Safety protection rule verification method, network message detection method and device

Abstract

The invention provides a security protection rule verification method and device and a network message detection method and device. The security protection rule verification method comprises the steps of obtaining a mirror image message of a target message; matching the mirror image message with a preset security protection rule to obtain a matching result, the preset security protection rule being used for performing security detection on the network message; judging whether a preset security protection rule needs to be modified or not according to a matching result; and if yes, modifying a preset security protection rule based on a matching result. Whether the preset security protection rule needs to be corrected is determined through the matching result of the mirror image message and the preset security protection rule, and then the preset security protection rule is corrected based on the matching result when it is determined that rule correction needs to be performed, so that the accuracy of the preset security protection rule is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security protection rule verification method, a network message detection method, a device, an electronic device, and a storage medium. Background Art

[0002] In critical information infrastructure, there are high requirements for the security, stability, processing speed, and throughput of network equipment. In order to ensure the information security of network equipment, protection devices are connected in series or reverse proxy access in network equipment. However, the series operation of protection devices in network equipment will cause certain network delays to network equipment. Therefore, bypass blocking technology came into being.

[0003] At present, the bypass blocking technology is used to ensure the information security of network devices, mainly by connecting the blocking device in the network device in a bypass manner. Specifically, when the client sends a message to the server, the bypass blocking device mirrors the message between the client and the server. After the bypass blocking device obtains the mirrored message, it matches the content in the mirrored message with the pre-set security protection rules. If the match is successful, the bypass blocking device believes that there is a security problem with the message sent by the client to the server, and then sends a blocking message to the client and the server to block the communication between the client and the server. If the match fails, the bypass blocking device believes that there is no security problem with the message sent by the client to the server, and then allows the client to send messages to the server.

[0004] However, in the process of matching the mirror message with the preset security protection rule, the bypass blocking device may have the problem of inaccurate configuration of the security protection rule, because the security protection rule is preset manually, thereby reducing the accuracy of the security protection rule. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a security protection rule verification method, a network message detection method, a device, an electronic device, and a storage medium to improve the accuracy of network message security detection.

[0006] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] The first aspect of the present application provides a method for verifying security protection rules, the method comprising: obtaining a mirror message of a target message; matching the mirror message with a preset security protection rule to obtain a matching result, wherein the preset security protection rule is used to perform security detection on network messages; judging whether the preset security protection rule needs to be modified based on the matching result; and if so, modifying the preset security protection rule based on the matching result.

[0008] Compared with the prior art, the security protection rule verification method provided in the first aspect of the present application determines whether the preset security protection rules need to be revised through the matching results of the mirror message and the preset security protection rules, and then when it is determined that the rules need to be revised, the preset security protection rules are revised based on the matching results, thereby improving the accuracy of the preset security protection rules.

[0009] In some changed implementation modes of the first aspect of the present application, the preset security protection rule includes multiple sub-rules, and the matching result is that the mirror message successfully matches the target sub-rule among the multiple sub-rules; judging whether the preset security protection rule needs to be modified based on the matching result includes: obtaining the total number of the multiple sub-rules and the target number of the target sub-rules; judging whether the target number is equal to the total number; if so, determining that the preset security protection rule does not need to be modified; if not, determining that the preset security protection rule needs to be modified; modifying the preset security protection rule based on the matching result includes: deleting the sub-rules in the preset security protection rule except the target sub-rule.

[0010] When the number of sub-rules that hit the message is less than the total number of sub-rules in the preset security protection rules, it means that some sub-rules in the preset security protection rules have not taken effect in actual detection, and these sub-rules may not be suitable for actual business scenarios. Deleting these sub-rules from the preset security protection rules makes the preset security protection rules more practical and streamlined, reduces the number of rule matches, and improves the efficiency of detection of the preset security protection rules.

[0011] In some changed implementation modes of the first aspect of the present application, judging whether the preset security protection rules need to be modified based on the matching results includes: determining whether there is an error result in the matching results; if so, determining that the preset security protection rules need to be modified; if not, determining that the preset security protection rules do not need to be modified; modifying the preset security protection rules based on the matching results includes: modifying the preset security protection rules corresponding to the error result.

[0012] If there are erroneous results in the matching results, the content in the preset security protection rules is corrected based on the erroneous results, so that the corrected preset security protection rules will no longer make the same misjudgment on subsequent messages, thereby improving the accuracy of the preset security protection rules.

[0013] In some changed implementation modes of the first aspect of the present application, the preset security protection rules include regular matching rules, and the error results include normal messages that are mistakenly hit and abnormal messages that are not hit; the preset security protection rules corresponding to the error results are modified, including: narrowing the scope of the regular matching rules based on the normal messages, so that the regular matching rules after the narrowed scope no longer hit the normal messages; expanding or modifying the scope of the regular matching rules based on the abnormal messages, so that the regular matching rules after the expanded or modified scope can hit the abnormal messages.

[0014] When a mirrored message is hit by a regular matching rule by mistake, it means that the scope of the regular matching rule is too large and covers the normal message. At this time, the scope of the regular matching rule is narrowed according to the normal message that is hit by mistake. After the scope is narrowed, the regular matching rule will no longer hit similar messages, which improves the accuracy of the preset security protection rules. And when an abnormal message is not hit by a regular matching rule, it means that the scope of the regular matching rule is too small or the scope is wrong. At this time, the scope of the regular matching rule is expanded or adjusted according to the abnormal message that is not hit, so that similar abnormal messages can be hit later, which improves the accuracy of the preset security protection rules.

[0015] In some changed implementation modes of the first aspect of the present application, the preset security protection rule includes multiple sub-rules, and the matching result is that the mirror message successfully matches the target sub-rule among the multiple sub-rules; after obtaining the matching result, the method also includes: associating the basic information and blocking information of the mirror message, and the relevant information of the target sub-rule and recording them in a log, so as to combine them with the information of other messages recorded in the log to generate an attack behavior chain.

