Method for verifying security protection rules, and method and device for detecting network message

Abstract

The application provides a security protection rule verification method, a network message detection method and device. The security protection rule verification method comprises: obtaining a mirror message of a target message; matching the mirror message with a preset security protection rule to obtain a matching result, the preset security protection rule being used for security detection of a network message; judging whether the preset security protection rule needs to be modified according to the matching result; if yes, modifying the preset security protection rule based on the matching result. Whether the preset security protection rule needs to be modified is determined through the matching result of the mirror message and the preset security protection rule, and then the preset security protection rule is modified based on the matching result when it is determined that the rule needs to be modified, thereby improving the accuracy of the preset security protection rule.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, and particularly relates to a security protection rule verification method, a network message detection method and device, an electronic device and a storage medium. BACKGROUND

[0002] In a key information infrastructure, there are higher requirements for the security, stability, processing speed and throughput of network devices. In order to protect the information security of network devices, a protection device is connected in series or accessed by a reverse proxy in the network device. However, the protection device running in series in the network device will cause certain network delay to the network device. Therefore, bypass blocking technology emerges as the times require.

[0003] At present, the bypass blocking technology is mainly used to ensure the information security of the network device by connecting the bypass blocking device in the network device in a bypass manner. Specifically, when a client sends a message to a server, the bypass blocking device mirrors the message between the client and the server. After obtaining the mirrored message, the bypass blocking device matches the content in the mirrored message with a pre-set security protection rule. If the matching is successful, the bypass blocking device considers that the message sent by the client to the server has a security problem, and then sends a blocking message to the client and the server to block the communication between the client and the server. If the matching fails, the bypass blocking device considers that the message sent by the client to the server does not have a security problem, and then allows the client to send a message to the server.

[0004] However, in the process of matching the mirrored message with the pre-set security protection rule, since the security protection rule is pre-set by manual operation, there is a problem of inaccurate configuration of the security protection rule, which reduces the accuracy of the security protection rule. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a security protection rule verification method, a network message detection method, a device, an electronic device and a storage medium, so as to improve the accuracy of network message security detection.

[0006] To solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] The first aspect of the present application provides a security protection rule verification method, which comprises: obtaining a mirrored message of a target message; matching the mirrored message with a pre-set security protection rule to obtain a matching result, the pre-set security protection rule being used for security detection of a network message; judging whether the pre-set security protection rule needs to be modified according to the matching result; and if yes, modifying the pre-set security protection rule based on the matching result.

[0008] Compared with the prior art, the verification method of the security protection rule provided in the first aspect of the present application determines whether the preset security protection rule needs to be modified through the matching result of the mirror message and the preset security protection rule, and then modifies the preset security protection rule based on the matching result when it is determined that the rule needs to be modified, thereby improving the accuracy of the preset security protection rule.

[0009] In some modified embodiments of the first aspect of the present application, the preset security protection rule includes a plurality of sub-rules, and the matching result is that the mirror message matches a target sub-rule in the plurality of sub-rules successfully. The method further includes: obtaining a total number of the plurality of sub-rules and a target number of the target sub-rule; determining whether the target number is equal to the total number; if yes, determining that the preset security protection rule does not need to be modified; and if no, determining that the preset security protection rule needs to be modified. The method further includes: deleting sub-rules other than the target sub-rule in the preset security protection rule based on the matching result.

[0010] When the number of sub-rules that match the message is less than the total number of sub-rules in the preset security protection rule, it indicates that some sub-rules in the preset security protection rule do not produce effects in actual detection. These sub-rules may not be suitable for the actual business scenario. Deleting these sub-rules from the preset security protection rule makes the preset security protection rule more practical and more concise, reduces the number of rule matching, and improves the detection efficiency of the preset security protection rule.

[0011] In some modified embodiments of the first aspect of the present application, the method further includes: determining whether there is an error result in the matching result; if yes, determining that the preset security protection rule needs to be modified; and if no, determining that the preset security protection rule does not need to be modified. The method further includes: modifying the preset security protection rule corresponding to the error result based on the matching result.

[0012] If there is an error result in the matching result, the content in the preset security protection rule is modified based on the error result, so that the modified preset security protection rule no longer misjudges the subsequent message, thereby improving the accuracy of the preset security protection rule.

[0013] In some implementation forms of the first aspect of the application, the preset security protection rule comprises a regular matching rule, and the error result comprises a normal message of a false positive and an abnormal message of a false negative; the modifying the preset security protection rule corresponding to the error result comprises: narrowing the range of the regular matching rule based on the normal message, so that the regular matching rule after the range is narrowed no longer hits the normal message; and expanding or modifying the range of the regular matching rule based on the abnormal message, so that the regular matching rule after the range is expanded or modified can hit the abnormal message.

[0014] When the mirror message is hit by the regular matching rule by mistake, it indicates that the range of the regular matching rule is too large and covers the normal message. At this time, the range of the regular matching rule is narrowed according to the normal message of the false positive, and the regular matching rule after the range is narrowed will no longer hit similar messages, thereby improving the accuracy of the preset security protection rule. When the abnormal message is not hit by the regular matching rule, it indicates that the range of the regular matching rule is too small or the range is wrong. At this time, the range of the regular matching rule is expanded or adjusted according to the abnormal message of the false negative, so that similar abnormal messages can be hit subsequently, thereby improving the accuracy of the preset security protection rule.

[0015] In some implementation forms of the first aspect of the application, the preset security protection rule comprises a plurality of sub-rules, and the matching result is that the mirror message matches a target sub-rule in the plurality of sub-rules successfully. After the matching result is obtained, the method further comprises: associating and recording the basic information and blocking information of the mirror message and the related information of the target sub-rule in a log, so as to generate an attack behavior chain in combination with the information of other messages recorded in the log.

[0016] After the mirror message is hit by the rule, the mirror message and the related information of the target sub-rule that is hit are associated and recorded in a log. Subsequently, a plurality of messages can be associated and analyzed through the log to find out an execution chain of an attack behavior, so that the attack behavior can be comprehensively discovered and the security of the network is improved.

