Method, device, equipment, medium and program product for parallel processing of firewall rules and IPS intrusion features

Abstract

The embodiments of the present application provide a method, apparatus, device, medium and program product for parallel processing of firewall rules and IPS intrusion features, relating to the field of network security technology. The method comprises: based on a memory mapping mechanism, obtaining a memory mapping of a physical memory area through a first virtual address space; accessing a network data packet in the physical memory area through a first virtual address of the first virtual address space, wherein the network data packet is written to the physical memory area through direct memory access (DMA); processing the network data packet according to a five-tuple rule to determine whether the network data packet complies with a release rule; if the network data packet complies with the release rule, placing the network data packet into a public memory area queue of the physical memory area based on a security monitoring rule; if the network data packet does not comply with the release rule, discarding the data packet; shortening the data processing chain, reducing system overhead and achieving high hardware resource utilization.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, apparatus, device, medium, and program product for parallel processing of firewall rules and IPS intrusion features. Background Art

[0002] In traditional security networks, firewalls and intrusion detection devices are separate devices. When a network packet enters the network, it first reaches the firewall. The firewall processes it based on a set rule table, allowing only legitimate packets to pass through the firewall and enter the internal network. The processed packet then passes to the IPS intrusion detection device, which analyzes the packet content. If it detects a potential attack, it blocks further transmission, ensuring network security. After multiple layers of data filtering, the data finally reaches the network user. This security processing mechanism results in a long data processing chain, high system overhead, and low hardware resource utilization. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a method, device, equipment, medium and program product for parallel processing of firewall rules and IPS intrusion features, so as to solve the problems of time-consuming communication of existing telecommunication network elements and low real-time performance of data forwarding.

[0004] In a first aspect, an embodiment of the present application provides a method for parallel processing of firewall rules and IPS intrusion features, for a first CPU, the first CPU being bound to a firewall system and the first CPU being located in a kernel layer, the method comprising:

[0005] Based on the memory mapping mechanism, obtaining a memory mapping of the physical memory area through the first virtual address space;

[0006] Accessing a network data packet in a physical memory area through a first virtual address in a first virtual address space, wherein the network data packet is written to the physical memory area through DMA direct memory access;

[0007] Process the network data packet according to the five-tuple rule to determine whether the network data packet meets the release rule;

[0008] If the network data packet meets the release rules, the network data packet is placed into the public memory area queue of the physical memory area based on the security monitoring rules;

[0009] If the network data packet does not meet the release rules, the data packet will be discarded.

[0010] In the above implementation process, the embodiment of the present application is based on the memory mapping mechanism, and obtains the memory mapping of the physical memory area through the first virtual address space; accesses the network data packet of the physical memory area through the first virtual address space, wherein the network data packet is written to the physical memory area through DMA direct memory access; processes the network data packet according to the five-tuple rule to determine whether the network data packet complies with the release rule; if the network data packet complies with the release rule, the network data packet is placed in the public memory area queue of the physical memory area based on the security monitoring rule; if the network data packet does not comply with the release rule, the data packet is discarded; the firewall detection is directly processed from the kernel layer, and the network data packet of the physical memory area is directly accessed through the virtual address. The firewall system places the filtered data packet into the public memory area queue, shortens the data processing chain, reduces system overhead, and has high hardware resource utilization.

[0011] Furthermore, the processing of the network data packet according to the five-tuple rule to determine whether the network data packet complies with the release rule includes:

[0012] When all five fields of a network data packet meet the preset rules, the network data packet is judged to meet the release rules; the five fields include: source IP address, destination IP address, source port, destination port and transport layer protocol;

[0013] If one of the fields of the network data packet does not comply with the preset rule, it is determined that the network data packet does not comply with the release rule.

[0014] In the above implementation process, the network data packets are initially released and screened through the firewall system to ensure the security of the network.

[0015] Furthermore, the step of placing the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule includes:

[0016] Determine whether network data packets have preset threat characteristics;

[0017] If the network data packet does not contain the preset threat potential characteristics, the network data packet will be sent to the upper-layer application for processing;

[0018] If the network data packet has a preset threat hidden danger feature, the obtained threat data packet is placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion defense detection.

[0019] In the above implementation process, the firewall system detects whether the network data packets contain potential threats, and sends them to the public memory area queue after screening to facilitate IPS extraction and processing, thereby improving the data processing flow.

[0020] In a second aspect, an embodiment of the present application further provides a method for parallel processing of firewall rules and IPS intrusion features, for a second CPU, the second CPU being bound to an intrusion detection system IPS and the second CPU being located in a kernel layer, the method comprising:

[0021] Based on the memory mapping mechanism, a memory mapping of the physical memory area is obtained through the second virtual address space;

[0022] Accessing a public memory area queue of the physical memory area through a second virtual address in the second virtual address space to obtain a threat data packet; wherein the threat data packet is screened by the first CPU based on a security detection rule and placed in the public memory area queue;

[0023] Process the threat data packet according to the intrusion detection rules to determine whether the threat data packet matches the intrusion signature;

[0024] If the threat data packet does not match the intrusion signature, the network data packet is sent to the upper-layer application for processing;

[0025] If the threat data packet matches the intrusion signature, the threat data packet will be blocked, and an alarm will be issued and a log will be recorded.

