WO2025020439A1 - 安全规则库管理方法、装置、计算机设备和存储介质 - Google Patents

安全规则库管理方法、装置、计算机设备和存储介质 Download PDF

Info

Publication number
WO2025020439A1
WO2025020439A1 PCT/CN2023/140249 CN2023140249W WO2025020439A1 WO 2025020439 A1 WO2025020439 A1 WO 2025020439A1 CN 2023140249 W CN2023140249 W CN 2023140249W WO 2025020439 A1 WO2025020439 A1 WO 2025020439A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
event
rule
activity
group
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/CN2023/140249
Other languages
English (en)
French (fr)
Inventor
邓博仁
汪来富
刘东鑫
谢泳
吴波
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Telecom Corp Ltd
Original Assignee
China Telecom Corp Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Telecom Corp Ltd filed Critical China Telecom Corp Ltd
Publication of WO2025020439A1 publication Critical patent/WO2025020439A1/zh
Anticipated expiration legal-status Critical
Pending legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • the present application relates to the field of network security technology, and in particular to a security rule base management method, apparatus, computer equipment and storage medium.
  • Network security systems used to detect or protect against malicious attacks such as IDS (Intrusion Detection Systems), WAF (Web Application Firewall), and security gateways, mainly rely on feature detection technology to detect attack behaviors, and feature-based attack detection relies on a rule base.
  • the embodiments of the present application provide a security rule base management method, apparatus, computer equipment and storage medium, which can improve the detection efficiency of the network security system.
  • an embodiment of the present application provides a security rule base management method, the method comprising:
  • the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period;
  • each security rule in the security rule library is controlled to be turned on or off.
  • the above-mentioned determining the activity parameter of each security rule in the security rule base based on the security event data set includes:
  • the local activity set includes the local activity of each security rule
  • the global maximum activity set includes the global maximum activity of each security rule
  • the activity parameters of each security rule are determined based on the pre-acquired historical activity set, local activity set and global maximum activity set.
  • determining the local activity set based on the security event data set includes:
  • a rule group set is determined; the rule group set includes multiple rule groups, and each rule group includes multiple security rules;
  • the local activity of each security rule is determined according to the total number of events of the target rule group to which each security rule belongs, and a local activity set is formed by the local activities of multiple security rules.
  • the event data includes event time, source address and rule identifier
  • the rule group set is determined based on the security event data set and the preset time window size, including:
  • each time window For each time window, extract the security events within the time window from the security event data set, and divide the extracted security events according to the source address and the rule identifier to obtain an initial event group set, wherein the initial event group set includes multiple initial event groups, and each initial event group includes multiple security events with the same source address and the same rule identifier;
  • Target event group set includes multiple target event groups, and each target event group includes multiple rule groups divided according to source addresses;
  • the target event group sets corresponding to multiple time windows are merged according to the source addresses to obtain a rule group set.
  • the filtering process of the initial event group to obtain the target event group set corresponding to the time window includes:
  • the initial event group set is filtered according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set.
  • the above-mentioned normalization process is performed on each initial event group according to the number of events to obtain the event group parameters of each initial event group, including:
  • the event group parameters of the initial event group are determined according to the normalized number of events and the normalized number of successful events.
  • the filtering process of the initial event group set according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set includes:
  • the initial event group For each initial event group in the initial event group set, if the event group parameter of the initial event group is less than a preset event threshold, the initial event group is filtered;
  • the target event group set is obtained according to the initial event groups that are not filtered out in the initial event group set.
  • the above-mentioned determining multiple time windows according to the event time and the time window size of each security event in the security event data set includes:
  • Multiple time windows are determined according to the start time of the first time window and the time window size.
  • the step of determining the global maximum activity set includes:
  • control of turning on or off each security rule in the security rule library according to the activity parameter of each security rule includes:
  • each security rule in the security rule library is controlled to be opened or closed.
  • determining the activation probability of each security rule according to the activity parameter and the operation load data of the network security system includes:
  • the activation probability of each safety rule is determined according to the operating load data, the category parameter corresponding to the rule category of the safety rule, and the preset relationship corresponding to the target load interval.
  • control of turning on or off each security rule in the security rule library according to the turning-on probability of each security rule includes:
  • an embodiment of the present application provides a security rule base management device, the device comprising:
  • a data acquisition module is used to acquire a security event data set; wherein the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period;
  • the activity determination module is used to determine the activity of each security rule in the security rule base based on the security event data set. parameter;
  • the rule base management module is used to control the opening or closing of each security rule in the security rule base according to the activity parameters of each security rule.
  • an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in the first aspect are implemented.
  • an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in the first aspect are performed.
  • an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.
  • the above-mentioned security rule base management method, device, computer equipment and storage medium obtain a security event data set; determine the activity parameters of each security rule in the security rule base based on the security event data set; and control the opening or closing of each security rule in the security rule base according to the activity parameters of each security rule.
  • security rules with a low number of hits in the security rule base can be closed. In this way, the network security system does not need to traverse all security rules in the security rule base when performing security detection, thereby improving the detection efficiency of the network security system.
  • FIG1 is a diagram of an application environment of a security rule base management method in an embodiment of the present application.
  • FIG2 is a flow chart of a security rule base management method in one embodiment of the present application.
  • FIG3 is a flowchart of the steps of determining the activity parameters of each security rule in one embodiment of the present application.
  • FIG. 4 is a flow chart of the step of determining a local activity set in one embodiment of the present application.
  • FIG. 5 is a flowchart of the step of determining a rule group set in an embodiment of the present application.
  • FIG. 6 is a flow chart of the step of determining a target event group set in an embodiment of the present application.
  • FIG. 7 is a flow chart of the steps of controlling each security rule in the security rule library in one embodiment of the present application.
  • FIG8 is a flowchart of the step of determining the activation probability of each security rule in an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an activation probability curve in an embodiment of the present application.
  • FIG10 is a structural block diagram of a security rule base management device in an embodiment of the present application.
  • FIG. 11 is a diagram showing the internal structure of a computer device in one embodiment of the present application.
  • FIG1 is a schematic diagram of an application scenario of a security rule base management provided in an embodiment of the present application.
  • the application scenario includes a management server 101 and multiple network servers 102 arranged in different networks.
  • a network security management system is arranged on the management server 101; a network security system is arranged on the network server 102, and the network security system can perform security detection on the network in which it is located, thereby detecting intrusions, attacks and other behaviors.
  • the management server 101 communicates with the network server 102 through the network. For example, the network server 102 sends the determined local activity set to the management server 101, and the management server 101 determines the global activity set based on multiple local activity sets; thereafter, the management server 101 returns the global activity set to the network server 102.
  • the data storage system can store data that the network server 102 needs to process.
  • the data storage system stores security event data sets and security rule bases.
  • the data storage system can be integrated on the network server 102, or it can be placed on the cloud or other network servers.
  • Management server 101 and network server 102 can be implemented by independent servers or server clusters composed of multiple servers.
  • network security systems perform security detection based on security rule bases, and need to traverse each security rule in the security rule base.
  • network security systems In order to maintain the ability to detect intrusions, attacks, and other behaviors, network security systems must maintain a broad and comprehensive security rule base.
  • more and more security rules need to be traversed, resulting in a gradual decrease in detection efficiency.
  • an embodiment of the present application provides a management solution for a security rule base, which first obtains a set of security event data; then, determines the activity parameters of each security rule in the security rule base based on the security event data; and then, according to the activity parameters of each security rule, controls the opening or closing of each security rule in the security rule base.
  • security rules with a low number of hits in the security rule base can be closed, that is, the security rule base can be adaptively adjusted. In this way, the network security system does not need to traverse all security rules in the security rule base when performing security detection, thereby improving the detection efficiency.
  • a security rule base management method is provided, which is described by taking the method applied to the network server in FIG. 1 as an example, and may include the following steps:
  • Step S201 obtaining a security event data set.
  • the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period.
  • the event data includes the event time, the source address of the security event, the rule identifier of the security rule hit by the security event, and the response code of the network security system to the security event, as shown in Table 1.
  • the network security system performs security detection based on the security rule base to obtain event data of security events; then, the event data of security events is stored.
  • the security rule base needs to be managed, the event data within a preset historical period is obtained from the stored event data to obtain a security event data set.
  • the security rule base can be managed according to a preset time or a preset period. For example, if the preset time is X year X month X day, the security rule base is managed at the preset time; or, if the preset period is monthly, the security rule base is managed monthly. It should be noted that the triggering conditions for managing the security rule base are not limited to the above description.
  • the activity parameter represents the hit status of the security rule.
  • the larger the activity parameter the more times the security rule is hit; the smaller the activity parameter, the fewer times the security rule is hit.
  • security rule 1 in the security rule library is frequently hit within a preset historical period, while security rule 2 is not hit within a preset historical period... Then, based on the above event data, the parameters representing the frequent hits of security rule 1 are calculated to obtain the activity parameters of security rule 1. Similarly, the activity parameters of other security rules are calculated.
  • Step S203 Control the opening or closing of each security rule in the security rule library according to the activity parameter of each security rule. close.
  • the security rule For each security rule in the security rule library, if the activity parameter indicates that the security rule is frequently hit within a preset historical period, the security rule is controlled to be turned on; if the activity parameter indicates that the security rule is hit less frequently within the preset historical period, the security rule is controlled to be turned off.
  • the activity parameter corresponding to security rule 1 is a, which is greater than the preset parameter threshold x, then security rule 1 is controlled to be turned on; and the activity parameter corresponding to security rule 2 is b, which is less than the preset parameter threshold x, then security rule 2 is controlled to be turned off.
  • a security event data set is first obtained; then, the activity parameters of each security rule in the security rule base are determined based on the security event data set; and then, the opening or closing of each security rule in the security rule base is controlled according to the activity parameters of each security rule.
  • the security rules with a low number of hits in the security rule base can be closed, so that the network security system does not need to traverse all security rules in the security rule base when performing security detection, thereby improving the detection efficiency of the network security system.
  • the process of determining the activity parameter of each security rule in the security rule library based on the security event data set in step S202 above may include the following steps:
  • Step S301 determine a local activity set and a global maximum activity set based on a security event data set.
  • the local activity set includes the local activity of each security rule, and the local activity represents the hit situation of the security rule in a single network.
