Network request detection method and system based on threat intelligence

Abstract

The invention discloses a network request detection method and system based on threat intelligence, and the method comprises the steps: obtaining a first client and a second client through obtaining the safety requirement level of a client; and when the network request is detected, obtaining a sending source of the network request, and if the sending source is the first client, executing security detection on the network request according to the first threat intelligence information to obtain a first detection result. And if the sending source is the second client, performing security detection on the network request according to the second threat intelligence information to obtain a second detection result. According to the method and the device, the clients are classified based on the security requirement levels, security detection is performed on the clients with relatively high security levels through the first threat intelligence information with relatively large data volume, and security detection is performed on the clients with relatively low security levels through the second threat intelligence information with relatively small data volume; therefore, the efficiency of executing security detection on the network requests sent by the clients with different security levels is improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a network request detection method and system based on threat intelligence. Background Art

[0002] When the smart device starts the client of the application, it needs to connect to the network to maintain the network requirements of the client during operation. In order to improve the security of the client operation, the smart device can perform security detection on the network requests issued by the client during operation.

[0003] Smart devices can obtain the network that the network request wants to access, and then perform security checks on the network based on known threat intelligence information. If there is a security threat in the network, the smart device will block the client's access to the network, thereby improving the security of the client's operation.

[0004] Based on a large amount of threat intelligence information, it takes a long time for smart devices to perform security checks on the network. For clients with relatively low security, if the same amount of threat intelligence information is used to perform security checks on network requests issued by clients with different security levels, the efficiency of security checks will be reduced. Summary of the invention

[0005] In order to solve the problem of low efficiency of security detection when performing security detection on network requests through threat intelligence information.

[0006] In a first aspect, some embodiments of the present application provide a network request detection method based on threat intelligence, including:

[0007] Get the client's security requirement level;

[0008] Acquire a first client among the clients whose security requirement level is greater than or equal to a level threshold and a second client among the clients whose security requirement level is less than the level threshold;

[0009] Deploy the first client to a first cloud server, and deploy the second client to a second cloud server, wherein the first cloud server includes first threat intelligence information, and the second cloud server includes second threat intelligence information having a smaller data volume than the first threat intelligence information;

[0010] When a network request is detected, obtaining a sending source of the network request;

[0011] If the sending source is the first client, performing security detection on the network request through the first threat intelligence information to obtain a first detection result;

[0012] If the sending source is the second client, a security check is performed on the network request using the second threat intelligence information to obtain a second detection result.

[0013] In some embodiments, the step of performing security detection on the network request using the first threat intelligence information includes:

[0014] Obtaining network information of the network specified by the network request;

[0015] Searching the first threat intelligence information for target threat intelligence information corresponding to the network information, and generating a search result;

[0016] If the search result is that the target threat intelligence information exists, a first detection result indicating that the request risk exists is generated according to the target threat intelligence information.

[0017] In some embodiments, if the first detection result is that there is no request risk, the method further includes:

[0018] The network request is sent to a first cloud server, so that the first cloud server responds to the network request and connects the first client to a network specified by the network request.

[0019] In some embodiments, the method further comprises:

[0020] storing the network specified by the network request whose first detection result indicates that there is no request risk to a network whitelist of the first client, wherein the network whitelist is used to instruct the first cloud server not to perform security detection on the network;

[0021] When the first detection result is a first detection result with a request risk, the network specified by the network request is stored in a network blacklist of the first client according to the target threat intelligence information, and the network blacklist is used to indicate that the first client cannot connect to a network in the network blacklist.

[0022] In some embodiments, after the step of the first client accessing the network specified by the network request, the method further includes:

[0023] Obtaining network behavior information of the first client after accessing the network specified by the network request;

[0024] If the network behavior information is found in the first threat intelligence information, the connection between the first client and the network specified by the network request is interrupted.