[0026] In the above implementation process, the embodiment of the present application is based on the memory mapping mechanism, and obtains the memory mapping of the physical memory area through the second virtual address space; accesses the public memory area queue of the physical memory area through the second virtual address space to obtain the threat data packet; wherein, the threat data packet is screened by the first CPU based on the security detection rule and placed in the public memory area queue; the threat data packet is processed according to the intrusion detection rule to determine whether the threat data packet matches the intrusion feature; if the threat data packet does not match the intrusion feature, the network data packet is sent to the upper-layer application for processing; if the threat data packet matches the intrusion feature, the threat data packet is blocked, and an alarm is issued and a log is recorded; IPS detection is directly processed from the kernel layer, and the threat data packet in the public memory area queue is directly accessed through the virtual address for processing, shortening the data processing chain, reducing system overhead, and high hardware resource utilization.

[0027] Furthermore, the processing of the threat data packet according to the intrusion detection rule to determine whether the threat data packet matches the intrusion signature includes:

[0028] Perform feature matching and behavior analysis on threat data packets to determine whether the threat data packets match the preset intrusion features.

[0029] In the above implementation process, it is realized to determine whether the threat data packet has intrusion characteristics.

[0030] In a third aspect, an embodiment of the present application further provides a method for parallel processing of firewall rules and IPS intrusion features, for use in a network security system, the network security system comprising a first CPU and a second CPU, the first CPU being bound to a firewall system, the second CPU being bound to an intrusion detection system IPS, the first CPU and the second CPU being both located in a kernel layer, the method comprising:

[0031] Based on a memory mapping mechanism, mapping the memory mapping of the physical memory area to a first virtual address space of the first CPU and a virtual address space of the second CPU respectively;

[0032] Control DMA direct memory access to write network data packets into the physical memory area;

[0033] Controlling a first virtual address in a first virtual address space to access a network data packet in a physical memory area;

[0034] Processing the network data packet by the first CPU according to the five-tuple rule to determine whether the network data packet meets the release rule;

[0035] If the network data packet meets the release rule, the first CPU puts the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule;

[0036] Controlling the second virtual address of the second virtual address space to access the public memory area queue of the physical memory area to obtain the threat data packet;

[0037] Processing the threat data packet through the second CPU according to the intrusion detection rules to determine whether the threat data packet matches the intrusion signature;

[0038] If the threat data packet matches the intrusion signature, the threat data packet will be blocked, and an alarm will be issued and a log will be recorded.

[0039] In the above implementation process, firewall detection and IPS detection are processed directly from the kernel layer, and the public memory area queue of the physical memory area is directly accessed through the virtual address. The firewall system puts the filtered data packets into the public memory area queue, and the IPS directly accesses the threat data packets in the public memory area queue through the virtual address for processing, shortening the data processing chain, reducing system overhead, and improving hardware resource utilization.

[0040] Furthermore, after determining whether the network data packet meets the release rule, the method further includes:

[0041] If the network data packet does not meet the release rules, the data packet will be discarded.

[0042] After determining whether the threat data packet matches the intrusion signature, the method further includes:

[0043] If the threat data packet does not match the intrusion signature, the network data packet is sent to the upper-layer application for processing.

[0044] Furthermore, the processing of the network data packet by the first CPU according to the quintuple rule to determine whether the network data packet complies with the release rule includes:

[0045] When all five fields of the network data packet meet the preset rules, the first CPU determines that the network data packet meets the release rule; wherein the five fields include: source IP address, destination IP address, source port, destination port and transport layer protocol;

[0046] If one of the fields of the network data packet does not comply with the preset rule, it is determined that the network data packet does not comply with the release rule.

[0047] Furthermore, the step of placing the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule by the first CPU includes:

[0048] Determine, by the first CPU, whether the network data packet has a preset threat potential feature;

[0049] If the network data packet does not contain the preset threat potential characteristics, the network data packet will be sent to the upper-layer application for processing;

[0050] If the network data packet has a preset threat hidden danger feature, the obtained threat data packet is placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion defense detection.

[0051] Furthermore, the processing of the threat data packet by the second CPU according to the intrusion detection rule to determine whether the threat data packet matches the intrusion feature includes:

[0052] The second CPU performs feature matching and behavior analysis on the threat data packet to determine whether the threat data packet matches a preset intrusion feature.

