Network security rule matching method, device, equipment, medium and product

Abstract

The invention provides a network security rule matching method, device and equipment, a medium and a product, and belongs to the technical field of network security, and the method comprises the steps: obtaining network byte data; based on the network byte data, matching a first preset rule in the first-level automaton; if the matching is successful, determining an initial rule of the network byte data which is successfully matched in the first preset rule, and selecting a target automaton with the initial rule from a plurality of second-level automatons; matching a second preset rule in the target automaton based on the initial rule; and if the matching is successful, determining a target rule, matched successfully, of the network byte data in the second preset rule. According to the network security rule matching method provided by the invention, the network security rule matching speed can be improved through the first-stage automaton, then accurate matching of the target automaton is further realized through the target automaton, and the matching speed is improved under the condition of meeting accurate matching, so that the network security rule matching efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security rule matching method, device, equipment, medium and product. Background Art

[0002] With the continuous development and popularization of the internet, network security issues are also increasing. Therefore, to protect networks from various threats and attacks, network traffic detection can be used to identify network security issues and provide reliable network services and data security. Non-deterministic Finite State Automata (NFA) is a high-performance regular rule matching engine for network traffic security detection applications such as intrusion detection systems, intrusion prevention systems, network application firewalls, and deep packet inspection. Because NFA matching requires processing multiple states simultaneously, it requires parallel matching using Single Instruction Multiple Data (SIMD). Furthermore, since each NFA node (state) is represented by one bit, the width supported by the processor's SIMD instructions limits the number of NFA states that can be processed at once.

[0003] However, when there are a large number of rules or a large number of inseparable exons, the number of NFA states generated may be large, potentially exceeding the width of the current SIMD instruction. This requires multiple SIMD instructions for parallel matching, which may lead to irrational instruction allocation. Furthermore, when the NFA engine performs rule matching, a rule rarely successfully matches. This means that even for most unmatched rules, a full matching time is still required, resulting in low rule matching efficiency. Summary of the Invention

[0004] The present invention provides a network security rule matching method, device, equipment, medium and product to solve the problem of low rule matching efficiency in the prior art.

[0005] In a first aspect, the present invention provides a network security rule matching method, comprising:

[0006] Get network byte data;

[0007] Based on the network byte data, matching a first preset rule in a first-level automaton; the first-level automaton is obtained by merging states of a non-deterministic finite state automaton;

[0008] If the match is successful, determining an initial rule that the network byte data successfully matches in the first preset rule, and selecting a target automaton that has the initial rule from a plurality of second-level automata; the plurality of second-level automata are obtained by state splitting of a non-deterministic finite state automaton;

[0009] Based on the initial rule, matching a second preset rule in the target automaton;

[0010] If the match is successful, it is determined that the network byte data successfully matches the target rule in the second preset rule.

[0011] In one embodiment, matching a first preset rule in a first-level automaton based on the network byte data includes:

[0012] Determine the first byte data in the network byte data and the corresponding starting state in the first-level automaton;

[0013] Based on the first preset rule in the first-level automaton and the initial state, traverse each remaining byte data in the network byte data, and perform state jump for each remaining byte data; the remaining byte data refers to the byte data in the network byte data except the first byte data;

[0014] If the last byte data in each of the remaining byte data does not show a state jump termination before jumping to the termination state, it is determined that the match is successful.

[0015] In one embodiment, matching a second preset rule in the target automaton based on the initial rule includes:

[0016] If the starting state of the initial rule is the first state, determining the first starting position corresponding to the starting state in the target automaton; the first state is used to match any single character;

[0017] Based on the second preset rule in the target automaton and the first starting position, traverse each first remaining state in the initial rule and perform state jump for each first remaining state; the first remaining state refers to a state in the initial rule other than the starting state;

[0018] If the last state in each of the first remaining states does not show a state jump termination before jumping to the termination state, it is determined that the match is successful.

[0019] In one embodiment, matching a second preset rule in the target automaton based on the initial rule further includes:

[0020] If the initial state of the initial rule is the second state, the initial rule is subjected to rule reverse processing to obtain a reverse rule; the second state is used to match a specific character;

[0021] Determine a second starting position corresponding to the starting state of the reverse rule in the target automaton;

[0022] Based on the second preset rule and the second starting position in the target automaton, traverse each second remaining state in the reverse rule, and perform state jump for each second remaining state; the second remaining state refers to a state in the reverse rule other than the starting state;

[0023] If the last state in each second remaining state does not show a state jump termination before jumping to the terminal state, it is determined that the match is successful.

