Method and device for detecting security of network traffic, and electronic device

Abstract

The application discloses a kind of network flow security detection method and device, electronic equipment, it is related to network security technical field, wherein, the method comprises: receiving network flow, and network flow is parsed, obtains the field position information of multiple key fields in network flow;Based on the field position information of multiple key fields, network flow is matched with the rule in rule base, and matching result is obtained, wherein, rule includes multiple preset key fields, and the position of each preset key field in network flow is specified position;Determine whether network flow is attack flow based on matching result.The application solves the technical problem that in related art, when network flow is detected, by shunting network flow, and the network flow after shunting is detected, the detection efficiency is lower.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method, apparatus, and electronic device for secure network traffic detection. Background Technology

[0002] During network data transmission, specific network traffic (including network requests and responses) can transmit specific data. Attackers can intercept user network requests or responses through various means, tamper with their content, and thus launch malicious attacks. Such attacks may lead to security problems such as user information leakage, identity theft, webpage content tampering, or malicious code injection. Intrusion Prevention Systems (IPS) aim to monitor network traffic in real time, identify and defend against potential network intrusions and attacks. Intrusion prevention functions are mainly implemented through signature matching. Users can define custom rules, based on which they can detect whether network traffic has been tampered with and whether it carries attack packets. Rules are derived from combinations of multiple features, and the features in the rules can be flexibly adjusted to adapt to specific network environments and monitor specific security threats. The signature library of intrusion prevention systems has tens of thousands of predefined rules for intrusion prevention systems to detect and defend against threat traffic. To protect network and computer security, intrusion prevention technology can take real-time responses and proactively block attack behaviors based on pre-set security policies using various technical means, thereby maintaining network security.

[0003] In related technologies, when performing security detection on network traffic, security strategies can be used to perform security detection on network traffic based on protocol type or application. This security strategy performs attack feature detection on the network traffic after it is split to determine whether there are attack packets in the network traffic. However, since most of the existing network traffic and attack packets are generated based on the HTTP protocol, splitting based on protocol type does not significantly improve the detection efficiency of network traffic. On the other hand, splitting based on application is problematic because some attacks targeting the HTTP protocol are not strongly related to the application. If the splitting granularity is too small, it is easy to miss detections, while if the splitting granularity is too large, it will lead to low security detection efficiency.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, and electronic device for security detection of network traffic, which at least solves the technical problem in the related art where the detection efficiency is low when network traffic is split and then the split network traffic is security detected.

[0006] According to one aspect of the present invention, a method for security detection of network traffic is provided, comprising: receiving network traffic and parsing the network traffic to obtain field location information of multiple key fields in the network traffic; matching the network traffic with rules in a rule base based on the field location information of the multiple key fields to obtain a matching result, wherein the rule includes multiple preset key fields, and the position of each preset key field in the network traffic is a specified position; and determining whether the network traffic is attack traffic based on the matching result.

[0007] Optionally, based on the field location information of multiple key fields, the network traffic is matched with rules in the rule base to obtain a matching result, including: performing multi-modal matching on the network traffic based on the field location information of multiple key fields and a first type of key field among multiple preset key fields included in each rule to obtain a multi-modal matching result, wherein the first type of key field in the rule is a feature selected based on the frequency of occurrence of key fields in multiple sample network traffic, and the multi-modal matching is used to indicate that the network traffic is matched with multiple rules simultaneously; determining at least one target rule that matches the network traffic based on the multi-modal matching result; performing single-modal matching on the network traffic with each target rule based on the field location information of multiple key fields to obtain a single-modal matching result, wherein the single-modal matching is used to indicate that the network traffic is matched with each target rule one by one; and obtaining the matching result of the network traffic based on the single-modal matching result.

[0008] Optionally, the network traffic security detection method further includes: using the first-level key fields and second-level key fields in the preset rule feature list as multiple preset key fields to create rules in the rule base, wherein the granularity of the second-level key fields is finer than the granularity of the first-level key fields.

[0009] Optionally, the first type of key field is a key field whose frequency of occurrence is less than a preset frequency among the key fields in multiple sample network traffic. The step of performing multi-modal matching on the network traffic based on the field position information of the multiple key fields and the first type of key field among the multiple preset key fields included in each rule to obtain a multi-modal matching result includes: matching each rule with the network traffic simultaneously based on the first type of key field in each rule to determine whether there is a target key field among the multiple key fields of the network traffic that matches the first type of key field; if the target key field exists, matching the field position of the target key field with the specified position of the first type of key field that matches the target key field to generate the multi-modal matching result.

[0010] Optionally, after obtaining the multi-mode matching result, the method further includes: if the multi-mode matching result indicates that there is no target key field matching the first type of key field among the multiple key fields of the network traffic, then determining that the network traffic is not attack traffic; or, if the multi-mode matching result indicates that there is a target key field matching the first type of key field among the multiple key fields of the network traffic, and the position of the target key field in the network traffic belongs to the specified position of the matched first type of key field, then determining that the rule to which the matched first type of key field belongs is the target rule matching the network traffic.

[0011] Optionally, the step of performing single-model matching between the network traffic and each of the target rules based on the field location information of multiple key fields to obtain a single-model matching result includes: matching each of the target rules with the network traffic one by one based on the field location information of multiple key fields, determining whether the field locations of the multiple key fields contain a specified location of a second type of key field, wherein the second type of key field is a key field in the target rule that is different from the first type of key field; if the field locations of the multiple key fields contain a specified location of the second type of key field, matching the multiple key fields with the second type of key field to generate the single-model matching result.

[0012] Optionally, the network traffic security detection method further includes: when the network traffic is segmented, splicing different segments of the network traffic belonging to the same network traffic to obtain complete network traffic; parsing the network traffic to obtain the field position information of multiple key fields in the network traffic includes: parsing the complete network traffic to obtain the field position information of multiple key fields in the complete network traffic.

[0013] Optionally, parsing the complete network traffic to obtain the field location information of multiple key fields in the complete network traffic includes: obtaining the position offset of each segment of the network traffic belonging to the same network traffic; updating the position range of each key field in the concatenated segmented network traffic based on the position offset of each segment of the network traffic; and parsing the complete network traffic based on the updated position range of each key field to obtain the field location information of multiple key fields in the complete network traffic.