  • the global maximum activity set includes the global maximum activity of each security rule, and the global maximum activity represents the maximum value of the hit situation of the security rule in all networks.
  • the local activity of each security rule in other networks can be obtained from other networks; then, for each security rule, determine the maximum value of its local activity in all networks to obtain the global maximum activity of the security rule; finally, the global maximum activity of multiple security rules constitutes a global activity set.
  • Step S302 determining the activity parameters of each security rule according to the pre-acquired historical activity set, the local activity set and the global maximum activity set.
  • the historical activity set includes the historical activity of multiple security rules, and the historical activity is the local activity determined according to historical time.
  • the historical activity set, the local activity set and the global maximum activity set, the historical activity, local activity and global maximum activity of each security rule are determined; then, the historical activity, local activity and global maximum activity are weightedly calculated to obtain the activity parameter of the security rule.
  • the activity parameter of the security rule can be determined by referring to formula (1):
  • w_i is the activity parameter
  • wi is the local activity
  • history_wi is the historical activity
  • max_w is the global maximum activity
  • ⁇ is the weight corresponding to the historical activity
  • ⁇ is the weight corresponding to the global maximum activity.
  • the local activity set and the global maximum activity set are determined based on the security event data set; the local activity set and the global maximum activity set are determined based on the security event data set.
  • the environmental differences of different networks are comprehensively considered, and the local activity, the global maximum activity and the historical activity are integrated to determine the activity set.
  • the jump parameter can improve the effectiveness and comprehensiveness of the activity parameter.
  • the process of determining a local activity set based on a security event data set in step S301 above may include the following steps S401-S402:
  • Step S401 determining a rule group set based on a security event data set and a preset time window size.
  • the rule group set includes multiple rule groups, each rule group includes multiple security rules.
  • id is the rule identifier of the security rule.
  • Step S402 determining the local activity of each security rule according to the total number of events of the target rule group to which each security rule belongs, and forming a local activity set from the local activities of multiple security rules.
  • wi is the local activity
  • i is the serial number of the security rule
  • j is the serial number of the rule group.
  • a rule group set is determined based on a security event data set and a preset time window size; the local activity of each security rule is determined based on the total number of events of the target rule group to which each security rule belongs, and a local activity set is formed by the local activities of multiple security rules.
  • the event data includes event time, source address and rule identifier.
  • the process of determining a rule group set based on a security event data set and a preset time window size in step S401 is involved.
  • the embodiment of the present application may include the following steps S501-S504:
  • Step S501 determining a plurality of time windows according to the event time and the time window size of each security event in the security event data set.
  • the starting time of the first time window is determined according to the event time of each security event in the security event data set; and multiple time windows are determined according to the starting time of the first time window and the time window size.
  • the end time of the first time window is used as the start time of the second time window, and the end time of the second time window can be determined based on the start time of the second time window and the time window size.
  • multiple time windows can be determined.
  • Step S502 for each time window, extract the security events within the time window from the security event data set.
  • the extracted security events are divided according to the source address and rule identifier to obtain an initial event group set.
  • the initial event group set includes multiple initial event groups, and each initial event group includes multiple security events with the same source address and the same rule identifier.
  • the security events within the time window are extracted from the security event data set according to the event time; then, the extracted security events are divided according to the source address and the rule identifier to obtain multiple initial event groups; and then the initial event group set is formed from the multiple initial event groups. Referring to Table 3, the initial event group set of the first time window is shown.
  • Step S503 filter the initial event group set to obtain a target event group set corresponding to the time window.
  • the target event group set includes multiple target event groups, and each target event group includes multiple rule groups divided according to source addresses.
  • the target event group set event_group ⁇ event_group1, event_group2, event_group3, ... ⁇ of the first time window is shown.
  • the target event group sets of other time windows can be determined by sliding the time window in accordance with the above method.
  • Step S504 merging target event group sets corresponding to multiple time windows according to source addresses to obtain a rule group set.
  • the target event group sets corresponding to multiple time windows are merged to obtain a rule group set.
  • the target event group set of time window 1 and the target event group set of time window 2 are merged to obtain a rule group; and the total number of events after merging is the sum of the total number of events of the two target event group sets. If a source address in time window 1 does not exist in time window 2, the target event group set of time window 1 is directly used as a rule group.
  • a rule group set is composed of multiple rule groups, as shown in Table 2 in the above embodiment.
  • multiple time windows are determined based on the event time and time window size of each security event in the security event data set; for each time window, the security events within the time window are extracted from the security event data set, and the extracted security events are divided according to the source address and rule identifier to obtain an initial event group set; the initial event group set is filtered to obtain a target event group set corresponding to the time window; the target event group sets corresponding to multiple time windows are merged according to the source address to obtain a rule group set.
  • the embodiment of the present application uses a sliding window method to group security events. The amount of calculation for each time window is small, and the calculation of multiple time windows can be performed in parallel. Therefore, the grouping speed and grouping efficiency can be improved, thereby improving the adaptive adjustment efficiency of the security rule base.
  • the process of filtering the initial event group in the above step S503 to obtain a target event group set corresponding to the time window may include the following steps S601-S602:
  • Step S601 normalize each initial event group according to the number of events to obtain event group parameters of each initial event group.
  • the event group parameter represents the proportion of successful request events in the initial event group. It can be understood that the larger the event group parameter, the higher the proportion of successful request events in the initial event group and the fewer false positive events; the smaller the event group parameter, the lower the proportion of successful request events in the initial event group and the more false positive events.
  • the number of successful request events in the initial event group may be determined first, and then normalized according to the number of successful request events and the number of events in the initial event group to obtain event group parameters of the initial event group.
  • the normalization process in step S601 may include the following steps S6011-S6013:
  • Step S6011 normalization is performed according to the number of events in the initial event group and a preset constant to obtain the normalized number of events, as shown in formula (3):
  • cnt_n is the normalized number of events
  • cnt is the number of events in the initial event group
  • MAX_cnt is a preset constant.
  • the preset constant MAX_cnt is 20.
  • a smaller value is first selected from the number of events in the initial event group and the preset constant, and then the ratio of the smaller value to the preset constant is calculated to obtain the normalized number of events.
  • Step S6012 normalize the number of events in the initial event group and the number of requested successful events to obtain a normalized number of successful events.
  • the number of events of the request success event in the initial event group is determined according to the response code, and then the ratio between the number of events of the request success event and the number of events in the initial event group is calculated to obtain the normalized number of successful events.
  • the first digit of the response code of the request success event is 2, for example, the response code is 201, 202, 203, etc.
  • the normalized number of successful events can be determined using formula (4), as follows:
  • sreq_n is the normalized number of successful events
  • sreq is the number of events requesting successful events
  • cnt is the number of events in the initial event group.
  • Step S6013 determining event group parameters of the initial event group according to the normalized event number and the normalized successful event number.
  • the ratio between the normalized number of successful events and the normalized number of events is calculated to obtain the event group parameters of the initial event group, as shown in formula (5):
  • k is the event group parameter
  • cnt_n is the normalized number of events
  • sreq_n is the normalized number of successful events.
  • Step S602 The initial event group set is processed according to the event group parameters of each initial event group and the preset event threshold. Filtering is performed to obtain the target event group set.
  • the event group parameter of the initial event group is compared with a preset event threshold, and whether to filter the initial event group is determined according to the comparison result; then, the initial event groups that are not filtered out form a target event group set.
  • the filtering process may include: for each initial event group in the initial event group set, if the event group parameter is less than a preset event threshold, filtering the initial event group; and obtaining a target event group set based on the initial event groups in the initial event group set that are not filtered out.
  • each initial event group is normalized according to the number of events to obtain the event group parameters of each initial event group; the initial event group set is filtered according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set.
  • the event number is normalized in combination with the response code to obtain the event group parameters, which can effectively filter the event group with many false alarm events, thereby reducing the impact of the false alarm time on the activity parameters and improving the accuracy of the activity parameters.
  • the process of determining the above-mentioned global maximum activity set includes: sending the local activity set to a preset server, so that the preset server determines the global maximum activity of each security rule based on multiple local activity sets, and the global maximum activity of multiple security rules forms a global maximum activity set; receiving the global activity set fed back by the preset server.
  • the preset server may be the management server in FIG. 1 .
  • the network server of each network After determining the local activity set, the network server of each network sends the local activity set to the preset server. After obtaining the local activity sets of multiple networks, the preset server determines the local activity of each security rule in multiple networks and selects the maximum local activity as the global maximum activity. Afterwards, the global maximum activity of multiple security rules is used to form the global maximum activity.
  • the management server feeds back the global activity set to the network server of each network respectively, so that the network server can determine the activity parameter of each security rule according to the global maximum activity set.
  • the local activity set is sent to the preset server, so that the preset server can determine the global maximum activity of each security rule based on multiple local activity sets, and the global maximum activity set is composed of the global maximum activity of multiple security rules; the global activity set fed back by the preset server is received.
  • the global maximum activity set is obtained, and when the security rule is not hit locally, the hit of the security rule outside the local area can be considered, thereby integrating the environmental differences of different networks and improving the effectiveness and comprehensiveness of the activity parameters of the security rule.
  • the process of controlling the opening or closing of each security rule in the security rule library according to the activity parameter of each security rule in the above step S203 may include the following steps S701-S702:
  • Step S701 determining the activation probability of each security rule according to the activity parameter and the operation load data of the network security system.
  • the operation load data affects the detection efficiency of the network security system.
  • the activation probability of each security rule is calculated by combining the activity parameters of the security rules and the operation load data of the network security system. It can be understood that the smaller the operation load data, the more security rules are allowed to be enabled in the security rule base, and the greater the calculated activation probability; the larger the operation load data, the fewer security rules are enabled in the security rule base, and the smaller the calculated activation probability.
  • Step S702 controlling each security rule in the security rule library to be turned on or off according to the turn-on probability of each security rule.
  • the security rule For each security rule in the security rule library, if the probability of the security rule being enabled is greater than or equal to the preset probability threshold, the security rule is controlled to be enabled; if the probability of the security rule being enabled is less than the preset probability threshold, the security rule is controlled to be disabled.
  • v is the state of the security rule
  • RAND(0,1) is a random number between 0 and 1
  • y is the probability of opening the security rule.
