A network application firewall rule configuration method, device, equipment and medium

Abstract

The application discloses a network application firewall rule configuration method and device, equipment and medium, and relates to the technical field of network security, comprising: after accessing the network application firewall, detecting attacks on network requests received in a preset time period based on the sub-rules of each level in each protection rule under the current environment, determining the detection result and the time consumed by the sub-rule detection; determining the protection rule hit type distribution in the preset time period by analyzing the detection result; triggering the sub-rule level update based on the protection rule hit type distribution and the time consumed by the sub-rule detection, determining the target protection rule combination under the current environment by solving the Markov decision process constructed based on the update result; when a misjudgment interception behavior occurs based on the configured target protection rule combination, analyzing based on a preset expert decision interface to determine whether the rule correction trigger condition is met at present. The application can dynamically adjust the WAF protection rule combination based on the current environment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, and medium for configuring network application firewall rules. Background Technology

[0002] Traditional WAFs (Web Application Firewalls) use a uniform regular expression rule base, making it impossible to dynamically adjust detection strength based on environmental characteristics in existing rule configuration schemes. Different business systems (such as e-commerce, finance, and government) face significant differences in attack types, traffic scale, and protocol characteristics. For example, financial systems are frequently vulnerable to precise SQL injection and API parameter tampering attacks, while content platforms are more susceptible to front-end attacks such as XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery). Manually adjusting these rules would increase operational costs.

[0003] In addition, using complex regular expressions in this solution can cause a surge in CPU usage, leading to congestion in the business request queue. However, relaxing the rule thresholds to improve the detection rate can result in an exponential increase in the false positive rate. Furthermore, when the environment changes but the rules remain the same, security vulnerabilities can easily arise in highly sensitive environments due to lax rules, while performance bottlenecks can occur in low-risk scenarios due to over-detection. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for configuring network application firewall (WAF) rules, which can dynamically adjust the combination of WAF protection rules based on the current environment, thereby improving the reliability, efficiency, accuracy, and adaptability of WAF protection, and ensuring the processing speed and resource consumption of protection response. The specific solution is as follows:

[0005] Firstly, this application provides a method for configuring network application firewall rules, including:

[0006] After the origin site is connected to the network application firewall, attack detection is performed on network requests received within a preset time period based on the sub-rules of each level in the current protection rules to determine the corresponding detection results and the time consumed by the sub-rule detection.

[0007] By analyzing the detection results, the attack type information suffered based on the network request within the preset time period and the proportion of each type of attack in the attack type information are determined, so as to determine the distribution of protection rule hit types within the preset time period.

[0008] Based on the distribution of the hit types of the protection rules and the time consumed by the detection of the sub-rules, the corresponding sub-rule level update operation is triggered, and the target protection rule combination in the current environment is determined by solving the Markov decision process constructed based on the update results.

[0009] When a misjudgment and interception occurs based on the configured combination of target protection rules, the misjudgment and interception behavior is analyzed based on a preset expert decision interface, and the behavior analysis results are used to determine whether the current rule correction triggering conditions are met.

[0010] Optionally, after the origin site is connected to the network application firewall, the attack detection of network requests received within a preset time period is performed based on the sub-rules of each level in the current environment's protection rules, including:

[0011] After the origin site is connected to the network application firewall, an alarm mode is enabled within a preset time period; the alarm mode is a mode that detects but does not block received network requests.

[0012] When a network request is received, the data in the network request is matched for attack information based on the sub-rules of each level in the current protection rules to determine the detection result corresponding to each sub-rule and the time consumed by the sub-rule detection.

[0013] Optionally, the step of determining the attack type information based on the network request within the preset time period and the proportion of each type of attack within the attack type information by analyzing the detection results, in order to determine the distribution of protection rule hit types within the preset time period, includes:

[0014] By analyzing the detection results, the attack types suffered based on the network requests within the preset time period are statistically analyzed, and the corresponding protection rules are classified based on the attack type information to obtain the rule classification results.

[0015] By determining the proportion of each type of attack in the attack type information within the preset time period, the distribution of protection rule hit types is determined based on the proportion and the rule classification results.

[0016] Optionally, the step of analyzing the misjudged blocking behavior based on a preset expert decision interface and determining whether the rule correction triggering condition is currently met using the behavior analysis results includes:

[0017] Based on a preset expert decision-making interface and expert experience information, it is determined whether the misjudged interception behavior belongs to normal attack interception behavior, so as to obtain the behavior judgment result;

[0018] If the behavior judgment result is yes, then it is determined that the current rule correction trigger condition is not met.

