Supervision platform and supervision method suitable for WAF

Abstract

The invention relates to the technical field of WAF, and discloses a supervision platform and a supervision method suitable for WAF, and the supervision platform suitable for WAF comprises an automatic test terminal which obtains a current to-be-tested multicast network scene, calls a preset API interface of an SDN controller, and sends a configuration command corresponding to the multicast network scene to the SDN controller; the SDN controller is used for updating the network configuration of the multicast network based on the configuration command; and the automatic test terminal pulls up the message sending end container and the message receiving end container in the preset server, and tests the multicast network scene according to the message sending end container and the message receiving end container. According to the monitoring platform suitable for the WAF, a containerization technology is adopted to deploy the message sending end and the message receiving end, resource waste caused by the fact that a large number of independent hosts are needed in a traditional testing method is reduced, the container can be dynamically created and destroyed according to needs, and therefore the utilization rate of testing resources is optimized.

Description

Technical Field

[0001] The present disclosure relates to the WAF technical field, and in particular to a supervision platform and a supervision method applicable to WAF. Background Art

[0002] Web Application Firewall (WAF) is a firewall that filters Web requests and analyzes and intercepts malicious traffic through customized WAF rules to achieve security protection for Web applications. With the widespread deployment of WAF, how to monitor and manage WAF has become an inevitable issue.

[0003] In the related technologies, the monitoring and management process of WAF may have the problem of excessively high supervision costs, and a better solution is needed. Summary of the invention

[0004] In view of this, the present disclosure provides a supervision platform and a supervision method applicable to WAF to solve the problem of how to reduce the supervision cost of WAF.

[0005] On the one hand, the present disclosure provides a supervision platform suitable for WAF, and the supervision platform suitable for WAF includes: a central cloud server and multiple node agents, and the central cloud server includes: a data analysis module, which is used to obtain node data of each WAF node deployed in multiple WAF nodes, and adopts a third-party integration module to analyze the node data and identify abnormal behaviors in the node data; the node data is collected by the node agent; a response module, which is used to generate WAF rules corresponding to the abnormal behaviors based on the abnormal behaviors in the node data, and send the WAF rules to each WAF node; wherein the WAF rules are used to handle abnormal behaviors; an alarm module, which is used to perform continuous detection on each WAF node, and output alarm information when node data exceeding a preset alarm threshold is detected.

[0006] On the other hand, the present disclosure also provides a supervision method, which includes: a data analysis module in a central cloud server, which obtains node data of each WAF node deployed in multiple WAF nodes, uses a third-party integration module to analyze the node data, and identifies abnormal behavior in the node data; the node data is collected by a node agent; a response module in the central cloud server, which generates WAF rules corresponding to the abnormal behavior based on the abnormal behavior in the node data, and sends the WAF rules to each WAF node; wherein the WAF rules are used to handle abnormal behavior; an alarm module in the central cloud server, which continuously detects each WAF node, and outputs an alarm message when node data exceeding a preset alarm threshold is detected.

[0007] On the other hand, the present disclosure further provides a computer device, which includes: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor implements the above-mentioned supervision method by executing the computer instructions.

[0008] On the other hand, the present disclosure further provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to implement the above-mentioned supervision method.

[0009] Through the supervision platform and supervision method applicable to WAF of the above-mentioned embodiments of the present invention, the response module automatically generates corresponding WAF rules according to the abnormal behaviors identified in the node data, and automatically sends these rules to all relevant WAF nodes. The process of automatic rule generation and sending greatly reduces manual intervention, thereby reducing the supervision cost of WAF. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1 An exemplary schematic diagram showing the architecture of a supervision platform applicable to WAF according to an embodiment of the present disclosure;

[0012] Figure 2 A schematic diagram of the architecture of a data analysis module of a supervision platform applicable to WAF according to an embodiment of the present disclosure is shown;

[0013] Figure 3 A schematic diagram of the architecture of a central cloud server of a WAF monitoring platform applicable to an embodiment of the present disclosure is shown;

[0014] Figure 4 A schematic diagram of the architecture of a node agent of a supervision platform applicable to WAF according to an embodiment of the present disclosure is shown;

