Traffic cleaning method and device and electronic equipment

Abstract

The invention relates to the technical field of internet, in particular to a traffic cleaning method and device and electronic equipment, the method is applied to safety equipment, the method comprises the steps that to-be-cleaned traffic of the ith round is acquired, and i is an integer larger than 0; matching the to-be-cleaned flow of the ith round based on a preset cleaning rule; if the to-be-cleaned flow of the ith round is not matched with the preset cleaning rule, a reference cleaning flow in a cache of the security equipment is inquired, and the reference cleaning flow in the cache comprises the to-be-cleaned flow which is not matched with the preset cleaning rule before the ith round and a reference threat state of the reference cleaning flow; if the target reference cleaning flow matched with the to-be-cleaned flow of the ith round exists in the cache; cleaning the to-be-cleaned flow of the ith round based on the reference threat state of the target reference cleaning flow; according to the method provided by the invention, the cache is introduced, so that the number of times that the security equipment performs flow cleaning through cloud query is reduced, and the use cost of the security equipment is reduced.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a traffic cleaning method, device and electronic equipment. Background Art

[0002] In Internet technology, firewalls are important tools to ensure user network security. Firewalls clean traffic through preset cleaning rules, thereby intercepting threat traffic. With the development of Internet technology, in order to cope with more diverse threat traffic, the concept of next-generation firewalls has been proposed, that is, firewalls can not only clean traffic through preset cleaning rules, but also clean traffic by querying the threat situation library in the cloud. Since the cloud database in the cloud contains a large amount of threat intelligence, the next-generation firewall can intercept more threat traffic, greatly improving the protection capabilities of the next-generation firewall. However, querying the threat situation library in the cloud to clean traffic requires the computing resources of the device where the firewall is located. When facing large-scale traffic, a large amount of computing resources are required, which greatly increases the cost of using the firewall. Summary of the invention

[0003] In view of this, the embodiments of the present application propose a traffic cleaning method, device and electronic device, which can generate a local cache based on the query records of the traffic to be cleaned in the cloud database, thereby reducing the number of queries to the cloud database by querying the local cache, thereby reducing the computing resources occupied by querying the cloud database and reducing the cost of using the firewall.

[0004] The embodiment of the present application is implemented by adopting the following technical solutions:

[0005] In a first aspect, an embodiment of the present application provides a traffic cleaning method, which is applied to a security device, and the method includes: obtaining the traffic to be cleaned in the i-th round, where i is an integer greater than 0; matching the traffic to be cleaned in the i-th round based on a preset cleaning rule to obtain a matching result of the traffic to be cleaned in the i-th round; if the matching result of the traffic to be cleaned in the i-th round indicates that the traffic to be cleaned does not match the preset cleaning rule, querying the reference cleaning traffic in the cache of the security device based on the traffic to be cleaned in the i-th round to obtain a query result, wherein the query result is used to indicate whether there is a reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache of the security device, the reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rule in the security device before the i-th round, and the cache of the security device also stores a reference threat status of the reference cleaning traffic; if the query result indicates that there is a target reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache, obtaining the reference threat status of the target reference cleaning traffic from the cache of the security device; and cleaning the traffic to be cleaned in the i-th round based on the reference threat status of the target reference cleaning traffic.

[0006] In a second aspect, an embodiment of the present application provides a flow cleaning device, which is applied to a security device, and the device includes: a first acquisition module, which is used to obtain the flow to be cleaned in the i-th round, where i is an integer greater than 0; a matching module, which is used to match the flow to be cleaned in the i-th round based on a preset cleaning rule to obtain a matching result of the flow to be cleaned in the i-th round; and a query module, which is used to query a reference cleaning flow in the cache of the security device based on the flow to be cleaned in the i-th round if the matching result of the flow to be cleaned in the i-th round indicates that the flow to be cleaned does not match the preset cleaning rule, and obtain a query result, wherein the query result is used to indicate whether there is a reference cleaning flow in the cache of the security device. A reference cleaning flow that matches the flow to be cleaned in the i-th round, the reference cleaning flow in the cache of the security device includes the flow to be cleaned that has not matched the preset cleaning rule in the security device before the i-th round, and the cache of the security device also stores a reference threat status of the reference cleaning flow; a second acquisition module, used to obtain the reference threat status of the target reference cleaning flow from the cache of the security device if the query result indicates that there is a target reference cleaning flow that matches the flow to be cleaned in the i-th round in the cache; a cleaning module, used to clean the flow to be cleaned in the i-th round based on the reference threat status of the target reference cleaning flow.

[0007] In some embodiments, the query module is also used to send a query request to a cloud database based on the i-th round of traffic to be cleaned if there is no target reference cleaning traffic associated with the i-th round of traffic to be cleaned in the cache, the cloud database containing multiple threat traffic and threat status corresponding to each threat traffic, the cloud database responds to the query request, queries the target threat traffic matching the i-th round of traffic to be cleaned among the multiple threat traffic, and returns the target threat status corresponding to the target threat traffic; the second acquisition module is also used to receive the target threat status corresponding to the target threat traffic returned by the cloud database in response to the query request; the cleaning module is also used to clean the i-th round of traffic to be cleaned based on the target threat status corresponding to the target threat traffic.

[0008] In some implementations, the traffic cleaning device further includes an update module, which is configured to use the target threat traffic as a reference cleaning traffic and store the target threat state corresponding to the target threat traffic as a reference threat state of the reference cleaning traffic into a cache of the security device.

[0009] In some embodiments, the cache of the security device includes a first version number of the cloud database, and the second acquisition module is also used to obtain the current version number of the cloud database; if the current version number does not successfully match the first version number, the target threat traffic of the first i rounds of the cloud database and the threat status corresponding to the target threat traffic are obtained, and the target threat traffic of the first i rounds is the target threat traffic queried by the cloud database in response to the query request corresponding to the traffic to be cleaned from the 1st round to the i-th round; the update module is also used to update the cache of the security device based on the target threat traffic of the first i rounds and the threat status corresponding to the target threat traffic.