[0019] If the behavior judgment result is negative, then it is determined that the current rule correction trigger condition is met.

[0020] Optionally, after determining that the rule correction triggering condition is currently met, the method further includes:

[0021] Based on the preset expert decision interface, the target sub-rule corresponding to the misjudged interception behavior is searched from the target protection rule combination;

[0022] The target sub-rule is modified by performing a rule weight modification operation through the preset expert decision interface to update the level information of the target sub-rule and obtain the updated sub-rule level information corresponding to the target sub-rule.

[0023] Optionally, the step of triggering the corresponding sub-rule level update operation based on the distribution of the protection rule hit types and the time consumed by the sub-rule detection includes:

[0024] Based on the distribution of the hit types of the protection rules and the time consumed in detecting the sub-rules, the protection capability of each sub-rule is analyzed to obtain the capability analysis results;

[0025] Based on the preset level information and the capability analysis results corresponding to each of the sub-rules, it is determined whether the sub-rule level update triggering condition is met, so as to obtain the triggering judgment result;

[0026] For the trigger judgment result indicating that the sub-rule level update trigger condition is met, a sub-rule level update operation is performed based on the corresponding capability analysis result and the preset level information to obtain the update result.

[0027] Optionally, the step of determining the target protection rule combination in the current environment by solving the Markov decision process constructed based on the update results includes:

[0028] The target state space is determined based on the number of rules by taking each of the current protection rules as a state.

[0029] Based on the update results, select each of the sub-rules in the current protection rules to configure the action space, so as to determine the target action space;

[0030] Based on the preset level information, a sub-rule weight matrix is ​​constructed, and the paranoid reward information corresponding to each type of attack is determined using a preset reward function, the sub-rule weight matrix, and the distribution of the protection rule hit types.

[0031] The corresponding hit benefit bonus information is determined by the preset reward function and the detection results;

[0032] The corresponding time gain information is determined by the preset reward function and the time consumed by the sub-rule detection.

[0033] The target reward is determined based on the paranoid reward information, the hit benefit bonus information, and the time gain information.

[0034] Based on the discount factor, the Bellman optimal equation, the corresponding target reward, and the preset value function, the target value function corresponding to each state is determined respectively.

[0035] The target protection rule combination is determined based on the target value function in the current environment.

[0036] Secondly, this application provides a network application firewall rule configuration device, comprising:

[0037] The attack detection module is used to perform attack detection on network requests received within a preset time period based on sub-rules of each level in the current protection rules after the origin site is connected to the network application firewall, so as to determine the corresponding detection results and the time consumed by the sub-rule detection.

[0038] The hit distribution determination module is used to determine the attack type information suffered based on the network request within the preset time period and the proportion of each type of attack in the attack type information by analyzing the detection results, so as to determine the hit type distribution of the protection rule within the preset time period.

[0039] The rule combination determination module is used to trigger the corresponding sub-rule level update operation based on the distribution of the hit type of the protection rule and the time consumed by the sub-rule detection, and to determine the target protection rule combination in the current environment by solving the Markov decision process constructed based on the update result.

[0040] The rule correction triggering module is used to analyze the misjudged interception behavior based on a preset expert decision interface when a misjudged interception behavior occurs based on the configured target protection rule combination, and to determine whether the rule correction triggering condition is met using the behavior analysis results.

[0041] Thirdly, this application provides an electronic device, comprising:

[0042] Memory, used to store computer programs;

[0043] A processor is used to execute the computer program to implement the steps of the aforementioned network application firewall rule configuration method.

[0044] Fourthly, this application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of the aforementioned network application firewall rule configuration method.

[0045] As can be seen, in this application, after the origin site is connected to the network application firewall, attack detection is performed on network requests received within a preset time period based on sub-rules of each level in the current protection rules to determine the corresponding detection results and the time consumed by sub-rule detection. The detection results are analyzed to determine the attack type information suffered by the network requests within the preset time period and the proportion of each type of attack, thus determining the distribution of protection rule hit types within the preset time period. Based on the distribution of protection rule hit types and the time consumed by sub-rule detection, a corresponding sub-rule level update operation is triggered, and the target protection rule combination in the current environment is determined by solving a Markov decision process constructed based on the update results. When a misjudgment interception occurs based on the configured target protection rule combination, the misjudgment interception behavior is analyzed based on a preset expert decision interface, and the behavior analysis results are used to determine whether the rule correction triggering condition is met. In other words, this application first detects received network requests within a preset time period based on sub-rules of each level in the current protection rules, then uses the detection results to determine the distribution of protection rule hit types within the preset time period, and triggers the corresponding sub-rule level update operation in conjunction with the time consumed by sub-rule detection. Subsequently, a Markov decision process is constructed and solved based on the updated results to obtain and configure the target protection rule combination. When a false positive interception occurs, the false positive interception behavior is analyzed based on a preset expert decision interface to determine whether the current rule correction triggering conditions are met. In this way, the WAF protection rule combination can be dynamically adjusted based on the current environment, thereby improving the reliability, efficiency, accuracy, and adaptability of WAF protection, while ensuring the processing speed and resource consumption of protection response. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0047] Figure 1 A flowchart of a network application firewall rule configuration method provided in this application;