[0015] Figure 5 It is a flowchart of a supervision method provided by an embodiment of the present disclosure;

[0016] Figure 6 It is a structural diagram of a monitoring device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] A Web Application Firewall (WAF) is a firewall that filters Web requests. It uses customized WAF rules to analyze and intercept malicious traffic to achieve security protection for Web applications. WAF is usually located between the Web server and the external network. It is specifically used to analyze and filter traffic transmitted through the HTTP / HTTPS protocol, block malicious requests, and ensure the security of Web applications. Although WAF has significant advantages in defending against Web attacks, as the scale of WAF continues to expand, how to monitor and manage WAF has become an inevitable problem.

[0018] The related technologies often have the following problems:

[0019] 1. In large-scale Web application environments, WAFs are often deployed in multiple nodes and different regions, and these nodes may involve different data centers or cloud platforms. When conducting supervision, administrators need to frequently log in to different nodes to check their status, logs, traffic and other information, which is not only time-consuming but also easy to miss key information.

[0020] 2. WAF rules need to be continuously updated and adjusted according to changes in the network security environment. Administrators need to manually configure and update rules for each node to ensure the consistency and accuracy of the rules, which increases the operation and maintenance costs of WAF.

[0021] 3. Traditional WAF systems mainly rely on static rule bases to detect and prevent attack behaviors. With the continuous evolution of Web attack methods, WAFs that rely solely on rule matching may not be able to identify new attacks in a timely manner, especially when facing zero-day attacks or complex attack behaviors, the identification speed is slow.

[0022] 4. WAF relies on rules to filter traffic. Improper or overly strict configuration of rules may lead to false positives, that is, normal traffic is misjudged as an attack, resulting in service interruption or business traffic obstruction. On the other hand, overly loose rules may lead to missed positives, that is, attacks are allowed to pass, causing security risks.

[0023] To solve the above problems, various embodiments of the present disclosure provide a supervision platform suitable for WAF, and the supervision platform suitable for WAF includes: a central cloud server and multiple node agents, and the central cloud server includes: a data analysis module, which is used to obtain node data of each WAF node deployed in multiple WAF nodes, and adopts a third-party integration module to analyze the node data and identify abnormal behaviors in the node data; the node data is collected by the node agent; a response module, which is used to generate WAF rules corresponding to the abnormal behaviors based on the abnormal behaviors in the node data, and send the WAF rules to each WAF node; wherein the WAF rules are used to handle abnormal behaviors; an alarm module, which is used to perform continuous detection on each WAF node, and output alarm information when node data exceeding a preset alarm threshold is detected.

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0025] refer to Figure 1 , Figure 1 FIG. 1 is an exemplary schematic diagram showing an architecture of a monitoring platform applicable to WAF according to an embodiment of the present disclosure. Figure 1 As shown in the figure, the supervision platform suitable for WAF includes: a central cloud server and multiple node agents. The central cloud server includes:

[0026] The data analysis module is used to obtain the node data of each WAF node deployed in multiple WAF nodes, analyze the node data using a third-party integration module, and identify abnormal behaviors in the node data; the node data is collected by the node agent;

[0027] The response module is used to generate WAF rules corresponding to abnormal behaviors based on abnormal behaviors in node data, and send WAF rules to each WAF node; wherein the WAF rules are used to handle abnormal behaviors;

[0028] The alarm module is used to continuously detect each WAF node and output alarm information when node data exceeding the preset alarm threshold is detected.

[0029] In this embodiment, WAF can be a distributed application built based on cloud computing technology, and WAF can be composed of a central management component and a distributed protection component, wherein the central management component can be a cloud center service, and the distributed protection component can be at least one WAF node.

[0030] Furthermore, the central cloud server can be deployed in the cloud center service, and each of the at least one node agent can be deployed in a WAF node respectively.

[0031] Here, the central cloud server can be the core management and control unit in the cloud WAF, located in the center of the system, responsible for global data processing, analysis, rule generation and distribution, etc. The node agent can be used for local data collection, rule execution and upload task execution.

