Message detection method and device and electronic equipment

Abstract

The invention provides a message detection method and device and electronic equipment. The method is applied to firewall equipment and comprises the following steps: monitoring a first equipment performance index when the firewall equipment starts an initial DPI detection engine; if the first equipment performance index is lower than a preset threshold value, determining a first traffic characteristic of network traffic data flowing through the firewall equipment; in the DPI detection engine list, determining a first DPI detection engine used for executing detection operation on the data packet with the first flow characteristic; and closing the initial DPI detection engine, and starting the first DPI detection engine. According to the method, the DPI detection engines are intelligently switched according to the traffic characteristics, and the key network traffic is preferentially processed by using the DPI detection engines in the DPI detection engine list, so that the dynamic balance between the forwarding stability of the firewall equipment and the network security detection capability is realized.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message detection method, device and electronic equipment. Background Art

[0002] Next-generation firewalls play a vital role in the field of network security. Their main functions are not only traditional packet filtering access control, but also advanced features such as Deep Packet Inspection (DPI). DPI services can comprehensively identify, control and manage data packets at the application layer, but DPI services require a lot of device resources, and enabling DPI services will seriously affect the performance of firewall devices. Especially during peak traffic periods, how to balance the performance of firewall devices and the effectiveness of packet inspection is a key issue. Summary of the invention

[0003] In order to overcome the problems existing in the related art, the present application provides a message detection method, device and electronic device.

[0004] According to a first aspect of an embodiment of the present application, a message detection method is provided, the method being applied to a firewall device, the method comprising:

[0005] Monitoring a first device performance indicator of the firewall device when an initial DPI detection engine is enabled;

[0006] If the first device performance indicator is lower than a preset threshold, determining a first flow characteristic of network flow data flowing through the firewall device;

[0007] In the DPI detection engine list, determine a first DPI detection engine for performing a detection operation on a data packet having the first traffic feature, wherein the detection capabilities of the DPI detection engines in the DPI detection engine list are different, and the detection capabilities of the DPI detection engines in the DPI detection engine list are less than the detection capabilities of the initial DPI detection engine, and the default state of the DPI detection engines in the DPI detection engine list is closed;

[0008] The initial DPI detection engine is disabled, and the first DPI detection engine is enabled.

[0009] According to a second aspect of an embodiment of the present application, a message detection device is provided, the device being applied to a firewall device, the device comprising:

[0010] A monitoring module, configured to monitor a first device performance indicator of the firewall device when an initial DPI detection engine is enabled;

[0011] a characteristic determination module, configured to determine a first flow characteristic of network flow data flowing through the firewall device if the first device performance indicator is lower than a preset threshold;

[0012] an engine determination module, configured to determine, in a DPI detection engine list, a first DPI detection engine for performing a detection operation on a data packet having the first traffic characteristic, wherein the detection capabilities of the DPI detection engines in the DPI detection engine list are different, and the detection capabilities of the DPI detection engines in the DPI detection engine list are all less than the detection capabilities of the initial DPI detection engine, and the default state of the DPI detection engines in the DPI detection engine list is closed;

[0013] A switching module is used to disable the initial DPI detection engine and enable the first DPI detection engine.

[0014] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including:

[0015] A memory and one or more processors; the memory is coupled to the processor; wherein the memory stores computer program code, the computer program code includes computer instructions, and when the computer instructions are executed by the processor, the electronic device executes the method as described above.

[0016] According to a fourth aspect of an embodiment of the present application, there is provided a computer-readable storage medium, comprising computer instructions, which, when executed on an electronic device, enables the electronic device to execute the method as described above.

[0017] According to a fifth aspect of an embodiment of the present application, a computer program product is provided. When the computer program product is run on a computer, the computer is enabled to execute the method described above.

[0018] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0019] This application pre-designs a series of DPI detection engines with detection capabilities less than the initial DPI detection engine and different detection capabilities, and records them in the DPI detection engine list. In actual network applications, the default DPI detection engine of the firewall device is the initial DPI detection engine. When the first device performance indicator of the firewall device after enabling the initial DPI detection engine is lower than the preset threshold, the DPI detection engine switching process is triggered: analyze the network traffic data flowing through the firewall device and determine the first traffic feature of the network traffic data; determine the first DPI detection engine used to perform detection operations on data packets with the first traffic feature in the DPI detection engine list; shut down the initial DPI detection engine, and enable the first DPI detection engine.