[0048] Figure 2 A rule classification diagram provided for this application;

[0049] Figure 3 This application provides a specific schematic diagram of a Markov decision-making process;

[0050] Figure 4 A schematic diagram of a network application firewall rule configuration device provided in this application;

[0051] Figure 5 This application provides a structural diagram of an electronic device. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Traditional Web Application Firewalls (WAFs) use a unified regular expression rule base, making it impossible to dynamically adjust detection intensity based on environmental characteristics in existing rule configuration schemes. Different business systems (such as e-commerce, finance, and government) face significant differences in attack types, traffic scale, and protocol characteristics. Manual adjustments would increase operational costs. Furthermore, using complex regular expressions in this scheme can cause a surge in CPU utilization, leading to congestion in the business request queue. However, relaxing rule thresholds to improve detection rates can result in an exponential increase in false positive rates. Moreover, when the environment changes but the rules remain the same, security vulnerabilities can easily arise in highly sensitive environments due to lenient rules, while performance bottlenecks can occur in low-risk scenarios due to over-detection. Therefore, this application provides a Web Application Firewall rule configuration scheme that can dynamically adjust the combination of WAF protection rules based on the current environment, thereby improving the reliability, efficiency, accuracy, and adaptability of WAF protection, while ensuring the processing speed and resource consumption of protection responses.

[0054] See Figure 1 As shown in the figure, an embodiment of the present invention discloses a method for configuring network application firewall rules, including:

[0055] Step S11: After the source site is connected to the network application firewall, attack detection is performed on the network requests received within a preset time period based on the sub-rules of each level in the current protection rules, so as to determine the corresponding detection results and the time consumed by the sub-rule detection.

[0056] Specifically, in this embodiment, after the origin site is connected to the WAF, an alarm mode is activated for a certain period of time. This mode detects incoming network requests but does not intercept them, allowing the acquisition of basic rule detection attributes. In other words, after the origin site is connected to the WAF, an alarm mode is activated for a preset time period. The alarm mode detects received network requests but does not intercept them. Then, when a network request is received, attack information matching is performed on the data in the network request based on the sub-rules of each level in the current environment's protection rules to determine the detection results corresponding to each sub-rule and the time consumed by the sub-rule detection. The preset time period can be configured based on actual needs. It is important to understand that after receiving a network request, detection is performed using the three levels (basic, intermediate, and advanced) of each protection rule, and the time consumed by each rule at each level in the current environment is recorded. It is understandable that during this stage, it is possible that all sub-rules of each protection rule at all levels are matched, or only some or no patterns are matched.

[0057] Step S12: By analyzing the detection results, determine the attack type information suffered based on the network request within the preset time period and the proportion of each type of attack in the attack type information, so as to determine the distribution of protection rule hit types within the preset time period.

[0058] In this embodiment, by analyzing the detection results, if an attack-type access is detected, the matched rules and the level of the rules used are recorded, along with the type of attack suffered. That is, firstly, the attack type information based on network requests within a preset time period is statistically analyzed using the detection results, and the corresponding protection rules are classified based on the attack type information to obtain rule classification results; then, by determining the proportion of each type of attack in the attack type information within the preset time period, the distribution of protection rule hit types is determined based on the proportion and the rule classification results.

[0059] Furthermore, regarding the determination of the distribution of protection rule hit types, firstly, based on the detection results, the protection rules triggered by the protected attack types are classified, such as: SQL injection, XSS attack, WEBSHELL attack, malicious crawler, invalid access control, etc. The rule classification results are obtained, and the set C of protection rule types can be defined based on these classification results:

[0060] ;

[0061] Where n is the number of types of protection rules in the partition. as well as This indicates the type of protection rule. Then, within a preset time period, the proportion of attacks of different attack types is calculated to determine the corresponding distribution of protection rule types triggered, i.e., the distribution K of protection rule hit types is:

[0062] ;

[0063] in, express The corresponding hit probability, express The corresponding hit probability, express The corresponding hit probability, express The corresponding hit probability.

