CN101272254A - Method for generating attack signature database, method and device for preventing network attacks - Google Patents

Abstract

The embodiment of the invention discloses a method for generating an attack feature library, a method for preventing network attacks and a device for preventing network attacks. The method for preventing network attacks includes: judging according to the attack signature database whether the message to be sent to the main control CP contains the attack signature in the attack signature database, and if it is judged to be yes, according to the The attack feature performs corresponding anti-attack processing on the message; when the judgment is no, the message is sent to the main control CP and cached in the queue to be analyzed. By using the present invention, the attack signatures that have occurred can be extracted from the huge IPS rule library to form an attack signature database, so that effective real-time defense can be implemented against subsequent attacks of the same type, and better system performance can be achieved while ensuring system performance. preventive effect.

Description

Method for generating attack signature database, method and device for preventing network attacks

technical field

The invention relates to the Internet, in particular to a method for generating an attack feature database, a method for preventing network attacks and a device for preventing network attacks.

Background technique

When it comes to secure networks, it is generally divided into three levels, namely equipment security, network security, and business security. Among them, device security is the basis for building a secure network. Therefore, how to ensure the security of network devices, especially network devices of important nodes (such as routers and switches) is a problem that the industry needs to focus on solving.

For the protection of key equipment such as servers, it is natural to think of firewalls. Generally, connecting a firewall to the network interface of the equipment can effectively ensure the security of the equipment. However, it is more difficult to protect devices such as routers, because routers, especially high-end routers, have high interface density and large traffic, so it is impossible to use an external firewall to protect the router itself from attacks. Therefore, there are generally the following two technologies for the protection of routers.

The solution of the prior art is to integrate the IPS (Intrusion Prevention System, intrusion prevention system)/IDS (Intrusion Detection System, intrusion detection system) system into the system, and the system CPU performs real-time anti-attack processing. The IPS rule base is a summary of various attack characteristics existing on the network. As time goes by, there are more and more attacks, the IPS rule base is also getting bigger and bigger, and the system processing burden (resource and performance consumption) is also getting heavier, so the IPS rule base is generally large and the processing process is complicated. The CPU performance requirements are high, and the general CPU processing performance is low, so it is usually used on enterprise-level low-end routers. If it is applied to a high-end router based on a distributed architecture, it will take up too many resources and CPU performance, and the effect will be poor.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a method and device for preventing network attacks, which can implement effective real-time protection for the system without occupying too many resources and CPU performance, and improve the security of the entire system. preventive ability.

In order to solve the above technical problems, an embodiment of the present invention provides a method for generating an attack signature library, including:

When the message is sent to the main control CP, the message is cached in the queue to be analyzed;

When the active/standby abnormal switchover occurs in the master control CP, it is judged according to the IPS rule base whether the cached uploaded message in the queue to be analyzed contains an attack signature, and if it is judged to be yes, the attack signature of the message is extracted and stored in the attack signature database .

Also provides a way to protect against cyber attacks, including:

According to the attack signature library, it is judged whether the message that needs to be sent to the main control CP contains the attack signature in the attack signature database, and if it is judged to be yes, the message is subjected to corresponding anti-attack processing according to the attack signature ; When judging no, send the message to the main control CP and cache it in the queue to be analyzed.

Correspondingly, the embodiment of the present invention also provides a device for preventing network attacks, including:

a receiving unit, configured to receive messages to be sent to the main control CP;

a queue unit, configured to store the message received by the receiving unit that needs to be sent to the main control CP;

An attack signature library, configured to store attack signatures and initial statistical data and aging intervals corresponding to the attack signatures;

The detection unit is used to judge whether the uploaded message cached in the queue unit contains an attack feature according to the IPS rule base, and if it is judged to be yes, extract the attack feature of the message and save it to the attack feature base, and/or according to the According to the attack rules stored in the attack rule base, it is judged whether the message received by the receiving unit contains an attack feature. The message is sent to the main control CP and buffered in the queue unit.

Implementing the embodiment of the present invention has the following beneficial effects: the attack signatures that have occurred can be extracted from the huge IPS rule base to form an attack signature base, so that subsequent attacks of the same type can be effectively prevented in real time, while ensuring system performance At the same time, better prevention effect can be obtained.