[0025] In some embodiments, the step of interrupting the connection between the first client and the network specified by the network request comprises:

[0026] Performing threat analysis on the network behavior information based on the first threat intelligence information to obtain a behavior path of the network behavior information;

[0027] According to the behavior path, the connection between the first client and the network specified by the network request is interrupted.

[0028] In some embodiments, before the step of performing security detection on the network request using the first threat intelligence information, the method further includes:

[0029] In the smart device where the first client is installed, obtaining local threat intelligence information;

[0030] Perform security detection on the network request according to the local threat intelligence information to obtain a local detection result;

[0031] If the local detection result is that a request risk is detected, security detection is not performed on the network request through the first threat intelligence information.

[0032] In some embodiments, after the steps of deploying the first client to a first cloud server and deploying the second client to a second cloud server, the method further includes:

[0033] Set the update interval of threat intelligence information;

[0034] According to the update interval, the first threat intelligence information of the first cloud server is regularly updated, and the second threat intelligence information of the second cloud server is regularly updated.

[0035] In some embodiments, the step of performing security detection on the network request using the second threat intelligence information includes:

[0036] Obtaining the domain name and network connection of the network request;

[0037] Parsing the network request into a network string according to the domain name and the network connection;

[0038] Obtaining string information of the network string;

[0039] A security check is performed on the character string information using the second threat intelligence information to obtain a second detection result.

[0040] In a second aspect, some embodiments of the present application provide a network request detection system based on threat intelligence, the system comprising a communicator and an executor, the communicator being configured to establish a communication connection with a cloud server, and the executor being configured to:

[0041] Get the client's security requirement level;

[0042] Acquire a first client among the clients whose security requirement level is greater than or equal to a level threshold and a second client among the clients whose security requirement level is less than the level threshold;

[0043] Deploy the first client to a first cloud server, and deploy the second client to a second cloud server, wherein the first cloud server includes first threat intelligence information, and the second cloud server includes second threat intelligence information having a smaller data volume than the first threat intelligence information;

[0044] When a network request is detected, obtaining a sending source of the network request;

[0045] If the sending source is the first client, performing security detection on the network request through the first threat intelligence information to obtain a first detection result;

[0046] If the sending source is the second client, a security check is performed on the network request using the second threat intelligence information to obtain a second detection result.

[0047] It can be seen from the above technical solutions that the present application provides a network request detection method and system based on threat intelligence, which obtains the security requirement level of the client, obtains the first client and the second client, deploys the first client to the first cloud server, and deploys the second client to the second cloud server. When a network request is detected, the sending source of the network request is obtained. If the sending source is the first client, a security check is performed on the network request according to the first threat intelligence information to obtain a first detection result. If the sending source is the second client, a security check is performed on the network request according to the second threat intelligence information to obtain a second detection result. The present application classifies clients based on security requirement levels. For clients with higher security levels, security checks are performed using first threat intelligence information with a relatively large amount of data. For clients with lower security levels, security checks are performed using second threat intelligence information with a relatively small amount of data, thereby improving the efficiency of performing security checks on network requests sent by clients with different security levels. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0049] Figure 1 A flowchart of a network request detection method based on threat intelligence provided in an embodiment of the present application;

[0050] Figure 2 A flowchart of performing security checks on network requests in an embodiment of the present application;

[0051] Figure 3 This is a flow chart of executing network connection according to the security detection result in an embodiment of the present application;

[0052] Figure 4 This is a flowchart of performing security detection based on local threat intelligence information in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose and implementation method of the present application clearer, the exemplary implementation method of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0054] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0055] The terms "first", "second", "third", etc. in the specification and the above drawings of this application are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise specified. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0056] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0057] Smart devices such as mobile phones and TVs can install applications to perform corresponding functional services, such as playing games, listening to music, browsing the web, etc. For some applications, you need to connect to the Internet to use the corresponding functional services. Therefore, before the smart device starts the application, it is necessary to detect the network connection status of the smart device. When the smart device is already connected to the Internet, the smart device can start the application.

