Security rule base management method and apparatus, computer device, and storage medium

Abstract

The present application relates to a security rule base management method and apparatus, a computer device, and a storage medium. The method comprises: acquiring a security event data set, wherein the security event data set comprises event data of a plurality of security events detected by a network security system on the basis of a security rule base within a preset historical time period; on the basis of the security event data set, determining activeness parameters of security rules in the security rule base; and on the basis of the activeness parameters of the security rules, controlling the security rules in the security rule base to be enabled or disabled. By employing the present method, the detection efficiency of the network security system can be improved.

Description

Security rule base management method, device, computer equipment and storage medium

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 202310906721.8, filed on July 24, 2023, entitled “Security Rule Base Management Method, Apparatus, Computer Equipment and Storage Medium,” the entire text of which is incorporated herein by reference. Technical Field

[0003] The present application relates to the field of network security technology, and in particular to a security rule base management method, apparatus, computer equipment, and storage medium. Background Art

[0004] Network security systems used to detect or protect against malicious attacks, such as IDS (Intrusion Detection Systems), WAF (Web Application Firewall), and security gateways, mainly rely on signature detection technology to detect attack behaviors. Signature detection-based attack detection relies on a rule base.

[0005] To maintain the ability to detect attacks, network security systems must maintain a broad and comprehensive rule base. However, as vulnerabilities continue to emerge and the size of the rule base continues to expand, detection efficiency gradually decreases.

[0006] Summary of the Invention

[0007] The embodiments of the present application provide a security rule base management method, apparatus, computer equipment, and storage medium, which can improve the detection efficiency of a network security system.

[0008] In a first aspect, an embodiment of the present application provides a security rule base management method, the method comprising:

[0009] Acquire a security event data set, wherein the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period;

[0010] Determine the activity parameters of each security rule in the security rule library based on the security event data set;

[0011] Control the opening or closing of each security rule in the security rule library based on the activity parameters of each security rule.

[0012] In one embodiment, the above-mentioned determining the activity parameter of each security rule in the security rule library based on the security event data set includes:

[0013] Determine a local activity set and a global maximum activity set based on the security event data set; the local activity set includes the local activity of each security rule, and the global maximum activity set includes the global maximum activity of each security rule;

[0014] The activity parameters of each security rule are determined based on the pre-acquired historical activity set, local activity set and global maximum activity set.

[0015] In one embodiment, determining the local activity set based on the security event data set includes:

[0016] Determine a rule group set based on a security event data set and a preset time window size; the rule group set includes multiple rule groups, each rule group includes multiple security rules;

[0017] The local activity of each security rule is determined based on the total number of events of the target rule group to which each security rule belongs, and the local activity sets are composed of the local activity of multiple security rules.

[0018] In one embodiment, the event data includes event time, source address, and rule identifier. The above-mentioned determination of the rule group set based on the security event data set and the preset time window size includes:

[0019] Determine multiple time windows based on the event time and time window size of each security event in the security event data set;

[0020] For each time window, extract the security events within the time window from the security event data set, and divide the extracted security events according to the source address and rule identifier to obtain an initial event group set, wherein the initial event group set includes multiple initial event groups, and each initial event group includes multiple security events with the same source address and the same rule identifier;

[0021] Filtering the initial event group set to obtain a target event group set corresponding to the time window, wherein the target event group set includes multiple target event groups, and each target event group includes multiple rule groups divided according to source addresses;

[0022] The target event group sets corresponding to multiple time windows are merged according to the source addresses to obtain a rule group set.

[0023] In one embodiment, the filtering process performed on the initial event group to obtain the target event group set corresponding to the time window includes:

[0024] Normalize each initial event group according to the number of events to obtain the event group parameters of each initial event group;

[0025] The initial event group set is filtered according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set.

[0026] In one embodiment, the normalization process is performed on each initial event group according to the number of events to obtain event group parameters of each initial event group, including:

[0027] Performing normalization processing according to the number of events in the initial event group and a preset constant to obtain a normalized number of events;

[0028] Normalizing the number of events in the initial event group and the number of successfully requested events to obtain a normalized number of successful events;

[0029] The event group parameters of the initial event group are determined according to the normalized number of events and the normalized number of successful events.

[0030] In one embodiment, the filtering process of the initial event group set according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set includes:

[0031] For each initial event group in the initial event group set, if the event group parameter of the initial event group is less than the preset event threshold, the initial event group is filtered;

[0032] The target event group set is obtained according to the initial event groups that are not filtered out in the initial event group set.

[0033] In one embodiment, the above-mentioned determination of multiple time windows based on the event time and time window size of each security event in the security event data set includes:

[0034] Determine the start time of the first time window based on the event time of each security event in the security event data set;

[0035] Multiple time windows are determined based on the start time of the first time window and the time window size.

[0036] In one embodiment, the step of determining the global maximum activity set includes:

[0037] Sending the local activity sets to a preset server, so that the preset server can determine the global maximum activity of each security rule based on the multiple local activity sets, and forming a global maximum activity set from the global maximum activity of the multiple security rules;

[0038] Receives the global activity set fed back by the preset server.

[0039] In one embodiment, the above-mentioned control of enabling or disabling each security rule in the security rule library according to the activity parameter of each security rule includes:

[0040] Determine the activation probability of each security rule based on activity parameters and operational load data of the network security system;

[0041] Control the opening or closing of each security rule in the security rule library based on the opening probability of each security rule.

