Security detection method and device, electronic equipment and storage medium

Abstract

The invention provides a security detection method and device, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the steps of determining a target detection mode of to-be-detected access traffic in response to the obtained to-be-detected access traffic, and if the target detection mode corresponds to a plurality of target detection nodes and physical resources corresponding to the target detection nodes are mutually isolated, detecting the to-be-detected access traffic. Therefore, when the detection modules corresponding to the target detection nodes are called in parallel to detect the to-be-detected access traffic, the detection nodes do not interfere with one another during detection, physical resources can be independently arranged between the detection nodes, and the parallel efficiency of detection is improved to a certain extent when large-batch to-be-detected access traffic is detected.

Description

Technical Field

[0001] This disclosure belongs to the field of communication technology, and specifically relates to a security detection method, device, electronic device and storage medium. Background Technology

[0002] Network security refers to the protective mechanisms that safeguard computer networks from attackers. Typically, after access traffic arrives, a security resource pool is used to virtualize various security detection modules to achieve security detection of the access traffic.

[0003] However, using a security resource pool for security detection only logically isolates the virtual instances corresponding to each security detection module. The virtual instances corresponding to each security detection module still share physical resources such as processors and buses. When faced with a large volume of access traffic, it is difficult to achieve parallel processing of the large volume of access traffic due to limited physical resources. Summary of the Invention

[0004] This disclosure provides a security testing method, apparatus, electronic device, and storage medium.

[0005] A first aspect of this disclosure provides a security detection method, the method comprising: In response to obtaining the access traffic to be detected, determine the target detection method that matches the access traffic to be detected; If the target detection method corresponds to multiple target detection nodes, the detection modules corresponding to each target detection node are called in parallel to detect the access traffic to be detected; wherein, the physical resources corresponding to each target detection node are isolated from each other; After obtaining the detection results of each detection node, the target detection result is generated based on the detection results corresponding to each detection node.

[0006] In this embodiment of the disclosure, before the detection methods corresponding to each of the target detection nodes are called in parallel to detect the access traffic to be detected, the method further includes: The channels corresponding to the multiple target detection nodes are determined according to the pre-allocated channel parameters; The access traffic to be detected is transmitted to the corresponding target detection node based on the channel parameters corresponding to the channel of the target detection node.

[0007] In this embodiment of the disclosure, transmitting the access traffic to be detected to the corresponding target detection node based on the channel parameters corresponding to the channel of the target detection node includes: The access traffic to be detected is copied to obtain multiple access traffic to be detected; each of the multiple access traffic to be detected corresponds one-to-one with the multiple target detection nodes. Based on the channel parameters of the corresponding channels of each target detection node, the multiple access traffic to be detected are transmitted in parallel to the corresponding target detection nodes through the corresponding channels.

[0008] In this embodiment of the disclosure, transmitting the plurality of access traffic to be detected to the corresponding target detection node through the corresponding channel includes: Obtain the load status of each target detection node; For any target detection node, if the load condition of the target detection node does not meet the preset detection conditions, the target detection node is changed to a backup detection node; wherein, the load condition of the backup detection node meets the preset detection conditions, and the detection method of the backup detection node is the same as or corresponding to the detection method of the target detection node; The access traffic to be detected is transmitted to the backup detection node through the channel parameters of the backup detection node.

[0009] In this embodiment of the disclosure, the parallel invocation of the detection modules corresponding to each of the target detection nodes to detect the access traffic to be detected includes: For any target detection node, if the child node that the target detection node detects the access traffic to be detected fails, the corresponding backup child node in the detection node is used to detect the access traffic to be detected.

[0010] In this embodiment of the disclosure, after generating the target detection result based on the detection results corresponding to each detection node, the process includes: Analyze the information representing security risks in the sub-detection results corresponding to each detection node; Based on information indicating security risks, identify risky traffic from the access traffic to be detected. Adjust the risky traffic in the access traffic to be detected to obtain the target access traffic.

[0011] In this embodiment of the disclosure, determining the target detection method for the access traffic to be detected includes: Determine the attribute information of the access traffic to be detected; the attribute information includes at least one of the following: tenant information, access service type, or risk level of the access traffic to be detected. The detection method corresponding to the attribute information in the preset mapping relationship is determined to obtain the target detection method. The preset mapping relationship is the mapping relationship between the attribute information and the detection method.

