A detection rule verification method, electronic equipment, storage medium and program product

Abstract

An embodiment of the application provides a detection rule verification method, an electronic device, a storage medium and a program product. The method comprises the following steps: obtaining a test data packet; determining target test data corresponding to a test field in the test data packet according to the pre-set test field; determining a detection rule corresponding to the preset field according to the target test data corresponding to the test field and a test condition corresponding to the test field; and verifying the detection rule corresponding to the test field according to the target test data corresponding to the test field. The automatic verification of the detection condition is realized, manual strategy addition and verification are not required, manual consumption can be reduced, and the verification efficiency of the detection condition can be improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a verification method for detection rules, an electronic device, a storage medium, and a program product. Background Technology

[0002] With the continuous development of network technology, the security requirements for various network devices are becoming increasingly stringent. This necessitates testing the security performance of products before they leave the factory. Currently, testing terminals have various pre-set detection rules. After capturing data packets, these rules are used to verify them. If multiple rules need verification, different rules must be manually pre-set, and the captured data packets are then verified. The results determine whether the rules meet the requirements. This process is not only labor-intensive but also inefficient. Summary of the Invention

[0003] The purpose of some embodiments of this application is to provide a method, electronic device, storage medium, and program product for verifying detection rules. Through the technical solutions of the embodiments of this application, a test data packet is acquired; target test data corresponding to the test field in the test data packet is determined according to a pre-set test field; a detection rule corresponding to the test field is determined according to the target test data and the test conditions corresponding to the test field, wherein the test conditions include comparison conditions, inclusion conditions, or regular expression conditions, and the detection rule is a rule for detecting different preset fields of the test data packet; the detection rule corresponding to the test field is verified according to the target test data. In the embodiments of this application, by pre-setting test fields and corresponding test conditions, target test data corresponding to preset fields of known test data packets is acquired; detection rules are generated according to the target test data and test conditions; and then each generated detection rule is verified according to the target test data of the known test data packet. This achieves automatic verification of detection conditions without the need for manual strategy addition and verification, which not only reduces manual labor but also improves the verification efficiency of detection conditions.

[0004] Firstly, some embodiments of this application provide a method for verifying detection rules, including: Obtain the test data packet; Based on the pre-set test fields, determine the target test data in the test data packet that corresponds to the test fields; Based on the target test data corresponding to the test field and the test conditions corresponding to the test field, the detection rules corresponding to the test field are determined. The test conditions include comparison conditions, inclusion conditions, or regular expression conditions. The detection rules are rules for detecting different preset fields of the test data packet. The detection rules corresponding to the test fields are verified based on the target test data corresponding to the test fields.

[0005] Some embodiments of this application obtain target test data corresponding to the preset fields of a known test data packet by pre-setting test fields and corresponding test conditions, generate detection rules based on the target test data and test conditions, and then verify each generated detection rule based on the target test data of the known test data packet. This achieves automatic verification of detection conditions without the need for manual strategy addition and verification, which not only reduces manual labor but also improves the verification efficiency of detection conditions.

[0006] Optionally, the step of validating the detection rule corresponding to the test field based on the target test data corresponding to the test field includes: If the target test data corresponding to the test field matches the detection rule, the detection rule is determined to have passed the verification. If the target test data corresponding to the test field does not match the detection rule, it is determined that the detection rule has failed the verification.

[0007] Some embodiments of this application use target test data in a known test data package to verify the detection rules corresponding to the test fields, obtain verification results, and determine whether the expected results are achieved based on the verification results.

[0008] Optionally, the method further includes: If the detection rule passes verification, an alarm log is generated.

[0009] Some embodiments of this application use test data packets to verify the generated detection rules. If the two match, an alarm log is generated, and the verification status can be viewed through the alarm log.

[0010] Optionally, the method further includes: If the detection rule passes verification, the detection rule corresponding to the test field will be deleted.

[0011] Some embodiments of this application will remove detection rules through verification, thereby improving verification efficiency and reducing storage space.

[0012] Optionally, determining the target test data in the test data packet corresponding to the pre-set test field according to the pre-set test field includes: The test data packet is parsed to obtain the initial test data corresponding to the test field; Based on the preset adjustment range, the target test data corresponding to the initial test data is determined.

[0013] Some embodiments of this application adjust the initial test data according to a preset adjustment range to obtain target test data, and use a larger range to generate detection rules, thereby improving the verification accuracy of the detection rules.