[0042] In one embodiment, determining the activation probability of each security rule based on the activity parameter and the operational load data of the network security system includes:

[0043] Determining a target load interval where the operating load data is located from a plurality of preset load intervals;

[0044] For each security rule in the security rule base, determine the rule category of the security rule according to the activity parameter;

[0045] The activation probability of each safety rule is determined based on the operating load data, the category parameter corresponding to the rule category of the safety rule, and the preset relationship corresponding to the target load range.

[0046] In one embodiment, the above-mentioned control of enabling or disabling each security rule in the security rule library according to the enabling probability of each security rule includes:

[0047] Get the random number corresponding to each security rule;

[0048] Control the opening or closing of each security rule based on the random number and the opening probability of each security rule.

[0049] In a second aspect, an embodiment of the present application provides a security rule base management device, the device comprising:

[0050] A data acquisition module is used to acquire a security event data set; wherein the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period;

[0051] An activity determination module, configured to determine the activity parameters of each security rule in the security rule library based on a set of security event data;

[0052] The rule base management module is used to control the opening or closing of each security rule in the security rule base according to the activity parameters of each security rule.

[0053] In a third aspect, an embodiment of the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0054] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method described in the first aspect are performed.

[0055] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0056] The above-mentioned security rule base management method, apparatus, computer equipment and storage medium obtain a security event data set; determine the activity parameters of each security rule in the security rule base based on the security event data set; and control the opening or closing of each security rule in the security rule base according to the activity parameters of each security rule. Through the embodiments of the present application, security rules with a low number of hits in the security rule base can be closed. In this way, the network security system does not need to traverse all security rules in the security rule base when performing security detection, thereby improving the detection efficiency of the network security system. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technology descriptions. Obviously, the drawings described below are only some embodiments of this application. For those of ordinary skill in the art, other drawings can be derived from these drawings without inventive effort.

[0058] FIG1 is a diagram showing an application environment of a security rule base management method in an embodiment of the present application.

[0059] FIG2 is a flow chart of a security rule base management method in one embodiment of the present application.

[0060] FIG3 is a flowchart illustrating the steps of determining the activity parameters of each security rule in an embodiment of the present application.

[0061] FIG4 is a flow chart of the steps of determining a local activity set in one embodiment of the present application.

[0062] FIG5 is a flowchart illustrating the steps of determining a set of rule groups in an embodiment of the present application.

[0063] FIG6 is a flow chart of the step of determining a target event group set in one embodiment of the present application.

[0064] FIG7 is a flow chart of the steps for controlling each security rule in the security rule library in one embodiment of the present application.

[0065] FIG8 is a flowchart illustrating the steps of determining the activation probability of each security rule in an embodiment of the present application.

[0066] FIG. 9 is a schematic diagram of a turn-on probability curve in an embodiment of the present application.

[0067] FIG10 is a structural block diagram of a security rule base management device in an embodiment of the present application.

[0068] FIG11 is a diagram showing the internal structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0070] FIG1 is a schematic diagram of an application scenario for security rule base management provided by an embodiment of the present application. As shown in FIG1 , the application scenario includes a management server 101 and multiple network servers 102 located in different networks. A network security management system is provided on the management server 101; a network security system is provided on the network server 102. The network security system can perform security checks on the network in which it is located, thereby detecting intrusions, attacks, and other behaviors. The management server 101 communicates with the network server 102 via the network. For example, the network server 102 sends the determined local activity set to the management server 101, and the management server 101 determines the global activity set based on the multiple local activity sets. The management server 101 then returns the global activity set to the network server 102. The data storage system can store data that the network server 102 needs to process. For example, the data storage system stores security event data sets and security rule bases. The data storage system can be integrated on the network server 102, or it can be placed on the cloud or other network servers. The management server 101 and the network server 102 can each be implemented as an independent server or a server cluster consisting of multiple servers.

[0071] Traditionally, network security systems perform security checks based on a security rule base, requiring them to traverse every security rule in the base. To maintain the ability to detect intrusions, attacks, and other behaviors, network security systems must maintain a broad and comprehensive security rule base. However, with the continuous emergence of vulnerabilities and the continuous expansion of the security rule base, the number of security rules that need to be traversed has increased, leading to a gradual decline in detection efficiency.

[0072] Based on the above-mentioned traditional technology, an embodiment of the present application provides a management solution for a security rule base, which first obtains a set of security event data; then, based on the set of security event data, determines the activity parameters of each security rule in the security rule base; and then, according to the activity parameters of each security rule, controls the opening or closing of each security rule in the security rule base. Through the embodiment of the present application, security rules with a low number of hits in the security rule base can be closed, that is, the security rule base can be adaptively adjusted. In this way, the network security system does not need to traverse all security rules in the security rule base when performing security detection, thereby improving detection efficiency.

[0073] It should be noted that the beneficial effects or technical problems solved by the embodiments of the present application are not limited to this one, but may also include other implicit or related problems. For details, please refer to the description of the following embodiments.

[0074] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0075] In one embodiment, as shown in FIG2 , a security rule base management method is provided. The method is described by taking the network server in FIG1 as an example, and may include the following steps:

[0076] Step S201: Acquire a security event data set.

[0077] The security event data set includes event data for multiple security events detected by the network security system based on the security rule base within a preset historical period. The event data includes the event time, the source address of the security event, the rule identifier of the security rule that the security event matched, and the response code of the network security system in response to the security event, as shown in Table 1.