[0012] In this embodiment of the disclosure, before determining the target detection method corresponding to the attribute information based on the preset mapping relationship between the attribute information and the detection method, the method further includes: Obtain historical attribute information, historical detection methods, and historical detection results of historical access traffic within a preset historical time period; Using a preset analysis model, the historical attribute information, historical detection methods, and historical detection results are analyzed to determine the preset mapping relationship.

[0013] A second aspect of this disclosure provides a security detection device, the device comprising: The traffic access module is used to determine the target detection method that matches the access traffic to be detected in response to acquiring the access traffic to be detected. A parallel detection module is used to concurrently call the detection modules corresponding to each of the target detection nodes to detect the access traffic to be detected if the target detection method corresponds to multiple target detection nodes; wherein, the physical resources corresponding to each target detection node are isolated from each other; The result generation module is used to generate target detection results based on the detection results corresponding to each detection node after obtaining the detection results of each detection node.

[0014] An embodiment of the third aspect of this disclosure provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect or any optional embodiment of the first aspect.

[0015] An embodiment of the fourth aspect of this disclosure provides a computer-readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the method described in the first aspect or any optional embodiment of the first aspect.

[0016] The technical solutions provided in this disclosure have at least the following technical effects or advantages: In response to obtaining the access traffic to be detected, this embodiment determines the target detection method for the access traffic to be detected. If the target detection method corresponds to multiple target detection nodes, the physical resources of each target detection node are isolated from each other. Therefore, when the detection modules corresponding to each target detection node are called in parallel to detect the access traffic to be detected, the detection nodes do not interfere with each other during detection. Each detection node can be configured with its own physical resources. When facing a large number of access traffic to be detected, the parallel efficiency of detection is improved to a certain extent.

[0017] Additional aspects and advantages of this disclosure will be set forth in part in the description which follows, and in part will be obvious from the description or may be learned by practice of this disclosure. Attached Figure Description

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this disclosure. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A schematic diagram of the structure of a security detection system provided in an embodiment of this disclosure is shown; Figure 2 A flowchart of a security detection method provided in an embodiment of this disclosure is shown; Figure 3 A schematic diagram of the structure of a security detection device provided in another embodiment of this disclosure is shown; Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure is shown; Figure 5 A schematic diagram of a storage medium provided according to an embodiment of the present disclosure is shown. Detailed Implementation

[0019] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0020] It should be noted that, unless otherwise stated, the technical or scientific terms used in this disclosure shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains.

[0021] The following describes the implementation scenarios and related technologies involved in the embodiments of this disclosure.

[0022] With the development of computer networks, network security is the foundation of network application interaction. Network security refers to the protection mechanisms that safeguard computer networks from attackers. Typically, network security systems in related technologies distribute incoming traffic to be inspected via switches, routers, etc., using methods such as port forwarding and traffic mirroring. Next, various security detection modules in a security resource pool inspect the distributed traffic, where each module is virtualized to achieve flexible allocation of computing resources. However, the virtual instances corresponding to each security detection module need to share physical resources such as processors and buses. When faced with large volumes of access traffic, the limited physical resources make it difficult to achieve parallel processing of such traffic.

[0023] In view of the above, this disclosure provides a security detection method, apparatus, electronic device, and storage medium. The technical solutions of this disclosure are described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of this disclosure will now be described with reference to the accompanying drawings.

[0024] See Figure 1 , Figure 1 A schematic diagram of an exemplary system architecture of the security detection system provided in this disclosure is shown. The security detection system provided in this disclosure includes a traffic acquisition module 101, a security resource processing module 102, and a scheduling module 103. The traffic acquisition module 101 can be used to distribute large volumes of access traffic to be detected at high speed. During the distribution process, isolation is performed using signal parameters such as wavelength to ensure the security of the access traffic to be detected. The traffic acquisition module 101 may include a traffic access unit 1011 and a traffic distribution unit 1012. The traffic access unit 1011 is used to access the access traffic to be detected from various nodes or from the core network. The traffic distribution unit 1012 is used to distribute the access traffic to be detected to the security resource processing module 102. The corresponding security resource processing module 102 consists of multiple independent detection nodes (detection node 1, detection node 2, ..., detection node n). Each detection node corresponds to its own physical resources and does not need to share physical resources with other detection nodes, ensuring that parallel processing can be achieved to improve processing speed when a large number of access traffic to be detected arrives. The scheduling module 103 can set traffic distribution-related parameters for the traffic acquisition module 101 and schedule the detection nodes corresponding to the security resource processing module 102. The corresponding traffic distribution and scheduling methods will be described in subsequent method embodiments and will not be repeated here.