[0014] Optionally, if the test field is the destination port and response code of a communication protocol, determining the detection rule corresponding to the test field based on the target test data and test conditions corresponding to the test field includes: The first value of the destination port and the comparison condition are combined respectively to obtain the first strategy condition corresponding to the destination port; The second value of the response code and the comparison condition are combined respectively to obtain the second strategy condition corresponding to the response code; Based on the first strategy condition and the second strategy condition, the detection rule corresponding to the test field is determined.

[0015] Some embodiments of this application set different comparison conditions according to testing requirements, which can generate a variety of different strategy conditions, improve the accuracy of detection rule verification, and generate corresponding strategy conditions by combining the target port and response code in the communication protocol with the corresponding comparison conditions. Based on the strategy conditions, corresponding detection rules are generated. In this way, the detection rules for one test field can be verified, and the detection rules for two test fields can be verified simultaneously, which improves the detection efficiency of the detection rules.

[0016] Optionally, if the test field is published content, determining the detection rule corresponding to the test field based on the target test data and test conditions corresponding to the test field includes: The character segment data of the published content and the inclusion condition or regular expression condition in the test conditions are combined to obtain the third strategy condition corresponding to the published content. Based on the third strategy condition, the detection rules corresponding to the published content are determined.

[0017] Some embodiments of this application combine the published content in the communication protocol with corresponding inclusion conditions or regular expression conditions to generate corresponding detection rules, automatically verify the detection rules, and improve the detection efficiency of the detection rules.

[0018] Secondly, some embodiments of this application provide a verification device for detection rules, including: The acquisition module is used to acquire test data packets; The determination module is used to determine the target test data in the test data packet that corresponds to the test field according to the pre-set test field; The combination module is used to determine the detection rule corresponding to the test field based on the target test data corresponding to the test field and the test conditions corresponding to the test field. The test conditions include comparison conditions, inclusion conditions or regular expression conditions, and the detection rule is a rule for detecting different preset fields of the test data packet. The verification module is used to verify the detection rule corresponding to the test field based on the target test data corresponding to the test field.

[0019] Some embodiments of this application obtain target test data corresponding to the preset fields of a known test data packet by pre-setting test fields and corresponding test conditions, generate detection rules based on the target test data and test conditions, and then verify each generated detection rule based on the target test data of the known test data packet. This achieves automatic verification of test conditions without the need for manual strategy addition and verification, which not only reduces manual labor but also improves the verification efficiency of test conditions.

[0020] Optionally, the verification module is used for: If the target test data corresponding to the test field matches the detection rule, the detection rule is determined to have passed the verification. If the target test data corresponding to the test field does not match the detection rule, it is determined that the detection rule has failed the verification.

[0021] Some embodiments of this application use target test data in a known test data package to verify the detection rules corresponding to the test fields, obtain verification results, and determine whether the expected results are achieved based on the verification results.

[0022] Optionally, the verification module is used for: If the detection rule passes verification, an alarm log is generated.

[0023] Some embodiments of this application use test data packets to verify the generated detection rules. If the two match, an alarm log is generated, and the verification status can be viewed through the alarm log.

[0024] Optionally, the verification module is used for: If the detection rule passes verification, the detection rule corresponding to the test field will be deleted.

[0025] Some embodiments of this application will remove detection rules through verification, thereby improving verification efficiency and reducing storage space.

[0026] Optionally, the determining module is configured to: The test data packet is parsed to obtain the initial test data corresponding to the test field; Based on the preset adjustment range, the target test data corresponding to the initial test data is determined.

[0027] Some embodiments of this application adjust the initial test data according to a preset adjustment range to obtain target test data, and use a larger range to generate detection rules, thereby improving the verification accuracy of the detection rules.

[0028] Optionally, if the test field is the destination port and response code of a communication protocol, the combining module is used to: The first value of the destination port and the comparison condition are combined respectively to obtain the first strategy condition corresponding to the destination port; The second value of the response code and the comparison condition are combined respectively to obtain the second strategy condition corresponding to the response code; Based on the first strategy condition and the second strategy condition, the detection rule corresponding to the test field is determined.

[0029] Some embodiments of this application combine the target port and response code in the communication protocol with corresponding comparison conditions to generate corresponding policy conditions, and generate corresponding detection rules based on the policy conditions. In this way, the detection rules for one test field can be verified, and the detection rules for two test fields can be verified simultaneously, thereby improving the detection efficiency of the detection rules.