[0078] Table 1

[0079] The network security system performs security checks based on the security rule base, obtains event data for security incidents, and then stores the event data. When the security rule base needs to be managed, event data within a preset historical period is retrieved from the stored event data to obtain a security event data set.

[0080] The security rule base can be managed according to a preset time or a preset period. For example, if the preset time is X year X month X day, the security rule base will be managed at that preset time; or, if the preset period is monthly, the security rule base will be managed monthly. It should be noted that the triggering conditions for managing the security rule base are not limited to those described above.

[0081] Step S202: determining the activity parameter of each security rule in the security rule library based on the security event data set.

[0082] The activity parameter represents the number of times the security rule is hit. Optionally, a larger activity parameter indicates a greater number of times the security rule is hit; a smaller activity parameter indicates a smaller number of times the security rule is hit.

[0083] After obtaining the security event data set, the hit status of each security rule in the security rule library can be determined based on the security event data set to obtain the activity parameter.

[0084] For example, based on event data such as event time, source address, rule identifier, and response code, it is determined that security rule 1 in the security rule library is frequently hit within a preset historical period, while security rule 2 is not hit within a preset historical period. Then, based on this event data, a parameter representing the frequent hits of security rule 1 is calculated to obtain the activity parameter for security rule 1. Similarly, the activity parameters for each of the other security rules are calculated.

[0085] Step S203: Controlling the opening or closing of each security rule in the security rule library according to the activity parameter of each security rule.

[0086] For each security rule in the security rule library, if the activity parameter indicates that the security rule is frequently hit within a preset historical period, the security rule is controlled to be turned on; if the activity parameter indicates that the security rule is hit less frequently within the preset historical period, the security rule is controlled to be turned off.

[0087] For example, if the activity parameter corresponding to security rule 1 is a and is greater than the preset parameter threshold x, then security rule 1 is controlled to be turned on; and if the activity parameter corresponding to security rule 2 is b and is less than the preset parameter threshold x, then security rule 2 is controlled to be turned off.

[0088] In the above embodiment, a security event data set is first obtained; then, based on the security event data set, the activity parameters of each security rule in the security rule base are determined; and then, based on the activity parameters of each security rule, the opening or closing of each security rule in the security rule base is controlled. Through the embodiment of the present application, security rules with a low number of hits in the security rule base can be closed. In this way, the network security system does not need to traverse all security rules in the security rule base when performing security detection, thereby improving the detection efficiency of the network security system.

[0089] In one embodiment, as shown in FIG3 , the process of determining the activity parameter of each security rule in the security rule library based on the security event data set in step S202 may include the following steps:

[0090] Step S301: Determine a local activity set and a global maximum activity set based on a security event data set.

[0091] The local activity set includes the local activity of each security rule, which represents the hit rate of the security rule in a single network. The global maximum activity set includes the global maximum activity of each security rule, which represents the maximum hit rate of the security rule in all networks.

[0092] After obtaining the security event data set, the hit status of each security rule in the network can be determined based on the security event data set, the local activity of each security rule can be obtained, and the local activity of multiple security rules can be used to form a local activity set.

[0093] After determining the local activity of each security rule, the local activity of each security rule in other networks can be obtained from other networks; then, for each security rule, the maximum value of its local activity in all networks is determined to obtain the global maximum activity of the security rule; finally, the global maximum activity of multiple security rules constitutes a global activity set.

[0094] Step S302 : determining the activity parameters of each security rule based on the pre-acquired historical activity set, the local activity set, and the global maximum activity set.

[0095] The historical activity set includes the historical activity of multiple security rules, and the historical activity is the local activity determined according to historical time.

[0096] Based on the historical activity set, local activity set and global maximum activity set, the historical activity, local activity and global maximum activity of each security rule are determined; then, the historical activity, local activity and global maximum activity are weightedly calculated to obtain the activity parameter of the security rule.

[0097] The activity parameter of the security rule can be determined by referring to formula (1):

[0098] Among them, w_i is the activity parameter, wi is the local activity, history_wi is the historical activity, max_w is the global maximum activity, σ is the weight corresponding to the historical activity, and δ is the weight corresponding to the global maximum activity.

[0099] As can be seen from formula (1), when the local activity of the security rule is 0, the global maximum activity is used to determine the activity parameter; however, when the local rule of the security rule is greater than 0, the global maximum activity is not used to determine the activity parameter. Optionally, when the local activity of the security rule is 0, the weight δ corresponding to the global maximum activity is 0.5, and when the local rule of the security rule is greater than 0, the weight δ corresponding to the global maximum activity is 0. Optionally, the weight σ corresponding to the historical activity is 0.5.

[0100] In the above embodiment, a local activity set and a global maximum activity set are determined based on a security event data set; a local activity set and a global maximum activity set are determined based on a security event data set. Through the embodiments of the present application, by comprehensively considering the environmental differences of different networks and integrating local activity, global maximum activity, and historical activity to determine activity parameters, the effectiveness and comprehensiveness of the activity parameters can be improved.

[0101] In one embodiment, as shown in FIG4 , regarding the process of determining the local activity set based on the security event data set in step S301 above, the embodiment of the present application may include the following steps S401-S402:

[0102] Step S401: Determine a rule group set based on a security event data set and a preset time window size.

[0103] The rule group set includes multiple rule groups, each rule group includes multiple security rules. Referring to Table 2, id is the rule identifier of the security rule.