[0020] That is to say, this application intelligently switches the DPI detection engine based on traffic characteristics, classifies traffic based on traffic characteristics in the DPI service, and uses the DPI detection engine in the DPI detection engine list to prioritize critical network traffic. Other traffic is simplified or not detected, thereby achieving a dynamic balance between the forwarding stability of the firewall device and the network security detection capability. The switching process is automatically triggered and executed, with high timeliness, and avoids the problem of a significant decrease in security detection capabilities caused by a one-size-fits-all approach to DPI services. Significantly improve the network stability, security defense capabilities and accuracy of enterprises during peak traffic periods, forming a more complete, intelligent, multi-level security architecture.

[0021] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0023] Figure 1 A first flow chart of the message detection method provided in the embodiment of the present application;

[0024] Figure 2 A second flow chart of the message detection method provided in the embodiment of the present application;

[0025] Figure 3 A third flow chart of the message detection method provided in the embodiment of the present application;

[0026] Figure 4 A functional schematic diagram of a message detection device provided in an embodiment of the present application;

[0027] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, the terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to be limiting of the present application.

[0029] It should be noted that in this application, "at least one" means one or more, and "more than one" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The terms "first", "second", "third", etc. (if any) in the specification, claims and drawings of this application are used to distinguish similar objects, rather than to describe a specific order or sequence.

[0030] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0031] Ordinary message detection mainly relies on basic network layer and transport layer information. DPI provides a deeper level of network traffic analysis and control capabilities, and can perform detailed detection of all layers of data packets (including header information and actual data content), identify and handle more complex network applications and security threats. DPI is usually used in security devices (such as firewall devices) to detect and control network traffic flowing through the device to enhance network security and compliance. DPI is characterized by high accuracy, but due to its high consumption of system resources, it has high requirements for device performance.

[0032] During traffic peaks, firewall devices may be overloaded and unable to process all data packets in a timely manner, requiring administrators to manually shut down DPI services to ensure the performance and stability of firewall devices. However, this manual shutdown of DPI services relies on manual judgment of the shutdown timing, which may result in large errors. On the other hand, shutting down the packet detection function of all DPI services in a one-size-fits-all manner cannot maximize network security.

[0033] In order to provide the best security protection under different network environments and attack situations, the present application provides a message detection method, device and electronic device, which improve the detection and response capabilities of firewall equipment through intelligent switching of DPI detection engine.

[0034] Next, the embodiments of the present application are described in detail.

[0035] The present application embodiment provides a message detection method, such as Figure 1 As shown, the method is applied to a firewall device, and the method specifically comprises the following steps:

[0036] Step 110: monitor the first device performance indicator of the firewall device when the initial DPI detection engine is enabled;

[0037] Step 120: If the first device performance indicator is lower than a preset threshold, determine a first flow characteristic of the network flow data flowing through the firewall device;

[0038] Step 130: Determine, in the DPI detection engine list, a first DPI detection engine for performing a detection operation on a data packet having a first traffic characteristic;

[0039] Step 140: disable the initial DPI detection engine and enable the first DPI detection engine.

[0040] Specifically, the above-mentioned initial DIM detection engine refers to the current standard DIM detection engine. This embodiment involves multiple DIM detection engines based on the initial DIM detection engine, and they are recorded in the DIM detection engine list. Among them, the detection capabilities of each DPI detection engine in the DPI detection engine list are different, and the detection capabilities of each DPI detection engine in the DPI detection engine list are all less than the detection capabilities of the initial DPI detection engine, and the default state of each DPI detection engine in the DPI detection engine list is closed.