[0030] Optionally, if the test field is published content, the combination module is used to: The character segment data of the published content and the inclusion condition or regular expression condition in the test conditions are combined to obtain the third strategy condition corresponding to the published content. Based on the third strategy condition, the detection rules corresponding to the published content are determined.

[0031] Some embodiments of this application combine the published content in the communication protocol with corresponding inclusion conditions or regular expression conditions to generate corresponding detection rules, automatically verify the detection rules, and improve the detection efficiency of the detection rules.

[0032] Thirdly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a verification method for detection rules as described in any embodiment of the first aspect.

[0033] Fourthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the verification method for the detection rules as described in any embodiment of the first aspect.

[0034] Fifthly, some embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the verification method of the detection rules as described in any embodiment of the first aspect. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 A flowchart illustrating a method for verifying detection rules provided in an embodiment of this application; Figure 2 A schematic diagram of the structure of the verification device for the detection rules provided in the embodiments of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0037] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0038] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0039] With the continuous development of network technology, the security requirements for various network devices are becoming increasingly stringent. This necessitates testing the security performance of products before they leave the factory. Currently, testing terminals have various pre-set detection rules. After capturing data packets, these rules are used to verify them. If multiple rules need verification, different rules must be manually pre-set, and the captured data packets are then verified. The results determine whether the rules meet the requirements. This process is not only labor-intensive but also inefficient.

[0040] In view of this, some embodiments of this application provide a method for verifying detection rules. The method includes acquiring a test data packet; determining target test data in the test data packet corresponding to a pre-set test field; determining a detection rule corresponding to the test field based on the target test data and test conditions corresponding to the test field, wherein the test conditions include comparison conditions, inclusion conditions, or regular expression conditions, and the detection rule is a rule for detecting different preset fields of the test data packet; and verifying the detection rule corresponding to the test field based on the target test data.

[0041] In this embodiment, by pre-setting test fields and corresponding test conditions, target test data corresponding to the preset fields of known test data packets is obtained. Detection rules are generated based on the target test data and test conditions. Then, the generated detection rules are verified based on the target test data of the known test data packets. This achieves automatic verification of test conditions without the need for manual strategy addition and verification. This not only reduces manual labor but also improves the verification efficiency of test conditions.

[0042] like Figure 1 As shown, an embodiment of this application provides a method for verifying detection rules, the method comprising: S101. Obtain the test data packet; Specifically, in this embodiment of the application, the test terminal sends a driving instruction to the sending terminal. The driving instruction is used to drive the sending terminal to send a test data packet to the terminal under test. After receiving the test data packet, the terminal under test performs the operation corresponding to the test data packet, obtains the execution result, and stores the test data packet, the test data packet, and the execution result in a log file.

[0043] In this embodiment of the application, when it is necessary to verify the detection rules, the test terminal obtains the log file of the terminal under test, parses the log file, and obtains the test data packet.

[0044] S102. Determine the target test data in the test data packet that corresponds to the test field according to the pre-set test field; Specifically, the test terminal stores all the test fields for the detection rules that need to be verified. For example, for the HTTP protocol, the test fields that need to be set include the destination port, response code, and published content. The test terminal parses the acquired test data packets to obtain the target test data corresponding to the test fields in the test data packets. The target test data can be obtained by directly parsing the test data packets, or by adjusting the data obtained from parsing the test data packets. The target test data can be a numerical value or a string.

[0045] For example, the target test data includes a port number, a response code value, or a string, wherein the port number and the response code value are numerical values. For instance, if the test field is a target port, the target test data corresponding to the target port is determined to be the target port number of the target port; if the test field is a response code, the target test data corresponding to the response code is determined to be the target response code value; and if the test field is published content, the target test data corresponding to the published content is determined to be the target string.

[0046] S103. Based on the target test data corresponding to the test field and the test conditions corresponding to the test field, determine the detection rules corresponding to the test field, wherein the test conditions include comparison conditions, inclusion conditions or regular expression conditions, and the detection rules are rules for detecting different preset fields of the test data packet; Specifically, for each test field, the test terminal also has corresponding test conditions set. These test conditions include comparison conditions, inclusion conditions, or regular expression conditions. The detection rules are rules for detecting different preset fields of the test data packet. They can be selected and set according to test requirements. The number of comparison conditions, inclusion conditions, or regular expression conditions is not specifically limited in this application.

