Suricata rule similarity calculation method based on directed acyclic graph
By using a Suricata rule similarity calculation method based on directed acyclic graphs, the problems of insufficient semantic matching and difficulty in handling dependencies in existing technologies are solved. This improves the accuracy and efficiency of rule merging and deduplication processes, and adapts to rule set updates for different versions and scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-10
- Publication Date
- 2026-03-13
AI Technical Summary
Existing Suricata rule similarity calculation methods lack semantic matching and dependency handling, resulting in low accuracy and efficiency in the rule merging and deduplication process, making it difficult to meet the requirements of real-time or near real-time rule updates.
A rule set is constructed using a directed acyclic graph (DAG) approach. Dependencies are established using the keywords flowbits and flowint, node similarity is calculated, and nodes are filtered and replaced based on similarity thresholds to update dependencies and maintain the integrity and consistency of the rule file.
It improves the accuracy and efficiency of rule merging and deduplication processes, reduces missed detections and false alarms, and enhances the response speed and adaptability of the Suricata system.
Smart Images
Figure CN121664459A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of Suricata rules, specifically relating to a method for calculating the similarity of Suricata rules based on directed acyclic graphs. Background Technology
[0002] With the rapid development of internet technology, cybersecurity threats are becoming increasingly serious. Intrusion detection systems (IDS) and intrusion prevention systems (IPS), as crucial components of cybersecurity, identify and respond to potential security threats by analyzing network traffic and system logs. Suricata is an open-source, high-performance network security monitoring engine widely used in IDS, IPS, and network security monitoring scenarios. Its detection capabilities primarily rely on rule files, which define how to identify and respond to anomalous behavior within the network.
[0003] In Suricata rule management and maintenance, it is often necessary to obtain rule sets from different data sources and merge them. During this process, the verification and removal of duplicate rules is crucial. However, existing rule similarity calculation methods mostly employ simple text similarity metrics, which have the following limitations: Lack of semantic matching: Text similarity calculation mainly focuses on the surface similarity of rule strings, ignoring the semantic information behind the rules. This leads to the inaccurate identification of some rules that are semantically similar but have different textual expressions.
[0004] Inadequate handling of dependencies: Suricata rules may have complex dependencies, such as one rule depending on the variable assignment or judgment result of another rule. Existing similarity calculation methods cannot effectively handle these dependencies, leading to a decrease in the accuracy of rule matching.
[0005] Inefficient: Manual verification or simple text difference matching methods are inefficient when processing large-scale rule sets and cannot meet the requirements for real-time or near real-time rule updates. Summary of the Invention
[0006] To address the aforementioned issues, this invention provides a Suricata rule similarity calculation method based on a directed acyclic graph, which can solve the problems mentioned in the background section. The method includes the following steps: construction of a directed acyclic graph, similarity calculation, and rule file updating. The construction of the directed acyclic graph (DAG) begins by treating each rule in the Suricata rule set as a node in the DAG. Directed edges are then constructed based on the dependencies between the rules. Specifically, the determination of dependencies is based on keywords in the rules, such as flowbits and flowint. The `flowbits` keyword is used to assign values to variables, perform calculations, or make judgments. The `flowint` keyword is used to assign values to variables, perform calculations, or make judgments. For similarity calculation, after constructing a directed acyclic graph, a graph-based similarity calculation method is proposed. This method first calculates the similarity between any two nodes, and then filters and replaces nodes based on the similarity threshold. After completing similarity calculation and node replacement, the updated directed acyclic graph needs to be converted back to the rule file format. The specific steps are as follows: Preserve node rules: Write the rules corresponding to the preserved representative nodes into a new rule file; Update dependencies: Adjust the dependency variables and keywords in the rules based on the updated dependencies; Keep other content unchanged: Other content in the rule, such as message content, category type, SID, etc., remains unchanged.