  • the activation probability of each security rule is determined according to the activity parameter and the operation load data of the network security system; and according to the activation probability of each security rule, each security rule in the security rule base is controlled to be turned on or off.
  • the embodiment of the present application sets the activation probability for each security rule in combination with the operation load of the network security system, which can realize adaptive adjustment of the security rule base under different allowable load conditions, thereby improving the detection efficiency of the network security system.
  • the process of determining the activation probability of each security rule according to the activity parameter and the operation load data of the network security system in the above step S701 may include the following steps S801-S803:
  • Step S801 determining a target load interval where operating load data is located from a plurality of preset load intervals.
  • Multiple load intervals are pre-set, and the corresponding target load interval is determined according to the operating load data.
  • an operating load threshold (0 ⁇ xa ⁇ 1) and a threshold (xa ⁇ xb ⁇ 1) are set, and three load intervals are divided according to the operating load threshold: [0, xa], (xa, xb], (xb, 1].
  • the load interval where the operating load data x is located is determined as the target load interval.
  • the operation load data may be collected according to a preset collection period.
  • the collection period is 10 minutes, that is, the operation load data is collected every 10 minutes.
  • Step S802 for each security rule in the security rule library, determine the rule category of the security rule according to the activity parameter.
  • the rule category of the security rule can be determined according to the preset activity threshold, sleep threshold and activity parameter.
  • Step S803 determining the activation probability of each safety rule according to the operating load data, the category parameter corresponding to the rule category of the safety rule, and the preset relationship corresponding to the target load interval.
  • f 1 (w) and f 2 (w) are category parameters corresponding to the rule category of the security rule. For different rule categories, the values of f 1 (w) and f 2 (w) are different.
  • the opening probability curve shown in FIG. 9 can be obtained.
  • the preset relationship for determining the opening probability is not limited to the linear relationship of the above formula (7), and other nonlinear relationships may also be used.
  • the target load interval where the operating load data is located is determined from a plurality of preset load intervals; for each security rule in the security rule library, the rule category of the security rule is determined according to the activity parameter; and the activation probability of each security rule is determined according to the operating load data, the category parameter corresponding to the rule category of the security rule, and the preset relationship corresponding to the target load interval.
  • the embodiment of the present application sets different activation probabilities for different categories of security rules in combination with the operating load conditions of the network security system. Differentially setting the rule activation probability can achieve adaptive adjustment of different security rules under different operating load conditions, thereby improving the application efficiency of security rules and the detection efficiency of the network security system.
  • a security rule base management method is provided, which is described by taking the method applied to the network server in FIG. 1 as an example, and may include the following steps:
  • Step 1 Obtain a security event data set.
  • the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period.
  • the event data includes at least one of event time, source address, rule identifier and response code.
  • Step 2 Determine the start time of the first time window according to the event time of each security event in the security event data set; determine multiple time windows according to the start time of the first time window and the time window size.
  • Step 3 for each time window, extract the security events within the time window from the security event data set, and divide the extracted security events according to the source address and rule identifier to obtain an initial event group set.
  • the initial event group set includes multiple initial event groups, and each initial event group includes multiple security events with the same source address and the same rule identifier.
  • Step 4 normalize according to the number of events in the initial event group and a preset constant to obtain a normalized number of events; normalize according to the number of events in the initial event group and the number of events of successfully requested events to obtain a normalized number of successful events; determine the event group parameters of the initial event group based on the normalized number of events and the normalized number of successful events.
  • Step 5 For each initial event group in the initial event group set, if the event group parameter is less than a preset event threshold, the initial event group is filtered; and a target event group set is obtained based on the initial event groups that are not filtered out in the initial event group set.
  • Step 6 merge the target event group sets corresponding to multiple time windows according to the source addresses to obtain a rule group set.
  • Step 7 Determine the local activity of each security rule according to the total number of events of the target rule group to which each security rule belongs, and form a local activity set by the local activities of multiple security rules.
  • Step 8 Send the local activity set to the preset server, so that the preset server can determine the global maximum activity of each security rule based on multiple local activity sets, and form a global maximum activity set by the global maximum activities of multiple security rules; receive the global activity set fed back by the preset server.
  • Step 9 Determine the activity parameters of each security rule based on the pre-acquired historical activity set, the local activity set, and the global maximum activity set.
  • Step 10 determine the target load interval where the operating load data is located from multiple preset load intervals; for each security rule in the security rule library, determine the rule category of the security rule according to the activity parameter; determine the activation probability of each security rule according to the preset relationship between the operating load data, the category parameters corresponding to the rule category of the security rule, and the target load interval.
  • Step 11 obtain the random number of each security rule; control the opening or closing of each security rule according to the random number and the opening probability of each security rule.
  • steps in the above flowchart are shown in sequence as indicated by the arrows, these steps are The steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above flow chart may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
  • a security rule base management device including:
  • the data acquisition module 901 is used to acquire a security event data set; wherein the security event data set includes event data of multiple security events detected by the network security system based on the security rule base within a preset historical period;
  • An activity determination module 902 for determining an activity parameter of each security rule in a security rule base based on a security event data set
  • the rule base management module 903 is used to control the opening or closing of each security rule in the security rule base according to the activity parameter of each security rule.
  • the activity determination module 902 is specifically used to determine a local activity set and a global maximum activity set based on a security event data set; the local activity set includes the local activity of each security rule, and the global maximum activity set includes the global maximum activity of each security rule; the activity parameters of each security rule are determined based on the pre-acquired historical activity set, the local activity set and the global maximum activity set.
  • the activity determination module 902 is specifically used to determine a rule group set based on a security event data set and a preset time window size; the rule group set includes multiple rule groups, each rule group includes multiple security rules; based on the total number of events of the target rule group to which each security rule belongs, the local activity of each security rule is determined, and the local activity set is composed of the local activities of multiple security rules.
  • event data includes event time, source address and rule identifier; the activity determination module 902 is specifically used to determine multiple time windows based on the event time and time window size of each security event in the security event data set; for each time window, the security events within the time window are extracted from the security event data set, and the extracted security events are divided according to the source address and rule identifier to obtain an initial event group set; the initial event group set includes multiple initial event groups, each initial event group includes multiple security events with the same source address and the same rule identifier; the initial event group set is filtered to obtain a target event group set corresponding to the time window; the target event group set includes multiple target event groups, each target event group includes multiple rule groups divided according to the source address; the target event group sets corresponding to multiple time windows are merged according to the source address to obtain a rule group set.
  • the activity determination module 902 is specifically used to normalize each initial event group according to the number of events to obtain the event group parameters of each initial event group; filter the initial event group set according to the event group parameters of each initial event group and the preset event threshold to obtain the target event group set.
  • the activity determination module 902 is specifically used to perform normalization processing based on the number of events in the initial event group and a preset constant to obtain a normalized number of events; perform normalization processing based on the number of events in the initial event group and the number of events of successfully requested events to obtain a normalized number of successful events; and determine the event group parameters of the initial event group based on the normalized number of events and the normalized number of successful events.
  • the activity determination module 902 is specifically used to filter the initial event group for each initial event group in the initial event group set if the event group parameter is less than a preset event threshold; and obtain the target event group set based on the initial event groups that are not filtered in the initial event group set.
  • the activity determination module 902 is specifically used to determine the start time of the first time window based on the event time of each security event in the security event data set; and determine multiple time windows based on the start time of the first time window and the time window size.
  • the activity determination module 902 is specifically used to send the local activity set to the preset server, so that the preset server can determine the global maximum activity of each security rule based on multiple local activity sets, and form a global maximum activity set by the global maximum activities of multiple security rules; and receive the global activity set fed back by the preset server.
  • the rule base management module 903 is specifically used to calculate the activity parameters and the network security system
  • the operation load data is used to determine the activation probability of each security rule; according to the activation probability of each security rule, the security rules in the security rule library are controlled to be turned on or off.
  • the rule base management module 903 is specifically used to determine the target load interval where the operating load data is located from multiple preset load intervals; for each security rule in the security rule base, determine the rule category of the security rule according to the activity parameter; and determine the activation probability of each security rule according to the operating load data, the category parameter corresponding to the rule category of the security rule, and the preset relationship corresponding to the target load interval.
  • the rule base management module 903 is specifically used to obtain a random number corresponding to each security rule; and control each security rule to be turned on or off according to the random number and the activation probability of each security rule.
  • Each module in the above-mentioned security rule base management device can be implemented in whole or in part by software, hardware and a combination thereof.
  • the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
  • a computer device which may be a server, and its internal structure diagram may be shown in FIG11.
  • the computer device includes a processor, a memory, an input/output interface (Input/Output, referred to as I/O) and a communication interface.
  • the processor, the memory and the input/output interface are connected through a system bus, and the communication interface is connected to the system bus through the input/output interface.
  • the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium and an internal memory.
  • the non-volatile storage medium stores an operating system, a computer program and a database.
  • the internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium.
  • the database of the computer device is used to store security rule base management data.
  • the input/output interface of the computer device is used to exchange information between the processor and an external device.
  • the communication interface of the computer device is used to communicate with an external terminal through a network connection.
  • a computer readable storage medium is also provided, on which a computer program is stored, and the computer program can be executed by a processor of a server to complete the above method.
  • the storage medium can be a non-temporary computer readable storage medium, for example, the non-temporary computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.
  • a computer program product is also provided.
  • the above method can be implemented.
  • the computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, part or all of the above method can be implemented in whole or in part according to the process or function described in the embodiment of the present disclosure.
  • Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer And Data Communications (AREA)
  • Alarm Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请涉及一种安全规则库管理方法、装置、计算机设备和存储介质。所述方法包括：获取安全事件数据集合；其中，所述安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据；基于所述安全事件数据集合确定所述安全规则库中各安全规则的活跃度参数；根据各所述安全规则的活跃度参数，控制所述安全规则库中各所述安全规则开启或关闭。采用本方法能够提升网络安全系统的检测效率。