[0014] According to another aspect of the present invention, a network traffic security detection device is also provided, comprising: a parsing unit, configured to receive network traffic and parse the network traffic to obtain field location information of multiple key fields in the network traffic; a matching unit, configured to match the network traffic with rules in a rule base based on the field location information of the multiple key fields to obtain a matching result; wherein the rule includes multiple preset key fields, and the position of each preset key field in the network traffic is a specified position; and a determining unit, configured to determine whether the network traffic is attack traffic based on the matching result.

[0015] Optionally, the matching unit includes: a first matching module, configured to perform multi-mode matching on the network traffic based on the field position information of multiple key fields and a first type of key field among multiple preset key fields included in each rule, to obtain a multi-mode matching result, wherein the first type of key field in the rule is a feature selected based on the frequency of occurrence of key fields in multiple sample network traffic, and the multi-mode matching is used to instruct the network traffic to be matched with multiple rules simultaneously; a first determining module, configured to determine at least one target rule that matches the network traffic based on the multi-mode matching result; a second matching module, configured to perform single-mode matching on the network traffic and each target rule based on the field position information of multiple key fields, to obtain a single-mode matching result, wherein the single-mode matching is used to instruct the network traffic to be matched with each of the target rules one by one; and a first obtaining module, configured to obtain the matching result of the network traffic based on the single-mode matching result.

[0016] Optionally, the network traffic security detection device further includes: a first creation unit, used to create rules in the rule base by taking the first-level key fields and second-level key fields in the preset rule feature list as multiple preset key fields, wherein the granularity of the second-level key fields is finer than the granularity of the first-level key fields.

[0017] Optionally, the first type of key field is a key field whose frequency of occurrence is less than a preset frequency among the key fields in multiple sample network traffic. The first matching module includes: a first matching submodule, used to match each rule with the network traffic simultaneously based on the first type of key field in each rule, to determine whether there is a target key field that matches the first type of key field among the multiple key fields of the network traffic; and a second matching submodule, used to match the field position of the target key field with a specified position of the first type of key field that matches the target key field if the target key field exists, to generate the multi-mode matching result.

[0018] Optionally, the first matching module further includes: a first determining submodule, configured to determine that the network traffic is not attack traffic when there is no target key field matching the first type of key field among the multiple key fields indicated by the multi-mode matching result of the network traffic; and a second determining submodule, configured to determine that the rule to which the matched first type of key field belongs is a target rule matching the network traffic when there is a target key field matching the first type of key field among the multiple key fields indicated by the multi-mode matching result of the network traffic, and the position of the target key field in the network traffic belongs to a specified position of the matched first type of key field.

[0019] Optionally, the second matching module includes: a third matching submodule, configured to match each of the target rules with the network traffic one by one based on the field position information of the multiple key fields, and determine whether the field positions of the multiple key fields contain a specified position of a second type of key field, wherein the second type of key field is a key field in the target rule that is different from the first type of key field; and a fourth matching submodule, configured to match the multiple key fields with the second type of key field when the field positions of the multiple key fields contain the specified position of the second type of key field, and generate the single-mode matching result.

[0020] Optionally, the network traffic security detection device further includes: a first splicing unit, used to splice different segments of the same network traffic to obtain complete network traffic when there are segmented network traffic; the parsing unit includes: a first parsing module, used to parse the complete network traffic and obtain the field position information of multiple key fields in the complete network traffic.

[0021] Optionally, the first parsing module includes: a first acquisition submodule, used to acquire the position offset of each segment of network traffic belonging to the same network traffic; a first update submodule, used to update the position range of each key field in the spliced ​​segmented network traffic based on the position offset of each segment of network traffic; and a second acquisition submodule, used to parse the complete network traffic based on the updated position range of each key field, and acquire the field position information of multiple key fields in the complete network traffic.

[0022] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described network traffic security detection methods.

[0023] In this disclosure, the following steps are performed: first, network traffic is received and parsed to obtain the field location information of multiple key fields in the network traffic; then, based on the field location information of multiple key fields, the network traffic is matched with rules in the rule base to obtain matching results. The rules contain multiple preset key fields, and the position of each preset key field in the network traffic is a specified position. Finally, based on the matching results, it is determined whether the network traffic is attack traffic.

[0024] In this disclosure, when performing security detection on network traffic, the location of the feature can be explicitly specified in the rule to be detected. During scanning, only the data at the specific location needs to be matched, thereby reducing the length of the string to be scanned, achieving accurate detection, reducing scanning time, and effectively improving the accuracy and efficiency of security detection. This solves the technical problem in related technologies where network traffic is split and then security detection is performed on the split network traffic, resulting in low detection efficiency. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0026] Figure 1 This is a flowchart of an optional network traffic security detection method according to an embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of an optional network traffic security detection process according to an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of a single-mode matching process in an optional network traffic security detection according to an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of an optional network traffic security detection device according to an embodiment of the present invention;

[0030] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) for a network traffic security detection method according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0034] The Hypertext Transfer Protocol, or HTTP for short, is a protocol used to transfer hypertext files. It uses a client-server model, where the client sends a request to the server, and the server returns the corresponding content based on the request.

[0035] An Intrusion Prevention System (IPS) is a network security device or software used to detect and prevent intrusion activities on a network.

[0036] SQL, short for Structured Query Language, is a data manipulation language used in relational database management systems.

[0037] A Uniform Resource Identifier (URI) is a string that identifies a resource on the Internet using syntax.

[0038] The content-type is an attribute field in the HTTP protocol message header used to specify the MIME type (Multipurpose Internet Mail Extensions) and character set used in the entity body sent by the client and the response body returned by the server.

[0039] Cookie is an attribute field in the HTTP protocol header. It is sent by the server to the client in the Set-Cookie header of the HTTP response, and the client then sends the data back to the server in each subsequent request via the Cookie header.

[0040] User-Agent is a field in the HTTP request header that identifies the client application or browser that sent the request.