[0016] After the mirror message is hit by the rule, the mirror message and the relevant information of the hit target sub-rule are associated and recorded in the log. Later, through the log, multiple messages can be associated and analyzed to find the execution chain of the attack behavior, which can comprehensively discover the attack behavior and improve the security of the network.

[0017] In some changed implementation modes of the first aspect of the present application, before determining whether the preset security protection rules need to be modified based on the matching results, the method further includes: determining whether the observer mode is turned on, the observer mode being used to indicate that the correctness of the preset security protection rules needs to be verified; if so, executing the step of determining whether the preset security protection rules need to be modified based on the matching results; if not, determining whether to send a blocking message to both transmission parties of the target message based on the matching results.

[0018] Through the observer mode, the preset security protection rules can be switched between the debugging mode and the use mode, which improves the flexibility of debugging the preset security protection rules.

[0019] In some changed implementation modes of the first aspect of the present application, the target message is a Transmission Control Protocol (TCP) connection message, and the blocking message is a Reset (RST) packet; determining whether to send a blocking message to both transmission parties of the target message according to the matching result includes: when the matching result indicates that the mirror message matches the preset security protection rule, obtaining the source IP address, source port, destination address, destination port and current sequence number in the mirror message; determining the next sequence number of the current sequence number; using the source IP address and source port as new destination address and destination port, and using the destination address and destination port as new source IP address and source port, generating a first RST packet based on the new source IP address, source port, new destination address, destination port and the next sequence number, and sending the first RST packet to the sender of the target message; generating a second RST packet based on the source IP address, source port, destination address, destination port and the next sequence number, and sending the second RST packet to the receiver of the target message.

[0020] In the scenario of TCP network connection, using the verified preset security protection rules, when it is determined that there is a security problem with the mirrored message, the source IP address, source port, destination address, destination port and current sequence number in the mirrored message are used to simulate the message sender, generate an RST packet, and send the RST packet to both parties of the message, which can accurately block abnormal messages between the two parties of the message.

[0021] In some changed implementation modes of the first aspect of the present application, the method is applied to a bypass blocking device, which is located between the sender of the target message and the receiver of the target message, and the transmission distance between the bypass blocking device and the sender is less than the transmission distance between the bypass blocking device and the receiver; determining whether to send a blocking message to both transmission parties of the target message based on the matching result includes: when the matching result indicates that the mirror message matches the preset security protection rule, sending the blocking message to the sender from the current position according to the reverse path of the preset transmission path, and sending the blocking message to the receiver from the current position according to the preset transmission path, and the preset transmission path is the path for message transmission between the sender and the receiver.

[0022] By arranging the bypass blocking device at a position closer to the message sender, it is ensured that the blocking message sent by the simulated message receiver can arrive at the message receiver before that, thereby further improving the success rate of connection blocking.

[0023] A second aspect of the present application provides a method for detecting a network message, the method comprising: obtaining a mirror message of a network message; using the verification method in the first aspect to perform verification and pass a preset security protection rule, detecting the mirror message of the network message, and obtaining a detection result of the network message.

[0024] The third aspect of the present application provides a security protection rule verification device, which includes: a first acquisition module, used to obtain a mirror message of a target message; a matching module, used to match the mirror message with a preset security protection rule to obtain a matching result, and the preset security protection rule is used to perform security detection on the network message; a judgment module, used to judge whether the preset security protection rule needs to be modified according to the matching result; if so, enter the correction module; the correction module is used to modify the preset security protection rule based on the matching result.

[0025] In a fourth aspect, the present application provides a network message detection device, the device comprising: a second acquisition module, used to obtain a mirror message of a network message; a detection module, used to detect the mirror message of the network message according to a preset security protection rule after verification by the verification method in the first aspect, and obtain a detection result of the network message.

[0026] The fifth aspect of the present application provides an electronic device, which includes: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other through the bus; and the processor is used to call program instructions in the memory to execute the method in the first aspect or the second aspect.

[0027] A sixth aspect of the present application provides a computer-readable storage medium, the storage medium comprising: a stored program; wherein, when the program is executed, the device where the storage medium is located is controlled to execute the method in the first aspect or the second aspect.

[0028] The network message detection method provided in the second aspect of the present application, the security protection rule verification device provided in the third aspect, the network message detection device provided in the fourth aspect, the electronic device provided in the fifth aspect, and the computer-readable storage medium provided in the sixth aspect have the same or similar technical effects as the security protection rule verification method provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0030] Figure 1 A schematic diagram of an application scenario of a method for verifying security protection rules and a method for detecting network messages in an embodiment of the present application;

[0031] Figure 2 The following is a flow chart of the verification method of the security protection rules in the embodiment of the present application. Figure 1 ;

[0032] Figure 3 The following is a flow chart of the verification method of the security protection rules in the embodiment of the present application. Figure 2 ;

[0033] Figure 4 A schematic diagram of a flow chart of a method for detecting network messages in an embodiment of the present application;

[0034] Figure 5 The structure of the verification device of the security protection rule in the embodiment of the present application is shown as follows Figure 1 ;

[0035] Figure 6 The structure of the verification device of the security protection rule in the embodiment of the present application is shown as follows Figure 2 ;

[0036] Figure 7 This is a schematic diagram of the structure of a device for detecting network messages in an embodiment of the present application;

[0037] Figure 8 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0039] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0040] At present, the preset security protection rules used for security monitoring of network messages are all set manually. The manually set security protection rules may have the problem of inaccurate rule settings.

[0041] In view of this, the embodiments of the present application provide a security protection rule verification method, a network message detection method, a device, an electronic device and a storage medium. In the process of using preset security protection rules to detect network messages, the accuracy of the preset security protection rules is verified through the matching results between the network messages and the preset security protection rules, thereby ensuring the accuracy of the preset security protection rules in the process of monitoring network messages.

[0042] First, the application scenarios of the security protection rule verification method and the network message detection method provided in the embodiments of the present application are described.

[0043] Figure 1 This is a schematic diagram of an application scenario of the method for verifying security protection rules and the method for detecting network messages in the embodiment of the present application, see Figure 1 As shown, the scenario may include: a client 11 , a server 12 , and a bypass blocking device 13 .

[0044] When the client 11 sends a message a to the server 12, the bypass blocking device 13 mirrors the message a in the path sent by the client 11 to the server 12 to obtain a mirrored message. The bypass blocking device 13 matches the mirrored message with the preset security protection rule. If the match is successful, a blocking message is generated based on the content in the message a, and the blocking message is sent to the client 11 and the server 12 respectively. In this way, for the client 11, when it receives the blocking message, it will think that the server 12 wants to disconnect it. For the server 12, when it receives the blocking message, it will think that it is a disconnection instruction sent by the client 11 again. Thereby, the client 11 and the server 12 are disconnected. If the match fails, it means that there are no security issues with the client 11, the server 12 and the message a. The bypass blocking device 13 does not process the message a in any way, and the client 11 can communicate normally with the server 12.

[0045] Similarly, the server 12 will continue to send messages, namely message b, to the client 11 or other devices in the network. The bypass blocking device 13 will continue to mirror the message b, thereby matching the mirrored message of message b with the preset security protection rules to determine whether there is a security problem in the communication through message b.

[0046] Whether it is message a or message b, it needs to be matched with the preset security protection rules. Therefore, the accuracy of the preset security protection rules will affect the accuracy of communication security judgment. Therefore, it is necessary to match several messages with the preset security protection rules, and then verify the accuracy of the preset security protection rules based on the matching results, and correct the preset security protection rules when it is determined that there are errors in the preset security protection rules. Subsequently, the corrected security protection rules are used to perform security detection on network messages, thereby improving the accuracy of network message security detection.

[0047] Next, the verification method of the security protection rules provided in the embodiment of the present application is described in detail.

[0048] Figure 2 The following is a flow chart of the verification method of the security protection rules in the embodiment of the present application. Figure 1 , see Figure 2 As shown, the method may include:

[0049] S21: Obtain a mirror image message of the target message.

[0050] The target message here can be multiple messages transmitted in real time or historically within the preset network range. The preset network range refers to the coverage of the network that needs to be monitored for network message security. It can be a specified area in the public network or a private network.

[0051] When obtaining the mirror image of the target message, a splitter device can be set at the port where the external network core switch connects to the operator (i.e., the server operator), and the target message is split by the splitter device to obtain the mirror image. Other existing data replication technologies can also be used to obtain the mirror image of the target message.

[0052] S22: Match the mirrored message with the preset security protection rule to obtain a matching result.

[0053] The preset security protection rules are used to perform security detection on network messages. The preset security protection rules can be a collection of some features and behaviors, such as: the source IP address, source port, destination IP address, destination port extracted from messages with security issues found in history, IP address, port, malicious behavior features obtained from intelligence data, etc.

[0054] The mirrored message is matched with the preset security protection rule. In the obtained matching result, either the mirrored message matches the preset security protection rule, indicating that the mirrored message has a security problem, or the mirrored message does not match the preset security protection rule, indicating that the mirrored message does not have a security problem.

[0055] S23: According to the matching result, determine whether the preset security protection rule needs to be modified. If yes, execute S24, if no, execute S25.

[0056] In the matching results, either the mirrored message matches the preset security protection rules, or the mirrored message does not match the preset security protection rules. Regardless of whether the mirrored message matches the preset security protection rules, since the preset security protection rules are manually set, there may be some errors, which will also lead to errors in the matching results. For example: the mirrored message does not actually have a security problem, but due to an error in the setting of the preset security protection rules, the mirrored message hits the rule, causing the mirrored message to be mistakenly considered to have a security problem. Another example: the mirrored message actually has a security problem, but due to an error in the setting of the preset security protection rules, the mirrored message is not detected, resulting in the omission of the message with the security problem. Therefore, it is necessary to determine whether there is a problem with the preset security protection rules based on the matching results, so as to correct the problematic rules.

[0057] When determining whether the preset security protection rules need to be modified, it is necessary to analyze the hits in the matching results. On the one hand, the mirrored messages that hit the rules in the matching results can be manually analyzed to confirm whether there are indeed security issues with the mirrored messages, and when it is confirmed that there are no security issues with the mirrored messages, it is determined that the preset security protection rules are incorrectly configured and need to be corrected. On the other hand, the mirrored messages that do not hit the rules in the matching results can be manually analyzed to confirm whether there are indeed security issues with the mirrored messages, and when it is confirmed that there are security issues with the mirrored messages, it is determined that the preset security protection rules are incorrectly configured and need to be corrected. On the other hand, it is also possible to check whether the rules that do not hit the messages are redundantly configured to streamline the rules.

[0058] S24: Modify the preset security protection rules based on the matching results.

[0059] When a mirrored message without security issues is matched by a rule in the matching result, it is necessary to delete the feature containing the mirrored message in the rule.

[0060] When there is a mirrored message with security issues in the matching result that is not matched by the rule, it is necessary to add the feature of the mirrored message to the rule.

[0061] When it is found according to the matching results that there are rules in the preset security protection rules that are not used or are used very rarely, the rule can be deleted.

[0062] For different situations in the matching results, different measures are taken for the preset security protection rules, which need to be determined based on the actual situation in the matching results and are not specifically limited here.

[0063] S25: End.

[0064] If there are no mirror message judgment errors in the matching results, or the rules are fully used, it means that there are no problems with the preset security protection rules and there is no need to modify them.

[0065] From the above content, it can be seen that the security protection rule verification method provided in the embodiment of the present application determines whether the preset security protection rules need to be modified through the matching results of the mirror message and the preset security protection rules, and then when it is determined that the rules need to be modified, the preset security protection rules are modified based on the matching results, thereby improving the accuracy of the preset security protection rules.

[0066] Furthermore, as a Figure 2 As a refinement and extension of the method shown, an embodiment of the present application also provides a method for verifying security protection rules.

[0067] Figure 3 The following is a flow chart of the verification method of the security protection rules in the embodiment of the present application. Figure 2 , see Figure 3 As shown, the method may include:

[0068] S31: Obtain a mirror image message of the target message.

[0069] S32: Match the mirrored message with the preset security protection rule to obtain a matching result.

[0070] The specific implementation methods of steps S31 and S32 are the same as those of the aforementioned steps S21 and S22. Please refer to the relevant instructions in the aforementioned steps S21 and S22, and will not be repeated here.

[0071] S33: Determine whether the observer mode is on. If yes, execute S34; if no, execute S35.

[0072] Among them, the observer mode is used to indicate that the correctness of the preset security protection rules needs to be verified.

[0073] Before conducting a formal security check on network messages, you can first conduct a trial run, that is, turn on the observer mode. After the observer mode is turned on, you can judge whether the preset security protection rules are accurate by matching the results of some messages within the preset network range, so as to achieve the purpose of verifying, modifying, and improving the accuracy of the preset security protection rules.

[0074] In the process of determining whether the observer mode is turned on, the determination can be made through a preset flag in the bypass blocking device. Specifically, when the observer mode is not turned on, the flag can be set to 0 by default. When the user turns on the observer mode, the flag is automatically adjusted to 1. The specific content of the flag here is only an example, and different flags can be configured according to actual conditions. Of course, it is also possible to determine whether the observer mode is turned on by the bypass blocking device through other existing mode recognition methods.

[0075] In actual applications, the preset security protection rule is not just one rule, but is composed of multiple rules. That is, the preset security protection rule includes multiple sub-rules. The mirror message is matched with multiple sub-rules respectively, and the successfully matched target sub-rule and the mirror message will form a matching result.

[0076] S34: Associating the basic information and blocking information of the mirrored message and the relevant information of the target sub-rule and recording them in the log, so as to be combined with the information of other messages recorded in the log to generate an attack behavior chain.

[0077] In the log, the basic information and blocking information of the successfully matched mirror message and the relevant information of the corresponding target sub-rule are recorded. The basic information of the mirror message may include: source Internet Protocol (IP) address, source port, destination IP address, destination port, etc. The blocking information of the mirror message may include: blocked Hypertext Transfer Protocol (HTTP) Uniform Resource Locator (URL), blocked host (HOST), number of blockings, blocking time, etc. The relevant information of the target sub-rule may include: identity document (ID), etc.

[0078] In addition to recording various information about the mirror message and the target sub-rule it hits, the log also records other messages and the sub-rules they hit. One message may not be able to accurately infer the attack behavior chain, but multiple messages can be used to infer the attack behavior chain. For example: through the mirror message and the target sub-rule it hits, it can only be determined that the target IP failed to log in to the system at 5:00 on January 20, 2024. This is a single login failure behavior. However, through correlation analysis, through other messages in the log and the rules they hit, it was also found that the target IP failed to log in to the system at 4:00 on January 19, 2024, and the target IP failed to log in to the system at 6:00 on January 18, 2024. It can be found that the target IP will try to log in to the system every day in the early morning recently, so that targeted attacks can be prevented.

[0079] S35: Determine whether to send a blocking message to both transmission parties of the target message according to the matching result of the mirror message.

[0080] If the observer mode is not enabled, it means that the preset security protection rules are being used to perform security checks on the target message. Therefore, it is possible to determine whether to send blocking information to the sender and receiver of the target message based on the matching result between the current target message and the preset security protection rules. When the matching result indicates that the target message matches the preset security protection rules, it is necessary to send blocking information to the sender and receiver of the target message. When the matching result indicates that the target message does not match the preset security protection rules, no further operations are performed, and the next message in the network is mirrored, rule matched, blocked, and other processes are continued.

[0081] After step S34, that is, in the observer mode, after the matched mirror message and the sub-rule are recorded in the log, it is necessary to verify the correctness of the preset security protection rule based on the content in the log.

[0082] S36: According to the matching result, it is determined whether the preset security protection rule needs to be modified. If yes, S37 is executed; if no, S38 is executed.

[0083] When determining whether to modify the preset security protection rules based on the matching results, it can be done from two aspects: on the one hand, whether the rules are fully utilized, and on the other hand, whether there are false hits or missed hits.

[0084] For the first aspect, the preset security protection rule includes multiple sub-rules, and the matching result is that the mirror message successfully matches the target sub-rule in the multiple sub-rules. The above step S36 may include:

[0085] Step A1: Obtain the total number of multiple sub-rules and the target number of the target sub-rules.

[0086] Step A2: Determine whether the target quantity is equal to the total quantity. If yes, proceed to step A3; if no, proceed to step A4.

[0087] Step A3: Determine that there is no need to modify the preset security protection rules.

[0088] Step A4: Determine whether the preset security protection rules need to be modified.

[0089] The preset security protection rules include multiple sub-rules. In actual application scenarios, not all of these sub-rules are useful. That is, only some of the multiple sub-rules are applicable to the current scenario. Therefore, it is necessary to find and delete some irrelevant sub-rules in the preset security protection rules that are not used in actual scenarios.

[0090] For example, suppose that the preset security protection rules include 1000 sub-rules. The matching results show that 600 of the sub-rules match the message. The 600 sub-rules that match the message are less than the 1000 sub-rules in the preset security protection rules. This means that 400 of the 1000 sub-rules are of no practical use in this scenario. These 400 sub-rules can be deleted from the preset security protection rules. In this way, the matching efficiency of subsequent messages and preset security protection rules can be accelerated. To match the message with the original preset security protection rules, 1000 rule matches are required. To match the message with the current preset security protection rules, only 600 rule matches are required. The number of matches is reduced, and the matching efficiency is naturally increased. Moreover, the reduced sub-rules are all sub-rules of no practical use, and will not affect the accuracy of security detection.

[0091] For the second aspect, the above step S36 may include:

[0092] Step B1: Determine whether there is an erroneous result in the matching result. If yes, execute step B2; if no, execute step B3.

[0093] Step B2: Determine whether the preset security protection rules need to be modified.

[0094] Step B3: Determine that there is no need to modify the preset security protection rules.

[0095] In the specific judgment process, the matching result can be fed back to the communicating parties or manually, and the judgment is made according to the errors fed back by the communicating parties or manually or the results of the re-check. When the mirrored message hits the rule, the message will be considered to have a security problem, thereby blocking the communication between the two parties of the message. If one or both parties of the communication feedback that there is a blocking error, then it is determined that the matching error exists, and then it is determined that there is an erroneous result in the matching result. Alternatively, the message and rule in each result in the matching result are checked again, and its IP address, specific content, etc. are checked. If the IP address is checked to be a normal business, or the specific content is not offensive, then it is determined that the matching error exists, and then it is determined that there is an erroneous result in the matching result. In this way, the corresponding rules need to be corrected (modified or deleted). If no erroneous results are found in the matching results through the above methods, then the current security protection rules have not made any errors, and the current security protection rules can continue to be used for security detection without correcting the rules.

[0096] S37: Delete the sub-rules except the target sub-rule in the preset security protection rule, or modify the preset security protection rule corresponding to the error result.

[0097] S38: Maintain the default security protection rules.

[0098] In actual applications, the preset security protection rule can be an IP address or a regular matching rule. When the preset security protection rule is an IP address, if it is found that the matched message is a normal message, that is, the IP address in the message belongs to normal business, then the IP address is deleted from the preset security protection rule. When the preset security protection rule is a regular matching rule, if it is found that the matched message does not have a security problem, that is, the matched message is a false hit message, it means that the regular matching rule has an over-matching problem, and the scope of the regular matching rule needs to be narrowed. If it is found that the message with security problems is not hit by the rule, it means that the regular matching rule has a missed match problem, and the scope of the regular matching rule needs to be expanded or adjusted.

[0099] Specifically, the above step S37 may include:

[0100] Step C1: Narrowing the scope of the regular matching rule based on the normal message so that the regular matching rule after the narrowing of the scope no longer hits the normal message.

[0101] For example, suppose a regular matching rule is: [1-9][1-9]....loop 18 times. This rule is used to identify sensitive information in the message, that is, the ID card number. If this rule is hit, it means that there is sensitive information in the message and it needs to be blocked. For this rule, [1-9] means matching any number from 1 to 9. However, under this rule, what is matched is a continuous 18-digit number, not necessarily the ID card number. This is because each digit in the ID card number has a special meaning. Therefore, it is necessary to narrow the scope of the regular matching rule. The narrowed rule can be: / (^[1-9]\d{5}(18|19|(

[23] \d))\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}[0-9Xx]$)|(^[1-9]\d{5}\d{2}((0[1-

[0102] 9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}$) / .

[0103] Step C2: Expand or modify the scope of the regular matching rule based on the abnormal message, so that the regular matching rule after the expanded or modified scope can hit the abnormal message.

[0104] For example, suppose a regular matching rule is actually used to identify sensitive information of users, and the currently configured regular matching rule is 18 digits. The user's sensitive information includes not only the ID card number, but also the phone number. If the mirrored message contains a phone number, the current regular matching rule cannot match the mirrored message, causing the mirrored message to bypass detection. In this case, the scope of the currently configured regular matching rule needs to be expanded to include not only 18 digits, but also 11 digits.

[0105] For another example, suppose a regular matching rule is actually used to identify abnormal behavior, and the current regular matching rule is for logging into the system during non-working hours. Sometimes users need to log into the system during non-working hours for work reasons, and then there will be misjudgment of related mirroring messages. In this case, the scope of the currently configured regular matching rule needs to be adjusted to the preset number of failed login attempts.

[0106] In this way, in observer mode, the verification and correction of preset security protection rules are completed.

[0107] Next, we will continue to explain how to process messages in non-observer mode.

[0108] In step S35, when the mirrored message matches the preset security protection rule, it indicates that the target message has a security problem and the connection between the two communicating parties of the target message needs to be blocked. When the mirrored message does not match the preset security protection rule, it indicates that the target message has no security problem and there is no need to interfere with the communicating parties of the target message.

[0109] Specifically, in a TCP connection scenario, the target message is a TCP connection message, and the blocking message is an RST packet. The above step S35 may include:

[0110] Step D1: When the matching result indicates that the mirrored message matches the preset security protection rule, the source IP address, source port, destination address, destination port and current sequence number in the mirrored message are obtained.

[0111] The match here can refer to the source IP address, source port, destination address or destination port in the mirrored message matching the IP address or port in the rule, or it can refer to the content in the mirrored message meeting the characteristics in the rule. When the mirrored message matches the preset security protection rule, it means that the target message corresponding to the mirrored message has a security problem, and the communication of both parties of the target message needs to be blocked.

[0112] Blocking the communicating parties means disconnecting the communicating parties. In the TCP scenario, it simulates one party in the communication and sends an RST packet to the other party. The RST packet is a special TCP packet and also contains some information in the TCP packet. Therefore, it is necessary to obtain the source IP address, source port, destination address, destination port and current sequence number from the mirror message in order to accurately simulate the communicating parties. The specific method of extracting the source IP address, source port, destination address, destination port and current sequence number from the mirror message can adopt the existing information parsing or extraction technology, which will not be repeated here.

[0113] Step D2: Determine the next sequence number of the current sequence number.

[0114] In a TCP connection, the two communicating parties include the requester and the responder. When sending messages, the requester and the responder will perform a three-way handshake. In the first handshake, the requester sends a message to the responder, which carries the requester's IP address, port, the responder's IP address, port, SYN=j and other information. In the second handshake, the responder sends a message to the requester, which carries the responder's IP address, port, the requester's IP address, port, ACK=j+1, SYN=k and other information. In the third handshake, the requester sends a message to the responder, which carries the requester's IP address, port, the responder's IP address, port, ACK=k+1 and other information. The SYN or ACK here is the current sequence number, and the SYN or ACK in the next handshake is the next sequence number.

[0115] For example, suppose the target message is the message sent by the requester to the responder in the first handshake above. j is the current sequence number, and k is the next sequence number.

[0116] For another example: Assume that the target message is the message sent by the responder to the requester in the second handshake above. k is the current sequence number, and k+1 is the next sequence number.

[0117] Step D3: Use the source IP address and source port as the new destination address and destination port, use the destination address and destination port as the new source IP address and source port, generate the first RST packet based on the new source IP address, source port, the new destination address, destination port and the next sequence number, and send the first RST packet to the sender of the target message.

[0118] That is to say, the source and destination IP addresses are converted to each other, the source and destination ports are converted to each other, the message receiver is imitated, and an RST packet (RST flag position is 1) is sent to the message sender to block the connection between the two parties.

[0119] Step D4: Generate a second RST packet based on the source IP address, source port, destination address, destination port and next sequence number, and send the second RST packet to the recipient of the target message.

[0120] That is to say, after the message sender sends the target message to the message receiver, it imitates the message sender and sends a RST packet (RST flag position is 1) to the message receiver to block the connection between the two parties.

[0121] In actual applications, since the RST packet imitates the message sender or receiver, in order to ensure that the RST packet arrives before the message feedback from the message receiver, the bypass blocking device can be located between the sender of the target message and the receiver of the target message, and the transmission distance between the bypass blocking device and the sender can be smaller than the transmission distance between the bypass blocking device and the receiver.

[0122] Specifically, the above step S35 may include:

[0123] Step E: When the matching result indicates that the mirrored message matches the preset security protection rule, a blocking message is sent to the sender from the current position according to the reverse path of the preset transmission path, and a blocking message is sent to the receiver from the current position according to the preset transmission path.

[0124] The preset transmission path is a path for message transmission between a sender and a receiver.

[0125] For example, assume that the preset transmission path for the target message from the sender to the receiver needs to pass through route 1, route 2, route 3 and route 4 in sequence. Set the bypass blocking device on route 1 or route 2. When it is determined that there is a security problem with the target message, the bypass blocking device can imitate the receiver and send it directly to the sender from route 1, or from route 2 via route 1. Compared with the receiver sending the real response message to the sender through route 4, route 3, route 2 and route 1, the number of routes passed can be reduced, so that the blocking message received by the sender arrives before the response message. The bypass blocking device imitates the sender to send a blocking message to the receiver, which arrives at the receiver after the target message.

[0126] Of course, the bypass blocking device can also be set near the message receiver, that is, the transmission distance between the bypass blocking device and the receiver of the target message is shorter than the transmission distance between the bypass blocking device and the sender of the target message. In this way, when it is determined that there is a security problem with the target message, the blocking message sent by the bypass blocking device to the sender by imitating the receiver will also arrive before the response message.

[0127] At this point, the verification method for the security protection rules provided in the embodiment of the present application has been fully explained.

[0128] Based on the same inventive concept, an embodiment of the present application also provides a method for detecting a network message.

[0129] Figure 4 This is a flow chart of the method for detecting network messages in the embodiment of the present application, see Figure 4 As shown, the method may include:

[0130] S41: Obtain a mirror image message of the network message.

[0131] After the preset security protection rules are verified by using the verification method in the aforementioned embodiment, the preset security protection rules that have passed the verification can be used to perform security detection on messages transmitted in the preset network.

[0132] The network message here can be a message transmitted in a preset network after the preset security protection rule is verified, or it can be a message transmitted in a preset network when the preset security protection rule is verified, that is, message detection is performed while rule verification is performed. The specific meaning of the network message is not limited here.

[0133] After the network message is detected, the network message can be mirrored to obtain the mirrored message. The specific method of mirroring the message is a conventional data mirroring method, which will not be described here.

[0134] S42: Using the verification method in the above embodiment to verify and pass the preset security protection rules, the mirror message of the network message is detected to obtain the detection result of the network message.

[0135] After obtaining the mirrored message, the mirrored message is matched with the preset security protection rules. Since the preset security protection rules contain the characteristics of messages with security issues, if the mirrored message successfully matches the preset security protection rules, it means that the mirrored message has a security issue, and then it is determined that the corresponding network message has a security issue, and both sides of the message need to be blocked. If the mirrored message fails to match the preset security protection rules, it means that the mirrored message does not have a security issue, and then it is determined that the corresponding network message does not have a security issue, so that the corresponding network message can continue to flow.

[0136] It can be seen from the above content that the network message detection method provided in the embodiment of the present application, after the preset security protection rules are verified, uses the verified preset security protection rules to perform security detection on the network message, which can improve the accuracy of network message security detection.

[0137] Based on the same inventive concept, as an implementation of the above verification method, an embodiment of the present application also provides a verification device for security protection rules.

[0138] Figure 5The structure of the verification device of the security protection rule in the embodiment of the present application is shown as follows Figure 1 , see Figure 5 As shown, the device may include: a first acquisition module 51, a matching module 52, a judgment module 53 and a correction module 54. The first acquisition module 51, the matching module 52, the judgment module 53 and the correction module 54 are connected in sequence.

[0139] The first acquisition module 51 is used to acquire a mirrored message of a target message.

[0140] The matching module 52 is used to match the mirrored message with a preset security protection rule to obtain a matching result. The preset security protection rule is used to perform security detection on the network message.

[0141] The judgment module 53 is used to judge whether the preset security protection rule needs to be modified according to the matching result. If so, the process enters the correction module 54.

[0142] The correction module 54 is used to modify the preset security protection rule based on the matching result.

[0143] Furthermore, as a Figure 5 As a refinement and extension of the device shown, an embodiment of the present application also provides a security protection rule verification device.

[0144] Figure 6 The structure of the verification device of the security protection rule in the embodiment of the present application is shown as follows Figure 2 , see Figure 6 As shown, the device may include: a first acquisition module 61, a matching module 62, a mode module 63, a log module 64, a blocking module 65, a judgment module 66, and a correction module 67. The first acquisition module 61, the matching module 62, the mode module 63, the log module 64, the judgment module 66, and the correction module 67 are connected in sequence. The blocking module 65 is connected to the mode module 63.

[0145] The first acquisition module 61 is used to acquire a mirrored message of a target message.

[0146] The matching module 62 is used to match the mirrored message with a preset security protection rule to obtain a matching result. The preset security protection rule is used to perform security detection on the network message.

[0147] The mode module 63 is used to determine whether the observer mode is turned on, and the observer mode is used to indicate that the correctness of the preset security protection rules needs to be verified. If yes, the log module 64 is entered, and if no, the blocking module 65 is entered.

[0148] When the preset security protection rule includes multiple sub-rules, and the matching result is that the mirror message successfully matches the target sub-rule among the multiple sub-rules, the log module 64 is used to associate the basic information and blocking information of the mirror message and the relevant information of the target sub-rule and record them in the log, so as to combine them with the information of other messages recorded in the log to generate an attack behavior chain.

[0149] The blocking module 65 is used to determine whether to send a blocking message to both transmission parties of the target message according to the matching result.

[0150] The judgment module 66 includes: a first judgment unit 661 and a second judgment unit 662 .

[0151] When the preset security protection rule includes multiple sub-rules, and the matching result is that the mirror message successfully matches the target sub-rule among the multiple sub-rules, the first judgment unit 661 is used to obtain the total number of the multiple sub-rules and the target number of the target sub-rules; determine whether the target number is equal to the total number; if so, determine that there is no need to modify the preset security protection rule; if not, determine that the preset security protection rule needs to be modified.

[0152] The second judgment unit 662 is used to determine whether there is an erroneous result in the matching result; if so, it is determined that the preset security protection rule needs to be modified; if not, it is determined that the preset security protection rule does not need to be modified.

[0153] The correction module 67 is used to delete the sub-rules in the preset security protection rules except the target sub-rule when determining to modify, or to modify the preset security protection rules corresponding to the error result.

[0154] When the preset security protection rules include regular matching rules, and the error results include normal messages that are mistakenly hit and abnormal messages that are missed, the correction module 67 is specifically used to narrow the scope of the regular matching rules based on the normal messages, so that the regular matching rules after the narrowed scope no longer hit the normal messages; and to expand or modify the scope of the regular matching rules based on the abnormal messages, so that the regular matching rules after the expanded or modified scope can hit the abnormal messages.

[0155] When the target message is a TCP connection message and the blocking message is an RST packet, the blocking module 65 includes: an extraction unit 651, a determination unit 652, a first sending unit 653 and a second sending unit 654. The extraction unit 651, the determination unit 652 and the first sending unit 653 are connected in sequence, and the second sending unit 654 is connected to the determination unit 652.

[0156] The extraction unit 651 is configured to obtain a source IP address, a source port, a destination address, a destination port, and a current sequence number in the mirror message when the matching result indicates that the mirror message matches the preset security protection rule.

[0157] The determination unit 652 is configured to determine the next sequence number of the current sequence number.

[0158] The first sending unit 653 is used to use the source IP address and source port as new destination address and destination port, use the destination address and destination port as new source IP address and source port, generate a first RST packet based on the new source IP address, source port, new destination address, destination port and the next sequence number, and send the first RST packet to the sender of the target message.

[0159] The second sending unit 654 is used to generate a second RST packet based on the source IP address, source port, destination address, destination port and the next sequence number, and send the second RST packet to the recipient of the target message.

[0160] When the method is applied to a bypass blocking device, the bypass blocking device is located between the sender of the target message and the receiver of the target message, and the transmission distance between the bypass blocking device and the sender is less than the transmission distance between the bypass blocking device and the receiver, the blocking module 65 is specifically used to send the blocking message to the sender from the current position according to the reverse path of the preset transmission path when the matching result indicates that the mirror message matches the preset security protection rule, and send the blocking message to the receiver from the current position according to the preset transmission path, and the preset transmission path is the path for message transmission between the sender and the receiver.

[0161] It should be noted here that the description of the above verification device embodiment is similar to the description of the above verification method embodiment, and has similar beneficial effects as the verification method embodiment. For technical details not disclosed in the verification device embodiment of this application, please refer to the description of the verification method embodiment of this application for understanding.

[0162] Based on the same inventive concept, as an implementation of the above detection method, an embodiment of the present application also provides a network message detection device.

[0163] Figure 7 This is a schematic diagram of the structure of the network message detection device in the embodiment of the present application, see Figure 7 As shown, the device may include: a second acquisition module 71 and a detection module 72. The second acquisition module 71 is connected to the detection module 72.

[0164] The second acquisition module 71 is used to acquire the mirror message of the network message.

[0165] The detection module 72 is used to detect the mirror message of the network message by using the verification method in the above embodiment and the preset security protection rules after verification, and obtain the detection result of the network message.

[0166] It should be noted here that the description of the above detection device embodiment is similar to the description of the above detection method embodiment, and has similar beneficial effects as the detection method embodiment. For technical details not disclosed in the detection device embodiment of this application, please refer to the description of the detection method embodiment of this application for understanding.

[0167] Based on the same inventive concept, an embodiment of the present application also provides an electronic device. Figure 8 This is a schematic diagram of the structure of the electronic device in the embodiment of the present application, see Figure 8 As shown, the electronic device may include: a processor 81, a memory 82, and a bus 83; wherein the processor 81 and the memory 82 communicate with each other via the bus 83; the processor 81 is used to call program instructions in the memory 82 to execute the methods in one or more of the above embodiments.

[0168] It should be noted that the description of the above electronic device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the electronic device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0169] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method in one or more of the above embodiments.

[0170] It should be noted here that the description of the above storage medium embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the storage medium embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0171] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for verifying security protection rules, characterized in that: The method comprises: Get the mirror message of the target message; Matching the mirrored message with a preset security protection rule to obtain a matching result, wherein the preset security protection rule is used to perform security detection on the network message; According to the matching result, determining whether the preset security protection rule needs to be modified; If so, the preset security protection rule is modified based on the matching result.

2. The method according to claim 1, characterized in that The preset security protection rule includes a plurality of sub-rules, and the matching result is that the mirror message successfully matches a target sub-rule among the plurality of sub-rules; The determining, based on the matching result, whether the preset security protection rule needs to be modified includes: Obtaining a total number of the plurality of sub-rules and a target number of the target sub-rules; Determining whether the target quantity is equal to the total quantity; If so, it is determined that there is no need to modify the preset security protection rules; If not, it is determined that the preset security protection rules need to be modified; The modifying the preset security protection rule based on the matching result includes: Delete the sub-rules in the preset security protection rules except the target sub-rule.

3. The method according to claim 1, characterized in that: The determining, based on the matching result, whether the preset security protection rule needs to be modified includes: Determine whether there is an erroneous result in the matching result; If so, it is determined that the preset security protection rule needs to be modified; If not, it is determined that there is no need to modify the preset security protection rules; The modifying the preset security protection rule based on the matching result includes: Modify the preset security protection rules corresponding to the error result.

4. The method according to claim 3, characterized in that The preset security protection rules include regular matching rules, and the error results include normal messages that are hit by mistake and abnormal messages that are not hit; The modifying of the preset security protection rule corresponding to the error result includes: Based on the normal message, the scope of the regular matching rule is narrowed so that the regular matching rule after the narrowing of the scope no longer matches the normal message; The scope of the regular matching rule is expanded or modified based on the abnormal message, so that the regular matching rule after the expanded or modified scope can hit the abnormal message.

5. The method according to claim 1, characterized in that The preset security protection rule includes a plurality of sub-rules, and the matching result is that the mirror message successfully matches a target sub-rule among the plurality of sub-rules; After obtaining the matching result, the method further includes: The basic information and blocking information of the mirrored message and the relevant information of the target sub-rule are associated and recorded in a log, so as to be combined with the information of other messages recorded in the log to generate an attack behavior chain.

6. The method according to any one of claims 1 to 5, characterized in that Before determining whether the preset security protection rule needs to be modified according to the matching result, the method further includes: Determine whether the observer mode is turned on, wherein the observer mode is used to indicate that the correctness of the preset security protection rule needs to be verified; If yes, then executing the step of determining whether the preset security protection rule needs to be modified according to the matching result; If not, determining whether to send a blocking message to both transmission parties of the target message according to the matching result.

7. The method according to claim 6, characterized in that The target message is a TCP connection message, and the blocking message is an RST packet; and determining whether to send a blocking message to both transmission parties of the target message according to the matching result includes: When the matching result indicates that the mirrored message matches the preset security protection rule, obtaining the source IP address, source port, destination address, destination port and current sequence number in the mirrored message; Determine the next sequence number of the current sequence number; Using the source IP address and source port as new destination address and destination port, using the destination address and destination port as new source IP address and source port, generating a first RST packet based on the new source IP address, source port, new destination address, destination port and the next sequence number, and sending the first RST packet to the sender of the target message; A second RST packet is generated based on the source IP address, source port, destination address, destination port and the next sequence number, and the second RST packet is sent to a recipient of the target message.

8. The method according to claim 6, characterized in that The method is applied to a bypass blocking device, the bypass blocking device is located between the sender of the target message and the receiver of the target message, and the transmission distance between the bypass blocking device and the sender is shorter than the transmission distance between the bypass blocking device and the receiver; the determining whether to send a blocking message to both transmission parties of the target message according to the matching result includes: When the matching result indicates that the mirror message matches the preset security protection rule, the blocking message is sent to the sender from the current position according to the reverse path of the preset transmission path, and the blocking message is sent to the receiver from the current position according to the preset transmission path, and the preset transmission path is the path for message transmission between the sender and the receiver.

9. A method for detecting network messages, characterized in that: The method comprises: Get mirror messages of network messages; The verification method according to any one of claims 1 to 8 is used to perform verification and pass the preset security protection rules, and the mirror message of the network message is detected to obtain the detection result of the network message.

10. A security protection rule verification device, characterized in that: The device comprises: A first acquisition module, used to acquire a mirror message of a target message; A matching module, used to match the mirrored message with a preset security protection rule to obtain a matching result, wherein the preset security protection rule is used to perform security detection on the network message; A judgment module, used to judge whether the preset security protection rule needs to be modified according to the matching result; if so, enter the correction module; A correction module is used to modify the preset security protection rules based on the matching results.

11. A network message detection device, characterized in that: The device comprises: A second acquisition module, used to acquire a mirror message of a network message; A detection module is used to detect the mirror message of the network message by using the verification method described in any one of claims 1 to 8 and passing the preset security protection rules to obtain the detection result of the network message.

12. An electronic device, characterized in that: The electronic device comprises: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute the method as claimed in any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that: The storage medium comprises: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method as claimed in any one of claims 1 to 9.

Images