WO2024021479A1 - 一种报文检测方法、装置、电子设备及存储介质 - Google Patents

一种报文检测方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2024021479A1
WO2024021479A1 PCT/CN2022/141580 CN2022141580W WO2024021479A1 WO 2024021479 A1 WO2024021479 A1 WO 2024021479A1 CN 2022141580 W CN2022141580 W CN 2022141580W WO 2024021479 A1 WO2024021479 A1 WO 2024021479A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
message
malicious
malicious transmission
packet
Prior art date
Application number
PCT/CN2022/141580
Other languages
English (en)
French (fr)
Inventor
吴静勇
向祖庭
唐荣生
韩旺
兰培挺
王晓华
Original Assignee
天翼云科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天翼云科技有限公司 filed Critical 天翼云科技有限公司
Publication of WO2024021479A1 publication Critical patent/WO2024021479A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • Embodiments of the present application relate to the field of network security technology, and in particular to a message detection method, device, electronic equipment and storage medium.
  • the basic principle of common firewall packet detection is to first classify the existing signature library according to the application layer protocol, and then build a detection engine respectively. When receiving the packet to be detected, identify the application layer protocol of the packet to be detected, and enter The corresponding detection engine performs feature matching on the packet to be detected. If it matches, it is determined that the packet to be detected is a malicious packet. Otherwise, it is determined that the packet to be detected is not a malicious packet.
  • the creators of malicious traffic will use a variety of means to hide it, such as customizing some private application layer protocols, and at the same time unpacking the packets with characteristics and splitting them into several small packets of random length. As a result, a single message no longer has complete characteristics.
  • the firewall cannot identify the application layer protocol and can only perform packet detection based on the transport layer protocol. After the packets are split, a single packet no longer has the characteristics of malicious traffic, so it will be The firewall considers the packet to be a normal packet and lets it pass.
  • embodiments of the present application provide a packet detection method, device, electronic device and storage medium, which can solve the problem of malicious traffic characteristics being split into multiple packets and bypassing the firewall. , improve the detection accuracy of malicious packets.
  • embodiments of the present application provide a message detection method, including:
  • message detection is performed on the target message according to the detection engine corresponding to the transport layer protocol and transmission direction of the target message.
  • the message detection method after receiving the message to be detected and obtaining at least one historical message received previously, can determine from at least one historical message that the message to be detected has the same traffic information target historical packets, and splice the packet to be detected with the target historical packet to obtain the target packet. If the application layer protocol corresponding to the target packet cannot be identified, the target packet will be detected based on the transport layer protocol and transmission direction of the target packet.
  • the corresponding detection engine performs packet detection on the target packets. After receiving the message to be detected, the message to be detected is first spliced with the previously received message with the same traffic information, and then the spliced message is detected. This can solve the problem of malicious traffic characteristics being blocked.
  • the transport layer protocol and transmission layer of the packet can be The detection engine corresponding to the direction detects the packet, improves the detection speed of packet detection, and further improves the detection accuracy.
  • performing packet detection on the target packet according to the detection engine corresponding to the transport layer protocol and transmission direction of the target packet includes:
  • each malicious transmission rule includes multiple malicious transmission characteristics
  • For each malicious transmission rule determine one malicious transmission characteristic from the plurality of malicious transmission characteristics as the first malicious transmission characteristic
  • the target message is determined based on other malicious transmission characteristics in each target malicious transmission rule except the first malicious transmission characteristic.
  • the target packet is detected and the target detection result of the target packet relative to each target malicious transmission rule is determined.
  • At least one malicious transmission rule under the detection engine corresponding to the transport layer protocol and transmission direction of the target message can be obtained.
  • a malicious transmission characteristic is determined from multiple malicious transmission characteristics as first malicious transmission characteristic, and detect the target packet according to the first malicious transmission characteristic of each malicious transmission rule, and determine the initial detection result of the target packet relative to each malicious transmission rule. If the target packet is determined based on the initial detection result, If the message initially meets at least one target malicious transmission rule, the target message will be detected based on other malicious transmission characteristics in each target malicious transmission rule except the first malicious transmission characteristic, and the target message will be determined to be more malicious than each target. Transport rule's target detection results.
  • the target packet is first detected through a malicious transmission feature in each malicious transmission rule included under the detection engine. , determine whether the target packet initially meets one or more malicious transmission rules, and after determining that the target packet initially meets the malicious transmission rules, further detect the target packet through other malicious transmission characteristics in the malicious transmission rule, so as to It can improve the detection speed and detection accuracy of packet detection.
  • the target packet is detected according to the first malicious transmission characteristic of each malicious transmission rule, and the initial detection result of the target packet relative to each malicious transmission rule is determined.
  • the target packet is matched and detected to determine the matching result of each first malicious transmission characteristic and the target packet; the AC state machine uses a multi-mode matching AC algorithm to determine the matching result of each malicious transmission according to the multi-mode matching AC algorithm.
  • the first malicious transmission characteristic of the rule is generated;
  • each first malicious transmission characteristic fails to match the target packet, determine that the target packet is a normal packet relative to the initial detection result of each malicious transmission rule;
  • the initial detection result relative to each target malicious transmission rule is preliminary compliance with the target malicious transmission rule.
  • the AC state machine generated according to the first malicious transmission characteristic of each malicious transmission rule through the multi-mode matching AC algorithm can be first obtained, and then the target packet is matched and detected based on the generated AC state machine to determine The matching result of each first malicious transmission characteristic and the target packet. If the matching of each first malicious transmission characteristic and the target packet fails, the initial detection result of the target packet relative to each malicious transmission rule is determined to be a normal packet. message, if at least one first malicious transmission feature successfully matches the target message, then determine the target malicious transmission rule corresponding to the first malicious transmission feature matching the target message, and determine the target message relative to each target malicious transmission rule The initial detection result is that it initially complies with the target malicious transmission rules.
  • the target packet When detecting a target packet through a malicious transmission feature in a malicious transmission rule, the target packet can be detected by constructing an AC state machine based on a malicious transmission feature in each malicious transmission rule, which can improve The detection speed of packet detection, and based on the malicious transmission characteristics matched by the accurately detected target packet, determine that the target packet is a normal packet or initially meets the malicious transmission rules.
  • performing matching detection on the target packet based on the AC state machine and determining the matching result of each first malicious transmission characteristic and the target packet includes:
  • the matching result of each first malicious transmission characteristic and the target message is determined.
  • the end status and the number of detected bytes obtained by detecting the target historical message through the AC state machine can be obtained.
  • the undetected characters corresponding to the target message are determined according to the number of detected bytes.
  • the undetected starting position in the string, and the string to be detected is searched from the undetected starting position according to the end status, and the target matching the string to be detected is determined from the string corresponding to the first malicious transmission feature string, and determines the matching result of each first malicious transmission characteristic and the target message based on the target malicious transmission characteristics corresponding to the target string.
  • the end status obtained from the last detection of the historical packet and the number of detected bytes can be input into the AC state machine at the same time, thus avoiding the need to detect the target packet. Perform repeated detection to improve the detection speed and detection performance of packet detection.
  • the target message is detected based on other malicious transmission characteristics in each target malicious transmission rule except the first malicious transmission characteristic, and the target message is determined.
  • This article provides target detection results for each target malicious transmission rule, including:
  • the other malicious transmission characteristics corresponding to each target malicious transmission rule include other malicious transmission characteristics that fail to match the target message, it is determined that the target detection result corresponding to the target message is a normal message.
  • the other malicious transmission features in the target malicious transmission rule except the first malicious transmission feature are matched with the target packet respectively. If the other malicious transmission features are matched with the target packet, If all the messages are matched successfully, it is determined that the target detection result corresponding to the target message is a malicious message. If there are other malicious transmission characteristics corresponding to each target malicious transmission rule that fail to match the target message, it is determined that The target detection result corresponding to the target packet is a normal packet. After it is determined that the target packet initially complies with the target malicious transmission rules, the target packet still needs to be detected based on other malicious transmission characteristics in the target malicious transmission rules to determine whether the target packet is a malicious packet, which can improve reporting accuracy. The accuracy of the text detection.
  • the method further includes:
  • the target message is detected according to a plurality of malicious application characteristics included in the at least one malicious application rule to determine whether the target message is a malicious message.
  • the application layer protocol corresponding to the target message is identified, at least one malicious application rule under the detection engine corresponding to the application layer protocol is obtained, and based on multiple malicious application characteristics included in the at least one malicious application rule , detect the target packet and determine whether the target packet is a malicious packet.
  • the target packet can be detected according to the malicious application rules under the application layer protocol, thereby improving the detection accuracy of the packet detection.
  • embodiments of the present application also provide a message detection device, including:
  • a message receiving unit used to receive the message to be detected and obtain at least one historical message received previously;
  • a message splicing unit configured to determine, from the at least one historical message, a target historical message that has the same traffic information as the message to be detected, and combine the message to be detected with the target historical message. Perform splicing to obtain the target message;
  • a message detection unit used to detect the target message according to the detection engine corresponding to the transport layer protocol and transmission direction of the target message if the application layer protocol corresponding to the target message cannot be identified. detection.
  • the message detection unit is specifically used to:
  • each malicious transmission rule includes multiple malicious transmission characteristics
  • For each malicious transmission rule determine one malicious transmission characteristic from the plurality of malicious transmission characteristics as the first malicious transmission characteristic
  • the target message is determined based on other malicious transmission characteristics in each target malicious transmission rule except the first malicious transmission characteristic.
  • the target packet is detected and the target detection result of the target packet relative to each target malicious transmission rule is determined.
  • the message detection unit is also used to:
  • the target packet is matched and detected to determine the matching result of each first malicious transmission characteristic and the target packet; the AC state machine uses a multi-mode matching AC algorithm to determine the matching result of each malicious transmission according to the multi-mode matching AC algorithm.
  • the first malicious transmission characteristic of the rule is generated;
  • each first malicious transmission characteristic fails to match the target packet, determine that the target packet is a normal packet relative to the initial detection result of each malicious transmission rule;
  • the initial detection result relative to each target malicious transmission rule is preliminary compliance with the target malicious transmission rule.
  • the message detection unit is also used to:
  • the matching result of each first malicious transmission characteristic and the target message is determined.
  • the message detection unit is also used to:
  • the other malicious transmission characteristics corresponding to each target malicious transmission rule include other malicious transmission characteristics that fail to match the target message, it is determined that the target detection result corresponding to the target message is a normal message.
