample contains contextual attack behavior and / or attack behavior carrying special characters; if so, it determines that the target attack sample contains preset attack behavior.

[0138] In one embodiment, when the processor executes the logic of a computer program to determine the new firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior, the following steps are specifically implemented: if the preset attack behavior is a context attack behavior, then based on the rule generation strategy corresponding to the context attack behavior, the number and location of attack feature information appearing in the attack sample to be identified are predicted; based on the number and location of attack feature information appearing in the attack sample to be identified, the new firewall rule corresponding to the target attack sample is generated.

[0139] In one embodiment, when the processor executes a computer program to determine the logic of adding a new firewall rule corresponding to the target attack sample based on attack feature information and a rule generation strategy corresponding to a preset attack behavior, the following steps are specifically implemented: if the preset attack behavior is an attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, the number and feature content of attack feature information appearing in the attack sample to be identified are predicted; and based on the number and feature content of attack feature information appearing in the attack sample to be identified, a new firewall rule corresponding to the target attack sample is generated.

[0140] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0141] Obtain the target attack sample corresponding to the current firewall rule;

[0142] When a target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample;

[0143] Based on the attack characteristic information and the rule generation strategy corresponding to the preset attack behavior, determine the new firewall rule corresponding to the target attack sample;

[0144] Update the current firewall rules based on the newly added firewall rules.

[0145] In one embodiment, when the logic of the computer program to obtain the target attack sample corresponding to the current firewall rule is executed by the processor, the following steps are specifically implemented: obtaining the simulated attack sample output by the adversarial generation network; determining the target attack sample based on the simulated attack sample and the real attack sample corresponding to the current firewall rule in the update cycle.

[0146] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: performing vector formatting on the original attack samples; using the vector-formatted original attack samples as a training set; and using the training set to train the initial network to obtain an adversarial generative network.

[0147] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: analyzing the keywords in the target attack sample according to the feature extraction function to determine whether the target attack sample contains contextual attack behavior and / or attack behavior carrying special characters; if so, it is determined that the target attack sample contains preset attack behavior.

[0148] In one embodiment, when the logic of determining the new firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior is executed by the processor, the following steps are specifically implemented: if the preset attack behavior is a context attack behavior, then based on the rule generation strategy corresponding to the context attack behavior, predict the number and location of attack feature information in the attack sample to be identified; generate the new firewall rule corresponding to the target attack sample based on the number and location of attack feature information in the attack sample to be identified.

[0149] In one embodiment, when the logic of determining the new firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior is executed by the processor, the following steps are specifically implemented: if the preset attack behavior is an attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, the number and feature content of the attack feature information appearing in the attack sample to be identified are predicted; based on the number and feature content of the attack feature information appearing in the attack sample to be identified, the new firewall rule corresponding to the target attack sample is generated.

[0150] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0151] Obtain the target attack sample corresponding to the current firewall rule;

[0152] When a target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample;

[0153] Based on the attack characteristic information and the rule generation strategy corresponding to the preset attack behavior, determine the new firewall rule corresponding to the target attack sample;

[0154] Update the current firewall rules based on the newly added firewall rules.

[0155] In one embodiment, when the logic of the computer program to obtain the target attack sample corresponding to the current firewall rule is executed by the processor, the following steps are specifically implemented: obtaining the simulated attack sample output by the adversarial generation network; determining the target attack sample based on the simulated attack sample and the real attack sample corresponding to the current firewall rule in the update cycle.

[0156] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: performing vector formatting on the original attack samples; using the vector-formatted original attack samples as a training set; and using the training set to train the initial network to obtain an adversarial generative network.

[0157] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: analyzing the keywords in the target attack sample according to the feature extraction function to determine whether the target attack sample contains contextual attack behavior and / or attack behavior carrying special characters; if so, it is determined that the target attack sample contains preset attack behavior.