[0017] In some implementation forms of the first aspect of the application, before the step of determining whether the preset security protection rule needs to be modified according to the matching result, the method further comprises: determining whether an observer mode is enabled, the observer mode being used to indicate that the correctness of the preset security protection rule needs to be verified; if yes, the step of determining whether the preset security protection rule needs to be modified according to the matching result is performed; and if no, it is determined whether a blocking message is sent to both transmission parties of the target message according to the matching result.

[0018] Through the observer mode, the preset security protection rule can be switched between the debugging mode and the use mode, and the flexibility of debugging the preset security protection rule is improved.

[0019] In some modified embodiments of the first aspect of the application, the target message is a Transmission Control Protocol (TCP) connection message, and the blocking message is a Reset (RST) packet; and the determining, according to the matching result, whether to send a blocking message to both transmission parties of the target message comprises: when the matching result indicates that the mirror message matches the preset security protection rule, obtaining a source IP address, a source port, a destination address, a destination port, and a current sequence number in the mirror message; determining a next sequence number of the current sequence number; taking the source IP address and the source port as new destination addresses and new destination ports, and taking the destination addresses and the destination ports as new source IP addresses and new source ports; generating a first RST packet based on the new source IP addresses and the new source ports, the new destination addresses and the new destination ports, and the next sequence number, and sending the first RST packet to the sender of the target message; and generating a second RST packet based on the source IP address, the source port, the destination address, the destination port, and the next sequence number, and sending the second RST packet to the receiver of the target message.

[0020] In the scenario of a TCP network connection, the verified preset security protection rule is used, when it is determined that the mirror message has a security problem, a sender of the mirror message is simulated based on a source IP address, a source port, a destination address, a destination port, and a current sequence number in the mirror message, an RST packet is generated, and the RST packet is sent to both parties of the message, so that the abnormal message can be accurately blocked between the two parties of the message.

[0021] In some modified embodiments of the first aspect of the application, the method is applied to a bypass blocking device, the bypass blocking device is located between a sender of the target message and a receiver of the target message, a transmission distance between the bypass blocking device and the sender is less than a transmission distance between the bypass blocking device and the receiver; and the determining, according to the matching result, whether to send a blocking message to both transmission parties of the target message comprises: when the matching result indicates that the mirror message matches the preset security protection rule, sending the blocking message to the sender according to a reverse path of a preset transmission path from a current position, and sending the blocking message to the receiver according to the preset transmission path from the current position, the preset transmission path being a path for message transmission between the sender and the receiver.

[0022] By setting the bypass blocking device closer to the message sender, it is ensured that the blocking message sent by the simulated message receiver reaches first, further improving the success rate of connection blocking.

[0023] The second aspect of the present application provides a network message detection method, which comprises: obtaining a mirror message of a network message; and detecting the mirror message of the network message by using a preset security protection rule that has passed the verification method in the first aspect to obtain a detection result of the network message.

[0024] The third aspect of the present application provides a security protection rule verification device, which comprises: a first obtaining module for obtaining a mirror message of a target message; a matching module for matching the mirror message with a preset security protection rule to obtain a matching result, wherein the preset security protection rule is used for security detection of a network message; a judging module for judging whether the preset security protection rule needs to be modified according to the matching result; if yes, entering a correction module; and the correction module for modifying the preset security protection rule based on the matching result.

[0025] The fourth aspect of the present application provides a network message detection device, which comprises: a second obtaining module for obtaining a mirror message of a network message; and a detection module for detecting the mirror message of the network message by using a preset security protection rule that has passed the verification method in the first aspect to obtain a detection result of the network message.

[0026] The fifth aspect of the present application provides an electronic device, which comprises: a processor, a memory and a bus; wherein the processor, the memory and the bus complete communication with each other; the processor is used for calling program instructions in the memory to execute the method in the first aspect or the second aspect.

[0027] The sixth aspect of the present application provides a computer readable storage medium, which comprises: stored programs; wherein when the programs run, the device where the storage medium is located executes the method in the first aspect or the second aspect.

[0028] The network message detection method provided by the second aspect of the present application, the security protection rule verification device provided by the third aspect, the network message detection device provided by the fourth aspect, the electronic device provided by the fifth aspect and the computer readable storage medium provided by the sixth aspect have the same or similar technical effects as the security protection rule verification method provided by the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0029] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which a number of embodiments of the present application are shown by way of example, in which like reference numerals refer to like elements, and wherein:

[0030] Figure 1 A schematic diagram of an application scenario of the security protection rule verification method and the network message detection method in the embodiments of the present application;

[0031] Figure 2 A flowchart of the security protection rule verification method in the embodiments of the present application Figure 1 ;

[0032] Figure 3 A flowchart of the security protection rule verification method in the embodiments of the present application Figure 2 ;

[0033] Figure 4 A flowchart of the network message detection method in the embodiments of the present application;

[0034] Figure 5 A structural diagram of the security protection rule verification apparatus in the embodiments of the present application Figure 1 ;

[0035] Figure 6 A structural diagram of the security protection rule verification apparatus in the embodiments of the present application Figure 2 ;

[0036] Figure 7 A structural diagram of the network message detection apparatus in the embodiments of the present application;

[0037] Figure 8 A structural diagram of the electronic device in the embodiments of the present application. DETAILED DESCRIPTION

[0038] Example embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. If the present disclosure is implemented in various forms, it is to be understood that the present disclosure should not be interpreted as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0039] Note that the technical and scientific terms used in the present application should be understood as having their ordinary meanings to those skilled in the art unless otherwise defined.

[0040] Currently, the preset security protection rules used for security monitoring of network messages are manually set. The manually set security protection rules may have the problem of inaccurate rule setting.

[0041] Therefore, the embodiments of the present application provide a security protection rule verification method, a network message detection method, an apparatus, an electronic device, and a storage medium. In the process of detecting network messages using preset security protection rules, the accuracy of the preset security protection rules is verified through the matching result of the network messages and the preset security protection rules, so as to ensure the accuracy of the preset security protection rules in the process of monitoring network messages.

[0042] First, the application scenarios of the security protection rule verification method and the network message detection method provided by the embodiments of the present application are described.