[0024] In one embodiment, before obtaining the network byte data, the method further includes:

[0025] Determining a difference between the number of states in the non-deterministic finite state automaton and a preset number of states; merging the states in the non-deterministic finite state automaton based on the difference to obtain a first-level automaton;

[0026] The third preset rule of the non-deterministic finite state automaton is split into multiple sub-rules according to the condition that the number of states is less than the preset number of states; and a second-level automaton corresponding to each sub-rule is generated.

[0027] In one embodiment, after determining the target rule that matches successfully, the method further includes:

[0028] Determining network security detection results according to the target rules;

[0029] Perform network management based on network security test results.

[0030] In a second aspect, the present invention further provides a network security rule matching device, comprising:

[0031] Acquisition module, used to obtain network byte data;

[0032] A first matching module is configured to match a first preset rule in a first-level automaton based on the network byte data; the first-level automaton is obtained by merging states of a non-deterministic finite state automaton;

[0033] a selection module configured to, if a match is successful, determine an initial rule that the network byte data successfully matches in the first preset rule, and select a target automaton that has the initial rule from a plurality of second-level automata; the plurality of second-level automata being obtained by state splitting of a non-deterministic finite state automaton;

[0034] A second matching module, configured to match a second preset rule in the target automaton based on the initial rule;

[0035] The target determination module is used to determine the target rule that the network byte data successfully matches in the second preset rule if the match is successful.

[0036] In a third aspect, the present invention provides a device, comprising an electronic device, wherein the electronic device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the network security rule matching method as described in any one of the above are implemented.

[0037] In a fourth aspect, the present invention further provides a medium comprising a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above-mentioned network security rule matching methods are implemented.

[0038] In a fifth aspect, the present invention also provides a product, which includes a computer program product, and the computer program product includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by the processor, it implements the steps of any of the network security rule matching methods described above.

[0039] The network security rule matching method, apparatus, device, medium, and product provided by the present invention first perform network security rule matching on network byte data through a more relaxed first-level automaton with fewer states, which can improve the speed of network security rule matching. If the network byte data successfully matches the initial rule in the first-level automaton, a target automaton with the initial rule is further selected from multiple second-level automatons, and network security rule matching is performed on the initial rule to achieve accurate matching of the target automaton. Therefore, network security rule matching can increase the matching speed while satisfying accurate matching, thereby improving the efficiency of network security rule matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 This is a flow chart of the network security rule matching method provided by the present invention;

[0042] Figure 2 It is a schematic diagram of the rules provided by the present invention;

[0043] Figure 3 It is a schematic diagram of a simple merge of the normal state provided by the present invention;

[0044] Figure 4 It is a schematic diagram of the termination state merging provided by the present invention;

[0045] Figure 5 This is a schematic diagram of the structure of the network security rule matching device provided by the present invention;

[0046] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0047] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0048] It should be noted that, in the description of the present invention, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, the phrase "comprises a..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising the elements. Terms such as "upper" and "lower" indicate positions or relationships based on those shown in the accompanying drawings and are intended solely to facilitate the description of the present invention and simplify the description. They are not intended to indicate or imply that the devices or elements referred to must have a specific orientation, be constructed, or operate in a specific orientation, and are therefore not to be construed as limitations on the present invention. Unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be broadly construed, for example, to mean fixed, removable, or integral; mechanical or electrical; direct or indirect through an intermediary; or internal communication between two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0049] The terms "first," "second," and so forth, used herein are used to distinguish similar objects, not to describe a specific order or precedence. It should be understood that such terms are interchangeable where appropriate, allowing embodiments of the present invention to be implemented in an order other than that illustrated or described herein. Furthermore, the terms "first," "second," and so forth generally distinguish objects of a single type, and do not limit the number of objects. For example, the first object may be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates an "or" relationship between the connected objects.

[0050] The following combination Figures 1-6 Describe the network security rule matching method, device, equipment, medium and product provided by the present invention.