[0007] Furthermore, examples of the flowbits and flowint keywords are as follows: Suppose we have the following two rules: Rule a: alert http $EXTERNAL_NET any -> $HOME_NET any msg:"SSLVPN"; ...flowbits:set,CVE_2024_53704; fast_pattern; classtype:web-application-attack;sid:1; rev:1; Rule b: alert http $HOME_NET any -> $EXTERNAL_NET any msg:"SSLVPNBypass Response"; flowbits:isset,CVE_2024_53704; ... classtype:web-application-attack; sid:2; rev:1; In this example, rule a performs a configuration set operation on the variable CVE_2024_53704, while rule b uses this variable for judgment (isset operation). Therefore, rule b depends on rule a. When constructing a directed acyclic graph, rule a and rule b correspond to node a and node b, respectively. Node a is a child node of node b, and a directed edge is constructed from a to b.
[0008] Furthermore, the similarity calculation includes node similarity calculation: Node similarity calculation takes into account the content of the node itself as well as the content of all its child nodes.
[0009] The specific formula is as follows: ; in: d(ci,cj) represents the distance between nodes ni and nj based on the content of a single node, which can be calculated using methods such as cosine similarity and Jaccard similarity. Si and Sj represent the sets of all child nodes of nodes ni and nj, respectively; Freq(sk,ci) represents the frequency of child node sk appearing in the content of node ni; α is a weighting coefficient used to balance the importance of single-node content similarity and child-node content similarity.
[0010] Furthermore, the similarity calculation includes filtering and replacement: Filter similar node pairs: Based on a preset similarity threshold x, such as 0.99, 0.98, 0.95, etc., filter out node pairs with a similarity greater than x.
[0011] Furthermore, the similarity calculation includes filtering and replacing duplicate nodes: for each pair of similar nodes, the node with the larger number is removed, and the node with the smaller number is retained as the representative. Update dependencies: If a removed node has dependent nodes, update the dependencies of these dependent nodes to point to the retained representative node.
[0012] Furthermore, the directed acyclic graph construction includes the flowbits keyword: used to assign values to variables, perform operations, or make judgments; Assignment operations include set, toggle, unset, etc., while conditional operations include isset, isnotset, etc. The `flowint` keyword is used to assign values to variables, perform calculations, or make judgments. Assignment operations include =, +, -, etc., while conditional operations include <, >, <=, >=, ==, !=, etc.
[0013] The Suricata rule similarity calculation method based on directed acyclic graphs, as provided in the technical solution of this invention, has the following significant advantages: Improving the accuracy of similarity calculation: By constructing a directed acyclic graph to model the dependencies between rules and performing similarity calculations based on this graph, this invention can more accurately identify rules that are semantically similar but have different textual expressions. This helps reduce missed detections and false positives, and improves the accuracy of rule merging and deduplication processes.
[0014] Enhanced dependency handling capabilities: This invention can effectively handle complex dependencies between rules, ensuring that the original dependency structure is not destroyed during rule merging and deduplication. This helps maintain the integrity and consistency of the rule set.
[0015] Improved processing efficiency: By automating the construction of directed acyclic graphs and calculating similarity, this invention significantly improves the efficiency of rule merging and deduplication processes. This helps meet the needs of real-time or near real-time rule updates and improves the response speed of intrusion detection systems.
[0016] Enhanced flexibility and scalability: The technical solution of this invention offers high flexibility and scalability, adapting to different versions of the Suricata rule set and various application scenarios. By adjusting parameters such as the similarity threshold and weight coefficients, the similarity calculation results can be further optimized. Attached Figure Description
[0017] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.
[0018] Figure 1 This is a schematic diagram of the first embodiment of a Suricata rule similarity calculation method based on a directed acyclic graph in this invention.
[0019] Figure 2 This is a schematic diagram of a second embodiment of a Suricata rule similarity calculation method based on a directed acyclic graph in this invention.
[0020] Figure 3 This is a schematic diagram of the overall process of a Suricata rule similarity calculation method based on a directed acyclic graph in an embodiment of the present invention. Detailed Implementation
[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.
[0022] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.