[0053] In a fourth aspect, an embodiment of the present application further provides a device for parallel processing of firewall rules and IPS intrusion features, which is used for a first CPU, the first CPU being bound to a firewall system and the first CPU being located in a kernel layer, the device comprising:

[0054] A first mapping module is configured to obtain a memory mapping of a physical memory area through a first virtual address space based on a memory mapping mechanism;

[0055] A first access module is configured to access a network data packet in a physical memory area through a first virtual address in a first virtual address space, wherein the network data packet is written into the physical memory area through DMA direct memory access;

[0056] The release detection module is used to process the network data packet according to the five-tuple rule to determine whether the network data packet meets the release rule;

[0057] a data storage module, configured to place the network data packet into a public memory area queue of the physical memory area based on security monitoring rules if the network data packet meets the release rules;

[0058] The data discard module is used to discard the data packet if the network data packet does not meet the release rules.

[0059] In a fifth aspect, an embodiment of the present application further provides a device for parallel processing of firewall rules and IPS intrusion features, which is used for a second CPU, the second CPU being bound to an intrusion detection system IPS and the second CPU being located in the kernel layer, the device comprising:

[0060] A second mapping module is used to obtain a memory mapping of the physical memory area through the second virtual address space based on a memory mapping mechanism;

[0061] a second access module, configured to access the public memory area queue of the physical memory area through the second virtual address of the second virtual address space to obtain a threat data packet; wherein the threat data packet is screened by the first CPU based on the security detection rule and placed in the public memory area queue;

[0062] A threat judgment module is used to process threat data packets according to intrusion detection rules to determine whether the threat data packets match intrusion signatures;

[0063] A threat determination module is used to send the network data packet to an upper-layer application for processing if the threat data packet does not match the intrusion signature;

[0064] The threat matching module is used to block the threat data packet, issue an alarm and record a log if the threat data packet matches the intrusion signature.

[0065] In a sixth aspect, an embodiment of the present application further provides a device for parallel processing of firewall rules and IPS intrusion features, for use in a network security system, the network security system comprising a first CPU and a second CPU, the first CPU being bound to a firewall system, the second CPU being bound to an intrusion detection system IPS, the first CPU and the second CPU being both located in a kernel layer, the device comprising:

[0066] A memory mapping module is used to map the memory mapping of the physical memory area to the first virtual address space of the first CPU and the virtual address space of the second CPU respectively based on the memory mapping mechanism;

[0067] Memory access module, used to control DMA direct memory access to write network data packets into the physical memory area;

[0068] An access control module, configured to control a network data packet of a first virtual address in a first virtual address space to access a physical memory area;

[0069] A first processing module, configured to process the network data packet through the first CPU according to the quintuple rule, and determine whether the network data packet complies with the release rule;

[0070] a release processing module, configured to place the network data packet into a public memory area queue of the physical memory area based on a security monitoring rule through the first CPU if the network data packet meets the release rule;

[0071] A threat acquisition module, configured to control a second virtual address in the second virtual address space to access a public memory area queue in the physical memory area to acquire a threat data packet;

[0072] A threat processing module, configured to process a threat data packet through the second CPU according to an intrusion detection rule, and determine whether the threat data packet matches an intrusion signature;

[0073] The security response module is used to block the threat data packet if the threat data packet matches the intrusion signature, issue an alarm and record a log.

[0074] In a seventh aspect, an embodiment of the present application provides an electronic device, including:

[0075] A processor, a memory and a bus, wherein the processor is connected to the memory via the bus, and the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, they are used to implement the parallel processing method of firewall rules and IPS intrusion features as described above.

[0076] In an eighth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a server, the method for parallel processing of firewall rules and IPS intrusion features as described above is implemented.

[0077] In a ninth aspect, an embodiment of the present invention provides a computer program product, which includes instructions. When the instructions are executed by a computer, the computer implements the parallel processing method of firewall rules and IPS intrusion features as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0079] Figure 1 A flowchart of a method for parallel processing of firewall rules and IPS intrusion features provided in an embodiment of the present application;

[0080] Figure 2 A flowchart of another method for concurrently processing firewall rules and IPS intrusion signatures provided in an embodiment of the present application;

[0081] Figure 3 A flowchart of another method for concurrently processing firewall rules and IPS intrusion signatures provided in an embodiment of the present application;

[0082] Figure 4 A schematic diagram of the system architecture of a method for parallel processing of firewall rules and IPS intrusion features provided in an embodiment of the present application;

[0083] Figure 5 A schematic diagram of a common memory area queue for a method for parallel processing of firewall rules and IPS intrusion features provided in an embodiment of the present application;

[0084] Figure 6 A schematic diagram of a business processing flow of a method for concurrently processing firewall rules and IPS intrusion features provided in an embodiment of the present application;

[0085] Figure 7 A flowchart of a device for parallel processing of firewall rules and IPS intrusion features provided in an embodiment of the present application;

[0086] Figure 8 A flowchart of a device for parallel processing of firewall rules and IPS intrusion features provided in an embodiment of the present application;

[0087] Figure 9 A flowchart of a device for parallel processing of firewall rules and IPS intrusion features provided in an embodiment of the present application;

[0088] Figure 10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0089] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0090] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0091] DMA: Direct Memory Access allows external devices (such as disk drives, network cards, etc.) to exchange data directly with system memory without frequent CPU intervention.