[0051] Figure 1 This is a flow chart of the network security rule matching method provided by the present invention. Figure 1 As shown, the network security rule matching method provided by the present invention includes but is not limited to the following steps:

[0052] Step 100: Obtain network byte data;

[0053] Step 200: Matching a first preset rule in a first-level automaton based on the network byte data;

[0054] Step 300: If the match is successful, determining the initial rule that the network byte data successfully matches in the first preset rule, and selecting a target automaton that has the initial rule from a plurality of second-level automata;

[0055] Step 400: Based on the initial rule, matching a second preset rule in the target automaton;

[0056] Step 500: If the match is successful, determine the target rule that the network byte data successfully matches in the second preset rule.

[0057] It should be noted that the network security rule matching method provided in the embodiments of the present invention is implemented based on a network security rule matching device. This method is primarily used in applications such as network security monitoring, defense, and identification. It utilizes an NFA engine for matching. NFA requires SIMD instructions to simultaneously process multiple states, enabling parallel processing. Therefore, the embodiments of the present invention describe the network security rule matching method using the network security rule matching device as an example.

[0058] Specifically, the network security rule matching device obtains network byte data.

[0059] Furthermore, the network security rule matching device matches a first preset rule in a first-level automaton based on the network byte data, wherein the first-level automaton is obtained by state merging of a non-deterministic finite state automaton.

[0060] It should be noted that in NFA, the NFA state represents the matching location or specific state, and the NFA's preset rules (preset rules can be used as jump rules) define the conditions for going from one state to another. After the NFA merges states, the merged state will retain the jump edges of each original state, and the characters represented by the merged state are the union of the characters represented by each original state. Therefore, after the NFA state is merged, the number of states of the first-level automaton is reduced, but the jump rules of the original NFA are still met. Through the first-level automaton with a smaller number of states, fuzzy matching can be achieved, thereby improving the speed of network security rule matching.

[0061] Furthermore, if the matching fails, that is, no network byte data is matched in the first preset rule of the first-level automaton, the network security rule matching device ends the network security rule matching to proceed to the next network security rule matching process.

[0062] It should be noted that since most network byte data fails to match, matching network security rules through a first-level automaton with a smaller number of states can achieve faster rule matching speed than matching network security rules through the original NFA.

[0063] Furthermore, if the match is successful, that is, the network byte data is matched in the first preset rule of the first-level automaton, the network security rule matching device determines the initial rule in which the network byte data is successfully matched in the first preset rule.

[0064] Furthermore, the network security rule matching device selects a target automaton having an initial rule from a plurality of second-level automata, wherein the plurality of second-level automata are obtained by performing state splitting on a non-deterministic finite state automaton.

[0065] Furthermore, the network security rule matching device matches a second preset rule in the target automaton based on the initial rule.

[0066] It's important to note that the second-level automaton is derived from the NFA by splitting its states based on preset rules. This means that the second preset rules in the second-level automaton can be matched against the preset rules of the original NFA, and the sum of the second preset rules of all second-level automata includes the complete preset rules of the original NFA. Therefore, using a target automaton with fewer states for network security rule matching can further improve network security rule matching accuracy.

[0067] It's important to note that neither the first-level automaton generated by merging NFA states nor the second-level automaton generated by splitting NFA states changes the internal structure of the NFA engine. Therefore, these first-level and second-level automata can be seamlessly used with automaton engines such as Limited Extra-Sensory Information (LimEx). The LimEx algorithm leverages the limited extra-sensory information to achieve more efficient search and matching during string matching. Furthermore, after merging and splitting NFA states, only additional storage for the first-level automaton is required, resulting in a moderate system storage overhead.

[0068] Furthermore, if the matching fails, that is, the initial rule cannot be matched in the second preset rule of the target automaton, the network security rule matching device determines that the initial rule successfully matched by the first-level automaton is a false alarm, and ends the network security rule matching to proceed to the next network security rule matching process.

[0069] Furthermore, if the match is successful, that is, the initial rule is matched in the second preset rule of the target automaton, the network security rule matching device determines the target rule that the network byte data successfully matches in the second preset rule.

[0070] The network security rule matching method provided by the present invention first performs network security rule matching on network byte data through a more relaxed first-level automaton with fewer states, which can improve the speed of network security rule matching. If the network byte data successfully matches the initial rule in the first-level automaton, a target automaton with the initial rule is further selected from multiple second-level automatons, and network security rule matching is performed on the initial rule to achieve accurate matching of the target automaton. Therefore, network security rule matching can increase the matching speed while satisfying accurate matching, thereby improving the efficiency of network security rule matching.