Description

安全规则库管理方法、装置、计算机设备和存储介质
相关申请
本申请要求2023年7月24日申请的，申请号为202310906721.8，名称为“安全规则库管理方法、装置、计算机设备和存储介质”的中国专利申请的优先权，在此将其全文引入作为参考。
技术领域
本申请涉及网络安全技术领域，特别是涉及一种安全规则库管理方法、装置、计算机设备和存储介质。
背景技术
用于检测或防护恶意攻击行为的网络安全系统，如IDS(Intrusion Detection Systems，入侵检测系统)、WAF(Web Application Firewall，网站应用级入侵防御系统)、安全网关等主要依赖特征检测技术实现对攻击行为的检测，而基于特征检测的攻击检测依赖规则库。
为维持对攻击行为的检测能力，网络安全系统必须维护一个广泛且全面的规则库。随着漏洞的层出不穷、规则库规模的不断扩大，检测效率逐渐降低。
发明内容
本申请实施例提供一种安全规则库管理方法、装置、计算机设备和存储介质，能够提升网络安全系统的检测效率。
第一方面，本申请实施例提供了一种安全规则库管理方法，该方法包括：
获取安全事件数据集合，其中安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据；
基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数；
根据各安全规则的活跃度参数，控制安全规则库中各安全规则开启或关闭。
在其中一个实施例中，上述基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数，包括：
基于安全事件数据集合确定本地活跃度集合和全局最大活跃度集合；本地活跃度集合包括各安全规则的本地活跃度，全局最大活跃度集合包括各安全规则的全局最大活跃度；
根据预先获取的历史活跃度集合、本地活跃度集合和全局最大活跃度集合，确定各安全规则的活跃度参数。
在其中一个实施例中，上述基于安全事件数据集合确定本地活跃度集合，包括：
基于安全事件数据集合和预设的时间窗口大小，确定规则组集合；规则组集合包括多个规则组，各规则组包括多个安全规则；
根据各安全规则所属的目标规则组的事件总量，确定各安全规则的本地活跃度，并由多个安全规则的本地活跃度组成本地活跃度集合。
在其中一个实施例中，事件数据包括事件时间、源地址和规则标识，上述基于安全事件数据集合和预设的时间窗口大小，确定规则组集合，包括：
根据安全事件数据集合中各安全事件的事件时间与时间窗口大小，确定多个时间窗口；
对于各时间窗口，从安全事件数据集合中提取出时间窗口内的安全事件，并根据源地址和规则标识对提取出的安全事件进行划分得到初始事件组集合，其中初始事件组集合包括多个初始事件组，各初始事件组包括多个源地址相同和规则标识相同的安全事件；
对初始事件组集合进行过滤处理，得到时间窗口对应的目标事件组集合，其中目标事件组集合包括多个目标事件组，各目标事件组包括按照源地址划分的多个规则组；
根据源地址对多个时间窗口对应的目标事件组集合进行合并处理，得到规则组集合。
在其中一个实施例中，上述对初始事件组进行过滤处理，得到时间窗口对应的目标事件组集合，包括：
根据事件数量对各初始事件组进行归一化处理，得到各初始事件组的事件组参数；
根据各初始事件组的事件组参数和预设事件阈值对初始事件组集合进行过滤处理，得到目标事件组集合。
在其中一个实施例中，上述根据事件数量对各初始事件组进行归一化处理，得到各初始事件组的事件组参数，包括：
根据初始事件组的事件数量和预设常量进行归一化处理，得到归一化后的事件数量；
根据初始事件组中的事件数量和请求成功事件的事件数量进行归一化处理，得到归一化后的成功事件数量；
根据归一化后的事件数量和归一化后的成功事件数量，确定初始事件组的事件组参数。
在其中一个实施例中，上述根据各初始事件组的事件组参数和预设事件阈值对初始事件组集合进行过滤处理，得到目标事件组集合，包括：
对于初始事件组集合中的各初始事件组，若初始事件组的事件组参数小于预设事件阈值，则过滤该初始事件组；
根据初始事件组集合中未被过滤掉的初始事件组，得到目标事件组集合。
在其中一个实施例中，上述根据安全事件数据集合中各安全事件的事件时间与时间窗口大小，确定多个时间窗口，包括：
根据安全事件数据集合中各安全事件的事件时间，确定首个时间窗口的起始时间；
根据首个时间窗口的起始时间和时间窗口大小，确定多个时间窗口。
在其中一个实施例中，确定全局最大活跃度集合的步骤包括：
将本地活跃度集合发送至预设服务器，以供预设服务器根据多个本地活跃度集合确定各安全规则的全局最大活跃度，并由多个安全规则的全局最大活跃度组成全局最大活跃度集合；
接收预设服务器反馈的全局活跃度集合。
在其中一个实施例中，上述根据各安全规则的活跃度参数，控制安全规则库中各安全规则开启或关闭，包括：
根据活跃度参数和网络安全系统的运行负载数据，确定各安全规则的开启概率；
根据各安全规则的开启概率，控制安全规则库中各安全规则开启或关闭。
在其中一个实施例中，上述根据活跃度参数和网络安全系统的运行负载数据，确定各安全规则的开启概率，包括：
从预设的多个负载区间中，确定出运行负载数据所在的目标负载区间；
对于安全规则库中的各安全规则，根据活跃度参数确定安全规则的规则类别；
根据运行负载数据、安全规则的规则类别对应的类别参数、和目标负载区间对应的预设关系式，确定各安全规则的开启概率。
在其中一个实施例中，上述根据各安全规则的开启概率，控制安全规则库中各安全规则开启或关闭，包括：
获取各安全规则对应的随机数；
根据随机数和各安全规则的开启概率，控制各安全规则开启或关闭。
第二方面，本申请实施例提供了一种安全规则库管理装置，该装置包括：
数据获取模块，用于获取安全事件数据集合；其中，安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据；
活跃度确定模块，用于基于安全事件数据集合确定安全规则库中各安全规则的活跃度 参数；
规则库管理模块，用于根据各安全规则的活跃度参数，控制安全规则库中各安全规则开启或关闭。
第三方面，本申请实施例提供了一种计算机设备，包括存储器和处理器，存储器存储有计算机程序，处理器执行计算机程序时实现如第一方面所述方法的步骤。
第四方面，本申请实施例提供了一种计算机可读存储介质，其上存储有计算机程序，计算机程序被处理器执行时如第一方面所述方法的步骤。
第五方面，本申请实施例提供了一种计算机程序产品，包括计算机程序，该计算机程序被处理器执行时实现如第一方面所述方法的步骤。
上述安全规则库管理方法、装置、计算机设备和存储介质，获取安全事件数据集合；基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数；根据各安全规则的活跃度参数，控制安全规则库中各安全规则开启或关闭。通过本申请实施例，可以将安全规则库中命中次数较低的安全规则关闭，这样，网络安全系统在进行安全检测时，无需遍历安全规则库中的所有安全规则，因此，可以提升网络安全系统的检测效率。
附图说明
为了更清楚地说明本申请实施例或相关技术中的技术方案，下面将对实施例或相关技术描述中所需要使用的附图作简单地介绍。显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请一实施例中安全规则库管理方法的应用环境图。
图2为本申请一实施例中安全规则库管理方法的流程示意图。
图3为本申请一实施例中确定各安全规则的活跃度参数步骤的流程示意图。
图4为本申请一实施例中确定本地活跃度集合步骤的流程示意图。
图5为本申请一实施例中确定规则组集合步骤的流程示意图。
图6为本申请一实施例中确定目标事件组集合步骤的流程示意图。
图7为本申请一实施例中控制安全规则库中各安全规则步骤的流程示意图。
图8为本申请一实施例中确定各安全规则的开启概率步骤的流程示意图。
图9为本申请一实施例中开启概率曲线的示意图。
图10为本申请一实施例中安全规则库管理装置的结构框图。
图11为本申请一实施例中计算机设备的内部结构图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
图1为本申请实施例提供的一种安全规则库管理的应用场景示意图。如图1所示，该应用场景包括管理服务器101和多个设置在不同网络中的网络服务器102。管理服务器101上设置有网络安全管理系统；网络服务器102上设置有网络安全系统，网络安全系统可以对其所在的网络进行安全检测，从而检测出入侵、攻击等行为。管理服务器101通过网络与网络服务器102通信，比如，网络服务器102将确定出的本地活跃度集合发送至管理服务器101，管理服务器101根据多个本地活跃度集合确定全局活跃度集合；之后，管理服务器101再将全局活跃度集合返回至网络服务器102。数据存储系统可以存储网络服务器102需要处理的数据，比如，数据存储系统存储安全事件数据集合和安全规则库。数据存储系统可以集成在网络服务器102上，也可以放在云上或其他网络服务器上。管理服务器 101和网络服务器102分别可以用独立的服务器或者是多个服务器组成的服务器集群来实现。
传统技术中，网络安全系统根据安全规则库进行安全检测，需要遍历安全规则库中的每个安全规则。为维持对入侵、攻击等行为的检测能力，网络安全系统必须维护一个广泛且全面的安全规则库。而随着漏洞的层出不穷、安全规则库规模的不断扩大，需要遍历的安全规则越来越多，导致检测效率逐渐降低。
基于上述传统技术，本申请实施例提供了一种安全规则库的管理方案，该方案先获取安全事件数据集合；然后，基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数；再根据各安全规则的活跃度参数，控制安全规则库中各安全规则开启或关闭。通过本申请实施例，可以将安全规则库中命中次数较低的安全规则关闭，即对安全规则库进行自适应调整。这样，网络安全系统在进行安全检测时，无需遍历安全规则库中的所有安全规则，因此，可以提升检测效率。
需要说明的是，本申请实施例所带来的有益效果或者所解决的技术问题并不限定于这一个，还可以是其它隐含或者关联的问题，具体可以参见下述实施例的描述。
下面以具体地实施例对本申请的技术方案以及本申请的技术方案如何解决上述技术问题进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。下面将结合附图，对本申请的实施例进行描述。
在一个实施例中，如图2所示，提供了一种安全规则库管理方法，以该方法应用于图1中的网络服务器为例进行说明，可以包括如下步骤：
步骤S201，获取安全事件数据集合。
其中，安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据。事件数据包括事件时间、安全事件的源地址、安全事件命中的安全规则的规则标识、以及网络安全系统对安全事件响应的响应码等，参照表1所示。
表1
网络安全系统基于安全规则库进行安全检测，得到安全事件的事件数据；之后，存储安全事件的事件数据。在需要对安全规则库进行管理时，从存储的事件数据中获取到预设历史时段内的事件数据以得到安全事件数据集合。
对安全规则库进行管理，可以是按照预设时间，也可以按照预设周期。例如，预设时间为X年X月X日，则在该预设时间对安全规则库进行管理；或者，预设周期为每月，则每月对安全规则库进行管理。需要说明的是，对安全规则库进行管理的触发条件不限于上述描述。
步骤S202，基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数。
其中，活跃度参数表征安全规则的命中情况。可选地，活跃度参数越大，表明安全规则被命中的次数越多；活跃度参数越小，表明安全规则被命中的次数越少。
在获取到安全事件数据集合后，可以根据安全事件数据集合确定安全规则库中各安全规则的命中情况，得到活跃度参数。
例如，根据事件时间、源地址、规则标识和响应码等事件数据，确定安全规则库中的安全规则1在预设历史时段内被频繁命中，而安全规则2在预设历史时段内未被命中……。然后，根据上述事件数据计算出表征安全规则1被频繁命中的参数，得到安全规则1的活跃度参数。以此类推，计算出其他各安全规则的活跃度参数。
步骤S203，根据各安全规则的活跃度参数，控制安全规则库中各安全规则的开启或关 闭。
对于安全规则库中的各安全规则，如果活跃度参数表征该安全规则在预设历史时段内被频繁命中，则控制该安全规则开启；如果活跃度参数表征该安全规则在预设历史时段内被命中的次数较低，则控制该安全规则关闭。
例如，安全规则1对应的活跃度参数为a，大于预设参数阈值x，则控制安全规则1开启；而安全规则2对应的活跃度参数为b，小于预设参数阈值x，则控制安全规则2关闭。
上述实施例中，先获取安全事件数据集合；然后，基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数；再根据各安全规则的活跃度参数，控制安全规则库中各安全规则的开启或关闭。通过本申请实施例，可以将安全规则库中命中次数较低的安全规则关闭，这样，网络安全系统在进行安全检测时，无需遍历安全规则库中的所有安全规则，因此，可以提升网络安全系统的检测效率。
在一个实施例中，如图3所示，涉及上述步骤S202中基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数的过程，本申请实施例可以包括如下步骤：