[0064] Step S13: Based on the distribution of the hit types of the protection rules and the time consumed by the detection of the sub-rules, trigger the corresponding sub-rule level update operation, and determine the target protection rule combination in the current environment by solving the Markov decision process constructed based on the update results.

[0065] In this embodiment, after obtaining the distribution of protection rule hit types, the corresponding sub-rule level update is triggered based on the distribution of protection rule hit types and the recorded sub-rule detection time. Specifically, firstly, the protection capability of each sub-rule is analyzed based on the distribution of protection rule hit types and the sub-rule detection time to obtain capability analysis results; then, based on preset level information and the capability analysis results corresponding to each sub-rule, it is determined whether the sub-rule level update triggering condition is met to obtain a triggering judgment result; then, for the triggering judgment results indicating that the sub-rule level update triggering condition is met, the sub-rule level update operation is performed based on the corresponding capability analysis results and preset level information to obtain the update result. It should be understood that, combined with... Figure 2 As shown, each set of protection rule types stores rules for detecting specific patterns. Within the same rule, there are four levels based on protection capability: "None," "Basic," "Intermediate," and "Advanced." Different rules have different protection capabilities, and their execution times also differ; more complex rules will take longer to detect. For example, the sub-rules for each of the four levels are described below:

[0066] 1) No rules;

[0067] No rule means not to participate in regular expression matching, and is used to skip this rule.

[0068] 2) Elementary rules;

[0069] ;

[0070] As shown in the expression above, the regular expression for this level rule is a simple regular expression that only focuses on identifying sequences containing "select" and "from", which can detect some basic SQL injection vulnerabilities.

[0071] 3) Intermediate rules;

[0072] ;

[0073] As shown in the expression above, the regular expression for this level of rule includes more SQL statement elements, such as "group" and "Join," to improve accuracy. It can identify more complex injection attempts but can still be evaded by variations.

[0074] 4) Advanced rules.

[0075] ;

[0076] As shown in the expression above, the regular expression for this level rule uses techniques such as negative forward confirmation syntax and string boundary matching to accurately identify SELECT clauses while avoiding common false positives.

[0077] In other words, this embodiment divides the same protection rules into different levels according to their detection capabilities and the time consumed by the detection. By detecting the hit frequency of the protection type and combining the detection time corresponding to the hit detection, the level of the rule used is dynamically adjusted.

[0078] To further determine the rule combination suitable for the current environment, this embodiment adopts a Markov decision process. First, by treating each current protection rule as a state, the target state space is determined based on the number of rules. Then, based on the update results, each sub-rule among the current protection rules is selected for action space configuration to determine the target action space. Next, a sub-rule weight matrix is ​​constructed based on preset level information, and the paranoid reward information corresponding to various attacks is determined using a preset reward function, the sub-rule weight matrix, and the distribution of protection rule hit types. The corresponding hit benefit bonus information is determined through the preset reward function and detection results. The corresponding time gain information is determined through the preset reward function and the time consumed by sub-rule detection. The target reward is determined based on the paranoid reward information, hit benefit bonus information, and time gain information. The target value function corresponding to each state is determined based on the discount factor, the Bellman optimal equation, the corresponding target reward, and the preset value function. Finally, the target protection rule combination for the current environment is determined based on the target value function. The specific related steps are as follows:

[0079] 1) Define the state space;

[0080] Assuming there are a total of n protection rules, the state space is: .

[0081] 2) Define the action space;

[0082] Each protection rule, excluding "none", has three paradigms, therefore the action space is... , among them These represent the paradigms corresponding to "basic", "intermediate", and "advanced" levels of each protection rule, respectively.

[0083] 3) Define the transition probability;

[0084] After choosing action a from state s, the probability of transitioning to state s+1 is 1, that is... =1, where, .

[0085] 4) Define the reward function;

[0086] reward function This represents the reward obtained after choosing action a in state s. The final result of the reward function consists of three parts:

[0087] a) Rule type selection bias bonus, i.e., the biased reward information e. Rule type selection bias definition: For each protection rule, except for "None," a specified compilation matrix is ​​assigned to each paradigm, constructing matrix T in the order of "Elementary," "Intermediate," and "Advanced."