[0104] Table 2

[0105] Multiple time windows are determined according to a preset time window size, and event data of each time window is determined based on a security event data set; the event data of each time window is processed to obtain multiple rule groups corresponding to each time window and the total number of events corresponding to each rule group; then, the rule groups and total number of events corresponding to the multiple time windows are processed to obtain a rule group set.

[0106] Step S402 : determining the local activity of each security rule according to the total number of events of the target rule group to which each security rule belongs, and forming a local activity set from the local activities of multiple security rules.

[0107] For each security rule, determine at least one target rule group to which the security rule belongs, and sum the total number of events in at least one target rule group to obtain the local activity of the security rule. This is shown in formula (2):

[0108] Among them, wi is the local activity, i is the sequence number of the security rule, and j is the sequence number of the rule group.

[0109] Referring to Table 2, the target rule groups to which id3 belongs include rule_group1, rule_group2, and rule_group3; the total number of events of rule_group1 is C1, the total number of events of rule_group2 is C2, and the total number of events of rule_group3 is C3. Therefore, the local activity of id3 is w3 = C1 + C2 + C3.

[0110] In the above embodiment, a set of rule groups is determined based on a set of security event data and a preset time window size; the local activity of each security rule is determined based on the total number of events in the target rule group to which each security rule belongs, and a local activity set is formed from the local activity of multiple security rules. Through the embodiment of the present application, analysis from the perspective of the rule group can effectively evaluate the hit status of security rules, providing a basis for managing the security rule base.

[0111] In one embodiment, the event data includes event time, source address, and rule identifier. As shown in FIG. 5 , the process of determining a rule group set based on the security event data set and a preset time window size in step S401 may include the following steps S501-S504:

[0112] Step S501: Determine a plurality of time windows according to the event time of each security event in the security event data set and the size of the time window.

[0113] The starting time of the first time window is determined according to the event time of each security event in the security event data set; and multiple time windows are determined according to the starting time of the first time window and the time window size.

[0114] For example, arrange the event times of all security events in chronological order, then determine the earliest event time as the start time of the first time window, time1. Based on the start time of the first time window, time1, and the time window size, time_window, determine the end time of the first time window, time2 = time1 + time_window. The first time window is then represented as (time1, time2). The end time of the first time window is used as the start time of the second time window. Based on the start time and time window size of the second time window, the end time of the second time window can be determined. Multiple time windows can be determined in this way.

[0115] Step S502 : For each time window, extract the security events within the time window from the security event data set, and divide the extracted security events according to the source address and the rule identifier to obtain an initial event group set.

[0116] The initial event group set includes multiple initial event groups, and each initial event group includes multiple security events with the same source address and the same rule identifier.

[0117] For each time window, we first extract the security events within the time window from the security event data set based on the event time. We then divide these extracted security events into multiple initial event groups based on the source address and rule identifier. These initial event groups are then combined to form an initial event group set. Table 3 shows the initial event group set for the first time window.

[0118] Table 3

[0119] Step S503: Filter the initial event group set to obtain a target event group set corresponding to the time window.

[0120] The target event group set includes multiple target event groups, and each target event group includes multiple rule groups divided according to source addresses.

[0121] When the network security system performs security detection, false alarms may occur. Therefore, after determining the initial event group set, it is possible to determine whether there is a false alarm based on the response code, and then filter the initial event group set based on the false alarm situation, and determine the target event group set based on the filtered initial event group set.

[0122] Referring to Table 4, the target event group set event_group {event_group1, event_group2, event_group3...} of the first time window is shown. The target event group sets of other time windows can be determined by sliding the time window in accordance with the above method.

[0123] Table 4

[0124] Step S504 : merging target event group sets corresponding to multiple time windows according to the source addresses to obtain a rule group set.

[0125] After determining the target event group set corresponding to each time window, the target event group sets corresponding to multiple time windows are merged to obtain a rule group set.

[0126] For example, if a source address IP in time window 1 exists in time window 2, the target event group set of time window 1 and the target event group set of time window 2 are merged to form a rule group; and the total number of events after the merger is the sum of the total number of events of the two target event group sets. If a source address in time window 1 does not exist in time window 2, the target event group set of time window 1 is directly used as a rule group. By analogy, multiple rule groups are obtained, and a rule group set is composed of multiple rule groups, as shown in Table 2 in the above embodiment.

[0127] In the above embodiment, multiple time windows are determined based on the event time and time window size of each security event in the security event data set; for each time window, the security events within the time window are extracted from the security event data set, and the extracted security events are divided according to the source address and rule identifier to obtain an initial event group set; the initial event group set is filtered to obtain a target event group set corresponding to the time window; the target event group sets corresponding to multiple time windows are merged according to the source address to obtain a rule group set. The embodiment of the present application uses a sliding window method to group security events. The amount of calculation for each time window is small, and the calculation of multiple time windows can be performed in parallel. Therefore, the grouping speed and efficiency can be improved, thereby improving the adaptive adjustment efficiency of the security rule base.

[0128] In one embodiment, as shown in FIG6 , the process of filtering the initial event group in step S503 to obtain a target event group set corresponding to the time window may include the following steps S601-S602:

[0129] Step S601 : normalize each initial event group according to the number of events to obtain event group parameters of each initial event group.

[0130] The event group parameter represents the proportion of successful request events in the initial event group. As you can understand, a larger event group parameter indicates a higher proportion of successful request events in the initial event group and fewer false positives; a smaller event group parameter indicates a lower proportion of successful request events in the initial event group and more false positives.

[0131] When filtering the initial event group, the number of successful request events in the initial event group may be determined first, and then normalized based on the number of successful request events and the number of events in the initial event group to obtain event group parameters of the initial event group.

[0132] Optionally, the normalization process in step S601 may include the following steps S6011-S6013:

[0133] Step S6011: normalize the number of events in the initial event group and a preset constant to obtain the normalized number of events, as shown in formula (3):

[0134] Wherein, cnt_n is the normalized number of events, cnt is the number of events in the initial event group, and MAX_cnt is a preset constant. Optionally, the preset constant MAX_cnt is 20.

[0135] According to the above formula (3), the smaller value is first selected from the number of events in the initial event group and the preset constant, and then the ratio of the smaller value to the preset constant is calculated to obtain the normalized number of events.

[0136] Step S6012: performing normalization processing based on the number of events in the initial event group and the number of requested successful events to obtain a normalized number of successful events.

[0137] The number of successful request events in the initial event group is determined based on the response code, and then the ratio of the number of successful request events to the number of events in the initial event group is calculated to obtain the normalized number of successful events. Optionally, the first digit of the response code for a successful request event is 2, for example, response codes 201, 202, 203, etc.

[0138] Considering that the number of events in the initial event group may be 0, the normalized number of successful events can be determined using formula (4), as follows:

[0139] Where sreq_n is the normalized number of successful events, sreq is the number of requested successful events, and cnt is the number of events in the initial event group.

[0140] Step S6013: determining event group parameters of the initial event group according to the normalized number of events and the normalized number of successful events.

[0141] The ratio between the normalized number of successful events and the normalized number of events is calculated to obtain the event group parameters of the initial event group, as shown in formula (5):

[0142] Where k is the event group parameter, cnt_n is the normalized number of events, and sreq_n is the normalized number of successful events.

[0143] Step S602 : filtering the initial event group set according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set.

[0144] For each initial event group, the event group parameter of the initial event group is compared with the preset event threshold, and whether to filter the initial event group is determined according to the comparison result; then, the target event group set is formed by the initial event groups that are not filtered out.

[0145] Optionally, the filtering process may include: for each initial event group in the initial event group set, if the event group parameter is less than a preset event threshold, filtering the initial event group; and obtaining the target event group set based on the initial event groups not filtered out in the initial event group set.

[0146] For example, the preset event threshold is 3. If the event parameter of the initial event group is less than 3, it indicates that the initial event group has fewer successful request events and more false alarm events. Therefore, the initial event group is filtered out.

[0147] In the above embodiment, each initial event group is normalized according to the number of events to obtain the event group parameters of each initial event group; and the initial event group set is filtered according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set. In the embodiment of the present application, the event group parameters are obtained by normalizing the number of events in combination with the response code, which can effectively filter out event groups with many false alarm events, thereby reducing the impact of false alarm time on the activity parameter and improving the accuracy of the activity parameter.

[0148] In one embodiment, the process of determining the above-mentioned global maximum activity set includes: sending the local activity set to the preset server, so that the preset server can determine the global maximum activity of each security rule based on multiple local activity sets, and the global maximum activity of multiple security rules is composed of the global maximum activity set; receiving the global activity set fed back by the preset server.

[0149] The preset server may be the management server in FIG1 .

[0150] After determining the local activity set for each network, the network server on each network sends it to the pre-defined server. After obtaining the local activity sets for multiple networks, the pre-defined server determines the local activity for each security rule across the multiple networks and selects the maximum local activity as the global maximum activity. The global maximum activity for each security rule is then combined to form the global maximum activity.

[0151] The management server feeds back the global activity set to the network server of each network, so that the network server can determine the activity parameter of each security rule according to the global maximum activity set.

[0152] In the above embodiment, the local activity set is sent to a preset server, which determines the global maximum activity of each security rule based on multiple local activity sets, and the global maximum activity set is composed of the global maximum activity of multiple security rules; and the global activity set fed back by the preset server is received. In the embodiment of the present application, obtaining the global maximum activity set can consider the hit situation of the security rule in the event of a local security rule miss, thereby integrating the environmental differences of different networks and improving the effectiveness and comprehensiveness of the activity parameters of the security rule.

[0153] In one embodiment, as shown in FIG. 7 , the process of controlling the activation or deactivation of each security rule in the security rule library according to the activity parameter of each security rule in step S203 may include the following steps S701-S702:

[0154] Step S701 : determining the activation probability of each security rule based on the activity parameter and the operation load data of the network security system.

[0155] The operation load data may include at least one of CPU utilization, memory utilization, and packet loss rate. The activation probability is used to represent the probability of the security rule being activated.

[0156] Operational load data affects the detection efficiency of the network security system. In practical applications, the activation probability of each security rule is calculated by combining the activity parameters of the security rules and the operational load data of the network security system. It can be understood that the smaller the operational load data, the more security rules allowed to be enabled in the security rule base, and the higher the calculated activation probability; while the larger the operational load data, the fewer security rules enabled in the security rule base, and the lower the calculated activation probability.

[0157] Step S702: Control each security rule in the security rule library to be turned on or off according to the activation probability of each security rule.

[0158] For each security rule in the security rule library, if the activation probability of the security rule is greater than or equal to the preset probability threshold, control the security rule to be activated; if the activation probability of the security rule is less than the preset probability threshold, control the security rule to be deactivated.

[0159] In one embodiment, obtain the random numbers of each security rule; according to the random numbers and the activation probabilities of each security rule, control each security rule to be activated or deactivated, as shown in formula (6):

[0160] Where, v is the state of the security rule, v = 0 indicates that the security rule is controlled to be deactivated, and v = 1 indicates that the security rule is controlled to be activated; RAND(0, 1) is a random number between 0 and 1, and y is the activation probability of the security rule.

[0161] In the above embodiment, according to the activity parameter and the operation load data of the network security system, determine the activation probability of each security rule; according to the activation probability of each security rule, control each security rule in the security rule library to be activated or deactivated. The embodiment of the present application sets the activation probability for each security rule in combination with the operation load situation of the network security system, which can achieve the adaptive adjustment of the security rule library under different allowable load conditions, thereby improving the detection efficiency of the network security system.

[0162] In one embodiment, as shown in FIG. 8, it relates to the process of determining the activation probability of each security rule according to the activity parameter and the operation load data in the above step S701. The embodiment of the present application may include the following steps S801-S803:

[0163] Step S801, determine the target load interval where the operation load data is located from a preset plurality of load intervals.

[0164] Pre-set a plurality of load intervals, and determine the corresponding target load interval according to the operation load data.

[0165] For example, set the operation load thresholds (0 < xa < 1) and thresholds (xa < xb < 1), and divide 3 load intervals according to the operation load thresholds: [0, xa], (xa, xb], (xb, 1]. Optionally, xa = 0.5, xb = 0.9. Determine the load interval where the operation load data x is located as the target load interval.

[0166] Among them, the operation load data can be collected according to a pre-set collection period. Optionally, the collection period is 10 minutes, that is, the operation load data is collected every 10 minutes.

[0167] Step S802, for each security rule in the security rule library, determine the rule category of the security rule according to the activity parameter.

[0168] The rule category can also represent the number of security rule hits. In practice, rule categories are arranged from most to least frequently hit, and may include active rules, silent rules, dormant rules, and sleeping rules. It should be noted that rule categories are not limited to the ones described above and may include other categories.

[0169] For each security rule in the security rule library, after determining the activity parameter of the security rule, the rule category of the security rule can be determined according to the preset activity threshold, sleep threshold and activity parameter.

[0170] For example, the active threshold is t1, and the sleep threshold is t2, where t1>t21; 1) when the activity parameter wi>t1, the rule category of the security rule is determined to be an active rule; 2) when the activity parameter t1>wi>t2, the rule category of the security rule is determined to be a silent rule; 3) when the activity parameter t2>wi>0, the rule category of the security rule is determined to be a sleep rule; 4) when the activity parameter wi=0, the rule category of the security rule is determined to be a dormant rule. Optionally, t1=100 and t2=10.

[0171] Step S803 , determining the activation probability of each safety rule according to the operating load data, the category parameter corresponding to the rule category of the safety rule, and the preset relationship corresponding to the target load range.

[0172] For different load ranges, different preset relationships can be used to determine the probability of activation of safety rules, as shown in formula (7):

[0173] Where f1(w) and f2(w) are category parameters corresponding to the rule category of the security rule. The values ​​of f1(w) and f2(w) are different for different rule categories.

[0174] For example, for active rules, that is, when the activity parameter wi of the security rule is greater than t1, f1(w) = 1, f2(w) = 0.8; for silent rules, that is, when the activity parameter t1>wi>t2 of the security rule, f1(w) = 0.8, f2(w) = 0.5; for sleeping rules, that is, when the activity parameter t2>wi>0 of the security rule, f1(w) = 0.5, f2(w) = 0; for dormant rules, that is, when the activity parameter wi of the security rule is equal to 0, f1(w) = 0, f2(w) = 0.

[0175] According to Formula 7, the opening probability curve shown in FIG9 can be obtained.

[0176] It should be noted that, in practical applications, the preset relationship for determining the opening probability is not limited to the linear relationship of formula (7) above, and other nonlinear relationships may also be used.

[0177] In the above embodiment, the target load interval where the operating load data is located is determined from a plurality of preset load intervals; for each security rule in the security rule library, the rule category of the security rule is determined based on the activity parameter; and the activation probability of each security rule is determined based on the operating load data, the category parameter corresponding to the rule category of the security rule, and the preset relationship corresponding to the target load interval. The embodiment of the present application sets different activation probabilities for different categories of security rules in combination with the operating load conditions of the network security system. By differentially setting the rule activation probabilities, adaptive adjustment of different security rules under different operating load conditions can be achieved, thereby improving the application efficiency of security rules and the detection efficiency of the network security system.

[0178] In one embodiment, a security rule base management method is provided. The method is described by taking the network server in FIG1 as an example, and the method may include the following steps:

[0179] Step 1: Obtain a security event data set.

[0180] The security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period. The event data includes at least one of event time, source address, rule identifier, and response code.

[0181] Step 2: Determine the start time of the first time window according to the event time of each security event in the security event data set; and determine multiple time windows according to the start time of the first time window and the time window size.

[0182] Step 3: For each time window, extract the security events within the time window from the security event data set, and divide the extracted security events according to the source address and rule identifier to obtain an initial event group set.

[0183] The initial event group set includes multiple initial event groups, and each initial event group includes multiple security events with the same source address and the same rule identifier.

[0184] Step 4: Normalize the number of events in the initial event group and a preset constant to obtain a normalized number of events; normalize the number of events in the initial event group and the number of successfully requested events to obtain a normalized number of successful events; determine the event group parameters of the initial event group based on the normalized number of events and the normalized number of successful events.

[0185] Step 5: For each initial event group in the initial event group set, if the event group parameter is less than a preset event threshold, the initial event group is filtered; and the target event group set is obtained based on the initial event groups that are not filtered out in the initial event group set.

[0186] Step 6: Merge target event group sets corresponding to multiple time windows according to source addresses to obtain a rule group set.

[0187] Step 7: Determine the local activity of each security rule based on the total number of events of the target rule group to which each security rule belongs, and form a local activity set based on the local activities of multiple security rules.

[0188] Step 8: Send the local activity set to the preset server, so that the preset server can determine the global maximum activity of each security rule based on multiple local activity sets, and form a global maximum activity set by the global maximum activity of multiple security rules; receive the global activity set fed back by the preset server.

[0189] Step 9: Determine the activity parameters of each security rule based on the pre-acquired historical activity set, local activity set, and global maximum activity set.

[0190] Step 10: Determine the target load interval where the operating load data is located from multiple preset load intervals; for each security rule in the security rule library, determine the rule category of the security rule based on the activity parameter; determine the activation probability of each security rule based on the preset relationship between the operating load data, the category parameters corresponding to the rule category of the security rule, and the target load interval.

[0191] Step 11, obtain the random number of each security rule; control the opening or closing of each security rule according to the random number and the opening probability of each security rule.

[0192] It should be understood that, although the various steps in the above flow chart are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the above flow chart may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0193] In one embodiment, as shown in FIG10 , a security rule base management device is provided, including:

[0194] The data acquisition module 901 is used to acquire a security event data set; wherein the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period;

[0195] An activity determination module 902 is configured to determine an activity parameter of each security rule in a security rule library based on a set of security event data;

[0196] The rule base management module 903 is used to control the opening or closing of each security rule in the security rule base according to the activity parameter of each security rule.

[0197] In one embodiment, the activity determination module 902 is specifically used to determine a local activity set and a global maximum activity set based on a security event data set; the local activity set includes the local activity of each security rule, and the global maximum activity set includes the global maximum activity of each security rule; the activity parameters of each security rule are determined based on the pre-acquired historical activity set, local activity set and global maximum activity set.

[0198] In one embodiment, the activity determination module 902 is specifically used to determine a rule group set based on a security event data set and a preset time window size; the rule group set includes multiple rule groups, each rule group includes multiple security rules; based on the total number of events of the target rule group to which each security rule belongs, the local activity of each security rule is determined, and the local activity set is composed of the local activities of multiple security rules.

[0199] In one embodiment, event data includes event time, source address and rule identifier; the activity determination module 902 is specifically used to determine multiple time windows based on the event time and time window size of each security event in the security event data set; for each time window, the security events within the time window are extracted from the security event data set, and the extracted security events are divided according to the source address and rule identifier to obtain an initial event group set; the initial event group set includes multiple initial event groups, and each initial event group includes multiple security events with the same source address and the same rule identifier; the initial event group set is filtered to obtain a target event group set corresponding to the time window; the target event group set includes multiple target event groups, and each target event group includes multiple rule groups divided according to the source address; the target event group sets corresponding to multiple time windows are merged according to the source address to obtain a rule group set.

[0200] In one embodiment, the activity determination module 902 is specifically used to normalize each initial event group according to the number of events to obtain the event group parameters of each initial event group; filter the initial event group set according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set.

[0201] In one embodiment, the activity determination module 902 is specifically used to perform normalization processing based on the number of events in the initial event group and a preset constant to obtain a normalized number of events; perform normalization processing based on the number of events in the initial event group and the number of events of successful request events to obtain a normalized number of successful events; and determine the event group parameters of the initial event group based on the normalized number of events and the normalized number of successful events.

[0202] In one embodiment, the activity determination module 902 is specifically configured to filter each initial event group in the initial event group set if the event group parameter is less than a preset event threshold; and obtain a target event group set based on the initial event groups that are not filtered in the initial event group set.

[0203] In one embodiment, the activity determination module 902 is specifically used to determine the start time of the first time window based on the event time of each security event in the security event data set; and determine multiple time windows based on the start time of the first time window and the time window size.

[0204] In one embodiment, the activity determination module 902 is specifically used to send the local activity set to the preset server, so that the preset server can determine the global maximum activity of each security rule based on multiple local activity sets, and form a global maximum activity set by the global maximum activities of multiple security rules; and receive the global activity set fed back by the preset server.

[0205] In one embodiment, the rule base management module 903 is specifically used to determine the activation probability of each security rule based on the activity parameter and the operating load data of the network security system; and control the activation or deactivation of each security rule in the security rule base based on the activation probability of each security rule.

[0206] In one embodiment, the rule base management module 903 is specifically used to determine the target load interval where the operating load data is located from a plurality of preset load intervals; for each security rule in the security rule base, the rule category of the security rule is determined according to the activity parameter; and the activation probability of each security rule is determined according to the operating load data, the category parameter corresponding to the rule category of the security rule, and the preset relationship formula corresponding to the target load interval.

[0207] In one embodiment, the rule base management module 903 is specifically used to obtain a random number corresponding to each security rule; and control each security rule to be turned on or off according to the random number and the activation probability of each security rule.

[0208] The specific definition of the security rule base management device can be found in the definition of the security rule base management method above and will not be repeated here. The various modules in the above-mentioned security rule base management device can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0209] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in Figure 11. The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, memory, and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store security rule base management data. The I / O interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a security rule base management method.