[0047] The testing terminal generates detection rules corresponding to the test fields based on the target test data and test conditions obtained for the test fields. These detection rules can be matching rules or non-matching rules.

[0048] If there are multiple test fields, and corresponding test conditions are set for each different test field, then different strategy conditions are generated for each test field based on the different test conditions and the target test data corresponding to each test field, and detection rules are generated based on the strategy conditions.

[0049] In the embodiments of this application, the detection rule can be a single policy condition corresponding to a test field, or multiple policy conditions for multiple test fields, and these policy conditions are related by AND.

[0050] For example, if the test field is the target port, the target port number corresponding to the target port is obtained as 80. The test condition corresponding to the test field is the comparison condition, which includes equal to, less than, less than or equal to, etc., and can be set according to requirements. Then, the target port number 80 of the target port and each condition in the comparison condition are combined to generate detection rules. For example, detection rule 1 is that the target port is equal to 80, detection rule 2 is that the target port is less than 80, and detection rule 3 is that the target port is less than or equal to 80.

[0051] S104. Verify the detection rule corresponding to the test field based on the target test data corresponding to the test field.

[0052] Specifically, the test terminal verifies each detection rule based on the target test data corresponding to the test field. If the target test data and the verification rule match, that is, if the verification rule contains the target test data, it means that the detection rule can detect the test field in the known test data packet. For example, detection rule 1, detection rule 2 and detection rule 3 are verified based on the target port number 80 of the target port to obtain the verification result. In this way, there is no need for manual configuration of the detection rules, which improves the verification efficiency of the detection rules. Some embodiments of this application obtain target test data corresponding to the preset fields of a known test data packet by pre-setting test fields and corresponding test conditions, generate detection rules based on the target test data and test conditions, and then verify each generated detection rule based on the target test data of the known test data packet. This achieves automatic verification of test conditions without the need for manual strategy addition and verification, which not only reduces manual labor but also improves the verification efficiency of test conditions.

[0053] Another embodiment of this application further supplements the description of the verification method for the detection rules provided in the above embodiments.

[0054] Optionally, the step of validating the detection rule corresponding to the test field based on the target test data corresponding to the test field includes: If the target test data corresponding to the test field matches the detection rule, the detection rule is determined to have passed the verification. If the target test data corresponding to the test field does not match the detection rule, it is determined that the detection rule has failed the verification.

[0055] In other words, if the detection rule contains target test data corresponding to the test field, it means that the detection rule has passed the verification; if the detection rule does not contain target test data corresponding to the test field, it means that the detection rule has failed the verification.

[0056] For example, based on the above embodiments, detection rules 1, 2, and 3 are verified according to the target port number 80 of the target port. Specifically, for detection rule 1, the target port is equal to 80, and the target port number of the test data packet is exactly 80, so detection rule 1 passes verification. For detection rule 2, the target port is less than 80, and the target port number of the test data packet is exactly 80, indicating that detection rule 2 fails verification. For detection rule 3, the target port is less than or equal to 80, which matches the target port number 80. Therefore, detection rules 1 and 3 pass verification, while detection rule 2 fails verification.

[0057] Some embodiments of this application use target test data in a known test data package to verify the detection rules corresponding to the test fields, obtain verification results, and determine whether the expected results are achieved based on the verification results.

[0058] Optionally, determining the target test data in the test data packet corresponding to the pre-set test field according to the pre-set test field includes: The test data packet is parsed to obtain the initial test data corresponding to the test field; Based on the preset adjustment range, the target test data corresponding to the initial test data is determined.

[0059] Specifically, the test terminal obtains the initial test data of the test data packet, and then adjusts the initial test data within a certain range according to a preset adjustment range to obtain the target test data.

[0060] For example, if parsing the test data packet yields the initial test data (initial port number) of the target port as 80, and the preset condition range is 1, the target port number obtained will be 79, 80, or 81; if the preset condition range is 2, the target port number obtained will be 78, 80, or 82. The preset adjustment range is not specifically limited and can be set as needed.

[0061] Some embodiments of this application adjust the initial test data according to a preset adjustment range to obtain target test data, and use a larger test range to generate detection rules, thereby improving the verification accuracy of the detection rules.