Description of drawings

Fig. 1 is the overall structure schematic diagram of the embodiment of the present invention;

Fig. 2 is a schematic structural diagram of a detection unit in an embodiment of the present invention;

Fig. 3 is a schematic flow diagram of generating an attack signature library in an embodiment of the present invention;

Fig. 4 is a schematic flow diagram of preventing network attacks in an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

Referring to Figures 1 and 2, Figure 1 is a schematic diagram of the overall structure of the device for preventing network attacks according to an embodiment of the present invention, including a receiving unit 1, a queue unit 2, a detection unit 3, an attack signature library 4, a recording unit 5 and an aging processing unit 6, Wherein: the receiving unit 1 is used for receiving the message to be sent to the main control CP. The queue unit 2 is configured to store the message received by the receiving unit 1 that needs to be sent to the main control CP. The attack feature library 4 is used to store the attack feature and initial statistical data corresponding to the attack feature and the aging interval, the initial statistical data is the number of attacks of the attack feature, and the aging interval is the survival time of the attack feature part. The detection unit 3 is used to judge whether the uploaded message cached in the queue unit 2 contains an attack feature according to the IPS rule base, and if it is judged to be yes, extract the attack feature of the message and save it to the attack feature base 4, And/or judge whether the message received by the receiving unit contains an attack feature according to the attack rule stored in the attack rule base 4, and if it is judged to be yes, perform corresponding anti-attack processing on the attack message according to the attack feature. If not, send the message to the main control CP and cache it in the queue unit 2. With reference to Fig. 2, described detection unit 3 comprises: the first detection unit 31, is used for detecting whether contains attack feature in the described message to be analyzed according to the rule in the IPS storehouse, when judged to be yes, extract the information of described message The attack feature is saved to the attack feature library 4; the second detection unit 32 is used to detect whether the message received by the receiving unit 3 according to the attack feature in the attack feature library 4 contains an attack feature, and when it is judged to be yes, according to the attack feature According to the above attack characteristics, perform corresponding anti-attack processing on the message and accumulate the number of existing attacks; The recording unit 5 is configured to generate initial statistical data and an aging interval for the attack signature when the attack signature database 4 receives the attack signature submitted by the first detection unit 31 . The aging processing unit 6 is configured to judge that the number of existing attacks of the attack signature in the second detection unit 32 corresponds to the attack signature in the attack signature library 4 when the attack signature reaches the aging interval. Whether the initial statistical data is consistent, when judged to be yes, delete the attack signature from the attack signature database 4, and release system resources; Replace the existing attack count with the attack signature and generate a new aging interval for the attack signature.

In the specific implementation process, after the receiving unit 1 receives the message that needs to be sent to the main control CP, the second detection unit 32 in the detection unit 3 detects the receiving unit 1 according to the attack signature in the attack signature database 4 Whether the received message contains an attack feature, if it is judged to be yes, the message is subjected to corresponding anti-attack processing according to the type of the attack feature, and at the same time, the existing attack times are accumulated for the attack feature type, and all attack feature databases 4 The current number of attacks of the attack feature in is initially 0, and in specific implementation, for example, the current number of attacks of a certain attack feature is 3, when the second detection unit 32 is sent from the message sent to the main control CP If a message containing the attack feature is found, the attack prevention process is performed on the message, and the number of existing attacks of the attack feature is accumulated to 4. The anti-attack processing includes discarding, speed limit, etc., and the types of the attack features can be divided into three types: quintuple type, depth filter type, and speed limit type; Control the CP and buffer it to the queue unit 2. After the message is sent, it is judged whether the main control CP is attacked and restarted, and the master and standby abnormal switch occurs. If the judgment is no, continue to receive the message. The attack feature detection is performed on the text, specifically, the first detection unit 31 in the detection unit 3 judges whether the message in the queue unit 2 contains an attack feature according to the attack feature in the IPS rule base, and when it is judged to be yes, extracts the message. The attack feature of text is saved to attack feature storehouse 4; When attack feature storehouse 4 receives the attack feature that described detection unit 3 sends every time, recording unit 5 will all be for described received attack feature record and produce initial statistical data and aging interval, The initial statistical data of attack feature is 0; Whether the corresponding initial statistical data in the attack signature database is consistent, if it is judged to be yes, delete the attack signature from the attack signature database 4, and release system resources; The original statistics of the attack signature are replaced with the existing number of attacks for the attack signature and a new aging interval is generated for the attack signature. In specific implementation, for example, the existing attack count of an attack signature A is 3, the existing attack count of an attack signature B is 0, and the initial statistical data of attack signatures A and B in the attack signature database are both 0, when the attack signature When A arrives at the aging interval, the aging unit 6 compares the existing attack times 3 of the attack feature A with its corresponding initial statistical data 0 in the attack feature database to see if it is consistent, and judges as no, at this time, the aging unit 6 will If the original statistical data 0 of the attack feature A is replaced with the existing attack times 3 of the attack feature A, the initial statistical data of the attack feature A becomes 3, and at the same time, the aging unit 6 will also generate a new attack feature A aging interval. When the attack feature B reaches the aging interval, the aging unit 6 compares the existing attack times 0 of the attack feature B with its corresponding initial statistical data 0 in the attack feature database to see if it is consistent, and it is judged as yes, at this time, the aging unit 6. Delete the attack signature B from the attack signature database to release system resources.