[0088] ;

[0089] in, , as well as These represent the weights of each paradigm representation corresponding to "Basic," "Intermediate," and "Advanced" in the protection rules, respectively. The higher the paradigm weight, the greater the resulting weight. The attack type bias reward e for the current attack is obtained by calculating the product of the protection rule hit type distribution K and T.

[0090] ;

[0091] in, express arrive The mean.

[0092] b) The benefit bonus from rule hits, i.e., the hit benefit bonus information. If the enforced rule protects the request and the rule is hit, a positive benefit can be obtained. .

[0093] c) The time gain consumed by executing the rule, i.e., time gain information. Since executing each rule takes time, this time consumption represents a negative reward for the entire system. express.

[0094] The final reward function is the sum of the three rewards mentioned above, that is... Then the target reward can be determined according to the formula.

[0095] 5) Define the value function;

[0096] The result of the reward function is related to the detection execution time, bias reward, and hit reward. Define the value function. To minimize time and achieve the highest matching rate, the value function... This represents the expected total reward that can be obtained by acting according to the optimal strategy, starting from state s.

[0097] 6) Bellman optimal equation;

[0098] The value function defined in this embodiment needs to satisfy the Bellman optimality equation, which is: in, It is a discount factor, which is set since all times are equally important. =1.

[0099] 7) Calculate the value function in reverse.

[0100] Starting with the last protection rule, calculate the optimal value function for each state (i.e., rule) in reverse order. For state n: For the state : And so on, until state 1 is calculated.

[0101] Through the Markov decision process described above, a set of rule combinations that maximizes benefits in the current environment can be selected. In this combination, some protection rules choose the "basic" protection level, some choose the "intermediate" protection level, and others choose the "advanced" protection level. By using different levels of rules, both protection is ensured, and response time and efficiency are balanced. The process can be described as follows: Figure 3 As shown, in one specific implementation, the rule hit distributions for XSS detection, SQL injection detection, WEBSHELL detection, ..., malicious crawler detection are calculated to be 0.32, 0.16, 0.09, ..., 0.42. Taking the protection rule triggered by XSS detection as an example, the rewards corresponding to the three paradigms of the three levels in this rule are calculated. Then, based on the calculated three reward information, the optimal value function is determined to return and update the rule level, such as... Figure 3As shown in steps 1, 2, 3, and 4, this allows for further strengthening of the rules' protection. For frequently attacked types, the rule level will be upgraded through the above decision-making process, up to the "advanced" level. For types that are less frequently attacked or not attacked at all, the rule level will be downgraded to "basic" protection. This dynamically adjusts the rule level, allowing the protection mode to change with the environment while ensuring response speed and resource consumption.

[0102] Step S14: When a misjudged interception occurs based on the configured target protection rule combination, the misjudged interception is analyzed based on the preset expert decision interface, and the behavior analysis results are used to determine whether the rule correction triggering conditions are met.

[0103] In this embodiment, after determining the target protection rule combination corresponding to the current environment, the rules are configured, and expert intervention is introduced when necessary. That is, when a misjudgment and interception occurs based on the configured target protection rule combination, the system first determines whether the misjudged interception is a normal attack interception based on a preset expert decision interface and expert experience information to obtain a behavior judgment result. Then, if the behavior judgment result is yes, it is determined that the current rule correction triggering condition is not met; if the behavior judgment result is no, it is determined that the current rule correction triggering condition is met. After determining that the current rule correction triggering condition is met, the system further includes: searching for the target sub-rule corresponding to the misjudged interception from the target protection rule combination based on the preset expert decision interface; modifying the rule weight of the target sub-rule through the preset expert decision interface to update the level information of the target sub-rule, and obtaining the updated sub-rule level information corresponding to the target sub-rule. In other words, when the Markov decision process selects a set of specified protection rules, if normal traffic is misjudged as an attack, the probability of intercepting specific types of requests will increase dramatically. Therefore, expert intervention is needed at this time, and experts use their experience to determine whether the interception is a misjudgment or a normal attack interception. In the case of false blocking, experts can find the protection rules that were blocked, check the specific blocking rule level, and after analysis, modify the values ​​in the bias matrix T of each rule to change the weight of the rule, so that the selection of its rule level will be shifted. The worst result is that it will shift to "no" rule.

[0104] In summary, this embodiment categorizes the same protection rules into different levels based on their detection capabilities and the time consumed in detection. A Markov decision process is used to find the optimal solution that executes all protection rules, and this optimal solution yields the most suitable rule system for the protected site. Simultaneously, changes in attack types are monitored, and the weight of certain rule types is dynamically adjusted based on these changes, prompting the rule system to dynamically evolve and improve protection capabilities under the influence of the optimal solution. The time consumed in rule verification serves as negative feedback, encouraging rules that participate less in attack protection to move to levels that consume fewer resources.