[0023] A method for calculating Suricata rule similarity based on directed acyclic graphs, such as... Figure 1 As shown, the process includes the following steps: construction of a directed acyclic graph, similarity calculation, and rule file updating; The construction of the directed acyclic graph (DAG) begins by treating each rule in the Suricata rule set as a node in the DAG. Directed edges are then constructed based on the dependencies between the rules. Specifically, the determination of dependencies is based on keywords in the rules, such as flowbits and flowint. The `flowbits` keyword is used to assign values to variables, perform calculations, or make judgments. The `flowint` keyword is used to assign values to variables, perform calculations, or make judgments. For similarity calculation, after constructing a directed acyclic graph, a graph-based similarity calculation method is proposed. This method first calculates the similarity between any two nodes, and then filters and replaces nodes based on the similarity threshold. After completing similarity calculation and node replacement, the updated directed acyclic graph needs to be converted back to the rule file format. The specific steps are as follows: Preserve node rules: Write the rules corresponding to the preserved representative nodes into a new rule file; Update dependencies: Adjust the dependency variables and keywords in the rules based on the updated dependencies; Keep other content unchanged: Other content in the rule, such as message content, category type, SID, etc., remains unchanged.
[0024] Specifically, this invention models the dependencies between rules by constructing a directed acyclic graph (DAG) and calculates similarity based on this graph. This allows for more accurate identification of rules that are semantically similar but have different textual expressions. This helps reduce missed detections and false positives, and improves the accuracy of rule merging and deduplication processes.
[0025] In this embodiment, examples of the flowbits and flowint keywords are as follows: Suppose we have the following two rules: Rule a: alert http $EXTERNAL_NET any -> $HOME_NET any msg:"SSLVPN"; ...flowbits:set,CVE_2024_53704; fast_pattern; classtype:web-application-attack;sid:1; rev:1; Rule b: alert http $HOME_NET any -> $EXTERNAL_NET any msg:"SSLVPNBypass Response"; flowbits:isset,CVE_2024_53704; ... classtype:web-application-attack; sid:2; rev:1; In this example, rule a performs a configuration set operation on the variable CVE_2024_53704, while rule b uses this variable for judgment (isset operation). Therefore, rule b depends on rule a. When constructing a directed acyclic graph, rule a and rule b correspond to node a and node b, respectively. Node a is a child node of node b, and a directed edge is constructed from a to b.
[0026] Specifically, this invention effectively handles complex dependencies between rules, ensuring that the original dependency structure is not disrupted during rule merging and deduplication. This helps maintain the integrity and consistency of the rule set.
[0027] In this embodiment, the similarity calculation includes node similarity calculation: Node similarity calculation takes into account the content of the node itself as well as the content of all its child nodes.
[0028] The specific formula is as follows: ; in: d(ci,cj) represents the distance between nodes ni and nj based on the content of a single node, which can be calculated using methods such as cosine similarity and Jaccard similarity. Si and Sj represent the sets of all child nodes of nodes ni and nj, respectively; Freq(sk,ci) represents the frequency of child node sk appearing in the content of node ni; α is a weighting coefficient used to balance the importance of single-node content similarity and child-node content similarity.
[0029] Specifically, by automating the construction of directed acyclic graphs and calculating similarity, this invention can significantly improve the efficiency of rule merging and deduplication processes. This helps meet the needs of real-time or near real-time rule updates and improves the response speed of intrusion detection systems.
[0030] In this embodiment, the similarity calculation includes filtering and replacement: Filter similar node pairs: Based on a preset similarity threshold x, such as 0.99, 0.98, 0.95, etc., filter out node pairs with a similarity greater than x.
[0031] Specifically, the technical solution of this invention has high flexibility and scalability, and can adapt to different versions of the Suricata rule set and different application scenarios. By adjusting parameters such as the similarity threshold and weight coefficient, the similarity calculation results can be further optimized.
[0032] In this embodiment, the similarity calculation includes filtering and replacing duplicate nodes: for each pair of similar nodes, the node with the larger number is removed, and the node with the smaller number is retained as the representative; Update dependencies: If a removed node has dependent nodes, update the dependencies of these dependent nodes to point to the retained representative node.
[0033] Specifically, the dependencies between rules are modeled by constructing a directed acyclic graph, and similarity is calculated based on this graph, thereby improving the accuracy and efficiency of the rule merging and deduplication process.
[0034] In this embodiment, the directed acyclic graph construction includes the flowbits keyword: used to assign values to variables, perform calculations, or make judgments; Assignment operations include set, toggle, unset, etc., while conditional operations include isset, isnotset, etc. The `flowint` keyword is used to assign values to variables, perform calculations, or make judgments. Assignment operations include =, +, -, etc., while conditional operations include <, >, <=, >=, ==, !=, etc.