  • the message detection unit is also used to:
  • the target message is detected according to a plurality of malicious application characteristics included in the at least one malicious application rule to determine whether the target message is a malicious message.
  • embodiments of the present application further provide a computer-readable storage medium.
  • a computer program is stored in the computer-readable storage medium.
  • the message detection of the first aspect is implemented. method.
  • embodiments of the present application further provide an electronic device, including a memory and a processor.
  • the memory stores a computer program that can run on the processor.
  • the processor When executed, the processor is caused to implement the packet detection method of the first aspect.
  • Figure 1 is a schematic diagram of adding a transmission direction field to a feature library provided by an embodiment of the present application
  • Figure 2 is a schematic diagram of a feature library grouping construction detection engine provided by an embodiment of the present application
  • Figure 3 is a flow chart of a message detection method provided by an embodiment of the present application.
  • Figure 4 is a flow chart of packet detection by a transport layer packet detection engine provided by an embodiment of the present application
  • Figure 5 is a flow chart for determining initial detection results provided by an embodiment of the present application.
  • Figure 6 is a flow chart of an AC state machine performing matching detection on target packets provided by an embodiment of the present application
  • Figure 7 is a flow chart for determining target detection results provided by an embodiment of the present application.
  • Figure 8 is a flow chart of another message detection method provided by an embodiment of the present application.
  • Figure 9 is a schematic structural diagram of a message detection device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the existing signature databases are first grouped according to the transport layer protocol and transmission direction to obtain signature database groups. Among them, the existing signature database contains all characteristics that may identify the packet as a malicious packet. After the feature database is grouped, a detection engine is built based on each feature database group, so that when detecting the packet, the packet can be sent to the corresponding constructed detection engine for detection to determine whether the packet is A malicious message.
  • the transport layer protocol may include TCP protocol, UDP protocol, etc.
  • the transmission direction may include client to server and server to client.
  • the feature library is first designed to add a transmission direction field.
  • a transmission direction field can be added to the feature database in the manner shown in Figure 1.
  • tcp in Figure 1 is the TCP protocol in the transport layer protocol
  • the transmission direction corresponding to to_client in Figure 1 is from the server to the client
  • the transmission direction corresponding to to_server in Figure 1 is from the client to the server.
  • the feature library is parsed, the feature library is grouped according to the transport layer protocol and transmission direction field of each feature, and respective detection engines are constructed for the grouped feature libraries.
  • the feature library can be grouped and the detection engine can be built as shown in Figure 2.
  • the transport layer protocols include TCP protocol, UDP protocol and other protocols
  • the transmission direction includes client to server (toserver) and server to client (toclient).
  • the feature library can be divided into TCP protocol_server to client (tcp_toclient) group, TCP protocol_client to server (toserver) group, UDP protocol_server to client (udp_toclient) ) group, UDP protocol_client to server (udp_toserver) group, other protocol_server to client (other protocol_toclient) group and other protocol_client to server (other protocol_toserver) group.
  • the characteristics can be further divided into application layer characteristics and non-application layer characteristics according to whether the characteristics contain application layer protocols. And within each group, the corresponding application layer detection engine is constructed according to the application layer characteristics, and the corresponding transport layer detection engine is constructed according to the non-application layer characteristics.
  • the packets can be detected using the built detection engine.
  • the embodiment of the present application provides a message detection method, as shown in Figure 3, including the following steps:
  • Step S301 Receive the message to be detected and obtain at least one historical message received previously.
  • At least one historical message received before receiving the message to be detected is obtained.
  • Step S302 Determine a target historical packet with the same traffic information as the packet to be detected from at least one historical packet, and splice the packet to be detected and the target historical packet to obtain the target packet.
  • the traffic information corresponding to the packet to be detected can be searched based on the five-tuple of the packet to be detected.
  • the five-tuple of the packet to be detected includes protocol type, source IP address, source port, destination IP address, and destination port.
  • the target historical packet with the same traffic information as the packet to be detected can be determined from at least one historical packet, and the determined target historical packet and the packet to be detected can be compared
  • the files are spliced together to obtain the target message.
  • multiple packets of the same flow can be cached and reorganized, and each time a received packet to be detected is spliced with previously received packets of the same flow before detection. Then detect the spliced packets.
  • the target history with the same traffic information as the message to be detected cannot be determined from at least one historical message received previously.
  • the message to be detected can be used as the target message.
  • Step S303 If the application layer protocol corresponding to the target packet cannot be identified, packet detection is performed on the target packet based on the transport layer protocol of the target packet and the detection engine corresponding to the transmission direction.
  • the target message After obtaining the target message, first perform transport layer protocol identification and transmission direction identification on the target message. After identifying the transport layer protocol and transmission direction of the target message, then perform application layer protocol identification on the target message. If it cannot After identifying the application layer protocol corresponding to the target packet, the target packet can be detected according to the detection engine corresponding to the transport layer protocol and transmission direction of the target packet.
  • the transport layer protocol can be TCP protocol and UDP protocol
  • the transmission direction can be client to server and server to client.
  • the detection engine corresponding to the TCP protocol and the client to the server is the first detection engine
  • the detection engine corresponding to the TCP protocol and the server to the client is the second detection engine
  • the detection engine corresponding to the UDP protocol and the client to the server is the third detection engine
  • the detection engine corresponding to the UDP protocol and the server to the client is the fourth detection engine.
  • a third detection engine can be used to detect the target packet. Perform message detection on the message.
  • the process shown in Figure 4 can be followed to perform packet detection on the target packet according to the transport layer protocol of the target packet and the detection engine corresponding to the transmission direction. As shown in Figure 4, it includes the following steps:
  • Step S401 Obtain at least one malicious transmission rule under the detection engine corresponding to the transport layer protocol and transmission direction of the target message.
  • Each malicious transmission rule includes multiple malicious transmission characteristics.
  • Step S402 For each malicious transmission rule, determine one malicious transmission feature from multiple malicious transmission features as the first malicious transmission feature.
  • one malicious transmission feature can be selected from multiple malicious transmission features included in the malicious transmission rule according to the set selection rule, and the malicious transmission feature can be used as the first malicious transmission feature.
  • Step S403 Detect the target packet according to the first malicious transmission characteristic of each malicious transmission rule, and determine the initial detection result of the target packet relative to each malicious transmission rule.
  • the initial detection result of the target packet relative to each malicious transmission rule can be determined through the process shown in Figure 5. As shown in Figure 5, it includes the following steps:
  • Step S4031 Perform matching detection on the target packet based on the AC state machine to determine the matching result of each first malicious transmission characteristic and the target packet.
  • the AC state machine is generated based on the first malicious transmission characteristic of each malicious transmission rule through the multi-pattern matching AC algorithm.
  • the multi-pattern matching (Aho-Corasick, AC) algorithm is a multi-pattern matching string search algorithm. Its core idea is to first generate an AC state machine based on multiple pattern strings, and the string to be detected is used as the input of the AC state machine. , scan the string to be detected once, and you can get all matching pattern strings.
  • Each time the stateless AC algorithm searches for a string to be detected it starts from the initial state of the AC state machine.
  • Each detection of the current string to be detected is an independent detection, different from the last string to be detected. has nothing to do with the matching results. If the first half of a pattern string is in the previous string to be detected and the second half is in the next string to be detected, then neither of the two strings to be detected will be able to match the pattern string, thus Causing false negatives from the detection engine. If the last string to be detected is used as input when detecting the current string to be detected, two searches will be performed for the last string to be detected and the detection will be repeated, resulting in a decrease in the performance of the detection engine.
  • the embodiment of this application proposes a stateful AC algorithm. Compared with the stateless AC algorithm, the improvements of this stateful AC algorithm are:
  • the input parameters of the AC state machine add two input parameters: one is the end status of the last detection, and the other is the number of bytes that have been detected; when the AC state machine searches for the string to be detected, first Offset according to the number of bytes that have been detected to get the starting position of the string to be detected, and then start running from the end status of the last detection; after the search is completed, record the end status of this detection as the input of the next detection Parameter, record the sum of the number of bytes detected this time and the number of detected bytes entered as the input parameter for the next detection. In this way, searching for multiple strings to be detected is just like searching for one concatenated string to be detected, and at the same time, repeated detection is avoided.
  • the matching result of each first malicious transmission characteristic and the target packet can be determined according to the process shown in FIG. 6 . As shown in Figure 6, it includes the following steps:
  • Step S40311 Obtain the end status and the number of detected bytes obtained by detecting the target historical message through the AC state machine.
  • Step S40312 based on the AC state machine, determine the undetected starting position in the undetected string corresponding to the target message according to the number of detected bytes, and search the undetected string from the undetected starting position according to the end status. From the character string corresponding to the first malicious transmission characteristic, a target character string matching the character string to be detected is determined.
  • the pattern strings generated by the AC state machine are "yes", “her” and “use”
  • the string to be detected is “yesherusewe”
  • the end status obtained by the AC state machine when detecting the target historical packets is 30, and the result is The number of detected bytes is 7, then it can be determined that the undetected starting position in the string to be detected “yesherusewe” is the 8th character "s" in the string to be detected, that is, the string to be detected "yesherusewe”
  • the undetected string in is “sewe", and using state 30 as the starting state, search starting from the "s" position in the undetected string "sewe” to determine the pattern strings "yes” and “her” and “use", the target string that matches the string to be detected “yesherusewe”.
  • Step S40313 Determine the matching result of each first malicious transmission feature and the target message based on the target malicious transmission feature corresponding to the target string.
  • Step S4032 If each first malicious transmission characteristic fails to match the target packet, it is determined that the initial detection result of the target packet relative to each malicious transmission rule is a normal packet.
  • the detection engine corresponding to the transport layer protocol and transmission direction of the target message contains a total of 6 malicious transmission rules 1, 2, 3, 4, 5, and 6.
  • Each malicious transmission rule includes 3 malicious transmissions. feature.
  • the first malicious transmission characteristic determined from malicious transmission rule 1 is characteristic A
  • the first malicious transmission characteristic determined from malicious transmission rule 2 is characteristic B
  • the first malicious transmission characteristic determined from malicious transmission rule 3 is characteristic C.
  • the first malicious transmission feature determined from malicious transmission rule 4 is feature D
  • the first malicious transmission feature determined from malicious transmission rule 5 is feature E
  • the first malicious transmission feature determined from malicious transmission rule 6 is Feature F.
  • the AC state machine it is determined that feature A, feature B, feature C, feature D, feature E, and feature F all fail to match the target packet, and the target packet can be determined to be a normal packet.
  • Step S4033 if at least one first malicious transmission feature successfully matches the target message, determine the target malicious transmission rule corresponding to the first malicious transmission feature matching the target message, and determine the target malicious transmission rule for each target message.
  • the initial detection result of the rule is preliminary compliance with the target malicious transmission rule.
  • the detection engine corresponding to the transport layer protocol and transmission direction of the target message contains a total of 6 malicious transmission rules 1, 2, 3, 4, 5, and 6.
  • Each malicious transmission rule includes 3 malicious transmissions. feature.
  • Step S404 if it is determined based on the initial detection results that the target packet initially meets at least one target malicious transmission rule, then detect the target packet according to other malicious transmission characteristics in each target malicious transmission rule except the first malicious transmission characteristic. , determine the target detection results of the target packet relative to each target malicious transmission rule.
  • the target detection result of the target message relative to each malicious transmission rule can be determined through the process shown in Figure 7. As shown in Figure 7, it includes the following steps:
  • Step S4041 For each target malicious transmission rule, match other malicious transmission features in the target malicious transmission rule except the first malicious transmission feature with the target message respectively.
  • Step S4042 If other malicious transmission characteristics and the target packet are successfully matched, it is determined that the target detection result corresponding to the target packet is a malicious packet.
  • the target malicious transmission rules are 1, 2, and 3.
  • the target malicious transmission rule 1 also includes malicious transmission feature B and malicious transmission feature C;
  • the target malicious transmission rule 2 includes in addition to the first malicious transmission feature A.
  • the malicious transmission feature D also includes the malicious transmission feature E and the malicious transmission feature F; in addition to the first malicious transmission feature G, the target malicious transmission rule 3 also includes the malicious transmission feature H and the malicious transmission feature I.
  • the target message can be determined to be a malicious message; or, when the malicious transmission characteristic H and the malicious transmission characteristic I are determined to match the target message successfully, the target message can be determined to be a malicious message.
  • the target packet is a malicious packet.
  • Step S4043 If the other malicious transmission characteristics corresponding to each target malicious transmission rule include other malicious transmission characteristics that fail to match the target message, it is determined that the target detection result corresponding to the target message is a normal message.
  • the target malicious transmission rules are 1, 2, and 3.
  • the target malicious transmission rule 1 also includes malicious transmission feature B and malicious transmission feature C;
  • the target malicious transmission rule 2 includes in addition to the first malicious transmission feature A.
  • the malicious transmission feature D also includes the malicious transmission feature E and the malicious transmission feature F;
  • the target malicious transmission rule 3 also includes the malicious transmission feature H and the malicious transmission feature I.
  • the target can be determined.
  • the message is a normal message.
  • a target historical message with the same traffic information as the message to be detected from at least one previously received historical message and splice the message to be detected and the target historical message to obtain the target message.
  • the application layer protocol corresponding to the target message is identified, at least one malicious application rule under the detection engine corresponding to the application layer protocol is obtained, and based on the multiple malicious application characteristics included in the at least one malicious application rule, Detect the target packets to determine whether they are malicious packets.
  • One malicious application feature is determined as the target malicious application feature among the multiple malicious application features included.
  • the target packet is determined to be a normal packet. If the target malicious application feature of at least one target malicious application rule in at least one malicious application rule successfully matches the target message, then for each target malicious application rule, the target malicious application rule except the target malicious application feature is Other malicious application characteristics are matched with the target packet respectively. If the other malicious application characteristics in the target malicious application rule match the target packet successfully, the target packet can be determined to be a malicious packet. If each target malicious application If there are other malicious application characteristics corresponding to the rule that fail to match the target packet, it can be determined that the target packet is a normal packet.
  • the message detection method provided in the embodiments of this application can also be implemented according to the process shown in Figure 8. As shown in Figure 8, it includes the following steps:
  • Step S801 Receive the message to be detected, and search the traffic information corresponding to the message to be detected according to the five-tuple of the message to be detected.
  • Step S802 Splice the message to be detected and the previously received target historical message with the same traffic information as the message to be detected, to obtain the target message.
  • Step S803 Whether the application layer protocol corresponding to the target message is identified; if not, execute step S804; if yes, execute step S812.
  • Step S804 Obtain at least one malicious transmission rule under the detection engine corresponding to the transport layer protocol and transmission direction of the target message, and determine one malicious transmission characteristic as the first malicious transmission characteristic from the multiple malicious transmission characteristics included in each malicious transmission rule. transmission characteristics.
  • Step S805 Perform matching detection on the target packet based on the AC state machine.
  • the AC state machine is generated based on the first malicious transmission characteristic of each malicious transmission rule through the multi-pattern matching AC algorithm.
  • the specific process of performing matching detection on the target packet based on the AC state machine and determining the matching result of the first malicious transmission characteristic of each malicious transmission rule and the target packet can be seen in Figure 6, and this embodiment will not be described in detail here.
  • Step S806 Determine whether the first malicious transmission characteristic of each malicious transmission rule fails to match the target packet; if yes, execute step S807; if not, execute step S808.
  • Step S807 determine that the target packet is a normal packet.
  • Step S808 Determine at least one target malicious transmission rule whose first malicious transmission characteristic successfully matches the target message from at least one malicious transmission rule.
  • Step S809 Match other malicious transmission features in each target malicious transmission rule except the first malicious transmission feature with the target message respectively.
  • Step S810 Determine whether other malicious transmission characteristics corresponding to each target malicious transmission rule include other malicious transmission characteristics that fail to match the target message; if yes, execute step S807; if not, execute step S811.
  • Step S811 determine that the target packet is a malicious packet.
  • Step S812 Obtain at least one malicious application rule under the detection engine corresponding to the application layer protocol, and determine one malicious application feature as a target malicious application feature from multiple malicious application features included in each malicious application rule.
  • Step S813 Match the target malicious application characteristics in each malicious application rule with the target packet.
  • Step S814 Determine whether the target malicious application characteristics of each malicious application rule and the target packet fail to match; if yes, execute step S807; if not, execute step S815.
  • Step S815 Determine at least one target malicious application rule whose characteristics of the target malicious application successfully match the target message from the at least one malicious application rule.
  • Step S816 Match other malicious application features in each target malicious application rule except the first malicious application feature with the target message respectively.
  • Step S817 Determine whether other malicious application features corresponding to each target malicious application rule include other malicious application features that fail to match the target message; if yes, execute step S807; if not, execute step S811.
  • This application provides a message detection method that can solve the problem of being unable to identify the application layer protocol of the received message and the malicious traffic characteristics being split into multiple messages to bypass the firewall.
  • detecting the received message Before detecting the packet, first splice the packet with the previously received packet of the same flow, and then detect the spliced packet.
  • the detection engine uses the stateful AC Algorithm, that is, while inputting the packet into the AC state machine, the end status of the last detection and the number of detected bytes are also input into the AC state machine to perform matching detection on the packet, thereby avoiding repeated detection of the packet. , improve the detection speed and detection accuracy of packet detection, and also avoid the performance degradation of the detection engine.
  • the message detection method provided in the embodiment of the present application can group the existing feature library according to the transport layer protocol and transmission direction to construct multiple smaller sub-engines, and through the grouped features
  • the library constructs and generates its own transport layer packet detection sub-engine respectively.
  • Each transport layer packet detection sub-engine contains its own AC state machine with status, which can improve the detection speed of the detection engine.
  • embodiments of the present application also provide a message detection device. Since this device is a device corresponding to the message detection method of the present application, and the principle of solving problems of this device is similar to that of this method, the implementation of this device can be referred to the implementation of the above method, and repeated details will not be repeated.
  • Figure 9 shows a schematic structural diagram of a message detection device provided by an embodiment of the present application.
  • the message detection device includes a message receiving unit 901, a message splicing unit 902 and a message detecting unit 903 .
  • the message receiving unit 901 is used to receive the message to be detected and obtain at least one historical message received previously;
  • the message splicing unit 902 is used to determine from at least one historical message a target historical message that has the same traffic information as the message to be detected, and splice the message to be detected and the target historical message to obtain the target message. ;
  • the packet detection unit 903 is used to perform packet detection on the target packet based on the detection engine corresponding to the transport layer protocol and transmission direction of the target packet if the application layer protocol corresponding to the target packet cannot be identified.
  • the message detection unit 903 is specifically used to:
  • each malicious transmission rule includes multiple malicious transmission characteristics
  • For each malicious transmission rule determine one malicious transmission feature from multiple malicious transmission features as the first malicious transmission feature
  • the target packet will be detected based on other malicious transmission characteristics in each target malicious transmission rule except the first malicious transmission characteristic, and the target will be determined.
  • Target detection results of packets relative to each target malicious transmission rule If it is determined based on the initial detection results that the target packet initially meets at least one target malicious transmission rule, the target packet will be detected based on other malicious transmission characteristics in each target malicious transmission rule except the first malicious transmission characteristic, and the target will be determined. Target detection results of packets relative to each target malicious transmission rule.
  • the message detection unit 903 is also used to:
  • the target packet is matched and detected to determine the matching result of each first malicious transmission characteristic and the target packet; the AC state machine uses the multi-mode matching AC algorithm to determine the first malicious transmission according to each malicious transmission rule. Characteristically generated;
  • the initial detection result of the target packet relative to each malicious transmission rule is determined to be a normal packet
  • the target malicious transmission rule corresponding to the first malicious transmission feature matching the target message is determined, and the initial value of the target message relative to each target malicious transmission rule is determined.
  • the detection result is that it initially complies with the target malicious transmission rules.
  • the message detection unit 903 is also used to:
  • the AC state machine Based on the AC state machine, determine the undetected starting position in the undetected string corresponding to the target message based on the number of detected bytes, and search the undetected string from the undetected starting position based on the end status, starting from the first Among the strings corresponding to the malicious transmission characteristics, determine the target string that matches the string to be detected;
  • the matching result of each first malicious transmission characteristic and the target message is determined.
  • the message detection unit 903 is also used to:
  • the target detection result corresponding to the target packet is determined to be a malicious packet
  • the target detection result corresponding to the target packet is determined to be a normal packet.
  • the message detection unit 903 is also used to:
  • the embodiment of the present application also provides an electronic device.
  • This electronic device can be used for message detection.
  • the structure of the electronic device may be as shown in Figure 10, including a memory 1001 and one or more processors 1002.
  • Memory 1001 is used to store computer programs executed by processor 1002.
  • the memory 1001 may mainly include a program storage area and a data storage area.
  • the program storage area may store the operating system and programs required to run instant messaging functions.
  • the storage data area may store various instant messaging information and operating instruction sets.
  • the memory 1001 may be a volatile memory (volatile memory), such as a random-access memory (RAM); the memory 1001 may also be a non-volatile memory (non-volatile memory), such as read-only memory, flash memory, hard disk drive (HDD) or solid-state drive (SSD), or the memory 1001 can be used to carry or store instructions or data. Without limitation, any other medium that may be in the form of the desired program code and capable of being accessed by a computer.
  • the memory 1001 may be a combination of the above memories.
  • Processor 1002 may include one or more central processing units (central processing units). processing unit (CPU) or digital processing unit, etc.
  • CPU central processing unit
  • the processor 1002 is configured to implement the above message detection method when calling the computer program stored in the memory 1001.
  • the specific connection medium between the above-mentioned memory 1001 and the processor 1002 is not limited in the embodiment of the present application.
  • the memory 1001 and the processor 1002 are connected through a bus 1003 in Figure 10.
  • the bus 1003 is represented by a thick line in Figure 10.
  • the connection between other components is only a schematic explanation and does not It is limited.
  • the bus 1003 can be divided into an address bus, a data bus, a control bus, etc. For ease of presentation, only one thick line is used in Figure 10, but it does not mean that there is only one bus or one type of bus.
  • a computer program product or computer program includes computer instructions stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the message detection method in the above embodiment.
  • the Program Product may take the form of one or more readable media in any combination.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供一种报文检测方法、装置、电子设备及存储介质，涉及网络安全技术领域。在接收待检测报文，并获取之前接收到的至少一个历史报文之后，可以从至少一个历史报文中确定出与待检测报文具有相同流量信息的目标历史报文，并将待检测报文与目标历史报文进行拼接，获得目标报文，若无法识别出目标报文对应的应用层协议，则根据目标报文的传输层协议和传输方向对应的检测引擎，对目标报文进行报文检测。由于在对报文进行检测前，可以将报文与之前接收到的具有相同流量信息的报文进行拼接后再进行检测，从而可以解决恶意流量特征被拆分到多个报文中而绕过防火墙的问题，提高对报文进行检测的准确率。

Description

一种报文检测方法、装置、电子设备及存储介质 技术领域
本申请实施例涉及网络安全技术领域，尤其涉及一种报文检测方法、装置、电子设备及存储介质。
 背景技术
互联网中的恶意流量泛滥，攻击手段层出不穷，时刻威胁着网络中的用户。常见的防火墙报文检测的基本原理是先将已有的特征库按照应用层协议分类，然后分别构建检测引擎，当收到待检测报文时，识别待检测报文的应用层协议，并进入相应的检测引擎对待检测报文进行特征匹配，如果匹配，则确定待检测报文是恶意报文，否则，确定待检测不是恶意报文。
 技术问题
为了躲避防火墙的检测，恶意流量的制造者会使用多种手段进行隐藏，比如自定义一些私有应用层协议，同时对带有特征的报文进行拆包，拆分成若干个长度随机的小包，使得单个报文中不再具有完整的特征。当这些恶意报文到达防火墙后，防火墙无法识别出应用层协议，只能根据传输层协议做报文检测，而报文经过拆分后，单个报文已经不具备恶意流量的特征，因此会被防火墙认为是正常报文而放过。
 技术解决方案
为解决现有存在的技术问题，本申请实施例提供了一种报文检测方法、装置、电子设备及存储介质，可以解决恶意流量特征被拆分到多个报文中而绕过防火墙的问题，提高对恶意报文的检测准确率。
为达到上述目的，本申请实施例的技术方案是这样实现的：
第一方面，本申请实施例提供一种报文检测方法，包括：
接收待检测报文，并获取之前接收到的至少一个历史报文；
从所述至少一个历史报文中确定出与所述待检测报文具有相同流量信息的目标历史报文，并将所述待检测报文与所述目标历史报文进行拼接，获得目标报文；
若无法识别出所述目标报文对应的应用层协议，则根据所述目标报文的传输层协议和传输方向对应的检测引擎，对所述目标报文进行报文检测。
本申请实施例提供的报文检测方法，在接收待检测报文，并获取之前接收到的至少一个历史报文之后，可以从至少一个历史报文中确定出与待检测报文具有相同流量信息的目标历史报文，并将待检测报文与目标历史报文进行拼接，获得目标报文，若无法识别出目标报文对应的应用层协议，则根据目标报文的传输层协议和传输方向对应的检测引擎，对目标报文进行报文检测。由于在接收到待检测报文后，先将待检测报文与之前接收到的具有相同流量信息的报文进行拼接，再对拼接后的报文进行报文检测，从而可以解决恶意流量特征被拆分到多个报文中而绕过防火墙的问题，提高对报文进行检测的准确率，同时，在无法识别出报文对应的应用层协议时，可以根据报文的传输层协议和传输方向对应的检测引擎对报文进行检测，提高对报文进行检测的检测速度，并进一步提高检测准确率。
在一种可选的实施例中，所述根据所述目标报文的传输层协议和传输方向对应的检测引擎，对所述目标报文进行报文检测，包括：
获取所述目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则，其中每个恶意传输规则包括多个恶意传输特征；
对于每个恶意传输规则，从所述多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征；
根据每个恶意传输规则的第一恶意传输特征对所述目标报文进行检测，确定所述目标报文相对于每个恶意传输规则的初始检测结果；
若基于所述初始检测结果确定所述目标报文初步符合至少一个目标恶意传输规则，则根据每个目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，对所述目标报文进行检测，确定所述目标报文相对于每个目标恶意传输规则的目标检测结果。
在该实施例中，可以获取目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则，对于每个恶意传输规则，从多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征，并根据每个恶意传输规则的第一恶意传输特征对目标报文进行检测，确定目标报文相对于每个恶意传输规则的初始检测结果，若基于初始检测结果确定目标报文初步符合至少一个目标恶意传输规则，则根据每个目标恶意传输规则中除第一恶意传输特征之外的其他恶意传输特征，对目标报文进行检测，确定目标报文相对于每个目标恶意传输规则的目标检测结果。由于在通过传输层协议和传输方向对应的检测引擎，对目标报文进行报文检测时，是先通过该检测引擎下包括的每个恶意传输规则中的一个恶意传输特征对目标报文进行检测，确定目标报文是否初步符合一个或多个恶意传输规则，且在确定目标报文初步符合恶意传输规则后，再通过该恶意传输规则中的其他恶意传输特征对目标报文进行进一步检测，从而可以提高对报文进行检测的检测速度和检测准确率。
在一种可选的实施例中，所述根据每个恶意传输规则的第一恶意传输特征对所述目标报文进行检测，确定所述目标报文相对于每个恶意传输规则的初始检测结果，包括：
基于AC状态机对所述目标报文进行匹配检测，确定每个第一恶意传输特征与所述目标报文的匹配结果；所述AC状态机是通过多模式匹配AC算法，根据每个恶意传输规则的第一恶意传输特征生成的；
若每个第一恶意传输特征与所述目标报文均匹配失败，则确定所述目标报文相对于每个恶意传输规则的初始检测结果为正常报文；
若至少一个所述第一恶意传输特征与所述目标报文匹配成功，则确定与所述目标报文匹配的所述第一恶意传输特征对应的目标恶意传输规则，并确定所述目标报文相对于每个目标恶意传输规则的初始检测结果为初步符合所述目标恶意传输规则。
在该实施例中，可以先获取通过多模式匹配AC算法，根据每个恶意传输规则的第一恶意传输特征生成的AC状态机，然后基于生成的AC状态机对目标报文进行匹配检测，确定每个第一恶意传输特征与目标报文的匹配结果，若每个第一恶意传输特征与目标报文均匹配失败，则确定目标报文相对于每个恶意传输规则的初始检测结果为正常报文，若至少一个第一恶意传输特征与目标报文匹配成功，则确定与目标报文匹配的第一恶意传输特征对应的目标恶意传输规则，并确定目标报文相对于每个目标恶意传输规则的初始检测结果为初步符合目标恶意传输规则。由于在通过恶意传输规则中的一个恶意传输特征对目标报文进行检测时，可以通过根据每个恶意传输规则中的一个恶意传输特征构建生成的AC状态机对目标报文进行检测，从而可以提高对报文进行检测的检测速度，以及根据准确检测出的目标报文所匹配的恶意传输特征，进而确定目标报文为正常报文或初步符合恶意传输规则。
在一种可选的实施例中，所述基于AC状态机对所述目标报文进行匹配检测，确定每个第一恶意传输特征与所述目标报文的匹配结果，包括：
获取通过AC状态机对所述目标历史报文进行检测获得的结束状态和已检测字节数；
基于所述AC状态机，根据所述已检测字节数确定所述目标报文对应的待检测字符串中的未检测起始位置，并根据所述结束状态从所述未检测起始位置处对所述待检测字符串进行查找，从所述第一恶意传输特征对应的字符串中，确定出与所述待检测字符串相匹配的目标字符串；
根据所述目标字符串对应的目标恶意传输特征，确定每个第一恶意传输特征与所述目标报文的匹配结果。
在该实施例中，可以获取通过AC状态机对目标历史报文进行检测获得的结束状态和已检测字节数，基于AC状态机，根据已检测字节数确定目标报文对应的待检测字符串中的未检测起始位置，并根据结束状态从未检测起始位置处对待检测字符串进行查找，从第一恶意传输特征对应的字符串中，确定出与待检测字符串相匹配的目标字符串，根据目标字符串对应的目标恶意传输特征，确定每个第一恶意传输特征与目标报文的匹配结果。由于在通过AC状态机对目标报文进行检测时，可以同时将上次对历史报文进行检测获得的结束状态和已检测字节数一起输入到AC状态机中，从而可以避免对目标报文进行重复检测，提高对报文进行检测的检测速度和检测性能。
在一种可选的实施例中，所述根据每个目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，对所述目标报文进行检测，确定所述目标报文相对于每个目标恶意传输规则的目标检测结果，包括：
对于每个目标恶意传输规则，将所述目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，分别与所述目标报文进行匹配；
若所述其他恶意传输特征与所述目标报文均匹配成功，则确定所述目标报文对应的目标检测结果为恶意报文；
若每个目标恶意传输规则对应的所述其他恶意传输特征中都有与所述目标报文匹配失败的其他恶意传输特征，则确定所述目标报文对应的目标检测结果为正常报文。
在该实施例中，对于每个目标恶意传输规则，将目标恶意传输规则中除第一恶意传输特征之外的其他恶意传输特征，分别与目标报文进行匹配，若其他恶意传输特征与目标报文均匹配成功，则确定目标报文对应的目标检测结果为恶意报文，若每个目标恶意传输规则对应的其他恶意传输特征中都有与目标报文匹配失败的其他恶意传输特征，则确定目标报文对应的目标检测结果为正常报文。由于在确定目标报文初步符合目标恶意传输规则后，还需要根据目标恶意传输规则中的其他恶意传输特征对目标报文进行检测，以确定目标报文是否为恶意报文，从而可以提高对报文进行检测的准确率。
在一种可选的实施例中，所述获得目标报文之后，所述方法还包括：
若识别出所述目标报文对应的应用层协议，则获取所述应用层协议对应的检测引擎下的至少一个恶意应用规则；
根据所述至少一个恶意应用规则中包括的多个恶意应用特征，对所述目标报文进行检测，确定所述目标报文是否为恶意报文。
在该实施例中，若识别出目标报文对应的应用层协议，则获取应用层协议对应的检测引擎下的至少一个恶意应用规则，并根据至少一个恶意应用规则中包括的多个恶意应用特征，对目标报文进行检测，确定目标报文是否为恶意报文。由于在识别出目标报文对应的应用层协议时，可以根据该应用层协议下的恶意应用规则对目标报文进行报文检测，从而可以提高对报文进行检测的检测准确率。
第二方面，本申请实施例还提供了一种报文检测装置，包括：
报文接收单元，用于接收待检测报文，并获取之前接收到的至少一个历史报文；
报文拼接单元，用于从所述至少一个历史报文中确定出与所述待检测报文具有相同流量信息的目标历史报文，并将所述待检测报文与所述目标历史报文进行拼接，获得目标报文；
报文检测单元，用于若无法识别出所述目标报文对应的应用层协议，则根据所述目标报文的传输层协议和传输方向对应的检测引擎，对所述目标报文进行报文检测。
在一种可选的实施例中，所述报文检测单元，具体用于：
获取所述目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则，其中每个恶意传输规则包括多个恶意传输特征；
对于每个恶意传输规则，从所述多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征；
根据每个恶意传输规则的第一恶意传输特征对所述目标报文进行检测，确定所述目标报文相对于每个恶意传输规则的初始检测结果；
若基于所述初始检测结果确定所述目标报文初步符合至少一个目标恶意传输规则，则根据每个目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，对所述目标报文进行检测，确定所述目标报文相对于每个目标恶意传输规则的目标检测结果。
在一种可选的实施例中，所述报文检测单元，还用于：
基于AC状态机对所述目标报文进行匹配检测，确定每个第一恶意传输特征与所述目标报文的匹配结果；所述AC状态机是通过多模式匹配AC算法，根据每个恶意传输规则的第一恶意传输特征生成的；
若每个第一恶意传输特征与所述目标报文均匹配失败，则确定所述目标报文相对于每个恶意传输规则的初始检测结果为正常报文；
若至少一个所述第一恶意传输特征与所述目标报文匹配成功，则确定与所述目标报文匹配的所述第一恶意传输特征对应的目标恶意传输规则，并确定所述目标报文相对于每个目标恶意传输规则的初始检测结果为初步符合所述目标恶意传输规则。
在一种可选的实施例中，所述报文检测单元，还用于：
获取通过AC状态机对所述目标历史报文进行检测获得的结束状态和已检测字节数；
基于所述AC状态机，根据所述已检测字节数确定所述目标报文对应的待检测字符串中的未检测起始位置，并根据所述结束状态从所述未检测起始位置处对所述待检测字符串进行查找，从所述第一恶意传输特征对应的字符串中，确定出与所述待检测字符串相匹配的目标字符串；
根据所述目标字符串对应的目标恶意传输特征，确定每个第一恶意传输特征与所述目标报文的匹配结果。
在一种可选的实施例中，所述报文检测单元，还用于：
对于每个目标恶意传输规则，将所述目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，分别与所述目标报文进行匹配；
若所述其他恶意传输特征与所述目标报文均匹配成功，则确定所述目标报文对应的目标检测结果为恶意报文；
若每个目标恶意传输规则对应的所述其他恶意传输特征中都有与所述目标报文匹配失败的其他恶意传输特征，则确定所述目标报文对应的目标检测结果为正常报文。
在一种可选的实施例中，所述报文检测单元，还用于：
若识别出所述目标报文对应的应用层协议，则获取所述应用层协议对应的检测引擎下的至少一个恶意应用规则；
根据所述至少一个恶意应用规则中包括的多个恶意应用特征，对所述目标报文进行检测，确定所述目标报文是否为恶意报文。
第三方面，本申请实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时，实现第一方面的报文检测方法。
第四方面，本申请实施例还提供了一种电子设备，包括存储器和处理器，所述存储器上存储有可在所述处理器上运行的计算机程序，当所述计算机程序被所述处理器执行时，使得所述处理器实现第一方面的报文检测方法。
第二方面至第四方面中任意一种实现方式所带来的技术效果可参见第一方面中对应的实现方式所带来的技术效果，此处不再赘述。
 附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种特征库增加传输方向字段的示意图；
图2为本申请实施例提供的一种特征库分组构建检测引擎的示意图；
图3为本申请实施例提供的一种报文检测方法的流程图；
图4为本申请实施例提供的一种传输层报文检测引擎进行报文检测的流程图；
图5为本申请实施例提供的一种确定初始检测结果的流程图；
图6为本申请实施例提供的一种AC状态机对目标报文进行匹配检测的流程图；
图7为本申请实施例提供的一种确定目标检测结果的流程图；
图8为本申请实施例提供的另一种报文检测方法的流程图；
图9为本申请实施例提供的一种报文检测装置的结构示意图；
图10为本申请实施例提供的一种电子设备的结构示意图。
 本发明的实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。
需要说明的是，本申请的文件中涉及的术语“包括”和“具有”以及它们的变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
下面将结合附图，对本申请实施例提供的技术方案进行详细说明。
下文中所用的词语“示例性”的意思为“用作例子、实施例或说明性”。作为“示例性”所说明的任何实施例不必解释为优于或好于其它实施例。在本申请实施例的描述中，除非 另有说明，“多个”的含义是两个或两个以上。
在进行报文检测之前，首先根据传输层协议和传输方向，对已有的特征库进行分组，得到特征库分组。其中，已有的特征库中包含有所有可能识别出报文为恶意报文的特征。在对特征库进行分组后，再根据每个特征库分组构建检测引擎，以使在对报文进行检测时，可以将报文送入相应的构建好的检测引擎中进行检测，确定报文是否为恶意报文。
其中，传输层协议可以包括TCP协议和UDP协议等，传输方向可以包括客户端到服务端和服务端到客户端。
具体地，先对特征库进行特征设计，增加传输方向字段。示例性地，可以按照如图1所示的方式，对特征库增加传输方向字段。其中，图1中的tcp为传输层协议中的TCP协议，图1中的to_client对应的传输方向为服务端到客户端，图1中的to_server对应的传输方向为客户端到服务端。
在特征库增加传输方向字段后，解析特征库，根据每条特征的传输层协议和传输方向字段对特征库分组，并对分好组的特征库分别构建各自的检测引擎。
示例性地，可以按照如图2所示的方式，对特征库分组并构建检测引擎。如图2所示，传输层协议包括TCP协议、UDP协议和其他协议，传输方向包括客户端到服务端（toserver）和服务端到客户端（toclient）。根据传输层协议和传输方向，可以将特征库分为TCP协议_服务端到客户端（tcp_toclient）分组、TCP协议_客户端到服务端（toserver）分组、UDP协议_服务端到客户端（udp_toclient）分组、UDP协议_客户端到服务端（udp_toserver）分组、其他协议_服务端到客户端（其他协议_toclient）分组和其他协议_客户端到服务端（其他协议_toserver）分组。
在每个分组内，根据特征是否包含应用层协议，可以将进一步地将特征分为应用层特征和无应用层特征。并在每个分组内，根据应用层特征构建相应的应用层检测引擎，根据无应用层特征构建相应的传输层检测引擎。
在对特征库分组构建检测引擎后，可以通过构建的检测引擎对报文进行检测。具体地，本申请实施例提供了一种报文检测方法，如图3所示，包括如下步骤：
步骤S301，接收待检测报文，并获取之前接收到的至少一个历史报文。
在接收到待检测报文的同时获取到在接收待检测报文之前所接收到的至少一个历史报文。
步骤S302，从至少一个历史报文中确定出与待检测报文具有相同流量信息的目标历史报文，并将待检测报文与目标历史报文进行拼接，获得目标报文。
在接收到待检测报文后，可以根据待检测报文的五元组查找待检测报文对应的流量信息。其中，待检测报文的五元组包括协议类型、源IP地址、源端口、目的IP地址和目的端口。
根据每个历史报文分别对应的流量信息，可以从至少一个历史报文中确定出与待检测报文具有相同流量信息的目标历史报文，并将确定出的目标历史报文与待检测报文进行拼接，获得目标报文。
具体地，可以对同一条流的多个报文进行缓存和重组，每次在对接收到的待检测报文进行检测前，均将其与之前接收到的同一条流的报文进行拼接，再对拼接后的报文进行检测。
可选的，在接收到待检测报文后，若根据待检测报文对应的流量信息，从之前接收到的至少一个历史报文中无法确定出与待检测报文具有相同流量信息的目标历史报文，则可以将待检测报文作为目标报文。
步骤S303，若无法识别出目标报文对应的应用层协议，则根据目标报文的传输层协议和传输方向对应的检测引擎，对目标报文进行报文检测。
在获得目标报文后，首先对目标报文进行传输层协议识别和传输方向识别，在识别出目标报文的传输层协议和传输方向后，再对目标报文进行应用层协议识别，若无法识别出目标报文对应的应用层协议，则可以根据目标报文的传输层协议和传输方向对应的检测引擎，对目标报文进行报文检测。
例如，传输层协议可以为TCP协议和UDP协议，传输方向可以为客户端到服务端和服务端到客户端。其中，TCP协议和客户端到服务端对应的检测引擎为第一检测引擎，TCP协议和服务端到客户端对应的检测引擎为第二检测引擎，UDP协议和客户端到服务端对应的检测引擎为第三检测引擎，UDP协议和服务端到客户端对应的检测引擎为第四检测引擎。假设识别出目标报文的传输层协议为UDP协议，目标报文的传输方向为客户端到服务端，且无法识别出目标报文对应的应用层协议，则可以采用第三检测引擎对目标报文进行报文检测。
具体地，可以按照图4中示出的过程，根据目标报文的传输层协议和传输方向对应的检测引擎，对目标报文进行报文检测。如图4所示，包括如下步骤：
步骤S401，获取目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则。
其中，每个恶意传输规则包括多个恶意传输特征。
步骤S402，对于每个恶意传输规则，从多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征。
对于每个恶意传输规则，可以按照设定的选取规则，从该恶意传输规则包括的多个恶意传输特征中选取出一个恶意传输特征，并将该恶意传输特征作为第一恶意传输特征。
步骤S403，根据每个恶意传输规则的第一恶意传输特征对目标报文进行检测，确定目标报文相对于每个恶意传输规则的初始检测结果。
其中，目标报文相对于每个恶意传输规则的初始检测结果可以通过图5中示出的过程进行确定。如图5所示，包括如下步骤：
步骤S4031，基于AC状态机对目标报文进行匹配检测，确定每个第一恶意传输特征与目标报文的匹配结果。
其中，AC状态机是通过多模式匹配AC算法，根据每个恶意传输规则的第一恶意传输特征生成的。
多模式匹配（Aho-Corasick，AC）算法是一种多模匹配字符串查找算法，其核心思想是先根据多个模式字符串生成一个AC状态机，待检测字符串作为该AC状态机的输入，扫描一次待检测字符串，便能得到所有匹配的模式字符串。
无状态的AC算法每次查找待检测字符串时，都是从AC状态机的初始状态开始运转，每次对当前待检测字符串的检测都是一次独立的检测，与上次待检测字符串的匹配结果无关，如果某个模式字符串的前半部分在前一个待检测字符串，后半部分在后一个待检测字符串，那么这两个待检测字符串都无法匹配该模式字符串，从而导致检测引擎漏报。如果检测当前待检测字符串时，把上次待检测字符串一并作为输入进行检测，那么就会对上次待检测字符串执行两次查找，重复检测，从而导致检测引擎的性能下降。
因此，本申请实施例提出一种带状态的AC算法，该带状态的AC算法相比于无状态的AC算法，改进点在于：
AC状态机的输入参数除了待检测字符串之外，增加两个输入参数：一个是上一次检测的结束状态，一个是已检测的字节数；AC状态机对待检测字符串进行查找时，先根据已检测的字节数进行偏移，得到待检测字符串的起始位置，然后从上一次检测的结束状态开始运转；查找结束后，记录本次检测的结束状态，作为下次检测的输入参数，记录本次已检测的字节数与输入的已检测字节数之和，作为下次检测的输入参数。如此，对多个待检测字符串的查找就如同对拼接好的一个待检测字符串查找一样，同时也避免了重复检测。
具体地，每个第一恶意传输特征与目标报文的匹配结果可以根据图6中示出的过程来进行确定。如图6所示，包括如下步骤：
步骤S40311，获取通过AC状态机对目标历史报文进行检测获得的结束状态和已检测字节数。
步骤S40312，基于AC状态机，根据已检测字节数确定目标报文对应的待检测字符串中的未检测起始位置，并根据结束状态从未检测起始位置处对待检测字符串进行查找，从第一恶意传输特征对应的字符串中，确定出与待检测字符串相匹配的目标字符串。
例如，生成AC状态机的模式字符串为“yes”、“her”和“use”，待检测字符串为“yesherusewe”，AC状态机对目标历史报文进行检测获得的结束状态为30，获得的已检测字节数为7，则可以确定待检测字符串“yesherusewe”中的未检测起始位置为位于待检测字符串中的第8个字符“s”，即待检测字符串“yesherusewe”中的未检测字符串为“sewe”，并将状态30作为起始状态，从未检测字符串“sewe”中的“s”位置处开始进行查找，确定模式字符串“yes”、“her”和“use”中，与待检测字符串“yesherusewe”相匹配的目标字符串。
步骤S40313，根据目标字符串对应的目标恶意传输特征，确定每个第一恶意传输特征与目标报文的匹配结果。
步骤S4032，若每个第一恶意传输特征与目标报文均匹配失败，则确定目标报文相对于每个恶意传输规则的初始检测结果为正常报文。
例如，目标报文的传输层协议和传输方向对应的检测引擎下包含有1、2、3、4、5、6共6个恶意传输规则，每个恶意传输规则中都包括有3个恶意传输特征。假设从恶意传输规则1中确定的第一恶意传输特征为特征A，从恶意传输规则2中确定的第一恶意传输特征为特征B，从恶意传输规则3中确定的第一恶意传输特征为特征C，从恶意传输规则4中确定的第一恶意传输特征为特征D，从恶意传输规则5中确定的第一恶意传输特征为特征E，从恶意传输规则6中确定的第一恶意传输特征为特征F。通过AC状态机确定特征A、特征B、特征C、特征D、特征E和特征F与目标报文均匹配失败，则可以确定目标报文为正常报文。
步骤S4033，若至少一个第一恶意传输特征与目标报文匹配成功，则确定与目标报文匹配的第一恶意传输特征对应的目标恶意传输规则，并确定目标报文相对于每个目标恶意传输规则的初始检测结果为初步符合目标恶意传输规则。
例如，目标报文的传输层协议和传输方向对应的检测引擎下包含有1、2、3、4、5、6共6个恶意传输规则，每个恶意传输规则中都包括有3个恶意传输特征。在从恶意传输规则1、2、3、4、5、6中确定出特征A、特征B、特征C、特征D、特征E、特征F后，通过AC状态机确定特征A、特征B和特征C与目标报文匹配成功，特征D、特征E和特征F与目标报文匹配失败，则可以确定目标报文分别初步符合恶意传输规则1、恶意传输规则2和恶意传输规则3。
步骤S404，若基于初始检测结果确定目标报文初步符合至少一个目标恶意传输规则，则根据每个目标恶意传输规则中除第一恶意传输特征之外的其他恶意传输特征，对目标报文进行检测，确定目标报文相对于每个目标恶意传输规则的目标检测结果。
其中，目标报文相对于每个恶意传输规则的目标检测结果可以通过图7中示出的过程进行确定。如图7所示，包括如下步骤：
步骤S4041，对于每个目标恶意传输规则，将目标恶意传输规则中除第一恶意传输特征之外的其他恶意传输特征，分别与目标报文进行匹配。
步骤S4042，若其他恶意传输特征与目标报文均匹配成功，则确定目标报文对应的目标检测结果为恶意报文。
例如，目标恶意传输规则为1、2、3，目标恶意传输规则1中除第一恶意传输特征A之外，还包括恶意传输特征B和恶意传输特征C；目标恶意传输规则2中除第一恶意传输特征D之外，还包括恶意传输特征E和恶意传输特征F；目标恶意传输规则3中除第一恶意传输特征G之外，还包括恶意传输特征H和恶意传输特征I。将恶意传输特征B、C、E、F、H、I分别与目标报文进行匹配，当确定恶意传输特征B和恶意传输特征C与目标报文均匹配成功时，可以确定目标报文为恶意报文；或者，当确定恶意传输特征E和恶意传输特征F与目标报文均匹配成功时，可以确定目标报文为恶意报文；或者，当确定恶意传输特征H和恶意传输特征I与目标报文均匹配成功时，可以确定目标报文为恶意报文。
步骤S4043，若每个目标恶意传输规则对应的其他恶意传输特征中都有与目标报文匹配失败的其他恶意传输特征，则确定目标报文对应的目标检测结果为正常报文。
例如，目标恶意传输规则为1、2、3，目标恶意传输规则1中除第一恶意传输特征A之外，还包括恶意传输特征B和恶意传输特征C；目标恶意传输规则2中除第一恶意传输特征D之外，还包括恶意传输特征E和恶意传输特征F；目标恶意传输规则3中除第一恶意传输特征G之外，还包括恶意传输特征H和恶意传输特征I。将恶意传输特征B、C、E、F、H、I分别与目标报文进行匹配，当确定恶意传输特征B和恶意传输特征C中至少存在一个恶意传输特征与目标报文匹配失败，且恶意传输特征E和恶意传输特征F中至少存在一个恶意传输特征与目标报文匹配失败，且恶意传输特征H和恶意传输特征I中至少存在一个恶意传输特征与目标报文匹配失败时，可以确定目标报文为正常报文。
可选的，在从之前接收到的至少一个历史报文中确定出与待检测报文具有相同流量信息的目标历史报文，并将待检测报文与目标历史报文进行拼接，获得目标报文后，若识别出目标报文对应的应用层协议，则获取应用层协议对应的检测引擎下的至少一个恶意应用规则，并根据所述至少一个恶意应用规则中包括的多个恶意应用特征，对目标报文进行检测，确定目标报文是否为恶意报文。
具体地，在识别出目标报文对应的应用层协议，并获取到该应用层协议对应的检测引擎下的至少一个恶意应用规则后，对于每个恶意应用规则，可以先从该恶意应用规则中包括的多个恶意应用特征中确定一个恶意应用特征作为目标恶意应用特征。
将每个恶意应用规则中的目标恶意应用特征分别与目标报文进行匹配，若每个恶意应用规则中的目标恶意应用特征与目标报文均匹配失败，则确定目标报文为正常报文，若至少一个恶意应用规则中的至少一个目标恶意应用规则的目标恶意应用特征与目标报文匹配成功，则对于每个目标恶意应用规则，将该目标恶意应用规则中除目标恶意应用特征之外的其他恶意应用特征，分别与目标报文进行匹配，若该目标恶意应用规则中的其他恶意应用特征与目标报文均匹配成功，则可以确定目标报文为恶意报文，若每个目标恶意应用规则对应的其他恶意应用特征中都有与目标报文匹配失败的其他恶意应用特征，则可以确定目标报文为正常报文。
在一些实施例中，本申请实施例中提供的报文检测方法，还可以按照如图8所示的过程进行实现，如图8所示，包括如下步骤：
步骤S801，接收待检测报文，并根据待检测报文的五元组查找待检测报文对应的流量信息。
步骤S802，将待检测报文和之前接收到的与待检测报文具有相同流量信息的目标历史报文进行拼接，获得目标报文。
步骤S803，是否识别出目标报文对应的应用层协议；如果否，执行步骤S804；如果是，执行步骤S812。
步骤S804，获取目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则，并从每个恶意传输规则包括的多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征。
步骤S805，基于AC状态机对目标报文进行匹配检测。
其中，AC状态机是通过多模式匹配AC算法，根据每个恶意传输规则的第一恶意传输特征生成的。且基于AC状态机对目标报文进行匹配检测，确定每个恶意传输规则的第一恶意传输特征与目标报文的匹配结果的具体过程可以参见图6，本实施例在此不作赘述。
步骤S806，确定每个恶意传输规则的第一恶意传输特征与目标报文是否均匹配失败；如果是，执行步骤S807；如果否，执行步骤S808。
步骤S807，确定目标报文为正常报文。
步骤S808，从至少一个恶意传输规则中，确定出第一恶意传输特征与目标报文匹配成功的至少一个目标恶意传输规则。
步骤S809，将每个目标恶意传输规则中除第一恶意传输特征之外的其他恶意传输特征，分别与目标报文进行匹配。
步骤S810，确定每个目标恶意传输规则对应的其他恶意传输特征中是否都有与目标报文匹配失败的其他恶意传输特征；如果是，执行步骤S807；如果否，执行步骤S811。
步骤S811，确定目标报文为恶意报文。
步骤S812，获取应用层协议对应的检测引擎下的至少一个恶意应用规则，并从每个恶意应用规则包括的多个恶意应用特征中确定一个恶意应用特征作为目标恶意应用特征。
步骤S813，将每个恶意应用规则中的目标恶意应用特征，分别与目标报文进行匹配。
步骤S814，确定每个恶意应用规则的目标恶意应用特征与目标报文是否均匹配失败；如果是，执行步骤S807；如果否，执行步骤S815。
步骤S815，从至少一个恶意应用规则中，确定出目标恶意应用特征与目标报文匹配成功的至少一个目标恶意应用规则。
步骤S816，将每个目标恶意应用规则中除第一恶意应用特征之外的其他恶意应用特征，分别与目标报文进行匹配。
步骤S817，确定每个目标恶意应用规则对应的其他恶意应用特征中是否都有与目标报文匹配失败的其他恶意应用特征；如果是，执行步骤S807；如果否，执行步骤S811。
本申请提供的一种报文检测方法，可以解决无法识别接收报文的应用层协议，以及恶意流量特征被拆分到多个报文中而绕过防火墙的问题，通过在对接收到的报文进行检测前，先将报文与之前接收到的同一条流的报文进行拼接，再对拼接后的报文进行检测，并且在采用检测引擎对报文进行检测时，采用带状态的AC算法，即在将报文输入AC状态机的同时，将上次检测的结束状态和已检测字节数也输入AC状态机，来对报文进行匹配检测，从而可以避免对报文的重复检测，提高对报文进行检测的检测速度和检测准确率，同时也可以避免检测引擎的性能下降。
此外，本申请实施例中提供的报文检测方法，可以根据传输层协议和传输方向对已有的特征库进行分组，构建出多个规模较小的子引擎，并且，通过分好组的特征库分别构建生成各自的传输层报文检测子引擎，每个传输层报文检测子引擎包含各自带状态的AC状态机，从而可以提高检测引擎的检测速度。
与图3所示的报文检测方法基于同一发明构思，本申请实施例中还提供了一种报文检测装置。由于该装置是本申请报文检测方法对应的装置，并且该装置解决问题的原理与该方法相似，因此该装置的实施可以参见上述方法的实施，重复之处不再赘述。
图9示出了本申请实施例提供的一种报文检测装置的结构示意图，如图9所示，该报文检测装置包括报文接收单元901、报文拼接单元902和报文检测单元903。
其中，报文接收单元901，用于接收待检测报文，并获取之前接收到的至少一个历史报文；
报文拼接单元902，用于从至少一个历史报文中确定出与待检测报文具有相同流量信息的目标历史报文，并将待检测报文与目标历史报文进行拼接，获得目标报文；
报文检测单元903，用于若无法识别出目标报文对应的应用层协议，则根据目标报文的传输层协议和传输方向对应的检测引擎，对目标报文进行报文检测。
在一种可选的实施例中，报文检测单元903，具体用于：
获取目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则，其中每个恶意传输规则包括多个恶意传输特征；
对于每个恶意传输规则，从多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征；
根据每个恶意传输规则的第一恶意传输特征对目标报文进行检测，确定目标报文相对于每个恶意传输规则的初始检测结果；
若基于初始检测结果确定目标报文初步符合至少一个目标恶意传输规则，则根据每个目标恶意传输规则中除第一恶意传输特征之外的其他恶意传输特征，对目标报文进行检测，确定目标报文相对于每个目标恶意传输规则的目标检测结果。
在一种可选的实施例中，报文检测单元903，还用于：
基于AC状态机对目标报文进行匹配检测，确定每个第一恶意传输特征与目标报文的匹配结果；AC状态机是通过多模式匹配AC算法，根据每个恶意传输规则的第一恶意传输特征生成的；
若每个第一恶意传输特征与目标报文均匹配失败，则确定目标报文相对于每个恶意传输规则的初始检测结果为正常报文；
若至少一个第一恶意传输特征与目标报文匹配成功，则确定与目标报文匹配的第一恶意传输特征对应的目标恶意传输规则，并确定目标报文相对于每个目标恶意传输规则的初始检测结果为初步符合目标恶意传输规则。
在一种可选的实施例中，报文检测单元903，还用于：
获取通过AC状态机对目标历史报文进行检测获得的结束状态和已检测字节数；
基于AC状态机，根据已检测字节数确定目标报文对应的待检测字符串中的未检测起始位置，并根据结束状态从未检测起始位置处对待检测字符串进行查找，从第一恶意传输特征对应的字符串中，确定出与待检测字符串相匹配的目标字符串；
根据目标字符串对应的目标恶意传输特征，确定每个第一恶意传输特征与目标报文的匹配结果。
在一种可选的实施例中，报文检测单元903，还用于：
对于每个目标恶意传输规则，将目标恶意传输规则中除第一恶意传输特征之外的其他恶意传输特征，分别与目标报文进行匹配；
若其他恶意传输特征与目标报文均匹配成功，则确定目标报文对应的目标检测结果为恶意报文；
若每个目标恶意传输规则对应的其他恶意传输特征中都有与目标报文匹配失败的其他恶意传输特征，则确定目标报文对应的目标检测结果为正常报文。
在一种可选的实施例中，报文检测单元903，还用于：
若识别出目标报文对应的应用层协议，则获取应用层协议对应的检测引擎下的至少一个恶意应用规则；
根据至少一个恶意应用规则中包括的多个恶意应用特征，对目标报文进行检测，确定目标报文是否为恶意报文。
与上述方法实施例基于同一发明构思，本申请实施例中还提供了一种电子设备。该电子设备可以用于进行报文检测。在该实施例中，电子设备的结构可以如图10所示，包括存储器1001以及一个或多个处理器1002。
存储器1001，用于存储处理器1002执行的计算机程序。存储器1001可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统，以及运行即时通讯功能所需的程序等；存储数据区可存储各种即时通讯信息和操作指令集等。
存储器1001可以是易失性存储器（volatile memory），例如随机存取存储器（random-access memory，RAM）；存储器1001也可以是非易失性存储器（non-volatile memory），例如只读存储器，快闪存储器（flash memory），硬盘（hard disk drive，HDD）或固态硬盘（solid-state drive，SSD）、或者存储器1001是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1001可以是上述存储器的组合。
处理器1002，可以包括一个或多个中央处理单元（central processing unit， CPU）或者为数字处理单元等等。处理器1002，用于调用存储器1001中存储的计算机程序时实现上述报文检测方法。
本申请实施例中不限定上述存储器1001和处理器1002之间的具体连接介质。本公开实施例在图10中以存储器1001和处理器1002之间通过总线1003连接，总线1003在图10中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。总线1003可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
根据本申请的一个方面，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述实施例中的报文检测方法。
程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以是——但不限于——电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子（非穷举的列表）包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器（RAM）、只读存储器（ROM）、可擦式可编程只读存储器（EPROM或闪存）、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。

Claims (10)

  1. 一种报文检测方法，其特征在于，包括：
    接收待检测报文，并获取之前接收到的至少一个历史报文；
    从所述至少一个历史报文中确定出与所述待检测报文具有相同流量信息的目标历史报文，并将所述待检测报文与所述目标历史报文进行拼接，获得目标报文；
    若无法识别出所述目标报文对应的应用层协议，则根据所述目标报文的传输层协议和传输方向对应的检测引擎，对所述目标报文进行报文检测。
  2. 如权利要求1所述的方法，其特征在于，所述根据所述目标报文的传输层协议和传输方向对应的检测引擎，对所述目标报文进行报文检测，包括：
    获取所述目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则，其中每个恶意传输规则包括多个恶意传输特征；
    对于每个恶意传输规则，从所述多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征；
    根据每个恶意传输规则的第一恶意传输特征对所述目标报文进行检测，确定所述目标报文相对于每个恶意传输规则的初始检测结果；
    若基于所述初始检测结果确定所述目标报文初步符合至少一个目标恶意传输规则，则根据每个目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，对所述目标报文进行检测，确定所述目标报文相对于每个目标恶意传输规则的目标检测结果。
  3. 如权利要求2所述的方法，其特征在于，所述根据每个恶意传输规则的第一恶意传输特征对所述目标报文进行检测，确定所述目标报文相对于每个恶意传输规则的初始检测结果，包括：
    基于AC状态机对所述目标报文进行匹配检测，确定每个第一恶意传输特征与所述目标报文的匹配结果；所述AC状态机是通过多模式匹配AC算法，根据每个恶意传输规则的第一恶意传输特征生成的；
    若每个第一恶意传输特征与所述目标报文均匹配失败，则确定所述目标报文相对于每个恶意传输规则的初始检测结果为正常报文；
    若至少一个所述第一恶意传输特征与所述目标报文匹配成功，则确定与所述目标报文匹配的所述第一恶意传输特征对应的目标恶意传输规则，并确定所述目标报文相对于每个目标恶意传输规则的初始检测结果为初步符合所述目标恶意传输规则。
  4. 如权利要求3所述的方法，其特征在于，所述基于AC状态机对所述目标报文进行匹配检测，确定每个第一恶意传输特征与所述目标报文的匹配结果，包括：
    获取通过AC状态机对所述目标历史报文进行检测获得的结束状态和已检测字节数；
    基于所述AC状态机，根据所述已检测字节数确定所述目标报文对应的待检测字符串中的未检测起始位置，并根据所述结束状态从所述未检测起始位置处对所述待检测字符串进行查找，从所述第一恶意传输特征对应的字符串中，确定出与所述待检测字符串相匹配的目标字符串；
    根据所述目标字符串对应的目标恶意传输特征，确定每个第一恶意传输特征与所述目标报文的匹配结果。
  5. 如权利要求2所述的方法，其特征在于，所述根据每个目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，对所述目标报文进行检测，确定所述目标报文相对于每个目标恶意传输规则的目标检测结果，包括：
    对于每个目标恶意传输规则，将所述目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，分别与所述目标报文进行匹配；
    若所述其他恶意传输特征与所述目标报文均匹配成功，则确定所述目标报文对应的目标检测结果为恶意报文；
    若每个目标恶意传输规则对应的所述其他恶意传输特征中都有与所述目标报文匹配失败的其他恶意传输特征，则确定所述目标报文对应的目标检测结果为正常报文。
  6. 如权利要求1~5中任一项所述的方法，其特征在于，所述获得目标报文之后，所述方法还包括：
    若识别出所述目标报文对应的应用层协议，则获取所述应用层协议对应的检测引擎下的至少一个恶意应用规则；
    根据所述至少一个恶意应用规则中包括的多个恶意应用特征，对所述目标报文进行检测，确定所述目标报文是否为恶意报文。
  7. 一种报文检测装置，其特征在于，包括：
    报文接收单元，用于接收待检测报文，并获取之前接收到的至少一个历史报文；
    报文拼接单元，用于从所述至少一个历史报文中确定出与所述待检测报文具有相同流量信息的目标历史报文，并将所述待检测报文与所述目标历史报文进行拼接，获得目标报文；
    报文检测单元，用于若无法识别出所述目标报文对应的应用层协议，则根据所述目标报文的传输层协议和传输方向对应的检测引擎，对所述目标报文进行报文检测。
  8. 如权利要求7所述的装置，其特征在于，所述报文检测单元，具体用于：
    获取所述目标报文的传输层协议和传输方向对应的检测引擎下的至少一个恶意传输规则，其中每个恶意传输规则包括多个恶意传输特征；
    对于每个恶意传输规则，从所述多个恶意传输特征中确定一个恶意传输特征作为第一恶意传输特征；
    根据每个恶意传输规则的第一恶意传输特征对所述目标报文进行检测，确定所述目标报文相对于每个恶意传输规则的初始检测结果；
    若基于所述初始检测结果确定所述目标报文初步符合至少一个目标恶意传输规则，则根据每个目标恶意传输规则中除所述第一恶意传输特征之外的其他恶意传输特征，对所述目标报文进行检测，确定所述目标报文相对于每个目标恶意传输规则的目标检测结果。
  9. 一种电子设备，其特征在于，其包括处理器和存储器，其中，所述存储器存储有程序代码，当所述程序代码被所述处理器执行时，使得所述处理器执行权利要求1~6中任一所述方法的步骤。
  10. 一种计算机可读存储介质，其特征在于，其包括程序代码，当所述程序代码在电子设备上运行时，所述程序代码用于使所述电子设备执行权利要求1~6中任一所述方法的步骤。
PCT/CN2022/141580 2022-07-27 2022-12-23 一种报文检测方法、装置、电子设备及存储介质 WO2024021479A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210891395.3 2022-07-27
CN202210891395.3A CN115296878B (zh) 2022-07-27 2022-07-27 一种报文检测方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2024021479A1 true WO2024021479A1 (zh) 2024-02-01

Family

ID=83823742

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/141580 WO2024021479A1 (zh) 2022-07-27 2022-12-23 一种报文检测方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN115296878B (zh)
WO (1) WO2024021479A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117978706A (zh) * 2024-03-29 2024-05-03 中国电子技术标准化研究院 流量协议识别方法、装置、电子设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115296878B (zh) * 2022-07-27 2023-11-03 天翼云科技有限公司 一种报文检测方法、装置、电子设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101252444A (zh) * 2008-04-03 2008-08-27 华为技术有限公司 报文特征的检测方法及装置
CN107181605A (zh) * 2016-03-09 2017-09-19 阿里巴巴集团控股有限公司 报文检测方法及系统、内容提取装置、流量匹配装置
CN108134751A (zh) * 2017-12-12 2018-06-08 杭州迪普科技股份有限公司 一种tcp分段报文待检测文本重组方法及装置
CN113381993A (zh) * 2021-06-08 2021-09-10 清华大学 深度报文检测系统及其检测方法、计算机设备和存储介质
WO2022127586A1 (zh) * 2020-12-17 2022-06-23 中兴通讯股份有限公司 报文处理方法、节点及计算机可读存储介质
CN115296878A (zh) * 2022-07-27 2022-11-04 天翼云科技有限公司 一种报文检测方法、装置、电子设备及存储介质

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1980240A (zh) * 2006-12-08 2007-06-13 杭州华为三康技术有限公司 数据流的模式匹配方法及装置
US8291495B1 (en) * 2007-08-08 2012-10-16 Juniper Networks, Inc. Identifying applications for intrusion detection systems
CN103475653A (zh) * 2013-09-05 2013-12-25 北京科能腾达信息技术股份有限公司 网络数据包的检测方法
CN104954346B (zh) * 2014-03-31 2018-12-18 北京奇安信科技有限公司 基于对象分析的攻击识别方法及装置
CN111355696A (zh) * 2018-12-24 2020-06-30 中移（杭州）信息技术有限公司 一种报文识别方法、装置、dpi设备及存储介质
CN112989337A (zh) * 2019-12-02 2021-06-18 华为技术有限公司 一种恶意脚本代码检测方法及装置
CN110971601A (zh) * 2019-12-02 2020-04-07 邑客得（上海）信息技术有限公司 一种高效的网络报文传输层多级特征提取方法和系统
CN113194058B (zh) * 2020-01-14 2023-03-21 深信服科技股份有限公司 Web攻击检测方法、设备、网站应用层防火墙及介质
CN111526134B (zh) * 2020-04-13 2022-04-01 杭州迪普信息技术有限公司 一种报文检测系统、方法及装置
CN112351002B (zh) * 2020-10-21 2022-04-26 新华三信息安全技术有限公司 一种报文检测方法、装置及设备
CN112311789B (zh) * 2020-10-28 2023-02-28 北京锐安科技有限公司 深度报文处理方法、装置、电子设备及存储介质
CN112994931B (zh) * 2021-02-05 2023-01-17 绿盟科技集团股份有限公司 一种规则匹配的方法及其设备
CN114050926A (zh) * 2021-11-09 2022-02-15 南方电网科学研究院有限责任公司 一种数据报文深度检测方法和装置
CN114285624B (zh) * 2021-12-21 2024-05-24 天翼云科技有限公司 攻击报文识别方法、装置、网络设备和存储介质
CN114553546B (zh) * 2022-02-24 2023-07-04 杭州迪普科技股份有限公司 基于网络应用的报文抓取的方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101252444A (zh) * 2008-04-03 2008-08-27 华为技术有限公司 报文特征的检测方法及装置
CN107181605A (zh) * 2016-03-09 2017-09-19 阿里巴巴集团控股有限公司 报文检测方法及系统、内容提取装置、流量匹配装置
CN108134751A (zh) * 2017-12-12 2018-06-08 杭州迪普科技股份有限公司 一种tcp分段报文待检测文本重组方法及装置
WO2022127586A1 (zh) * 2020-12-17 2022-06-23 中兴通讯股份有限公司 报文处理方法、节点及计算机可读存储介质
CN113381993A (zh) * 2021-06-08 2021-09-10 清华大学 深度报文检测系统及其检测方法、计算机设备和存储介质
CN115296878A (zh) * 2022-07-27 2022-11-04 天翼云科技有限公司 一种报文检测方法、装置、电子设备及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117978706A (zh) * 2024-03-29 2024-05-03 中国电子技术标准化研究院 流量协议识别方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN115296878B (zh) 2023-11-03
CN115296878A (zh) 2022-11-04

Similar Documents

Publication Publication Date Title
WO2024021479A1 (zh) 一种报文检测方法、装置、电子设备及存储介质
US9990583B2 (en) Match engine for detection of multi-pattern rules
US11120008B2 (en) Verifying configuration management database configuration items
CN103428261B (zh) 通过硬件辅助处理http报头的方法
CN101557329A (zh) 一种基于应用层的数据分割方法及装置
US7571278B2 (en) Content access memory (CAM) as an application hardware accelerator for servers
US8484147B2 (en) Pattern matching
WO2009067915A1 (fr) Procede d'identification d'un type de service correspondant a un message et dispositif associe
US7526804B2 (en) Hardware assist for pattern matches
CN107241344A (zh) 拦截客户端对恶意网络服务器的访问的方法、设备和系统
KR102280845B1 (ko) 네트워크 내의 비정상 행위 탐지 방법 및 그 장치
KR20080010339A (ko) 이니시에이터 하드웨어 클래스 식별자에 기초하여 스토리지자원에 ｉＳＣＳＩ 타겟명을 맵핑하는 방법
CN109688153A (zh) 使用主机应用/程序到用户代理的映射的零日威胁检测
US20190173844A1 (en) Firewall device
WO2017157335A1 (zh) 报文识别的方法及装置
CN112769850A (zh) 网络报文过滤方法、电子设备及存储介质
US20190384415A1 (en) Enhanced command line interface auto-completion
CN110929185A (zh) 网站目录检测方法、装置、计算机设备及计算机存储介质
US10897483B2 (en) Intrusion detection system for automated determination of IP addresses
CN112351002B (zh) 一种报文检测方法、装置及设备
US20140283080A1 (en) Identifying stored vulnerabilities in a web service
US8539547B2 (en) Policy selector representation for fast retrieval
WO2024036822A1 (zh) 一种恶意域名确定方法、装置、设备及介质
CN112994931A (zh) 一种规则匹配的方法及其设备
CN112702331A (zh) 基于敏感词的恶意链接识别方法、装置、电子设备及介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22952910

Country of ref document: EP

Kind code of ref document: A1