[0032] The data flow in the supervision platform can include upload and download directions. The upload direction can be that the node agent regularly transmits the locally collected data to the central cloud server, and the download direction can be that the WAF rules or instructions generated by the central cloud server are issued through the node agent and take effect on the specific WAF node.

[0033] Each node agent collects node data in the WAF node where it is located and sends the node data to the data analysis module in the central cloud server. The node data may include but is not limited to: HTTP request and response records, characteristic information of attack traffic, system resource usage, and alarm information.

[0034] The data analysis module can be used to conduct in-depth analysis of node data based on third-party integrated modules.

[0035] Here, the third-party integration module may refer to an integrated existing third-party tool, and the in-depth analysis may include but is not limited to: log retrieval, attack pattern matching, traffic trend analysis, etc.

[0036] As an example, abnormal behaviors in node data may include, but are not limited to, attack behaviors, abnormal requests, and abnormal traffic.

[0037] Furthermore, the data analysis module can also be used to mark the abnormal behavior after identifying the abnormal behavior and generate an analysis report of the abnormal behavior.

[0038] The data analysis module can be used to specifically mark the attack type, attack characteristics, and attack source of abnormal behavior. The data analysis module can also be used to output detailed abnormal behavior records, such as occurrence time, impact range, attack type, and characteristic information.

[0039] The response module may be specifically configured to receive an analysis report of abnormal behavior generated by the data analysis module, and generate at least one WAF rule corresponding to the abnormal behavior based on the abnormal behavior data in the analysis report.

[0040] Here, WAF rules can be predefined policies and filtering conditions used by WAF to protect Web applications from various network attacks and malicious traffic. The content of WAF rules can include: rule name, attack characteristics, and processing methods.

[0041] As an example, when the abnormal behavior is a SQL injection attack, the WAF rule generated by the response module may be a SQL injection filtering rule; when the abnormal behavior is a DDoS attack, the WAF rule generated by the response module may be a rate limiting rule.

[0042] The response module is used to send the WAF rules to each WAF node, and may include: the response module uses a broadcast method to send the WAF rules to each WAF node to ensure that each WAF node takes effect immediately after receiving the rules.

[0043] The alarm module is used to continuously detect each WAF node and output alarm information when node data exceeding the preset alarm threshold is detected.

[0044] In a possible implementation, the preset alarm threshold may include at least one of the following: a traffic threshold, an attack behavior threshold, and a system performance threshold.

[0045] Among them, as network traffic, attack patterns and business environment change, the preset alarm thresholds can be regularly adjusted dynamically.

[0046] The alarm module can be used to perform continuous detection on each WAF node 24 / 7 and compare it with the preset threshold. When the data of a WAF node exceeds the preset alarm threshold, it is judged that the data has abnormal behavior, triggers the alarm mechanism, and generates alarm information.

[0047] The alarm information may include at least one of the following: alarm type, alarm level, alarm time, etc.

[0048] Furthermore, the alarm module can also be used to send the alarm information to the administrator according to a preset alarm method.

[0049] As an example, the preset alarm method may include at least one of the following: email notification, SMS notification, push notification, etc.

[0050] In the supervision platform and supervision method applicable to WAF in the above-mentioned embodiment of the present disclosure, the data analysis module can collect and analyze the node data deployed in multiple WAF nodes, and use the third-party integration module to identify potential abnormal behaviors. This real-time data analysis and abnormal detection can effectively prevent attack behaviors and abnormal traffic, and improve the protection capabilities of WAF nodes. The response module generates corresponding WAF rules based on the abnormal behaviors in the node data and sends them to each WAF node. This can ensure the rapid update and application of WAF protection rules, improve the response capabilities of the WAF system when facing new attacks, and reduce the need for manual intervention. The alarm module continuously detects each WAF node. Once it is found that the node data exceeds the preset alarm threshold, the system will automatically generate an alarm message and notify the relevant personnel. This automated alarm mechanism can quickly notify the operation and maintenance personnel or administrator when a network security incident occurs, so as to respond quickly and reduce potential losses. Through automated data collection, analysis, alarm, response and other functions, the platform significantly reduces the need for manual intervention and reduces the complexity of WAF management.