[0041] TCP segmentation uses a segmented transmission method to divide application layer data into TCP segments, which are transmitted over the network to the destination host and then reassembled into application layer data at the receiving end.

[0042] IP fragmentation is a process of breaking down IP datagrams into smaller fragments for transmission. When the size of an IP datagram exceeds the maximum transmission unit limit on a network path, the sender needs to fragment the datagram so that it can be transmitted over the network.

[0043] It should be noted that the network traffic security detection method and apparatus disclosed herein can be used in the field of network security technology to perform security detection of target network traffic based on the location information of the features to be detected, and can also be used in any field other than network security technology to perform security detection of target network traffic based on the location information of the features to be detected. The application field of the network traffic security detection method and apparatus disclosed herein is not limited.

[0044] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) disclosed herein are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant regions, and corresponding access points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information must be sent to the aforementioned user or organization through the interface, and the relevant information will be obtained only after receiving consent from the aforementioned user or organization.

[0045] The embodiments or examples disclosed herein are not exhaustive, but merely illustrative of some embodiments or examples, and are not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment or example can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment or example can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment or example can be arbitrarily interchanged. Furthermore, optional methods or examples in a particular embodiment or example can be arbitrarily combined; moreover, embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a particular embodiment or example can be arbitrarily combined with optional methods or examples of other embodiments or examples. The steps shown in the flowcharts can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in a different order than that shown here.

[0046] The following embodiments of the present invention can be applied to various network traffic security detection systems / applications / devices. The present invention parses target network traffic and records the location information of the features to be detected, thereby shortening the length of the string to be matched during security detection. It eliminates the need to traverse and detect all characters in the traffic each time, thus improving detection efficiency and accuracy.

[0047] The present invention will now be described in detail with reference to various embodiments.

[0048] Example 1

[0049] According to an embodiment of the present invention, an embodiment of a network traffic security detection method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0050] Figure 1 This is a flowchart of an optional network traffic security detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0051] Step S101: Receive network traffic and parse the network traffic to obtain the field location information of multiple key fields in the network traffic;

[0052] Step S102: Based on the field location information of multiple key fields, the network traffic is matched with the rules in the rule base to obtain the matching results;

[0053] Step S103: Determine whether the network traffic is attack traffic based on the matching results.

[0054] Through the above steps, network traffic is first received and parsed to obtain the field location information of multiple key fields in the network traffic. Then, based on the field location information of multiple key fields, the network traffic is matched with the rules in the rule base to obtain the matching result. The rule contains multiple preset key fields, and the position of each preset key field in the network traffic is a specified position. Finally, based on the matching result, it is determined whether the network traffic is attack traffic.

[0055] The network traffic security detection method provided in this embodiment can be applied to an intrusion prevention system (IPS). The rule base can be an IPS rule base.

[0056] In this embodiment, when performing security detection on network traffic, the location of features (e.g., preset key fields) can be explicitly specified in the rules to be detected. During scanning, only data at specific locations in the network traffic needs to be matched, thereby reducing the length of the string to be scanned, achieving accurate detection, reducing scanning time, and effectively improving the accuracy and efficiency of security detection. This solves the technical problem in related technologies where network traffic is split and security detection is performed on the split network traffic, resulting in low detection efficiency.

[0057] The embodiments of the present invention will now be described in detail with reference to the steps described above.

[0058] It's important to note that IPS detection involves attack or threat detection of network traffic. It determines whether network traffic is abnormal by matching it against relevant rules in the IPS rule base. The IPS rule base is like a dictionary, containing the characteristics of various attack behaviors and network threats. When the IPS engine receives network traffic, it searches the rule base for these characteristics and matches them one by one. If the target network traffic contains all the characteristics of a rule in the rule base, it's considered a match, and the traffic is blocked. In normal network traffic transmission, a user sends a request to a server, and the server returns a message to the client containing the information the user needs. Attackers, however, can intercept data between the user and server to obtain user privacy or server information. They can modify the parameters the user intended to transmit, altering them to obtain the desired information, and thus launch a network attack.

[0059] For example, there is a rule to be matched: all enable http[80,8080](msg_cn:"SQL injection attack selection statement detection";uricontent:"select";nocase;pcre:" / [\x00-

[0060] \x20\xA0\x2B\x2F\x29\x27\x22\d](and|or|union)[\x00-\x20\xA0\x2B\x2F\x28\x23\x2D][^&]{0,50}select[\x00-\x20\x A0\x2B\x2F\x28\x23\x2D\x5B].+[\x00-\x20\xA0\x2B\x2F\x29\x5D]from[\x00-\x20\xA0\x2B\x2F\x28\x23\x2D\x5B]. / isU The rule ";) indicates that the rule is valid and matches SQL injection attacks based on the HTTP protocol. If the message URI contains keywords such as AND, OR, or UNION followed by SQL commands like SELECT...FROM, this rule is hit, and corresponding alarm information and logs are generated. Therefore, the function of this rule is to identify malicious SQL query statements that may exist in some requests and to detect network traffic. If a request matches this rule, the IPS engine will determine that the request is accompanied by attack instructions, and the engine can then execute the predefined actions of the policy to perform security protection, thereby ensuring network security.

[0061] It should be noted that existing IPS rule libraries contain tens of thousands of rules, each containing multiple features. Matching all features of each rule with the characters of the target network traffic one by one would be very inefficient. In this embodiment of the invention, the position of each feature is predefined in the rules during security detection. Thus, when performing security detection on network traffic, the position information of multiple key fields is obtained by parsing the network traffic, and the fields at specific positions are matched with the features in the rules. This achieves accurate feature matching, filters out threatening network traffic, and intercepts it, reducing scanning time, effectively improving security detection efficiency, and ensuring the accuracy of detection results.

[0062] Optionally, the network traffic security detection method further includes: using the first-level key fields and second-level key fields in the preset rule feature list as multiple preset key fields to create rules in the rule base, wherein the granularity of the second-level key fields is finer than that of the first-level key fields.