[0010] In some embodiments, the second acquisition module is further used to receive the current version number of the cloud database returned by the cloud database in response to the query request, and the update module is further used to update the first version number in the cache to the current version number of the cloud database.

[0011] In some embodiments, the update module is also used to determine the effective duration of each reference cleaning flow based on the reference threat status of each reference cleaning flow in the cache of the security device; if the storage duration of a reference cleaning flow in the cache is not less than the effective duration corresponding to the reference cleaning flow, the reference cleaning flow and the reference threat status of the reference cleaning flow are deleted from the cache.

[0012] In some implementations, the traffic cleaning device further includes a reporting module, which is used to generate a cleaning log corresponding to the traffic to be cleaned, wherein the cleaning log includes the traffic to be cleaned and a cleaning result corresponding to the traffic to be cleaned; and send the cleaning log to the client.

[0013] In some implementations, the cleaning module is further configured to clean the i-th round of traffic to be cleaned based on the preset cleaning rule if the matching result of the i-th round of traffic to be cleaned indicates that the traffic to be cleaned matches the preset cleaning rule.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, which includes one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above method.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores program code, and the program code can be called by a processor to execute the above method.

[0016] The embodiments of the present application provide a flow cleaning method, device and electronic device. The method is applied to a security device. The method includes obtaining the flow to be cleaned in the i-th round, where i is an integer greater than 0; matching the flow to be cleaned in the i-th round based on a preset cleaning rule to obtain a matching result of the flow to be cleaned in the i-th round; if the matching result of the flow to be cleaned in the i-th round indicates that the flow to be cleaned does not match the preset cleaning rule, querying the reference cleaning flow in the cache of the security device based on the flow to be cleaned in the i-th round to obtain a query result, the query result is used to indicate whether there is a reference cleaning flow matching the flow to be cleaned in the i-th round in the cache of the security device, the reference cleaning flow in the cache of the security device includes the flow to be cleaned that has not matched the preset cleaning rule in the security device before the i-th round, and the cache of the security device also stores a reference threat status of the reference cleaning flow; if the query result indicates that there is a target reference cleaning flow matching the flow to be cleaned in the i-th round in the cache, obtaining the reference threat status of the target reference cleaning flow from the cache of the security device; querying the i-th round based on the reference threat status of the target reference cleaning flow The traffic to be cleaned is cleaned; through the method provided by the present application, since the reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rules before the i-th round, it cannot be matched and cleaned by the preset cleaning rules in the security device, that is, the reference threat state corresponding to the reference cleaning flow in the cache of the security device is the threat state obtained by querying the cloud; when the traffic to be cleaned in the i-th round fails to match the preset cleaning rules, by querying the cache of the security device, if the query result indicates that there is a target reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache, it can be understood that the traffic to be cleaned has queried the cloud database within a period of time, and therefore, the reference threat state corresponding to the matched target reference cleaning traffic can be used as the threat state of the traffic to be cleaned in the i-th round, so that the traffic to be cleaned in the i-th round is cleaned according to the reference threat state of the target reference cleaning traffic, thereby avoiding the process of cloud query for the traffic to be cleaned in the i-th round, reducing the number of cloud queries performed by the security device, and reducing the use cost of the security device.

[0017] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1A schematic diagram of a scenario involved in an embodiment of the present application is shown.

[0020] Figure 2 A first flow chart of the flow cleaning method provided in an embodiment of the present application is shown.

[0021] Figure 3 A second flow chart of the flow cleaning method provided in an embodiment of the present application is shown.

[0022] Figure 4 A third flow chart of the flow cleaning method provided in an embodiment of the present application is shown.

[0023] Figure 5 A fourth flow chart of the flow cleaning method provided in an embodiment of the present application is shown.

[0024] Figure 6 A fifth flow chart of the flow cleaning method provided in an embodiment of the present application is shown.

[0025] Figure 7 A schematic diagram of another application scenario involved in the embodiment of the present application is shown.

[0026] Figure 8 The embodiment of the present application provides Figure 7 A flow chart of traffic cleaning performed by the next generation firewall 30.

[0027] Fig. 9 A schematic diagram of a flow cleaning device provided in an embodiment of the present application is shown.

[0028] Fig.10 A schematic diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0029] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0030] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0031] In the following description, the terms "first\second" and the like are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first\second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0032] The term "multiple" as used herein refers to two or more than two. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the related objects are in an "or" relationship.

[0033] With the development of Internet technology, while enjoying more and more abundant network content, we also need to face increasingly diverse network threats. Among network devices, firewalls are important tools to ensure user network security and prevent network threats. Firewalls clean traffic through preset cleaning rules to intercept threat traffic. With the development of Internet technology, in order to deal with more diverse threat traffic, the concept of next-generation firewalls has been proposed, that is, firewalls can not only clean traffic through preset cleaning rules, but also clean traffic by querying the threat situation library in the cloud. Since the cloud database in the cloud contains a large amount of threat intelligence, the next-generation firewall can intercept more threat traffic, greatly improving the protection ability of the next-generation firewall. However, querying the threat situation library in the cloud to clean traffic requires the computing resources of the device where the firewall is located. When facing large-scale traffic, a large amount of computing resources are required, which greatly increases the cost of using the firewall.

[0034] In order to solve the above problems, the present application proposes a traffic cleaning method, device and electronic device, which is applied to a security device, and the method includes: obtaining the traffic to be cleaned in the i-th round, where i is an integer greater than 0; matching the traffic to be cleaned in the i-th round based on a preset cleaning rule to obtain a matching result of the traffic to be cleaned in the i-th round; if the matching result of the traffic to be cleaned in the i-th round indicates that the traffic to be cleaned does not match the preset cleaning rule, querying the reference cleaning traffic in the cache of the security device based on the traffic to be cleaned in the i-th round to obtain a query result, the query result is used to indicate whether there is a reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache of the security device, the reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rule in the security device before the i-th round, and the cache of the security device also stores a reference threat status of the reference cleaning traffic; if the query result indicates that there is a target reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache, obtaining the reference threat status of the target reference cleaning traffic from the cache of the security device; and cleaning the traffic to be cleaned in the i-th round based on the reference threat status of the target reference cleaning traffic.

[0035] Through the method provided by the present application, since the reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rules before the i-th round, the reference cleaning traffic cannot be cleaned through the preset cleaning rules in the security device, that is, the reference cleaning flow in the cache of the security device is the traffic that needs to be matched by querying the cloud, and its corresponding reference threat state is the threat state obtained by querying the cloud; when the traffic to be cleaned in the i-th round fails to match the preset cleaning rules, by querying the cache of the security device, if the query result indicates that there is a target reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache, it can be understood that the traffic to be cleaned has queried the cloud database within a period of time, and therefore, the reference threat state corresponding to the matched target reference cleaning traffic can be used as the threat state of the traffic to be cleaned in the i-th round, so that the traffic to be cleaned in the i-th round is cleaned according to the reference threat state of the target reference cleaning traffic, thereby avoiding the process of cloud query for the traffic to be cleaned in the i-th round, reducing the number of cloud queries performed by the security device, and reducing the use cost of the security device.

[0036] See also Figure 1 , Figure 1 A schematic diagram of a scenario involved in the present application is provided, including a device 10 and a server 20, wherein the device 10 and the server 20 are connected to each other via a wired or wireless network.

[0037] Among them, the device 10 stores at least one preset cleaning rule, and a cache is set in the device 10, which stores reference cleaning traffic and reference threat status of the reference cleaning traffic; a database can be deployed in the server 20, and a large amount of traffic and threat status corresponding to the traffic can be stored in the database.

[0038] When receiving traffic, device 10 matches the received traffic according to the stored preset cleaning rules. If the match is successful, the traffic is cleaned based on the matched preset cleaning rules. If the match is not successful, the device 10 cache is queried to see whether there is a matching target reference cleaning traffic. If there is a matching target reference cleaning traffic, the traffic is cleaned according to the reference threat status of the target reference cleaning traffic. If there is no matching target reference cleaning traffic, a query request is sent to server 20 to query the threat status of the traffic. Server 20 responds to the query request, queries the threat status corresponding to the traffic in the database and returns it to device 10. Device 10 cleans the traffic according to the threat status returned by server 20.

[0039] In the above application scenario, when the device 10 matches the preset cleaning rule or matches the target reference cleaning traffic in the cache, the device 10 can complete the cleaning of the traffic without sending a query request to the server 20; only when the preset cleaning rule and the target reference cleaning traffic are not matched, a query request will be sent to the server 20 to complete the cleaning of the traffic, avoiding the need for the device 10 to query the server 20 for traffic cleaning for each traffic that does not match the preset cleaning rule, reducing the frequency of the device 10 sending query requests to the server 20, and thereby reducing the occupation of the computing resources of the device 10 by traffic cleaning.

[0040] In some embodiments, the device 10 may be a smart phone, tablet computer, laptop computer, desktop computer, smart TV, vehicle-mounted terminal, or other device that can access network traffic. The server 200 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, and big data and artificial intelligence platforms, and this is not limited here.

[0041] It should be understood that the application scenarios of the method steps described above are merely illustrative and are not intended to limit the present invention.

[0042] The embodiments provided in this application will be described below with reference to the accompanying drawings.

[0043] See also Figure 2 , Figure 2 A first flow chart of a traffic cleaning method provided in an embodiment of the present application is provided. The method is applied to a security device and includes steps S110-S150:

[0044] S110, obtaining the flow to be cleaned in the i-th round, where i is an integer greater than 0.

[0045] Among them, the traffic to be cleaned, that is, traffic, refers to the data packets accessing the security device, usually including domain names, IP (Internet protocol, network address), URL (Uniform Resource Locator, the same resource locator), file MD5 (MD5 Message-Digest Algorithm, a widely used cryptographic hash function) and other contents.

[0046] There are many ways to divide the rounds of traffic to be cleaned; for example, a fixed number of traffic can be regarded as one round of traffic, such as setting 100 traffic as one round of traffic, the first round of traffic is the 1st to 100th traffic received by the security device, the second round of traffic is the 101st to 200th traffic received by the security device, etc.; it is also possible to regard traffic within a fixed time period as one round of traffic; it is also possible to directly regard one traffic as one round of traffic, etc., without specific restrictions here.

[0047] S120 , matching the traffic to be cleaned in the i-th round based on preset cleaning rules to obtain a matching result of the traffic to be cleaned in the i-th round.

[0048] It should be noted that the preset cleaning rules are pre-configured and stored in the security device; the preset cleaning rules may include domain name filtering rules, IP filtering rules, URL filtering rules, etc.

[0049] For example, as shown in Table 1, Table 1 provides an exemplary example of domain name filtering rules:

[0050]

[0051] Table 1

[0052] The following is a brief description of each domain name filtering rule in Table 1.

[0053] In Table 1, the domain name filtering rule domain_valid_character filters out invalid domain names through the value range of characters, and its value range is "AZ, az, 0-9, *, -,."; that is, if a character outside the above value range appears in the domain name of the traffic to be cleaned, such as α, then the domain name of the traffic to be cleaned is determined to be an invalid domain name, and corresponding cleaning operations are performed on the traffic to be cleaned, such as interception or warning.

[0054] Similarly, the domain name filtering rule domain_necessary_character filters out invalid domain names by specifying characters, where the specified characters are characters that must appear in the domain name, such as ".". In other words, if "." does not appear in the domain name of the traffic to be cleaned, the domain name of the traffic to be cleaned is determined to be an invalid domain name.

[0055] The domain name filtering rules domain_safe_suffix, domain_country_suffix and domain_local_suffix all refer to domain name filtering through specified domain names at different levels (such as domain name suffix, top-level domain name, local domain name); specifically, domain_safe_suffix is ​​filtered by whether the domain name suffix is ​​in the whitelist (such as gov, edu, etc. in Table 1). The domain name with the domain name suffix in the whitelist is a safe domain name by default; domain_country_suffix is ​​filtered by whether the top-level domain (TLD) is in the whitelist. If the TLD is in the whitelist, the domain name is a safe domain name by default; domain_local_suffix is ​​filtered by whether there is a local resource domain name. The local resource domain name is a safe domain name by default.

[0056] As shown in Table 2, Table 2 exemplarily provides an IP filtering rule.

[0057]

[0058]

[0059] Table 2

[0060] Among them, the IP filtering rule IP_reserved_address in Table 2 means that only the traffic corresponding to the IP address within the value range is retained, and the traffic corresponding to the IP address outside the value range is filtered out. The value range is configured in advance and can include private networks, network loops and other addresses that need to be reserved. The specific configuration can be based on actual needs.

[0061] As shown in Table 3, Table 3 exemplarily provides a URL filtering rule.

[0062]

[0063] Table 3

[0064] Among them, the URL filtering rule URL_invalid_file_extend in Table 3 refers to judging whether the traffic is meaningless traffic by the URL of the traffic. For example, if the URL contains gif, it means that the corresponding traffic resource is a gif image resource, and there is no need to clean it, and it can be regarded as safe traffic by default.

[0065] When using the various preset cleaning rules in Tables 1-3 above to match the traffic to be cleaned, sequential matching can be performed in a certain order, such as matching the domain name filtering rule first, then matching the IP filtering rule, etc. When any filtering rule is successfully matched, stop matching; it is also possible to match multiple preset cleaning rules at the same time, without specific restrictions here.

[0066] Furthermore, the matching result of the traffic to be cleaned includes the preset cleaning rules matched by the cleaning traffic; if sequential matching is performed in a certain order, the matching result of the traffic to be cleaned will only include one matched preset cleaning rule; if matching of multiple preset cleaning rules is performed at the same time, the matching result of the traffic to be cleaned may include one matched preset cleaning rule or multiple preset cleaning rules.

[0067] In some implementations, if the matching result of the traffic to be cleaned in the i-th round indicates that the traffic to be cleaned matches a preset cleaning rule, the traffic to be cleaned in the i-th round is cleaned based on the preset cleaning rule.

[0068] In some embodiments, when there is only one preset cleaning rule in the matching result, the traffic to be cleaned is cleaned according to the corresponding cleaning operation (such as interception, allowing passage, waiting for query, generating alarm information, etc.) according to the preset cleaning rule. If the matched preset cleaning rule is domain_safe_suffix, that is, the domain name suffix of the traffic to be cleaned is in the whitelist, the traffic to be cleaned is allowed to pass.

[0069] When there are multiple preset cleaning rules in the matching results, different priority levels can be set for different preset cleaning rules, and the cleaning operation corresponding to the preset cleaning rule with a higher priority level can be used to clean the traffic to be cleaned; or, different priority levels can be set for different cleaning operations, and the cleaning operation with a higher priority level can be used to clean the traffic to be cleaned. The specific method is not limited here.

[0070] S130. If the matching result of the traffic to be cleaned in the i-th round indicates that the traffic to be cleaned does not match the preset cleaning rule, query the reference cleaning traffic in the cache of the security device based on the traffic to be cleaned in the i-th round to obtain a query result. The query result is used to indicate whether there is a reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache of the security device. The reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rule in the security device before the i-th round. The cache of the security device also stores a reference threat status of the reference cleaning traffic.

[0071] Among them, the threat status of a flow can also be understood as the security status of the flow; for example, the threat status of a flow can include black (threat), white (no threat), and gray (threat unknown), and the corresponding flow can be divided into black flow, white flow, and gray flow.

[0072] It is understandable that as the rounds of traffic to be cleaned gradually increase, the reference cleaned traffic in the cache of the security device will be gradually updated.

[0073] It can be understood that since the reference cleaning traffic is the traffic to be cleaned that has not matched the preset cleaning rules in the security device before the i-th round, its status cannot be determined based on the preset cleaning rules of the security device, and it cannot be cleaned based on the preset cleaning rules of the security device. Therefore, the reference cleaning traffic needs to be determined through external queries (such as cloud database queries, manual review, etc.) to determine its status and then determine how to clean it.

[0074] In some implementations, the reference threat status of the reference cleansing traffic stored in the cache of the security device is queried from a cloud database, which stores a variety of threat traffic and the threat status corresponding to each threat traffic.

[0075] S140: If the query result indicates that there is a target reference cleaning flow matching the to-be-cleaned flow in the i-th round in the cache, obtain a reference threat status of the target reference cleaning flow from the cache of the security device.

[0076] Among them, the target reference cleaning traffic that matches the traffic to be cleaned in the i-th round can be traffic that has exactly the same one or more characteristics as the traffic to be cleaned in the i-th round, such as a completely matched domain name, IP, URL, etc., or it can be traffic that has partially the same one or more characteristics as the traffic to be cleaned in the i-th round, such as the same domain name suffix, the same IP address subnet mask, etc. The specific matching rules can be set according to actual needs.

[0077] When the query result indicates that there is a target reference cleaning flow in the cache that matches the flow to be cleaned in the i-th round, it can be understood that the flow to be cleaned in the i-th round has been queried as the target reference cleaning flow before the i-th round. Considering that the threat status of a flow will remain stable over a period of time, the reference threat status of the target reference cleaning flow can represent the threat status of the flow to be cleaned in the i-th round to a certain extent.

[0078] S150 , cleaning the traffic to be cleaned in the i-th round based on the reference threat status of the target reference cleaning traffic.

[0079] Among them, the cleaning operation corresponding to each threat state is pre-stored in the security device; for example, when the traffic to be cleaned in the i-th round is black traffic (that is, the reference threat state is black), the corresponding cleaning operation is interception; when the traffic to be cleaned in the i-th round is gray traffic (that is, the reference threat state is gray), the corresponding cleaning operation is alarm; when the traffic to be cleaned in the i-th round is white traffic (that is, the reference threat state is white), the corresponding cleaning operation is allowing passage.

[0080] According to the method provided by the embodiment of the present application, since the reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rules before the i-th round, the reference cleaning traffic cannot be matched and cleaned by the preset cleaning rules in the security device, that is, the reference cleaning flow in the cache of the security device is the traffic that needs to be matched by querying the cloud, and its corresponding reference threat state is the threat state obtained by querying the cloud; when the traffic to be cleaned in the i-th round fails to match the preset cleaning rules, by querying the cache of the security device, if the query result indicates that there is a target reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache, it can be understood that the traffic to be cleaned has queried the cloud database within a period of time, and therefore, the reference threat state corresponding to the matched target reference cleaning traffic can be used as the threat state of the traffic to be cleaned in the i-th round, so that the traffic to be cleaned in the i-th round is cleaned according to the reference threat state of the target reference cleaning traffic, thereby avoiding the process of cloud query for the traffic to be cleaned in the i-th round, reducing the number of cloud queries performed by the security device, and reducing the use cost of the security device.

[0081] In some other embodiments, see Figure 3 , Figure 3 A second flow chart of the flow cleaning method provided in an embodiment of the present application is given. After step S120, the flow cleaning method further includes steps S210-S230:

[0082] S210. If the target reference cleaning flow associated with the flow to be cleaned in the i-th round does not exist in the cache, a query request is sent to the cloud database based on the flow to be cleaned in the i-th round. The cloud database contains multiple threat flows and the threat status corresponding to each threat flow. In response to the query request, the cloud database queries the target threat flow matching the flow to be cleaned in the i-th round among the multiple threat flows, and returns the target threat status corresponding to the target threat flow.

[0083] It is understandable that the query request includes information about the i-th round of traffic to be cleaned; after receiving the query request, the cloud database can perform a query based on the information about the i-th round of traffic to be cleaned contained in the query request.

[0084] S220: Receive the target threat status corresponding to the target threat traffic returned by the cloud database in response to the query request.

[0085] In some embodiments, after receiving the target threat status corresponding to the target threat traffic returned by the cloud database in response to the query request, the target threat traffic can also be used as a reference cleaning traffic, and the target threat status corresponding to the target threat traffic can be stored in the cache of the security device as the reference threat status of the reference cleaning traffic, thereby updating the cache to facilitate the next round of traffic to be cleaned to query the updated cache.

[0086] S230 , cleaning the to-be-cleaned traffic of the i-th round based on the target threat state corresponding to the target threat traffic.

[0087] Among them, the process of step S230 is similar to that of step S150 in the aforementioned embodiment. For the specific description of step S230, please refer to the specific description of step S150 in the aforementioned embodiment, which will not be repeated here.

[0088] The method provided in the embodiment of the present application, when the i-th round of to-be-cleaned traffic fails to successfully match the preset cleaning rules and the matching target reference cleaning traffic fails to be queried in the cache, a query request is sent to the cloud database, and the corresponding target threat traffic and the target threat status of the target threat traffic are queried, thereby cleaning the i-th round of to-be-cleaned traffic based on the target threat status corresponding to the target threat traffic; through the method provided in the embodiment of the present application, traffic cleaning is performed in combination with the cloud database, which enriches the traffic cleaning range of the security device, improves the traffic cleaning capability of the security device, and thus improves the protection capability of the security device.

[0089] In some other implementations, the cloud database also needs to be maintained and updated. Figure 4 , Figure 4A third flow chart of the traffic cleaning method provided in an embodiment of the present application is provided. The cache of the security device includes the first version number of the cloud database. After step S210, the traffic cleaning method further includes steps S310-S330:

[0090] S310: Obtain the current version number of the cloud database.

[0091] It should be noted that the version number of the cloud database corresponds one-to-one to the content in the cloud database, that is, when the version number of the cloud database is updated, it means that the content in the cloud database is also updated. The update of the content in the cloud database may include multiple operations such as adding, deleting, and modifying the content.

[0092] Obviously, the current version number of the cloud database is also the latest version number of the cloud database, and the content of the cloud database corresponding to the current version number is also the latest and most accurate.

[0093] In some implementations, the security device may separately issue a request to obtain a version number before issuing each query request. When the current version number successfully matches the first version number, a query request is issued for the i-th round of traffic to be cleaned. When the current version number does not successfully match the first version number, a query request is issued for the previous i rounds of traffic to be cleaned.

[0094] The security device may also query the version number of the cloud database through a query request at the same time. If the current version number does not successfully match the first version number, a request is issued to obtain the target threat traffic of the previous i rounds of the cloud database and the threat status corresponding to the target threat traffic.

[0095] In the case where the security device simultaneously queries the version number of the cloud database through the query request, step S310 specifically includes: receiving the current version number of the cloud database returned by the cloud database in response to the query request.

[0096] S320. If the current version number does not successfully match the first version number, obtain the target threat traffic of the first i rounds and the threat status corresponding to the target threat traffic from the cloud database. The target threat traffic of the first i rounds is the target threat traffic queried by the cloud database in response to the query request corresponding to the traffic to be cleaned from the 1st round to the i-th round.

[0097] When the current version number fails to match the first version number, it means that there may be data inconsistency between the cache and the cloud database; for example, in the cloud database corresponding to the first version number, the threat status of traffic A is unknown threat, and the cache corresponding to the first version number is obtained based on the cloud database corresponding to the first version number. Therefore, in the cache corresponding to the first version number, the threat status of traffic A stored therein is also unknown threat; if the threat status of traffic A is updated to threatening in the cloud database corresponding to the current version number, this will cause data inconsistency between the cache and the cloud database, thereby reducing the effect of traffic cleaning.

[0098] Therefore, when the current version number fails to match the first version number, the target threat traffic of the first i rounds of the cloud database and the threat status corresponding to the target threat traffic are obtained. The target threat traffic of the first i rounds is the target threat traffic queried by the cloud database in response to the query request corresponding to the traffic to be cleaned from the 1st round to the i-th round; obviously, the target threat traffic of the first i rounds includes all reference cleaning traffic in the cache.

[0099] In some embodiments, after determining that the current version number does not successfully match the first version number and obtaining the target threat traffic of the previous i rounds of the cloud database and the threat status corresponding to the target threat traffic, the first version number in the cache can also be updated to the current version number of the cloud database, thereby achieving an update of the cached first version number.

[0100] S330: Update the cache of the security device based on the target threat flow of the previous i rounds and the threat status corresponding to the target threat flow.

[0101] Specifically, the target threat traffic of the first i rounds corresponds one-to-one to the reference cleaning traffic in the cache of the security device. The threat state corresponding to the target threat traffic of the first i rounds is used to replace the reference threat state of the corresponding reference cleaning traffic, thereby updating the cache.

[0102] Through the method adopted in the embodiment of the present application, the reference cleaning traffic and the reference threat status of the reference cleaning traffic in the cache are consistent with the target threat traffic and the threat status corresponding to the target threat traffic in the cloud database, thereby avoiding data inconsistency between the cache and the cloud database, resulting in poor traffic cleaning effect.

[0103] In some other embodiments, see Figure 5 , Figure 5 A fourth flow chart of the traffic cleaning method provided in the embodiment of the present application is provided. The traffic cleaning method further includes steps S410-S420:

[0104] S410: Determine the effective duration of each reference cleaning flow based on the reference threat status of each reference cleaning flow in the cache of the security device.

[0105] Among them, the effective duration of the reference cleaning flow can also be understood as the duration during which the threat status of the reference cleaning flow remains stable, that is, within the effective duration of a reference cleaning flow, the threat status of the reference cleaning flow is likely to remain stable.

[0106] S420: If the storage duration of a reference cleaning flow in the cache is not less than the effective duration corresponding to the reference cleaning flow, the reference cleaning flow and the reference threat status of the reference cleaning flow are deleted from the cache.

[0107] Exemplarily, the threat status of traffic includes black, white and gray. For black traffic and white traffic, the corresponding effective time can be set to 7 days, and for gray traffic, the corresponding effective time can be set to 1 hour. If the reference cleaning traffic A is black traffic and its storage time in the cache reaches 7 days, the reference cleaning traffic A and the corresponding reference threat status will be deleted from the cache.

[0108] In some embodiments, when the corresponding reference cleaning flow in the cache and the reference threat status of the reference cleaning flow are updated, as in step S330 in the aforementioned embodiment, the effective duration of the reference cleaning flow may be updated accordingly; of course, in other embodiments, when the corresponding reference cleaning flow in the cache and the reference threat status of the reference cleaning flow are updated, the effective duration of the reference cleaning flow may not be updated.

[0109] Through the method provided in the present application, different effective durations are set for reference threat traffic of different reference threat states, thereby ensuring the validity of the reference threat state. At the same time, by setting the effective duration, expired data in the cache can be cleared in a timely manner to avoid excessive data volume in the cache, thereby further improving the efficiency of cache query.

[0110] In some other embodiments, see Figure 6 , Figure 6 A fifth flow chart of the traffic cleaning method provided in the embodiment of the present application is provided. The traffic cleaning method further includes steps S510-S520:

[0111] S510: Generate a cleaning log corresponding to the flow to be cleaned, where the cleaning log includes the flow to be cleaned and the cleaning result corresponding to the flow to be cleaned.

[0112] S520: Send the cleaning log to the client.

[0113] Among them, after receiving the cleaning log, the client can conduct in-depth mining on the cleaning log to find the traffic that was incorrectly cleaned due to incorrect judgment in the cleaning log, and then send the incorrectly cleaned traffic and the correct judgment of the traffic to the cloud database. The cloud database maintains the cloud database based on the incorrectly cleaned traffic and the correct judgment of the traffic to achieve the update of the cloud database; further, after the cloud database is updated, its version number needs to be updated accordingly.

[0114] For easier understanding, the following will be explained with a specific scenario diagram. Figure 7 , Figure 7 Another application scenario diagram of the traffic cleaning method provided in an embodiment of the present application is given, including a next-generation firewall 30 (that is, the security device of the present application), a cloud log center 40 (that is, the client of the present application) and a threat intelligence center 50 (that is, the cloud database of the present application).

[0115] After receiving the traffic, the next-generation firewall 30 uses the traffic cleaning method provided in the present application to clean the traffic, and reports the generated cleaning log to the cloud log center 40. After receiving the cleaning log reported by the next-generation firewall 30, the cloud log center 40 performs intelligence mining on the cleaning log (which can be achieved by manual mining by personnel or by program code, etc.), obtains new threat intelligence, and sends the mined new threat intelligence to the threat intelligence center 50. The threat intelligence center 50 is updated according to the new threat intelligence sent by the cloud log center 40.

[0116] During the process of the next-generation firewall 30 using the traffic cleaning method provided in the present application to clean the traffic, the next-generation firewall 30 will periodically query the threat intelligence center 50 (that is, the process in which the security device in the present application sends a query request to the cloud database and obtains the current version number), and the threat intelligence center 50 responds to the query of the next-generation firewall 30 and returns the threat intelligence to the next-generation firewall 30, and the next-generation firewall 30 updates the cache according to the received threat intelligence.

[0117] See also Figure 8 , Figure 8 Given Figure 7 The flow chart of the next generation firewall 30 cleaning the traffic is as follows:

[0118] After receiving the traffic, the next generation firewall 30 matches it using the preset cleaning rules, wherein the preset cleaning rules include basic IP rules, basic domain name rules and basic URL rules. If the traffic successfully matches the preset cleaning rules, the traffic is cleaned using the preset cleaning rules.

[0119] If the traffic does not match the preset cleaning rules, the cache is queried based on the traffic. The cache contains multiple traffic flows and corresponding threat status. If the target traffic corresponding to the traffic is successfully matched in the cache, the threat status of the target traffic in the cache is obtained, and the traffic is cleaned based on the threat status of the target traffic.

[0120] If the target traffic corresponding to the traffic is not successfully matched in the cache, a request is made to the cloud to query the threat status of the traffic, and the traffic is cleaned based on the threat status of the traffic queried and returned by the cloud.

[0121] It can be seen that in the above traffic cleaning process, when matching the preset cleaning rules or matching the target traffic in the cache, there is no need to initiate a query to the cloud. That is, by introducing the cache, the number of queries to the cloud is reduced, thereby reducing the cost of traffic cleaning.

[0122] In some embodiments, see Fig. 9 , Fig. 9 A schematic diagram of a flow cleaning device provided in an embodiment of the present application is provided. The flow cleaning device 600 includes:

[0123] The first acquisition module 610 is used to acquire the flow to be cleaned in the i-th round, where i is an integer greater than 0.

[0124] The matching module 620 is used to match the traffic to be cleaned in the i-th round based on the preset cleaning rule to obtain the matching result of the traffic to be cleaned in the i-th round.

[0125] The query module 630 is used to query the reference cleaning traffic in the cache of the security device based on the i-th round of traffic to be cleaned if the matching result of the i-th round of traffic to be cleaned indicates that the traffic to be cleaned does not match the preset cleaning rule, and obtain the query result. The query result is used to indicate whether there is a reference cleaning traffic matching the i-th round of traffic to be cleaned in the cache of the security device. The reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that did not match the preset cleaning rule in the security device before the i-th round. The cache of the security device also stores the reference threat status of the reference cleaning traffic.

[0126] The second acquisition module 640 is configured to acquire a reference threat status of the target reference cleaning flow from the cache of the security device if the query result indicates that the target reference cleaning flow matching the to-be-cleaned flow in the i-th round exists in the cache.

[0127] The cleaning module 650 is used to clean the traffic to be cleaned in the i-th round based on the reference threat status of the target reference cleaning traffic.

[0128] In some embodiments, the query module 630 is also used to send a query request to the cloud database based on the traffic to be cleaned in the i-th round if there is no target reference cleaning traffic associated with the traffic to be cleaned in the i-th round in the cache. The cloud database contains multiple threat traffics and threat states corresponding to each threat traffic. In response to the query request, the cloud database queries the target threat traffic matching the traffic to be cleaned in the i-th round among the multiple threat traffics, and returns the target threat state corresponding to the target threat traffic; the second acquisition module 640 is also used to receive the target threat state corresponding to the target threat traffic returned by the cloud database in response to the query request; the cleaning module 650 is also used to clean the traffic to be cleaned in the i-th round based on the target threat state corresponding to the target threat traffic.

[0129] In some implementations, the traffic cleaning device 600 further includes an update module, which is configured to use the target threat traffic as a reference cleaning traffic and store the target threat state corresponding to the target threat traffic as a reference threat state of the reference cleaning traffic into a cache of the security device.

[0130] In some embodiments, the cache of the security device includes a first version number of the cloud database, and the second acquisition module 640 is also used to obtain the current version number of the cloud database; if the current version number does not successfully match the first version number, the target threat traffic of the cloud database in the previous i rounds and the threat status corresponding to the target threat traffic are obtained, and the target threat traffic of the previous i rounds is the target threat traffic queried by the cloud database in response to the query request corresponding to the traffic to be cleaned from the 1st round to the i-th round; the update module is also used to update the cache of the security device based on the target threat traffic of the previous i rounds and the threat status corresponding to the target threat traffic.

[0131] In some embodiments, the second acquisition module 640 is further configured to receive the current version number of the cloud database returned by the cloud database in response to the query request, and the update module is further configured to update the first version number in the cache to the current version number of the cloud database.

[0132] In some embodiments, the update module is also used to determine the effective duration of each reference cleaning flow based on the reference threat status of each reference cleaning flow in the cache of the security device; if the storage duration of a reference cleaning flow in the cache is not less than the effective duration corresponding to the reference cleaning flow, the reference cleaning flow and the reference threat status of the reference cleaning flow are deleted from the cache.

[0133] In some implementations, the traffic cleaning device 600 further includes a reporting module, which is used to generate a cleaning log corresponding to the traffic to be cleaned, the cleaning log including the traffic to be cleaned and the cleaning result corresponding to the traffic to be cleaned; and send the cleaning log to the client.

[0134] In some implementations, the cleaning module 650 is further configured to clean the traffic to be cleaned in the i-th round based on the preset cleaning rule if the matching result of the traffic to be cleaned in the i-th round indicates that the traffic to be cleaned matches the preset cleaning rule.

[0135] In some implementations, based on the flow cleaning determination method provided in the above embodiment, the present application embodiment also provides an electronic device, such as Fig.10 , Fig.10 A structural block diagram of an electronic device provided in an embodiment of the present application is given, where the electronic device 700 includes one or more processors 710; a memory 720; and one or more programs, wherein the one or more programs are stored in the memory 720 and configured to be executed by the one or more processors 710, and the one or more programs are configured to execute the above method.

[0136] Among them, the electronic device 700 can be a terminal device, and the terminal device can be a computer, a tablet computer, a car terminal, etc.

[0137] The processor 710 may include one or more processing cores. The processor 710 uses various interfaces and lines to connect the various parts of the entire wearable device, and executes various functions of the wearable device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 720, and calling data stored in the memory 720. Optionally, the processor 710 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 710 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor, but may be implemented separately through a communication chip.

[0138] The memory 720 may include a random access memory (RAM) or a read-only memory (ROM). The memory 720 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 720 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the electronic device during use.

[0139] In some embodiments, the present application further provides a computer-readable storage medium, which stores program code, and the program code can be called by a processor to execute the above method.

[0140] The computer readable storage medium may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer readable storage medium includes a non-transitory computer-readable storage medium. The computer readable storage medium has storage space for program codes that execute any of the method steps in the above method. These program codes may be read from or written to one or more computer program products. The program code may be compressed in an appropriate form.

[0141] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of the overall module or unit of the module or unit function.

[0142] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technical personnel in the field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. A flow cleaning method, characterized in that: Applications in safety equipment, including: Get the flow to be cleaned in the i-th round, where i is an integer greater than 0; Matching the flow to be cleaned in the i-th round based on the preset cleaning rule to obtain a matching result of the flow to be cleaned in the i-th round; If the matching result of the traffic to be cleaned in the i-th round indicates that the traffic to be cleaned does not match the preset cleaning rule, query the reference cleaning traffic in the cache of the security device based on the traffic to be cleaned in the i-th round to obtain a query result, the query result is used to indicate whether there is a reference cleaning traffic matching the traffic to be cleaned in the i-th round in the cache of the security device, the reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rule in the security device before the i-th round, and the cache of the security device also stores a reference threat status of the reference cleaning traffic; If the query result indicates that there is a target reference cleaning flow matching the to-be-cleaned flow in the i-th round in the cache, obtaining a reference threat status of the target reference cleaning flow from the cache of the security device; The traffic to be cleaned in the i-th round is cleaned based on the reference threat status of the target reference cleaning traffic.

2. The method according to claim 1, characterized in that The method further comprises: If the target reference cleaning flow associated with the flow to be cleaned in the i-th round does not exist in the cache, a query request is sent to a cloud database based on the flow to be cleaned in the i-th round, the cloud database includes multiple threat flows and threat states corresponding to each threat flow, and the cloud database responds to the query request by querying a target threat flow matching the flow to be cleaned in the i-th round among the multiple threat flows, and returns a target threat state corresponding to the target threat flow; Receiving a target threat state corresponding to the target threat flow returned by the cloud database in response to the query request; The to-be-cleaned traffic of the i-th round is cleaned based on the target threat state corresponding to the target threat traffic.

3. The method according to claim 2, characterized in that After receiving the target threat status corresponding to the target threat flow returned by the cloud database in response to the query request, the method includes: The target threat flow is used as a reference cleaning flow, and a target threat state corresponding to the target threat flow is stored in a cache of the security device as a reference threat state of the reference cleaning flow.

4. The method according to claim 2, characterized in that: The cache of the security device includes a first version number of the cloud database, and the method further includes: Obtaining the current version number of the cloud database; If the current version number does not successfully match the first version number, obtaining the target threat traffic of the first i rounds of the cloud database and the threat status corresponding to the target threat traffic, wherein the target threat traffic of the first i rounds is the target threat traffic queried by the cloud database in response to the query request corresponding to the to-be-cleaned traffic from the first round to the i-th round; The cache of the security device is updated based on the target threat traffic of the previous i rounds and the threat status corresponding to the target threat traffic.

5. The method according to claim 4, characterized in that The obtaining the current version number of the cloud database includes: receiving a current version number of the cloud database returned by the cloud database in response to the query request; After obtaining the target threat flow of the previous i rounds of the cloud database and the threat status corresponding to the target threat flow, the method further includes: The first version number in the cache is updated to the current version number of the cloud database.

6. The method according to claim 1, characterized in that The method further comprises: Determining the effective duration of each reference cleaning flow based on the reference threat status of each reference cleaning flow in the cache of the security device; If the storage time of a reference cleaning flow in the cache is not less than the effective time corresponding to the reference cleaning flow, the reference cleaning flow and the reference threat status of the reference cleaning flow are deleted from the cache.

7. The method according to claim 1, characterized in that The method further comprises: Generate a cleaning log corresponding to the flow to be cleaned, wherein the cleaning log includes the flow to be cleaned and a cleaning result corresponding to the flow to be cleaned; The cleaning log is sent to the client.

8. The method according to claim 1, characterized in that The method further comprises: If the matching result of the traffic to be cleaned in the i-th round indicates that the traffic to be cleaned matches the preset cleaning rule, the traffic to be cleaned in the i-th round is cleaned based on the preset cleaning rule.

9. A flow cleaning device, characterized in that: Applications in safety equipment, including: The first acquisition module is used to obtain the flow to be cleaned in the i-th round, where i is an integer greater than 0; A matching module, used for matching the flow to be cleaned in the i-th round based on a preset cleaning rule to obtain a matching result of the flow to be cleaned in the i-th round; A query module, for querying the reference cleaning traffic in the cache of the security device based on the i-th round of traffic to be cleaned, if the matching result of the i-th round of traffic to be cleaned indicates that the traffic to be cleaned does not match the preset cleaning rule, to obtain a query result, wherein the query result is used to indicate whether there is a reference cleaning traffic matching the i-th round of traffic to be cleaned in the cache of the security device, the reference cleaning traffic in the cache of the security device includes the traffic to be cleaned that has not matched the preset cleaning rule in the security device before the i-th round, and the cache of the security device also stores a reference threat status of the reference cleaning traffic; A second acquisition module, configured to acquire a reference threat status of the target reference cleaning flow from the cache of the security device if the query result indicates that there is a target reference cleaning flow matching the flow to be cleaned in the i-th round in the cache; A cleaning module is used to clean the to-be-cleaned traffic of the i-th round based on the reference threat status of the target reference cleaning traffic.

10. An electronic device, characterized in that: include: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores program codes, and the program codes can be called by a processor to execute the method according to any one of claims 1 to 8.

Images