A real-time unified threat detection response method, system, device and medium based on VPP

Abstract

The application discloses a real-time unified threat detection response method and system based on VPP, equipment and medium, mainly relates to the technical field of threat detection response, to solve the problem that the existing scheme has large performance overhead, cannot block threats in real time, and cannot fuse multiple detection engines. Including: adding firewalld node, APP node, security node; establishing a mapping table of rules between the rule feature library and the multi-mode matching database; the firewalld node obtains the session structure corresponding to the message; the message is transmitted to the APP node as message information, and the application protocol type is added to the session structure; the security node uses the threat detection engine corresponding to the rule in the multi-mode matching database to detect the threat of the protocol analysis content, obtains the execution action; the protocol analysis content and the execution action are stored in the session structure corresponding to the message.

Description

Technical Field

[0001] This application relates to the field of threat detection and response technology, and in particular to a real-time unified threat detection and response method, system, device and medium based on VPP. Background Technology

[0002] VPP (Vector Packet Processing) systems are primarily used for general forwarding, network acceleration, or virtual switching scenarios. Their built-in security features are relatively weak, lacking support for advanced security functions such as detection of complex attack behaviors, abnormal traffic analysis, and threat profiling. Furthermore, traditional network security products are mostly based on kernel-mode drivers, image streams, or chain-based deployments, resulting in issues such as high detection latency, poor deployment flexibility, and processing performance bottlenecks.

[0003] Existing solutions to address the above issues mainly include: 1. The Linux kernel netfilter framework and threat detection plugins, which add multiple threat detection plugins to the netfilter framework to implement security detection functions; 2. VPP and Snort / Suricata plugins, which use Snort or Suricata plugins to copy packets to the Snort / Suricata detection engine for intrusion threat detection. This is a bypass-based threat detection method and cannot block threat traffic in real time; 3. VPP and multiple threat detection engines, similar to traditional Unified Threat Management (UTM), where each security function is independent and executed serially.

[0004] However, the rule checks in Scheme 1 are usually matched one by one, and the processing path traverses the kernel space, so the efficiency is limited by the cost of system calls and context switching; Scheme 2 involves packet copying, which has a large performance overhead, and it can generally only detect threats in a bypass manner and cannot block threats in real time, and it cannot integrate multiple detection engines; Scheme 3 also has the disadvantage of not being able to block threats in real time. Summary of the Invention

[0005] This application provides a real-time unified threat detection and response method, system, device, and medium based on VPP to solve the problems of existing solutions having high performance overhead, inability to block threats in real time, and inability to integrate multiple detection engines.

[0006] Firstly, this application provides a real-time unified threat detection and response method based on VPP, the method comprising: Within the VPP forwarding framework, add firewalld, APP, and security nodes; load the rule feature library of the threat detection engine, classify the rules in the rule feature library according to the application protocol, obtain application protocol rule groups, and compile the new rule groups into a multi-model matching database; establish a mapping table between the rule feature library and the multi-model matching database; when the firewalld node receives a packet, obtain the session structure corresponding to the packet; transmit the packet as packet information to the APP node, determine the application protocol type of the packet based on the application layer characteristics of the packet; read the session structure, add the application protocol type to the session structure, and transmit the packet to the security node; the security node reads the application protocol type from the corresponding session structure; extract the protocol parsing content in the packet according to the application protocol type; the protocol parsing content includes at least: basic protocol information and application layer protocol information; determine the corresponding multi-model matching database according to the application protocol type; based on the mapping table, use the threat detection engine corresponding to the rules in the multi-model matching database to perform threat detection on the protocol parsing content and obtain the execution action; store the protocol parsing content and execution action in the session structure corresponding to the packet.

[0007] In one implementation of this application, the node types of firewalld, APP, and security nodes are all VLIB_NODE_TYPE_INTERNAL; Furthermore, the ip4-input node of the VPP forwarding framework is connected to the firewalld node, the firewalld node is connected to the APP node, the APP node is connected to the ip4-lookup node of the VPP forwarding framework, the ip4-lookup node is connected to the security node, and the security node is connected to the ip4-rewrite node of the VPP forwarding framework.

[0008] In one implementation of this application, rules in the rule feature library are classified according to the application protocol to obtain an application protocol rule group, specifically including: The rules in the rule feature library are classified according to the application protocol to obtain the initial application protocol rule group; Obtain the dimensions of the application protocol; When the dimension is 1, the initial application protocol rule group is determined as the application protocol rule group; When the dimension is not 1, the initial application protocol rule group is divided according to the dimension of the application protocol, and the initial application protocol rule group is divided into an application protocol rule group consisting of several dimension rule groups.

[0009] In one implementation of this application, when the firewalld node receives a message, it obtains the session structure corresponding to the message, specifically including: When the firewalld node receives a message, it queries the session table based on the message's 5-tuple. When the session corresponding to the message 5-tuple is found, the session structure corresponding to the session is obtained; If no corresponding session exists, create a new session structure and insert it into the session table.

[0010] In one implementation of this application, the protocol parsing content in the message is extracted according to the application protocol type, specifically including: Determine the corresponding preset extraction program based on the application protocol type; The protocol parsing content is extracted from the message using a preset extraction program.

[0011] In one implementation of this application, based on a mapping table, a threat detection engine corresponding to rules in a multi-modal matching database is used to perform threat detection on the protocol parsing content to obtain the execution action, specifically including: Based on the mapping table, the threat detection engine corresponding to each rule in the current multi-mode matching database is determined. Then, the threat detection engine is used to perform threat detection on the protocol parsing content to obtain the execution action.

[0012] In one implementation of this application, after reading the session structure and adding the application protocol type to the session structure, the method further includes: When the APP node receives a message, it determines whether there is an application protocol type in the session structure of the session corresponding to the message; if there is an application protocol type, the message is directly sent to the security node. After storing the protocol parsing content and execution actions into the session structure corresponding to the message, the method also includes: When a security node receives a message, it determines whether the session structure corresponding to the message contains protocol parsing content and execution actions; if protocol parsing content and execution actions exist, it directly executes the execution actions.

[0013] Secondly, this application provides a real-time unified threat detection and response system based on VPP, the system comprising: Add a module to add firewalld, APP, and security nodes within the VPP forwarding framework; The compilation module is used to load the rule feature library of the threat detection engine, classify the rules in the rule feature library according to the application protocol, obtain the application protocol rule group, compile the new rule group into a multi-model matching database, and establish a mapping table of rules between the rule feature library and the multi-model matching database. The firewalld node is used to obtain the session structure corresponding to the received packet and transmit the packet as packet information to the APP node. The APP node is used to determine the application protocol type of a message based on its application layer characteristics; it reads the session structure, adds the application protocol type to the session structure, and transmits the message to the security node. The security node is used to read the application protocol type from the corresponding session structure; extract the protocol parsing content from the message according to the application protocol type; the protocol parsing content includes at least: basic protocol information and application layer protocol information; determine the corresponding multi-mode matching database according to the application protocol type; perform threat detection on the protocol parsing content based on the mapping table and the threat detection engine corresponding to the rules in the multi-mode matching database to obtain the execution action; and store the protocol parsing content and execution action into the session structure corresponding to the message.

[0014] Thirdly, this application provides a real-time unified threat detection and response device based on VPP, the device comprising: processor; And a memory containing executable code, which, when executed, causes the processor to execute a VPP-based real-time unified threat detection and response method as described above.

[0015] Fourthly, this application provides a non-volatile computer storage medium storing computer instructions thereon, which, when executed, implement a VPP-based real-time unified threat detection and response method as described above.

[0016] As can be seen from the above technical solutions, this application has the following advantages: I. Reduced system performance overhead: By integrating three dedicated nodes—firewalld, APP, and security—within the VPP forwarding framework, closed-loop processing of the user-space protocol stack is achieved. Compared to the traditional scheme 1's rule-by-rule matching and kernel-space traversal, this scheme transforms linear matching into efficient multi-mode matching by pre-compiling rule groups in a multi-mode matching database; simultaneously, it avoids the packet duplication overhead of scheme 2, directly transmitting metadata through the session structure. This design eliminates system call and context switching costs, enabling the threat detection process to be completed entirely in the user-space high-speed forwarding plane, reducing CPU and memory resource consumption at the architectural level.

[0017] II. Real-time threat blocking was achieved: By deeply coupling the security node with the forwarding path, detection results (actions) can be fed back to the session structure in real time. Compared to the bypass detection mode of solutions 2 and 3, this solution directly embeds the security decision-making mechanism into the packet processing pipeline: when a threat is detected, the VPP forwarding behavior (such as dropping / redirecting) can be controlled by modifying the session structure, without the need to establish an additional blocking channel. This integrated "detection-response" design breaks through the latency bottleneck of the separation of detection and handling in traditional solutions, and realizes real-time threat blocking capabilities.

[0018] III. Support for multi-engine dynamic fusion detection: By employing a mapping table mechanism between a rule feature library and a multi-model matching database, rules from different detection engines can be dynamically scheduled according to application protocol types. For different protocols such as HTTP / DNS, the security node can automatically select the corresponding protocol rule group and associated engine (such as WAF, IDS, malicious domain detection, etc.), overcoming the limitations of single-engine detection in traditional Solution 3. Through the protocol type-driven rule matching mode, the independence of detection logic is maintained while multi-engine collaborative analysis is achieved, improving the detection rate of complex threats. Attached Figure Description

[0019] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of a real-time unified threat detection and response method based on VPP provided in an embodiment of this application.

[0021] Figure 2 This is a schematic diagram of a VPP forwarding framework structure provided in an embodiment of this application.

[0022] Figure 3 This is a schematic diagram of the internal structure of a real-time unified threat detection and response system based on VPP provided in an embodiment of this application.

[0023] Figure 4 This is a schematic diagram of the internal structure of a real-time unified threat detection and response device based on VPP, provided in an embodiment of this application. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.

[0026] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0027] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0028] The embodiment provides a real-time unified threat detection and response method based on VPP, such as Figure 1 As shown in the embodiments of this application, the method mainly includes the following steps: Step 110: Add firewalld node, APP node, and security node to the VPP forwarding framework.

[0029] In some embodiments, the node type of firewalld node, APP node, and security node is VLIB_NODE_TYPE_INTERNAL. Furthermore, the ip4-input node of the VPP forwarding framework is connected to the firewalld node, the firewalld node is connected to the APP node, the APP node is connected to the ip4-lookup node of the VPP forwarding framework, the ip4-lookup node is connected to the security node, and the security node is connected to the ip4-rewrite node of the VPP forwarding framework.

[0030] To further supplement, such as Figure 2 As shown, the VPP forwarding framework includes: the dpdk-input node is the VPP packet receiving plugin, the ethernet-input node is the Layer 2 protocol processing node, the ip4-input node is the Layer 3 protocol processing node, the firewalld node is the session management node, the APP node is the protocol identification node, the ip4-lookup node is the route lookup node, the security node is the security engine node, and the interface-output node is the packet sending node (the dashed lines represent the three newly added nodes: firewalld node, APP node, and security node).

[0031] Step 120: Load the rule feature library of the threat detection engine, classify the rules in the rule feature library according to the application protocol, obtain the application protocol rule group, compile the new rule group into a multi-model matching database, and establish a mapping table of rules between the rule feature library and the multi-model matching database.

[0032] Specifically, the rules in the rule feature library are classified according to the application protocol to obtain the application protocol rule group, which includes: The rules in the rule feature library are classified according to the application protocol to obtain the initial application protocol rule group; the dimensions of the application protocol are obtained; when the dimension is 1, the initial application protocol rule group is determined as the application protocol rule group; when the dimension is not 1, the initial application protocol rule group is divided according to the dimensions of the application protocol, and the initial application protocol rule group is divided into an application protocol rule group composed of several dimension rule groups.

[0033] It should be noted that the rule feature libraries of each threat detection engine are loaded. These threat detection engines include intrusion prevention, malware protection, IP blacklists, domain blacklists, email filtering, threat intelligence, etc. The rule library of each threat detection engine consists of strings or regular expressions.

[0034] Specifically, the rule feature libraries of each threat detection module are classified according to application protocols, and then new rule groups are formed according to each protocol.

[0035] For example, HTTP rules from the intrusion prevention signature database, HTTP rules from the domain blacklist, and HTTP rules from the threat intelligence signature database can be combined into a new rule group. Each rule ID is labeled to indicate that it belongs to the rule ID in the original signature database. A mapping table of signature database rule IDs is established, and then the Hyperscan multi-model matching engine is used to compile the new rule group into a multi-model matching database.

[0036] For the DNS protocol, the domain-related rules from intrusion prevention, domain blacklists, and threat intelligence are merged into a new rule group, and a corresponding rule mapping table and multi-mode matching database are established. Similarly, the IP-related rules from the IP blacklist and threat intelligence are merged into an IP-related rule group, and a corresponding rule mapping table and multi-mode matching database are established.

[0037] For the FTP protocol, the rule information from malicious code detection, file filtering, and threat intelligence is grouped into a new set of rules according to different dimensions (including file name, file type, file size, and file digest value), and a corresponding rule mapping table and multi-mode matching database are established.

[0038] Similarly, the threat detection modules are regrouped according to the application protocol category, a mapping table between the old and new rule groups is established, and the new rule groups are compiled into a multi-mode matching database for use in subsequent stages of message protocol content matching.

[0039] Step 130: When the firewalld node receives a message, it obtains the session structure corresponding to the message; transmits the message as message information to the APP node, determines the application protocol type of the message based on the application layer characteristics of the message; reads the session structure, adds the application protocol type to the session structure, and transmits the message to the security node.

[0040] When a firewalld node receives a message, it retrieves the corresponding session structure, which includes: When a firewalld node receives a packet, it queries the session table based on the packet's 5-tuple. If a session corresponding to the packet's 5-tuple is found, the session structure corresponding to the session is obtained. If no corresponding session exists, a new session structure is created and inserted into the session table.

[0041] More specifically, in the VPP forwarding framework, the dpdk-input node is responsible for receiving packets from the network interface card (NIC), which then pass through the ethernet-input node, ip4-input-no-checksum, and ip4-sv-reassembly-feature, before reaching the firewalld node. At the firewalld node, the session table is queried based on the packet's 5-tuple. If the session is found, the session structure is obtained; otherwise, a new session structure is created and inserted into the session table. Subsequent packets with the same 5-tuple belong to this session, and the packets are then forwarded to subsequent VPP nodes.

[0042] Those skilled in the art will understand that the session structure here is the basic data structure for the subsequent application classification stage, the security service detection stage, and the threat response stage of the message. The application identification results of the APP node and the results of the protocol parsing and security detection services of the security node will be stored in this data structure for direct use by subsequent messages of the session, thereby accelerating the message processing flow. For example, before application classification, the APP node will first check whether the session has completed application classification. If it has been classified, it will return directly without continuing the classification. Similarly, if the message of the session has been matched and blocked by the security node, the subsequent message of the session will query the action in the session structure after arriving at the security node and directly execute the discard action without further threat detection.

[0043] The message is classified by application at the APP node. Based on the application layer characteristics of the message, it is matched and classified into protocol types such as HTTP, DNS, FTP, SMTP, POP3, etc.

[0044] Step 140: The security node reads the application protocol type from the corresponding session structure; extracts the protocol parsing content from the packet according to the application protocol type; determines the corresponding multi-mode matching database according to the application protocol type; performs threat detection on the protocol parsing content based on the mapping table and the threat detection engine corresponding to the rules in the multi-mode matching database to obtain the execution action; and stores the protocol parsing content and execution action into the session structure corresponding to the packet.

[0045] The protocol parsing content includes at least: basic protocol information and application layer protocol information.

[0046] In some embodiments, the protocol parsing content in the message is extracted according to the application protocol type, specifically including: Based on the application protocol type, determine the corresponding preset extraction program; use the preset extraction program to extract the protocol parsing content from the message.

[0047] Specifically, based on the mapping table, a threat detection engine corresponding to the rules in the multi-modal matching database is used to perform threat detection on the protocol parsing content and obtain the execution actions, including: Based on the mapping table, the threat detection engine corresponding to each rule in the current multi-mode matching database is determined. Then, the threat detection engine is used to perform threat detection on the protocol parsing content to obtain the execution action.

[0048] After reading the session structure and adding the application protocol type to the session structure, the method also includes: When the APP node receives a message, it determines whether there is an application protocol type in the session structure of the session corresponding to the message; if there is an application protocol type, the message is directly sent to the security node. After storing the protocol parsing content and execution actions into the session structure corresponding to the message, the method also includes: When a security node receives a message, it determines whether the session structure corresponding to the message contains protocol parsing content and execution actions; if protocol parsing content and execution actions exist, it directly executes the execution actions.

[0049] It should be further explained that when a message arrives at the security node, the protocol parsing and content extraction begin based on the application protocol type of the message. This is mainly divided into two parts: one part is the basic protocol information of the traditional link layer, network layer, and transport layer, and the other part is the application layer protocol information.

[0050] For example, for the HTTP protocol, it is necessary to parse out each field in the HTTP header and the body; for the DNS message, it is necessary to parse out the DNS request domain name and the list of returned IP addresses; and for the FTP protocol, it is necessary to parse out the file name, file type, file size and file sample of the transmitted file.

[0051] Next, security business detection is performed based on the protocol type and protocol parsing content of the message. If it is an HTTP message, the HTTP parsing content is matched against the HTTP multi-model database. This rule group integrates HTTP rules from multiple threat detection engines (intrusion prevention rules, domain blacklists, threat intelligence, etc.). Because it is a multi-model matching algorithm, it only needs to match once to complete the matching of all rules. Then, these matching results are mapped based on the mapping table formed in the preprocessing stage to obtain the rule ID in the original detection engine. If the message is a DNS protocol message, the domain name information is extracted from the DNS message, and the domain name information is matched with the domain name matching database in a multi-mode matching process. The matching result is obtained in one match and mapped to the rule ID in the original detection engine. Alternatively, IP information can be extracted from the DNS response message, and the IP information is matched with the IP matching database in a multi-mode matching process. The matching result is obtained in one match and mapped to the rule ID in the original detection engine to obtain the final detection result.

[0052] If the message is a file transfer protocol such as FTP, since there are multiple dimensions, it is necessary to extract the file class dimension from the message, such as file name, file type, file size and file sample. Then, match the feature library rule groups of each dimension. These feature library rule groups are composed of file class rules from engines such as malicious code, threat engine, and file filtering. After obtaining the matching result, it is mapped to the rule ID in the original detection engine according to the rule mapping table to obtain the final detection result.

[0053] It should be noted that there is a possibility that a single matching object may match multiple threat detection rules. For example, the HTTP protocol may match both intrusion prevention rules and threat intelligence rules, resulting in a single set of detection results.

[0054] Based on the parsed message protocol content, after multi-mode matching and rule mapping, the rules and actions of each detection engine are obtained, and then the actions are executed. Since there may be multiple detection results, as long as one detection result contains the discard action, the message is discarded and the traffic is blocked. At the same time, if there are log records, message forensics, alarms, etc., they are executed one by one, and finally the threat response processing is completed.

[0055] In addition, this application Figure 3 This application provides a real-time unified threat detection and response system based on VPP. For example... Figure 3 As shown in the embodiments of this application, the system mainly includes: Add module 210 to add firewalld node 230, APP node 240, and security node 250 within the VPP forwarding framework; The compilation module 220 is used to load the rule feature library of the threat detection engine, classify the rules in the rule feature library according to the application protocol, obtain the application protocol rule group, compile the new rule group into a multi-model matching database, and establish a mapping table of rules between the rule feature library and the multi-model matching database. firewalld node 230 is used to obtain the session structure corresponding to the received packet and transmit the packet as packet information to APP node 240. APP node 240 is used to determine the application protocol type of the message based on the application layer characteristics of the message; read the session structure, add the application protocol type to the session structure, and transmit the message to security node 250; Security node 250 is used to read the application protocol type from the corresponding session structure; extract the protocol parsing content from the message according to the application protocol type; the protocol parsing content includes at least: basic protocol information and application layer protocol information; determine the corresponding multi-mode matching database according to the application protocol type; perform threat detection on the protocol parsing content based on the mapping table and the threat detection engine corresponding to the rules in the multi-mode matching database to obtain the execution action; and store the protocol parsing content and execution action into the session structure corresponding to the message.

[0056] The above are method embodiments of this application. Based on the same inventive concept, embodiments of this application also provide a real-time unified threat detection and response device based on VPP. Figure 4As shown, the device includes: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a VPP-based real-time unified threat detection and response method as described in the above embodiments.

[0057] Specifically, the server adds firewalld, APP, and security nodes within the VPP forwarding framework; loads the rule feature library of the threat detection engine, classifies the rules in the rule feature library according to the application protocol, obtains application protocol rule groups, and compiles the new rule groups into a multi-mode matching database; establishes a mapping table between the rule feature library and the multi-mode matching database; when the firewalld node receives a packet, it obtains the session structure corresponding to the packet; transmits the packet as packet information to the APP node, determines the application protocol type of the packet based on the application layer characteristics of the packet; reads the session structure, adds the application protocol type to the session structure, and transmits the packet to the security node; the security node reads the application protocol type from the corresponding session structure; extracts the protocol parsing content in the packet according to the application protocol type; the protocol parsing content includes at least: basic protocol information and application layer protocol information; determines the corresponding multi-mode matching database according to the application protocol type; based on the mapping table, uses the threat detection engine corresponding to the rules in the multi-mode matching database to perform threat detection on the protocol parsing content and obtain the execution action; and stores the protocol parsing content and the execution action in the session structure corresponding to the packet.

[0058] In addition, embodiments of this application also provide a non-volatile computer storage medium storing executable instructions, which, when executed, implement the VPP-based real-time unified threat detection and response method described above.

[0059] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A real-time unified threat detection and response method based on VPP, characterized in that, The method includes: Add firewalld, APP, and security nodes to the VPP forwarding framework; the node type of firewalld, APP, and security nodes is VLIB_NODE_TYPE_INTERNAL. Furthermore, the ip4-input node of the VPP forwarding framework is connected to the firewalld node, the firewalld node is connected to the APP node, the APP node is connected to the ip4-lookup node of the VPP forwarding framework, the ip4-lookup node is connected to the security node, and the security node is connected to the ip4-rewrite node of the VPP forwarding framework. Load the rule feature library of the threat detection engine, classify the rules in the rule feature library according to the application protocol to obtain the application protocol rule group, compile the new rule group into a multi-model matching database, and establish a mapping table of rules between the rule feature library and the multi-model matching database; When the firewalld node receives a packet, it obtains the session structure corresponding to the packet; transmits the packet as packet information to the APP node, determines the application protocol type of the packet based on the application layer characteristics of the packet; reads the session structure, adds the application protocol type to the session structure, and transmits the packet to the security node; wherein, after reading the session structure and adding the application protocol type to the session structure, the method further includes: when the APP node receives the packet, determining whether there is an application protocol type in the session structure of the session corresponding to the packet; if there is an application protocol type, directly sending the packet to the security node; The security node reads the application protocol type from the corresponding session structure; based on the application protocol type, it extracts the protocol parsing content from the packet; the protocol parsing content includes at least: basic protocol information and application layer protocol information; based on the application protocol type, it determines the corresponding multi-mode matching database; based on the mapping table, it uses the threat detection engine corresponding to the rules in the multi-mode matching database to perform threat detection on the protocol parsing content and obtain the execution action; and it stores the protocol parsing content and the execution action into the session structure corresponding to the packet. After storing the protocol parsing content and execution action into the session structure corresponding to the message, the method further includes: when the security node obtains the message, determining whether the protocol parsing content and execution action exist in the session structure corresponding to the message; if the protocol parsing content and execution action exist, directly executing the execution action.

2. The real-time unified threat detection and response method based on VPP according to claim 1, characterized in that, The rules in the rule feature library are classified according to the application protocol to obtain the application protocol rule group, which specifically includes: The rules in the rule feature library are classified according to the application protocol to obtain the initial application protocol rule group; Obtain the dimensions of the application protocol; When the dimension is 1, the initial application protocol rule group is determined as the application protocol rule group; When the dimension is not 1, the initial application protocol rule group is divided according to the dimension of the application protocol, and the initial application protocol rule group is divided into an application protocol rule group consisting of several dimension rule groups.

3. The real-time unified threat detection and response method based on VPP according to claim 1, characterized in that, When the firewalld node receives a packet, it retrieves the corresponding session structure, which includes: When the firewalld node receives a message, it queries the session table based on the message's 5-tuple. When the session corresponding to the message 5-tuple is found, the session structure corresponding to the session is obtained; If no corresponding session exists, create a new session structure and insert it into the session table.

4. The real-time unified threat detection and response method based on VPP according to claim 1, characterized in that, Based on the application protocol type, extract the protocol parsing content from the message, specifically including: Determine the corresponding preset extraction program based on the application protocol type; The pre-defined extraction procedure is used to extract protocol parsing content from the message.

5. The real-time unified threat detection and response method based on VPP according to claim 1, characterized in that, Based on the mapping table, a threat detection engine corresponding to the rules in the multi-modal matching database is used to perform threat detection on the protocol parsing content and obtain the execution actions, specifically including: Based on the mapping table, the threat detection engine corresponding to each rule in the current multi-mode matching database is determined. Then, the threat detection engine is used to perform threat detection on the protocol parsing content to obtain the execution action.

6. A real-time unified threat detection and response system based on VPP, characterized in that, The system includes: Add a module to add firewalld nodes, APP nodes, and security nodes within the VPP forwarding framework; wherein the node type of firewalld nodes, APP nodes, and security nodes is VLIB_NODE_TYPE_INTERNAL. Furthermore, the ip4-input node of the VPP forwarding framework is connected to the firewalld node, the firewalld node is connected to the APP node, the APP node is connected to the ip4-lookup node of the VPP forwarding framework, the ip4-lookup node is connected to the security node, and the security node is connected to the ip4-rewrite node of the VPP forwarding framework. The compilation module is used to load the rule feature library of the threat detection engine, classify the rules in the rule feature library according to the application protocol, obtain the application protocol rule group, compile the new rule group into a multi-model matching database, and establish a mapping table of rules between the rule feature library and the multi-model matching database. The firewalld node is used to obtain the session structure corresponding to the received packet and transmit the packet as packet information to the APP node. The APP node is used to determine the application protocol type of a message based on its application layer characteristics; it reads the session structure, adds the application protocol type to the session structure, and transmits the message to the security node. The process includes, after reading the session structure and adding the application protocol type to the session structure, the following steps: when the APP node receives a message, determine whether there is an application protocol type in the session structure of the corresponding session; if there is an application protocol type, send the message directly to the security node. The security node is used to read the application protocol type from the corresponding session structure; extract the protocol parsing content from the packet according to the application protocol type; the protocol parsing content includes at least: basic protocol information and application layer protocol information; determine the corresponding multi-mode matching database according to the application protocol type; perform threat detection on the protocol parsing content based on the mapping table and the threat detection engine corresponding to the rules in the multi-mode matching database to obtain the execution action; store the protocol parsing content and execution action into the session structure corresponding to the packet; after storing the protocol parsing content and execution action into the session structure corresponding to the packet, the node also includes: when the security node obtains the packet, determining whether the protocol parsing content and execution action exist in the session structure of the corresponding session; if the protocol parsing content and execution action exist, directly executing the execution action.

7. A real-time unified threat detection and response device based on VPP, characterized in that, The device includes: processor; And a memory having executable code stored thereon, which, when executed, causes the processor to perform a VPP-based real-time unified threat detection and response method as described in any one of claims 1-5.

8. A non-volatile computer storage medium, characterized in that, It stores computer instructions, which, when executed, implement a VPP-based real-time unified threat detection and response method as described in any one of claims 1-5.

Images