[0063] It should be noted that the network traffic in this embodiment of the invention can be requests and responses based on communication protocols, such as HTTP requests and HTTP responses. When performing security detection on network traffic, considering that certain features only exist in specific structures or fields, such as URI fields, content-type fields, and cookie fields, the possible locations of these features can be explicitly specified in the rules. This embodiment of the invention determines the location of the feature in the network traffic by configuring first-level key fields and second-level key fields for each feature, and then creates rules to be matched based on the feature and the key fields corresponding to the feature, thus obtaining a rule base. When scanning, it is only necessary to match the field information at a specific location in the network traffic with the preset key fields in the rule base, thereby reducing the length of the string to be scanned, reducing the scanning time, and effectively improving detection efficiency and accuracy.

[0064] It should be noted that, in this embodiment of the invention, the attack points and unique features in network attacks, such as access paths, are extracted and used as rule features. If no rule feature exists in the network traffic to be detected, it means that the network traffic is safe and can be allowed to pass directly. If all rule features exist in the network traffic to be detected, it means that the network traffic is under attack.

[0065] Before performing security detection on network traffic, this embodiment of the invention first needs to finely divide the features in the preset feature list, determine the primary key field and secondary key field to which the feature belongs, wherein the primary key field is used to indicate the structure to which the feature belongs, and the secondary feature field is used to indicate the more fine-grained field to which the feature belongs. The preset feature list records the attack points and unique features that appear frequently in network attacks. Rules in the rule base are created through the features, the primary key field and the secondary key field corresponding to the features, thereby obtaining rules that include rule features and rule feature locations.

[0066] In this embodiment, the preset key fields included in the rule are used to characterize the rule features. The preset key fields may include first-level key fields and / or second-level key fields.

[0067] When performing network traffic security inspection, the location of a feature can be accurately pinpointed within the network traffic based on its characteristics and corresponding primary and secondary key fields. Examples of key fields and their meanings are shown in Table 1.

[0068] Table 1 Key Fields and Their Meanings

[0069] L First line, HTTP request / response line M The request method (GET / POST, etc.) in the HTTP request line. I URI in the HTTP request line S HTTP response line status codes H header, HTTP request header / response header A User-Agent field in the HTTP request header C Cookie field in HTTP request header T Content-Type field in HTTP request / response headers B body, HTTP request body / response body

[0070] It should be noted that after obtaining the rules to be matched, the rules can be converted into a computer executable language and loaded into the traffic parser, thereby automatically parsing all received network traffic.

[0071] Step S101: Receive network traffic and parse the network traffic to obtain the field location information of multiple key fields in the network traffic.

[0072] It should be noted that, after receiving network traffic, this embodiment of the invention parses the network traffic and obtains the location information of multiple key fields in the network traffic. Key fields are fields that may exhibit characteristics. When obtaining the field location information of key fields, it can be determined based on all the first-level key fields and second-level key fields that appear in the rule base.

[0073] Step S102: Based on the field location information of multiple key fields, the network traffic is matched with the rules in the rule base to obtain the matching results.

[0074] It should be noted that each of the above rules contains multiple preset key fields. The location where each preset key field appears in network traffic is a specified location. The process of matching the rules in the rule base with the network traffic may include, for example, determining the location to be detected indicated by the field location information of each key field in the network traffic, determining the target location belonging to the specified location from the locations to be detected, matching the key field at the target location with the preset key fields in the rule base, and determining whether the key field at the target location belonging to the specified location in the network traffic matches the feature indicated by the preset key field, thereby achieving accurate detection of network traffic and accelerating detection efficiency.

[0075] In some examples, the implementation process of step S102 may include: simultaneously matching network traffic with multiple rules based on the field location information of multiple key fields and the first type of key field among the multiple preset key fields contained in each rule to obtain a multi-mode matching result; determining at least one target rule that matches the network traffic based on the multi-mode matching result; matching network traffic with each target rule one by one based on the field location information of multiple key fields to obtain a single-mode matching result; and obtaining the matching result of network traffic based on the single-mode matching result.

[0076] This invention enables accurate detection of network traffic based on the location information of key fields, eliminating the need to match every single character in the network traffic and saving time in security detection.

[0077] Optionally, based on the field location information of multiple key fields, the network traffic is matched with rules in the rule base to obtain matching results. This includes: performing multi-mode matching on the network traffic based on the field location information of multiple key fields and the first type of key fields among the multiple preset key fields contained in each rule to obtain multi-mode matching results. The first type of key fields in the rules are features selected based on the frequency of occurrence of key fields in multiple sample network traffic. Multi-mode matching is used to indicate that the network traffic is matched with multiple rules simultaneously. Based on the multi-mode matching results, at least one target rule matching the network traffic is determined. Based on the field location information of multiple key fields, the network traffic is matched with each target rule in a single-mode manner to obtain single-mode matching results. Single-mode matching is used to indicate that the network traffic is matched with each target rule one by one. Based on the single-mode matching results, the matching result of the network traffic is obtained.

[0078] Sample network traffic can be historical network traffic, for example, historical normal network traffic. Here, historical normal network traffic is different from historical attack network traffic.

[0079] It's important to note that IPS rules consist of multiple features. When network traffic matches all features, it's considered a rule match, indicating a potential threat. To improve the efficiency of network traffic security detection, each rule selects a less common feature as a quick match item, the first type of key field, for preliminary matching. After receiving network traffic, the IPS detection device obtains the data to be detected through a protocol parser. First, it quickly scans the first type of key fields of all rules for that protocol to filter out potentially matching rules; this process is called multi-mode derivation. Then, for rules that match the first type of key field, it further performs a complete matching process for all features of that rule; this is called single-mode derivation. In single-mode derivation, characters in the network traffic are matched one by one with all rules, consuming device resources and resulting in low matching efficiency.

[0080] Optionally, the first type of key field is a key field whose frequency of occurrence is less than a preset frequency among the key fields in multiple sample network traffic. Based on the field position information of multiple key fields and the first type of key fields among the multiple preset key fields contained in each rule, the network traffic is subjected to multi-mode matching to obtain multi-mode matching results, including: based on the first type of key fields in each rule, each rule is matched with the network traffic simultaneously to determine whether there is a target key field that matches the first type of key field among the multiple key fields of the network traffic; if there is a target key field, the field position of the target key field is matched with the specified position of the first type of key field that matches the target key field to generate multi-mode matching results.

[0081] It should be noted that the embodiments of the present invention first need to perform multi-mode matching on the target network traffic, and then select the successfully matched rules as target rules for the next step of single-mode matching. The basis of multi-mode matching is the first type of key field. The first type of key field is the feature selected based on the usage frequency of all features in the rule. First, matching is performed based on the features with lower usage frequency to perform initial screening of the rules, filter the rules that may match, avoid frequent repeated matching, save security detection time, and improve detection efficiency.

[0082] Before performing multi-pattern matching, it is necessary to select the first type of key fields to be matched. Specifically, this includes: selecting multiple sample network traffic within a historical time period; matching the sample network traffic with each rule to obtain all key fields corresponding to the rules appearing in the sample network traffic; and counting the frequency of the above key fields in all sample network traffic. Key fields with a frequency lower than the preset frequency are selected as the first type of key fields for the rule.

[0083] When performing multi-pattern matching on network traffic, the first step is to match the first type of key field of each rule with the characters in the network traffic to determine whether the first type of key field corresponding to each rule exists in the network traffic. If it exists, the position information of the target key field that successfully matches the first type of key field is then matched with the specified position of the first type of key field to obtain the multi-pattern matching result.

[0084] Optionally, after obtaining the multi-mode matching result, the method further includes: if there is no target key field matching the first type of key field among the multiple key fields of the network traffic indicated by the multi-mode matching result, then determining that the network traffic is not attack traffic; or, if there is a target key field matching the first type of key field among the multiple key fields of the network traffic indicated by the multi-mode matching result, and the position of the target key field in the network traffic belongs to the specified position of the matched first type of key field, then determining that the rule to which the matched first type of key field belongs is the target rule matching the network traffic.

[0085] It should be noted that multi-pattern matching is actually a rule filtering process, which matches each feature of each rule with each string of the target network traffic one by one. This is labor-intensive and inefficient. Therefore, it is divided into multi-pattern matching and single-pattern matching to speed up the matching process. The first type of key field is matched with the network traffic to obtain the multi-pattern matching result. If the multi-pattern matching result indicates that the first type of key field of all rules does not exist in the network traffic, it means that the preliminary matching has failed. The network traffic has not matched any rule, and the network traffic is safe and does not belong to the attack traffic. It can be allowed to pass directly.

[0086] On the other hand, if the multi-mode matching result indicates that there is any first-type key field in the network traffic, and the location information of the target key field that successfully matches the first-type key field also successfully matches the specified location of the first-type key field, the rule to which the successfully matched first-type key field belongs is determined, and the rule is marked as the target rule. Subsequently, single-mode matching is required to further determine whether the network traffic hits the target rule.

[0087] Optionally, the step of performing single-model matching between network traffic and each target rule based on the field location information of multiple key fields to obtain the single-model matching result includes: matching each target rule with the network traffic one by one based on the field location information of multiple key fields, determining whether the field locations of multiple key fields contain the specified location of a second type of key field, wherein the second type of key field is a key field in the target rule that is different from the first type of key field; if the field locations of multiple key fields contain the specified location of a second type of key field, matching the multiple key fields with the second type of key field to generate a single-model matching result.

[0088] It should be noted that single-pattern matching refers to the process of matching network traffic with the selected target rules one by one. In single-pattern matching, regardless of the scanning algorithm used, two challenges are inevitable: First, as the number of rules increases, the size of the compiled database also expands, leading to a gradual increase in the time cost required to scan the rules; Second, to avoid missed detections caused by TCP segmentation or IP fragmentation, IPS detection uses a streaming scanning method, which concatenates all segments belonging to a single network traffic flow and then scans them as a whole. However, when the network traffic is large (each packet reaches several KB in size), the data length of each scan will also increase accordingly, putting significant pressure on performance.

[0089] This invention incorporates location information, which can accurately locate the position of key fields in network traffic and detect them, thereby improving detection efficiency. It eliminates the need to match all preset key fields of each target rule with all characters of each network traffic, which can greatly reduce the performance pressure on the devices performing security detection.

[0090] It should be noted that during single-mode detection, the system determines whether the rule contains any detectable features. If so, it calls the feature location information list and iterates through the preset feature locations of the target network traffic one by one using the location information and detectable features recorded in the list. If the iteration results indicate that all detectable features of the target rule exist in the target network traffic, and all detectable features exist at the preset feature locations corresponding to those features, it means that the target network traffic may hit the rule and poses a threat. In this case, single-mode matching needs to be performed on the target network traffic based on the remaining features in the target rule to determine whether the target network traffic hits the rule. Conversely, if none of the features in the target rule exist at any of the preset feature locations in the target network traffic, it means that the target network traffic will not hit the target rule, and the target network traffic is confirmed to be safe and can be allowed to pass directly.

[0091] It should be noted that during single-mode detection, based on the location information of multiple key fields obtained from the network traffic, the target rule is matched against the network traffic one by one to determine whether the field location information of multiple key fields includes the specified location of the second type of key field. If it does, the key field indicated by the field information is matched with the second type of key field to obtain the single-mode matching result, thereby determining whether the network traffic hits the rule. The aforementioned second type of key field refers to the preset key fields in the rule other than the first type of key field.

[0092] If the single-mode matching result indicates that all key fields and their location information in the network traffic successfully match the second type of key fields and their specified locations in the target rule, it means that the target network traffic has hit the target rule and poses a certain threat, so it needs to be blocked. Conversely, if the network traffic does not hit any of the second type of key fields, it means that the network traffic has not hit the target rule. At the same time, if the network traffic does not hit any of the target rules, it means that the network traffic is safe and can be allowed to pass directly.

[0093] Single-mode detection allows for more precise security detection of network traffic that hits target rules, ensuring the accuracy of security detection.

[0094] Optionally, the network traffic security detection method further includes: when there are segmented network traffic, splicing different segments of network traffic belonging to the same network traffic to obtain complete network traffic; parsing the network traffic to obtain the field position information of multiple key fields in the network traffic, including: parsing the complete network traffic to obtain the field position information of multiple key fields in the complete network traffic.

[0095] It should be noted that some network traffic is segmented to improve the security or speed of traffic transmission. The segmented data is then transmitted in the form of segmented data and then aggregated when it arrives at the server. It is difficult to effectively detect this part of the data. The location information in the embodiments of the present invention can limit the detection range. Even for segmented data, security detection can be performed segment by segment, reducing the performance pressure on the device performing security detection.

[0096] It should be noted that the starting position of the request body of network traffic is determined by the hexadecimal character '0d0a0d0a' appearing after the request header. If there are TCP segments in the request header and request body, the complete request body data cannot be obtained during the current parsing process, and it is impossible to determine whether the rule is hit. Therefore, it is necessary to wait for all segmented traffic to arrive, then concatenate the segmented network traffic belonging to the same network traffic to obtain the complete network traffic, and then obtain the field position information of multiple key fields in the complete network traffic. Based on the field position information, security detection is performed on the complete network traffic.

[0097] Optionally, the complete network traffic is parsed to obtain the field location information of multiple key fields in the complete network traffic, including: obtaining the location offset of each segment of network traffic belonging to the same network traffic; updating the location range of each key field in the concatenated segmented network traffic based on the location offset of each segment of network traffic; and parsing the complete network traffic based on the updated location range of each key field to obtain the field location information of multiple key fields in the complete network traffic.

[0098] It should be noted that when splicing a segment of data, it is necessary to obtain the position offset of each segment of network traffic belonging to the same network traffic. Based on the offset of each segment of network traffic, the position range of each key field in the spliced ​​network traffic is updated, and the complete network traffic is parsed according to the updated position range of the key fields to obtain the field position information of each key field in the complete network traffic.

[0099] Step S103: Determine whether the network traffic is attack traffic based on the matching results.

[0100] It should be noted that the final matching result can be obtained based on the single-model matching results of network traffic and each target rule. If the single-model matching result of network traffic with any target rule is successful, it indicates that the network traffic is attack traffic and needs to be blocked in time. If the single-model matching result of network traffic with all target rules fails, it indicates that the network traffic does not match any rule, the network traffic is safe, and can be allowed.

[0101] It should be noted that, in this embodiment of the invention, the target rules for single-mode matching are determined based on multi-mode matching, and the final matching results are obtained based on the single-mode matching of each target rule of network traffic. In this process, a large number of rules can be filtered through multi-mode matching, and then precise matching can be performed through single-mode matching. Thus, without omitting any rule in the rule base, the detection process is simplified and the detection efficiency and accuracy are improved.

[0102] The following describes in detail another optional implementation method.

[0103] The implementation subject of this invention is a network traffic detection device / system (i.e., a device / system that performs security detection), such as an IPS detection device / system. The detection system is deployed between the user end and the server, obtains requests or responses and performs security detection on them. The detection system can obtain the latest rules from the rule base server in the cloud. This invention embodiment performs security detection based on the location information of the key fields in the network traffic by meticulously decomposing the preset key fields in the rules, and identifies whether the network traffic carries attack packets and whether there is a threat.

[0104] For example, the original feature indicated that the presence of the string "A" in the first 100 characters of an HTTP request meant the message was an attack message. The updated feature indicates that the presence of the string "A" in the User-Agent header within the first 100 characters of an HTTP request means the message is an attack message. In the original processing logic, the default key field was the string "A", and the location information of the key field in the network traffic was an HTTP message of length 100. In the new detection logic, assuming that during HTTP protocol parsing, the User-Agent header starts at character 90 and ends at character 110, the default key field is still the string "A". However, the location information of the key field to be detected in the network traffic becomes starting at character 90 and ending at character 100, with a total length of only 10 characters to be detected. This saves detection costs, improves detection efficiency, achieves accurate positioning, and improves detection accuracy.

[0105] Figure 2 This is a schematic diagram of an optional network traffic security detection process according to an embodiment of the present invention, such as... Figure 2 As shown, the entire network traffic security detection process includes:

[0106] Step 1: Create IPS rules and configure the corresponding location information for the features in the IPS rules.

[0107] To avoid false positives due to shortened matching strings, this embodiment sorts and classifies existing IPS rules before execution, selects features that appear in the attack set as preset key fields, and determines the structure and fields to which the preset key fields belong, resulting in primary key fields and secondary key fields. The primary key fields represent the fields in the three parts of network traffic: request line / response line (L), request header / response header (H), and request body / response body (B). The secondary key fields are selected based on the data units in the structure, focusing on fields with a higher probability of threat attacks.

[0108] Step two, IPS rule parsing and loading, is used to parse the rules, represent them in computer language, and load them into the traffic parser.

[0109] Step 3, IPS engine detection, can include four parts: protocol parsing, acquiring the data to be detected, multi-mode derivation, and single-mode derivation.

[0110] Protocol parsing refers to parsing the received network traffic and marking the field location information of key fields. After obtaining the data to be detected, multi-mode derivation (i.e., multi-mode matching) is performed based on the selected first type of key fields and the specified location information of the first type of key fields. The network traffic is matched with multiple rules at the same time to filter out the target rules. Then, single-mode matching is performed on the filtered target rules based on the second type of key fields and their location information.

[0111] Figure 3 This is a schematic diagram of a single-mode matching process in an optional network traffic security detection according to an embodiment of the present invention, as shown below. Figure 3 As shown, the steps for single-mode derivation include:

[0112] Step 1: Obtain network traffic and select a target rule for IPS single-mode matching;

[0113] Step two: parse the target rule;

[0114] Step 3: Determine if the target rule contains any features with location information. If not, it means the rule does not exist. Match the target network traffic with other features of the rule to determine if the target network traffic matches the rule. If yes, it means the rule exists. Proceed to Step 4.

[0115] Step 4: Determine if the position of the feature is greater than a preset threshold, which is generally 0. If not, there is no need to match the feature; if so, proceed to step 5.

[0116] Step 5: Determine if the network traffic is fragmented data (segmented data). If yes, enter the data waiting state; otherwise, proceed to step 6.

[0117] Step 6: Detect the target network traffic based on the location information of the features to be detected (corresponding to the key fields mentioned above) to obtain the detection results;

[0118] Step 7: If the detection result indicates that no detectable feature exists at the preset feature location of the network traffic (i.e., the location indicated by the location information), continue to perform single-mode matching of other rules; if the detection result indicates that all detectable features exist at the preset feature location of the network traffic, the network traffic is blocked; if the detection result indicates that the network traffic does not match any rule, the network traffic is allowed to pass.

[0119] In this embodiment of the invention, network traffic is parsed, and the position information of key fields in the network traffic is recorded. This reduces the length of the string to be matched for features during security detection, eliminating the need to traverse and detect all characters in the network traffic each time, thereby improving detection efficiency and accuracy.

[0120] The following is a detailed description with reference to another embodiment.

[0121] Example 2

[0122] The network traffic security detection device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in the above embodiment one. The specific implementation method and beneficial effects can be referred to the aforementioned method embodiment, and will not be repeated here.

[0123] Figure 4 This is a schematic diagram of an optional network traffic security detection device according to an embodiment of the present invention, such as... Figure 4 As shown, the network traffic security detection device may include: a parsing unit 41, a matching unit 42, and a determining unit 43, wherein,

[0124] The parsing unit 41 is used to receive network traffic, parse the network traffic, and obtain the field position information of multiple key fields in the network traffic.

[0125] The matching unit 42 is used to match network traffic with rules in the rule base based on the field position information of multiple key fields to obtain matching results. The rules contain multiple preset key fields, and the position of each preset key field in the network traffic is a specified position.

[0126] The determination unit 43 is used to determine whether network traffic is attack traffic based on the matching results.

[0127] The aforementioned network traffic security detection device receives network traffic through the parsing unit 41 and parses the network traffic to obtain the field location information of multiple key fields in the network traffic; the matching unit 42 matches the network traffic with rules in the rule base based on the field location information of multiple key fields to obtain the matching result, wherein the rule contains multiple preset key fields, and the position of each preset key field in the network traffic is a specified position; the determining unit 43 determines whether the network traffic is attack traffic based on the matching result.

[0128] In this embodiment, when performing security detection on network traffic, the location of the feature can be explicitly specified in the rules to be detected. During scanning, only the data at the specific location needs to be matched, thereby reducing the length of the string to be scanned, achieving accurate detection, reducing scanning time, and effectively improving the accuracy and efficiency of security detection. This solves the technical problem in related technologies where network traffic is split and security detection is performed on the split network traffic, resulting in low detection efficiency.

[0129] Optionally, the matching unit includes: a first matching module, used to perform multi-mode matching on network traffic based on the field location information of multiple key fields and the first type of key fields among the multiple preset key fields contained in each rule, to obtain a multi-mode matching result, wherein the first type of key fields in the rule are features selected based on the frequency of occurrence of key fields in multiple sample network traffic, and multi-mode matching is used to indicate that network traffic is matched with multiple rules simultaneously; a first determining module, used to determine at least one target rule that matches the network traffic based on the multi-mode matching result; a second matching module, used to perform single-mode matching on network traffic and each target rule based on the field location information of multiple key fields, to obtain a single-mode matching result, wherein single-mode matching is used to indicate that network traffic is matched with each target rule one by one; and a first obtaining module, used to obtain the matching result of network traffic based on the single-mode matching result.

[0130] Optionally, the network traffic security detection device further includes: a first creation unit, used to create rules in the rule base by taking the first-level key fields and second-level key fields in the preset rule feature list as multiple preset key fields, wherein the granularity of the second-level key fields is finer than that of the first-level key fields.

[0131] Optionally, the first type of key field is a key field whose frequency of occurrence is less than a preset frequency among the key fields in multiple sample network traffic. The first matching module includes: a first matching submodule, used to match each rule with the network traffic simultaneously based on the first type of key fields in each rule, to determine whether there is a target key field that matches the first type of key field among the multiple key fields of the network traffic; and a second matching submodule, used to match the field position of the target key field with the specified position of the first type of key field that matches the target key field if the target key field exists, to generate a multi-mode matching result.

[0132] Optionally, the first matching module further includes: a first determining submodule, used to determine that the network traffic is not attack traffic when there is no target key field matching the first type of key field among the multiple key fields indicated by the multi-mode matching result of the network traffic; and a second determining submodule, used to determine that the rule to which the matched first type of key field belongs is the target rule matching the network traffic when there is a target key field matching the first type of key field among the multiple key fields indicated by the multi-mode matching result of the network traffic, and the position of the target key field in the network traffic belongs to the specified position of the matched first type of key field.

[0133] Optionally, the second matching module includes: a third matching submodule, used to match each target rule with network traffic one by one based on the field position information of multiple key fields, and determine whether the field positions of the multiple key fields contain the specified position of the second type of key field, wherein the second type of key field is a key field in the target rule that is different from the first type of key field; and a fourth matching submodule, used to match the multiple key fields with the second type of key field when the field positions of the multiple key fields contain the specified position of the second type of key field, and generate a single-mode matching result.

[0134] Optionally, the network traffic security detection device further includes: a first splicing unit, used to splice different segments of network traffic belonging to the same network traffic to obtain complete network traffic when there are segmented network traffic; the parsing unit includes: a first parsing module, used to parse the complete network traffic and obtain the field position information of multiple key fields in the complete network traffic.

[0135] Optionally, the first parsing module includes: a first acquisition submodule, used to acquire the location offsets of different segments of network traffic belonging to the same network traffic; a first update submodule, used to update the location range of each key field in the spliced ​​segmented network traffic based on the location offsets of the different segments of network traffic; and a second acquisition submodule, used to parse the complete network traffic based on the updated location range of each key field, and acquire the field location information of multiple key fields in the complete network traffic.

[0136] The aforementioned network traffic security detection device may also include a processor and a memory. The parsing unit 41, matching unit 42, determining unit 43, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0137] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, security checks on network traffic can be performed.

[0138] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0139] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the above-described network traffic security detection method.

[0140] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above-described network traffic security detection method.

[0141] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: receiving network traffic and parsing the network traffic to obtain the field position information of multiple key fields in the network traffic; matching the network traffic with rules in a rule base based on the field position information of the multiple key fields to obtain a matching result, wherein the rule contains multiple preset key fields, and the position of each preset key field in the network traffic is a specified position; and determining whether the network traffic is attack traffic based on the matching result.

[0142] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention for a network traffic security detection method. Figure 5 As shown, an electronic device may include one or more ( Figure 5 The processor 502 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 504 for storing data may also be included. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 5 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0143] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0144] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0149] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for secure network traffic detection, characterized in that, include: Receive network traffic and parse the network traffic to obtain the field location information of multiple key fields in the network traffic; Based on the field location information of multiple key fields, the network traffic is matched with the rules in the rule base to obtain a matching result. The rule contains multiple preset key fields, and the position of each preset key field in the network traffic is a specified position. Based on the matching results, determine whether the network traffic is attack traffic; Based on the field location information of multiple key fields, the network traffic is matched with rules in the rule base to obtain matching results, including: Based on the field location information of multiple key fields and the first type of key field among multiple preset key fields included in each rule, the network traffic is subjected to multi-mode matching to obtain multi-mode matching results. The first type of key field in the rule is a feature selected based on the frequency of occurrence of key fields in multiple sample network traffic. The multi-mode matching is used to indicate that the network traffic is matched with multiple rules simultaneously. Based on the multi-mode matching results, at least one target rule matching the network traffic is determined; Based on the field location information of multiple key fields, the network traffic is matched with each of the target rules in a single-mode matching process to obtain a single-mode matching result. The single-mode matching is used to instruct the network traffic to be matched with each of the target rules one by one. Based on the single-mode matching result, the matching result of the network traffic is obtained.

2. The security detection method according to claim 1, characterized in that, The method further includes: Rules in the rule base are created by using the first-level key fields and second-level key fields in the preset rule feature list as multiple preset key fields, wherein the granularity of the second-level key fields is finer than that of the first-level key fields.

3. The detection method according to claim 1, characterized in that, The first type of key fields are key fields that appear less frequently than a preset frequency among key fields in multiple sample network traffic; The process of performing multi-modal matching on the network traffic based on the field location information of multiple key fields and the first type of key field among multiple preset key fields included in each rule, to obtain multi-modal matching results, includes: Based on the first type of key fields in each of the rules, each of the rules is simultaneously matched with the network traffic to determine whether there is a target key field that matches the first type of key fields among the multiple key fields of the network traffic. If the target key field exists, the field position of the target key field is matched with the specified position of the first type of key field that matches the target key field to generate the multi-mode matching result.

4. The detection method according to claim 1 or 3, characterized in that, After obtaining the multi-modal matching result, the process also includes: If the multi-mode matching result indicates that there is no target key field that matches the first type of key field among the multiple key fields of the network traffic, it is determined that the network traffic is not attack traffic; or, If the multi-mode matching result indicates that there is a target key field that matches the first type of key field among multiple key fields of the network traffic, and the position of the target key field in the network traffic belongs to the specified position of the matched first type of key field, then the rule to which the matched first type of key field belongs is determined to be the target rule that matches the network traffic.

5. The detection method according to claim 1 or 3, characterized in that, The steps for performing single-model matching between the network traffic and each of the target rules based on the field location information of multiple key fields to obtain the single-model matching result include: Based on the field location information of multiple key fields, each target rule is matched with the network traffic one by one to determine whether the field location of the multiple key fields contains the specified location of the second type of key field, wherein the second type of key field is a key field in the target rule that is different from the first type of key field; When a specified position of the second type of key field is included in the field position of multiple key fields, the multiple key fields are matched with the second type of key field to generate the single-mode matching result.

6. The detection method according to any one of claims 1 to 2, characterized in that, Also includes: In the case where the network traffic is segmented, different segments of the network traffic belonging to the same network traffic are spliced ​​together to obtain the complete network traffic. The step of parsing the network traffic to obtain the field location information of multiple key fields in the network traffic includes: The complete network traffic is parsed to obtain the field location information of multiple key fields in the complete network traffic.

7. The detection method according to claim 6, characterized in that, The step of parsing the complete network traffic to obtain the field location information of multiple key fields in the complete network traffic includes: Obtain the position offset of each segment of network traffic belonging to the same network traffic; Based on the location offset of each segment of the network traffic, the location range of each key field in the spliced ​​segment of the network traffic is updated; Based on the updated location range of each key field, the complete network traffic is parsed to obtain the field location information of multiple key fields in the complete network traffic.

8. A network traffic security detection device, characterized in that, include: The parsing unit is used to receive network traffic, parse the network traffic, and obtain the field location information of multiple key fields in the network traffic; The matching unit is used to match the network traffic with the rules in the rule base based on the field position information of multiple key fields to obtain a matching result. The rule contains multiple preset key fields, and the position of each preset key field in the network traffic is a specified position. A determining unit is configured to determine whether the network traffic is attack traffic based on the matching result; The matching unit includes: a first matching module, used to perform multi-mode matching on network traffic based on the field location information of multiple key fields and the first type of key fields among the multiple preset key fields contained in each rule, to obtain a multi-mode matching result, wherein the first type of key fields in the rule are features selected based on the frequency of occurrence of key fields in multiple sample network traffic, and multi-mode matching is used to instruct network traffic to be matched with multiple rules simultaneously; a first determining module, used to determine at least one target rule that matches the network traffic based on the multi-mode matching result; a second matching module, used to perform single-mode matching on network traffic and each target rule based on the field location information of multiple key fields, to obtain a single-mode matching result, wherein single-mode matching is used to instruct network traffic to be matched with each target rule one by one; and a first obtaining module, used to obtain the matching result of network traffic based on the single-mode matching result.

9. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network traffic security detection method according to any one of claims 1 to 7.

Images