步骤S301，基于安全事件数据集合确定本地活跃度集合和全局最大活跃度集合。
其中，本地活跃度集合包括各安全规则的本地活跃度，本地活跃度表征安全规则在单个网络中的命中情况。全局最大活跃度集合包括各安全规则的全局最大活跃度，全局最大活跃度表征安全规则在所有网络中命中情况的最大值。
在获取到安全事件数据集合后，可以根据安全事件数据集合确定各安全规则在网络中的命中情况，得到各安全规则的本地活跃度，并由多个安全规则的本地活跃度组成本地活跃度集合。
在确定各安全规则的本地活跃度后，可以从其他网络获取各安全规则在其他网络的本地活跃度；然后，对于各安全规则，确定其在所有网络中本地活跃度的最大值，得到安全规则的全局最大活跃度；最后，由多个安全规则的全局最大活跃度组成全局活跃度集合。
步骤S302，根据预先获取的历史活跃度集合、本地活跃度集合和全局最大活跃度集合，确定各安全规则的活跃度参数。
其中，历史活跃度集合包括多个安全规则的历史活跃度，该历史活跃度为按照历史时间确定出的本地活跃度。
根据历史活跃度集合、本地活跃度集合和全局最大活跃度集合，确定各安全规则的历史活跃度、本地活跃度和全局最大活跃度；然后，对历史活跃度、本地活跃度和全局最大活跃度进行加权计算，得到安全规则的活跃度参数。
确定安全规则的活跃度参数可以参照公式(1)确定：
其中，w_i为活跃度参数，wi为本地活跃度，history_wi为历史活跃度，max_w为全局最大活跃度，σ为历史活跃度对应的权重，δ为全局最大活跃度对应的权重。
由公式(1)可以看出，在安全规则的本地活跃度为0时，使用全局最大活跃度确定活跃度参数；而在安全规则的本地规则大于0时，并不使用全局最大活跃度确定活跃度参数。可选地，在安全规则的本地活跃度为0时，全局最大活跃度对应的权重δ为0.5，在安全规则的本地规则大于0时，全局最大活跃度对应的权重δ为0。可选地，历史活跃度对应的权重σ为0.5。
上述实施例中，基于安全事件数据集合确定本地活跃度集合和全局最大活跃度集合；基于安全事件数据集合确定本地活跃度集合和全局最大活跃度集合。通过本申请实施例，综合考虑不同网络的环境差异性，融合本地活跃度、全局最大活跃度和历史活跃度确定活 跃度参数，可以提升活跃度参数的有效性与全面性。
在一个实施例中，如图4所示，涉及上述步骤S301中基于安全事件数据集合确定本地活跃度集合的过程，本申请实施例可以包括如下步骤S401-S402：
步骤S401，基于安全事件数据集合和预设的时间窗口大小，确定规则组集合。
其中，规则组集合包括多个规则组，各规则组包括多个安全规则，参照表2，id为安全规则的规则标识。
表2
根据预设的时间窗口大小确定多个时间窗口，基于安全事件数据集合确定各时间窗口的事件数据；对每个时间窗口的事件数据进行处理，得到每个时间窗口对应的多个规则组以及各规则组对应的事件总量；然后，对多个时间窗口分别对应的规则组和事件总量进行处理，得到规则组集合。
步骤S402，根据各安全规则所属的目标规则组的事件总量，确定各安全规则的本地活跃度，并由多个安全规则的本地活跃度组成本地活跃度集合。
对于各安全规则，确定安全规则所属的至少一个目标规则组，对至少一个目标规则组的事件总量进行求和处理，得到安全规则的本地活跃度。如公式(2)所示：
其中，wi为本地活跃度，i为安全规则的序号，j为规则组的序号。
参照表2，id3所属的目标规则组包括rule_group1、rule_group2、rule_group3；rule_group1的事件总量为C1，rule_group2的事件总量为C2，rule_group3的事件总量为C3，则id3的本地活跃度w3＝C1+C2+C3。
上述实施例中，基于安全事件数据集合和预设的时间窗口大小，确定规则组集合；根据各安全规则所属的目标规则组的事件总量，确定各安全规则的本地活跃度，并由多个安全规则的本地活跃度组成本地活跃度集合。通过本申请实施例，以规则组的视角进行分析，可以有效地评估安全规则的命中情况，为管理安全规则库提供了依据。
在一个实施例中，上述事件数据包括事件时间、源地址和规则标识，如图5所示，涉及上述步骤S401中基于安全事件数据集合和预设的时间窗口大小，确定规则组集合的过程，本申请实施例可以包括如下步骤S501-S504：
步骤S501，根据安全事件数据集合中各安全事件的事件时间与时间窗口大小，确定多个时间窗口。
根据安全事件数据集合中各安全事件的事件时间，确定首个时间窗口的起始时间；根据首个时间窗口的起始时间和时间窗口大小，确定多个时间窗口。
例如，将所有安全事件的事件时间按照时间先后顺序排列，然后将时间最靠前的事件时间确定为首个时间窗口的起始时间time1，根据首个时间窗口的起始时间time1和时间窗口大小time_window确定首个时间窗口的结束时间time2＝time1+time_window，则首个时间窗口表示为(time1，time2)。将首个时间窗口的结束时间作为第二个时间窗口的起始时间，根据第二时间窗口的起始时间和时间窗口大小可以确定第二个时间窗口的结束时间。以此类推，可以确定多个时间窗口。
步骤S502，对于各时间窗口，从安全事件数据集合中提取出时间窗口内的安全事件， 并根据源地址和规则标识对提取出的安全事件进行划分得到初始事件组集合。
其中，初始事件组集合包括多个初始事件组，各初始事件组包括多个源地址相同和规则标识相同的安全事件。
对于每个时间窗口，先根据事件时间从安全事件数据集合中提取出时间窗口内的安全事件；然后，根据源地址和规则标识对提取出的安全事件进行划分，得到多个初始事件组；再由多个初始事件组组成初始事件组集合。参照表3，示出了首个时间窗口的初始事件组集合。
表3
步骤S503，对初始事件组集合进行过滤处理，得到时间窗口对应的目标事件组集合。
其中，目标事件组集合包括多个目标事件组，各目标事件组包括按照源地址划分的多个规则组。
网络安全系统在进行安全检测时，可能会出现误报的情况，因此，在确定初始事件组集合后，可以根据响应码确定是否存在误报的情况，然后根据误报的情况对初始事件组集合进行过滤处理，并根据过滤后的初始事件组集合确定目标事件组集合。
参照表4，示出了首个时间窗口的目标事件组集合event_group{event_group1，event_group2，event_group3……}。滑动时间窗口，参照上述方式可以确定其他时间窗口的目标事件组集合。
表4
步骤S504，根据源地址对多个时间窗口对应的目标事件组集合进行合并处理，得到规则组集合。
在确定每个时间窗口对应的目标事件组集合后，对多个时间窗口对应的目标事件组集合进行合并处理，得到规则组集合。
例如，如果时间窗口1中的一个源地址ip在时间窗口2中存在，则将时间窗口1的目标事件组集合与时间窗口2的目标事件组集合进行合并得到一个规则组；并且，合并后事件总量为两个目标事件组集合的事件总量之和。如果时间窗口1中的一个源地址在时间窗口2中不存在，则将时间窗口1的目标事件组集合直接作为一个规则组。依次类推，得到多个规则组，并由多个规则组组成规则组集合，如上述实施例中的表2所示。
上述实施例中，根据安全事件数据集合中各安全事件的事件时间与时间窗口大小，确定多个时间窗口；对于各时间窗口，从安全事件数据集合中提取出时间窗口内的安全事件，并根据源地址和规则标识对提取出的安全事件进行划分得到初始事件组集合；对初始事件组集合进行过滤处理，得到时间窗口对应的目标事件组集合；根据源地址对多个时间窗口对应的目标事件组集合进行合并处理，得到规则组集合。本申请实施例采用滑窗的方式对安全事件进行分组，每个时间窗口的运算量较小，并且多个时间窗口的运算可以并行进行， 因此，可以提高分组速度和分组效率，从而提升了安全规则库的自适应调整效率。
在一个实施例中，如图6所示，涉及上述步骤S503中对初始事件组进行过滤处理，得到时间窗口对应的目标事件组集合的过程，本申请实施例可以包括如下步骤S601-S602：
步骤S601，根据事件数量对各初始事件组进行归一化处理，得到各初始事件组的事件组参数。
其中，事件组参数表征初始事件组中请求成功事件的占比。可以理解地，事件组参数越大，表明初始事件组中请求成功事件的占比越高，误报事件越少；事件组参数越小，表明初始事件组中请求成功事件的占比越低，误报事件越多。
在对初始事件组进行过滤处理时，可以先确定初始事件组中请求成功事件的事件数量，再根据请求成功事件的事件数量与初始事件组的事件数量进行归一化处理，得到初始事件组的事件组参数。
可选地，步骤S601中归一化处理过程可以包括如下步骤S6011-S6013：
步骤S6011，根据初始事件组的事件数量和预设常量进行归一化处理，得到归一化后的事件数量，如公式(3)所示：
其中，cnt_n为归一化后的事件数量，cnt为初始事件组的事件数量，MAX_cnt为预设常量。可选地，预设常量MAX_cnt为20。
根据上述公式(3)，先从初始事件组的事件数量与预设常量中选取出较小的值，再计算较小的值与预设常量的比值，得到归一化后的事件数量。
步骤S6012，根据初始事件组中的事件数量和请求成功事件的事件数量进行归一化处理，得到归一化后的成功事件数量。
根据响应码确定初始事件组中请求成功事件的事件数量，然后计算请求成功事件的事件数量与初始事件组中的事件数量之间的比值，得到归一化后的成功事件数量。可选地，请求成功事件的响应码的第一位为2，例如，响应码201、202、203等。
考虑到初始事件组的事件数量可能为0的情况，可以采用公式(4)确定归一化后的成功事件数量，如下：
其中，sreq_n为归一化后的成功事件数量，sreq为请求成功事件的事件数量，cnt为初始事件组的事件数量。
步骤S6013，根据归一化后的事件数量和归一化后的成功事件数量，确定初始事件组的事件组参数。
计算归一化后的成功事件数量与归一化后的事件数量之间的比值，得到初始事件组的事件组参数，如公式(5)所示：
其中，k为事件组参数，cnt_n为归一化后的事件数量，sreq_n为归一化后的成功事件数量。
步骤S602，根据各初始事件组的事件组参数和预设事件阈值对初始事件组集合进行过 滤处理，得到目标事件组集合。
对于各初始事件组，将初始事件组的事件组参数与预设事件阈值进行比较，根据比较结果确定是否过滤该初始事件组；之后，由未被过滤掉的初始事件组组成目标事件组集合。
可选地，过滤处理的过程可以包括：对于初始事件组集合中的各初始事件组，若事件组参数小于预设事件阈值，则过滤该初始事件组；根据初始事件组集合中未被过滤掉的初始事件组，得到目标事件组集合。
例如，预设事件阈值为3，如果初始事件组的事件参数小于3，表明该初始事件组的请求成功事件较少、误报事件较多，因此，将该初始事件组被过滤掉。
上述实施例中，根据事件数量对各初始事件组进行归一化处理，得到各初始事件组的事件组参数；根据各初始事件组的事件组参数和预设事件阈值对初始事件组集合进行过滤处理，得到目标事件组集合。本申请实施例中，结合响应码对事件数量进行归一化处理得到事件组参数，可以有效过滤误报事件多的事件组，从而降低误报时间对活跃度参数造成的影响，提高活跃度参数的准确度。
在一个实施例中，上述全局最大活跃度集合的确定过程包括：将本地活跃度集合发送至预设服务器，以供预设服务器根据多个本地活跃度集合确定各安全规则的全局最大活跃度，并由多个安全规则的全局最大活跃度组成全局最大活跃度集合；接收预设服务器反馈的全局活跃度集合。
其中，预设服务器可以为图1中的管理服务器。
各网络的网络服务器在确定本地活跃度集合后，将本地活跃度集合发送到预设服务器。预设服务器获取到多个网络的本地活跃度集合后，确定每个安全规则在多个网络的本地活跃度，并选取出最大的本地活跃度作为全局最大活跃度。之后，由多个安全规则的全局最大活跃度组成全局最大活跃度。
管理服务器将全局活跃度集合分别反馈回各网络的网络服务器，以便网络服务器可以根据全局最大活跃度集合确定各安全规则的活跃度参数。
上述实施例中，将本地活跃度集合发送至预设服务器，以供预设服务器根据多个本地活跃度集合确定各安全规则的全局最大活跃度，并由多个安全规则的全局最大活跃度组成全局最大活跃度集合；接收预设服务器反馈的全局活跃度集合。本申请实施例获取全局最大活跃度集合，可以在安全规则本地未命中的情况下，考虑安全规则外地的命中情况，从而综合不同网络的环境差异性，提升安全规则的活跃度参数的有效性与全面性。
在一个实施例中，如图7所示，涉及上述步骤S203中根据各安全规则的活跃度参数，控制安全规则库中各安全规则开启或关闭的过程，本申请实施例可以包括如下步骤S701-S702：
步骤S701，根据活跃度参数和网络安全系统的运行负载数据，确定各安全规则的开启概率。
其中，运行负载数据可以包括CPU利用率、内存利用率和丢包率中的至少一种。开启概率用于表征安全规则开启的概率。
运行负载数据影响网络安全系统的检测效率，在实际应用中，结合安全规则的活跃度参数以及网络安全系统的运行负载数据计算各安全规则的开启概率。可以理解地，运行负载数据越小，安全规则库中允许开启的安全规则就越多，计算出的开启概率就越大；运行负载数据越大，安全规则库中开启的安全规则越少，计算出的开启概率就越小。
步骤S702，根据各安全规则的开启概率，控制安全规则库中各安全规则开启或关闭。
对于安全规则库中的各安全规则，如果安全规则的开启概率大于或等于预设概率阈值，则控制安全规则开启；如果安全规则的开启概率小于预设概率阈值，则控制安全规则关闭。
在其中一个实施例中，获取各安全规则的随机数；根据随机数和各安全规则的开启概率，控制各安全规则开启或关闭，如公式(6)所示：