[0092] User level: User-level programs and processes are started and run by applications. They run in a restricted permission environment and cannot directly access the underlying hardware resources of the system. They can only use the standard interfaces and services provided by the operating system to complete tasks. When writing these program codes, they focus more on ease of use and business process implementation, and are relatively independent of the underlying hardware details.

[0093] Kernel Level: The kernel is the core of the operating system and possesses the highest authority. It interacts directly with the hardware, overseeing the scheduling, control, and data exchange of hardware devices such as the CPU, memory, hard disk, and network interface card. For example, in process management, the kernel determines which process receives CPU resources and when. In memory management, the kernel allocates physical memory to different processes and reclaims memory when a process terminates.

[0094] First, see Figure 1 , Figure 1 A flowchart of a method for concurrently processing firewall rules and IPS intrusion signatures provided in an embodiment of the present application. The method is used for a first CPU that is bound to a firewall system and is located in the kernel layer. The method includes:

[0095] 110. Based on a memory mapping mechanism, obtain a memory mapping of the physical memory area through the first virtual address space.

[0096] 120. Accessing a network data packet in a physical memory area through a first virtual address in a first virtual address space, wherein the network data packet is written to the physical memory area through DMA direct memory access.

[0097] 130. Process the network data packet according to the five-tuple rule to determine whether the network data packet complies with the release rule.

[0098] 131. When all five fields of a network data packet comply with the preset rules, the network data packet is judged to comply with the release rules; the five fields include: source IP address, destination IP address, source port, destination port and transport layer protocol.

[0099] 132. If one of the fields of the network data packet does not comply with the preset rule, determine that the network data packet does not comply with the release rule.

[0100] Therefore, the firewall system performs preliminary screening on network data packets to ensure the security of the network.

[0101] 140. If the network data packet meets the release rule, the network data packet is placed into the public memory area queue of the physical memory area based on the security monitoring rule.

[0102] 141. Determine whether the network data packet contains preset threat potential characteristics.

[0103] 142. If the network data packet does not have the preset threat potential characteristics, the network data packet will be sent to the upper-level application for processing.

[0104] 143. If the network data packet has a preset threat hidden danger feature, the obtained threat data packet is placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion prevention detection.

[0105] Thus, the firewall system detects whether the network data packets contain potential threats, filters them and sends them to the public memory area queue for IPS extraction and processing, thereby improving the data processing flow.

[0106] 150. If the network data packet does not meet the release rules, the data packet will be discarded.

[0107] As described above, the embodiment of the present application is based on a memory mapping mechanism, and obtains a memory mapping of a physical memory area through a first virtual address space; accesses a network data packet in the physical memory area through a first virtual address in the first virtual address space, wherein the network data packet is written to the physical memory area through direct memory access via DMA; processes the network data packet according to a five-tuple rule to determine whether the network data packet complies with the release rule; if the network data packet complies with the release rule, the network data packet is placed in a public memory area queue of the physical memory area based on a security monitoring rule; if the network data packet does not comply with the release rule, the data packet is discarded; the firewall detection is directly processed from the kernel layer, and the network data packet in the physical memory area is directly accessed through a virtual address. The firewall system places the filtered data packet in a public memory area queue, shortens the data processing chain, reduces system overhead, and has high hardware resource utilization.

[0108] Second, see Figure 2 , Figure 2 A flowchart of another method for concurrently processing firewall rules and IPS intrusion signatures provided in an embodiment of the present application. This method is used for a second CPU that is bound to an intrusion detection system (IPS) and is located in the kernel layer. The method includes:

[0109] 210. Based on the memory mapping mechanism, obtain the memory mapping of the physical memory area through the second virtual address space.

[0110] 220. Access the public memory area queue of the physical memory area through the second virtual address of the second virtual address space to obtain a threat data packet; wherein the threat data packet is screened by the first CPU based on the security detection rule and placed in the public memory area queue.

[0111] 230. Process the threat data packet according to the intrusion detection rule to determine whether the threat data packet matches the intrusion signature.

[0112] Specifically, feature matching and behavior analysis are performed on the threat data packet to determine whether the threat data packet matches a preset intrusion feature; thereby, determining whether the threat data packet has an intrusion feature.

[0113] 240. If the threat data packet does not match the intrusion signature, the network data packet is sent to the upper layer application for processing.

[0114] 250. If the threat data packet matches the intrusion signature, the threat data packet is blocked, and an alarm is issued and a log is recorded.

[0115] As described above, the embodiment of the present application is based on a memory mapping mechanism, and obtains a memory mapping of a physical memory area through a second virtual address space; accesses a public memory area queue of the physical memory area through a second virtual address space to obtain a threat data packet; wherein, the threat data packet is screened by the first CPU based on security detection rules and placed in a public memory area queue; the threat data packet is processed according to the intrusion detection rules to determine whether the threat data packet matches the intrusion feature; if the threat data packet does not match the intrusion feature, the network data packet is sent to an upper-layer application for processing; if the threat data packet matches the intrusion feature, the threat data packet is blocked, and an alarm is issued and a log is recorded; IPS detection is processed directly from the kernel layer, and the threat data packet in the public memory area queue is directly accessed through the virtual address for processing, thereby shortening the data processing chain, reducing system overhead, and achieving high hardware resource utilization.