[0058] These applications can exist in the form of clients in smart devices. When the smart device starts the application, the client can send a network request to the smart device to request access to the network that the smart device is currently connected to, thereby providing the client with the network support required for operation. In order to improve the security of client operation, the smart device can perform security detection on the network requests issued by the client during operation.

[0059] Smart devices can obtain the network that the network request wants to access, and then perform security checks on the network based on known threat intelligence information. If there is a security threat in the network, the smart device will block the client's access to the network, thereby improving the security of the client's operation.

[0060] When performing security checks, the smart device will obtain the network information corresponding to the network to be accessed, and query the network information in the threat intelligence information. If the network information is queried, it means that the network has a security threat corresponding to the threat intelligence information. The smart device will block the client's access to the network, thereby improving the security of the client's operation.

[0061] Based on a large amount of threat intelligence information, it takes a long time for smart devices to perform security checks on the network. For clients with relatively low security, if the same amount of threat intelligence information is used to perform security checks on network requests issued by clients with different security levels, the efficiency of security checks will be reduced.

[0062] In order to solve the problem of low efficiency of security detection when performing security detection on network requests through threat intelligence information, some embodiments of the present application provide a network request detection method based on threat intelligence, which is applied to smart devices, see Figure 1 , the method comprising:

[0063] S100: Obtain the security requirement level of the client.

[0064] Different clients may have different security requirement levels. Therefore, when starting or installing a client, the smart device may obtain the security requirement level of the client to determine the first threat intelligence information for detection based on the security requirement level.

[0065] It should be noted that a smart device can install or start multiple clients at the same time, so the smart device can obtain the security requirement levels corresponding to multiple client teams at the same time.

[0066] S200: Acquire a first client among the clients whose security requirement level is greater than or equal to a level threshold and a second client among the clients whose security requirement level is less than the level threshold.

[0067] After obtaining the security requirement level, the smart device can classify the client according to the security requirement level. To this end, the smart device can set a level threshold. When the security requirement level of the client is greater than or equal to the level threshold, the client is marked as a first client, that is, a client with a high security requirement level. When the security requirement level of the client is less than the level threshold, the client is marked as a second client, that is, a client with a low security requirement level.

[0068] S300: deploying the first client to a first cloud server, and deploying the second client to a second cloud server.

[0069] For the first client, due to the high level of security requirements, a large amount of threat intelligence information is needed to perform security checks on the first client. Therefore, the smart device can deploy the first client to the first cloud server, and the first cloud server includes the first threat intelligence information for performing security checks on the network requests sent by the first client.

[0070] For the second client, since the security requirement level is low, a relatively small amount of threat intelligence information is needed to perform security checks on the second client. Therefore, the smart device can deploy the second client to the second server, and the second cloud server includes the second threat intelligence information for performing security checks on the network requests sent by the second client.

[0071] Since the security requirement level of the second client is lower than that of the first client, after receiving the network request of the second client, the second cloud server uses the second threat intelligence information with a relatively small data volume to perform security detection on the network request of the second client, which can improve the efficiency of security detection.

[0072] S400: When a network request is detected, obtaining a sending source of the network request.

[0073] When a smart device detects a network request, it means that the smart device is about to run an application. In order to determine the amount of data used for threat intelligence information, the smart device needs to determine the source of the network request.

[0074] S500: If the sending source is the first client, a security check is performed on the network request using the first threat intelligence information to obtain a first detection result.

[0075] If the sending source is the first client, the smart device will establish a communication connection with the first cloud server, thereby sending the network request to the first cloud server. The first cloud server will perform a security check on the network request through the first threat intelligence information, thereby returning a first detection result to the smart device.

[0076] S600: If the sending source is the second client, perform security detection on the network request through the second threat intelligence information to obtain a second detection result.