[0105] Therefore, this application first detects received network requests based on sub-rules of each level within each protection rule under the current environment within a preset time period. Then, it uses the detection results to determine the distribution of protection rule hit types within the preset time period and triggers the corresponding sub-rule level update operation based on the time consumed by sub-rule detection. Next, a Markov decision process is constructed based on the update results and solved to obtain and configure the target protection rule combination. When a false positive interception occurs, the false positive interception behavior is analyzed based on a preset expert decision interface to determine whether the rule correction triggering condition is met. In this way, the WAF protection rule combination can be dynamically adjusted based on the current environment, thereby improving the reliability, efficiency, accuracy, and adaptability of WAF protection, while ensuring the processing speed and resource consumption of protection response.

[0106] See Figure 4 As shown in the figure, this application also discloses a network application firewall rule configuration device, including:

[0107] The attack detection module 11 is used to perform attack detection on network requests received within a preset time period based on the sub-rules of each level in the current protection rules after the origin site is connected to the network application firewall, so as to determine the corresponding detection results and the time consumed by the sub-rule detection.

[0108] The hit distribution determination module 12 is used to determine the attack type information suffered based on the network request within the preset time period and the proportion of each type of attack in the attack type information by analyzing the detection results, so as to determine the hit type distribution of the protection rule within the preset time period.

[0109] The rule combination determination module 13 is used to trigger the corresponding sub-rule level update operation based on the distribution of the protection rule hit type and the time consumed by the sub-rule detection, and to determine the target protection rule combination in the current environment by solving the Markov decision process constructed based on the update result.

[0110] The rule correction triggering module 14 is used to analyze the misjudged interception behavior based on a preset expert decision interface when a misjudged interception behavior occurs based on the configured target protection rule combination, and to determine whether the rule correction triggering condition is met using the behavior analysis results.

[0111] Therefore, this application first detects received network requests based on sub-rules of each level within each protection rule under the current environment within a preset time period. Then, it uses the detection results to determine the distribution of protection rule hit types within the preset time period and triggers the corresponding sub-rule level update operation based on the time consumed by sub-rule detection. Next, a Markov decision process is constructed based on the update results and solved to obtain and configure the target protection rule combination. When a false positive interception occurs, the false positive interception behavior is analyzed based on a preset expert decision interface to determine whether the rule correction triggering condition is met. In this way, the WAF protection rule combination can be dynamically adjusted based on the current environment, thereby improving the reliability, efficiency, accuracy, and adaptability of WAF protection, while ensuring the processing speed and resource consumption of protection response.

[0112] In some specific embodiments, the attack detection module 11 may specifically include:

[0113] The alarm mode activation unit is used to activate the alarm mode within a preset time period after the source site is connected to the network application firewall; the alarm mode is a mode that detects but does not block received network requests.

[0114] The request detection unit is used to, when receiving a network request, perform attack information matching on the data in the network request based on the sub-rules of each level in the current environment's protection rules, so as to determine the detection result corresponding to each sub-rule and the time consumed by the sub-rule detection.

[0115] In some specific embodiments, the hit distribution determination module 12 may specifically include:

[0116] The rule classification unit is used to analyze the detection results to statistically analyze the attack type information suffered by the network request within the preset time period, and classify the corresponding protection rules based on the attack type information to obtain the rule classification result.

[0117] The type distribution determination unit is used to determine the distribution of protection rule hit types based on the proportion of each type of attack in the attack type information within the preset time period and the rule classification result.

[0118] In some specific embodiments, the rule correction triggering module 14 may specifically include:

[0119] The behavior judgment unit is used to judge whether the misjudged interception behavior belongs to the normal attack interception behavior based on the preset expert decision interface and expert experience information, so as to obtain the behavior judgment result;

[0120] The condition-not-triggered unit is used to determine that the current rule correction triggering condition is not met if the behavior judgment result is yes.

[0121] The condition triggering unit is used to determine that the current rule correction triggering condition is met if the behavior judgment result is negative.

[0122] In some specific embodiments, the network application firewall rule configuration may further include:

[0123] The rule lookup unit is used to search for the target sub-rule corresponding to the misjudged interception behavior from the target protection rule combination based on the preset expert decision interface;

[0124] The weight modification unit is used to perform rule weight modification operations on the target sub-rule through the preset expert decision interface, so as to update the level information of the target sub-rule and obtain the updated sub-rule level information corresponding to the target sub-rule.