[0051] In a possible implementation of the above embodiment, the third-party integration module in the data analysis module includes at least a machine learning analysis module, a correlation analysis module and a linkage analysis module, wherein:

[0052] A machine learning analysis module, configured to perform a first preset analysis on the node data based on a pre-trained machine learning model in the module, and identify a first abnormal behavior in the node data;

[0053] A correlation analysis module, used to perform multi-data source correlation analysis on the node data to identify a second abnormal behavior in the node data; the node data is determined by at least one data source;

[0054] A linkage analysis module, used to perform linkage analysis on node data based on a preset external platform to identify third abnormal behaviors in the node data;

[0055] The data analysis module is used to determine abnormal behavior in the node data based on at least one of the first abnormal behavior, the second abnormal behavior and the third abnormal behavior.

[0056] In this embodiment, the machine learning analysis module can be specifically used to perform threat prediction and anomaly detection based on a large amount of historical data through a machine learning algorithm to identify the first abnormal behavior in the node data.

[0057] Specifically, the machine learning analysis module can be used to analyze the features in the node data through algorithms (such as decision trees, random forests, etc.) to extract patterns that may be related to attack behaviors. It can also be used for training based on historical attack data to predict whether new requests are potential threats. It can also be used to regularly and automatically update the model to adapt to new attack methods and enhance the protection capabilities of WAF.

[0058] The correlation analysis module can be specifically used to perform correlation analysis on data from different sources to help identify the second abnormal behavior, wherein the second abnormal behavior can be a complex, low-frequency or hidden attack behavior.

[0059] Here, the method of association analysis can be to integrate multiple data sources and use data mining and analysis techniques (such as cluster analysis, graph analysis, etc.) to perform in-depth pattern recognition and attack feature discovery.

[0060] Specifically, the correlation analysis module can be used to discover, for example, multiple low-frequency request patterns of the same source IP through correlation analysis of WAF logs and traffic. It can also combine different monitoring data to analyze the potential characteristics of attacks and provide more accurate attack judgments.

[0061] The linkage analysis module can be specifically used to link with an external threat intelligence platform or other security system to obtain the latest attack data in the node data as the third abnormal behavior. Among them, the threat intelligence platform can be a centralized system or service for collecting, analyzing and distributing information and data about network security threats.

[0062] Here, the third abnormal behavior may include but is not limited to: malicious Internet Protocol (Internet Protocol, IP), malicious Universal Resource Locator (Universal Resource Locator, URL).

[0063] Furthermore, the third abnormal behavior may be converted into WAF syntax, and the WAF rule base may be updated.

[0064] In a possible implementation, the third-party integration module in the data analysis module may further include a statistical analysis module, wherein:

[0065] The statistical analysis module is used to collect statistics on the log and indicator data in the node data and extract preset hotspot data, where the preset hotspot data may include but is not limited to: hot parameters and hot attack types.

[0066] refer to Figure 2 , Figure 2 FIG. 1 is a schematic diagram showing an architecture of a data analysis module of a monitoring platform applicable to WAF according to an embodiment of the present disclosure. Figure 2As shown, the data analysis module may include: a machine learning analysis module, a correlation analysis module, a linkage analysis module and a statistical analysis module.

[0067] In one possible implementation, the linkage analysis module can also be used to link with external artificial intelligence (AI) products to identify abnormal behavior.

[0068] In the monitoring platform and monitoring method applicable to WAF in the above-mentioned embodiments of the present disclosure, through a variety of analysis methods, false positives and missed positives can be effectively reduced, and the detection accuracy of WAF can be improved. The linkage analysis of the machine learning module and external threat intelligence ensures that WAF can quickly adapt to new attack methods and network threats. Through statistical analysis and the integration of multiple data sources, the platform can comprehensively and automatically monitor the operating status, traffic conditions and potential attack behaviors of WAF, thereby improving the efficiency of security management.

[0069] In a possible implementation of the above embodiment, the central cloud server further includes a visualization display module, wherein:

[0070] The visual display module is used to store the node data of each WAF node and the alarm information corresponding to the node data, and use a preset display method to visualize the node data and the alarm information; the preset display method includes at least one of the following: charts, reports.

