Feature library upgrading method

Abstract

The invention provides a feature library upgrading method, which is applied to a network protection system, the network protection system comprises a first proxy server and at least one network device, the first proxy server is provided with a first cache space, and the feature library upgrading method comprises the following steps: the first proxy server obtains a first feature library from a feature library server; the first feature library is a feature library of the latest version; the first proxy server caches the first feature library in a first cache space; at least one network device downloads the first feature library from the first cache space of the first proxy server, and updates the second feature library based on the first feature library; the second feature library is a feature library to be upgraded. Therefore, the network equipment can directly obtain the feature library from the proxy server for upgrading, the effect of obtaining the feature library at one time and using the feature library for multiple times can be achieved, the upgrading efficiency, the equipment performance and the reliability can be improved, and bandwidth resources can also be saved.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a feature library upgrade method. Background Art

[0002] With the development of network technology, network protection is becoming more and more important to avoid network attacks. At present, network protection is usually carried out through network devices such as intrusion detection system (IDS) and firewall (FW), and feature collection and feature matching are the more important technical means of current network protection. In order to ensure the effectiveness of network protection, it is usually necessary to upgrade the feature libraries such as AV library, vulnerability library, IPS library, etc. in the above network devices.

[0003] However, since the above-mentioned network devices are usually located in a local area network rather than directly exposed to the public network, when upgrading the feature library version of these devices, it is often necessary to access the feature library server through a proxy server to obtain version information from the feature library server, and then upgrade the feature library through a Hypertext Transfer Protocol (HTTP) proxy. That is, when upgrading the feature library version of the above-mentioned network devices, the network device needs to establish a Transmission Control Protocol (TCP) connection with the proxy server. If the establishment fails, it is necessary to try to establish it again. However, the process of trying to connect usually consumes a lot of time, especially when the number of devices is large or a single device needs to upgrade more feature libraries, the time consumed will be even greater. Summary of the invention

[0004] The present application provides a feature library upgrade method that can cache the feature library in a proxy server, so that the network device can directly obtain the feature library upgrade from the proxy server, which can achieve the effect of "obtain once, use multiple times" and improve the upgrade efficiency.

[0005] In a first aspect of the present application, a method for updating a signature database is provided, which is applied to a network protection system, wherein the network protection system includes a first proxy server and at least one network device, wherein the first proxy server is provided with a first cache space, and the method includes:

[0006] The first proxy server obtains a first feature library from a feature library server; the first feature library is the latest version of the feature library;

[0007] The first proxy server caches the first feature library in the first cache space;

[0008] At least one of the network devices downloads the first feature library from the first cache space of the first proxy server, and updates a second feature library based on the first feature library; the second feature library is a feature library to be upgraded.

[0009] In some embodiments, the first proxy server is provided with a timer;

[0010] The first proxy server obtains a first feature library from a feature library server, including:

[0011] The first proxy server periodically accesses the feature library server based on the timer, and updates the first feature library in the first cache space based on the feature library in the feature server to obtain a new first feature library.

[0012] In some embodiments, the method further comprises:

[0013] The first proxy server periodically determines server status information corresponding to the first proxy server based on the timer, and performs an operation corresponding to the server status information based on the server status information.

[0014] In some embodiments, performing an operation corresponding to the server status information based on the server status information includes:

[0015] If the service status information indicates that the first feature library is updated, an upgrade prompt message is sent to the terminal device;

[0016] If the service status information indicates that the first feature library fails to be updated, sending a troubleshooting prompt message corresponding to the first proxy server to the terminal device;

[0017] If the service status information indicates that the first feature library is being updated, then waiting is performed.

[0018] In some embodiments, the at least one network device downloads the first feature library from the first cache space of the first proxy server, including:

[0019] The network device sends a download request to the first proxy server;

[0020] The first proxy server receives the download request sent by the network device, and determines the server status information corresponding to the first proxy server in response to the download request;

[0021] If the service status information indicates that the first feature library is being updated, the first proxy server sends a waiting notification to the network device;

[0022] When receiving the waiting notification, the network device sends a download request to the first proxy server again after a preset time period.