[0071] Furthermore, before obtaining the network byte data, it also includes:

[0072] Determining a difference between the number of states in the non-deterministic finite state automaton and a preset number of states; merging the states in the non-deterministic finite state automaton based on the difference to obtain a first-level automaton;

[0073] The third preset rule of the non-deterministic finite state automaton is split into multiple sub-rules according to the condition that the number of states is less than the preset number of states; and a second-level automaton corresponding to each sub-rule is generated.

[0074] It's important to note that during the actual network security rule matching process, it's first compiled into intermediate code and optimized, improving the speed and efficiency of rule matching. Compilation is the offline matching preparation phase and only needs to be performed once, making the compilation phase less time-sensitive. Running is the online matching phase, requiring multiple runs against different data, making it more time-sensitive. The following describes the compilation process.

[0075] Specifically, the network security rule matching device calculates the difference between the number of states in the non-deterministic finite state automaton and the preset number of states to obtain the difference between the number of states and the preset number of states. Furthermore, the network security rule matching device merges the states in the deterministic finite state automaton based on the difference to obtain a first-level automaton.

[0076] It should be noted that the process of matching network security rules through NFA requires the use of SIMD instructions. Since each node (state) of NFA is represented by one bit, the width supported by the processor's SIMD instructions limits the number of NFA states that can be processed at one time. Therefore, the preset number of states is set based on the width supported by the processor's SIMD instructions, and the width supported by SIMD instructions is determined by the performance of the processor. In one embodiment, if the number of states in the NFA is 257 and the SIMD instructions support 256 bits, at least one state can be merged, so that rule matching can be performed through a single SIMD instruction, thereby improving the rule matching speed.

[0077] It should be further explained that the state merging methods include but are not limited to simple merging of ordinary states, merging of termination states (ie, receiving state merging) and continuous state merging. Figure 2 As shown, Figure 2 It is a schematic diagram of the rules provided by the present invention. Figure 2 State 0 in the code is used to match any single character, state 1 is used to match character a, state 2 is used to match any numeric character, state 3 is used to match any single word character, state 4 is used to match character a, state 5 is used to match character b, and state 6 is used to match any single character except character A and character B. Figure 3 As shown, Figure 3 This is a schematic diagram of a simple merge of common states provided by the present invention. After the original state 3 and state 6 are merged, a new state 3 is obtained. However, the new state 3 retains the jump edges of the original state 3 and state 6, and the new state 3 is used to match \w and [^AB]. Figure 4 As shown, Figure 4This is a schematic diagram of the terminal state merging provided by the present invention. The original state 4 is the terminal state of rule 1, and the original state 7 is the terminal state of rule 2. After the original state 4 and state 7 are merged, a new state 4 is obtained, but the new state 4 still includes rules 1 and 2. In addition, continuous state merging means that multiple continuous states are connected and merged into one state with a self-loop. The merged state is used to match the characters corresponding to all continuous states.

[0078] Furthermore, the network security rule matching device splits the third preset rule of the non-deterministic finite state automaton into multiple sub-rules according to the condition that the number of states is less than the preset number of states. Furthermore, the network security rule matching device generates a second-level automaton corresponding to each sub-rule.

[0079] It should be noted that the number of states in a second-level automaton generally needs to be smaller than the bit width of a SIMD instruction to ensure efficient and precise matching. Typically, the multiple second-level automata obtained after splitting have no common rules, meaning the second preset rules between the second-level automata do not intersect. This splitting method eliminates the need to select multiple target automata with the same initial rules during the precise matching phase, allowing for further precise matching.

[0080] It should be further explained that during the compilation process, if the matching start position is anchored, the split second-level automaton is reversed, and matching begins at the initial position of the reversed rule. If the matching start position is not anchored, the split second-level automaton is forward matched. In one embodiment, rule reversal involves reversing the front and back ends of the rule. For example, the rule / a\dc / becomes / c\da / after reverse processing (the rule is enclosed by " / / ").

[0081] In the embodiment of the present invention, during the compilation process, the states in the non-deterministic finite state automaton are merged to obtain a first-level automaton, and the states in the non-deterministic finite state automaton are split to obtain multiple second-level automata. Then, fuzzy matching of network byte data can be performed based on the first-level automaton, and precise matching of network byte data can be performed based on the second-level automaton. In addition, through the compilation process, the source code of the high-level language is converted into the target code of the machine language, and the target code is optimized to improve the efficiency and performance of the program.

[0082] Further, based on step 200, matching the first preset rule in the first-level automaton based on the network byte data includes:

[0083] Determine the first byte data in the network byte data and the corresponding starting state in the first-level automaton;

[0084] Based on the first preset rule in the first-level automaton and the initial state, traverse each remaining byte data in the network byte data, and perform state jump for each remaining byte data; the remaining byte data refers to the byte data in the network byte data except the first byte data;

[0085] If the last byte data in each of the remaining byte data does not show a state jump termination before jumping to the termination state, it is determined that the match is successful.

[0086] Specifically, the network security rule matching device determines the first byte data in the network byte data and the corresponding starting state in the first-level automaton.

[0087] Furthermore, the network security rule matching device traverses each remaining byte data in the network byte data based on the first preset rule and the starting state in the first-level automaton, and performs a state jump for each remaining byte data, wherein the remaining byte data refers to the byte data in the network byte data except the first byte data.

[0088] Therefore, it can be understood that when the network security rule matching device determines the first byte data in the network byte data, after the corresponding starting state in the first-level automaton, the remaining byte data will be jumped in sequence, that is, the remaining byte data will jump to the corresponding state in sequence.

[0089] Furthermore, if the last byte data in each remaining byte data does not show a state jump termination before jumping to the termination state, the network security rule matching device determines that the match is successful.

[0090] Furthermore, if the last byte data in each of the remaining byte data has a state jump termination before jumping to the termination state, the network security rule matching device determines that the matching has failed.

[0091] It should be noted that when the initial rule is matched in the first preset rule of the first-level automaton, rule information will be generated, wherein the rule information includes a rule identifier and a terminal state position. Therefore, rule matching can be performed more conveniently in the second-level automaton through the rule information.

[0092] The embodiment of the present invention determines the first byte data in the network byte number, and after the corresponding starting state in the first-level automaton, realizes the network security rule matching process of the first-level automaton through the state jump of each remaining byte data, which can improve the speed of network security rule matching.

[0093] Furthermore, based on step 400, matching a second preset rule in the target automaton based on the initial rule includes:

[0094] If the starting state of the initial rule is the first state, determining the first starting position corresponding to the starting state in the target automaton; the first state is used to match any single character;

[0095] Based on the second preset rule in the target automaton and the first starting position, traverse each first remaining state in the initial rule and perform state jump for each first remaining state; the first remaining state refers to a state in the initial rule other than the starting state;

[0096] If the last state in each of the first remaining states does not show a state jump termination before jumping to the termination state, it is determined that the match is successful.

[0097] Specifically, the network security rule matching device determines the state type of the initial state of the initial rule, wherein the state type includes a first state, and the first state is used to match any single character.

[0098] Furthermore, if the starting state of the initial rule is the first state, the network security rule matching device determines a first starting position corresponding to the starting state in the target automaton.

[0099] Furthermore, the network security rule matching device traverses each first remaining state in the initial rule based on the second preset rule and the first starting position in the target automaton, and performs state jumps for each first remaining state, wherein the first remaining state refers to the state in the initial rule other than the starting state.

[0100] Therefore, it can be understood that when the network security rule matching device determines the starting state of the initial rule, after the corresponding first starting position in the target automaton, each first remaining state is jumped in sequence, that is, each first remaining state is jumped to the corresponding state in sequence.

[0101] Furthermore, if the last state in each of the first remaining states does not experience a state jump termination before jumping to the termination state, the network security rule matching device determines that the match is successful.

[0102] Furthermore, if the last state in each of the first remaining states has a state jump termination before jumping to the termination state, the network security rule matching device determines that the matching has failed.

[0103] After determining that the starting state of the initial rule is the first state, the embodiment of the present invention determines the first starting position corresponding to the starting state in the target automaton, and further realizes the precise matching of the network security rules of the target automaton through state jumps of each first remaining state. Therefore, the network security rule matching can improve the matching speed while satisfying the precise matching, thereby improving the efficiency of the network security rule matching.

[0104] Furthermore, based on step 400, matching the second preset rule in the target automaton based on the initial rule further includes:

[0105] If the initial state of the initial rule is the second state, the initial rule is subjected to rule reverse processing to obtain a reverse rule; the second state is used to match a specific character;

[0106] Determine a second starting position corresponding to the starting state of the reverse rule in the target automaton;

[0107] Based on the second preset rule and the second starting position in the target automaton, traverse each second remaining state in the reverse rule, and perform state jump for each second remaining state; the second remaining state refers to a state in the reverse rule other than the starting state;

[0108] If the last state in each second remaining state does not show a state jump termination before jumping to the terminal state, it is determined that the match is successful.

[0109] Specifically, the network security rule matching device determines the state type of the initial state of the initial rule, wherein the state type includes a second state, and the second state is used to match a specific character.

[0110] Furthermore, if the initial state of the initial rule is the second state, the network security rule matching device performs rule reverse processing on the initial rule to obtain a reverse rule. Furthermore, the network security rule matching device determines the second starting position corresponding to the starting state of the reverse rule in the target automaton. It should be noted that the starting state of the reverse rule refers to the ending state of the initial rule. Since the position of the ending state of the initial rule can be determined based on the rule information, the position of the starting state of the reverse rule is also determined.

[0111] Furthermore, the network security rule matching device traverses each second remaining state in the reverse rule based on the second preset rule and the second starting position in the target automaton, and performs state jumps for each second remaining state, wherein the second remaining state refers to the state in the reverse rule other than the starting state.

[0112] Therefore, it can be understood that when the network security rule matching device determines the starting state of the reverse rule, after the corresponding second starting position in the target automaton, each second remaining state is jumped in sequence, that is, each second remaining state is jumped to the corresponding state in sequence.

[0113] Furthermore, if the last state in each second remaining state does not experience state jump termination before jumping to the termination state, the network security rule matching device determines that the match is successful.

[0114] Furthermore, if the last state in each second remaining state has a state jump termination before jumping to the termination state, the network security rule matching device determines that the matching fails.

[0115] After determining that the starting state of the initial rule is the second state, the embodiment of the present invention performs rule reverse processing on the initial rule to obtain a reverse rule, and determines the second starting position corresponding to the starting state of the reverse rule in the target automaton, and further realizes the reverse matching of the target automaton through state jumps of each second remaining state. It can improve the speed and accuracy of rule matching when the starting state position of the initial rule is uncertain, and at the same time, realize the precise matching of the network security rules of the target automaton. Therefore, network security rule matching can improve the matching speed when the precise matching is satisfied, thereby improving the efficiency of network security rule matching.

[0116] Furthermore, after determining the target rule that matches successfully, the following is also included:

[0117] Determining network security detection results according to the target rules;

[0118] Perform network management based on network security detection results.

[0119] Specifically, the network security rule matching device determines the network security detection result based on the target rule. It should be noted that the preset rules of the NFA correspond to network services. The preset rules of the NFA include but are not limited to network vulnerability rules, network intrusion rules, and data packet anomaly rules. Therefore, during the network security rule matching process, if a network vulnerability rule is successfully matched, the network may have a vulnerability problem; if a network intrusion rule is successfully matched, the network may have an intrusion problem; if a data packet anomaly rule is successfully matched, the network may have an attack behavior.

[0120] Furthermore, the network security rule matching device performs network management based on the network security detection results.

[0121] The embodiments of the present invention improve the efficiency of network security rule matching, determine network security detection results according to target rules, and perform network management based on the network security detection results, thereby achieving rapid response to network security incidents, reducing the impact of potential threats on the system, and thus improving network security levels and management efficiency.

[0122] Furthermore, the present invention also provides a network security rule matching device.

[0123] Reference Figure 5 , Figure 5 It is a structural diagram of the network security rule matching device provided by the present invention.

[0124] The network security rule matching device includes:

[0125] An acquisition module 510 is used to acquire network byte data;

[0126] A first matching module 520 is configured to match a first preset rule in a first-level automaton based on the network byte data; the first-level automaton is obtained by merging states of a non-deterministic finite state automaton;

[0127] A selection module 530 is configured to, if a match is successful, determine an initial rule that the network byte data successfully matches in the first preset rule, and select a target automaton that has the initial rule from a plurality of second-level automata; the plurality of second-level automata are obtained by state-splitting a non-deterministic finite state automaton;

[0128] A second matching module 540 is configured to match a second preset rule in the target automaton based on the initial rule;

[0129] The target determination module 550 is configured to determine the target rule that the network byte data successfully matches in the second preset rule if the match is successful.

[0130] The network security rule matching device provided by the present invention first performs network security rule matching on network byte data through a more relaxed first-level automaton with fewer states, which can improve the speed of network security rule matching. If the network byte data successfully matches the initial rule in the first-level automaton, a target automaton with the initial rule is further selected from multiple second-level automatons, and network security rule matching is performed on the initial rule to achieve accurate matching of the target automaton. Therefore, network security rule matching can increase the matching speed while satisfying accurate matching, thereby improving the efficiency of network security rule matching.

[0131] Furthermore, the network security rule matching device further includes:

[0132] Determining a difference between the number of states in the non-deterministic finite state automaton and a preset number of states; merging the states in the non-deterministic finite state automaton based on the difference to obtain a first-level automaton;

[0133] The third preset rule of the non-deterministic finite state automaton is split into multiple sub-rules according to the condition that the number of states is less than the preset number of states; and a second-level automaton corresponding to each sub-rule is generated.

[0134] Furthermore, the first matching module 520 further includes:

[0135] Determine the first byte data in the network byte data and the corresponding starting state in the first-level automaton;

[0136] Based on the first preset rule in the first-level automaton and the initial state, traverse each remaining byte data in the network byte data, and perform state jump for each remaining byte data; the remaining byte data refers to the byte data in the network byte data except the first byte data;

[0137] If the last byte data in each of the remaining byte data does not show a state jump termination before jumping to the termination state, it is determined that the match is successful.

[0138] Furthermore, the second matching module 540 further includes:

[0139] If the starting state of the initial rule is the first state, determining the first starting position corresponding to the starting state in the target automaton; the first state is used to match any single character;

[0140] Based on the second preset rule in the target automaton and the first starting position, traverse each first remaining state in the initial rule and perform state jump for each first remaining state; the first remaining state refers to a state in the initial rule other than the starting state;

[0141] If the last state in each of the first remaining states does not show a state jump termination before jumping to the termination state, it is determined that the match is successful.

[0142] Furthermore, the second matching module 540 further includes:

[0143] If the initial state of the initial rule is the second state, the initial rule is subjected to rule reverse processing to obtain a reverse rule; the second state is used to match a specific character;

[0144] Determine a second starting position corresponding to the starting state of the reverse rule in the target automaton;

[0145] Based on the second preset rule and the second starting position in the target automaton, traverse each second remaining state in the reverse rule, and perform state jump for each second remaining state; the second remaining state refers to a state in the reverse rule other than the starting state;

[0146] If the last state in each second remaining state does not show a state jump termination before jumping to the terminal state, it is determined that the match is successful.

[0147] Furthermore, the network security rule matching device further includes:

[0148] Determining network security detection results according to the target rules;

[0149] Perform network management based on network security test results.

[0150] It should be noted that the network security rule matching device provided by the present invention can execute the network security rule matching method described in any of the above embodiments during specific operation, which will not be described in detail in this embodiment.

[0151] Figure 6 Schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call logic instructions in the memory 630 to execute a network security rule matching method, which includes: obtaining network byte data; matching a first preset rule in a first-level automaton based on the network byte data; the first-level automaton is obtained by state merging of non-deterministic finite state automata; if the match is successful, determining an initial rule that the network byte data successfully matches in the first preset rule, and selecting a target automaton that contains the initial rule from multiple second-level automata; the multiple second-level automata are obtained by state splitting of non-deterministic finite state automata; matching a second preset rule in the target automaton based on the initial rule; if the match is successful, determining a target rule that the network byte data successfully matches in the second preset rule.

[0152] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0153] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the network security rule matching method provided by the above-mentioned embodiments, the method including: obtaining network byte data; matching a first preset rule in a first-level automaton based on the network byte data; the first-level automaton is obtained by state merging of a non-deterministic finite state automaton; if the match is successful, determining the initial rule that the network byte data successfully matches in the first preset rule, and selecting a target automaton with the initial rule from multiple second-level automata; multiple second-level automata are obtained by state splitting of a non-deterministic finite state automaton; based on the initial rule, matching a second preset rule in the target automaton; if the match is successful, determining the target rule that the network byte data successfully matches in the second preset rule.

[0154] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the network security rule matching method provided by the above-mentioned embodiments, the method comprising: obtaining network byte data; matching a first preset rule in a first-level automaton based on the network byte data; the first-level automaton is obtained by state merging of a non-deterministic finite state automaton; if the match is successful, determining the initial rule in which the network byte data is successfully matched in the first preset rule, and selecting a target automaton with the initial rule from multiple second-level automata; multiple second-level automata are obtained by state splitting of a non-deterministic finite state automaton; matching a second preset rule in the target automaton based on the initial rule; if the match is successful, determining the target rule in which the network byte data is successfully matched in the second preset rule.

[0155] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0156] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A network security rule matching method, characterized in that: include: Get network byte data; Based on the network byte data, matching a first preset rule in a first-level automaton; the first-level automaton is obtained by merging states of a non-deterministic finite state automaton; If the match is successful, determining an initial rule that the network byte data successfully matches in the first preset rule, and selecting a target automaton that has the initial rule from a plurality of second-level automata; Multiple second-level automata are obtained by splitting the state of non-deterministic finite state automata; Based on the initial rule, matching a second preset rule in the target automaton; If the match is successful, it is determined that the network byte data successfully matches the target rule in the second preset rule.

2. The network security rule matching method according to claim 1, characterized in that: The matching of the first preset rule in the first-level automaton based on the network byte data includes: Determine the first byte data in the network byte data and the corresponding starting state in the first-level automaton; Based on the first preset rule in the first-level automaton and the initial state, traverse each remaining byte data in the network byte data, and perform state jump for each remaining byte data; the remaining byte data refers to the byte data in the network byte data except the first byte data; If the last byte data in each of the remaining byte data does not show a state jump termination before jumping to the termination state, it is determined that the match is successful.

3. The network security rule matching method according to claim 2, characterized in that: The matching of the second preset rule in the target automaton based on the initial rule includes: If the starting state of the initial rule is the first state, determining the first starting position corresponding to the starting state in the target automaton; the first state is used to match any single character; Based on the second preset rule in the target automaton and the first starting position, traverse each first remaining state in the initial rule and perform state jump for each first remaining state; the first remaining state refers to a state in the initial rule other than the starting state; If the last state in each of the first remaining states does not show a state jump termination before jumping to the terminal state, it is determined that the match is successful.

4. The network security rule matching method according to claim 3, characterized in that: The matching of the second preset rule in the target automaton based on the initial rule further includes: If the initial state of the initial rule is the second state, the initial rule is subjected to rule reverse processing to obtain a reverse rule; the second state is used to match a specific character; Determine a second starting position corresponding to the starting state of the reverse rule in the target automaton; Based on the second preset rule and the second starting position in the target automaton, traverse each second remaining state in the reverse rule, and perform state jump for each second remaining state; the second remaining state refers to a state in the reverse rule other than the starting state; If the last state in each second remaining state does not show a state jump termination before jumping to the terminal state, it is determined that the match is successful.

5. The network security rule matching method according to claim 4, characterized in that: Before getting the network byte data, also include: Determining a difference between the number of states in the non-deterministic finite state automaton and a preset number of states; merging the states in the non-deterministic finite state automaton based on the difference to obtain a first-level automaton; The third preset rule of the non-deterministic finite state automaton is split into multiple sub-rules according to the condition that the number of states is less than the preset number of states; and a second-level automaton corresponding to each sub-rule is generated.

6. The network security rule matching method according to any one of claims 1 to 5, characterized in that: After determining the target rule that matches successfully, it also includes: Determining network security detection results according to the target rules; Perform network management based on network security test results.

7. A network security rule matching device, characterized in that: include: Acquisition module, used to obtain network byte data; A first matching module is configured to match a first preset rule in a first-level automaton based on the network byte data; the first-level automaton is obtained by merging states of a non-deterministic finite state automaton; a selection module configured to, if the match is successful, determine an initial rule that the network byte data successfully matches in the first preset rule, and select a target automaton that has the initial rule from a plurality of second-level automata; Multiple second-level automata are obtained by splitting the state of non-deterministic finite state automata; A second matching module, configured to match a second preset rule in the target automaton based on the initial rule; The target determination module is used to determine the target rule that the network byte data successfully matches in the second preset rule if the match is successful.

8. A device comprising an electronic device, wherein the electronic device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the network security rule matching method according to any one of claims 1 to 6 are implemented.

9. A medium comprising a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security rule matching method according to any one of claims 1 to 6 are implemented.

10. A product, comprising a computer program product, wherein the computer program product comprises a computer program, characterized in that When the computer program is executed by a processor, the steps of the network security rule matching method according to any one of claims 1 to 6 are implemented.

Images