[0071] In this embodiment, the visualization module can be specifically used to store node data and alarm information in a data storage system, assign an identifier associated with the WAF node to the node data and alarm information, and use a preset display method to visualize the node data and alarm information.

[0072] Among them, the preset display methods may include but are not limited to: charts, reports, heat maps, and dashboards.

[0073] As an example, the visual display module can use a bar chart to show the number of alarms for each WAF node, a line chart to show the trend of alarm triggering, or a pie chart or radar chart to show the proportion or frequency of different types of attacks.

[0074] In a possible implementation, the visualization module may also be used to provide interactive functions in the visualization interface. The interactive functions may include at least one of the following: a filtering function and a sorting function.

[0075] In the monitoring platform and monitoring method applicable to WAF in the above-mentioned embodiment of the present disclosure, through various analysis methods, the visual display module ensures that the node data and corresponding alarm information of all WAF nodes are centrally stored and associated with the WAF nodes, effectively avoiding the problem of data dispersion and difficulty in management. Through visual display, security personnel can quickly discover potential abnormal behaviors and attack trends without in-depth analysis of large amounts of raw data, thereby speeding up response and processing speed and improving security protection efficiency.

[0076] In a possible implementation of the above embodiment, the central cloud server further includes a first node management module, wherein:

[0077] The first node management module is used to obtain preset commands and perform batch operations on WAF nodes based on the preset commands.

[0078] In this embodiment, it can be specifically used to provide an operation interface to security personnel and obtain preset commands determined by the security personnel based on the operation interface, so that the security personnel can batch operate WAF nodes based on the operation interface.

[0079] Here, the preset command may include but is not limited to: start / stop, restart, detect connectivity, query service log, hot update service. The preset command may be delivered to the first node management module in the form of a configuration file, a command line interface, etc.

[0080] Furthermore, batch operations on WAF nodes can be synchronous or asynchronous. For example, if it is an update rule command, the module will pass the command to all target WAF nodes and execute the update one by one; if it is a restart node command, the restart process of each node can be triggered in batches.

[0081] Furthermore, the first node management module can also be used to feedback the execution results to the security personnel in the operation interface when the preset command is completed on all nodes.

[0082] refer to Figure 3 , Figure 3 The schematic diagram of the architecture of a central cloud server of a WAF monitoring platform according to an embodiment of the present disclosure is shown. Figure 3 As shown, the central cloud server includes a visualization display module and a first node management module.

[0083] In the WAF supervision platform and supervision method of the above-mentioned embodiment of the present disclosure, through various analysis methods, the first node management module can automatically perform batch management operations on multiple WAF nodes, thereby improving the configuration and maintenance efficiency of the nodes. The safety and accuracy of the operation are ensured through command verification, batch execution, status monitoring, result feedback and other links.

[0084] In a possible implementation of the above embodiment, the node agent includes at least a data acquisition module, a data processing module, and an optimization module, wherein:

[0085] The data collection module is used to collect node data of the WAF node where the node agent is located;

[0086] A data processing module, used for preprocessing node data;

[0087] The optimization module is used to obtain the WAF rules corresponding to the WAF node from the response module, and process the abnormal behavior in the node data based on the WAF rules.

[0088] In this embodiment, the data collection module can be specifically used to determine the data type and source of the node data to be collected according to a preset strategy, monitor the WAF node in real time, and collect node data periodically or by event.

[0089] The data processing module can be specifically used to pre-process the node data, and the pre-processing may include: data cleaning, formatting, screening and standardization.

[0090] Data cleaning can refer to performing operations such as deduplication, denoising, and filtering on the collected data to remove invalid or duplicate data. For example, redundant logs can be deleted and log records with incorrect formats can be removed.

[0091] Data formatting can refer to the unified formatting of data from different sources to ensure that the format of all data meets the preset standards. For example, the timestamp of HTTP logs can be unified into ISO 8601 format to ensure compatibility between data sources.

[0092] Data filtering can refer to filtering out data that may contain signs of attacks or abnormal behaviors. For example, filtering out logs with abnormal request volumes, long response times, or specific error codes.

[0093] Data standardization can refer to standardizing data to ensure that data in different formats can be analyzed on the same platform. For example, standardizing IP addresses, URLs, and parameters in network requests.