[0043] Figure 1 For the application scenarios of the security protection rule verification method and the network message detection method in the embodiments of the present application, refer to FIG. 1, which shows that the scenario can include a client 11, a server 12, and a bypass blocking device 13. Figure 1

[0044] When the client 11 sends a message a to the server 12, the bypass blocking device 13 performs mirror processing on the message a in the path sent by the client 11 to the server 12, and obtains a mirror message. The bypass blocking device 13 matches the mirror message with a preset security protection rule. If the matching is successful, a blocking message is generated based on the content in the message a, and the blocking message is sent to the client 11 and the server 12, respectively. In this way, for the client 11, when the blocking message is received, it is considered that the server 12 wants to disconnect with it. For the server 12, when the blocking message is received, it is considered that the client 11 sends a disconnection indication again. Thus, the disconnection of the client 11 and the server 12 is realized. If the matching fails, it means that the client 11, the server 12, and the message a have no security problem, and the bypass blocking device 13 does not process the message a. The client 11 can normally communicate with the server 12.

[0045] Similarly, the server 12 sends a message b to the client 11 or other devices in the network, and the bypass blocking device 13 continues to perform mirror processing on the message b, so as to match the mirror message of the message b with the preset security protection rule, to determine whether there is a security problem in the communication through the message b.

[0046] ​No matter the message a or the message b, it is needed to match with the preset security protection rule, therefore, the accuracy of the preset security protection rule will affect the accuracy of the communication security judgment, therefore, it is needed to match a plurality of messages with the preset security protection rule, and then verify the accuracy of the preset security protection rule based on the matching result, and correct the preset security protection rule in the case that it is determined that the preset security protection rule has errors. The corrected security protection rule is used for security detection of the network message, and therefore the accuracy of the network message security detection is improved.

[0047] Next, the verification method of the security protection rule provided by the embodiment of the application is described in detail.

[0048] Figure 2 The flow of the verification method of the security protection rule in the embodiment of the application is shown in Figure 1 , and the method can include: Figure 2

[0049] S21: Acquire the mirror message of the target message.

[0050] The target message here can be a plurality of messages transmitted in real time or historically in a preset network range. The preset network range refers to the coverage range of the network that needs to be monitored for network message security. It can be a specified area in a public network, or a certain private network.

[0051] When the mirror message of the target message is acquired, a light splitting device can be arranged at the port where the external network core switch is connected to the operator (i.e. the server operator), and the target message is split by the light splitting device to obtain the mirror message. Other existing data duplication technologies can also be used to acquire the mirror message of the target message.

[0052] S22: Match the mirror message with the preset security protection rule to obtain a matching result.

[0053] The preset security protection rule is used for security detection of the network message. The preset security protection rule can specifically be a collection of some features and behaviors, for example: source IP address, source port, destination IP address, destination port extracted from the messages with security problems found in history, IP address, port, malicious behavior features obtained from intelligence data, etc.

[0054] The mirror message is matched with the preset security protection rule, and in the obtained matching result, either the mirror message matches the preset security protection rule, which means that the mirror message has a security problem, or the mirror message does not match the preset security protection rule, which means that the mirror message does not have a security problem.

[0055] ​S23: According to the matching result, it is judged whether the preset security protection rule needs to be modified. If yes, S24 is executed, and if no, S25 is executed.

[0056] In the matching result, either the mirror message matches the preset security protection rule or the mirror message does not match the preset security protection rule. Regardless of whether the mirror message matches the preset security protection rule, since the preset security protection rule is set by human, there may be some errors, and thus, errors exist in the matching result. For example, the mirror message actually does not exist a security problem, but due to the preset security protection rule setting error, the mirror message hits the rule, and thus, the mirror message is mistakenly considered to exist a security problem. For another example, the mirror message actually exists a security problem, but due to the preset security protection rule setting error, the mirror message is not detected, and thus, the message existing a security problem is missed. Therefore, it is needed to judge whether the preset security protection rule exists a problem according to the matching result, so as to modify the rule existing a problem.

[0057] When it is judged whether the preset security protection rule needs to be modified, the hit condition in the matching result needs to be analyzed. On one hand, the mirror message hitting the rule in the matching result can be analyzed by human to confirm whether the mirror message actually exists a security problem, and when it is confirmed that the mirror message does not exist a security problem, it is determined that the preset security protection rule is configured incorrectly and needs to be modified. On the other hand, the mirror message not hitting the rule in the matching result can also be analyzed by human to confirm whether the mirror message actually exists a security problem, and when it is confirmed that the mirror message exists a security problem, it is determined that the preset security protection rule is configured incorrectly and needs to be modified. On the other hand, it is also possible to check whether the rule not hitting the message is configured redundantly to simplify the rule.

[0058] S24: The preset security protection rule is modified based on the matching result.

[0059] When the mirror message without a security problem exists in the matching result and is hit by the rule, the feature of the mirror message included in the rule needs to be deleted.

[0060] When the mirror message with a security problem exists in the matching result and is not hit by the rule, the feature of the mirror message needs to be added in the rule.

[0061] When it is found according to the matching result that the rule in the preset security protection rule does not exist or is rarely used, the rule can be deleted.

[0062] For different situations in the matching result, different measures are taken for the preset security protection rule, which needs to be determined according to the actual situation in the matching result, and here is not specifically limited.

[0063] S25: End.

[0064] When there is no mirror message judgment error in the matching result, or all rules are fully used, it indicates that the preset security protection rule currently has no problem and does not need to be modified.

[0065] From the above, the verification method of the security protection rule provided in the embodiments of the present application determines whether the preset security protection rule needs to be modified through the matching result of the mirror message and the preset security protection rule, and then modifies the preset security protection rule based on the matching result when it is determined that the rule needs to be modified, thereby improving the accuracy of the preset security protection rule.

[0066] Further, as a refinement and expansion of the method shown in Figure 2 , the embodiments of the present application also provide a verification method of a security protection rule.

[0067] Figure 3 For the flow of the verification method of the security protection rule in the embodiments of the present application Figure 2 , see Figure 3 shown, the method can include:

[0068] S31: Obtain a mirror message of a target message.

[0069] S32: Match the mirror message with a preset security protection rule to obtain a matching result.

[0070] Steps S31 and S32 have the same specific implementation as steps S21 and S22 described above, and the related descriptions in steps S21 and S22 can be referred to, which will not be repeated here.