[0062] Some embodiments of this application can set different comparison conditions according to testing requirements, thereby generating a variety of different strategy conditions and improving the accuracy of detection rule verification.

[0063] Optionally, determining the detection rule corresponding to the test field based on the target test data and the test conditions corresponding to the test field includes: When there are multiple test fields, the strategy conditions corresponding to the multiple test fields are determined based on the target test data corresponding to the test field and the test conditions corresponding to the test field. The strategy conditions corresponding to the multiple test fields are associated with a detection rule to obtain the detection rule corresponding to the test data packet.

[0064] Specifically, when the test terminal parses a test data packet containing multiple test fields, such as the target port and response code, and each test field corresponds to its own test conditions (equal to, less than or equal to, not equal to, or greater than), the test terminal combines the test conditions of different test fields with the target test data to generate policy conditions corresponding to the test fields. For example, there are multiple first policy conditions and multiple second policy conditions. The first policy condition is the policy condition for the target port, and the second policy condition is the policy condition for the response code. Any first policy condition and any second policy condition are bound to the detection rules to obtain all the detection rules corresponding to the test data packet.

[0065] In some embodiments of this application, the detection rules generated by the strategy conditions corresponding to multiple test fields can be verified simultaneously during a single verification process, thereby improving the efficiency of detection rule verification. Optionally, the method further includes: An alarm log is generated if the target test data corresponding to the test field matches the detection rule.

[0066] The test terminal verifies each detection rule based on the target test data. If the detection rule matches the target test data, it means that the detection rule is consistent with the expected result, and an alarm log is generated. Some embodiments of this application use test data packets to verify the generated detection rules. If the two match, an alarm log is generated, and the verification status can be viewed through the alarm log.

[0067] Furthermore, if the target test data corresponding to the test field matches the detection rule, the detection rule corresponding to the test field is deleted.

[0068] Some embodiments of this application disable or delete verified detection rules to avoid affecting the process of subsequent detection rules. Deleting verified detection rules improves verification efficiency and reduces storage space.

[0069] Optionally, if the test field is the destination port and response code of a communication protocol, determining the detection rule corresponding to the test field based on the target test data and test conditions corresponding to the test field includes: The first value of the destination port and the comparison condition are combined respectively to obtain the first strategy condition corresponding to the destination port; the comparison condition includes equal to, not equal to, less than or equal to, greater than or equal to, less than, greater than or between; The second value of the response code and the comparison condition are combined respectively to obtain the second strategy condition corresponding to the response code; Based on the first strategy condition and the second strategy condition, the detection rule corresponding to the test field is determined.

[0070] In some embodiments of this application, for a certain test field, one or more comparison conditions can be selected according to the test requirements. If multiple conditions are required, they are set according to their priority. The policy conditions are generated in the order of their priority. Based on the target port and response code in the communication protocol, they are combined with the corresponding comparison conditions to generate the corresponding policy conditions. The corresponding detection rules are generated based on the policy conditions. In this way, the detection rules for one test field can be verified, and the detection rules for two test fields can be verified simultaneously, thereby improving the detection efficiency of the detection rules.

[0071] Optionally, if the test field is published content, determining the detection rule corresponding to the test field based on the target test data and test conditions corresponding to the test field includes: The character segment data of the published content and the inclusion condition or regular expression condition in the test conditions are combined to obtain the third strategy condition corresponding to the published content. Based on the third strategy condition, the detection rules corresponding to the published content are determined.

[0072] Specifically, if the test field is a target port, the detection rule corresponding to the target port is determined based on the target port number corresponding to the test field and the test conditions corresponding to the target port, i.e., the first strategy condition; if the test field is a response code, the detection rule corresponding to the response code is determined based on the response code value corresponding to the response code and the test conditions corresponding to the response code, i.e., the second strategy condition.

[0073] Some embodiments of this application combine the published content in the communication protocol with corresponding inclusion conditions or regular expression conditions to generate corresponding detection rules, automatically verify the detection rules, and improve the detection efficiency of the detection rules.

[0074] This application embodiment obtains the system's parsing results of data packets by replaying existing data packets and querying audit log information. Based on the parsing results, it automatically generates matching or non-matching detection rules for different conditions of corresponding fields, and each strategy is matched or not matched with the corresponding expected rule result. After creating the strategy, the data packets are replayed again, and the system alarm log information is queried to confirm whether the actual strategy match is consistent with the expectation. If the strategy matches the expected result, the field condition of the strategy passes the verification; otherwise, the verification fails. Fields that fail verification are then manually tracked and verified. This method can automatically verify the detection status of rule fields, reduce manual intervention, and improve testing accuracy and efficiency.