[0094] The optimization module can be used to identify abnormal behaviors and execute response measures according to the WAF rules issued by the central cloud server.

[0095] Among them, the optimization module receives WAF rules from the response module of the central cloud server, parses the received WAF rules, confirms the content, execution logic and applicable conditions of the rules, and determines whether the data of the current node meets the conditions of a preset rule. If the node data meets the attack characteristics in the rules, the response operation is triggered.

[0096] As an example, the response operation may include, but is not limited to: intercepting a request, triggering an alarm, and updating a local policy.

[0097] In a possible implementation, the optimization module and the optimization module can be combined into a response and optimization module, which can run in the central cloud server and the node agent respectively to cooperate with each other.

[0098] In the monitoring platform and monitoring method applicable to WAF in the above-mentioned embodiments of the present disclosure, the response speed and protection accuracy of WAF are improved through various analysis methods, and manual intervention is reduced through automated rule response, thereby improving the real-time protection capability of the entire system. Dynamic response can help quickly adapt to new attack modes, improve the defense capability of WAF, and avoid missing attacks due to outdated rules or static configuration.

[0099] In a possible implementation of the above embodiment, the data acquisition module is also used to support a third-party data collection interface, and collect external preset data information based on the third-party data collection interface; wherein the preset data information includes at least one of the following: external alarm information, external node data.

[0100] In this embodiment, the data acquisition module is used to configure the third-party data collection interface that needs to be integrated inside the module according to specific needs, call the third-party data collection interface regularly or according to trigger conditions, obtain external preset data information, and fill it into the data acquisition module.

[0101] The external preset data information obtained by the third-party data collection interface can come from the threat intelligence platform, security monitoring system, and other WAF nodes. The preset data information can include but is not limited to external alarm information, traffic information, malicious IP addresses, attack characteristics, and monitoring indicators of external systems.

[0102] Furthermore, the data collection module is also used to synchronize external preset data information with the alarm module of the local WAF node, adjust the alarm level of the local system according to the severity and priority of the external alarm, and display the external alarm information together with the local data in the visual display module.

[0103] In the monitoring platform and monitoring method applicable to WAF in the above-mentioned embodiments of the present disclosure, comprehensive monitoring of WAF nodes is achieved through multiple analysis methods, by supporting third-party data collection interfaces, and integrating multiple data sources.

[0104] In a possible implementation of the above embodiment, the node agent further includes a second node management module, wherein:

[0105] The second node management module is used to obtain the preset command from the first node management module, execute the preset command in the WAF node, and send the execution result of the preset command to the central cloud server.

[0106] In this embodiment, the second node management module can be specifically used to obtain preset commands from the first node management module, verify whether the command source is legal, check the local WAF full-node permission configuration, call the interface of the local WAF node according to the content of the preset command, complete specific operations, obtain the execution results of the command, and organize it into a format that can be analyzed by the central cloud server.

[0107] In a possible implementation, the second node management module and the first node management module may be combined into a node management module, which may be run in the central cloud server and the node agent respectively to collaborate with each other.

[0108] In the supervision platform and supervision method applicable to WAF in the above-mentioned embodiments of the present disclosure, through multiple analysis methods, batch command distribution and execution, the management of WAF nodes is greatly simplified, the rapid operation of WAF nodes is supported, and the dynamic adjustment capability of the system is improved.

[0109] refer to Figure 4 , Figure 4 FIG. 1 shows a schematic diagram of the architecture of a node agent of a monitoring platform applicable to WAF according to an embodiment of the present disclosure. Figure 4 As shown, the node agent may include a data collection module, a data processing module, an optimization module, and a second node management module.

[0110] Further references Figure 5 , Figure 5 is a flowchart of a supervision method provided by an embodiment of the present disclosure, which is applied to the above Figure 1 The regulatory platform applicable to WAF shown in , the process of the method may include the following steps:

[0111] Step S501, the data analysis module in the central cloud server obtains the node data of each WAF node deployed in multiple WAF nodes, uses a third-party integration module to analyze the node data, and identifies abnormal behaviors in the node data; the node data is collected by the node agent.