[0071] S33: Determine whether the observer mode is enabled. If yes, execute S34, and if no, execute S35.

[0072] The observer mode is used to indicate that the correctness of the preset security protection rule needs to be verified.

[0073] Before formal security detection of network messages, a trial run can be performed, that is, the observer mode is enabled. After the observer mode is enabled, the matching result of some messages in the preset network range can be used to determine whether the preset security protection rule is accurate, so as to achieve the purpose of verifying, modifying and improving the accuracy of the preset security protection rule.

[0074] In the process of judging whether the observer mode is started, the preset identifier in the bypass blocking device can be used for judgment. Specifically, when the observer mode is not started, the identifier can be defaulted as 0. When the user starts the observer mode, the identifier is automatically adjusted to 1. The specific content of the identifier here is only an example, and the identifier with different content can be configured according to the actual situation. Of course, other mode identification methods can also be used to judge whether the bypass blocking device starts the observer mode.

[0075] In actual application, the preset security protection rule is not only one rule, but also a plurality of rules. That is, the preset security protection rule includes a plurality of sub-rules. The mirror message is matched with the plurality of sub-rules respectively, and the target sub-rule matched successfully with the mirror message forms a matching result.

[0076] S34: The basic information and blocking information of the mirror message and the related information of the target sub-rule are associated and recorded in the log, so as to generate an attack behavior chain in combination with the information of other messages recorded in the log.

[0077] In the log, the basic information and blocking information of the mirror message matched successfully and the related information of the corresponding target sub-rule are recorded. The basic information of the mirror message can include: source Internet Protocol (IP) address, source port, destination IP address, destination port, etc. The blocking information of the mirror message can include: blocked Hypertext Transfer Protocol (HTTP) Uniform Resource Locator (URL), blocked HOST, blocked times, blocked time, etc. The related information of the target sub-rule can include: Identity Document (ID), etc.

[0078] In the log, in addition to the various information of the mirror message and the target sub-rule hit by it, other messages and the sub-rules hit by them are also recorded. One message may not be able to accurately infer the attack behavior chain, but multiple messages can infer the attack behavior chain. For example: through the mirror message and the target sub-rule hit by it, it can only be determined that the target IP failed to log in the system at 5 o'clock on January 20, 2024. This is a single login failure behavior. However, through correlation analysis, through other messages in the log and the rules hit by them, it is also found that the target IP failed to log in the system at 4 o'clock on January 19, 2024, and the target IP failed to log in the system at 6 o'clock on January 18, 2024. Therefore, it can be found that the target IP will try to log in the system every day at dawn recently, so that the attack can be prevented in a targeted manner.

[0079] S35: determining whether to send a blocking message to both the sender and the receiver of the target message according to the matching result of the mirror message.

[0080] In the case where it is determined that the observer mode is not started, it is explained that the preset security protection rule is being used to perform security detection on the target message at this time, and therefore, whether to send a blocking message to the sender and the receiver of the target message can be determined according to the matching result of the current target message and the preset security protection rule. When the matching result indicates that the target message matches the preset security protection rule, a blocking message needs to be sent to the sender and the receiver of the target message. When the matching result indicates that the target message does not match the preset security protection rule, no further operation is performed, and the next message in the network is continuously subjected to mirroring, rule matching, blocking, and the like.

[0081] After step S34, i.e., in the observer mode, after the matched mirror message is recorded in the log, the correctness of the preset security protection rule needs to be verified based on the content in the log.

[0082] S36: determining whether the preset security protection rule needs to be modified according to the matching result. If yes, S37 is performed, and if no, S38 is performed.

[0083] When determining whether the preset security protection rule needs to be modified according to the matching result, two aspects can be considered. On one hand, whether the rule is fully utilized. On the other hand, whether there is a false positive or a false negative.

[0084] For the first aspect, the preset security protection rule includes a plurality of sub-rules, and the matching result indicates that the mirror message matches a target sub-rule in the plurality of sub-rules. The above step S36 can include:

[0085] Step A1: obtaining a total number of the plurality of sub-rules and a target number of the target sub-rule.

[0086] Step A2: determining whether the target number is equal to the total number. If yes, step A3 is performed, and if no, step A4 is performed.

[0087] Step A3: determining that the preset security protection rule does not need to be modified.

[0088] Step A4: determining that the preset security protection rule needs to be modified.

[0089] The preset security protection rule includes a plurality of sub-rules. In actual application scenarios, these sub-rules are not all useful. That is, only part of the plurality of sub-rules is applicable to the current scenario. Therefore, some irrelevant sub-rules in the preset security protection rule that are not used in the actual scenario need to be found out and deleted.

[0090] For example, it is assumed that 1000 sub-rules are included in the preset security protection rule. It is known from the matching result that 600 sub-rules of the preset security protection rule are hit by the message. The 600 sub-rules hit by the message are less than the 1000 sub-rules in the preset security protection rule. This indicates that 400 sub-rules of the 1000 sub-rules are not actually useful in this scenario. The 400 sub-rules can be deleted from the preset security protection rule. In this way, the matching efficiency of subsequent messages and the preset security protection rule can be accelerated. The message is matched with the original preset security protection rule, and 1000 times of rule matching are required. The message is matched with the preset security protection rule at present, and only 600 times of rule matching are required. The matching efficiency naturally increases as the number of matching times decreases. Moreover, the reduced sub-rules are sub-rules that are not actually useful, and the accuracy of security detection is not affected.

[0091] For the second aspect, the above step S36 can include:

[0092] Step B1: determining whether there is an error result in the matching result. If yes, step B2 is performed, and if no, step B3 is performed.

[0093] Step B2: determining that the preset security protection rule needs to be modified.

[0094] Step B3: determining that the preset security protection rule does not need to be modified.

[0095] In the specific judgment process, the matching result can be fed back to the communication parties or artificial, and the judgment is performed according to the error feedback or the result of re-inspection by the communication parties or artificial. When the mirrored message hits the rule, the message is considered to have a security problem, and the communication between the message parties is blocked. If one or both of the communication parties feedback that there is a blocking error, it is determined that the matching is incorrect, and it is determined that there is an error result in the matching result. Alternatively, the message and the rule in each result in the matching result are re-inspected, and the IP address and specific content are re-inspected. If it is found that the IP address is normal business or the specific content is not attackable, it is determined that the matching is incorrect, and it is determined that there is an error result in the matching result. In this way, the corresponding rule needs to be corrected (modified or deleted). If no error result is found in the matching result through the above methods, it is determined that the current security protection rule is not incorrect, and the current security protection rule can be used for security detection without correcting the rule.

[0096] S37: deleting the sub-rules in the preset security protection rule except the target sub-rule, or modifying the preset security protection rule corresponding to the error result.

[0097] S38: maintaining the preset security protection rule unchanged.

[0098] In actual application, the preset security protection rule can be an IP address or a regular matching rule. When the preset security protection rule is an IP address, if the matched message is a normal message, i.e., the IP address in the message belongs to normal business, the IP address is deleted from the preset security protection rule. When the preset security protection rule is a regular matching rule, if the matched message does not have a security problem, i.e., the matched message is a false negative message, it indicates that the regular matching rule has an over-matching problem, and the range of the regular matching rule needs to be reduced. If the message with a security problem is not hit by the rule, it indicates that the regular matching rule has a missing-matching problem, and the range of the regular matching rule needs to be expanded or adjusted.

[0099] Specifically, the step S37 can include:

[0100] Step C1: reducing the range of the regular matching rule based on the normal message, so that the regular matching rule after the range is reduced no longer hits the normal message.

[0101] For example, assuming that a regular matching rule is: [1-9][1-9]... repeat 18 times. The rule is used to identify sensitive information in a message, i.e., an ID card number. If the rule is hit, it indicates that the message has sensitive information, and needs to be blocked. For the rule, [1-9] means matching any digit from 1 to 9. However, under the rule, the matched is a continuous 18-digit number, which is not necessarily an ID card number. Because each digit of the ID card number has a special meaning. Therefore, the range of the regular matching rule needs to be reduced, and the reduced rule can be: / (^[1-9]\d{5}(18|19|(

[23] \d))\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}[0-9Xx]$)|(^[1-9]\d{5}\d{2}((0[1-

[0102] 9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}$) / .

[0103] Step C2: expanding or modifying the range of the regular matching rule based on the abnormal message, so that the regular matching rule after the range is expanded or modified can hit the abnormal message.

[0104] ​For example, assume that a regular matching rule is configured to identify sensitive information of a user, and the current regular matching rule is configured to identify 18-digit numbers. If the sensitive information of the user includes not only an ID number but also a phone number, the current regular matching rule cannot match a mirror message that contains a phone number, and thus the mirror message bypasses the detection. In this case, the current regular matching rule needs to be expanded to include not only 18-digit numbers but also 11-digit numbers.

[0105] For another example, assume that a regular matching rule is configured to identify abnormal behavior, and the current regular matching rule is configured to identify login to a system at a non-working time. Sometimes, a user needs to log in to the system at a non-working time due to work reasons, and in this case, a mirror message related to the login at the non-working time is misjudged. In this case, the current regular matching rule needs to be adjusted to identify a preset number of login failures.

[0106] In this way, in the observer mode, the preset security protection rule is verified and corrected.

[0107] Next, the message processing manner in the non-observer mode is described.

[0108] In step S35, when the mirror message matches the preset security protection rule, it indicates that the target message has a security problem, and the connection between the communication parties of the target message needs to be blocked. When the mirror message does not match the preset security protection rule, it indicates that the target message does not have a security problem, and the communication parties of the target message do not need to be interfered.

[0109] Specifically, in a TCP connection scenario, the target message is a TCP connection message, and the blocking message is an RST packet. Step S35 can include the following steps.

[0110] Step D1: When the matching result indicates that the mirror message matches the preset security protection rule, the source IP address, the source port, the destination address, the destination port, and the current sequence number in the mirror message are obtained.

[0111] Here, the matching can refer to that the source IP address, the source port, the destination address, or the destination port in the mirror message matches the IP address or the port in the rule, or that the content in the mirror message matches the feature in the rule. When the mirror message matches the preset security protection rule, it indicates that the target message corresponding to the mirror message has a security problem, and the communication parties of the target message need to be blocked.

[0112] And the communication between the two parties is blocked, that is, the connection between the two parties is disconnected. In the TCP scenario, it is to simulate one of the communications and send an RST packet to the other party of the communication. The RST packet is a special TCP packet that also contains some information in the TCP packet, so the source IP address, source port, destination address, destination port and current sequence number need to be obtained from the mirror message to accurately simulate the communication between the parties. And the specific way to extract the source IP address, source port, destination address, destination port and current sequence number from the mirror message can use existing information parsing or extraction technology, which will not be described here.

[0113] Step D2: Determine the next sequence number of the current sequence number.

[0114] In a TCP connection, the communication parties include the request party and the response party, and the request party and the response party will perform three handshakes when sending messages. The first handshake is that the request party sends a message to the response party, which carries the IP address, port of the request party, IP address, port of the response party, SYN=j, etc. The second handshake is that the response party sends a message to the request party, which carries the IP address, port of the response party, IP address, port of the request party, ACK=j+1, SYN=k, etc. The third handshake is that the request party sends a message to the response party, which carries the IP address, port of the request party, IP address, port of the response party, ACK=k+1, etc. Here, SYN or ACK is the current sequence number, and SYN or ACK in the next handshake is the next sequence number.

[0115] For example: Assuming that the target message is the message sent by the request party to the response party in the first handshake described above. j is the current sequence number, and k is the next sequence number.

[0116] For another example: Assuming that the target message is the message sent by the response party to the request party in the second handshake described above. k is the current sequence number, and k+1 is the next sequence number.

[0117] Step D3: Take the source IP address and the source port as the new destination address and the new destination port, take the destination address and the destination port as the new source IP address and the new source port, generate a first RST packet based on the new source IP address, the new source port, the new destination address, the new destination port and the next sequence number, and send the first RST packet to the sender of the target message.

[0118] That is, the source and destination IP addresses are converted to each other, the source and destination ports are converted to each other, the message receiver is imitated, and an RST packet (RST flag position is 1) is sent to the message sender to block the connection between the two parties.