[0075] For example, embodiments of this application can be applied to a network auditing system, providing a method for verifying detection rules, specifically including: 1. The test terminal obtains all test fields to be verified and the corresponding test conditions of the audit system detection strategy module on the terminal under test, and records and saves them in any way.

[0076] For example, the test fields for the HTTP protocol include destination port, response code, and published content. Different fields correspond to different test conditions. The test conditions for the HTTP destination port include equal to, not equal to, less than or equal to, greater than or equal to, less than, greater than or between; the test conditions for the HTTP response code include equal to, not equal to, less than or equal to, greater than or equal to, less than, greater than or between; the test conditions for the HTTP published content include regular expression conditions and inclusion conditions.

[0077] The result is stored in JSON format as follows: {"HTTP":{"Destination Port":["equal to","not equal to","less than or equal to","greater than or equal to","less than","greater than","between"], "Response Code":["equal to","not equal to","less than or equal to","greater than or equal to","less than","greater than","between"], "Published content":["Contains","Regular expression"]}} 2. A sending client is installed on the sending terminal. The test terminal sends a driver instruction to the sending terminal. This driver instruction is used to drive the sending terminal to send test data packets to the terminal under test. After receiving the test data packet, the terminal under test performs the operation corresponding to the test data packet, obtains the execution result, and stores the test data packet, the test data packet, and the execution result in a log file. The test terminal connects to SSH and uses tcpreplay to replay an existing data packet, i.e., the test data packet. Assume that the content of the test data packet is HTTP protocol. 3. The test terminal queries the audit log of the audit system of the terminal under test, and views the field information of this test data packet parsed by the audit system, that is, the target test data in the test data packet corresponding to the test field, for example, the destination port number is equal to 80, the response code value is 200, and the published content is an empty string; 4. The test terminal obtains the pre-set test fields, such as the HTTP protocol fields containing the destination port and response code. Based on the target test data of the test data packet, such as field values ​​(destination port number, response code value, or published content) and the corresponding test conditions, it generates corresponding detection rules. The detection rules include policy conditions, which can be one or more, as shown in Table 1, which represents the detection rules and matching results.

[0078] Table 1

[0079] 5. After generating a detection rule, the test terminal re-acquires the target test data of the test data packet, verifies each detection rule, and generates an alarm log if a match is found. The alarm log can be queried in subsequent processes to determine whether the expected and actual results match. The corresponding test results are recorded as follows: {"HTTP":{"Destination port number equals 80":"Verification passed", "Destination port equals 79: "Verification successful", "Destination port is not equal to 80": "Verification passed", "Destination port is not equal to 79": "Verification passed", "Destination port less than or equal to 80": "Verification passed", "Destination port less than or equal to 81": "Verification passed", "Destination port less than or equal to 79": "Verification passed", "Destination port is greater than or equal to 80": "Verification passed", "Destination port is greater than or equal to 79": "Verification passed", "Destination port is greater than or equal to 81":"Verification passed", "Destination port less than 80":"Verification passed", "Destination port is less than 81":"Verification passed", "Destination port is greater than 80": "Verification passed", "Destination port is greater than 79":"Verification passed", "Destination port is between 79-81": "Verification successful", "Destination port is between 79 and 80": "Verification successful", "Destination port is between 80 and 81": "Verification successful", "Response code equals 200": "Verification successful", Response code equals 199: "Verification successful". "Response code is not equal to 200": "Verification passed", "Response code is not equal to 199": "Verification passed", "Response code less than or equal to 200": "Verification passed", "Response code less than or equal to 201": "Verification passed", "Response code less than or equal to 199": "Verification passed", "Response code greater than or equal to 200": "Verification passed", "Response code greater than or equal to 199": "Verification passed", "Response code greater than or equal to 201": "Verification passed", "Response code less than 200": "Verification passed", "Response code less than 201": "Verification passed", "Response code greater than 200": "Verification passed", "Response code greater than 199": "Verification passed", "Response code between 199 and 201": "Verification successful", "Response code between 199 and 200": "Verification successful" "Response code between 200 and 201": "Verification successful" 6. Disable / delete the verified detection rules. This data packet has been verified for the HTTP destination port and response code fields. Remove it from the protocol verification fields. Subsequent replay data packets will no longer verify this field. Only data packets with published content will be checked for matching verification of the published content policy. 7. And so on, until all fields of the protocol have been verified or the data packet has been verified, the overall test result will be output.