In the specific implementation process, the attack signature databases among the network attack prevention devices can be synchronized according to the needs, so as to achieve better prevention effect.

Fig. 3 is a schematic flow diagram of generating an attack signature database in an embodiment of the present invention, and in the method for generating an attack signature database, specifically includes the following steps:

Step S301, receiving a message to be sent to the main control CP.

Step S302, buffering the message to the queue to be analyzed. During specific implementation, after sending the received message to the main control CP, the cache space of the message is not released, but the message sent is cached in the queue to be analyzed, and the queue to be analyzed is a circular queue .

Step S303, judging whether the active/standby abnormal switching of the main control CP occurs. In specific implementation, after the message is sent, it is judged whether the main control CP has an abnormal master/standby switchover. If the judgment is no, the process ends. If the judgment is yes, step S304 is continued.

Step S304, judging according to the IPS rules whether the packets in the queue to be analyzed contain attack characteristics. If it is judged as yes, execute step S305; if it is judged as no, the process ends.

Step S305, saving the found attack signatures to an attack signature database. During specific implementation, when an attack signature is found from the packets in the queue to be analyzed according to the IPS rule, the discovered attack signature is extracted from the packet and stored in the attack signature database.

Step S306, generating initial statistical data and an aging interval for the attack signature. During specific operations, each time a new attack signature is saved to the attack signature database, the corresponding initial statistical data and aging interval will be set for the newly saved attack signature, and the initial statistical data is 0 at initialization.

Fig. 4 is a schematic flow diagram of preventing network attacks in an embodiment of the present invention. The specific steps are:

Step S401, receiving a message to be sent to the main control CP.

Step S402, judging whether the packet contains an attack signature according to the attack signature database, if it is judged yes, execute step S403; if judged no, execute step S405.

Step S403, performing corresponding anti-attack processing on the message according to the type of the attack feature. During specific implementation, after the attack signature is detected, the packet containing the attack signature is processed according to the attack prevention corresponding to the type of the attack signature in the packet. The types of attack signatures are specifically divided into three types: quintuple type, depth filter type, and speed limit type. Corresponding anti-attack processing includes discarding, rate limiting, and so on.

Step S404, accumulating the number of existing attacks of the attack signature. During specific implementation, for example, the original existing number of attacks of a certain attack feature is 3, when a message containing the attack feature is found from the message sent to the main control CP, the attack prevention process is performed on the message At the same time, the number of existing attacks of the attack signature of the attack signature is also accumulated to 4.

Step S405, sending the message to the main control CP. During specific implementation, when it is judged according to the attack signature database that there is no attack signature in the message to be sent, the message is sent to the main control CP.

Step S406, buffering the message to the queue to be analyzed. During specific implementation, after the message is sent to the main control CP, the cache space of the message is not released, but the sent message is cached in the queue to be analyzed, and the queue to be analyzed is a circular queue.

Step S407, judging whether the active/standby abnormal switching of the main control CP occurs. In specific implementation, after the message is sent, it is judged whether the main control CP has an abnormal master/standby switchover. If the judgment is no, the process ends. If the judgment is yes, go to step S408.

Step S408, judging according to the IPS rules whether the packets in the queue to be analyzed contain attack characteristics. If it is judged as yes, execute step S409; if it is judged as no, the process ends.

Step S409, saving the discovered attack signatures to an attack signature database. During specific implementation, when an attack signature is found from the packets in the queue to be analyzed according to the IPS rule, the discovered attack signature is extracted from the packet and stored in the attack signature database.

Step S410, generating initial statistical data and aging intervals for attack signatures. During specific operations, each time a new attack signature is saved to the attack signature database, the corresponding initial statistical data and aging interval will be set for the newly saved attack signature, and the initial statistical data is 0 at initialization.

Step S411, when the attack signature reaches the aging interval, it is judged whether the current number of attacks of the attack signature is consistent with the initial statistical data, if it is judged yes, execute step S502, if judged no, execute step S503;

Step S412, when the judgment is yes, that is, the existing attack times of the attack signature is consistent with the initial statistical data, then delete the attack signature from the attack signature database, and release the occupied system resources;

Step S413, when the judgment is no, that is, the existing number of attacks of the attack signature is inconsistent with the initial statistical data, replace the initial statistical data of the attack signature with the existing number of attacks, and generate a new attack signature for the attack signature aging interval.