[0077] If the sending source is the second client, the smart device will establish a communication connection with the second cloud server, thereby sending the network request to the second cloud server. The second cloud server will perform a security check on the network request through the second threat intelligence information, and return the second detection result to the smart device.

[0078] It should be noted that the process of the smart device performing security checks on the network request sent by the first client and the network request sent by the second client is the same. The only difference is that the amount of data of the first threat intelligence information and the second threat intelligence information is different. Therefore, this embodiment is exemplified by performing security checks on the network request sent by the first client.

[0079] In some embodiments, during the process of performing security detection on the network request using the first threat intelligence information, such as Figure 2 As shown, the smart device can also obtain network information of the network specified by the network request, and send the network information to the first cloud server, so that the first cloud server searches the first threat intelligence information for target threat intelligence information corresponding to the network information, thereby generating a search result. If the search result shows that the target threat intelligence information exists, the first cloud server can generate a first detection result indicating that there is a request risk, and send the first detection result to the smart device.

[0080] If the search result shows that the target threat intelligence information does not exist, the first cloud server can generate a first detection result that there is no request risk, and send the first detection result to the smart device. When the first detection result shows that there is no request risk, after receiving the first detection result, the smart device can send a network request to the first cloud server, so that the first cloud server responds to the network request and connects the first client to the network specified by the network request.

[0081] In some embodiments, during the process of performing security checks on a network request sent by a second client using second threat intelligence information, the smart device can send the network information to a second cloud server so that the second server searches the second intelligence information for target threat intelligence information, thereby generating a search result. If the search result shows that the target threat intelligence information exists, the second cloud server can generate a second detection result indicating that there is a request risk, and send the second detection result to the smart device.

[0082] The above technical solution classifies clients into different levels, and uses the first threat intelligence information with a larger data volume to perform security detection on network requests sent by clients with higher security requirements, so as to improve the security of the clients. For network requests sent by clients with lower security requirements, the second threat intelligence information with a relatively smaller data volume is used to perform security detection, so as to improve the efficiency of performing security detection.

[0083] In some embodiments, the smart device may also store the network specified by the network request for which the first detection result is that there is no request risk to the first client's network whitelist, and the network whitelist is used to instruct the first cloud server not to perform security detection on the network. When the smart device detects a network request for a network in the specified network whitelist again, it may not perform security detection on the network and directly connect the client to the network.

[0084] When the first detection result is a first detection result with a request risk, the network specified by the network request is stored in the network blacklist of the first client according to the target threat intelligence information. The network blacklist is used to indicate that the first client cannot connect to the network in the network blacklist. When the smart device detects a network request from a network in the specified network blacklist again, a prompt message is generated based on the target threat intelligence information in response to the network request to prompt the user that the current network has a security risk corresponding to the target threat intelligence information and cannot be connected at present.

[0085] In some embodiments, after the client accesses the network and requests the specified network, the online behavior performed by the user through the client may also cause network security risks, for example, locating dangerous web pages in the browser. Figure 3 As shown, the smart device can also perform security detection again based on the network behavior information. Continuing with the first client as an example, the smart device can obtain the network behavior information of the first client after the first client accesses the network. And send the network behavior information to the first cloud server to query the network behavior information in the first threat intelligence information. If the query is found, it means that the user has dangerous network behavior. At this time, the connection between the first client and the network specified by the network request is interrupted to improve the security of the operation of the first client.

[0086] In some embodiments, the smart device can also perform threat analysis on the network behavior information based on the first threat intelligence information to determine the node where the network behavior information generates the network threat, thereby obtaining the behavior path of the network behavior information. According to the behavior path, the connection between the first client and the network can be interrupted after the node that generates the network threat, without affecting the network use before the network threat node, thereby improving the flexibility of network use.