[0080] This application embodiment automatically adds and verifies policy detection fields and corresponding conditions based on audit log results, providing comprehensive coverage; it automatically verifies the generated detection rules, eliminating the need for manual policy addition and verification, and delivering accurate and fast results; it also enables automatic querying of alarm logs to verify matching results.

[0081] This application provides a reverse verification method, namely, an automatic policy field matching verification method based on existing data packets. The test terminal first automatically replays the data packets (test data packets). After replay, the tested terminal generates an audit log of the data packet content. Based on the audit log fields of the data packets, corresponding matching or non-matching rules are automatically created. After creating the rules, the data packets are replayed again to check whether the alarm log matches the corresponding policy, thereby completing the automatic reverse verification of rules based on the data packets.

[0082] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0083] Another embodiment of this application provides a verification device for detection rules, used to execute the verification method for detection rules provided in the above embodiments.

[0084] like Figure 2 The diagram shown is a structural schematic of a verification device for detection rules provided in an embodiment of this application. The verification device for detection rules includes an acquisition module 201, a determination module 202, a combination module 203, and a verification module 204, wherein: Module 201 is used to acquire test data packets; The determining module 202 is used to determine the target test data in the test data packet corresponding to the test field according to the pre-set test field; The combination module 203 is used to determine the detection rule corresponding to the test field based on the target test data corresponding to the test field and the test conditions corresponding to the test field. The test conditions include comparison conditions, inclusion conditions or regular expression conditions, and the detection rule is a rule for detecting different preset fields of the test data packet. The verification module 204 is used to verify the detection rule corresponding to the test field based on the target test data corresponding to the test field.

[0085] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0086] Some embodiments of this application obtain target test data corresponding to the preset fields of a known test data packet by pre-setting test fields and corresponding test conditions, generate detection rules based on the target test data and test conditions, and then verify each generated detection rule based on the target test data of the known test data packet. This achieves automatic verification of test conditions without the need for manual strategy addition and verification, which not only reduces manual labor but also improves the verification efficiency of test conditions.

[0087] Another embodiment of this application further supplements the description of the verification device for the detection rules provided in the above embodiments.

[0088] Optionally, the verification module is used for: If the target test data corresponding to the test field matches the detection rule, the detection rule is determined to have passed the verification. If the target test data corresponding to the test field does not match the detection rule, it is determined that the detection rule has failed the verification.

[0089] Some embodiments of this application use target test data in a known test data package to verify the detection rules corresponding to the test fields, obtain verification results, and determine whether the expected results are achieved based on the verification results.

[0090] Optionally, the determining module is configured to: The test data packet is parsed to obtain the initial test data corresponding to the test field; Based on the preset adjustment range, the target test data corresponding to the initial test data is determined.

[0091] Some embodiments of this application adjust the initial test data according to a preset adjustment range to obtain target test data, and use a larger range to generate detection rules, thereby improving the verification accuracy of the detection rules.

[0092] Optionally, the comparison conditions include equal to, not equal to, less than or equal to, greater than or equal to, less than, greater than, or between.

[0093] Some embodiments of this application can set different comparison conditions according to testing requirements, thereby generating a variety of different strategy conditions and improving the accuracy of detection rule verification.

[0094] Optionally, the verification module is used for: An alarm log is generated if the target test data corresponding to the test field matches the detection rule. Some embodiments of this application use test data packets to verify the generated detection rules. If the two match, an alarm log is generated, and the verification status can be viewed through the alarm log.

[0095] Optionally, the verification module is used for: If the target test data corresponding to the test field matches the detection rule, the detection rule corresponding to the test field will be deleted.

[0096] Some embodiments of this application will remove detection rules through verification, thereby improving verification efficiency and reducing storage space.

[0097] Optionally, if the test field is the destination port and response code of a communication protocol, the combining module is used to: The first value of the destination port and the comparison condition are combined respectively to obtain the first strategy condition corresponding to the destination port; The second value of the response code and the comparison condition are combined respectively to obtain the second strategy condition corresponding to the response code; Based on the first strategy condition and the second strategy condition, the detection rule corresponding to the test field is determined.