[0041] Exemplarily, the detection capability of the above-mentioned DPI detection engine can be the range of the detection object. During the message detection process, the detection object of the DPI detection engine is various detailed information of the network traffic, such as data packet header information, data packet content, protocol type, application layer data, service type, application behavior, etc. The detection object range of the initial DPI detection engine is the largest, and the detection object range of each DPI detection engine in the DPI detection engine list is smaller than that of the initial DPI detection engine, and the detection object range of each DPI detection engine in the DPI detection engine list is different.

[0042] In this embodiment, the firewall device enables the initial DPI detection engine by default, and monitors the device performance indicators of the firewall device, such as CPU utilization, when the initial DPI detection engine is enabled. To distinguish the description, in this embodiment, the device performance indicator when the initial DPI detection engine is enabled is referred to as the first device performance indicator, and the device performance indicator when the initial DPI detection engine is disabled is referred to as the second device performance indicator.

[0043] As a specific implementation, when the initial DPI detection engine is enabled, the first device performance indicator of the firewall device can be continuously monitored, or the first device performance indicator of the firewall device can be periodically or regularly monitored, or the first device performance indicator of the firewall device can be monitored during peak traffic periods. This embodiment does not limit this.

[0044] This embodiment sets a preset threshold for the device performance index of the firewall device. When the first performance index of the firewall device is monitored to be lower than the preset threshold, it indicates that the current DPI service occupies too many firewall device resources, affecting the stability of the firewall device. At this time, this embodiment determines and enables the first DPI detection engine in the following manner, and shuts down the initial DPI detection engine at the same time:

[0045] Determine a first traffic feature of network traffic data flowing through a firewall device; determine, in a DPI detection engine list, a first DPI detection engine for performing a detection operation on a data packet having the first traffic feature; shut down an initial DPI detection engine, and enable a first DPI detection engine.

[0046] As a specific implementation, the first traffic feature may be one or more traffic features with the largest traffic proportion in the network traffic data. Therefore, this embodiment may determine the first traffic feature of the network traffic data in the following manner: determine all traffic features of the network traffic data, and select a first preset number of traffic features with the largest traffic proportion from all traffic features as the first traffic feature.

[0047] Each DPI detection engine in the DPI detection engine list of this embodiment is used to detect data packets with different traffic characteristics, that is, there is a corresponding relationship between the DPI detection engine and the traffic characteristics. According to this corresponding relationship, a DPI detection engine used to perform a detection operation on a data packet with a first traffic characteristic, i.e., a first DPI detection engine, can be screened out from the DPI detection engine list.

[0048] It is understandable that after the initial DPI detection engine is turned off and the first DPI detection engine is enabled, the performance of the firewall device will be improved, but it is uncertain whether the performance index of the improved device exceeds the preset threshold. Figure 2 As shown, as a preferred implementation, this embodiment further adjusts the DPI detection engine through the following steps:

[0049] Step 210: After the initial DPI detection engine is turned off and the first DPI detection engine is enabled, the second device performance indicator of the firewall device within a preset time is monitored;

[0050] Step 220: If the second device performance indicator is lower than a preset threshold, determine a second flow characteristic of the network flow data;

[0051] Step 230: Determine, in the DPI detection engine list, a second DPI detection engine for performing a detection operation on a data packet having a second traffic characteristic;

[0052] Step 240: Close the second DPI detection engine.

[0053] That is, after the initial DPI detection engine is turned off and the first DPI detection engine is enabled, if the device performance index of the firewall device is still lower than the preset threshold, that is, the second device performance index of the firewall device is lower than the preset threshold, some DPI detection engines in the first DPI detection engine are turned off. Specifically, the second DPI detection engine used to perform detection operations on data packets with the second traffic characteristics is turned off.

[0054] Among them, the second traffic feature refers to the traffic features whose traffic proportion in all traffic features of the network traffic data is not less than and is closest to the second preset number of target traffic features. The target traffic feature refers to the traffic feature with the smallest traffic proportion in the first traffic feature, and the second preset number is not greater than the first preset number.

[0055] It is understandable that in actual applications, the occurrence of some traffic peaks is foreseeable. In this case, the end time of the traffic peak can be set in advance. After the end time is reached, the firewall device returns to the initial state, that is, the initial DPI detection engine is enabled, thereby ensuring that the network traffic detection efficiency is maximized.

[0056] In addition, you can also set a DPI detection cycle. After a cycle ends, the firewall device returns to the initial state and re-enables the initial DPI detection engine. At this time, the implementation steps are as follows: Figure 3 As shown:

[0057] Step 310: monitor the first device performance indicator of the firewall device when the initial DPI detection engine is enabled;

[0058] Step 320: If the first device performance indicator is lower than a preset threshold, determine a first flow characteristic of the network flow data flowing through the firewall device;

[0059] Step 330: Determine, in the DPI detection engine list, a first DPI detection engine for performing a detection operation on a data packet having a first traffic characteristic;

[0060] Step 340: disable the initial DPI detection engine and enable the first DPI detection engine.

[0061] Step 350: After the current DPI detection cycle ends, turn off the enabled DPI detection engine in the DPI detection engine list, and enable the initial DPI detection engine; enter the next DPI detection cycle, and return to step 310.

[0062] It can be understood that the enabled DPI detection engine in the DPI detection engine list closed in step 350 can be the first DPI detection engine mentioned above, or it can be the remaining DPI detection engine after the second DPI detection engine is removed from the first DPI detection engine.

[0063] Exemplarily, the DPI detection engine list of this embodiment may include any one or more of the following DPI detection engines: Cookie detection engine, HTTP detection engine, file type detection engine, domain name detection engine, SSL (Secure Sockets Layer) detection engine. The following introduces each DPI detection engine:

[0064] The traffic feature corresponding to the Cookie detection engine is that the data packet contains the Cookie field. The detection capability of the Cookie detection engine includes decoding the Cookie field in the data packet and performing detection operations on the decoding results. Specifically, the Cookie detection engine converts the encoded string in the Cookie obtained by the firewall device back to the original string form, and then reads and processes the data stored in it to better identify the attack characteristics or virus characteristics.

[0065] The traffic feature corresponding to the HTTP detection engine is that the protocol type of the data packet is the HTTP protocol. The detection capability of the HTTP detection engine includes performing detection operations on the data packets whose protocol type is the HTTP protocol.

[0066] The initial DPI detection engine will perform full transaction detection on packets whose protocol type is HTTP protocol. It is understandable that in a high-traffic scenario, detecting all transactions of the entire HTTP session will greatly reduce the throughput performance of the firewall device. In scenarios where the device throughput performance is required to be high, only the first transaction can be detected. That is, as a preferred implementation, the detection capability of the above-mentioned HTTP detection engine is specifically: performing the first transaction detection operation on packets whose protocol type is HTTP protocol.

[0067] The first transaction of HTTP traffic refers to the first "request-response" process in an HTTP session. The first transaction is the starting point for establishing communication between the client and the server. The first transaction often contains the key information necessary to open a web page or start a new HTTP session. Many network threats and intrusion behaviors, such as malware distribution, phishing attacks, or command and control communications, often occur at the beginning of an HTTP session. Therefore, first transaction detection can usually identify potential security threats efficiently.

[0068] The traffic feature corresponding to the file type detection engine is the file type target file type of the data packet. The detection capability of the file type detection engine includes performing detection operations on the data packets of the target file type.

[0069] The initial DPI detection engine will detect all file types to improve the detection success rate. However, when the number of files transmitted in the network is too large or the files are too large, this full file type detection work will consume a lot of device resources and seriously affect the device processing performance. Therefore, the file type detection engine of this embodiment only detects some file types, namely the above-mentioned target file types, to reduce the impact on the device processing performance. Exemplarily, after turning off the initial DPI detection engine and enabling the file type detection engine, the firewall device will not detect audio and video files, picture files, and CODE files.

[0070] The above file type can be specifically determined according to the Content-Type field of the data packet.

[0071] The traffic feature corresponding to the domain name detection engine is that the domain name of the data packet is the target domain name, and the detection capability of the domain name detection engine includes performing detection operations on data packets whose domain name is the target domain name, such as MD5 (Message-Digest Algorithm5) detection. The initial DPI detection engine will perform detection operations on data packets of all domain names. The domain name detection engine of this embodiment only detects some domain names, namely the above-mentioned target domain names, such as blacklist domain names, and domain names outside the whitelist.

[0072] The traffic feature corresponding to the SSL detection engine is that the data packet has not been decrypted by SSL. The detection capability of the SSL detection engine includes performing detection operations on data packets that have not been decrypted by SSL. The initial DPI detection engine will perform detection operations on all data packets. The SSL detection engine of this embodiment only performs detection operations on data packets that have not been decrypted by SSL.

[0073] Exemplarily, a TLS (Transport Layer Security) detection engine may be further included. The traffic feature corresponding to the TLS detection engine is that the data packet has not been decrypted by TLS, and the detection capability of the TLS detection engine includes performing detection operations on data packets that have not been decrypted by TLS. The initial DPI detection engine will perform detection operations on all data packets, and the TLS detection engine of this embodiment only performs detection operations on data packets that have not been decrypted by TLS.

[0074] It can be seen from the above technical solutions that this application pre-designs a series of DPI detection engines with detection capabilities less than the initial DPI detection engine and with different detection capabilities, and records them in the DPI detection engine list. In actual network applications, the default DPI detection engine of the firewall device is the initial DPI detection engine. After monitoring that the first device performance indicator of the firewall device when the initial DPI detection engine is enabled is lower than the preset threshold, the following DPI detection engine switching process is triggered: analyze the network traffic data flowing through the firewall device and determine the first traffic feature of the network traffic data; determine the first DPI detection engine used to perform detection operations on data packets with the first traffic feature in the DPI detection engine list; shut down the initial DPI detection engine and enable the first DPI detection engine.

[0075] Furthermore, the second device performance indicator of the firewall device is monitored when the initial DPI detection engine is turned off and the first DPI detection engine is enabled. If the second device performance indicator is lower than the preset threshold, the following DPI detection engine shutdown process is triggered: the network traffic data flowing through the firewall device is analyzed to determine the second traffic characteristic of the network traffic data; in the DPI detection engine list, a second DPI detection engine is determined to perform detection operations on data packets with the second traffic characteristic; and the second DPI detection engine is shut down.

[0076] In other words, this application intelligently switches the DPI detection engine based on traffic characteristics, achieving a dynamic balance between the forwarding stability of the firewall device and the network security detection capability. The switching process is automatically triggered and executed, with high timeliness, and avoids the problems caused by the one-size-fits-all approach to DPI services.

[0077] In the DPI business, this application classifies traffic based on traffic characteristics, uses the DPI detection engine in the DPI detection engine list to prioritize critical network traffic, and uses simplified detection or no detection for other traffic, significantly improving the company's network stability, security defense capabilities and accuracy during peak traffic periods, and forming a more complete, intelligent, multi-level security architecture.

[0078] Based on the same inventive concept, the present application also provides a message detection device, which is applied to a firewall device, such as Figure 4 As shown, the device comprises:

[0079] A monitoring module 410, configured to monitor a first device performance indicator of the firewall device when an initial DPI detection engine is enabled;

[0080] A feature determination module 420, configured to determine a first flow feature of network flow data flowing through the firewall device if the first device performance indicator is lower than a preset threshold;

[0081] The engine determination module 430 is used to determine, in the DPI detection engine list, a first DPI detection engine for performing a detection operation on a data packet having the first traffic characteristic, wherein the detection capabilities of the DPI detection engines in the DPI detection engine list are different, and the detection capabilities of the DPI detection engines in the DPI detection engine list are all less than the detection capabilities of the initial DPI detection engine, and the default state of the DPI detection engines in the DPI detection engine list is closed;

[0082] The switching module 440 is used to disable the initial DPI detection engine and enable the first DPI detection engine.

[0083] As a specific implementation, the feature determination module 420 specifically determines the first traffic feature of the network traffic data in the following manner:

[0084] All traffic features of the network traffic data are determined, and a first preset number of traffic features with the largest traffic proportions are selected from all the traffic features to serve as first traffic features.

[0085] As a specific implementation, the device further includes:

[0086] A second monitoring module, configured to monitor a second device performance indicator of the firewall device within a preset time after the initial DPI detection engine is turned off and the first DPI detection engine is enabled;

[0087] A second feature determination module, configured to determine a second flow feature of the network flow data if the second device performance indicator is lower than the preset threshold, wherein the second flow feature is a flow feature of a second preset number of the total flow features whose flow ratio is not less than and is closest to a target flow feature, the target flow feature is a flow feature with the smallest flow ratio in the first flow feature, and the second preset number is not greater than the first preset number;

[0088] A second engine determination module, configured to determine, in the DPI detection engine list, a second DPI detection engine for performing a detection operation on a data packet having the second traffic characteristic;

[0089] The second switching module is used to shut down the second DPI detection engine.

[0090] As a specific implementation, the device further includes:

[0091] The reset module is used to shut down the enabled DPI detection engine in the DPI detection engine list and enable the initial DPI detection engine after a DPI detection cycle ends.

[0092] As a specific implementation, the DPI detection engine list includes any one or more of the following DPI detection engines:

[0093] Cookie detection engine, wherein the traffic feature corresponding to the Cookie detection engine is that the data packet contains a Cookie field, and the detection capability of the Cookie detection engine includes performing a decoding operation on the Cookie field in the data packet and performing a detection operation on the decoding result;

[0094] HTTP detection engine, wherein the traffic feature corresponding to the HTTP detection engine is that the protocol type of the data packet is HTTP protocol, and the detection capability of the HTTP detection engine includes performing detection operations on data packets whose protocol type is HTTP protocol;

[0095] A file type detection engine, wherein the traffic feature corresponding to the file type detection engine is a target file type of a data packet, and the detection capability of the file type detection engine includes performing a detection operation on a data packet of the target file type;

[0096] A domain name detection engine, wherein the traffic feature corresponding to the domain name detection engine is that the domain name of the data packet is a target domain name, and the detection capability of the domain name detection engine includes performing a detection operation on the data packet whose domain name is the target domain name;

[0097] An SSL detection engine, wherein the traffic feature corresponding to the SSL detection engine is that the data packet has not been decrypted by SSL, and the detection capability of the SSL detection engine includes performing detection operations on the data packet that has not been decrypted by SSL.

[0098] As a specific implementation, the detection capability of the HTTP detection engine is specifically as follows:

[0099] The first transaction detection operation is performed on the data packet whose protocol type is HTTP protocol.

[0100] An embodiment of the present application provides an electronic device, which may include: a memory and one or more processors. The memory is used to store computer program code, and the computer program code includes computer instructions. When the processor executes the computer instructions, the electronic device may perform various functions or steps of the above method embodiment.

[0101] The structure of the electronic device can refer to Figure 5 The structure of the electronic device 100 is shown.

[0102] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0103] An embodiment of the present application also provides a computer-readable storage medium, which includes computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes each function or step of the above method embodiment.

[0104] The computer-readable storage medium includes but is not limited to any one of the following: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0105] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is enabled to perform each function or step of the above method embodiment.

[0106] Among them, the electronic device, computer-readable storage medium, and computer program product provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0107] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0108] In the several embodiments provided in the present application, it should be understood that the disclosed method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of modules or units, which can be electrical, mechanical or other forms.

[0109] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0110] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A message detection method, characterized in that: The method is applied to a firewall device, and the method comprises: Monitoring a first device performance indicator of the firewall device when an initial DPI detection engine is enabled; If the first device performance indicator is lower than a preset threshold, determining a first flow characteristic of network flow data flowing through the firewall device; In the DPI detection engine list, determine a first DPI detection engine for performing a detection operation on a data packet having the first traffic feature, wherein the detection capabilities of the DPI detection engines in the DPI detection engine list are different, and the detection capabilities of the DPI detection engines in the DPI detection engine list are less than the detection capabilities of the initial DPI detection engine, and the default state of the DPI detection engines in the DPI detection engine list is closed; The initial DPI detection engine is disabled, and the first DPI detection engine is enabled.