[0158] In one embodiment, when the logic of determining the new firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior is executed by the processor, the following steps are specifically implemented: if the preset attack behavior is a context attack behavior, then based on the rule generation strategy corresponding to the context attack behavior, predict the number and location of attack feature information in the attack sample to be identified; generate the new firewall rule corresponding to the target attack sample based on the number and location of attack feature information in the attack sample to be identified.

[0159] In one embodiment, when the logic of determining the new firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior is executed by the processor, the following steps are specifically implemented: if the preset attack behavior is an attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, the number and feature content of the attack feature information appearing in the attack sample to be identified are predicted; based on the number and feature content of the attack feature information appearing in the attack sample to be identified, the new firewall rule corresponding to the target attack sample is generated.

[0160] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0161] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A firewall rule update method, characterized in that, The method includes: Obtain simulated attack samples output by the adversarial generative network; Based on the simulated attack samples and the real attack samples corresponding to the current firewall rules within the update cycle, the target attack samples are determined, wherein the real attack samples include attack traffic that is not identified by the current firewall rules; If the target attack sample contains a preset attack behavior, determine the attack feature information in the target attack sample; Based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior, determine the firewall rule corresponding to the target attack sample; The identified firewall rules are used as pending filtering rules. The effectiveness of the blocking effect of the pending filtering rules is verified by testing attack traffic. The pending filtering rules that pass the verification are added as new firewall rules. Update the current firewall rules based on the newly added firewall rules.

2. The method according to claim 1, characterized in that, The adversarial generative network is trained in the following manner: The original attack sample is processed into a vector format; Use the original attack samples after vector formatting as the training set; The initial network is trained using the training set to obtain the adversarial generative network.

3. The method according to claim 1, characterized in that, The method further includes: Based on the feature extraction function, the keywords in the target attack sample are analyzed to determine whether the target attack sample contains contextual attack behavior and / or attack behavior carrying special characters; If so, then the target attack sample is determined to contain a preset attack behavior.

4. The method according to claim 3, characterized in that, The step of determining the firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation policy corresponding to the preset attack behavior includes: If the preset attack behavior is the context attack behavior, then based on the rule generation strategy corresponding to the context attack behavior, predict the number and location of the attack feature information in the attack sample to be identified; Based on the number and location of the attack feature information in the attack sample to be identified, firewall rules corresponding to the target attack sample are generated.

5. The method according to claim 3, characterized in that, The step of determining the firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation policy corresponding to the preset attack behavior includes: If the preset attack behavior is the attack behavior carrying special characters, then based on the rule generation strategy corresponding to the attack behavior carrying special characters, the number and feature content of the attack feature information appearing in the attack sample to be identified are predicted. Based on the number and characteristics of the attack feature information appearing in the attack sample to be identified, firewall rules corresponding to the target attack sample are generated.

6. The method according to claim 1, characterized in that, The effectiveness of the pending filtering rules is verified by testing attack traffic, and the verified pending filtering rules are added as new firewall rules, including: The incoming test attack traffic is identified by the pending filtering rules. If both the pending filtering rules and the firewall configured with the current firewall rules identify the test attack traffic, the redundancy of the pending filtering rules is determined. If the pending filtering rule is a non-redundant rule, it will be added as a new firewall rule.

7. A firewall rule update device, characterized in that, The device includes: The acquisition module is used to acquire simulated attack samples output by the adversarial generation network; and to determine target attack samples based on the simulated attack samples and the real attack samples corresponding to the current firewall rules within the update cycle, wherein the real attack samples include attack traffic not identified by the current firewall rules. The feature extraction module is used to determine the attack feature information in the target attack sample when the target attack sample contains a preset attack behavior; The rule generation module is used to determine the firewall rule corresponding to the target attack sample based on the attack feature information and the rule generation strategy corresponding to the preset attack behavior; the determined firewall rule is used as a pending filtering rule, the effectiveness of the blocking effect of the pending filtering rule is verified by testing attack traffic, and the pending filtering rule that passes the verification is used as a new firewall rule. The update module is used to update the current firewall rules based on the newly added firewall rules.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images