[0116] Thirdly, please see Figure 3 , Figure 3A flowchart of another method for parallel processing of firewall rules and IPS intrusion features provided in an embodiment of the present application. This method for parallel processing of firewall rules and IPS intrusion features is used in a network security system, wherein the network security system includes a first CPU and a second CPU, wherein the first CPU is bound to a firewall system and the second CPU is bound to an intrusion detection system IPS, and the first CPU and the second CPU are both located in the kernel layer. The method includes:

[0117] 310. Based on a memory mapping mechanism, map the memory mapping of the physical memory area to the first virtual address space of the first CPU and the virtual address space of the second CPU respectively.

[0118] 320. Control DMA direct memory access to write network data packets into the physical memory area.

[0119] 330. Control the first virtual address of the first virtual address space to access the network data packet in the physical memory area.

[0120] For example, the network card receives external network data and writes it directly to a designated memory area via DMA. Using the memory mapping mechanism provided by the system, the same block of physical memory is mapped to the virtual address space of both CPUs. In this way, both CPUs can access the same block of physical memory through their respective virtual addresses. In this case, DMA can transfer data directly to a shared memory area under the control of one CPU, and the other CPU can read the data in the shared memory at the appropriate time. To ensure that only one CPU can access shared memory at a time, mutual exclusion and synchronization mechanisms, such as semaphores and mutex locks, can be used to prevent access conflicts.

[0121] 340. Process the network data packet through the first CPU according to the five-tuple rule to determine whether the network data packet complies with the release rule.

[0122] 341. When the five fields of the network data packet all meet the preset rules, the first CPU determines that the network data packet meets the release rules; wherein the five fields include: source IP address, destination IP address, source port, destination port and transport layer protocol.

[0123] 342. If one of the fields of the network data packet does not comply with the preset rule, determine that the network data packet does not comply with the release rule.

[0124] 350. If the network data packet meets the release rule, the first CPU puts the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule.

[0125] 351. Determine, by the first CPU, whether the network data packet has a preset threat potential feature.

[0126] 352. If the network data packet does not have the preset threat potential characteristics, the network data packet will be sent to the upper-level application for processing.

[0127] 353. If the network data packet has a preset threat potential feature, the obtained threat data packet is placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion prevention detection.

[0128] 354. If the network data packet does not meet the release rules, the data packet will be discarded.

[0129] 360. Control the second virtual address of the second virtual address space to access the public memory area queue of the physical memory area to obtain the threat data packet.

[0130] like Figure 5 As shown in the figure, the firewall and IPS applications are bound to two CPUs respectively, and a queue is added between the two CPUs. The firewall first processes the network data, and then puts the threat data that needs to be processed by the IPS into the queue. The IPS module processes and analyzes it and performs the next step.

[0131] 370. Process the threat data packet by the second CPU according to the intrusion detection rule to determine whether the threat data packet matches the intrusion feature.

[0132] The second CPU performs feature matching and behavior analysis on the threat data packet to determine whether the threat data packet matches a preset intrusion feature.

[0133] 380. If the threat data packet matches the intrusion signature, the threat data packet is blocked, and an alarm is issued and a log is recorded.

[0134] If the threat data packet does not match the intrusion signature, the network data packet is sent to the upper-layer application for processing.

[0135] For example, the specific business processing flow of the embodiment of the present application is as follows: Figure 6As shown. It's important to explain that after the firewall releases packets according to pre-defined rules, it needs to determine the destination of the released packets. Threatening packets are further handed over to the IPS for processing. The IPS decision can be made based on marking high-risk ports (such as common malware communication ports). Specific ports for critical services may also be sent to the IPS to ensure data security and integrity, preventing potential attacks targeting these business applications. Certain special protocol types, traffic patterns (sudden and abnormal increases in traffic over a short period of time), and threat intelligence (such as malicious domain names and source addresses) can all pass firewall release rules, but they pose potential risks. Handling them over to the IPS module at the kernel layer allows for early and expedited threat resolution, providing a more comprehensive and low-level security protection.

[0136] As described above, in the embodiment of the present application, firewall detection and IPS detection are directly processed from the kernel layer, and the public memory area queue of the physical memory area is directly accessed through the virtual address. The firewall system puts the filtered data packets into the public memory area queue, and the IPS directly accesses the threat data packets in the public memory area queue through the virtual address for processing, shortening the data processing chain, reducing system overhead, and achieving high hardware resource utilization.

[0137] The security processing module of existing common network security equipment system architecture is located at the user layer. When the application layer processes the data received by the network card, it needs to copy it multiple times between the user layer and the kernel layer, resulting in high context switching overhead.