[0023] In some embodiments, if the network protection system further includes at least one proxy server, the method further includes:

[0024] The first proxy server sends the first feature library to each of the second proxy servers;

[0025] Each of the second proxy servers caches the first feature library in the second cache space corresponding to each of the second proxy servers.

[0026] In some embodiments, the method further comprises:

[0027] The first proxy server periodically determines the number of download connections between the first proxy server and at least one of the second proxy servers based on the timer;

[0028] The first proxy server determines a target proxy server from the first proxy server and at least one of the proxy servers based on the number of download connections of the first proxy server and at least one of the second proxy servers respectively;

[0029] If the first proxy server receives the download request sent by the network device, then in response to the download request, response information is generated based on the server address of the target proxy server and sent to the network device;

[0030] When the network device receives the response information, the network device downloads the first feature library from the second cache space corresponding to the target proxy server based on the server address of the target proxy server in the response message.

[0031] In some embodiments, determining a target proxy server from the first proxy server and at least one of the proxy servers based on the number of download connections of each of the first proxy server and at least one of the second proxy servers comprises:

[0032] Based on the respective numbers of download connections of the first proxy server and at least one of the second proxy servers, a proxy server having the smallest number of download connections among the first proxy server and at least one of the second proxy servers is determined as the target proxy server.

[0033] A second aspect of an embodiment of the present application provides a feature library upgrade method, which is applied to a proxy server, and the method includes:

[0034] Obtaining a first feature library from a feature library server; the first feature library is a feature library of the latest version;

[0035] caching the first feature library in a cache space;

[0036] In response to a download request sent by a network device, the first feature library in the cache space is sent to the network device, so that the network device updates a second feature library based on the first feature library; the second feature library is the feature library to be upgraded.

[0037] According to a third aspect of an embodiment of the present application, a method for updating a feature library is provided, which is applied to a network device. The method includes:

[0038] Send a download request to the proxy server;

[0039] Receiving the first feature library sent by the proxy server in response to the download request; the first feature library is the latest version of the feature library obtained by the proxy server from the feature library server and cached in the cache space;

[0040] The second feature library is updated based on the first feature library; the second feature library is the feature library to be upgraded.

[0041] In a fourth aspect of the embodiments of the present application, a proxy server is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method steps described in any one of the above embodiments are implemented.

[0042] In a fifth aspect of an embodiment of the present application, a network device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method steps described in any one of the above embodiments are implemented.

[0043] In a sixth aspect of the embodiments of the present application, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, characterized in that when the computer program is executed by a processor, the method steps described in any of the above embodiments are implemented.

[0044] The embodiment of the present application provides a method for upgrading a feature library, which is applied to a network protection system. The network protection system includes a first proxy server and at least one network device. The first proxy server is provided with a first cache space. The method for upgrading the feature library includes: the first proxy server obtains the first feature library from the feature library server; the first feature library is the latest version of the feature library; the first proxy server caches the first feature library in the first cache space; at least one network device downloads the first feature library from the first cache space of the first proxy server, and updates the second feature library based on the first feature library; the second feature library is the feature library to be upgraded. In this way, the network device can directly obtain the feature library upgrade from the proxy server, and does not need to establish a link with the feature library server through the proxy server every time it is upgraded to obtain the latest version of the feature library from the feature library server. In this way, the effect of "obtaining once and using multiple times" can be achieved, which can improve the upgrade efficiency, device performance and reliability, and can also save bandwidth resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A flowchart of a feature library upgrade method provided in an embodiment of the present application;

[0046] Figure 2 A schematic diagram of an application scenario of a feature library upgrade method provided in an embodiment of the present application;

[0047] Figure 3 A flowchart of another feature library upgrade method provided in an embodiment of the present application;

[0048] Figure 4 A flowchart of another feature library upgrade method provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of an application scenario of another feature library upgrade method provided in an embodiment of the present application;

[0050] Figure 6 A flowchart of another feature library upgrade method provided in an embodiment of the present application;

[0051] Figure 7 A flowchart of another feature library upgrade method provided in an embodiment of the present application;

[0052] Figure 8 A flowchart of another feature library upgrade method provided in an embodiment of the present application;

[0053] Fig. 9 A schematic diagram of the physical structure of a proxy server provided in an embodiment of the present application;

[0054] Fig.10A schematic diagram of the physical structure of a network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application.