[0035] Specifically, this method aims to improve the accuracy and efficiency of rule merging and deduplication processes in Suricata Intrusion Detection System (IDS) and Intrusion Prevention System (IPS), and to solve problems such as insufficient semantic matching and difficulty in handling dependencies in existing rule similarity calculations.
[0036] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.
Claims
1. A method for calculating Suricata rule similarity based on directed acyclic graphs, characterized in that, The Suricata rule similarity calculation method based on directed acyclic graphs includes the following steps: construction of directed acyclic graphs, similarity calculation, and rule file updating; The construction of the directed acyclic graph (DAG) begins by treating each rule in the Suricata rule set as a node in the DAG. Directed edges are then constructed based on the dependencies between the rules. Specifically, the determination of dependencies is based on keywords in the rules, such as flowbits and flowint. The `flowbits` keyword is used to assign values to variables, perform calculations, or make judgments. The `flowint` keyword is used to assign values to variables, perform calculations, or make judgments. For similarity calculation, after constructing a directed acyclic graph, a graph-based similarity calculation method is proposed. This method first calculates the similarity between any two nodes, and then filters and replaces nodes based on the similarity threshold. After completing similarity calculation and node replacement, the updated directed acyclic graph needs to be converted back to the rule file format. The specific steps are as follows: Preserve node rules: Write the rules corresponding to the preserved representative nodes into a new rule file; Update dependencies: Adjust the dependency variables and keywords in the rules based on the updated dependencies; Keep other content unchanged: Other content in the rule, such as message content, category type, SID, etc., remains unchanged.
2. The method for calculating Suricata rule similarity based on directed acyclic graphs according to claim 1, characterized in that, Examples of the flowbits and flowint keywords are as follows: Suppose we have the following two rules: Rule a: alert http$EXTERNAL_NET any->$HOME_NET any msg:"SSLVPN";...flowbits:set,CVE_2024_53704;fast_pattern;classtype:web-application-attack;sid:1;rev:1; Rule b: alert http$HOME_NET any->$EXTERNAL_NET any msg:"SSLVPN BypassResponse"; flowbits:isset,CVE_2024_53704;...classtype:web-application-attack;sid:2;rev:1; In this example, rule a performs a configuration set operation on the variable CVE_2024_53704, while rule b uses this variable for judgment (isset operation). Therefore, rule b depends on rule a. When constructing a directed acyclic graph, rule a and rule b correspond to node a and node b, respectively. Node a is a child node of node b, and a directed edge is constructed from a to b.
3. The method for calculating Suricata rule similarity based on directed acyclic graphs according to claim 1, characterized in that, The similarity calculation includes node similarity calculation: Node similarity calculation takes into account the content of the node itself as well as the content of all its child nodes. The specific formula is as follows: in: d(ci,cj) represents the distance between nodes ni and nj based on the content of a single node, which can be calculated using methods such as cosine similarity and Jaccard similarity. Si and Sj represent the sets of all child nodes of nodes ni and nj, respectively; Freq(sk,ci) represents the frequency of child node sk appearing in the content of node ni; α is a weighting coefficient used to balance the importance of single-node content similarity and child-node content similarity.
4. The method for calculating Suricata rule similarity based on directed acyclic graphs according to claim 1, characterized in that, The similarity calculation includes filtering and replacement: Filter similar node pairs: Based on a preset similarity threshold x, such as 0.99, 0.98, 0.95, etc., filter out node pairs with a similarity greater than x.
5. The method for calculating Suricata rule similarity based on directed acyclic graphs according to claim 1, characterized in that, The similarity calculation includes filtering and replacing duplicate nodes: for each pair of similar nodes, the node with the larger number is removed, and the node with the smaller number is retained as the representative. Update dependencies: If a removed node has dependent nodes, update the dependencies of these dependent nodes to point to the retained representative node.
6. The method for calculating Suricata rule similarity based on directed acyclic graphs according to claim 1, characterized in that, The directed acyclic graph construction includes the flowbits keyword, which is used to assign values to variables, perform operations, or make judgments. Assignment operations include set, toggle, unset, etc., while conditional operations include isset, isnotset, etc. The `flowint` keyword is used to assign values to variables, perform calculations, or make judgments. Assignment operations include =, +, -, etc., while conditional operations include <, >, <=, >=, ==, !=, etc.