In specific implementation, for example, the current attack count of an attack signature A is 3, the current attack count of an attack signature B is 0, and the initial statistics of attack signatures A and B are both 0, when the attack signature A reaches the aging interval , it will be judged whether the existing attack times 3 of the attack feature A is consistent with its corresponding initial statistical data 0, if the judgment is no, at this time, the initial statistical data 0 of the attack feature A will be replaced by the initial statistical data 0 of the attack feature If the number of attacks is 3, the initial statistical data of attack signature A becomes 3, and at the same time, a new aging interval will be generated for attack signature A. When the attack signature B reaches the aging interval, it will be judged whether the existing attack times 0 of the attack signature B is consistent with its corresponding initial statistical data 0 in the attack signature database, and if it is judged to be yes, at this time, the The attack signature B is deleted from the library, and the system resources occupied by it are released.

By implementing the embodiment of the present invention, the attack that is most likely to occur at present can be extracted from the huge IPS rule base to form an attack feature base, and effective real-time prevention can be implemented for the same type of attack that has occurred, which not only optimizes the performance of the system, And achieved a better preventive effect.

The above disclosures are only preferred embodiments of the present invention, and certainly cannot limit the scope of rights of the present invention. Therefore, equivalent changes made according to the claims of the present invention still fall within the scope of the present invention.

Claims (11)

1. A method for generating an attack signature database, comprising: When the message is sent to the main control CP, the message is cached in the queue to be analyzed; When the active/standby abnormal switchover occurs in the master control CP, it is judged according to the IPS rule base whether the cached uploaded message in the queue to be analyzed contains an attack signature, and if it is judged to be yes, the attack signature of the message is extracted and stored in the attack signature database . 2. The method according to claim 1, wherein the queue to be analyzed is a circular queue. 3. The method according to claim 1, wherein said extracting the attack signature of the message and storing it in the attack signature database comprises: Initial statistics and aging intervals are generated for the attack signature. 4. A method for preventing network attacks, comprising: According to the attack signature library, it is judged whether the message that needs to be sent to the main control CP contains the attack signature in the attack signature database, and if it is judged to be yes, the message is subjected to corresponding anti-attack processing according to the attack signature ; When judging no, send the message to the main control CP and cache it in the queue to be analyzed. 5. The method according to claim 4, further comprising: Accumulate the number of existing attacks of the attack signature; 6. The method according to claim 5, wherein when the attack signature reaches the aging interval, it is judged that the current attack times of the attack signature correspond to the initial attack signature in the attack signature library. Whether the statistical data is consistent, when it is judged to be yes, delete the attack signature from the attack signature database, and release system resources; when it is judged to be no, replace the initial statistical data of the attack signature with the existing attack times and Generate a new aging interval. 7. The method of claim 4, further comprising: When the main control CP has an abnormal master-standby switchover, it is judged according to the IPS rule base that the uploaded message cached in the queue to be analyzed contains an attack signature, and if it is judged to be yes, the attack signature of the message is extracted and saved to the attack signature database . 8. The method according to any one of claims 4-7, wherein the attack signature types are specifically: quintuple type, depth filter type, and speed limit type. 9. A device for preventing network attacks, comprising: a receiving unit, configured to receive messages to be sent to the main control CP; a queue unit, configured to store the message received by the receiving unit that needs to be sent to the main control CP; An attack signature library, configured to store attack signatures and initial statistical data and aging intervals corresponding to the attack signatures; The detection unit is used to judge whether the uploaded message cached in the queue unit contains an attack feature according to the IPS rule base, and if it is judged to be yes, extract the attack feature of the message and save it to the attack feature base, and/or according to the According to the attack rules stored in the attack rule base, it is judged whether the message received by the receiving unit contains an attack feature. The message is sent to the main control CP and buffered in the queue unit. 10. The device for preventing network attacks according to claim 9, wherein the detection unit specifically includes: The first detection unit is used to detect whether the message to be analyzed contains an attack feature according to the rules in the IPS library, and if it is judged to be yes, extract the attack feature of the message and save it to the attack feature library; The second detection unit is used to detect whether the message received by the receiving unit contains an attack feature according to the attack feature in the attack feature database, and if it is judged to be yes, perform corresponding defense against the message according to the attack feature Attack processing and accumulating the number of existing attacks; if no, send the message to the main control CP and cache it in the queue unit. 11. The device for preventing network attacks according to claim 9, further comprising: A recording unit, configured to generate initial statistical data and an aging interval for the attack signature when the attack signature library receives the attack signature submitted by the first detection unit; The aging processing unit, when the attack signature reaches the aging interval, judges whether the current number of attacks of the attack signature in the second detection unit is consistent with the initial statistical data corresponding to the attack signature in the attack signature database , when the judgment is yes, delete the attack signature from the attack signature library, and release system resources; when it is judged no, replace the original statistical data of the attack signature with the attack signature by the recording unit and generate a new aging interval for the attack signature.

Images