[0056] With the development of network technology, network protection is becoming more and more important to avoid network attacks. At present, network protection is usually carried out through network devices such as intrusion detection system (IDS) and firewall (FW), and feature collection and feature matching are the more important technical means of current network protection. In order to ensure the effectiveness of network protection, it is usually necessary to upgrade the feature libraries such as AV library, vulnerability library, IPS library, etc. in the above network devices.

[0057] However, since the above-mentioned network devices are usually located in a local area network rather than directly exposed to the public network, when upgrading the feature library version of these devices, it is often necessary to access the feature library server through a proxy server to obtain version information from the feature library server, and then upgrade the feature library through a Hypertext Transfer Protocol (HTTP) proxy. That is, when upgrading the feature library version of the above-mentioned network devices, the network device needs to establish a Transmission Control Protocol (TCP) connection with the proxy server. If the establishment fails, it is necessary to try to establish it again. However, the process of trying to connect usually consumes a lot of time, especially when the number of devices is large or a single device needs to upgrade more feature libraries, the time consumed will be even greater.

[0058] In order to solve the above-mentioned problem, the present application provides a feature library upgrade method, which can cache the feature library in the proxy server, so that the network device can directly obtain the feature library upgrade from the proxy server, which can achieve the effect of "obtain once, use multiple times" and improve the upgrade efficiency.

[0059] See also Figure 1 The embodiment of the present application provides a method for updating a signature database, which is applied to a network protection system, wherein the network protection system includes a first proxy server and at least one network device, and the first proxy server is provided with a first cache space. The method for updating the signature database includes S101-S103.

[0060] S101. A first proxy server obtains a first feature library from a feature library server.

[0061] S102: The first proxy server caches the first feature library in a first cache space.

[0062] S103: At least one network device downloads a first feature library from a first cache space of a first proxy server, and updates a second feature library based on the first feature library.

[0063] Among them, the first cache space is a storage space opened on the first proxy server for caching the latest version of the feature library obtained by the first proxy server from the feature server. The size of the cache space can be determined according to the version size and number of the feature library that needs to be upgraded to ensure that the cache space can accommodate all the latest feature library version files, such as virus libraries, vulnerability libraries, etc. The embodiment of the present application does not limit the size of the cache space. The first feature library is the latest version of the feature library, and the second feature library is the feature library to be upgraded. The first proxy server is a proxy server configured with a server address corresponding to a feature library server for obtaining the latest version of the feature library from the feature library server and caching it.

[0064] In some embodiments, after the proxy server is linked to the feature server, the proxy server sends a feature library download request to the feature library server. After the feature library server receives the feature library download request sent by the proxy server, it responds to the feature library download request and sends the latest version of the feature library (i.e., the first feature library) to the proxy server. After the proxy server receives the latest version of the feature library sent by the feature library server, it caches the latest version of the feature library in the cache space (i.e., the first cache space) in the proxy server. When the network device needs to upgrade the feature library, the network device can send a download request to the proxy server. After the proxy server receives the download request sent by the network device, it responds to the download request sent by the network device and sends the latest version of the feature library in the cache space to the network device. After the network device receives the latest version of the feature library sent by the proxy server in response to the download request, the current feature library (i.e., the second feature library) on the network device is updated and upgraded using the latest version of the feature library. For example, the current feature library on the network device is overwritten with the latest version of the feature library to complete the feature library upgrade of the network device.