[0119] Step D4: generating a second RST packet based on the source IP address, the source port, the destination address, the destination port and the next sequence number, and sending the second RST packet to the recipient of the target message.

[0120] That is, after the message sender sends the target message to the message recipient, the message sender is imitated again to send an RST packet (the RST flag is set to 1) to the message recipient again to block the connection between the two parties.

[0121] In actual application, since the RST packet is sent by imitating the message sender or the message recipient, in order to ensure that the RST packet arrives first before the message feedback from the message recipient, the bypass blocking device is located between the sender of the target message and the recipient of the target message, and the transmission distance between the bypass blocking device and the sender is less than the transmission distance between the bypass blocking device and the recipient.

[0122] Specifically, the above step S35 can include:

[0123] Step E: when the matching result indicates that the mirror message matches the preset security protection rule, sending the blocking message to the sender from the current position according to the reverse path of the preset transmission path, and sending the blocking message to the recipient from the current position according to the preset transmission path.

[0124] The preset transmission path is a path for message transmission between the sender and the recipient.

[0125] For example, it is assumed that the preset transmission path for transmitting the target message from the sender to the recipient needs to pass through route 1, route 2, route 3 and route 4 in sequence. The bypass blocking device is arranged at route 1 or route 2. When it is determined that the target message has a security problem, the bypass blocking device can imitate the recipient to send a blocking message directly to the sender from route 1 or from route 2 through route 1. Compared with the case that the recipient sends a real response message to the sender through route 4, route 3, route 2 and route 1, the number of routes passed through is reduced, so that the blocking message received by the sender arrives first before the response message. And the bypass blocking device imitates the sender to send a blocking message to the recipient, which arrives at the recipient after the target message.

[0126] Of course, the bypass blocking device can also be arranged near the message recipient, that is, the transmission distance between the bypass blocking device and the recipient of the target message is less than the transmission distance between the bypass blocking device and the sender of the target message. In this way, when it is determined that the target message has a security problem, the blocking message sent by the bypass blocking device imitating the recipient to the sender will also arrive first before the response message.

[0127] Up to now, the verification method of the security protection rule provided by the embodiment of the present application has been fully described.

[0128] Based on the same inventive concept, the embodiment of the present application further provides a network message detection method.

[0129] Figure 4 For the flowchart of the network message detection method in the embodiment of the present application, referring to Figure 4 , the method can include:

[0130] S41: Obtain a mirror message of the network message.

[0131] After the preset security protection rule is verified by using the verification method in the foregoing embodiment, the preset security protection rule that passes the verification can be used to perform security detection on the message transmitted in the preset network.

[0132] The network message herein can be the message transmitted in the preset network after the preset security protection rule passes the verification, or the message transmitted in the preset network when the preset security protection rule is verified, that is, the message detection is performed while the rule verification is performed. The specific reference of the network message is not limited herein.

[0133] After the network message is monitored, the network message can be mirrored to obtain a mirror message. The specific mirroring manner of the message is a conventional data mirroring manner, which is not described herein.

[0134] S42: Perform detection on the mirror message of the network message by using the preset security protection rule that passes the verification by using the verification method in the foregoing embodiment, to obtain a detection result of the network message.

[0135] After the mirror message is obtained, the mirror message is matched with the preset security protection rule. Since the preset security protection rule contains the features of the message with security problems, if the mirror message is successfully matched with the preset security protection rule, it indicates that the mirror message has security problems, and it is further determined that the corresponding network message has security problems, and the message parties need to be blocked. If the mirror message fails to be matched with the preset security protection rule, it indicates that the mirror message does not have security problems, and it is further determined that the corresponding network message does not have security problems, so that the corresponding network message can continue to circulate.

[0136] From the foregoing, the network message detection method provided by the embodiment of the present application can improve the accuracy of network message security detection by using the preset security protection rule that passes the verification to perform security detection on the network message after the preset security protection rule passes the verification.

[0137] Based on the same inventive concept, as an implementation of the foregoing verification method, the embodiment of the present application further provides a security protection rule verification device.

[0138] Figure 5This is a schematic diagram of the structure of the verification device for security protection rules in the embodiments of this application. Figure 1 See Figure 5 As shown, the device may include: a first acquisition module 51, a matching module 52, a judgment module 53, and a correction module 54. The first acquisition module 51, the matching module 52, the judgment module 53, and the correction module 54 are connected sequentially.

[0139] The first acquisition module 51 is used to acquire the mirror message of the target message.

[0140] The matching module 52 is used to match the mirror message with preset security protection rules to obtain a matching result. The preset security protection rules are used to perform security detection on network messages.

[0141] The judgment module 53 is used to determine whether the preset security protection rule needs to be modified based on the matching result. If so, the process proceeds to the correction module 54.

[0142] The correction module 54 is used to modify the preset security protection rules based on the matching results.

[0143] Furthermore, as a response to Figure 5 In addition to the refinement and expansion of the illustrated device, this application embodiment also provides a verification device for security protection rules.

[0144] Figure 6 This is a schematic diagram of the structure of the verification device for security protection rules in the embodiments of this application. Figure 2 See Figure 6 As shown, the device may include: a first acquisition module 61, a matching module 62, a mode module 63, a log module 64, a blocking module 65, a judgment module 66, and a correction module 67. The first acquisition module 61, matching module 62, mode module 63, log module 64, judgment module 66, and correction module 67 are connected sequentially. The blocking module 65 is connected to the mode module 63.

[0145] The first acquisition module 61 is used to acquire the mirror message of the target message.

[0146] The matching module 62 is used to match the mirror message with preset security protection rules to obtain a matching result. The preset security protection rules are used to perform security detection on network messages.

[0147] The mode module 63 is used to determine whether the observer mode is enabled. The observer mode is used to indicate that the correctness of the preset security protection rules needs to be verified. If yes, it proceeds to the log module 64; otherwise, it proceeds to the blocking module 65.

[0148] When the preset security protection rule comprises a plurality of sub-rules, and the matching result is that the mirror message matches a target sub-rule in the plurality of sub-rules successfully, the log module 64 is configured to associate and record the basic information and blocking information of the mirror message and the related information of the target sub-rule in a log, so as to generate an attack behavior chain in combination with the information of other messages recorded in the log.

[0149] The blocking module 65 is configured to determine whether to send a blocking message to both transmission parties of the target message according to the matching result.

[0150] The judgment module 66 comprises a first judgment unit 661 and a second judgment unit 662.

[0151] When the preset security protection rule comprises a plurality of sub-rules, and the matching result is that the mirror message matches a target sub-rule in the plurality of sub-rules successfully, the first judgment unit 661 is configured to acquire a total number of the plurality of sub-rules and a target number of the target sub-rule; determine whether the target number is equal to the total number; if yes, determine that the preset security protection rule does not need to be modified; and if no, determine that the preset security protection rule needs to be modified.

[0152] The second judgment unit 662 is configured to determine whether there is an error result in the matching result; if yes, determine that the preset security protection rule needs to be modified; and if no, determine that the preset security protection rule does not need to be modified.

[0153] The correction module 67 is configured to, when it is determined that the preset security protection rule needs to be modified, delete the sub-rules other than the target sub-rule in the preset security protection rule, or modify the preset security protection rule corresponding to the error result.

[0154] When the preset security protection rule comprises a regular matching rule, and the error result comprises a normal message of false positive and an abnormal message of false negative, the correction module 67 is specifically configured to narrow the range of the regular matching rule based on the normal message, so that the regular matching rule after the range is narrowed no longer hits the normal message; and expand or modify the range of the regular matching rule based on the abnormal message, so that the regular matching rule after the range is expanded or modified can hit the abnormal message.

[0155] When the target message is a TCP connection message, and the blocking message is an RST packet, the blocking module 65 comprises an extraction unit 651, a determination unit 652, a first sending unit 653 and a second sending unit 654. The extraction unit 651, the determination unit 652 and the first sending unit 653 are connected in sequence, and the second sending unit 654 is connected to the determination unit 652.

[0156] The extraction unit 651 is configured to acquire a source IP address, a source port, a destination address, a destination port and a current sequence number in the mirror message when the matching result indicates that the mirror message matches the preset security protection rule.

[0157] The determination unit 652 is configured to determine a next sequence number of the current sequence number.

[0158] The first sending unit 653 is configured to take the source IP address and the source port as new destination address and destination port, take the destination address and the destination port as new source IP address and source port, generate a first RST packet based on the new source IP address, the new destination address, the new source port and the new destination port and the next sequence number, and send the first RST packet to a sender of the target message.

[0159] The second sending unit 654 is configured to generate a second RST packet based on the source IP address, the source port, the destination address, the destination port and the next sequence number, and send the second RST packet to a receiver of the target message.

[0160] When the method is applied to a bypass blocking device between the sender of the target message and the receiver of the target message, and the transmission distance between the bypass blocking device and the sender is less than the transmission distance between the bypass blocking device and the receiver, the blocking module 65 is specifically configured to send the blocking message to the sender from a current position according to a reverse path of a preset transmission path when the matching result indicates that the mirror message matches the preset security protection rule, and send the blocking message to the receiver from the current position according to the preset transmission path, the preset transmission path being a path for message transmission between the sender and the receiver.

[0161] It should be noted that the above description of the verification device embodiment is similar to the description of the above verification method embodiment, and has similar beneficial effects to the verification method embodiment. For technical details not disclosed in the verification device embodiment of the present application, please refer to the description of the verification method embodiment of the present application.

[0162] Based on the same inventive concept, as an implementation of the above detection method, the embodiments of the present application also provide a network message detection device.

[0163] Figure 7 For the structural schematic diagram of the network message detection device in the embodiments of the present application, refer to Figure 7 As shown in the figure, the device can include a second acquisition module 71 and a detection module 72. The second acquisition module 71 is connected to the detection module 72.

[0164] The second obtaining module 71 is configured to obtain a mirror message of a network message.

[0165] The detecting module 72 is configured to detect the mirror message of the network message by using the verification method in the foregoing embodiments and a preset security protection rule after the verification is passed, to obtain a detection result of the network message.

[0166] It should be noted that the description of the foregoing detection device embodiments is similar to the description of the foregoing detection method embodiments, and has similar beneficial effects to the detection method embodiments. For technical details in the detection device embodiments of the present application that are not disclosed, please refer to the description of the detection method embodiments of the present application for understanding.

[0167] Based on the same inventive concept, the embodiments of the present application further provide an electronic device. Figure 8 For a structural schematic diagram of the electronic device in the embodiments of the present application, refer to Figure 8 As shown in the figure, the electronic device can include a processor 81, a memory 82, and a bus 83; wherein the processor 81 and the memory 82 complete mutual communication through the bus 83; the processor 81 is configured to invoke program instructions in the memory 82 to execute the method in one or more of the foregoing embodiments.

[0168] It should be noted that the description of the foregoing electronic device embodiments is similar to the description of the foregoing method embodiments, and has similar beneficial effects to the method embodiments. For technical details in the electronic device embodiments of the present application that are not disclosed, please refer to the description of the method embodiments of the present application for understanding.

[0169] Based on the same inventive concept, the embodiments of the present application further provide a computer readable storage medium, which can include a stored program; wherein when the program is running, the device where the storage medium is located executes the method in one or more of the foregoing embodiments.

[0170] It should be noted that the description of the foregoing storage medium embodiments is similar to the description of the foregoing method embodiments, and has similar beneficial effects to the method embodiments. For technical details in the storage medium embodiments of the present application that are not disclosed, please refer to the description of the method embodiments of the present application for understanding.

[0171] The foregoing is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for verifying security protection rules, characterized in that, The method includes: In observer mode, a mirror message of the target message is obtained. The target message is some messages within a preset network range. Observer mode is used to indicate that the correctness of the preset security protection rules needs to be verified. The mirrored message is matched with a preset security protection rule to obtain a matching result. The preset security protection rule is used to perform security detection on network messages. Based on the matching results, determine whether the preset security protection rules need to be modified; If so, the preset security protection rule is modified based on the matching result; The step of determining whether the preset security protection rule needs to be modified based on the matching result includes: The matching results are fed back to both communicating parties. If one or both parties report a blocking error, it is determined that there is an erroneous result in the matching results. Furthermore, the mirrored messages that match the rules in the matching results are manually analyzed to confirm whether the mirrored messages do indeed have security issues. If it is confirmed that the mirrored messages do not have security issues, it is determined that the preset security protection rule configuration is incorrect and needs to be corrected. Conversely, the mirrored messages that do not match the rules in the matching results are manually analyzed to confirm whether the mirrored messages do indeed have security issues. If it is confirmed that the mirrored messages have security issues, it is determined that the preset security protection rule configuration is incorrect and needs to be corrected.

2. The method according to claim 1, characterized in that, The preset security protection rules include multiple sub-rules, and the matching result is that the mirror message successfully matches the target sub-rule among the multiple sub-rules; The step of determining whether the preset security protection rule needs to be modified based on the matching result includes: Obtain the total number of the multiple sub-rules and the target number of the target sub-rules; Determine whether the target quantity is equal to the total quantity; If so, then it is determined that there is no need to modify the preset security protection rules; If not, then it is determined that the preset security protection rules need to be modified; Modifying the preset security protection rule based on the matching result includes: Delete all sub-rules in the preset security protection rules except for the target sub-rule.

3. The method according to claim 1, characterized in that, The step of determining whether the preset security protection rule needs to be modified based on the matching result includes: Determine whether there are any erroneous results in the matching results; If so, then it is determined that the preset security protection rules need to be modified; If not, then it is determined that there is no need to modify the preset security protection rules; Modifying the preset security protection rule based on the matching result includes: Modify the preset security protection rules corresponding to the erroneous results.

4. The method according to claim 3, characterized in that, The preset security protection rules include regular expression matching rules, and the error results include normal messages that are falsely matched and abnormal messages that are not matched. Modifying the preset security protection rules corresponding to the erroneous results includes: The scope of the regular expression matching rule is narrowed based on the normal message, so that the regular expression matching rule after narrowing the scope no longer matches the normal message; The scope of the regular expression matching rule is expanded or modified based on the abnormal message, so that the expanded or modified regular expression matching rule can match the abnormal message.

5. The method according to claim 1, characterized in that, The preset security protection rules include multiple sub-rules, and the matching result is that the mirror message successfully matches the target sub-rule among the multiple sub-rules; After obtaining the matching result, the method further includes: The basic information and blocking information of the mirrored message, as well as the relevant information of the target sub-rule, are associated and recorded in the log so that they can be combined with the information of other messages recorded in the log to generate an attack behavior chain.

6. The method according to any one of claims 1 to 5, characterized in that, Before determining whether the preset security protection rule needs to be modified based on the matching result, the method further includes: Determine whether the observer mode is enabled. The observer mode is used to indicate that the correctness of the preset security protection rules needs to be verified. If so, then proceed with the step of determining whether the preset security protection rule needs to be modified based on the matching result; If not, then determine whether to send a blocking message to both parties transmitting the target message based on the matching result.

7. The method according to claim 6, characterized in that, The target message is a TCP connection message, and the blocking message is an RST packet; determining whether to send a blocking message to both transmitting parties of the target message based on the matching result includes: When the matching result indicates that the mirrored message matches the preset security protection rule, the source IP address, source port, destination address, destination port, and current sequence number in the mirrored message are obtained; Determine the next sequence number for the current sequence number; The source IP address and source port are used as the new destination address and destination port, and the destination address and destination port are used as the new source IP address and source port. A first RST packet is generated based on the new source IP address and source port, the new destination address and destination port, and the next sequence number, and the first RST packet is sent to the sender of the target message. A second RST packet is generated based on the source IP address, source port, destination address, destination port, and the next sequence number, and the second RST packet is sent to the recipient of the target message.

8. The method according to claim 6, characterized in that, The method is applied to a bypass blocking device located between the sender and receiver of the target message, wherein the transmission distance between the bypass blocking device and the sender is less than the transmission distance between the bypass blocking device and the receiver; the step of determining whether to send a blocking message to both parties transmitting the target message based on the matching result includes: When the matching result indicates that the mirror message matches the preset security protection rule, the blocking message is sent to the sender from the current position according to the reverse path of the preset transmission path, and the blocking message is sent to the receiver from the current position according to the preset transmission path. The preset transmission path is the path for message transmission between the sender and the receiver.

9. A method for detecting network messages, characterized in that, The method includes: Retrieve mirrored messages from network messages; The network message's mirror message is detected using a preset security protection rule that has been verified and passed by any one of claims 1 to 8, thereby obtaining the network message's detection result.

10. A verification device for security protection rules, characterized in that, The device includes: The first acquisition module is used to acquire a mirror message of a target message in observer mode. The target message is some messages within a preset network range. Observer mode is used to indicate that the correctness of the preset security protection rules needs to be verified. The matching module is used to match the mirrored message with preset security protection rules to obtain the matching result. The preset security protection rules are used to perform security detection on network messages. The judgment module is used to determine whether the preset security protection rule needs to be modified based on the matching result; if so, it proceeds to the correction module. The correction module is used to modify the preset security protection rules based on the matching results; The judgment module is used to feed back the matching results to both communicating parties. If one or both parties report a blocking error, it determines that there is an erroneous result in the matching results. Furthermore, it manually analyzes the mirrored messages that match the rules in the matching results to confirm whether the mirrored messages do indeed have security issues. If it confirms that the mirrored messages do not have security issues, it determines that the preset security protection rule configuration is incorrect and needs to be corrected. Additionally, it manually analyzes the mirrored messages that do not match the rules in the matching results to confirm whether the mirrored messages do indeed have security issues. If it confirms that the mirrored messages have security issues, it determines that the preset security protection rule configuration is incorrect and needs to be corrected.

11. A device for detecting network messages, characterized in that, The device includes: The second acquisition module is used to acquire mirror messages of network messages; The detection module is used to detect the mirror message of the network message by using the verification method described in any one of claims 1 to 8 and a preset security protection rule after verification, and to obtain the detection result of the network message.

12. An electronic device, characterized in that, The electronic device includes: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the method as described in any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that, The storage medium includes: a stored program; wherein, when the program is executed, it controls the device where the storage medium is located to perform the method as described in any one of claims 1 to 9.

Images