[0210] In one embodiment, a computer-readable storage medium is further provided, on which a computer program is stored. The computer program can be executed by a processor of a server to perform the above method. The storage medium can be a non-transitory computer-readable storage medium, for example, a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0211] In one embodiment, a computer program product is also provided. When executed by a processor, the computer program can implement the above method. The computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, part or all of the above method can be implemented in whole or in part according to the process or functions described in the embodiments of the present disclosure.

[0212] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0213] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0214] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A security rule base management method, comprising: Acquire a security event data set, wherein the security event data set includes event data of a plurality of security events detected by the network security system based on a security rule base within a preset historical period; Determining an activity parameter of each security rule in the security rule base based on the security event data set; According to the activity parameter of each security rule, each security rule in the security rule library is controlled to be turned on or off.

2. The method according to claim 1, wherein determining the activity parameter of each security rule in the security rule base based on the security event data set comprises: Determine a local activity set and a global maximum activity set based on the security event data set, the local activity set including the local activity of each of the security rules, and the global maximum activity set including the global maximum activity of each of the security rules; The activity parameter of each of the security rules is determined according to the pre-acquired historical activity set, the local activity set and the global maximum activity set.

3. The method according to claim 2, wherein determining a local activity set based on the security event data set comprises: Determine a rule group set based on the security event data set and a preset time window size, wherein the rule group set includes multiple rule groups, and each rule group includes multiple security rules; The local activity of each of the security rules is determined according to the total number of events of the target rule group to which each of the security rules belongs, and the local activity set is composed of the local activities of multiple security rules.

4. The method according to claim 3, wherein the event data includes event time, source address and rule identifier, and the determining the rule group set based on the security event data set and a preset time window size includes: Determining a plurality of time windows according to the event time of each security event in the security event data set and the size of the time window; For each of the time windows, extract the security events within the time windows from the security event data set, and divide the extracted security events according to the source address and the rule identifier to obtain an initial event group set, wherein the initial event group set includes multiple initial event groups, and each of the initial event groups includes multiple security events with the same source address and the same rule identifier; Filtering the initial event group set to obtain a target event group set corresponding to the time window, wherein the target event group set includes a plurality of target event groups, each of the target event groups includes a plurality of rule groups divided according to source addresses; The target event group sets corresponding to the multiple time windows are merged according to the source address to obtain the rule group set.

5. The method according to claim 4, wherein filtering the initial event group to obtain the target event group set corresponding to the time window comprises: Normalizing each of the initial event groups according to the number of events to obtain event group parameters of each of the initial event groups; The initial event group set is filtered according to the event group parameters of each of the initial event groups and a preset event threshold to obtain the target event group set.

6. The method according to claim 5, wherein the step of normalizing each of the initial event groups according to the number of events to obtain event group parameters of each of the initial event groups comprises: Performing normalization processing according to the event quantity of the initial event group and a preset constant to obtain a normalized event quantity; Performing normalization processing according to the number of events in the initial event group and the number of events of the requested successful events to obtain a normalized number of successful events; An event group parameter of the initial event group is determined according to the normalized event number and the normalized successful event number.

7. The method according to claim 5, wherein filtering the initial event group set according to the event group parameters of each of the initial event groups and the preset event threshold to obtain the target event group set comprises: For each of the initial event groups in the initial event group set, if an event group parameter of the initial event group is less than the preset event threshold, filtering the initial event group; The target event group set is obtained according to the initial event groups that are not filtered out in the initial event group set.

8. The method according to claim 6, wherein the determining of a plurality of time windows according to the event time of each security event in the security event data set and the size of the time window comprises: Determining the start time of the first time window according to the event time of each security event in the security event data set; The multiple time windows are determined according to the start time of the first time window and the size of the time window.

9. The method according to claim 2, wherein the step of determining the global maximum activity set comprises: Sending the local activity set to a preset server, so that the preset server determines the global maximum activity of each of the security rules according to the multiple local activity sets, and the global maximum activity of the multiple security rules forms the global maximum activity set; Receive the global activity set fed back by the preset server.

10. The method according to any one of claims 1 to 9, wherein controlling each of the security rules in the security rule library to be turned on or off according to the activity parameter of each of the security rules comprises: Determining the activation probability of each of the security rules according to the activity parameter and the operation load data of the network security system; According to the activation probability of each of the security rules, each of the security rules in the security rule library is controlled to be activated or deactivated.

11. The method according to claim 10, wherein determining the activation probability of each of the security rules according to the activity parameter and the operation load data of the network security system comprises: Determining a target load interval where the operating load data is located from a plurality of preset load intervals; For each security rule in the security rule base, determining a rule category of the security rule according to the activity parameter; The activation probability of each of the safety rules is determined according to the operating load data, the category parameter corresponding to the rule category of the safety rule, and the preset relationship corresponding to the target load interval.

12. The method according to claim 11, wherein the controlling the opening or closing of each of the security rules in the security rule library according to the opening probability of each of the security rules comprises: Obtaining a random number corresponding to each of the security rules; According to the random number and the opening probability of each security rule, each security rule is controlled to be opened or closed.

13. A security rule base management device, comprising: A data acquisition module, used to acquire a security event data set, wherein the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period; An activity determination module, configured to determine an activity parameter of each security rule in the security rule base based on the security event data set; The rule base management module is used to control the opening or closing of each security rule in the security rule base according to the activity parameter of each security rule.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein the processor implements the steps of the method according to any one of claims 1 to 12 when executing the computer program.

15. A computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the method according to any one of claims 1 to 12 when executed by a processor.

Images