[0025] The traffic acquisition module 101 can be a programmable optical splitter, a wavelength selective switch (WSS), an erbium-doped fiber amplifier (EDFA), or a quantum key distribution (QKD) device. The security resource processing module 102 can be a field-programmable gate array (FPGA), an x86 server, or a virtual security network element built using Kubernetes (K8s), as long as the physical resources between the corresponding detection nodes are independent. The scheduling module 103 can be a server or a cloud-native cluster, such as a standalone physical server, a server cluster composed of multiple physical servers, a distributed system, or a cloud platform. The scheduling module 103 can be deployed with its own resources and computing power. The security detection method provided in this embodiment is deployed in the scheduling module 103 to schedule and configure the traffic acquisition module 101 and the security resource processing module 102.

[0026] It is understood that the structure of the examples in this disclosure does not constitute a specific limitation on the security detection system. In other embodiments of this disclosure, the security detection system may include... Figure 1 The number of devices shown is not limited here. The algorithms and networks included in the above analysis modules are illustrative examples of this disclosure and do not constitute a limitation on the modules in the embodiments of this disclosure. The algorithms included in the modules in the embodiments of this disclosure can be flexibly deployed by those skilled in the art according to actual conditions. No limitations are imposed here.

[0027] The following is combined Figure 1 The illustrated embodiments are used to describe a security detection method proposed according to embodiments of the present disclosure. For example... Figure 2 As shown, this disclosure provides a security detection method, which can be applied to the scheduling module 103 in the aforementioned security detection system. The method includes: In step S21, in response to obtaining the access traffic to be detected, the target detection method matching the access traffic to be detected is determined.

[0028] For example, the access traffic to be detected can be the service traffic of the core network or various nodes. After acquiring the access traffic to be detected, in order to perform security detection on the access traffic, traffic features of the access traffic to be detected can be extracted, and the traffic features can be input into a pre-trained model for real-time classification to obtain the corresponding target detection method. The pre-trained model can be a neural network model, etc. The target detection method can be deep packet inspection (DPI), access traffic behavior analysis, etc. In this embodiment of the disclosure, in step S21, determining the target detection method for the access traffic to be detected can also be achieved by: determining the attribute information of the access traffic to be detected; determining the detection method corresponding to the attribute information in the preset mapping relationship, thereby obtaining the target detection method.

[0029] The attribute information includes at least one of the following: tenant information of the access traffic to be detected, access service type, or risk level; the preset mapping relationship is the mapping relationship between the attribute information and the detection method. For example, tenant information can be the tenant identifier to which the traffic belongs, such as an enterprise, department, or user group; the access service type can be the business scenario associated with the traffic to be detected, such as a payment scenario, login scenario, or file transfer scenario; the risk level can be the potential security threat level of the traffic to be detected, such as high risk, medium risk, or low risk. The preset mapping relationship can be a static or semi-dynamic policy table, where the primary key is "attribute combination" and the value is "detection method to be enabled," where "attribute combination" can be a combination of one or more of the aforementioned attribute information. The target detection method can be a specific detection strategy found according to the preset mapping relationship, such as DPI detection, Intrusion Detection System (IDS), Firewall (FW) detection, and de-identification detection.

[0030] After acquiring the access traffic to be detected, the corresponding metadata, such as the five-tuple, protocol, domain name, certificate, and user account, can be identified based on information such as the packet header. Further, the corresponding attribute information can be obtained from this metadata. The attribute information of each type is combined to obtain a key, which is then used to match the corresponding target detection method in a preset mapping relationship.

[0031] To further improve the accuracy of target detection methods, it is necessary to improve the accuracy of preset mapping relationships. In this embodiment of the present disclosure, before determining the target detection method corresponding to the attribute information based on the preset mapping relationship between attribute information and detection methods, the method may further include: obtaining historical attribute information, historical detection methods, and historical detection results of historical access traffic within a preset historical time period; and using a preset analysis model to analyze the historical attribute information, historical detection methods, and historical detection results to determine the preset mapping relationship.