其中，v为安全规则的状态，v＝0表明控制安全规则关闭，v＝1表明控制安全规则开启；RAND(0，1)为0到1之间的随机数，y为安全规则的开启概率。
上述实施例中，根据活跃度参数和网络安全系统的运行负载数据，确定各安全规则的开启概率；根据各安全规则的开启概率，控制安全规则库中各安全规则开启或关闭。本申请实施例结合网络安全系统的运行负载情况为各安全规则设置开启概率，可以实现对安全规则库在不同允许负载情况下的自适应调整，从而提升网络安全系统的检测效率。
在一个实施例中，如图8所示，涉及上述步骤S701中根据活跃度参数和网络安全系统的运行负载数据，确定各安全规则的开启概率的过程，本申请实施例可以包括如下步骤S801-S803：
步骤S801，从预设的多个负载区间中，确定出运行负载数据所在的目标负载区间。
预先设置多个负载区间，根据运行负载数据确定出对应的目标负载区间。
例如，设置运行负载阈值(0<xa<1)与阈值(xa<xb<1)，根据运行负载阈值划分出3个负载区间：[0，xa]、(xa，xb]、(xb，1]。可选地，xa＝0.5，xb＝0.9。将运行负载数据x所在的负载区间确定为目标负载区间。
其中，运行负载数据可以按照预先设置的采集周期进行采集。可选地，采集周期为10分钟，即每10分钟采集一次运行负载数据。
步骤S802，对于安全规则库中的各安全规则，根据活跃度参数确定安全规则的规则类别。
其中，规则类别也可以表征安全规则的命中情况。在实际应用中，规则类别按照命中次数从多到少排列，可以包括活跃规则、沉默规则、睡眠规则、休眠规则。需要说明的是，规则类别不限于上述描述，还可以包括其他类别。
对于安全规则库中的各安全规则，在确定安全规则的活跃度参数后，可以根据预设的活跃阈值、睡眠阈值和活跃度参数确定安全规则的规则类别。
例如，活跃阈值t1，睡眠阈值t2，其中t1>t21；1)当活跃度参数wi>t1，则确定安全规则的规则类别为活跃规则；2)当活跃度参数t1>wi>t2，则确定安全的规则类别为沉默规则；3)当活跃度参数t2>wi>0，则确定安全规则的规则类别为睡眠规则；4)当活跃度参数wi＝0，则确定安全规则的规则类别为休眠规则。可选地，t1＝100，t2＝10。
步骤S803，根据运行负载数据、安全规则的规则类别对应的类别参数、和目标负载区间对应的预设关系式，确定各安全规则的开启概率。
对于不同的负载区间，确定安全规则的开启概率可以采用不同的预设关系式，如公式(7)所示：
其中，f1(w)和f2(w)为安全规则的规则类别对应的类别参数。对于不同规则类别，f1(w)和f2(w)的值不同。
例如，对于活跃规则，即当安全规则的活跃度参数wi>t1时，f1(w)＝1，f2(w)＝0.8；对于沉默规则，即当安全规则的活跃度参数t1>wi>t2时，f1(w)＝0.8，f2(w)＝0.5；对 于睡眠规则，即当安全规则的活跃度参数t2>wi>0时，f1(w)＝0.5，f2(w)＝0；对于休眠规则，即当安全规则的活跃度参数wi＝0时，f1(w)＝0，f2(w)＝0。
根据公式7可以得到如图9所示的开启概率曲线。
需要说明的是，在实际应用中，确定开启概率的预设关系式不限于上述公式(7)的线性关系式，还可以采用其他非线性关系式。
上述实施例中，从预设的多个负载区间中，确定出运行负载数据所在的目标负载区间；对于安全规则库中的各安全规则，根据活跃度参数确定安全规则的规则类别；根据运行负载数据、安全规则的规则类别对应的类别参数、和目标负载区间对应的预设关系式，确定各安全规则的开启概率。本申请实施例结合网络安全系统的运行负载情况为不同类别的安全规则设置不同的开启概率，差异性设置规则开启概率，可以实现对不同安全规则在不同运行负载情况下的自适应调整，从而提升安全规则的应用效率和网络安全系统的检测效率。
在一个实施例中，提供了一种安全规则库管理方法，以该方法应用于图1中的网络服务器为例进行说明，可以包括如下步骤：
步骤1，获取安全事件数据集合。
其中，安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据。事件数据包括事件时间、源地址、规则标识和响应码中至少一种。
步骤2，根据安全事件数据集合中各安全事件的事件时间，确定首个时间窗口的起始时间；根据首个时间窗口的起始时间和时间窗口大小，确定多个时间窗口。
步骤3，对于各时间窗口，从安全事件数据集合中提取出时间窗口内的安全事件，并根据源地址和规则标识对提取出的安全事件进行划分得到初始事件组集合。
其中，初始事件组集合包括多个初始事件组，各初始事件组包括多个源地址相同和规则标识相同的安全事件。
步骤4，根据初始事件组的事件数量和预设常量进行归一化处理，得到归一化后的事件数量；根据初始事件组中的事件数量和请求成功事件的事件数量进行归一化处理，得到归一化后的成功事件数量；根据归一化后的事件数量和归一化后的成功事件数量，确定初始事件组的事件组参数。
步骤5，对于初始事件组集合中的各初始事件组，若事件组参数小于预设事件阈值，则过滤初始事件组；根据初始事件组集合中未被过滤掉的初始事件组，得到目标事件组集合。
步骤6，根据源地址对多个时间窗口对应的目标事件组集合进行合并处理，得到规则组集合。
步骤7，根据各安全规则所属的目标规则组的事件总量，确定各安全规则的本地活跃度，并由多个安全规则的本地活跃度组成本地活跃度集合。
步骤8，将本地活跃度集合发送至预设服务器，以供预设服务器根据多个本地活跃度集合确定各安全规则的全局最大活跃度，并由多个安全规则的全局最大活跃度组成全局最大活跃度集合；接收预设服务器反馈的全局活跃度集合。
步骤9，根据预先获取的历史活跃度集合、本地活跃度集合和全局最大活跃度集合，确定各安全规则的活跃度参数。
步骤10，从预设的多个负载区间中，确定出运行负载数据所在的目标负载区间；对于安全规则库中的各安全规则，根据活跃度参数确定安全规则的规则类别；根据运行负载数据、安全规则的规则类别对应的类别参数和目标负载区间对应的预设关系式，确定各安全规则的开启概率。
步骤11，获取各安全规则的随机数；根据随机数和各安全规则的开启概率，控制各安全规则开启或关闭。
应该理解的是，虽然上述流程图中的各个步骤按照箭头的指示依次显示，但是这些步 骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，上述流程图中的至少一部分步骤可以包括多个步骤或者多个阶段，这些步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤中的步骤或者阶段的至少一部分轮流或者交替地执行。
在一个实施例中，如图10所示，提供了一种安全规则库管理装置，包括：
数据获取模块901，用于获取安全事件数据集合；其中，安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据；
活跃度确定模块902，用于基于安全事件数据集合确定安全规则库中各安全规则的活跃度参数；
规则库管理模块903，用于根据各安全规则的活跃度参数，控制安全规则库中各安全规则开启或关闭。
在其中一个实施例中，活跃度确定模块902，具体用于基于安全事件数据集合确定本地活跃度集合和全局最大活跃度集合；本地活跃度集合包括各安全规则的本地活跃度，全局最大活跃度集合包括各安全规则的全局最大活跃度；根据预先获取的历史活跃度集合、本地活跃度集合和全局最大活跃度集合，确定各安全规则的活跃度参数。
在其中一个实施例中，活跃度确定模块902具体用于基于安全事件数据集合和预设的时间窗口大小，确定规则组集合；规则组集合包括多个规则组，各规则组包括多个安全规则；根据各安全规则所属的目标规则组的事件总量，确定各安全规则的本地活跃度，并由多个安全规则的本地活跃度组成本地活跃度集合。
在其中一个实施例中，事件数据包括事件时间、源地址和规则标识；活跃度确定模块902具体用于根据安全事件数据集合中各安全事件的事件时间与时间窗口大小，确定多个时间窗口；对于各时间窗口，从安全事件数据集合中提取出时间窗口内的安全事件，并根据源地址和规则标识对提取出的安全事件进行划分得到初始事件组集合；初始事件组集合包括多个初始事件组，各初始事件组包括多个源地址相同和规则标识相同的安全事件；对初始事件组集合进行过滤处理，得到时间窗口对应的目标事件组集合；目标事件组集合包括多个目标事件组，各目标事件组包括按照源地址划分的多个规则组；根据源地址对多个时间窗口对应的目标事件组集合进行合并处理，得到规则组集合。
在其中一个实施例中，活跃度确定模块902具体用于根据事件数量对各初始事件组进行归一化处理，得到各初始事件组的事件组参数；根据各初始事件组的事件组参数和预设事件阈值对初始事件组集合进行过滤处理，得到目标事件组集合。
在其中一个实施例中，活跃度确定模块902具体用于根据初始事件组的事件数量和预设常量进行归一化处理，得到归一化后的事件数量；根据初始事件组中的事件数量和请求成功事件的事件数量进行归一化处理，得到归一化后的成功事件数量；根据归一化后的事件数量和归一化后的成功事件数量，确定初始事件组的事件组参数。
在其中一个实施例中，活跃度确定模块902具体用于对于初始事件组集合中的各初始事件组，若事件组参数小于预设事件阈值，则过滤初始事件组；根据初始事件组集合中未被过滤的初始事件组，得到目标事件组集合。
在其中一个实施例中，活跃度确定模块902具体用于根据安全事件数据集合中各安全事件的事件时间，确定首个时间窗口的起始时间；根据首个时间窗口的起始时间和时间窗口大小，确定多个时间窗口。
在其中一个实施例中，活跃度确定模块902具体用于将本地活跃度集合发送至预设服务器，以供预设服务器根据多个本地活跃度集合确定各安全规则的全局最大活跃度，并由多个安全规则的全局最大活跃度组成全局最大活跃度集合；接收预设服务器反馈的全局活跃度集合。
在其中一个实施例中，规则库管理模块903具体用于根据活跃度参数和网络安全系统 的运行负载数据，确定各安全规则的开启概率；根据各安全规则的开启概率，控制安全规则库中各安全规则开启或关闭。
在其中一个实施例中，规则库管理模块903具体用于从预设的多个负载区间中，确定出运行负载数据所在的目标负载区间；对于安全规则库中的各安全规则，根据活跃度参数确定安全规则的规则类别；根据运行负载数据、安全规则的规则类别对应的类别参数、和目标负载区间对应的预设关系式，确定各安全规则的开启概率。
在其中一个实施例中，规则库管理模块903具体用于获取各安全规则对应的随机数；根据随机数和各安全规则的开启概率，控制各安全规则开启或关闭。
关于安全规则库管理装置的具体限定可以参见上文中对于安全规则库管理方法的限定，在此不再赘述。上述安全规则库管理装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一个实施例中，提供了一种计算机设备，该计算机设备可以是服务器，其内部结构图可以如图11所示。该计算机设备包括处理器、存储器、输入/输出接口(Input/Output，简称I/O)和通信接口。其中，处理器、存储器和输入/输出接口通过系统总线连接，通信接口通过输入/输出接口连接到系统总线。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质和内存储器。该非易失性存储介质存储有操作系统、计算机程序和数据库。该内存储器为非易失性存储介质中的操作系统和计算机程序的运行提供环境。该计算机设备的数据库用于存储安全规则库管理数据。该计算机设备的输入/输出接口用于处理器与外部设备之间交换信息。该计算机设备的通信接口用于与外部的终端通过网络连接通信。该计算机程序被处理器执行时以实现一种安全规则库管理方法。
在一个实施例中，还提供了一种计算机可读存储介质，其上存储有计算机程序，计算机程序可由服务器的处理器执行以完成上述方法。存储介质可以是非临时性计算机可读存储介质，例如，所述非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
在一个实施例中，还提供了一种计算机程序产品，该计算机程序被处理器执行时，可以实现上述方法。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行这些计算机指令时，可以全部或部分地按照本公开实施例所述的流程或功能实现上述方法中的部分或者全部。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一非易失性计算机可读取存储介质中，该计算机程序在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所命中的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和易失性存储器中的至少一种。非易失性存储器可包括只读存储器(Read-Only Memory，ROM)、磁带、软盘、闪存或光存储器等。易失性存储器可包括随机存取存储器(Random Access Memory，RAM)或外部高速缓冲存储器。作为说明而非局限，RAM可以是多种形式，比如静态随机存取存储器(Static Random Access Memory，SRAM)或动态随机存取存储器(Dynamic Random Access Memory，DRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范 围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (15)