[0087] In some embodiments, Figure 4As shown, before performing a security check on the network request through the first threat intelligence information, the smart device can also perform a security check on the network request through the local intelligence threat information to obtain a local detection result. The local threat intelligence information is the threat intelligence information stored in the smart device. When the detection result is that the request risk is detected, the target threat intelligence information in the local intelligence threat information is obtained. If the local detection result is that the request risk is detected, the security check on the network request is not performed through the first threat intelligence information to improve the efficiency of security detection.

[0088] If the local detection result is that no request risk is detected, the smart device can further perform security detection on the network request through the first threat intelligence information.

[0089] In some embodiments, the smart device can also update threat intelligence information to improve the extensiveness of detection. To this end, the smart device can set an update detection for threat intelligence information, and regularly send update requests to the first cloud server and the second cloud server according to the update detection to regularly update the first threat intelligence information of the first cloud server and the second threat intelligence information of the second cloud server.

[0090] In some embodiments, in order to improve the detection accuracy of security detection, the smart device can also parse the network request. Taking the network request sent by the second client as an example, after detecting the network request, the smart device can parse the network request to obtain the domain name and network connection of the network request. The domain name is the domain name of the network to be accessed, and the network connection is the network connection corresponding to the network to be accessed. After obtaining the domain name and network connection, the network request can be parsed into a network string based on the domain name and network connection, and the string information of the network string can be obtained. The smart device can send the string information to the second cloud server, so that the second cloud server can perform security detection on the string information based on the second threat intelligence information to obtain a second detection result.

[0091] Some embodiments of the present application also provide a network request detection system based on threat intelligence, including a communicator and an executor, wherein the communicator is used to establish a communication connection with a cloud server, and the cloud server may include a first cloud server and a second cloud server. The executor is configured to:

[0092] S100: Obtain the security requirement level of the client.

[0093] S200: Acquire a first client among the clients whose security requirement level is greater than or equal to a level threshold and a second client among the clients whose security requirement level is less than the level threshold.

[0094] S300: deploying the first client to a first cloud server, and deploying the second client to a second cloud server.

[0095] The first cloud server includes first threat intelligence information, and the second cloud server includes second threat intelligence information with a smaller data volume than the first threat intelligence information.

[0096] S400: When a network request is detected, obtaining a sending source of the network request.

[0097] S500: If the sending source is the first client, a security check is performed on the network request using the first threat intelligence information to obtain a first detection result.

[0098] S600: If the sending source is the second client, perform security detection on the network request through the second threat intelligence information to obtain a second detection result.

[0099] It can be seen from the above technical solutions that the present application provides a network request detection method and system based on threat intelligence, which obtains the security requirement level of the client, obtains the first client and the second client, deploys the first client to the first cloud server, and deploys the second client to the second cloud server. When a network request is detected, the sending source of the network request is obtained. If the sending source is the first client, a security check is performed on the network request according to the first threat intelligence information to obtain a first detection result. If the sending source is the second client, a security check is performed on the network request according to the second threat intelligence information to obtain a second detection result. The present application classifies clients based on security requirement levels. For clients with higher security levels, security checks are performed using first threat intelligence information with a relatively large amount of data. For clients with lower security levels, security checks are performed using second threat intelligence information with a relatively small amount of data, thereby improving the efficiency of performing security checks on network requests sent by clients with different security levels.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0101] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are intended to better explain the present disclosure, so that those skilled in the art can better use the embodiments.

Claims

1. A network request detection method based on threat intelligence, characterized in that: include: Get the client's security requirement level; Acquire a first client among the clients whose security requirement level is greater than or equal to a level threshold and a second client among the clients whose security requirement level is less than the level threshold; Deploy the first client to a first cloud server, and deploy the second client to a second cloud server, wherein the first cloud server includes first threat intelligence information, and the second cloud server includes second threat intelligence information having a smaller data volume than the first threat intelligence information; When a network request is detected, obtaining a sending source of the network request; If the sending source is the first client, performing security detection on the network request through the first threat intelligence information to obtain a first detection result; If the sending source is the second client, a security check is performed on the network request using the second threat intelligence information to obtain a second detection result.

2. The method for detecting network requests for threat intelligence according to claim 1, characterized in that: The step of performing security detection on the network request according to the first threat intelligence information includes: Obtaining network information of the network specified by the network request; Searching the first threat intelligence information for target threat intelligence information corresponding to the network information, and generating a search result; If the search result is that the target threat intelligence information exists, a first detection result indicating that the request risk exists is generated according to the target threat intelligence information.

3. The method for detecting network requests for threat intelligence according to claim 2, characterized in that: If the first detection result is that there is no request risk, the method further includes: The network request is sent to a first cloud server, so that the first cloud server responds to the network request and connects the first client to a network specified by the network request.

4. The method for detecting network requests for threat intelligence according to claim 3, characterized in that: The method further comprises: storing the network specified by the network request whose first detection result indicates that there is no request risk to a network whitelist of the first client, wherein the network whitelist is used to instruct the first cloud server not to perform security detection on the network; When the first detection result is a first detection result with a request risk, the network specified by the network request is stored in a network blacklist of the first client according to the target threat intelligence information, and the network blacklist is used to indicate that the first client cannot connect to a network in the network blacklist.

5. The method for detecting network requests based on threat intelligence according to claim 3, characterized in that: After the step of the first client accessing the network specified by the network request, the method further includes: Obtaining network behavior information of the first client after accessing the network specified by the network request; If the network behavior information is found in the first threat intelligence information, the connection between the first client and the network specified by the network request is interrupted.

6. The method for detecting network requests based on threat intelligence according to claim 5, characterized in that: The method includes the step of interrupting the connection between the first client and the network specified by the network request: Performing threat analysis on the network behavior information based on the first threat intelligence information to obtain a behavior path of the network behavior information; According to the behavior path, the connection between the first client and the network specified by the network request is interrupted.

7. The method for detecting network requests based on threat intelligence according to claim 1, characterized in that: Before the step of performing security detection on the network request using the first threat intelligence information, the method further includes: In the smart device where the first client is installed, obtaining local threat intelligence information; Perform security detection on the network request according to the local threat intelligence information to obtain a local detection result; If the local detection result is that a request risk is detected, security detection is not performed on the network request through the first threat intelligence information.

8. The method for detecting network requests based on threat intelligence according to claim 1, characterized in that: After the steps of deploying the first client to the first cloud server and deploying the second client to the second cloud server, the method further includes: Set the update interval of threat intelligence information; According to the update interval, the first threat intelligence information of the first cloud server is regularly updated, and the second threat intelligence information of the second cloud server is regularly updated.

9. The method for detecting network requests based on threat intelligence according to claim 1, characterized in that: The step of performing security detection on the network request according to the second threat intelligence information includes: Obtaining the domain name and network connection of the network request; Parsing the network request into a network string according to the domain name and the network connection; Obtaining string information of the network string; A security check is performed on the character string information using the second threat intelligence information to obtain a second detection result.

10. A network request detection system based on threat intelligence, characterized in that: The invention comprises a communicator and an actuator, wherein the communicator is configured to establish a communication connection with a cloud server, and the actuator is configured to: Get the client's security requirement level; Acquire a first client among the clients whose security requirement level is greater than or equal to a level threshold and a second client among the clients whose security requirement level is less than the level threshold; Deploy the first client to a first cloud server, and deploy the second client to a second cloud server, wherein the first cloud server includes first threat intelligence information, and the second cloud server includes second threat intelligence information having a smaller data volume than the first threat intelligence information; When a network request is detected, obtaining a sending source of the network request; If the sending source is the first client, performing security detection on the network request through the first threat intelligence information to obtain a first detection result; If the sending source is the second client, a security check is performed on the network request using the second threat intelligence information to obtain a second detection result.

Images