Method and device for updating threat intelligence of security gateway and processing equipment

Abstract

The invention provides a security gateway threat intelligence updating method, a security gateway threat intelligence updating device and processing equipment, which are used for configuring a threat intelligence rule custom processing architecture under the special condition that an intelligence center submerges or zero-day vulnerabilities occur under the existing threat intelligence detection system architecture involving a security gateway and an intelligence center. Therefore, the security gateway equipment can be prompted to detect threats in time under the special condition, and the network security is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically to a method, device and processing equipment for updating threat intelligence of a security gateway. Background Art

[0002] With the continuous evolution of cyber attack methods, the importance of threat intelligence in the field of network security has become increasingly prominent. Threat intelligence not only covers information about potential security incidents, but also includes response strategies for these incidents. Therefore, improving the efficiency and accuracy of threat intelligence detection systems is a key to ensuring network security.

[0003] Existing threat intelligence detection systems are usually deployed at a certain link in the enterprise intranet or directly on the egress gateway. Many service providers / parties have built-in threat intelligence detection functions in security gateways, but they basically rely on intelligence libraries, and the intelligence libraries are obtained from intelligence centers. In order to ensure the forwarding performance of security gateways, the corresponding intelligence centers usually update the intelligence libraries on a daily basis.

[0004] However, the inventors of the present application have discovered that when the intelligence center is compromised or a zero-day vulnerability occurs, the security gateway cannot obtain the corresponding threat intelligence from the intelligence center in a timely manner, which means that there is a possibility that the security gateway cannot detect the threat, and there is a corresponding security risk. Summary of the invention

[0005] The present application provides a method, apparatus and processing device for updating threat intelligence of a security gateway, which are used in an existing threat intelligence detection system architecture involving a security gateway and an intelligence center. In response to special circumstances in which an intelligence center has been compromised or a zero-day vulnerability has occurred, the present application configures a custom processing architecture for threat intelligence rules, thereby enabling the security gateway device to detect threats in a timely manner and ensure network security in such special circumstances.

[0006] In a first aspect, the present application provides a method for updating threat intelligence of a security gateway, the method comprising:

[0007] Under the application condition that the custom threat intelligence function of the security gateway device is enabled, enter the custom threat intelligence rules that need to be updated in manual mode;

[0008] Determine configuration information corresponding to the custom threat intelligence rule, wherein the configuration information includes threat characteristics, threat intelligence alarm events, and the number of threat event triggering times within a unit time interval;

[0009] The custom threat intelligence rules are written into the rule base list of the security gateway device to update the threat intelligence of the security gateway device. The rule base list includes different custom threat intelligence rules and basic threat intelligence feature libraries. The basic threat intelligence feature library is issued by the intelligence center. The rule base list is used to determine whether the currently processed traffic message belongs to the threat traffic message type based on the different custom threat intelligence rules and basic threat intelligence feature libraries in the security gateway work performed by the security gateway device.

[0010] In combination with the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, the method further includes:

[0011] When it is determined that there is an abnormal event that exposes a zero-day vulnerability or the intelligence center has been compromised, the custom threat intelligence function of the security gateway is activated.

[0012] In combination with the first aspect of the present application, in a second possible implementation method of the first aspect of the present application, the threat characteristics specifically include basic threat characteristics of IP, domain name, file and URL, and the threat characteristics also include a unique feature value calculated by the basic threat characteristics through a preset hash algorithm.

[0013] In combination with the second possible implementation of the first aspect of the present application, in a third possible implementation of the first aspect of the present application, writing the custom threat intelligence rules into the rule library list of the security gateway device includes:

[0014] In the rule base list of the security gateway device, the custom threat intelligence rules are written into the storage space of different custom threat intelligence rules using the unique feature value as the pairing index.

[0015] In combination with the first aspect of the present application, in a fourth possible implementation manner of the first aspect of the present application, the method further includes:

[0016] Obtain the target traffic message that the security gateway device currently needs to identify and release;

[0017] Based on the different custom threat intelligence rules and basic threat intelligence feature library in the rule library list, determine whether the target traffic message belongs to the threat traffic message type;

[0018] If yes, an alarm response process is performed on the target traffic message.

[0019] In combination with the fourth possible implementation of the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, based on different custom threat intelligence rules and basic threat intelligence feature libraries in the rule library list, determining whether the target traffic message belongs to the threat traffic message type includes:

[0020] The unique feature value calculated from the traffic feature of the target traffic message is matched with different custom threat intelligence rules;

[0021] If it matches different custom threat intelligence rules, it is determined that the target traffic message belongs to the threat traffic message type;

[0022] If it does not match different custom threat intelligence rules, the traffic characteristics of the target traffic message are matched with the threat characteristics of the basic threat intelligence feature library;

[0023] If the threat signature matches the basic threat intelligence signature database, the target traffic message is determined to be a threat traffic message type;

[0024] If the threat signature does not match the basic threat intelligence signature library, the target traffic message is released.

[0025] In combination with the first aspect of the present application, in a sixth possible implementation manner of the first aspect of the present application, the method further includes:

[0026] The customized threat intelligence rules and the corresponding personnel information of the input personnel are reported to the intelligence center, prompting the intelligence center to determine whether to write the customized threat intelligence rules into the basic threat intelligence feature library, and if it is determined that the customized threat intelligence rules are written into the basic threat intelligence feature library, synchronize them to different devices that use the basic threat intelligence feature library to perform traffic packet identification and processing.

[0027] In a second aspect, the present application provides a security gateway threat intelligence updating device, the device comprising:

[0028] An input unit is used to input the currently required updated custom threat intelligence rules in a manual mode under the application condition that the custom threat intelligence function of the security gateway device is enabled;

[0029] A determination unit, used to determine configuration information corresponding to a custom threat intelligence rule, wherein the configuration information includes threat characteristics, threat intelligence alarm events, and the number of threat event triggering times within a unit time interval;

[0030] A writing unit is used to write custom threat intelligence rules into a rule base list of a security gateway device to update threat intelligence for the security gateway device, wherein the rule base list includes different custom threat intelligence rules and a basic threat intelligence feature library. The basic threat intelligence feature library is issued by the intelligence center, and the rule base list is used to determine whether the currently processed traffic message belongs to a threat traffic message type based on the different custom threat intelligence rules and the basic threat intelligence feature library in the security gateway work performed by the security gateway device.

[0031] In conjunction with the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the device further includes an enabling unit, configured to:

[0032] When it is determined that there is an abnormal event that exposes a zero-day vulnerability or the intelligence center has been compromised, the custom threat intelligence function of the security gateway is activated.

[0033] In combination with the second aspect of the present application, in a second possible implementation method of the second aspect of the present application, the threat characteristics specifically include basic threat characteristics of IP, domain name, file and URL, and the threat characteristics also include a unique feature value calculated by the basic threat characteristics through a preset hash algorithm.

[0034] In combination with the second possible implementation of the second aspect of the present application, in a third possible implementation of the second aspect of the present application, the writing unit is specifically used to:

[0035] In the rule base list of the security gateway device, the custom threat intelligence rules are written into the storage space of different custom threat intelligence rules using the unique feature value as the pairing index.

[0036] In combination with the second aspect of the present application, in a fourth possible implementation manner of the second aspect of the present application, the device further includes a determination unit, which is used to:

[0037] Obtain the target traffic message that the security gateway device currently needs to identify and release;

[0038] Based on the different custom threat intelligence rules and basic threat intelligence feature library in the rule library list, determine whether the target traffic message belongs to the threat traffic message type;

[0039] If yes, an alarm response process is performed on the target traffic message.

[0040] In combination with the fourth possible implementation of the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, the determination unit is specifically configured to:

[0041] The unique feature value calculated from the traffic feature of the target traffic message is matched with different custom threat intelligence rules;

[0042] If it matches different custom threat intelligence rules, it is determined that the target traffic message belongs to the threat traffic message type;

[0043] If it does not match different custom threat intelligence rules, the traffic characteristics of the target traffic message are matched with the threat characteristics of the basic threat intelligence feature library;

[0044] If the threat signature matches the basic threat intelligence signature database, the target traffic message is determined to be a threat traffic message type;

[0045] If the threat signature does not match the basic threat intelligence signature library, the target traffic message is released.

[0046] In combination with the second aspect of the present application, in a sixth possible implementation manner of the second aspect of the present application, the apparatus further includes a reporting unit, configured to:

[0047] The customized threat intelligence rules and the corresponding personnel information of the input personnel are reported to the intelligence center, prompting the intelligence center to determine whether to write the customized threat intelligence rules into the basic threat intelligence feature library, and if it is determined that the customized threat intelligence rules are written into the basic threat intelligence feature library, synchronize them to different devices that use the basic threat intelligence feature library to perform traffic packet identification and processing.

[0048] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0049] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0050] From the above content, it can be concluded that the present application has the following beneficial effects:

[0051] Regarding network security work, under the existing threat intelligence detection system architecture involving security gateways and intelligence centers, this application configures a custom processing architecture for threat intelligence rules for special circumstances in which the intelligence center is compromised or a zero-day vulnerability occurs. This can enable security gateway devices to detect threats in a timely manner in such special circumstances to ensure network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 A flowchart of a method for updating threat intelligence of a security gateway for this application;

[0054] Figure 2 A schematic diagram of a structure of a security gateway threat intelligence update device for this application;

[0055] Figure 3 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0057] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0058] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0059] Before introducing the security gateway threat intelligence updating method provided by this application, the background content involved in this application is first introduced.

[0060] The security gateway threat intelligence updating method, device and computer-readable storage medium provided in the present application can be applied to processing equipment. In the existing threat intelligence detection system architecture involving security gateways and intelligence centers, for special circumstances where the intelligence center has been compromised or zero-day vulnerabilities have occurred, the present application configures a custom processing architecture for threat intelligence rules, thereby enabling the security gateway device to detect threats in a timely manner in such special circumstances to ensure network security.

[0061] The security gateway threat intelligence update method mentioned in the present application may be executed by a security gateway threat intelligence update device, or a security gateway device that integrates the security gateway threat intelligence update device, wherein the security gateway threat intelligence update device may be implemented in hardware or software.

[0062] In specific applications, the processing device can be either a security gateway device originally deployed in the enterprise network architecture or a security gateway device newly deployed in the enterprise network architecture along with the present application scheme. In addition, the present application scheme can also be executed by devices other than security gateway devices, and can even be a third-party device outside the enterprise's internal network architecture. In actual situations, the specific device type and device deployment form of the processing device can be configured according to specific application requirements, and this application does not make specific limitations.

[0063] In this way, the processing device can be not only a conventional security gateway type device involved in the prior art, but also a server, a physical host or a user equipment (UE) and other different types of devices, where the UE can specifically be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA). The processing device can also be set up in the form of a device cluster.

[0064] Next, we will introduce the security gateway threat intelligence update method provided by this application.

[0065] First, see Figure 1 , Figure 1 A schematic diagram of a process of updating threat intelligence of a security gateway provided by the present application is shown. The threat intelligence updating method of a security gateway provided by the present application may specifically include the following steps S101 to S103:

[0066] Step S101, under the application condition of enabling the custom threat intelligence function of the security gateway device, input the custom threat intelligence rules that need to be updated currently through manual mode;

[0067] It can be understood that the present application involves manually configuring the setting of threat intelligence rules to prompt the local security gateway device to update the detection capability of new threats that have not been updated in a timely manner by the intelligence center.

[0068] In this regard, this application can allow personnel responsible for network security work to enter the custom threat intelligence rules that need to be updated through manual mode (i.e., manual operation) under the application condition of enabling the custom threat intelligence function of the security gateway device.

[0069] Among them, for staff who manually enter custom threat intelligence rules, it can also involve identity verification, permission verification and other aspects of verification processing to ensure information security and network security in detail. Of course, the verification process itself is a relatively basic process in network security work, which can also appear in the subsequent processing links of this application solution. Considering that it belongs to the scope of the prior art, this application will not elaborate on it.

[0070] In addition, it can be understood that for the custom threat intelligence function of the security gateway device mentioned here, it can be started autonomously and in real time when executing the solution of this application, or it can be manually enabled by the staff (that is, the enabling state needs to be turned on / off manually), or the security gateway device can be enabled by default. These are all possible and can be adaptively adjusted according to actual conditions.

[0071] In terms of enabling this function, as an exemplary embodiment, corresponding to the special situation that the original intention of the present application scheme involves the existence of a zero-day vulnerability in the intelligence center or the intelligence center has fallen, the present application method may also include:

[0072] When it is determined that there is an abnormal event that exposes a zero-day vulnerability or the intelligence center has been compromised, the custom threat intelligence function of the security gateway is activated.

[0073] It can be understood that the determination of this special situation or abnormal event can be made manually or by the equipment according to the pre-configured detection strategy and autonomously based on the corresponding data on the system. For example, if a fault or abnormality is detected on the intelligence center side, it can be determined that the intelligence center side is in a compromised state. For another example, if an alarm instruction from relevant personnel is detected on the system, it can be determined that a zero-day vulnerability has appeared on the intelligence center side or the intelligence center has collapsed. For another example, if relevant personnel are detected on the internal communication platform of the enterprise associated with the system to make remarks that there is a zero-day vulnerability on the intelligence center side or the intelligence center has collapsed, it can also be determined. Obviously, the specific processing strategies / rules involved in this link are relatively flexible and can be flexibly configured according to the specific circumstances in actual applications.

[0074] Step S102, determining configuration information corresponding to the custom threat intelligence rule, wherein the configuration information includes threat characteristics, threat intelligence alarm events, and the number of threat event triggering times within a unit time interval;

[0075] It can be understood that after manually entering the custom threat intelligence rules that need to be updated, the corresponding configuration information needs to be determined corresponding to the setting requirements for entering the rules into the subsequent rule base list. In other words, the configuration information is used to enter the custom threat intelligence rules into the subsequent rule base list so that the security gateway device can implement the ability to detect new threats.

[0076] The configuration information mentioned here may specifically include threat characteristics, threat intelligence alarm events, and the number of threat event triggers within a unit time interval (that is, if a single traffic message has a detected or suspected threat, it is not suitable for a direct alarm response, which involves considerations of fault tolerance)

[0077] Specifically, as an exemplary embodiment here, the threat features involved may specifically include basic threat features such as IP, domain name, file and URL, and the threat features also include unique feature values ​​calculated by the basic threat features through a preset hash algorithm and used as an index.

[0078] It can be understood that the basic threat features are used to characterize the basic features of new threats, and the unique feature value (ie, hash value) is helpful in carrying out the management of custom threat intelligence rules because it has the characteristic of uniquely matching with the custom threat intelligence rules.

[0079] Among them, the specific hash algorithm used to calculate the unique eigenvalue can obviously adopt the corresponding existing hash algorithm conveniently according to actual needs, or, it can also adopt the hash algorithm obtained by making a new step of optimization and improvement on the basis of the existing hash algorithm, or even adopt a novel self-developed algorithm, which is possible in actual situations.

[0080] Step S103, write the custom threat intelligence rules into the rule base list of the security gateway device to implement threat intelligence update for the security gateway device, wherein the rule base list includes different custom threat intelligence rules and a basic threat intelligence feature library. The basic threat intelligence feature library is issued by the intelligence center, and the rule base list is used to determine whether the currently processed traffic message belongs to the threat traffic message type based on the different custom threat intelligence rules and the basic threat intelligence feature library in the security gateway work performed by the security gateway device.

[0081] In this way, after the configured custom threat intelligence rules are obtained in the previous step S102, they can be written into different custom threat intelligence rules in the rule library list.

[0082] As for the rule library list, it obviously involves two aspects of threat intelligence libraries. On the one hand, it corresponds to different customized threat intelligence rules that are manually updated, and on the other hand, it corresponds to the basic threat intelligence feature library that is led and issued / synchronized by the intelligence center. However, in the special case of zero-day vulnerabilities or the collapse of the intelligence center, it is obvious that the original basic threat intelligence feature library is difficult to detect new threats and play an effective role.

[0083] Therefore, after writing the current custom threat intelligence rules into the different custom threat intelligence rules in the rule library list, it is obvious that the security gateway device can effectively detect the new threats currently faced through the updated threat intelligence library or the different custom threat intelligence rules in the threat intelligence library, so as to be able to perform effective alarm responses and achieve the original purpose of deploying security gateway devices in the enterprise's internal network architecture, that is, to provide network security protection functions.

[0084] Among them, in the writing process, as an exemplary embodiment, writing the custom threat intelligence rules into the rule library list of the security gateway device may specifically include:

[0085] In the rule base list of the security gateway device, the custom threat intelligence rules are written into the storage space of different custom threat intelligence rules using the unique feature value as the pairing index.

[0086] It can be seen from the embodiment here that for the rule library list deployed on the security gateway device, the different customized threat intelligence rules therein can be specifically constructed with the corresponding specific displacement feature value as the unique index, and the remaining information can be entered into it to form a tree structure data that is convenient for different management tasks such as storage, query and positioning, so as to promote more efficient and accurate processing effects in terms of details.

[0087] In addition, in the process of building a tree through unique feature values, it is also possible to match the original index in the rule library list, that is, the original unique feature value, to check whether there are existing rules, avoid repeated entry operations or collisions with the original threat intelligence rules, and achieve a more complete effect in details.

[0088] In addition, in addition to ruling out the occurrence of low-probability events of duplicate threat intelligence rules, the writing process of this application may also involve matching with the original threat intelligence rules. Specifically, in some cases, the new threat whose detection capability is currently to be updated may have similar characteristics in some aspects to the threats that can be detected by the original detection capability. In this regard, timely reminders can be made based on similar detection results of threat characteristics to allow staff who perform manual updates on the security gateway device side to notice this situation. In actual situations, it helps staff to think about whether the currently entered threat intelligence rules can be further optimized and improved, or think about other aspects that can help enhance the threat detection capability and other settings that can be further improved in network security work. It provides further auxiliary data support for staff's decision-making at a subtle level, so as to capture potential optimization directions / problem-solving directions in actual applications and promote higher-quality advancement of network security work.

[0089] After completing the rule base list update operation, it is obvious that the follow-up may involve the detection and processing of new threats involved in this update.

[0090] In this regard, as an exemplary embodiment, the method of the present application may further include:

[0091] Obtain the target traffic message that the security gateway device currently needs to identify and release;

[0092] Based on the different custom threat intelligence rules and basic threat intelligence feature library in the rule library list, determine whether the target traffic message belongs to the threat traffic message type;

[0093] If yes, an alarm response process is performed on the target traffic message.

[0094] It can be understood that in the network architecture, the local security gateway device is a node in the traffic message transmission link. In this regard, the security gateway device can carry out threat identification processing on the traffic messages waiting to pass through. If detected, it can trigger an alarm response, that is, perform alarm processing, or perform additional response processing at the same time as the alarm processing, so as to prompt, defend or eliminate the detected threats as soon as possible under the preset response strategy / rules.

[0095] In addition, in actual applications, there may be traffic packets forwarded by other devices specifically for the security gateway device to identify. That is, the original transmission link of such traffic packets does not involve the local security gateway device. This may also happen in some cases.

[0096] For example, if in a security gateway device cluster, when a security gateway device has been manually updated recently, the security gateway device can be responsible for the identification and processing of the traffic packets of its own transmission link under the condition of permission (involving constraints on permissions, load, etc.), and can also be responsible for the identification and processing of the traffic packets of the transmission links of other security gateway devices. This may involve temporary adjustments to the original transmission links (i.e., updating the transmission link nodes of other security gateways to local security gateway devices), or directly replacing other security gateway devices without adjusting the transmission links, and identifying and processing the traffic packets that need to be identified by other security gateway devices. Compared with the staff updating the security gateway devices one by one, this allows the security gateway devices to be adaptively configured at the first time until other security network devices or the intelligence center update their new threat detection capabilities, thereby avoiding the impact of special circumstances such as the collapse of the intelligence center or the emergence of zero-day vulnerabilities.

[0097] At the same time, this application also provides a more specific rule base list application solution from the perspective of details.

[0098] Specifically, as an exemplary embodiment, based on different custom threat intelligence rules and a basic threat intelligence feature library in a rule library list, determining whether a target traffic message belongs to a threat traffic message type may specifically include:

[0099] The unique feature value calculated from the traffic feature of the target traffic message is matched with different custom threat intelligence rules;

[0100] 1) If it matches different custom threat intelligence rules, it is determined that the target traffic message belongs to the threat traffic message type;

[0101] 2) If it does not match different custom threat intelligence rules, the traffic characteristics of the target traffic message are matched with the threat characteristics of the basic threat intelligence feature library;

[0102] 2.1) If the threat signature matches the basic threat intelligence signature library, it is determined that the target traffic message belongs to the threat traffic message type;

[0103] 2.2) If the threat signature does not match the basic threat intelligence signature library, the target traffic message is released.

[0104] Among them, it can be understood that for the basic threat intelligence feature library, it can also use the unique feature value calculated by the threat feature / traffic feature under the hash algorithm to store, query and locate the threat intelligence rules, just like different customized threat intelligence rules on the other hand. In this case, the two links can also use different hash algorithms to further ensure the encryption of information.

[0105] Under the setting of this embodiment, it can be understood that it is first determined whether the new threat matches the custom update, and then whether it matches the conventional threat. This corresponds to the custom update status of the local security gateway device in detail, which helps to achieve more timely and accurate threat detection effects locally.

[0106] In addition, the threat intelligence detection system also involves the system architecture of the intelligence center. After manually updating the local security gateway device, you can also try to trigger the intelligence center to promote the update of the entire network.

[0107] Correspondingly, as an exemplary embodiment, the method of the present application may further include:

[0108] The customized threat intelligence rules and the corresponding personnel information of the input personnel are reported to the intelligence center, prompting the intelligence center to determine whether to write the customized threat intelligence rules into the basic threat intelligence feature library, and if it is determined that the customized threat intelligence rules are written into the basic threat intelligence feature library, synchronize them to different devices that use the basic threat intelligence feature library to perform traffic packet identification and processing.

[0109] Among them, it can be understood that the personnel information of the input personnel, on the basis of facilitating backtracking, helps the intelligence center to evaluate the authority and authority of the custom threat intelligence rules uploaded this time (that is, the personnel information can include identity identification, authority identification, importance identification and other types of identification to represent different situations). On the intelligence center side, the decision whether to perform a full network update can be made manually or by the system independently. The scope of the full network update can not only involve all security gateway devices involved in the enterprise's internal network architecture, but also other types of devices that have traffic message identification and processing requirements, which is also possible.

[0110] Regarding the above solution contents (including the solution contents of each exemplary embodiment), in general, for network security work, under the existing threat intelligence detection system architecture involving security gateways and intelligence centers, this application is aimed at special circumstances where the intelligence center collapses or zero-day vulnerabilities appear. This application configures a threat intelligence rule custom processing architecture, so that in this special situation, the security gateway device can detect threats in time and ensure network security.

[0111] The above is an introduction to the security gateway threat intelligence update method provided by this application. In order to facilitate better implementation of the security gateway threat intelligence update method provided by this application, this application also provides a security gateway threat intelligence update device from the perspective of functional modules.

[0112] See also Figure 2 , Figure 2This is a schematic diagram of a structure of a security gateway threat intelligence updating device of the present application. In the present application, the security gateway threat intelligence updating device 200 may specifically include the following structure:

[0113] An input unit 201 is used to input the currently required updated custom threat intelligence rules in a manual mode under the application condition that the custom threat intelligence function of the security gateway device is enabled;

[0114] A determination unit 202 is used to determine configuration information corresponding to the custom threat intelligence rule, wherein the configuration information includes threat characteristics, threat intelligence alarm events, and the number of threat event triggering times within a unit time interval;

[0115] The writing unit 203 is used to write the custom threat intelligence rules into the rule base list of the security gateway device to realize the threat intelligence update for the security gateway device, wherein the rule base list includes different custom threat intelligence rules and a basic threat intelligence feature library. The basic threat intelligence feature library is issued by the intelligence center. The rule base list is used to determine whether the currently processed traffic message belongs to the threat traffic message type based on the different custom threat intelligence rules and the basic threat intelligence feature library in the security gateway work performed by the security gateway device.

[0116] In an exemplary embodiment, the apparatus further includes an enabling unit 204, configured to:

[0117] When it is determined that there is an abnormal event that exposes a zero-day vulnerability or the intelligence center has been compromised, the custom threat intelligence function of the security gateway is activated.

[0118] In another exemplary embodiment, the threat features specifically include basic threat features of IP, domain name, file and URL, and the threat features also include unique feature values ​​calculated from the basic threat features by a preset hash algorithm.

[0119] In another exemplary embodiment, the writing unit 203 is specifically configured to:

[0120] In the rule base list of the security gateway device, the custom threat intelligence rules are written into the storage space of different custom threat intelligence rules using the unique feature value as the pairing index.

[0121] In another exemplary embodiment, the apparatus further includes a determination unit 205, configured to:

[0122] Obtain the target traffic message that the security gateway device currently needs to identify and release;

[0123] Based on the different custom threat intelligence rules and basic threat intelligence feature library in the rule library list, determine whether the target traffic message belongs to the threat traffic message type;

[0124] If yes, an alarm response process is performed on the target traffic message.

[0125] In another exemplary embodiment, the determination unit 205 is specifically configured to:

[0126] The unique feature value calculated from the traffic feature of the target traffic message is matched with different custom threat intelligence rules;

[0127] If it matches different custom threat intelligence rules, it is determined that the target traffic message belongs to the threat traffic message type;

[0128] If it does not match different custom threat intelligence rules, the traffic characteristics of the target traffic message are matched with the threat characteristics of the basic threat intelligence feature library;

[0129] If the threat signature matches the basic threat intelligence signature database, the target traffic message is determined to be a threat traffic message type;

[0130] If the threat signature does not match the basic threat intelligence signature library, the target traffic message is released.

[0131] In another exemplary embodiment, the apparatus further includes a reporting unit 206, configured to:

[0132] The customized threat intelligence rules and the corresponding personnel information of the input personnel are reported to the intelligence center, prompting the intelligence center to determine whether to write the customized threat intelligence rules into the basic threat intelligence feature library, and if it is determined that the customized threat intelligence rules are written into the basic threat intelligence feature library, synchronize them to different devices that use the basic threat intelligence feature library to perform traffic packet identification and processing.

[0133] This application also provides a processing device from the perspective of hardware structure, see Figure 3 , Figure 3 301, a memory 302, and an input / output device 303. The processor 301 is used to execute the computer program stored in the memory 302 to implement the following Figure 1 The steps of the security gateway threat intelligence update method in the corresponding embodiment; or, the processor 301 is used to execute the computer program stored in the memory 302 to implement the following Figure 2 Corresponding to the functions of each unit in the embodiment, the memory 302 is used to store the processor 301 executing the above Figure 1 The computer program required by the security gateway threat intelligence updating method in the corresponding embodiment.

[0134] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 302, and executed by the processor 301 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0135] The processing device may include, but is not limited to, a processor 301, a memory 302, and an input / output device 303. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 301, the memory 302, the input / output device 303, etc. are connected via a bus.

[0136] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0137] The memory 302 can be used to store computer programs and / or modules. The processor 301 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 302 and calling the data stored in the memory 302. The memory 302 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0138] When the processor 301 is used to execute the computer program stored in the memory 302, the following functions can be implemented:

[0139] Under the application condition that the custom threat intelligence function of the security gateway device is enabled, enter the custom threat intelligence rules that need to be updated in manual mode;

[0140] Determine configuration information corresponding to the custom threat intelligence rule, wherein the configuration information includes threat characteristics, threat intelligence alarm events, and the number of threat event triggering times within a unit time interval;

[0141] The custom threat intelligence rules are written into the rule base list of the security gateway device to update the threat intelligence of the security gateway device. The rule base list includes different custom threat intelligence rules and basic threat intelligence feature libraries. The basic threat intelligence feature library is issued by the intelligence center. The rule base list is used to determine whether the currently processed traffic message belongs to the threat traffic message type based on the different custom threat intelligence rules and basic threat intelligence feature libraries in the security gateway work performed by the security gateway device.

[0142] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the security gateway threat intelligence updating device, processing device and its corresponding units described above can refer to the following. Figure 1 The description of the security gateway threat intelligence updating method in the corresponding embodiment will not be repeated here.

[0143] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0144] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 For the steps of the security gateway threat intelligence update method in the corresponding embodiment, the specific operations can be referred to as follows Figure 1 The description of the security gateway threat intelligence updating method in the corresponding embodiment will not be repeated here.

[0145] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0146] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1The steps of the security gateway threat intelligence update method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the security gateway threat intelligence updating method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0147] The above is a detailed introduction to the security gateway threat intelligence update method, device, processing equipment and computer-readable storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A security gateway threat intelligence update method, characterized in that: The method comprises: Under the application condition that the custom threat intelligence function of the security gateway device is enabled, enter the custom threat intelligence rules that need to be updated in manual mode; Determine configuration information corresponding to the custom threat intelligence rule, wherein the configuration information includes threat characteristics, threat intelligence alarm events, and the number of threat event triggering times within a unit time interval; The custom threat intelligence rules are written into the rule library list of the security gateway device to implement threat intelligence update for the security gateway device, wherein the rule library list includes different custom threat intelligence rules and a basic threat intelligence feature library, and the basic threat intelligence feature library is issued by an intelligence center. The rule library list is used to determine whether the currently processed traffic message belongs to a threat traffic message type based on the different custom threat intelligence rules and the basic threat intelligence feature library in the security gateway work performed by the security gateway device.

2. The method according to claim 1, characterized in that: The method further comprises: When it is determined that there is an abnormal event that exposes a zero-day vulnerability or the intelligence center is compromised, the custom threat intelligence function of the security gateway is activated.

3. The method according to claim 1, characterized in that The threat characteristics specifically include basic threat characteristics of IP, domain name, file and URL, and the threat characteristics also include unique characteristic values ​​calculated by the basic threat characteristics through a preset hash algorithm.

4. The method according to claim 3, characterized in that The step of writing the custom threat intelligence rule into a rule library list of the security gateway device includes: In the rule library list of the security gateway device, the custom threat intelligence rule is written into the storage space of the different custom threat intelligence rules using the unique feature value as a pairing index.

5. The method according to claim 1, characterized in that The method further comprises: Obtaining the target traffic message that the security gateway device currently needs to identify and release; Based on the different custom threat intelligence rules in the rule base list and the basic threat intelligence feature library, determining whether the target traffic message belongs to the threat traffic message type; If so, an alarm response process is performed on the target traffic message.

6. The method according to claim 5, characterized in that The determining whether the target traffic message belongs to the threat traffic message type based on the different customized threat intelligence rules in the rule base list and the basic threat intelligence feature library includes: Matching the unique characteristic value calculated from the traffic characteristic of the target traffic message with the different customized threat intelligence rules; If the target traffic message matches the different custom threat intelligence rules, it is determined that the target traffic message belongs to the threat traffic message type; If it does not match the different customized threat intelligence rules, matching the traffic characteristics of the target traffic message with the threat characteristics of the basic threat intelligence feature library; If the target traffic message matches the threat feature of the basic threat intelligence feature library, it is determined that the target traffic message belongs to the threat traffic message type; If the threat signature does not match the basic threat intelligence signature library, the target traffic message is released.

7. The method according to claim 1, characterized in that The method further comprises: The custom threat intelligence rules and the personnel information of the corresponding input personnel are reported to the intelligence center, prompting the intelligence center to determine whether to write the custom threat intelligence rules into the basic threat intelligence feature library, and if it is determined that the custom threat intelligence rules are written into the basic threat intelligence feature library, synchronize them to different devices that use the basic threat intelligence feature library to perform traffic message identification and processing.

8. A security gateway threat intelligence updating device, characterized in that: The device comprises: An input unit is used to input the currently required updated custom threat intelligence rules in a manual mode under the application condition that the custom threat intelligence function of the security gateway device is enabled; A determination unit, configured to determine configuration information corresponding to the custom threat intelligence rule, wherein the configuration information includes threat characteristics, threat intelligence alarm events, and the number of threat event triggering times within a unit time interval; A writing unit is used to write the custom threat intelligence rules into the rule library list of the security gateway device to realize the threat intelligence update of the security gateway device, wherein the rule library list includes different custom threat intelligence rules and a basic threat intelligence feature library, and the basic threat intelligence feature library is issued by the intelligence center. The rule library list is used to determine whether the currently processed traffic message belongs to the threat traffic message type based on the different custom threat intelligence rules and the basic threat intelligence feature library in the security gateway work performed by the security gateway device.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images