[0112] Step S502, the response module in the central cloud server generates WAF rules corresponding to the abnormal behavior based on the abnormal behavior in the node data, and sends the WAF rules to each WAF node; wherein the WAF rules are used to handle the abnormal behavior.

[0113] In step S503, the alarm module in the central cloud server performs continuous detection on each WAF node, and outputs alarm information when node data exceeding a preset alarm threshold is detected.

[0114] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a monitoring device provided by an embodiment of the present disclosure, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0115] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0116] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0117] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0118] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0119] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0120] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0121] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0122] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0123] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0124] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A monitoring platform suitable for WAF, characterized in that: The supervision platform applicable to WAF includes: a central cloud server and multiple node agents, and the central cloud server includes: A data analysis module, used to obtain node data of each WAF node deployed in multiple WAF nodes, analyze the node data using a third-party integration module, and identify abnormal behaviors in the node data; the node data is collected by the node agent; A response module, configured to generate a WAF rule corresponding to the abnormal behavior based on the abnormal behavior in the node data, and send the WAF rule to each of the WAF nodes; wherein the WAF rule is used to process the abnormal behavior; The alarm module is used to continuously detect each of the WAF nodes and output alarm information when node data exceeding a preset alarm threshold is detected.

2. The monitoring platform applicable to WAF according to claim 1, characterized in that: The third-party integration module in the data analysis module at least includes a machine learning analysis module, a correlation analysis module and a linkage analysis module, wherein: The machine learning analysis module is used to perform a first preset analysis on the node data based on a pre-trained machine learning model in the module to identify a first abnormal behavior in the node data; The association analysis module is used to perform multi-data source association analysis on the node data to identify second abnormal behavior in the node data; the node data is determined by at least one data source; The linkage analysis module is used to perform linkage analysis on the node data based on a preset external platform to identify a third abnormal behavior in the node data; The data analysis module is used to determine abnormal behavior in the node data based on at least one of the first abnormal behavior, the second abnormal behavior and the third abnormal behavior.

3. The monitoring platform applicable to WAF according to claim 2, characterized in that: The central cloud server also includes a visual display module, wherein: The visual display module is used to store the node data of each WAF node and the alarm information corresponding to the node data, and use a preset display method to visually display the node data and the alarm information; the preset display method includes at least one of the following: charts, reports.

4. The monitoring platform applicable to WAF according to claim 3 is characterized in that: The central cloud server also includes a first node management module, wherein: The first node management module is used to obtain a preset command and perform batch operations on the WAF nodes based on the preset command.

5. The monitoring platform applicable to WAF according to claim 4, characterized in that: The node agent at least includes a data acquisition module, a data processing module, and an optimization module, wherein: The data collection module is used to collect node data of the WAF node where the node agent is located; The data processing module is used to pre-process the node data; The optimization module is used to obtain the WAF rules corresponding to the WAF node from the response module, and process the abnormal behavior in the node data based on the WAF rules.

6. The monitoring platform applicable to WAF according to claim 5, characterized in that: The data acquisition module is also used to support a third-party data collection interface, and based on the third-party data collection interface, collect external preset data information; wherein the preset data information includes at least one of the following: external alarm information, external node data.

7. The monitoring platform applicable to WAF according to claim 6, characterized in that: The node agent also includes a second node management module, wherein: The second node management module is used to obtain a preset command from the first node management module, execute the preset command in the WAF node, and send the execution result of the preset command to the central cloud server.

8. A supervision method, characterized in that: The method comprises: The data analysis module in the central cloud server obtains the node data of each WAF node deployed in the multiple WAF nodes, uses a third-party integration module to analyze the node data, and identifies abnormal behaviors in the node data; the node data is collected by the node agent; The response module in the central cloud server generates a WAF rule corresponding to the abnormal behavior based on the abnormal behavior in the node data, and sends the WAF rule to each WAF node; wherein the WAF rule is used to process the abnormal behavior; The alarm module in the central cloud server performs continuous detection on each of the WAF nodes, and outputs alarm information when node data exceeding a preset alarm threshold is detected.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the supervision method described in claim 8 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the supervision method described in claim 8.

Images