  1. 一种安全规则库管理方法，包括：
    获取安全事件数据集合，其中所述安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据；
    基于所述安全事件数据集合确定所述安全规则库中各安全规则的活跃度参数；
    根据各所述安全规则的活跃度参数，控制所述安全规则库中各所述安全规则开启或关闭。
  2. 根据权利要求1所述的方法，其中所述基于所述安全事件数据集合确定所述安全规则库中各安全规则的活跃度参数，包括：
    基于所述安全事件数据集合确定本地活跃度集合和全局最大活跃度集合，所述本地活跃度集合包括各所述安全规则的本地活跃度，所述全局最大活跃度集合包括各所述安全规则的全局最大活跃度；
    根据预先获取的历史活跃度集合、所述本地活跃度集合和所述全局最大活跃度集合，确定各所述安全规则的活跃度参数。
  3. 根据权利要求2所述的方法，其中所述基于所述安全事件数据集合确定本地活跃度集合，包括：
    基于所述安全事件数据集合和预设的时间窗口大小，确定规则组集合，所述规则组集合包括多个规则组，各所述规则组包括多个安全规则；
    根据各所述安全规则所属的目标规则组的事件总量，确定各所述安全规则的本地活跃度，并由多个所述安全规则的本地活跃度组成所述本地活跃度集合。
  4. 根据权利要求3所述的方法，其中所述事件数据包括事件时间、源地址和规则标识，所述基于所述安全事件数据集合和预设的时间窗口大小，确定规则组集合包括：
    根据所述安全事件数据集合中各安全事件的事件时间与所述时间窗口大小，确定多个时间窗口；
    对于各所述时间窗口，从所述安全事件数据集合中提取出所述各时间窗口内的安全事件，并根据所述源地址和所述规则标识对提取出的安全事件进行划分得到初始事件组集合，其中所述初始事件组集合包括多个初始事件组，各所述初始事件组包括多个源地址相同和规则标识相同的安全事件；
    对所述初始事件组集合进行过滤处理，得到所述时间窗口对应的目标事件组集合，其中所述目标事件组集合包括多个目标事件组，各所述目标事件组包括按照源地址划分的多个规则组；
    根据所述源地址对多个所述时间窗口对应的目标事件组集合进行合并处理，得到所述规则组集合。
  5. 根据权利要求4所述的方法，其中所述对所述初始事件组进行过滤处理，得到所述时间窗口对应的目标事件组集合，包括：
    根据事件数量对各所述初始事件组进行归一化处理，得到各所述初始事件组的事件组参数；
    根据各所述初始事件组的事件组参数和预设事件阈值对所述初始事件组集合进行过滤处理，得到所述目标事件组集合。
  6. 根据权利要求5所述的方法，其中所述根据事件数量对各所述初始事件组进行归一化处理，得到各所述初始事件组的事件组参数，包括：
    根据所述初始事件组的事件数量和预设常量进行归一化处理，得到归一化后的事件数量；
    根据所述初始事件组中的事件数量和请求成功事件的事件数量进行归一化处理，得到归一化后的成功事件数量；
    根据所述归一化后的事件数量和所述归一化后的成功事件数量，确定所述初始事件组的事件组参数。
  7. 根据权利要求5所述的方法，其中所述根据各所述初始事件组的事件组参数和预设事件阈值对所述初始事件组集合进行过滤处理，得到所述目标事件组集合，包括：
    对于所述初始事件组集合中的各所述初始事件组，若初始事件组的事件组参数小于所述预设事件阈值，则过滤所述初始事件组；
    根据所述初始事件组集合中未被过滤掉的初始事件组，得到所述目标事件组集合。
  8. 根据权利要求6所述的方法，其中所述根据所述安全事件数据集合中各安全事件的事件时间与所述时间窗口大小，确定多个时间窗口，包括：
    根据所述安全事件数据集合中各安全事件的事件时间，确定首个时间窗口的起始时间；
    根据所述首个时间窗口的起始时间和所述时间窗口大小，确定所述多个时间窗口。
  9. 根据权利要求2所述的方法，其中所述确定全局最大活跃度集合的步骤包括：
    将所述本地活跃度集合发送至预设服务器，以供所述预设服务器根据多个所述本地活跃度集合确定各所述安全规则的全局最大活跃度，并由多个所述安全规则的全局最大活跃度组成所述全局最大活跃度集合；
    接收所述预设服务器反馈的所述全局活跃度集合。
  10. 根据权利要求1-9任一项所述的方法，其中所述根据各所述安全规则的活跃度参数，控制所述安全规则库中各所述安全规则开启或关闭，包括：
    根据所述活跃度参数和所述网络安全系统的运行负载数据，确定各所述安全规则的开启概率；
    根据各所述安全规则的开启概率，控制所述安全规则库中各所述安全规则开启或关闭。
  11. 根据权利要求10所述的方法，其中所述根据所述活跃度参数和所述网络安全系统的运行负载数据，确定各所述安全规则的开启概率，包括：
    从预设的多个负载区间中，确定出所述运行负载数据所在的目标负载区间；
    对于所述安全规则库中的各安全规则，根据所述活跃度参数确定所述安全规则的规则类别；
    根据所述运行负载数据、所述安全规则的规则类别对应的类别参数、和所述目标负载区间对应的预设关系式，确定各所述安全规则的开启概率。
  12. 根据权利要求11所述的方法，其中所述根据各所述安全规则的开启概率，控制所述安全规则库中各所述安全规则开启或关闭，包括：
    获取各所述安全规则对应的随机数；
    根据所述随机数和各所述安全规则的开启概率，控制各所述安全规则开启或关闭。
  13. 一种安全规则库管理装置，包括：
    数据获取模块，用于获取安全事件数据集合，其中所述安全事件数据集合包括预设历史时段内网络安全系统基于安全规则库检测到的多个安全事件的事件数据；
    活跃度确定模块，用于基于所述安全事件数据集合确定所述安全规则库中各安全规则的活跃度参数；
    规则库管理模块，用于根据各所述安全规则的活跃度参数，控制所述安全规则库中各所述安全规则开启或关闭。
  14. 一种计算机设备，包括存储器和处理器，所述存储器存储有计算机程序，其中所述处理器执行所述计算机程序时实现权利要求1至12中任一项所述的方法的步骤。
  15. 一种计算机可读存储介质，其上存储有计算机程序，其中所述计算机程序被处理器执行时实现权利要求1至12中任一项所述的方法的步骤。
PCT/CN2023/140249 2023-07-24 2023-12-20 安全规则库管理方法、装置、计算机设备和存储介质 Pending WO2025020439A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310906721.8 2023-07-24
CN202310906721.8A CN116633695B (zh) 2023-07-24 2023-07-24 安全规则库管理方法、装置、计算机设备和存储介质