[0125] In some specific embodiments, the rule combination determination module 13 may specifically include:

[0126] The capability analysis unit is used to perform protection capability analysis on each of the sub-rules based on the distribution of the hit types of the protection rules and the time consumed by the detection of the sub-rules, so as to obtain the capability analysis results;

[0127] The analysis result processing unit is used to determine whether the sub-rule level update triggering condition is met based on the preset level information and the capability analysis results corresponding to each sub-rule, so as to obtain the triggering judgment result;

[0128] The level update unit is used to perform a sub-rule level update operation based on the corresponding capability analysis result and the preset level information, based on the trigger judgment result indicating that the sub-rule level update trigger condition is met, so as to obtain the update result.

[0129] In some specific embodiments, the rule combination determination module 13 may specifically include:

[0130] A state space determination unit is used to determine a target state space based on the number of rules by taking each of the current protection rules as a state.

[0131] An action space determination unit is used to select each of the sub-rules in the current protection rules based on the update result for action space configuration, so as to determine the target action space;

[0132] Based on the preset level information, a sub-rule weight matrix is ​​constructed, and a preset reward function and the sub-paranoid reward information determination unit are used to determine the paranoid reward information corresponding to each type of attack based on the rule weight matrix and the distribution of the protection rule hit type.

[0133] The hit benefit bonus information determination unit is used to determine the corresponding hit benefit bonus information through the preset reward function and the detection result;

[0134] The time gain information determination unit is used to determine the corresponding time gain information through the preset reward function and the time consumed by the sub-rule detection.

[0135] The target reward determination unit is used to determine the target reward based on the paranoia reward information, the hit benefit bonus information, and the time gain information.

[0136] The value function determination unit is used to determine the target value function corresponding to each state based on the discount factor, the Bellman optimal equation, the corresponding target reward, and the preset value function.

[0137] The rule combination determination unit is used to determine the target protection rule combination in the current environment based on the target value function.

[0138] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0139] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network application firewall rule configuration method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.

[0140] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0141] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0142] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the network application firewall rule configuration method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0143] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned network application firewall rule configuration method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0144] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0145] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0146] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0147] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0148] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for configuring network application firewall rules, characterized in that, include: After the origin site is connected to the network application firewall, attack detection is performed on network requests received within a preset time period based on the sub-rules of each level in the current protection rules to determine the corresponding detection results and the time consumed by the sub-rule detection. By analyzing the detection results, the attack type information suffered based on the network request within the preset time period and the proportion of each type of attack in the attack type information are determined, so as to determine the distribution of protection rule hit types within the preset time period. Based on the distribution of the hit types of the protection rules and the time consumed by the detection of the sub-rules, the corresponding sub-rule level update operation is triggered, and the target protection rule combination in the current environment is determined by solving the Markov decision process constructed based on the update results. When a misjudgment and interception occurs based on the configured combination of target protection rules, the misjudgment and interception is analyzed based on a preset expert decision interface, and the behavior analysis results are used to determine whether the rule correction triggering conditions are met. The process of determining the target protection rule combination in the current environment by solving the Markov decision process constructed based on the update results includes: The target state space is determined based on the number of rules by taking each of the current protection rules as a state. Based on the update results, select each of the sub-rules in the current protection rules to configure the action space, so as to determine the target action space; A sub-rule weight matrix is ​​constructed based on preset level information, and the paranoid reward information corresponding to each type of attack is determined using a preset reward function, the sub-rule weight matrix, and the distribution of the protection rule hit types. The corresponding hit benefit bonus information is determined by the preset reward function and the detection results; The corresponding time gain information is determined by the preset reward function and the time consumed by the sub-rule detection. The target reward is determined based on the paranoid reward information, the hit benefit bonus information, and the time gain information. Based on the discount factor, the Bellman optimal equation, the corresponding target reward, and the preset value function, the target value function corresponding to each state is determined respectively. The target protection rule combination is determined based on the target value function in the current environment.

2. The network application firewall rule configuration method according to claim 1, characterized in that, After the origin site is connected to the network application firewall, attack detection is performed on network requests received within a preset time period based on sub-rules of each level in the current environment's protection rules, including: After the origin site is connected to the network application firewall, an alarm mode is enabled within a preset time period; the alarm mode is a mode that detects but does not block received network requests. When a network request is received, the data in the network request is matched for attack information based on the sub-rules of each level in the current protection rules to determine the detection result corresponding to each sub-rule and the time consumed by the sub-rule detection.