[0032] For example, the preset historical time period can be all access traffic within a cycle, where the duration of the cycle can be set manually, such as a week, a month, etc., and can also be dynamically adjusted based on the detection results within a period of time.

[0033] After obtaining historical access traffic within a preset historical time period, the historical attribute information and historical detection results within the historical access traffic are further determined. The historical attribute information, historical detection methods, and historical detection results can be pre-stored in a preset storage location during the detection process, and can be directly read from this location. If some access traffic is not detected, or if there is no corresponding historical attribute information or historical detection result in the preset storage location, this data can be deleted as noise data or filled with blanks to ensure data integrity and improve data quality.

[0034] The pre-defined analysis model can be an Apriori algorithm, decision tree, clustering analysis algorithm, or neural network model used for mining association rules. After obtaining high-quality historical data (historical attribute information, historical detection methods, and historical detection results), any of the above algorithms / models is used to analyze the association between historical data and detection methods to obtain a pre-defined mapping relationship. The accuracy of the pre-defined mapping relationship is improved by analyzing the historical data.

[0035] After determining the target detection method, to ensure sufficient computing resources for detecting the access traffic and to improve the security of the access traffic, the access traffic to be detected can be transmitted to a dedicated target detection node for detection.

[0036] Typically, one detection node corresponds to one detection method. When there are multiple detection methods, there are multiple target detection nodes. In this case, the traffic to be accessed needs to be transmitted to the corresponding target detection nodes. When transmitting the signal to be detected, it is necessary to ensure the security of the transmission process and that the transmission processes do not interfere with each other, so as to ensure the accuracy of the access signal to be detected transmitted to the target detection node.

[0037] Therefore, before calling the detection methods corresponding to each target detection node in parallel to detect the access traffic to be detected, the method also includes: determining the channels corresponding to multiple target detection nodes according to the pre-allocated channel parameters; and transmitting the access traffic to be detected to the corresponding target detection nodes according to the channel parameters corresponding to the channels of the target detection nodes.

[0038] For example, channel parameters can include the wavelength, bandwidth, encryption type, and protocol type of the transmission signal channel. In this embodiment, wavelength is used as an example. Different wavelengths correspond to different detection nodes. Therefore, when transmitting the access traffic to be detected to multiple detection nodes in parallel, a corresponding wavelength can be set for the signal of the access traffic to be detected, so that it is transmitted from the channel corresponding to that detection node, thereby achieving non-interference between the detection nodes. QKD can also be set during transmission to ensure the security of the access traffic to be detected.

[0039] Since there are multiple target detection nodes, although different detection nodes use different detection methods, each detection method is for detecting all the access traffic to be detected. Therefore, each target detection node needs to obtain the complete access traffic to be detected. In this embodiment of the disclosure, the access traffic to be detected is transmitted to the corresponding target detection node based on the channel parameters corresponding to the channel of the target detection node, including: copying the access traffic to be detected to obtain multiple access traffic to be detected; the multiple access traffic to be detected are one-to-one corresponding to the multiple target detection nodes; based on the channel parameters of the channel corresponding to each target detection node, the multiple access traffic to be detected are transmitted in parallel to the corresponding target detection node through the corresponding channel.

[0040] For example, the access traffic to be detected can be replicated according to the number of target detection nodes to ensure that the number of access traffic to be detected is the same as the number of target detection nodes, and that each access traffic to be detected is completely identical. This replication process can be implemented using a programmable optical splitter. After replicating multiple access traffic to be detected, the wavelengths of the signals corresponding to the multiple access traffic to be detected are set according to the wavelength of the channel corresponding to each target detection node, so that the signals of the corresponding wavelengths can be transmitted to the corresponding detection nodes.

[0041] In some embodiments, some target detection nodes may experience high loads. In such cases, even if the access traffic to be detected is transmitted to the target detection node, the relevant detection cannot be performed in a timely manner, and it is necessary to wait for available computing resources to be available for detection. To address this situation, when multiple access traffic to be detected is transmitted to the corresponding target detection nodes through their respective channels, the load status of each target detection node can be obtained. If the load status of any target detection node does not meet the preset detection conditions, the target detection node is changed to a backup detection node. The backup detection node meets the preset detection conditions, and its detection method is the same as or corresponds to that of the target detection node. The access traffic to be detected is transmitted to the backup detection node through its channel parameters. The backup detection node can be a detection node that is not among the multiple target detection nodes from all preset detection nodes, or it can be one of the multiple target detection nodes.