[0065] Exemplarily, after the first proxy server is linked to the feature server, the first proxy server sends a feature library download request to the feature library server. After the feature library server receives the feature library download request sent by the first proxy server, it responds to the feature library download request and sends the first feature library to the first proxy server. After the first proxy server receives the first feature library sent by the feature library server, it caches the first feature library in the first cache space in the first proxy server. When the network device sends a download request to the first proxy server, if the first proxy server receives the download request sent by the network device, the first proxy server will respond to the download request sent by the network device and send the first feature library in the first cache space to the network device. After the network device receives the first feature library sent by the first proxy server in response to the download request, it uses the first feature library to update the second feature library on the network device.

[0066] In some embodiments, a proxy server may correspond to one network device or multiple network devices, that is, the number of network devices may be one or multiple. In the case where the number of network devices is multiple, after the proxy server obtains the latest version of the feature library from the feature library server and caches it in the cache space, multiple network devices can directly obtain the latest version of the feature library from the proxy server, achieving the effect of "obtain once, use multiple times". In each network device, the server address and port corresponding to the proxy server are configured, and the proxy server is configured with the server address corresponding to the feature server.

[0067] For example, Figure 2 A schematic diagram of an application scenario of a feature library upgrade method provided in an embodiment of the present application; Figure 2 As shown, suppose there are n network devices (such as Figure 2 The network devices 1, 2, 3, ..., n) shown in the figure can request to access the proxy server according to the server address corresponding to the proxy server configured by each of the n network devices, so as to obtain the latest version of the signature library from the cache space of the proxy server. The proxy server can request to access the signature library server according to the server address corresponding to the configured signature library server, so as to obtain the latest version of the signature library from the signature library server and cache it in the cache space.

[0068] It can be understood that after the proxy server obtains the latest feature library from the feature library server, it caches it locally (i.e., cache space), and the network device can directly obtain the feature library upgrade from the proxy server. In this way, the network device does not need to establish a link with the feature library server through the proxy server every time it upgrades to obtain the latest version of the feature library from the feature library server, which can improve efficiency, performance and reliability, and save bandwidth resources.

[0069] In some embodiments, the first proxy server is provided with a timer. Obtaining the first feature library from the feature library server through the first proxy server includes: the first proxy server periodically accesses the feature library server based on the timer, and updates the first feature library in the first cache space based on the feature library in the feature server to obtain a new first feature library.

[0070] In some embodiments, the proxy server periodically accesses the feature library server based on a timer to periodically obtain the feature library from the feature library server. After obtaining the feature library, the proxy server updates the feature library stored in the cache space based on the obtained feature library to obtain a new feature library (i.e., a new first feature library).

[0071] Exemplarily, the first proxy server periodically accesses the feature library server to periodically obtain the feature library from the feature library server, and uses the obtained feature library to overwrite the first feature library stored in the first cache space to obtain a new first feature library.

[0072] It can be understood that the proxy server's regular access to the feature library server can ensure that after the feature library in the feature library server is updated, the proxy server can promptly obtain the latest version of the feature library and update the feature library in the cache space. That is, the timer setting can enable the proxy server to regularly update the latest feature library to the local, prepare in advance for the network device to upgrade the feature library, and further shorten the upgrade time.

[0073] In some embodiments, the feature library upgrade method provided in the present application also includes: the first proxy server periodically determines the server status information corresponding to the first proxy server based on a timer, and performs operations corresponding to the server status information based on the server status information.

[0074] The server status information is used to indicate the current status of the proxy server. The server status information includes success, failure, and updating. The success status indicates that the current version of the signature database is the latest version and can be upgraded. The fail status indicates that the signature database update failed and the proxy server needs to be checked. The update status indicates that the signature database is being updated and needs to be waited.

[0075] In some embodiments, based on the server status information, executing operations corresponding to the server status information includes: if the service status information indicates that the update of the first feature library is complete, that is, the service status information is success, then sending an upgrade prompt message to the terminal device; if the service status information indicates that the update of the first feature library has failed, that is, the service status information is fail, then sending a troubleshooting prompt message corresponding to the first proxy server to the terminal device; if the service status information indicates that the first feature library is being updated, that is, the service status information is update, then waiting is performed.

[0076] The terminal device may be an administrator's mobile phone, computer or other electronic device, or a network device, which is not limited in this application.

