Method and device for optimizing and configuring detection rule
A method and a device for optimizing and configuring a detection rule, where the method includes: a network entity receives network traffic; extracts a packet from the network traffic, and identifies, according to a feature of the packet, protocol related information used in the network; saves the protocol related information and correspondence between pieces of information in the protocol related information to a first learning association table; and matches a corresponding rule from a vulnerability rule base according to the protocol related information to generate a first compact rule set. Through the generated compact rule set in the present invention, subsequent protocol detection is performed only for a protocol threat that may occur in a live network; therefore, content that needs to be detected subsequently is reduced, the detection efficiency is improved, and unnecessary performance consumption is avoided at the same time.
1. A method performed by a network entity for optimizing and configuring a detection rule, comprising:
receiving network traffic from a network device;
extracting a plurality of packets from the network traffic;
identifying protocol related information in the packets, wherein the protocol related information includes one or more of a protocol name, an application protocol name, a port number, a server software name, and a server software version;
saving the protocol related information in a memory of the network entity;
obtaining a first vulnerability rule corresponding to the protocol related information from a vulnerability rule base stored in the memory, wherein the first vulnerability rule is set corresponding to the protocol information in the vulnerability rule base; and
performing protocol threat detection according to the obtained first vulnerability rule;
the method further comprising setting a valid traffic percentage range, wherein extracting the packets from the network traffic comprises extracting the packets of at least one application protocol from the network traffic and wherein a percentage of traffic of each application protocol in the at least one application protocol from the network traffic is within the valid traffic percentage range.
2. The method according to claim 1 , further comprising:
sending the identified protocol related information and the obtained first vulnerability rule to a user; and
receiving a confirmed vulnerability rule delivered from the user when the user confirms the obtained first vulnerability rule.
3. The method according to claim 2 , further comprising:
saving changed protocol related information when the user changes the protocol related information;
obtaining a second vulnerability rule from the vulnerability rule base according to the changed protocol related information; and
performing protocol threat detection according to the second vulnerability rule which is obtained according to the changed protocol related information.
4. The method according to claim 1 , further comprising setting a learning range, wherein the learning range comprises a network segment or an Internet Protocol (IP) address that is determined in advance, and wherein extracting the packets from the network traffic comprises extracting, from the network traffic, the packets with a carried address within the learning range.
5. The method according to claim 1 , wherein after saving the protocol related information in a memory of the network entity, the method further comprises deleting, from the memory, protocol related information corresponding to traffic from the network traffic beyond the valid traffic percentage range.
6. A device for optimizing and configuring a detection rule, comprising:
a processor; and
a memory coupled to the processor and comprising instructions which, when executed by the processor, cause the processor to:
receive network traffic from a network device;
extract a plurality of packets from the network traffic;
identify, protocol related information in the packets, wherein the protocol related information includes one or more of a protocol name, an application protocol name, a port number, a server software name, and a server software version;
save the protocol related information in a memory of the device;
obtain a first vulnerability rule corresponding to protocol related information from a vulnerability rule base stored in the memory, wherein the first vulnerability rule is set corresponding to the protocol information in the vulnerability rule base; and
perform protocol threat detection according to the obtained first vulnerability rule;
the instructions further cause the processor to:
set a valid traffic percentage range;
wherein extracting the packets from the network traffic comprises:
extract the packets of at least one application protocol from the network traffic, and
wherein a percentage of traffic of each application protocol in the at least one application protocol from the network traffic is within the valid traffic percentage range.
7. The device according to claim 6 , wherein the instructions further cause the processor to:
send the identified protocol related information and the obtained first vulnerability rule to a user; and
receive a confirmed vulnerability rule delivered by the user when the user confirms the obtained first vulnerability rule.
8. The device according to claim 7 , wherein the instructions further cause the processor to:
save changed protocol related information in the memory of the device when the user changes the protocol related information,
obtain a second vulnerability rule from the vulnerability rule base according to the changed protocol related information; and
perform protocol threat detection according to the second vulnerability rule which is obtained according to the changed protocol related information.
9. The device according to claim 6 , wherein the instructions further cause the processor to:
set a learning range, wherein the learning range comprises a network segment or an Internet Protocol (IP) address that is determined in advance; and
extract, from the network traffic, the packets with a carried address within the learning range.
10. The device according to claim 6 , wherein the instructions further cause the processor to:
delete, from the memory, protocol related information corresponding to traffic from the network traffic beyond the valid traffic percentage range.