[0042] In step S22, if the target detection method corresponds to multiple target detection nodes, the detection modules corresponding to each target detection node are called in parallel to detect the access traffic to be detected; wherein, the physical resources corresponding to each target detection node are isolated from each other.

[0043] For example, each target detection node corresponds to a detection method. After the access traffic to be detected is transmitted to the corresponding multiple target detection nodes, each target detection node calls its corresponding detection module to detect the access traffic. The detection module can deploy algorithms corresponding to the detection method. Each target detection node does not interfere with the others and can independently complete its corresponding detection.

[0044] When detecting any target node, virtual child nodes can be created based on the current detection task for parallel execution. If a child node fails during parallel execution, the corresponding backup child node within the detection node will be used to detect the access traffic, ensuring the timely completion of the corresponding detection task in the target node. The backup child node can be a reserved child node or another child node that has already completed its corresponding task.

[0045] In step S23, after obtaining the detection results of each target detection node, the target detection results are generated based on the detection results corresponding to each detection node.

[0046] For example, after obtaining the detection results corresponding to each detection node, since the detection methods corresponding to each target detection node are different, the detection results corresponding to different target detection nodes may be different. Therefore, it is necessary to summarize the detection results corresponding to each target detection node to obtain the target detection result.

[0047] For example, the detection results (partial) for each target detection node can be processed and aggregated according to a unified format. Based on factors such as the load and historical accuracy of each target detection node, a credibility weight is generated for that node. This credibility weight characterizes the credibility of the detection results for that node. When aggregating the results for each target detection node, a credibility weight attribute is added to the detection results for reference when adjusting access traffic based on these results. For example, content corresponding to detection results with credibility weights greater than a certain value can be deleted. Furthermore, if the detection results for the same content differ across different target detection nodes, a final detection result for that content can be generated based on the credibility weight. Based on the above embodiments, after generating the target detection results, some embodiments may further parse the information representing the existence of security risks in the sub-detection results corresponding to each detection node; determine the risk traffic in the access traffic to be detected based on the information of the existence of security risks; adjust the risk traffic in the access traffic to be detected to obtain the target access traffic.

[0048] For example, the security risks included in the target detection results are parsed, and alarm levels, threat labels, malicious file hashes, and backlink domains that are equal to or higher than preset thresholds are extracted to form a "risk signal list". For example, any field value that can be interpreted as "malicious, suspicious, or risky", such as alarm level ≥ preset threshold, threat label "medium / high", and trust weight > 0.8.

[0049] The signals in the risk signal list are mapped back to the original packet sequence number or time offset to pinpoint which specific packets, files, or traffic windows need to be marked as "risk traffic." Adjustments are then made to the risk traffic according to the pre-defined handling template. After adjustment, the remaining traffic is repackaged into the target access traffic for continued access, while the removed high-risk segments are written separately to the isolation log for later analysis of the pre-defined mapping relationships. The pre-defined initial template is shown in Table 1.

[0050] Table 1

[0051] In summary, in response to obtaining the access traffic to be detected, the embodiments of this disclosure determine the target detection method for the access traffic to be detected. If the target detection method corresponds to multiple target detection nodes, the physical resources of each target detection node are isolated from each other. Therefore, when the detection modules corresponding to each target detection node are called in parallel to detect the access traffic to be detected, the detection nodes do not interfere with each other during detection. Each detection node can be configured with its own physical resources. When facing a large number of access traffic to be detected, the parallel efficiency of detection is improved to a certain extent.

[0052] correspond Figure 3 The illustrated security detection method, in this embodiment of the disclosure, also provides a security detection device for performing the security detection method, such as... Figure 3 As shown, the device includes: Traffic access module 301 is used to determine the target detection method matching the access traffic to be detected in response to acquiring the access traffic to be detected; The parallel detection module 302 is used to concurrently call the detection modules corresponding to each of the target detection nodes to detect the access traffic to be detected if the target detection method corresponds to multiple target detection nodes; wherein, the physical resources corresponding to each target detection node are isolated from each other; The result generation module 303 is used to generate target detection results based on the detection results corresponding to each detection node after obtaining the detection results of each detection node.