3. The network application firewall rule configuration method according to claim 1, characterized in that, The step of determining the attack type information based on the network request within the preset time period and the proportion of each type of attack within the attack type information by analyzing the detection results, in order to determine the distribution of protection rule hit types within the preset time period, includes: By analyzing the detection results, the attack types suffered based on the network requests within the preset time period are statistically analyzed, and the corresponding protection rules are classified based on the attack type information to obtain the rule classification results. By determining the proportion of each type of attack in the attack type information within the preset time period, the distribution of protection rule hit types is determined based on the proportion and the rule classification results.

4. The network application firewall rule configuration method according to claim 1, characterized in that, The step of analyzing the misjudged blocking behavior based on a preset expert decision interface and using the behavior analysis results to determine whether the rule correction triggering conditions are met includes: Based on a preset expert decision-making interface and expert experience information, it is determined whether the misjudged interception behavior belongs to normal attack interception behavior, so as to obtain the behavior judgment result; If the behavior judgment result is yes, then it is determined that the current rule correction trigger condition is not met. If the behavior judgment result is negative, then it is determined that the current rule correction trigger condition is met.

5. The network application firewall rule configuration method according to claim 4, characterized in that, After determining that the current rule correction triggering condition is met, the process also includes: Based on the preset expert decision interface, the target sub-rule corresponding to the misjudged interception behavior is searched from the target protection rule combination; The target sub-rule is modified by performing a rule weight modification operation through the preset expert decision interface to update the level information of the target sub-rule and obtain the updated sub-rule level information corresponding to the target sub-rule.

6. The network application firewall rule configuration method according to any one of claims 1 to 5, characterized in that, The step of triggering the corresponding sub-rule level update operation based on the distribution of the protection rule hit types and the time consumed by the sub-rule detection includes: Based on the distribution of the hit types of the protection rules and the time consumed in detecting the sub-rules, the protection capability of each sub-rule is analyzed to obtain the capability analysis results; Based on the preset level information and the capability analysis results corresponding to each of the sub-rules, it is determined whether the sub-rule level update triggering condition is met, so as to obtain the triggering judgment result; For the trigger judgment result indicating that the sub-rule level update trigger condition is met, a sub-rule level update operation is performed based on the corresponding capability analysis result and the preset level information to obtain the update result.

7. A network application firewall rule configuration device, characterized in that, include: The attack detection module is used to perform attack detection on network requests received within a preset time period based on sub-rules of each level in the current protection rules after the origin site is connected to the network application firewall, so as to determine the corresponding detection results and the time consumed by the sub-rule detection. The hit distribution determination module is used to determine the attack type information suffered based on the network request within the preset time period and the proportion of each type of attack in the attack type information by analyzing the detection results, so as to determine the hit type distribution of the protection rule within the preset time period. The rule combination determination module is used to trigger the corresponding sub-rule level update operation based on the distribution of the hit type of the protection rule and the time consumed by the sub-rule detection, and to determine the target protection rule combination in the current environment by solving the Markov decision process constructed based on the update result. The rule correction triggering module is used to analyze the misjudged interception behavior based on a preset expert decision interface when a misjudged interception behavior occurs based on the configured target protection rule combination, and to determine whether the rule correction triggering condition is met using the behavior analysis results. The rule combination determination module includes: A state space determination unit is used to determine a target state space based on the number of rules by taking each of the current protection rules as a state. An action space determination unit is used to select each of the sub-rules in the current protection rules based on the update result for action space configuration, so as to determine the target action space; The paranoia reward information determination unit is used to construct a sub-rule weight matrix based on preset level information, and use a preset reward function, the sub-rule weight matrix and the distribution of the protection rule hit type to determine the paranoia reward information corresponding to the various types of attacks. The hit benefit bonus information determination unit is used to determine the corresponding hit benefit bonus information through the preset reward function and the detection result; The time gain information determination unit is used to determine the corresponding time gain information through the preset reward function and the time consumed by the sub-rule detection. The target reward determination unit is used to determine the target reward based on the paranoia reward information, the hit benefit bonus information, and the time gain information. The value function determination unit is used to determine the target value function corresponding to each state based on the discount factor, the Bellman optimal equation, the corresponding target reward, and the preset value function. The rule combination determination unit is used to determine the target protection rule combination in the current environment based on the target value function.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the network application firewall rule configuration method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the network application firewall rule configuration method as described in any one of claims 1 to 6.

Images