[0138] The embodiment of the present application applies Kernel layer processing to firewall and IPS intrusion detection. Figure 4 Applications can interact directly with the network interface card (NIC) (network driver). A kernel-level firewall or IPS can read packets directly from the NIC's buffer, process them, and write them directly to the output buffer. This eliminates the need for user-level applications to copy packets from kernel space to user space, process them, and then copy them back to kernel space. This significantly improves packet processing speed, especially when processing large numbers of small packets in high-traffic network environments. Hardware resources can be more efficiently utilized for rapid packet parsing and matching, improving overall processing efficiency. For example, kernel-level processing can better collaborate with hardware for hardware-accelerated network security functions (such as encryption / decryption and packet filtering), leveraging hardware performance.

[0139] It can be understood that the present application adopts a multi-CPU mode, that is, the network security system includes two CPUs, one for firewall detection and the other for IPS detection. Optionally, the network security system may also include one CPU, in which different cores are used to detect firewalls and IPS.

[0140] The above steps are not to be performed in a strict order as described in the numbers, but should be understood as an overall solution.

[0141] In a fourth aspect, based on the above embodiments, the embodiments of the present application further provide a firewall rule and IPS intrusion feature parallel processing device for a first CPU, the first CPU is bound to the firewall system and the first CPU is located in the kernel layer, reference Figure 7 The firewall rule and IPS intrusion feature parallel processing device provided in this embodiment specifically includes: a first mapping module 701, a first access module 702, a release detection module 703, a data storage module 704 and a data discarding module 705.

[0142] Among them, the first mapping module 701 is used to obtain the memory mapping of the physical memory area through the first virtual address space based on the memory mapping mechanism; the first access module 702 is used to access the network data packet in the physical memory area through the first virtual address of the first virtual address space, wherein the network data packet is written to the physical memory area through DMA direct memory access; the release detection module 703 is used to process the network data packet according to the five-tuple rule to determine whether the network data packet complies with the release rule; the data storage module 704 is used to place the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule if the network data packet complies with the release rule; the data discard module 705 is used to discard the data packet if the network data packet does not comply with the release rule.

[0143] In the fifth aspect, based on the above embodiment, the embodiment of the present application further provides a firewall rule and IPS intrusion feature parallel processing device for a second CPU, the second CPU is bound to the intrusion detection system IPS and the second CPU is set in the kernel layer, reference Figure 8 The firewall rule and IPS intrusion feature parallel processing device provided in this embodiment specifically includes: a second mapping module 801, a second access module 802, a threat judgment module 803, a threat determination module 804 and a threat matching module 805.

[0144] Among them, the second mapping module 801 is used to obtain the memory mapping of the physical memory area through the second virtual address space based on the memory mapping mechanism; the second access module 802 is used to access the public memory area queue of the physical memory area through the second virtual address of the second virtual address space to obtain the threat data packet; wherein, the threat data packet is screened by the first CPU based on the security detection rule and placed in the public memory area queue; the threat judgment module 803 is used to process the threat data packet according to the intrusion detection rule to determine whether the threat data packet matches the intrusion feature; the threat judgment module 804 is used to send the network data packet to the upper-level application for processing if the threat data packet does not match the intrusion feature; the threat matching module 805 is used to block the threat data packet if the threat data packet matches the intrusion feature, and issue an alarm and record a log.

[0145] In a sixth aspect, based on the above embodiments, the embodiments of the present application further provide a firewall rule and IPS intrusion feature parallel processing device for a network security system, wherein the network security system includes a first CPU and a second CPU, wherein the first CPU is bound to a firewall system, and the second CPU is bound to an intrusion detection system IPS, and the first CPU and the second CPU are both located in the kernel layer, and the reference Figure 9 The firewall rule and IPS intrusion feature parallel processing device provided in this embodiment specifically includes:

[0146] The memory mapping module 901 is used to map the memory mapping of the physical memory area to the first virtual address space of the first CPU and the virtual address space of the second CPU respectively based on the memory mapping mechanism;

[0147] The memory access module 902 is used to control DMA direct memory access to write network data packets into the physical memory area;

[0148] The access control module 903 is used to control the network data packet of the first virtual address of the first virtual address space to access the physical memory area;

[0149] The first processing module 904 is used to process the network data packet through the first CPU according to the five-tuple rule to determine whether the network data packet meets the release rule;

[0150] The release processing module 905 is configured to place the network data packet into a public memory area queue of the physical memory area based on a security monitoring rule through the first CPU if the network data packet meets the release rule;

[0151] The threat acquisition module 906 is used to control the second virtual address of the second virtual address space to access the public memory area queue of the physical memory area to obtain the threat data packet;

[0152] The threat processing module 907 is used to process the threat data packet through the second CPU according to the intrusion detection rules to determine whether the threat data packet matches the intrusion signature;

[0153] The security response module 908 is configured to block the threat data packet, issue an alarm, and record a log if the threat data packet matches an intrusion signature.

[0154] In a seventh aspect, an embodiment of the present application further provides an electronic device that can integrate the firewall rules of the user-mode polling mechanism and the IPS intrusion feature parallel processing device provided in the embodiment of the present application. Figure 10 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 10 The electronic device includes: an input device 43, an output device 44, a memory 42, and one or more processors 41; the memory 42 is used to store one or more programs; when the one or more programs are executed by the one or more processors 41, the one or more processors 41 implement the firewall rules and IPS intrusion feature parallel processing method of the user-mode polling mechanism provided in the above embodiment. The input device 43, the output device 44, the memory 42, and the processor 41 can be connected by a bus or other means. Figure 10 The bus connection is taken as an example.

[0155] The processor 41 executes various functional applications and data processing of the device by running software programs, instructions and modules stored in the memory 42, that is, implements the above-mentioned user-mode polling mechanism firewall rule and IPS intrusion feature parallel processing method.

[0156] The electronic device provided above can be used to execute the firewall rules of the user-mode polling mechanism and the IPS intrusion feature parallel processing method provided in the above embodiment, and has corresponding functions and beneficial effects.

[0157] In an eighth aspect, an embodiment of the present application also provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the firewall rules and IPS intrusion feature parallel processing method as described above, and can achieve the same beneficial effects.

[0158] Of course, the storage medium containing computer-executable instructions provided in an embodiment of the present application is not limited to the firewall rules and IPS intrusion feature parallel processing method described above, and can also execute related operations in the firewall rules and IPS intrusion feature parallel processing method provided in any embodiment of the present application.

[0159] Ninthly, the embodiments of the present application further provide a computer program product, and the methods described in the various embodiments of the present application can be implemented in whole or in part through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the various embodiments of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM (Open Application Model) or other programmable device.

[0160] The computer program or instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program or instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired or wireless method. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; an optical medium, such as a digital video disk; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0161] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0162] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0163] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0164] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0165] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0166] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A method for parallel processing of firewall rules and IPS intrusion features, characterized in that: For a first CPU, the first CPU is bound to a firewall system and the first CPU is located in a kernel layer, the method comprising: Based on the memory mapping mechanism, obtaining a memory mapping of the physical memory area through the first virtual address space; Accessing a network data packet in a physical memory area through a first virtual address in a first virtual address space, wherein the network data packet is written to the physical memory area through DMA direct memory access; Process the network data packet according to the five-tuple rule to determine whether the network data packet meets the release rule; If the network data packet meets the release rules, the network data packet is placed into the public memory area queue of the physical memory area based on the security monitoring rules; If the network data packet does not meet the release rules, the data packet is discarded; The step of placing the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule includes: Determine whether network data packets have preset threat characteristics; If the network data packet does not contain the preset threat potential characteristics, the network data packet will be sent to the upper-layer application for processing; If the network data packet has a preset threat hidden danger feature, the obtained threat data packet will be placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion defense detection, perform feature matching and behavior analysis on the threat data packet, and determine whether the threat data packet matches the preset intrusion feature to determine whether the threat data packet has intrusion features.

2. The method for parallel processing of firewall rules and IPS intrusion features according to claim 1, characterized in that: The processing of the network data packet according to the five-tuple rule to determine whether the network data packet complies with the release rule includes: When all five fields of a network data packet meet the preset rules, the network data packet is judged to meet the release rules; the five fields include: source IP address, destination IP address, source port, destination port and transport layer protocol; If one of the fields of the network data packet does not comply with the preset rule, it is determined that the network data packet does not comply with the release rule.

3. A method for parallel processing of firewall rules and IPS intrusion features, characterized in that: For a network security system, the network security system includes a first CPU and a second CPU, the first CPU is bound to a firewall system, the second CPU is bound to an intrusion detection system IPS, and the first CPU and the second CPU are both located in the kernel layer, the method includes: Based on a memory mapping mechanism, mapping the memory mapping of the physical memory area to a first virtual address space of the first CPU and a virtual address space of the second CPU respectively; Control DMA direct memory access to write network data packets into the physical memory area; Controlling a first virtual address in a first virtual address space to access a network data packet in a physical memory area; Processing the network data packet by the first CPU according to the five-tuple rule to determine whether the network data packet meets the release rule; If the network data packet meets the release rule, the first CPU puts the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule; Controlling the second virtual address of the second virtual address space to access the public memory area queue of the physical memory area to obtain the threat data packet; Processing the threat data packet through the second CPU according to the intrusion detection rules to determine whether the threat data packet matches the intrusion signature; If the threat data packet matches the intrusion signature, the threat data packet will be blocked, an alarm will be issued, and a log will be recorded; The step of placing the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule by the first CPU includes: Determine, by the first CPU, whether the network data packet has a preset threat potential feature; If the network data packet does not contain the preset threat potential characteristics, the network data packet will be sent to the upper-layer application for processing; If the network data packet has a preset threat hidden danger feature, the obtained threat data packet is placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion prevention detection; The processing of the threat data packet by the second CPU according to the intrusion detection rule to determine whether the threat data packet matches the intrusion feature includes: The second CPU performs feature matching and behavior analysis on the threat data packet to determine whether the threat data packet matches a preset intrusion feature, so as to determine whether the threat data packet has an intrusion feature.

4. The method for parallel processing of firewall rules and IPS intrusion features according to claim 3, characterized in that: After determining whether the network data packet complies with the release rule, the method further includes: If the network data packet does not meet the release rules, the data packet is discarded; After determining whether the threat data packet matches the intrusion signature, the method further includes: If the threat data packet does not match the intrusion signature, the network data packet is sent to the upper-layer application for processing.

5. The method for parallel processing of firewall rules and IPS intrusion features according to claim 3, characterized in that: The processing of the network data packet by the first CPU according to the quintuple rule to determine whether the network data packet complies with the release rule includes: When all five fields of the network data packet meet the preset rules, the first CPU determines that the network data packet meets the release rule; wherein the five fields include: source IP address, destination IP address, source port, destination port and transport layer protocol; If one of the fields of the network data packet does not comply with the preset rule, it is determined that the network data packet does not comply with the release rule.

6. The method for parallel processing of firewall rules and IPS intrusion features according to claim 3, characterized in that: The processing of the threat data packet by the second CPU according to the intrusion detection rule to determine whether the threat data packet matches the intrusion feature includes: The second CPU performs feature matching and behavior analysis on the threat data packet to determine whether the threat data packet matches a preset intrusion feature.

7. A device for parallel processing of firewall rules and IPS intrusion features, characterized in that: For a first CPU, the first CPU is bound to a firewall system and the first CPU is located in a kernel layer, the device includes: A first mapping module is configured to obtain a memory mapping of a physical memory area through a first virtual address space based on a memory mapping mechanism; A first access module is configured to access a network data packet in a physical memory area through a first virtual address in a first virtual address space, wherein the network data packet is written into the physical memory area through DMA direct memory access; The release detection module is used to process the network data packet according to the five-tuple rule to determine whether the network data packet meets the release rule; a data storage module, configured to place the network data packet into a public memory area queue of the physical memory area based on security monitoring rules if the network data packet meets the release rules; A data discard module is used to discard the data packet if the network data packet does not meet the release rules; The step of placing the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule includes: Determine whether network data packets have preset threat characteristics; If the network data packet does not contain the preset threat potential characteristics, the network data packet will be sent to the upper-layer application for processing; If the network data packet has a preset threat hidden danger feature, the obtained threat data packet will be placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion defense detection, perform feature matching and behavior analysis on the threat data packet, and determine whether the threat data packet matches the preset intrusion feature to determine whether the threat data packet has intrusion features.

8. A device for parallel processing of firewall rules and IPS intrusion features, characterized in that: Used in a network security system, the network security system includes a first CPU and a second CPU, the first CPU is bound to a firewall system, the second CPU is bound to an intrusion detection system IPS, the first CPU and the second CPU are both located in the kernel layer, the device includes: A memory mapping module is used to map the memory mapping of the physical memory area to the first virtual address space of the first CPU and the virtual address space of the second CPU respectively based on the memory mapping mechanism; Memory access module, used to control DMA direct memory access to write network data packets into the physical memory area; An access control module, configured to control a network data packet of a first virtual address in a first virtual address space to access a physical memory area; A first processing module, configured to process the network data packet through the first CPU according to the quintuple rule, and determine whether the network data packet complies with the release rule; a release processing module, configured to place the network data packet into a public memory area queue of the physical memory area based on a security monitoring rule through the first CPU if the network data packet meets the release rule; A threat acquisition module, configured to control a second virtual address in the second virtual address space to access a public memory area queue in the physical memory area to acquire a threat data packet; A threat processing module, configured to process a threat data packet through the second CPU according to an intrusion detection rule, and determine whether the threat data packet matches an intrusion signature; A security response module is used to block the threat data packet, issue an alarm and record a log if the threat data packet matches the intrusion signature; The step of placing the network data packet into the public memory area queue of the physical memory area based on the security monitoring rule by the first CPU includes: Determine, by the first CPU, whether the network data packet has a preset threat potential feature; If the network data packet does not contain the preset threat potential characteristics, the network data packet will be sent to the upper-layer application for processing; If the network data packet has a preset threat hidden danger feature, the obtained threat data packet is placed in the public memory area queue of the physical memory area for storage, so as to instruct the second CPU to obtain the threat data packet from the public memory area queue for intrusion prevention detection; The processing of the threat data packet by the second CPU according to the intrusion detection rule to determine whether the threat data packet matches the intrusion feature includes: The second CPU performs feature matching and behavior analysis on the threat data packet to determine whether the threat data packet matches a preset intrusion feature, so as to determine whether the threat data packet has an intrusion feature.

Images