[0053] In this embodiment of the disclosure, before the parallel detection module, the device is further configured to: determine the channels corresponding to the plurality of target detection nodes respectively according to the pre-allocated channel parameters; The access traffic to be detected is transmitted to the corresponding target detection node based on the channel parameters corresponding to the channel of the target detection node.

[0054] In this embodiment of the disclosure, the device is further configured to: The access traffic to be detected is copied to obtain multiple access traffic to be detected; each of the multiple access traffic to be detected corresponds one-to-one with the multiple target detection nodes. Based on the channel parameters of the corresponding channels of each target detection node, the multiple access traffic to be detected are transmitted in parallel to the corresponding target detection nodes through the corresponding channels.

[0055] In this embodiment of the disclosure, the device is further configured to: acquire the load status of each target detection node; For any target detection node, if the load condition of the target detection node does not meet the preset detection conditions, the target detection node is changed to a backup detection node; wherein, the load condition of the backup detection node meets the preset detection conditions, and the detection method of the backup detection node is the same as or corresponding to the detection method of the target detection node; The access traffic to be detected is transmitted to the backup detection node through the channel parameters of the backup detection node.

[0056] In this embodiment of the disclosure, the parallel detection module is further configured to: for any target detection node, if the target detection node detects a failure in a child node of the access traffic to be detected, then use the corresponding backup child node in the detection node to detect the access traffic to be detected.

[0057] In this embodiment of the disclosure, after the result generation module, the device is further configured to: parse the information representing the existence of security risks in the sub-detection results corresponding to each detection node; Based on information indicating security risks, identify risky traffic from the access traffic to be detected. Adjust the risky traffic in the access traffic to be detected to obtain the target access traffic.

[0058] In this embodiment of the disclosure, the result generation module is further configured to: determine the attribute information of the access traffic to be detected; the attribute information includes at least one of the following: tenant information of the access traffic to be detected, access service type, or risk level; The detection method corresponding to the attribute information in the preset mapping relationship is determined to obtain the target detection method. The preset mapping relationship is the mapping relationship between the attribute information and the detection method.

[0059] In this embodiment of the disclosure, the result generation module is further configured to: obtain historical attribute information, historical detection methods, and historical detection results of historical access traffic within a preset historical time period; Using a preset analysis model, the historical attribute information, historical detection methods, and historical detection results are analyzed to determine the preset mapping relationship.

[0060] The security detection device and the security detection method provided in the above embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0061] This disclosure also provides an electronic device for performing the above-described security detection method. Please refer to... Figure 4 This illustrates a schematic diagram of an electronic device provided by some embodiments of the present disclosure. For example... Figure 4 As shown, the electronic device 4 includes: a processor 400, a memory 401, a bus 402, and a communication interface 403. The processor 400, the communication interface 403, and the memory 401 are connected via the bus 402. The memory 401 stores a computer program that can run on the processor 400. When the processor 400 runs the computer program, it executes the security detection method provided in any of the foregoing embodiments of this disclosure.

[0062] The memory 401 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between the virtual devices in the system is achieved through at least one communication interface 403 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network.

[0063] Bus 402 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 401 is used to store programs. After receiving an execution instruction, the processor 400 executes the program. The security detection method disclosed in any of the foregoing embodiments of this disclosure can be applied to the processor 400, or implemented by the processor 400.

[0064] The processor 400 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 400 or by instructions in software form. The processor 400 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 401. The processor 400 reads the contents of memory 401 and, in conjunction with its hardware, completes the steps of the above method.

[0065] The electronic devices and security detection methods provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they employ, operate, or implement.

[0066] This disclosure also provides a computer-readable storage medium corresponding to the security detection method provided in the foregoing embodiments. Please refer to... Figure 5The computer-readable storage medium shown is an optical disc 30, on which a computer program (i.e., a program product) is stored. When the microprocessor runs, the computer program executes the security detection method provided in any of the foregoing embodiments.

[0067] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0068] The computer-readable storage medium provided in the above embodiments of this disclosure and the security detection method provided in the embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0069] Although alternative embodiments of this disclosure have been described, those skilled in the art, upon learning the basic inventive concept, can make further changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this disclosure.

[0070] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this disclosure. It should be understood that the above description is only a specific embodiment of this disclosure and is not intended to limit the scope of protection of this disclosure. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of this disclosure should be included within the scope of protection of this invention.

Claims

1. A security detection method, characterized in that, The method includes: In response to obtaining the access traffic to be detected, determine the target detection method that matches the access traffic to be detected; If the target detection method corresponds to multiple target detection nodes, the detection modules corresponding to each target detection node are called in parallel to detect the access traffic to be detected; wherein, the physical resources corresponding to each target detection node are isolated from each other; After obtaining the detection results of each target detection node, a target detection result is generated based on the detection results corresponding to each detection node.

2. The method according to claim 1, characterized in that, Before the parallel invocation of the detection methods corresponding to each of the target detection nodes to detect the access traffic to be detected, the method further includes: The channels corresponding to the multiple target detection nodes are determined according to the pre-allocated channel parameters; The access traffic to be detected is transmitted to the corresponding target detection node based on the channel parameters corresponding to the channel of the target detection node.

3. The method according to claim 2, characterized in that, The step of transmitting the access traffic to be detected to the corresponding target detection node based on the channel parameters corresponding to the channel of the target detection node includes: The access traffic to be detected is copied to obtain multiple access traffic to be detected; each of the multiple access traffic to be detected corresponds one-to-one with the multiple target detection nodes. Based on the channel parameters of the corresponding channels of each target detection node, the multiple access traffic to be detected are transmitted in parallel to the corresponding target detection nodes through the corresponding channels.

4. The method according to claim 3, characterized in that, The step of transmitting the plurality of access traffic to be detected to the corresponding target detection node through the corresponding channel includes: Obtain the load status of each target detection node; For any target detection node, if the load condition of the target detection node does not meet the preset detection conditions, the target detection node is changed to a backup detection node; wherein, the load condition of the backup detection node meets the preset detection conditions, and the detection method of the backup detection node is the same as or corresponding to the detection method of the target detection node; The access traffic to be detected is transmitted to the backup detection node through the channel parameters of the backup detection node.

5. The method according to claim 1, characterized in that, The parallel invocation of the detection modules corresponding to each of the target detection nodes to detect the access traffic to be detected includes: For any target detection node, if the child node that the target detection node detects the access traffic to be detected fails, the corresponding backup child node in the detection node is used to detect the access traffic to be detected.

6. The method according to claim 1, characterized in that, After generating the target detection result based on the detection results corresponding to each detection node, the process includes: Analyze the information representing security risks in the sub-detection results corresponding to each detection node; Based on information indicating security risks, identify risky traffic from the access traffic to be detected. Adjust the risky traffic in the access traffic to be detected to obtain the target access traffic.

7. The method according to claim 1, characterized in that, The method for determining the target detection method for the access traffic to be detected includes: Determine the attribute information of the access traffic to be detected; the attribute information includes at least one of the following: tenant information, access service type, or risk level of the access traffic to be detected. The detection method corresponding to the attribute information in the preset mapping relationship is determined to obtain the target detection method. The preset mapping relationship is the mapping relationship between the attribute information and the detection method.

8. The method according to claim 7, characterized in that, Before determining the target detection method corresponding to the attribute information based on the preset mapping relationship between the attribute information and the detection method, the method further includes: Obtain historical attribute information, historical detection methods, and historical detection results of historical access traffic within a preset historical time period; Using a preset analysis model, the historical attribute information, historical detection methods, and historical detection results are analyzed to determine the preset mapping relationship.

9. A safety detection device, characterized in that, The device includes: The traffic access module is used to determine the target detection method that matches the access traffic to be detected in response to acquiring the access traffic to be detected. A parallel detection module is used to concurrently call the detection modules corresponding to each of the target detection nodes to detect the access traffic to be detected if the target detection method corresponds to multiple target detection nodes; wherein, the physical resources corresponding to each target detection node are isolated from each other; The result generation module is used to generate target detection results based on the detection results corresponding to each detection node after obtaining the detection results of each detection node.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory, wherein the processor, when executing the computer program, implements the method of any one of claims 1 to 8.

11. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images