[0077] In some embodiments, the upgrade prompt information is used to prompt the administrator to promptly operate the network device to upgrade the feature library, and the troubleshooting prompt information is used to prompt the administrator to promptly operate the proxy server to troubleshoot the proxy server. Among them, the upgrade prompt information and the troubleshooting prompt information can be sent to the terminal device in the form of an email, or in the form of a pop-up window, etc. This embodiment of the application is not limited to this.

[0078] like Figure 3 As shown, in some embodiments, downloading the first feature library from the first cache space of the first proxy server by at least one network device may include S301-S303.

[0079] S301. A network device sends a download request to a first proxy server.

[0080] S302: The first proxy server receives a download request sent by the network device, and determines server status information corresponding to the first proxy server in response to the download request.

[0081] S303: If the service status information indicates that the first feature library is being updated, the first proxy server sends a waiting notification to the network device.

[0082] S304: When the network device receives the waiting notification, it sends a download request to the first proxy server again after a preset time.

[0083] In some embodiments, the network device sends a download request to the proxy server. After the proxy server receives the download request sent by the network device, it will determine the server status information corresponding to the proxy server in response to the download request sent by the network device. If the service status information indicates that the feature library is being updated, the proxy server sends a waiting notification to the network device. When the network device receives the waiting notification, it will send a download request to the first proxy server again after a preset time. After the proxy server receives the download request sent by the network device, it will determine the server status information corresponding to the proxy server in response to the download request sent by the network device. If the service status information indicates that the feature library update is complete, that is, the current version of the feature library of the feature library is the latest version, the latest version of the feature library in the cache space is sent to the network device. After the network device receives the latest version of the feature library sent by the proxy server in response to the download request, the feature library (i.e., the second feature library) on the network device is updated and upgraded using the latest version of the feature library.

[0084] It should be noted that the preset duration is a preset value, that is, the preset duration is a value configured in the network device in advance, and the embodiment of the present application does not limit this.

[0085] like Figure 4 As shown, in some embodiments, if the network protection system also includes at least one second proxy server, the feature library upgrade method provided in the embodiment of the present application also includes S401-S402.

[0086] S401. The first proxy server sends the first feature library to each second proxy server.

[0087] S402: Each second proxy server caches the first feature library in a second cache space corresponding to each second proxy server.

[0088] The second cache space is a storage space opened on the second proxy server for caching the latest version of the feature library obtained by the second proxy server from the feature server. The second cache space is similar to the first cache space and will not be described in detail here.

[0089] Figure 5 A schematic diagram of an application scenario of another feature library upgrade method provided in an embodiment of the present application, such as Figure 5 As shown, the network protection system may include a first proxy server ( Figure 5 Proxy server 1) and at least one proxy server ( Figure 5Proxy server 2 in the network protection system). The first proxy server is the main server. After the main server obtains the latest version of the feature library from the feature library server, it can send the first feature library to each second proxy server, and each second proxy server caches the first feature library in the second cache space corresponding to each second proxy server, so that the feature library cached in each proxy server in the network protection system is the latest version of the feature library.

[0090] like Figure 6 As shown, in some embodiments, the feature library upgrade method provided in the embodiments of the present application also includes S601-S604.

[0091] S601: A first proxy server periodically determines the number of download connections between the first proxy server and at least one second proxy server based on a timer.

[0092] S602: The first proxy server determines a target proxy server from the first proxy server and the at least one proxy server based on the number of download connections of the first proxy server and the at least one second proxy server respectively.

[0093] S603: If the first proxy server receives the download request sent by the network device, then in response to the download request, the first proxy server generates response information based on the server address of the target proxy server and sends the response information to the network device.

[0094] S604: When the network device receives the response information, the network device downloads the first feature library from the corresponding second cache space of the target proxy server based on the server address of the target proxy server in the response message.

[0095] The number of connection downloads is the number of network devices that are connecting to the proxy server to download the signature database.

[0096] In some embodiments, the first proxy server determines the number of download connections of the first proxy server and at least one second proxy server based on a timer. And based on the number of download connections of the first proxy server and at least one second proxy server respectively, a target proxy server is determined from the first proxy server and at least one second proxy server. When the first proxy server receives a download request sent by a network device, the first proxy server generates a response message based on the server address of the target proxy server in response to the download request and sends it to the network device. When the network device receives the response message, the network device accesses the target proxy server based on the server address of the target proxy server in the response message to download the first feature library from the corresponding second cache space of the target proxy server.

[0097] In some embodiments, based on the number of download connections of each of the first proxy server and the at least one second proxy server, determining a target proxy server from the first proxy server and the at least one second proxy server includes: based on the number of download connections of each of the first proxy server and the at least one second proxy server, determining the proxy server with the smallest number of download connections among the first proxy server and the at least one second proxy server as the target proxy server.

[0098] The target proxy server is the proxy server with the smallest number of download connections among the first proxy server and the at least one second proxy server, that is, the proxy server with the smallest number of connected network devices among the first proxy server and the at least one second proxy server is determined as the target proxy server.

[0099] It should be noted that the number of the second proxy servers can be one or more. If the number of the second proxy servers is one, the second proxy server is determined as the target proxy server. If the number of the second proxy servers is more than one, based on the number of download connections of each second proxy server, the second proxy server with the smallest number of download connections among at least one second proxy server is determined as the target proxy server.

[0100] For example, Figure 5 As shown, assume that the first proxy server is proxy server 1 and the second proxy server is proxy server 2. Proxy server 1 obtains the latest version of the feature library (i.e., the first feature library) from the feature server, and sends the latest version of the feature library to proxy server 2. When network device 1 downloads the latest version of the feature library from proxy server 1, it can be determined that the number of download connections of proxy server 1 is 1, and the number of download connections of proxy server 2 is 0. At this time, proxy server 2 can be determined as the target proxy server. If network device 2 sends a download request to proxy server 1, proxy server 1 generates a response message based on the server address of proxy server 2 in response to the download request, and sends it to network device 2. When network device 2 receives the response message, network device 2 will access proxy server 2 based on the server address of proxy server 2 in the response message to download the latest version of the feature library from the corresponding second cache space of proxy server 2.

[0101] It is understandable that configuring multiple proxy servers as load balancing can avoid excessive server load caused by large-scale downloads, which may cause upgrade blockage.

[0102] like Figure 7 As shown, the embodiment of the present application also provides a feature library upgrade method applied to a proxy server, and the method includes S701-S703.

[0103] S701. Obtain a first feature database from a feature database server.

[0104] S702: Cache the first feature library in a cache space.

[0105] S703: In response to the download request sent by the network device, send the first feature library in the cache space to the network device, so that the network device updates the second feature library based on the first feature library.

[0106] It should be noted that the feature library upgrade method applied to the proxy server corresponds to the embodiment of the feature library upgrade method applied to the network protection system mentioned above, and will not be repeated here.

[0107] like Figure 8 As shown, the embodiment of the present application also provides a feature library upgrade method applied to a network device, the method comprising:

[0108] S801. Send a download request to a proxy server.

[0109] S802: Receive a first feature library sent by the proxy server in response to a download request.

[0110] S803: Update the second feature library based on the first feature library.

[0111] It should be noted that the feature library upgrade method applied to the network device corresponds to the embodiment of the feature library upgrade method applied to the network protection system mentioned above, and will not be repeated here.

[0112] like Fig. 9 As shown, a proxy server provided in an embodiment of the present application may include: a processor 910, a communication interface 920, a memory 930, and a communication bus 940, wherein the processor 910, the communication interface 920, and the memory 930 communicate with each other through the communication bus 940. The processor 910 may call the logic instructions in the memory 930 to execute the above methods.

[0113] like Fig.10 As shown, a network device provided in an embodiment of the present application may include: a processor (processor) 1010, a communication interface (Communications Interface) 1020, a memory (memory) 1030 and a communication bus 1040, wherein the processor 1010, the communication interface 1020, and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 can call the logic instructions in the memory 1030 to execute the above methods.

[0114] In addition, the above Fig. 9 and Fig.10 The logical instructions in the memory in the memory can be implemented in the form of software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the switch device mechanical state monitoring method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0115] In yet another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented to perform the above methods when executed by a processor.

[0116] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0117] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for updating a feature library, characterized in that: Applied to a network protection system, the network protection system includes a first proxy server and at least one network device, the first proxy server is provided with a first cache space, and the method includes: The first proxy server obtains a first feature library from a feature library server; the first feature library is the latest version of the feature library; The first proxy server caches the first feature library in the first cache space; At least one of the network devices downloads the first feature library from the first cache space of the first proxy server, and updates a second feature library based on the first feature library; the second feature library is a feature library to be upgraded.

2. The method according to claim 1, characterized in that The first proxy server is provided with a timer; The first proxy server obtains a first feature library from a feature library server, including: The first proxy server periodically accesses the feature library server based on the timer, and updates the first feature library in the first cache space based on the feature library in the feature server to obtain a new first feature library.

3. The method according to claim 2, characterized in that The method further comprises: The first proxy server periodically determines server status information corresponding to the first proxy server based on the timer, and performs an operation corresponding to the server status information based on the server status information.

4. The method according to claim 3, characterized in that: The performing an operation corresponding to the server status information based on the server status information includes: If the service status information indicates that the first feature library is updated, an upgrade prompt message is sent to the terminal device; If the service status information indicates that the first feature library fails to be updated, sending a troubleshooting prompt message corresponding to the first proxy server to the terminal device; If the service status information indicates that the first feature library is being updated, then waiting is performed.

5. The method according to claim 1, characterized in that The at least one network device downloads the first feature library from the first cache space of the first proxy server, including: The network device sends a download request to the first proxy server; The first proxy server receives the download request sent by the network device, and determines the server status information corresponding to the first proxy server in response to the download request; If the service status information indicates that the first feature library is being updated, the first proxy server sends a waiting notification to the network device; When receiving the waiting notification, the network device sends a download request to the first proxy server again after a preset time period.

6. The method according to claim 2, characterized in that If the network protection system further includes at least one proxy server, the method further includes: The first proxy server sends the first feature library to each of the second proxy servers; Each of the second proxy servers caches the first feature library in the second cache space corresponding to each of the second proxy servers.

7. The method according to claim 6, characterized in that The method further comprises: The first proxy server periodically determines the number of download connections between the first proxy server and at least one of the second proxy servers based on the timer; The first proxy server determines a target proxy server from the first proxy server and at least one of the proxy servers based on the number of download connections of the first proxy server and at least one of the second proxy servers respectively; If the first proxy server receives the download request sent by the network device, then in response to the download request, response information is generated based on the server address of the target proxy server and sent to the network device; When the network device receives the response information, the network device downloads the first feature library from the second cache space corresponding to the target proxy server based on the server address of the target proxy server in the response message.

8. The method according to claim 7, characterized in that The determining a target proxy server from the first proxy server and at least one of the proxy servers based on the number of download connections of each of the first proxy server and at least one of the second proxy servers comprises: Based on the respective numbers of download connections of the first proxy server and at least one of the second proxy servers, a proxy server having the smallest number of download connections among the first proxy server and at least one of the second proxy servers is determined as the target proxy server.

9. A method for updating a feature library, characterized in that: Applied to a proxy server, the method comprises: Obtaining a first feature library from a feature library server; the first feature library is a feature library of the latest version; caching the first feature library in a cache space; In response to a download request sent by a network device, the first feature library in the cache space is sent to the network device, so that the network device updates a second feature library based on the first feature library; the second feature library is the feature library to be upgraded.

10. A method for updating a feature library, characterized in that: Applied to a network device, the method comprises: Send a download request to the proxy server; Receiving a first feature library sent by the proxy server in response to the download request; the first feature library is the latest version of the feature library obtained by the proxy server from the feature library server and cached in the cache space; The second feature library is updated based on the first feature library; the second feature library is the feature library to be upgraded.

Images