[0098] Some embodiments of this application combine the target port and response code in the communication protocol with corresponding comparison conditions to generate corresponding policy conditions, and generate corresponding detection rules based on the policy conditions. In this way, the detection rules for one test field can be verified, and the detection rules for two test fields can be verified simultaneously, thereby improving the detection efficiency of the detection rules.

[0099] Optionally, if the test field is published content, the combination module is used to: The character segment data of the published content and the inclusion condition or regular expression condition in the test conditions are combined to obtain the third strategy condition corresponding to the published content. Based on the third strategy condition, the detection rules corresponding to the published content are determined.

[0100] Some embodiments of this application combine the published content in the communication protocol with corresponding inclusion conditions or regular expression conditions to generate corresponding detection rules, automatically verify the detection rules, and improve the detection efficiency of the detection rules.

[0101] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0102] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0103] This application also provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it can implement the operation of any of the methods corresponding to the verification methods of the detection rules provided in the above embodiments.

[0104] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the verification methods of the detection rules provided in the above embodiments.

[0105] like Figure 3 As shown, some embodiments of this application provide an electronic device 300, which includes a memory 310, a processor 320, and a computer program stored in the memory 310 and executable on the processor 320. When the processor 320 reads the program from the memory 310 via a bus 330 and executes the program, it can implement any of the methods included in the verification method of the detection rules described above.

[0106] Processor 320 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 320 may be a microprocessor.

[0107] The memory 310 can be used to store instructions executed by the processor 320 or data related to the execution of instructions. These instructions and data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 320 of this disclosure embodiment can be used to execute the instructions in the memory 310 to implement the methods shown above. The memory 310 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0108] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0109] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0110] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for verifying detection rules, characterized in that, include: Obtain the test data packet; Based on the pre-set test fields, determine the target test data in the test data packet that corresponds to the test fields; Based on the target test data corresponding to the test field and the test conditions corresponding to the test field, the detection rules corresponding to the test field are determined. The test conditions include comparison conditions, inclusion conditions, or regular expression conditions. The detection rules are rules for detecting different preset fields of the test data packet. The detection rules corresponding to the test fields are verified based on the target test data corresponding to the test fields.

2. The verification method for the detection rule according to claim 1, characterized in that, The step of validating the detection rule corresponding to the test field based on the target test data corresponding to the test field includes: If the target test data corresponding to the test field matches the detection rule, the detection rule is determined to have passed the verification. If the target test data corresponding to the test field does not match the detection rule, it is determined that the detection rule has failed the verification.

3. The verification method for the detection rule according to claim 1, characterized in that, The method further includes: If the detection rule passes verification, an alarm log is generated.

4. The verification method for the detection rule according to claim 1, characterized in that, The method further includes: If the detection rule passes verification, the detection rule corresponding to the test field will be deleted.

5. The verification method for the detection rule according to claim 1, characterized in that, The step of determining the target test data in the test data packet corresponding to the pre-set test field includes: The test data packet is parsed to obtain the initial test data corresponding to the test field; Based on the preset adjustment range, the target test data corresponding to the initial test data is determined.

6. The verification method for the detection rule according to claim 1, characterized in that, If the test field is the destination port and response code of a communication protocol, the step of determining the detection rule corresponding to the test field based on the target test data and test conditions corresponding to the test field includes: The first value of the destination port and the comparison condition are combined respectively to obtain the first strategy condition corresponding to the destination port; The second value of the response code and the comparison condition are combined respectively to obtain the second strategy condition corresponding to the response code; Based on the first strategy condition and the second strategy condition, the detection rule corresponding to the test field is determined.

7. The verification method for the detection rule according to claim 1, characterized in that, If the test field is published content, the step of determining the detection rule corresponding to the test field based on the target test data and test conditions corresponding to the test field includes: The character segment data of the published content and the inclusion condition or regular expression condition in the test conditions are combined to obtain the third strategy condition corresponding to the published content. Based on the third strategy condition, the detection rules corresponding to the published content are determined.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the verification method of the detection rule as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that, when the program is executed by a processor, it can implement the verification method of the detection rule as described in any one of claims 1-7.

10. A computer program product, said computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it can implement the verification method of the detection rule described in any one of claims 1-7.

Images