2. The method according to claim 1, characterized in that The method specifically determines the first flow characteristic of the network flow data in the following manner: All traffic features of the network traffic data are determined, and a first preset number of traffic features with the largest traffic proportions are selected from all the traffic features to serve as first traffic features.

3. The method according to claim 2, characterized in that The method further comprises: After shutting down the initial DPI detection engine and enabling the first DPI detection engine, monitoring a second device performance indicator of the firewall device within a preset time; If the second device performance indicator is lower than the preset threshold, determining a second traffic feature of the network traffic data, wherein the second traffic feature is a second preset number of traffic features whose traffic proportion among all traffic features is not less than and is closest to the target traffic feature, the target traffic feature is the traffic feature with the smallest traffic proportion among the first traffic features, and the second preset number is not greater than the first preset number; In the DPI detection engine list, determining a second DPI detection engine for performing a detection operation on a data packet having the second traffic characteristic; The second DPI detection engine is disabled.

4. The method according to claim 1, characterized in that: The method further comprises: After a DPI detection cycle ends, the enabled DPI detection engines in the DPI detection engine list are disabled, and the initial DPI detection engine is enabled.

5. The method according to any one of claims 1 to 4, characterized in that: The DPI detection engine list includes any one or more of the following DPI detection engines: Cookie detection engine, wherein the traffic feature corresponding to the Cookie detection engine is that the data packet contains a Cookie field, and the detection capability of the Cookie detection engine includes performing a decoding operation on the Cookie field in the data packet and performing a detection operation on the decoding result; HTTP detection engine, wherein the traffic feature corresponding to the HTTP detection engine is that the protocol type of the data packet is HTTP protocol, and the detection capability of the HTTP detection engine includes performing detection operations on data packets whose protocol type is HTTP protocol; A file type detection engine, wherein the traffic feature corresponding to the file type detection engine is a target file type of a data packet, and the detection capability of the file type detection engine includes performing a detection operation on a data packet of the target file type; A domain name detection engine, wherein the traffic feature corresponding to the domain name detection engine is that the domain name of the data packet is a target domain name, and the detection capability of the domain name detection engine includes performing a detection operation on the data packet whose domain name is the target domain name; An SSL detection engine, wherein the traffic feature corresponding to the SSL detection engine is that the data packet has not been decrypted by SSL, and the detection capability of the SSL detection engine includes performing detection operations on the data packet that has not been decrypted by SSL.

6. The method according to claim 5, characterized in that The detection capabilities of the HTTP detection engine are specifically as follows: The first transaction detection operation is performed on the data packet whose protocol type is HTTP protocol.

7. A message detection device, characterized in that: The device is applied to a firewall device, and the device comprises: A monitoring module, configured to monitor a first device performance indicator of the firewall device when an initial DPI detection engine is enabled; a characteristic determination module, configured to determine a first flow characteristic of network flow data flowing through the firewall device if the first device performance indicator is lower than a preset threshold; an engine determination module, configured to determine, in a DPI detection engine list, a first DPI detection engine for performing a detection operation on a data packet having the first traffic characteristic, wherein the detection capabilities of the DPI detection engines in the DPI detection engine list are different, and the detection capabilities of the DPI detection engines in the DPI detection engine list are all less than the detection capabilities of the initial DPI detection engine, and the default state of the DPI detection engines in the DPI detection engine list is closed; A switching module is used to disable the initial DPI detection engine and enable the first DPI detection engine.

8. The device according to claim 7, characterized in that The feature determination module specifically determines the first traffic feature of the network traffic data in the following manner: All traffic features of the network traffic data are determined, and a first preset number of traffic features with the largest traffic proportions are selected from all the traffic features to serve as first traffic features.

9. An electronic device, characterized in that: include: A memory and one or more processors; the memory is coupled to the processor; wherein the memory stores computer program code, the computer program code includes computer instructions, and when the computer instructions are executed by the processor, the electronic device executes the method as described in any one of claims 1-6.

10. A computer-readable storage medium comprising computer instructions, characterized in that: When the computer instructions are executed on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 6.

11. A computer program product, characterized in that When the computer program product is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

Images