Publications (1)

Publication Number Publication Date
WO2025020439A1 true WO2025020439A1 (zh) 2025-01-30

Family

ID=87592458

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/140249 Pending WO2025020439A1 (zh) 2023-07-24 2023-12-20 安全规则库管理方法、装置、计算机设备和存储介质

Country Status (2)

Country Link
CN (1) CN116633695B (zh)
WO (1) WO2025020439A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116633695B (zh) * 2023-07-24 2023-11-03 中国电信股份有限公司 安全规则库管理方法、装置、计算机设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105592061A (zh) * 2015-10-27 2016-05-18 杭州华三通信技术有限公司 一种攻击规则的关闭方法和装置
CN112084036A (zh) * 2020-09-21 2020-12-15 新华三信息安全技术有限公司 报文检测规则的控制方法、装置、电子设备及存储介质
CN113722573A (zh) * 2020-05-26 2021-11-30 中国电信股份有限公司 生成网络安全威胁数据集合的方法、系统和存储介质
CN114598659A (zh) * 2020-11-19 2022-06-07 华为技术有限公司 规则库优化方法和装置
CN116633695A (zh) * 2023-07-24 2023-08-22 中国电信股份有限公司 安全规则库管理方法、装置、计算机设备和存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8666861B2 (en) * 2010-10-21 2014-03-04 Visa International Service Association Software and methods for risk and fraud mitigation
US9225772B2 (en) * 2011-09-26 2015-12-29 Knoa Software, Inc. Method, system and program product for allocation and/or prioritization of electronic resources
CN108243060A (zh) * 2017-01-19 2018-07-03 上海直真君智科技有限公司 一种基于大数据预分类的网络安全告警风险判定方法
US20220383321A1 (en) * 2021-05-25 2022-12-01 Affirm, Inc. System, Method and Apparatus for Creating, Testing and Disseminating Fraud Rules
CN115955347A (zh) * 2022-12-21 2023-04-11 北京天融信网络安全技术有限公司 一种入侵防御规则处理方法、装置、设备及介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105592061A (zh) * 2015-10-27 2016-05-18 杭州华三通信技术有限公司 一种攻击规则的关闭方法和装置
CN113722573A (zh) * 2020-05-26 2021-11-30 中国电信股份有限公司 生成网络安全威胁数据集合的方法、系统和存储介质
CN112084036A (zh) * 2020-09-21 2020-12-15 新华三信息安全技术有限公司 报文检测规则的控制方法、装置、电子设备及存储介质
CN114598659A (zh) * 2020-11-19 2022-06-07 华为技术有限公司 规则库优化方法和装置
CN116633695A (zh) * 2023-07-24 2023-08-22 中国电信股份有限公司 安全规则库管理方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
CN116633695B (zh) 2023-11-03
CN116633695A (zh) 2023-08-22

Similar Documents

Publication Publication Date Title
US11558418B2 (en) System for query injection detection using abstract syntax trees
Venkataraman et al. New streaming algorithms for fast detection of superspreaders
Xu et al. A stochastic model of active cyber defense dynamics
US10476753B2 (en) Behavior-based host modeling
Gogoi et al. MLH-IDS: a multi-level hybrid intrusion detection method
US10367842B2 (en) Peer-based abnormal host detection for enterprise security systems
CN110351307A (zh) 基于集成学习的异常用户检测方法及系统
CN108769163B (zh) 联盟链共识达成方法、设备及计算机可读存储介质
US11477218B2 (en) Cluster-based precision mitigation of network attacks
CN112367340B (zh) 一种内网资产风险评估方法、装置、设备及介质
WO2018236504A1 (en) Automatically detecting insider threats using user collaboration patterns
EP3005661A1 (en) Controlling network access based on application detection
CN108540430A (zh) 一种威胁检测方法及装置
Chen et al. Persistent items tracking in large data streams based on adaptive sampling
CN114386025A (zh) 异常检测方法、装置、电子设备及存储介质
US20180183681A1 (en) Behavior-based community detection in enterprise information networks
CN114969744A (zh) 进程拦截方法及系统、电子设备、存储介质
WO2025020439A1 (zh) 安全规则库管理方法、装置、计算机设备和存储介质
US11544123B1 (en) Systems and methods for detecting partitioned and aggregated novel network, user, device and application behaviors
CN115632827A (zh) 一种网络防护方法、装置、计算机设备和存储介质
Qiao et al. Mining of attack models in ids alerts from network backbone by a two-stage clustering method
EP3005656A1 (en) Controlling network access based on application detection
RU2704741C2 (ru) СПОСОБ ЗАЩИТЫ ОТ DDoS-АТАК НА ОСНОВЕ КЛАССИФИКАЦИИ ТРАФИКА
US20250030707A1 (en) Attack behavior detection
CN114338237B (zh) 终端行为监测方法、装置、设备、介质和计算机程序产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23946514

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE