Rule matching method and device, electronic equipment and storage medium

Abstract

The invention relates to the field of network security, and discloses a rule matching method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring detection data and a preset fast mode set; screening a fast mode with hit data from the fast mode set as a target fast mode; the hit data is a first type of characters which are the same as the rapid mode and are contained in the detection data; performing rule matching on a first type of rules corresponding to the target rapid mode according to the target detection object to obtain a rule matching result; the target detection object is a detection object to which the hit data belongs in the detection data; the matching result comprises a plurality of first-class rules matched with the target detection object. Therefore, the screened rules and the detection data can have the same first type of characters in the same detection object, so that the first type of rules matched with the target detection object are more easily hit by traffic, and the matched invalid rules can be reduced.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a rule matching method and device, electronic equipment, and storage medium. Background Art

[0002] Currently, combined with Figure 1 As shown, an HTTP (Hypertext Transfer Protocol) transaction is usually divided into five detection phases: request header phase, request body phase, response header phase, response body phase, and log phase. Some rules are pre-set so that each rule belongs to one of the phases, and the rules of the same phase can constitute a rule set.

[0003] In the prior art, the rules pre-set in the same rule set are usually matched serially. If the rule is matched, the action is executed; if the rule is not matched, the next rule is matched. However, in normal business scenarios, the proportion of attack traffic in the overall traffic is small. When matching the rules serially in the above manner, there will be a large number of rules that are not matched. Among them, not being matched can be understood as not detecting the content that the rule needs to detect in the traffic when matching the rule, that is, there are a large number of rules that are invalid for the traffic.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0006] The embodiments of the present application provide a rule matching method and device, an electronic device, and a storage medium to reduce unnecessary rule matching in the process of rule matching on traffic, thereby improving the traffic processing performance of the device.

[0007] An embodiment of the present application provides a rule matching method, including: obtaining detection data and a preset quick pattern set; the detection data includes all detection objects of the HTTP transaction in the current detection stage; the quick pattern set includes multiple quick patterns corresponding to the current detection stage and having the same conversion function; the quick pattern corresponds to multiple first-class rules, and the matching characteristics of each of the first-class rules include the first-class characters of the quick pattern; the quick pattern with hit data is filtered out from the quick pattern set as the target quick pattern; the hit data is the first-class characters of the detection data that are the same as the quick pattern; rule matching is performed on the first-class rules corresponding to the target quick pattern according to the target detection object to obtain a rule matching result; the target detection object is the detection object to which the hit data belongs in the detection data; the matching result includes multiple first-class rules that match the target detection object.

[0008] In the above implementation, a part of the quick pattern is first matched through the first-class characters, and then the first-class rules matching the target detection object are matched from the first-class rules corresponding to the selected quick pattern. In this way, the screened rules and the detection data can have the same first-class characters in the same detection object, so that the first-class rules matching the target detection object are more likely to be hit by traffic, thereby reducing unnecessary rule matching, thereby improving the traffic processing performance of the device.

[0009] Furthermore, the quick pattern with hit data is selected from the quick pattern set as a target quick pattern, including: matching the detection data and the quick pattern set using a preset matching algorithm, and selecting the quick pattern with the same first-category character as the detection data as the target quick pattern.

[0010] In the above implementation, the matching algorithm can support simultaneous matching of multiple fast patterns, so as to achieve parallel matching of fast patterns in a fast pattern set, thereby improving the efficiency of rule matching.

[0011] Furthermore, the target detection object is obtained in the following manner: obtaining a first position range of each detection object in the detection data and a second position range of the hit data in the detection data; and determining the detection object corresponding to the first position range including the second position range as the target detection object.

[0012] In the above-mentioned embodiment, the detection data is pre-set according to each detection object, so that the first position range of each detection object in the detection data can be directly known. When the hit data is known, it is also easy to know the second position range of the hit data in the detection data. If the second position range is included in the first position range, the hit data belongs to a part of the characters constituting the detection object. Thus, the detection object where the hit data is located can be accurately determined, which is convenient for subsequent accurate matching rules.

[0013] Furthermore, rule matching is performed on the first-category rules corresponding to the target quick mode according to the target detection object to obtain a rule matching result, including: executing the following steps for each first-category rule corresponding to the target quick mode: determining the target position range in which the detection object of the first-category rule is located from multiple first position ranges; and when the second position range is included in the target position range, determining that the first-category rule is the first-category rule that matches the target detection object.

[0014] In the above implementation, it is considered that if only the quick mode with the same first-category characters as the detection data is screened. At this time, although the first-category rule corresponding to the quick mode will have the same first-category characters as the detection data, there may be a situation where the detection object to which the first-category characters in the detection data belong is inconsistent with the detection object to which the first-category characters in the first-category rule belong, so that the first-category rule cannot actually be hit by the traffic. By determining the position of the detection object of the first-category rule corresponding to the target quick mode in the detection data, and the position of the hit data in the detection data, it is possible to simply and conveniently determine whether the detection data and the first-category characters in the first-category rule belong to the same detection object.

[0015] Furthermore, after obtaining the rule matching result, the rule matching method also includes: obtaining matching features in a first type of rule that matches the target detection object; and executing the first type of rule when the characters constituting the detection data contain the matching features.

[0016] In the above implementation, it is considered that the matching features of the first category of rules are actually much more complicated than the first category of characters in the quick mode, that is, the matching features in the rules may be much more complicated than the hit data. Therefore, even if the first category of rules has the same hit data as the detection data, the first category of rules may not have the same matching features as the detection data. At this time, the first category of rules will still not be hit by traffic. By further determining whether the characters in the detection data contain matching features, the filtered first category of rules can be hit. At this time, only the first category of rules that can be hit by traffic are executed, which can save CPU (processor) resources.

[0017] Furthermore, the rule matching method also includes: obtaining the first component character of the target detection object in the detection data; the first component character represents the characters in the detection data that constitute the target detection object; comparing the matching feature with the first component character; if the first component character contains the matching feature, determining that the characters of the detection data contain the matching feature; otherwise, determining that the characters of the detection data do not contain the matching feature.

[0018] In the above implementation, by comparing characters, it is possible to simply and conveniently determine whether the detection data has the same matching features as the first type of rule.

[0019] Furthermore, the target detection object of the detection data includes: multiple sub-target detection objects; obtaining the first component character of the target detection object of the detection data, including: obtaining the third position range of each sub-target detection object in the detection data and the second position range of the hit data in the detection data; when the second position range is within the third position range, obtaining the second component character of the sub-target detection object corresponding to the third position range as the first component character; the second component character represents the character constituting the sub-target detection object.

[0020] In the above implementation, it is considered that the same target detection object in the first type of rule may have multiple sub-target detection objects, for example: the target detection object is "request parameter", which corresponds to multiple sub-target detection objects "test", "dGVzdA==", "shell.php", etc. The position range of each sub-target detection object is easy to obtain. According to the second position range of the hit data and the third position range of each sub-target detection object, the sub-target detection object where the hit data is located can be known, thereby only searching for matching features in the sub-target detection object can shorten the rule matching time and save CPU resources.

[0021] An embodiment of the present application provides a rule matching device, including: an acquisition module, used to acquire detection data and a preset quick pattern set; the detection data includes all detection objects of the HTTP transaction in the current detection stage; the quick pattern set includes multiple quick patterns corresponding to the current detection stage and having the same conversion function; the quick pattern corresponds to multiple first-class rules, and the matching characteristics of each of the first-class rules include the first-class characters of the quick pattern; a screening module, used to screen out the quick pattern with hit data from the quick pattern set as the target quick pattern; the hit data is the first-class characters of the detection data that are the same as the fast pattern; a matching module, used to perform rule matching on the first-class rules corresponding to the target quick pattern according to the target detection object to obtain a rule matching result; the target detection object is the detection object to which the hit data belongs in the detection data; the matching result includes multiple first-class rules that match the target detection object.

[0022] An embodiment of the present application provides a detection device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned rule matching method.

[0023] In some embodiments, the storage medium stores computer executable instructions, and when the computer executable instructions are called and executed by the processor, the computer executable instructions enable the processor to implement the above rule matching method.

[0024] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] One or more embodiments are exemplarily described by corresponding drawings, and these exemplary descriptions and drawings do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are considered similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0026] Figure 1 is a schematic diagram of a rule matching method provided in an embodiment of the present application;

[0027] Figure 2 is a schematic diagram of the first rule matching method provided in an embodiment of the present application;

[0028] Figure 3 is a schematic diagram of generating detection data provided by an embodiment of the present application;

[0029] Figure 4 It is a schematic diagram of a regular configuration format provided by an embodiment of the present application;

[0030] Figure 5 is a schematic diagram of a rule matching method provided in an embodiment of the present application;

[0031] Figure 6 It is a schematic diagram of a rule matching process provided by an embodiment of the present application;

[0032] Figure 7 It is a schematic diagram of a rule matching process provided by an embodiment of the present application;

[0033] Figure 8 is a schematic diagram of a rule matching method provided in an embodiment of the present application;

[0034] Fig. 9 It is a schematic diagram of a rule matching process provided by an embodiment of the present application;

[0035] Fig.10 It is a schematic diagram of a rule matching process provided by an embodiment of the present application;

[0036] Fig.11 It is a schematic diagram of a rule matching process provided by an embodiment of the present application;

[0037] Fig.12 It is a schematic diagram of a rule matching process provided by an embodiment of the present application;

[0038] Fig.13 is a schematic diagram of a rule matching device provided in an embodiment of the present application;

[0039] Fig.14 It is a schematic diagram of a detection device provided in an embodiment of the present application.

[0040] Reference numerals:

[0041] 1: Acquisition module; 2: Screening module; 3: Matching module; 4: Processor; 5: Memory; 6: Communication interface; 7: Bus. DETAILED DESCRIPTION

[0042] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0043] The terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0044] Unless otherwise stated, the term "plurality" means two or more.

[0045] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0046] Embodiment 1

[0047] According to an embodiment of the present invention, an embodiment of a method for processing network data is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0048] In an embodiment of the present application, a rule matching method is provided. The method can be executed by a network device, which can be, for example, a network traffic boundary security device, a network data forwarding device, a network traffic analysis device, or a network traffic management device, such as a firewall.

[0049] See also Figure 2 As shown, Figure 2 A schematic diagram of a flow chart of a rule matching method provided in an embodiment of the present application includes:

[0050] Step S101, acquiring detection data and a preset fast mode set.

[0051] The detection data includes all detection objects of the HTTP transaction in the current detection phase.

[0052] Exemplarily, the detection objects of HTTP transactions at different detection stages may be pre-set. Elements in the traffic data may be extracted according to the detection objects at different detection stages to form detection data at each detection stage. The detection stages of HTTP transactions may include: request header stage, request body stage, response header stage, response body stage, and log stage. The data detected at each detection stage is different. For example, the data detected at the request header stage is the traffic data sent by the client, and the network data detected at the response header stage is the traffic data returned by the server.

[0053] The network device can determine the current detection stage for detecting the received traffic data from multiple detection stages of the HTTP transaction corresponding to the traffic data. For example, the current detection stage is the request header stage, the request body stage, the response header stage, and so on.

[0054] The detection object of each detection stage is the concatenation of the specified rule detection objects. For example, the detection data of the request header stage is the concatenation of the request line, request header, and request parameters of the request data. The detection data of the request body stage is the concatenation of the request line, request header, request parameters, and request body of the request data. The detection data of the response header stage is the concatenation of the request line, request header, request parameters, request body, status line, and response header of the request data. The detection data of the response body stage is the concatenation of the request line, request header, request parameters, request body, status line, response header, and response body of the request data. The detection data of the log stage is the concatenation of the request line, request header, request parameters, request body, status line, response header, and response body of the request data.

[0055] The traffic data may be HTTP network data. For example, the HTTP network data may be HTTP request data or HTTP response data. The HTTP request includes elements such as a request line, a request header, request parameters, and a request body. The HTTP response includes elements such as a status line, a response header, and a response body.

[0056] Exemplary, combined Figure 3 As shown, the detection data of the request header stage can be obtained by splicing the request line, request header and request parameters. After splicing, the first position range corresponding to the request line, request header and request parameters in the spliced ​​detection data can be obtained. Among them, the first position range can refer to the character sequence number of the first character of the detection object in the detection data to the character sequence number of the last character. Figure 3 In the example, the position range of the request line is 0-29. The position range of the request header is 31-119. In this way, since the detection data is pre-joined by the detection objects, the first position range corresponding to each detection object in the detection data can be directly known.

[0057] The fast mode set includes a plurality of fast modes corresponding to the current detection stage and having the same conversion function.

[0058] Among them, the fast mode is a rule with first-class characters, a detection stage and a conversion function. The first-class characters of any fast mode are included in the matching features of the first-class rule corresponding to the fast mode. The fast mode with the first-class characters, the detection stage and the conversion function can be formed by extracting the first-class characters, the detection stage and the conversion function of the first-class rule. Since different first-class rules may extract the same fast mode when containing the same first-class characters, one fast mode corresponds to multiple first-class rules, and the matching features of each of the first-class rules contain the first-class characters of the fast mode.

[0059] Optionally, the first-category characters are substrings whose matching feature appears less frequently than a preset frequency in non-attack traffic, or the first-category characters are substrings whose matching feature appears not less frequently than a preset frequency in attack traffic. It is understandable that the first-category characters are strings that are not common in non-attack traffic (i.e., normal traffic), and the first-category characters can be set by engineers based on experience, such as shell, digg_frame, etc. Strings that do not belong to the first-category characters are second-category characters.

[0060] Exemplary, combined Figure 4 As shown, the configuration format of the rule may include: SecRule (named representation), VARIABLES (detection object), OPERATOR (operator), ACTION (action). Among them, the detection object, for example: URI (request URI), REQUEST_HEADERS (request header), REQUEST_BODY (request body), etc. Operators, for example: regular matching "@rxpattern", fuzzy matching "@pm string", numerical comparison "@eqvalue", etc. Actions may include: blocking actions, non-blocking actions, flow actions, metadata actions, data actions, etc. Specifically, blocking actions, for example: deny, pass, etc. Non-blocking actions, for example: capture, log, etc. Flow actions, for example: skip, skipAfter, etc. Metadata actions, for example: id, msg, etc. Data actions, for example: status, etc.

[0061] Follow the rules set in the above configuration format, for example:

[0062] SecRuleARGS"@rx attack""phase:1,log,deny,id:1",

[0063] SecRule URI "@pm attack""phase:2,log,pass,id:2",

[0064] SecRule REQUEST_BODY"@rx attack""phase:3,log,deny,id:3,capture"

[0065] In the above rule examples, phase represents the detection phase. For example, phase:1 can represent the request header phase, phase:2 can represent the request body phase, and phase:3 can represent the response header phase.

[0066] In some embodiments, the rules may be divided into two categories: first-category rules (or fast rules) and second-category rules (or slow rules). If a rule is not a fast rule, it is a slow rule.

[0067] If there are multiple rules with the same detection stage and the same conversion function, and there are two or more fast modes that can be extracted from the multiple rules, then the multiple rules are all first-category rules.

[0068] Exemplarily, assume that the quick modes are extracted for three rules respectively, for example: Rule A: SecRule REQUEST_URI "@rx shell.php" "id:1, t:none, phase:1", from which the quick mode a can be extracted: SecAcPattern "shell.php" "t:none, phase:1, rule_id:1". Rule B: SecRule REQUEST_BODY "@rx powershell.exe" "id:2, t:none, phase:1", from which the quick mode b can be extracted: SecAcPattern "powershell.exe" "t:none, phase:1, rule_id:2". Rule C: SecRule ARGS "@rx / usr / bin / (python|ftp|ls)" "id:3, t:none, phase:2", from rule C we can extract the fast pattern c: SecAcPattern " / usr / bin" "t:none, phase:2, rule_id:3".

[0069] Among them, fast mode a and fast mode b have the same detection phase and conversion function, and can form a fast mode set. When performing detection, detection data is generated in the detection phase, and after executing the t:none conversion function, fast mode a and fast mode b can be matched in parallel. Therefore, rule A and rule B are fast rules. Since the detection phase of fast mode c is different from that of fast mode a and fast mode b, fast mode c can only form a set alone, but since this set of fast mode c has only one fast mode, there is no need for parallel matching. Therefore, even if rule C can extract the fast mode, it cannot be used as a fast rule, but can only be a slow rule.

[0070] The fast patterns extracted from the rules and located in the same detection stage and having the same conversion function are put into a set, which is the fast pattern set.

[0071] Step S102: Filter out a fast pattern with hit data from the fast pattern set as a target fast pattern.

[0072] The hit data is the first type of characters whose detection data is the same as the quick mode.

[0073] In some embodiments, step S102 may include: matching the detection data and the fast pattern set using a preset matching algorithm, and selecting a fast pattern having the same first-category characters as the detection data as a target fast pattern.

[0074] Optionally, the preset matching algorithm can be a hyperscan (a regular expression matching library) algorithm. In this way, the hyperscan algorithm utilizes a specific CPU instruction set and has better performance than the AC (a multi-mode matching algorithm) algorithm. At the same time, the AC algorithm only supports strings, while the hyperscan algorithm can support some regular expressions. This application uses the hyperscan algorithm to have better flexibility. And after the hyperscan algorithm matches a hit, in addition to returning the current fast mode of the hit, it also returns the position of the hit data in the detection data, which can quickly obtain the second position range of the hit data in the detection data.

[0075] Exemplarily, a corresponding hyperscan matching database is generated for the fast pattern set. The hyperscan matching database stores compiled regular expressions. The fast pattern and detection data in the fast pattern set are extracted using regular expressions. In the case where there is a regular expression that hits both the fast pattern and the detection data, the hit data is extracted for comparison to determine whether the detection data and the fast pattern have the same first-class characters.

[0076] In some embodiments, the second position range of the hit data in the detection data can be obtained by: obtaining a third component character, comparing the hit data with the third component character, and determining the position range of the character identical to the hit data as the second position range of the hit data in the detection data. The third component character represents a character string constituting the detection data.

[0077] Step S103, performing rule matching on the first type of rules corresponding to the target fast mode according to the target detection object to obtain a rule matching result.

[0078] The matching result includes a plurality of first-category rules that match the target detection object.

[0079] The target detection object is the detection object to which the hit data belongs in the detection data.

[0080] Optionally, the target detection object is acquired in the following manner: acquiring a first position range of each detection object in the detection data and a second position range of hit data in the detection data; and determining the detection object corresponding to the first position range including the second position range as the target detection object.

[0081] In some embodiments, the detection object of the first category rule corresponding to each target quick mode can be obtained. If the detection object of the first category rule is the same as the target detection object, the first category rule is determined to be the first category rule that matches the target detection object.

[0082] In some embodiments, step S103 may include: performing the following steps for each first-class rule corresponding to the target quick mode: determining the target position range where the detection object of the first-class rule is located from multiple first position ranges; when the second position range is included in the target position range, determining that the first-class rule is a first-class rule that matches the target detection object.

[0083] In other embodiments, step S103 may include: performing the following steps for each first-class rule corresponding to the target quick mode: determining the target position range of the detection object of the first-class rule from multiple first position ranges; and when the first position range of the target detection object is consistent with the target position range, determining that the first-class rule is the first-class rule that matches the target detection object.

[0084] Optionally, each time a first-category rule matching a target detection object is determined, the first-category rule may be added to a preset set of rules to be matched, so that the set of rules to be matched may be directly used for subsequent rule matching.

[0085] Combination Figure 5 As shown, the embodiment of the present application provides another rule matching method, including:

[0086] Step S501, obtaining the detection object of the flow data in the current detection phase.

[0087] Step S502, generating detection data according to the detection object of the current detection stage.

[0088] Step S503, using the hyperscan algorithm to match the detection data and the fast pattern set, and screening out the fast pattern having the same first-category characters as the detection data as the target fast pattern.

[0089] Step S504, obtain the first position range of each detection object in the detection data and the second position range of the hit data in the detection data; perform the following steps for each first-class rule corresponding to the target quick mode: determine the target position range of the detection object of the first-class rule from multiple first position ranges; when the second position range is included in the target position range, determine that the first-class rule is the first-class rule that matches the target detection object; add the first-class rule that matches the target detection object to the preset set of rules to be matched, and record the second position range of the hit data to the hit data position set of the first-class rule.

[0090] Combination Figure 6As shown, exemplarily, assuming that the detection data is GET / ? id = 1 & user admin HTTP / 1.1 ^ Host ^ 10.10.10.10 ^ User-Agent ^ curl / 7.68.0 ^ Referer ^ http: / / 10.10.10.10 / shell.php ^ Accept: * / * ^ id ^ 1 ^ user ^ admin, assuming that there is a fast mode SecAc Pattern "shell" "ac_trie: phase1_1, t: none, t: urldecodeuni, rule_id: 1. The fast mode and the detection data have the same first-class character "shell", then the fast mode is the target fast mode, and the second position range (hit position) of the shell in the detection data can be obtained as 98-107. At this time, the fast rule corresponding to the target fast mode is obtained, for example: SecRuleREQUEST_LINE "@rx shell.php" "phase: 1, t: none, t: urldecodeuni, log, deny, id: 1. This quick rule is used to detect the request line, that is, the detection object (detection variable) of the quick rule is the request line, and the target position range of the request line in the detection data is 0-29. If the second position range is not within the target position range, then the quick rule does not have the target detection object where the hit data is located, and it is not a quick rule matching the target detection object, and there is no need to put the quick rule into the set of rules to be matched to continue matching.

[0091] Combination Figure 7As shown, for example, the detection data of the request header stage is generated for the request data, and the detection data is, for example: GET / ? a=shell.php HTTP / l.1\r\nHost:10.10.10.10\r\nUser-Agent:curl / 7.68.0\r\nAccept:* / *. Assume that the detection data matches the fast mode as SecAcPattern "shell" "ac_trie:phasel_1, t:none, t:urldecodeuni, rule_id:l, rule_id:2". Among them, the hit data is shell. Assume that there are two fast rules in the fast mode, for example: rule E and rule F. Rule E is SecRule REQUEST_URI! "@rxshell.php" "phase:l, t:none, t:urldecodeuni, log, deny, id:1". Rule F is "SecRuleREQUEST_LINE"@rx shell""phase:l,t:none,t:urldecodeuni,log,deny,id:2'". The target detection object where the hit data is located is the request line. The hit data is not in the detection object "request URI" of rule E. Rule E is not a quick rule matched by the target detection object. There is no need to put Rule E into the set of rules to be matched for further matching. The hit data is in the detection object "request line" of rule F. Rule F is a quick rule matched by the target detection object. Rule F is put into the set of rules to be matched for further matching, and the second position range of the hit data is recorded to the hit data position set of rule F.

[0092] In this way, only when the detection object where the hit data in the detection data is located is consistent with the detection object where the hit data in the quick rule is located, the quick rule is added to the set of rules to be matched, which can effectively reduce the number of quick rules to be executed later. When executing the rules, only a small number of matching rules to be detected need to be run to save CPU resources.

[0093] In some embodiments, after obtaining the rule matching result, the rule matching method further includes: obtaining matching features in the first category of rules that match the target detection object; and executing the first category of rules when the characters constituting the detection data contain matching features.

[0094] In the above embodiment, whether the characters in the detection data contain matching features can be determined in the following manner: obtaining the first component character of the target detection object of the detection data; the first component character represents the characters constituting the target detection object in the detection data; comparing the matching features with the first component character; if the first component character contains the matching features, determining that the characters in the detection data contain the matching features; otherwise, determining that the characters in the detection data do not contain the matching features.

[0095] Among them, the target detection object of the detection data includes: multiple sub-target detection objects. Obtaining the first component characters of the target detection object of the detection data includes: obtaining the third position range of each sub-target detection object in the detection data and the second position range of the hit data in the detection data; when the second position range is within the third position range, obtaining the second component characters of the sub-target detection object corresponding to the third position range as the first component characters; the second component characters represent the characters constituting the sub-target detection object. In this way, by determining the sub-target detection object where the hit data is located, the operation of screening matching features can be limited to a smaller range, making the operation of determining whether the matching features exist faster, thereby improving the efficiency of rule matching to speed up the speed of traffic protection.

[0096] Combination Figure 8 As shown, the embodiment of the present application provides another rule matching method. For each first-category rule in the set of rules to be matched, the method includes:

[0097] Step S801, obtaining matching features in the first type of rules, and then executing step S802.

[0098] Step S802, obtaining an object set of detection objects constituting the detection data, and then executing step S803.

[0099] Step S803, select a detection object from the object set according to a preset order, obtain the first component character of the detection object, and then execute step S804.

[0100] Step S804, determining whether the first component character contains a matching feature; if the first component character does not contain a matching feature, executing step S805; if the first component character contains a matching feature, executing step S806.

[0101] Step S805, determining whether there is an undetected detection object in the object set, if yes, executing step S803; if not, executing step S807.

[0102] Step S806, determine that the match is successful, and execute the first type of rules.

[0103] Step S807, end the matching.

[0104] Combination Fig. 9 and Fig.10 As shown, exemplarily, the request header phase rule parallel matching starts, assuming that the detection data of the request header phase generated for the request data is GET / ? a=shell.php HTTP / 1.1\r\nHost:10.10.10.10\r\nUser-Agent:curl / 7.68.0\r\nAccept:* / *. Assume that the fast pattern successfully matched to the detection data is SecAcPattern "shell" "ac_trie:phase1_1, t:none, t:urldecodeuni, rule_id:1". Its hit data is shell. The fast rule obtained in the fast pattern is SecRule REQUEST_URI|REQUEST_HEADERS|ARGS "@rx shell" "phase:1, t:none, t:urldecodeuni, log, deny, id:2". The detection objects of the fast rule are REQUEST_URI, REQUEST_HEADERS and ARGS. First, determine whether the hit data shell is in REQUEST_URI. The hit data is not in the detection object. Then determine whether the hit data shell is in REQUEST_HEADERS. The hit data is not in the detection object. Finally, determine whether the hit data shell is in ARGS. The hit data is in the detection object. Add the quick rule to the preset set of rules to be matched. At this time, the parallel matching of the request header stage rules ends. The serial matching of the request header stage rules begins. Assume that there is only one quick rule in the set of rules to be matched, for example: SecRule REQUEST_URI|REQUEST_HEADERS|ARGS "@rx shell" "phase:1, t:none, t:urldecodeuni, log, deny, id:2", and obtain the first component character of each detection object. For example, the first component character of REQUEST_URI is / . The first component characters of REQUEST_HEADERS are Host:10.10.10.10\r\n, User-Agent:curl / 7.68.0\r\n, and Accept:* / *. The first component of ARGS is shell.php. First, determine whether the hit data is in the first component of REQUEST_URI. The hit data is not. Then determine whether the hit data is in the first component of REQUEST_HEADERS. The hit data is not. Finally, determine whether the hit data is in the first component of ARGS. The hit data is. Then, execute the quick rule, and the serial matching of the request header stage rules ends.

[0105] Combination Fig.11 and Fig.12 As shown, again exemplarily, the request header stage rules are matched in parallel, assuming that the detection data of the request header stage generated for the request data is GET / ? user=test&token=dGVzdA==&id=shell.phpHTTP / 1.1\r\nHost:10.10.10.10\r\nUser-Agent:curl / 7.68.0\r\nAccept:* / *. Assume that the fast pattern set successfully matched to the detection data is SecAcPattern"shell""ac_trie:phase1_1,t:none,t:urldecodeuni,rule_id:1". Its hit data is shell. The fast rule obtained in the fast pattern set is SecRuleARGS"@rx shell""phase:1,t:none,t:urldecodeuni,log,deny,id:2". The detection object of this fast rule is ARGS. The hit data is in the detection object, and the quick rule is added to the preset set of rules to be matched. At this time, the parallel matching of the request header stage rules ends. The serial matching of the request header stage rules begins. Assuming that there is only one quick rule in the set of rules to be matched, obtain the quick rule in the set of rules to be matched, for example: SecRule ARGS "@rx shell" "phase:1, t:none, t:urldecodeuni, log, deny, id:2". Get the matching feature of the quick rule, and the matching feature is shell. The first component characters of the detection object "ARGS" obtained in the detection data are test, dGVzdA== and shell.php. First determine whether the matching feature is in the first component character test, and the matching feature is not. Then determine whether the matching feature is in the first component character dGVzdA==, and the matching feature is not. Finally, determine whether the matching feature is in the first component character shell.php of ARGS, and the matching feature is. Then, execute the quick rule, and the serial matching of the request header stage rules ends.

[0106] In some embodiments, before acquiring the detection data and the preset fast mode set, the method further includes: acquiring slow rules and performing serial matching on the slow rules.

[0107] It can be understood that the rule matching method provided in the embodiment of the present application records the hit position of each quick pattern in the detection data when matching the rules in parallel, and compares the hit position with the detection variable of the first type of rule corresponding to the quick pattern. Only when the hit position is in the detection variable of the rule will the first type of rule continue to be matched.

[0108] It can be understood that the rule matching method provided in the embodiment of the present application, when matching the detection variable set of a single rule, compares the hit position of the previous quick mode with the detection variable of the rule, and only when the hit position is in the detection variable will the detection data continue to be matched.

[0109] It can be understood that the rule matching method provided in the embodiment of the present application, when matching the detection data set of a single detection variable of a single rule, compares the hit position with the detection data, and only continues to match the detection data if the hit position is in the detection data.

[0110] The rule matching method provided in the embodiment of the present application can reduce the CPU resource consumption of the device for security detection in a real business scenario, thereby being able to process more business traffic and improving the traffic processing performance of the device.

[0111] Embodiment 2

[0112] Based on the same inventive concept, the present application embodiment provides a rule matching device, such as Fig.13 As shown, the rule matching device includes: an acquisition module 1, a screening module 2 and a matching module 3. The acquisition module 1 is used to acquire detection data and a preset fast pattern set; the detection data includes all detection objects of the HTTP transaction in the current detection stage; the fast pattern set includes multiple fast patterns corresponding to the current detection stage and having the same conversion function; the fast pattern corresponds to multiple first-class rules, and the matching characteristics of each first-class rule include the first-class characters of the fast pattern; the screening module 2 is used to screen out the fast pattern with hit data from the fast pattern set as the target fast pattern; the hit data is the first-class characters of the detection data that are the same as the fast pattern; the matching module 3 is used to perform rule matching on the first-class rules corresponding to the target fast pattern according to the target detection object to obtain a rule matching result; the target detection object is the detection object to which the hit data belongs in the detection data; the matching result includes multiple first-class rules that match the target detection object.

[0113] In some embodiments, the screening module 2 is used to screen out a quick pattern with hit data from the quick pattern set as a target quick pattern in the following manner: using a preset matching algorithm to match the detection data and the quick pattern set, and screening out a quick pattern with the same first-category characters as the detection data as the target quick pattern.

[0114] In some embodiments, the matching module 3 is used to obtain the target detection object in the following manner: obtain the first position range of each detection object in the detection data and the second position range of the hit data in the detection data; and determine the detection object corresponding to the first position range including the second position range as the target detection object.

[0115] In some embodiments, the matching module 3 is used to perform rule matching on the first type of rules corresponding to the target quick mode according to the target detection object to obtain the rule matching result by performing the following steps for each first type of rule corresponding to the target quick mode: determining the target position range where the detection object of the first type of rule is located from multiple first position ranges; when the second position range is included in the target position range, determining that the first type of rule is the first type of rule that matches the target detection object.

[0116] In some embodiments, the rule matching device also includes: an execution module, which is used to obtain matching features in the first category of rules that match the target detection object after obtaining the rule matching results; and execute the first category of rules when the characters constituting the detection data contain matching features.

[0117] In some embodiments, the execution module is also used to obtain the first component character of the target detection object in the detection data; the first component character represents the characters that constitute the target detection object in the detection data; compare the matching feature with the first component character; if the first component character contains the matching feature, determine that the character of the detection data contains the matching feature; otherwise, determine that the character of the detection data does not contain the matching feature.

[0118] In some embodiments, the target detection object in the detection data includes: multiple sub-target detection objects; the execution module is also used to obtain the first component characters of the target detection object in the detection data by: obtaining the third position range of each sub-target detection object in the detection data and the second position range of the hit data in the detection data; when the second position range is within the third position range, obtaining the second component characters of the sub-target detection object corresponding to the third position range as the first component characters; the second component characters represent the characters that constitute the sub-target detection objects.

[0119] Combination Fig.14 As shown, an embodiment of the present application provides a detection device, including a processor 4 and a memory 5. Optionally, the device may also include a communication interface 6 and a bus 7. Among them, the processor 4, the communication interface 6, and the memory 5 can communicate with each other through the bus 7. The communication interface 6 can be used for information transmission. The processor 4 can call the logic instructions in the memory 5 to execute the rule matching method of the above embodiment.

[0120] In addition, the logic instructions in the above-mentioned memory 5 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0121] The memory 5 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 4 executes the function application and data processing by running the program instructions / modules stored in the memory 5, that is, the rule matching method in the above embodiment is implemented.

[0122] The memory 5 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 5 may include a high-speed random access memory and may also include a non-volatile memory.

[0123] An embodiment of the present application provides a storage medium storing computer executable instructions, wherein the computer executable instructions are configured to execute the above rule matching method.

[0124] An embodiment of the present application provides a computer program product, which includes a computer program stored on a storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned rule matching method.

[0125] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0126] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium can be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., which can store program codes, or a transient storage medium.

[0127] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0128] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. At the same time, the above embodiments can be combined with each other to form new embodiments without conflict.

Claims

1. A rule matching method, characterized in that: include: Acquire detection data and a preset fast pattern set; the detection data includes all detection objects of the HTTP transaction in the current detection phase; the fast pattern set includes multiple fast patterns corresponding to the current detection phase and having the same conversion function; the fast pattern corresponds to multiple first-class rules, and the matching feature of each of the first-class rules includes the first-class characters of the fast pattern; The fast pattern with hit data is selected from the fast pattern set as a target fast pattern; the hit data is the first type of characters in the detection data that are the same as the fast pattern; Perform rule matching on the first type of rules corresponding to the target fast mode according to the target detection object to obtain a rule matching result; The target detection object is the detection object to which the hit data belongs in the detection data; the matching result includes one or more first-category rules that match the target detection object.

2. The method according to claim 1, characterized in that Filtering the quick pattern with hit data from the quick pattern set as a target quick pattern includes: The detection data and the fast pattern set are matched using a preset matching algorithm, and the fast pattern having the same first-category characters as the detection data is screened out as a target fast pattern.

3. The method according to claim 1, characterized in that The target detection object is obtained by: Acquire a first position range of each of the detection objects in the detection data and a second position range of the hit data in the detection data; A detection object corresponding to the first position range including the second position range is determined as the target detection object.

4. The method according to claim 3, characterized in that According to the target detection object, a first type of rule corresponding to the target fast mode is matched to obtain a rule matching result, including: For each first-category rule corresponding to the target fast mode, perform the following steps: Determine a target position range where the detection object of the first type rule is located from the plurality of first position ranges; In the case where the second position range is included in the target position range, the first type of rule is determined to be a first type of rule that matches the target detection object.

5. The method according to any one of claims 1 to 4, characterized in that: After obtaining the rule matching result, the method further includes: Obtaining matching features in a first category of rules that match the target detection object; In the case where the characters constituting the detection data contain the matching features, the first type of rules are executed.

6. The method according to claim 5, characterized in that The method further comprises: Acquire a first constituent character of the target detection object in the detection data; the first constituent character represents a character constituting the target detection object in the detection data; comparing the matching feature with the first component character; In the case where the first component character includes the matching feature, it is determined that the character of the detection data includes the matching feature; otherwise, it is determined that the character of the detection data does not include the matching feature.

7. The method according to claim 6, characterized in that The target detection object in the detection data includes: a plurality of sub-target detection objects; obtaining a first component character of the target detection object in the detection data includes: Acquire a third position range of each of the sub-target detection objects in the detection data and a second position range of the hit data in the detection data; When the second position range is within the third position range, a second constituent character of the sub-target detection object corresponding to the third position range is obtained as the first constituent character; the second constituent character represents a character constituting the sub-target detection object.

8. A rule matching device, characterized in that: include: An acquisition module, used to acquire detection data and a preset fast pattern set; the detection data includes all detection objects of the HTTP transaction in the current detection phase; the fast pattern set includes multiple fast patterns corresponding to the current detection phase and having the same conversion function; the fast pattern corresponds to multiple first-class rules, and the matching feature of each of the first-class rules includes the first-class characters of the fast pattern; A screening module, used for screening out the fast pattern with hit data from the fast pattern set as a target fast pattern; the hit data is the first type of characters in the detection data that are the same as the fast pattern; A matching module, used for matching the first type of rules corresponding to the target fast mode according to the target detection object to obtain a rule matching result; The target detection object is the detection object to which the hit data belongs in the detection data; the matching result includes a plurality of first-category rules that match the target detection object.

9. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the rule matching method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores computer executable instructions, and when the computer executable instructions are called and executed by a processor, the computer executable instructions enable the processor to implement the rule matching method described in any one of claims 1 to 7.

Images