CN106603524A - Method for combining safety rules and intelligent device - Google Patents

Abstract

This application proposes a method for merging security rules. At the beginning of a preset time period, the pending security rules of the network firewall are obtained, and the pending security rules of the network firewall are processed according to the countermeasures of the pending security rules of the network firewall. Classification, so that the countermeasures of the security rules to be processed in each category are the same; and then subcategorying the security rules to be processed in each category according to the address information of the security rules to be processed in each category, so that The source addresses or destination addresses of the security rules to be processed in the subcategory are continuous; finally, all the security rules to be processed in the subcategory are merged into one characteristic security rule. It can be seen that pending security rules with the same countermeasures and consecutive addresses will be combined into one feature security rule, thereby greatly reducing the number of security rules in the network firewall, thereby speeding up the matching of security rules and improving the performance of the firewall.

Description

A method for merging security rules and an intelligent device

technical field

The present invention relates to the technical field of communication, in particular to a method for merging security rules, and at the same time, the present application particularly relates to an intelligent device.

Background technique

A network firewall (Firewall), also known as a network protection wall, is a network security system located between an internal network and an external network. An information security protection system that allows or restricts the transmission of data in accordance with specific security rules.

When a network firewall makes a packet filtering decision, it has a set of security rules to follow, and these security rules are stored in a dedicated packet filtering table, and these tables are integrated in the Linux kernel. In the packet filtering table, security rules are grouped into chains of the packet filtering table. The packet filtering system is a powerful tool that can be used to add, edit and remove security rules. Security rules can control whether other devices are allowed to connect to the port of the device, which IP or network segments are allowed to access the device, etc.

Security rules contain attributes and countermeasures. Properties include address information and rule details. Address information refers to the source address and destination address information of the data packet. The source address is used to describe the source of the data packet. It can be the address of a single device or a collection of a series of addresses; the destination address is similar to the source Address, used to describe the destination of the data packet. The rule details refer to the detailed information of the rule, which is used to describe the detailed characteristics of the data packet. The countermeasure refers to the countermeasure that should be implemented when the information of the data packet (message) matches the source address, destination address, and rule details. Specifically, it includes preventing data packets from passing, allowing data packets to pass, allowing but sending warnings to users, etc.

When the network firewall performs rule matching, it matches in sequence from the beginning to the end in the rule list. The processing efficiency of this method is low. When there are many rules in the rule list, it is difficult to find matching rules in time.

In order to speed up the speed of network firewall matching security rules, there are two methods in the prior art:

(1) Method 1. Based on the analysis and simplification of security rule conflicts, useless rule items are automatically deleted. Organize and simplify the rules when there are relations between the rules including, included, intersecting, conflicting, etc. (2) Method 2: Using a multi-dimensional model and a fast search method to improve the performance of the firewall in matching security rules.

In the process of implementing the present application, the inventor found that at least the following problems exist in the prior art method for speeding up the speed of firewall matching rules:

(1) For Method 1, most security rules do not contain, be contained, intersect, or conflict. Therefore, this method can only combine and simplify a small number of security rules, and the degree of reducing the number of rules is limited.

(2) For the second method, the essence of this method is to improve the search algorithm and increase the search speed. However, this method does not reduce the number of security rules, and when the number of security rules is large, there is still a problem of slow search speed.

It can be seen that how to effectively reduce the number of security rules, thereby speeding up the speed of matching security rules and improving the performance of the firewall has become a technical problem to be solved urgently by those skilled in the art.

Contents of the invention

This application proposes a method for merging security rules to reduce the number of security rules in the firewall system, thereby speeding up the speed of matching security rules and improving the performance of the firewall. The method is applied to smart devices including network firewalls. Methods include at least:

At the beginning of the preset time period, obtain the pending security rules of the network firewall, and classify the pending security rules of the network firewall according to the countermeasures of the pending security rules of the network firewall, so that Actions are the same for pending security rules in each of the described categories;

dividing the security rules to be processed in the category into subcategories according to the address information of the security rules to be processed in the category, so that the source addresses or destination addresses of the security rules to be processed in the subcategories are continuous;

Merge all pending security rules in the subcategory into one feature security rule.

Preferably, after said merging the security rules to be processed in the subcategories into feature security rules, the method further includes:

Respectively acquire information about traffic hit by each feature security rule;

Sorting each of the feature security rules according to the magnitude of the traffic hit by each of the feature security rules from large to small;

Match each feature security rule with the message received by the network firewall in sequence according to the sorting order.

Preferably, the countermeasures according to the pending security rules of the network firewall classify the pending security rules of the network firewall, specifically including:

Respectively acquire the countermeasures of the pending security rules of the network firewall;

Divide the security rules to be processed with the same countermeasure in the network firewall into the same category.

Preferably, the subcategory of the security rules to be processed in the category according to the address information of the security rules to be processed in the category specifically includes:

Respectively acquire address information of the security rules to be processed in the categories;

Divide the security rules to be processed with consecutive source addresses or destination addresses in the category into the same subcategory.

Preferably, before the time period begins, the method further comprises:

Receive cycle setting information input by the user;

The time period is set according to the period setting information.

Correspondingly, this application proposes a smart device, the smart device includes a network firewall, and the smart device includes at least:

The first classification module acquires the security rules to be processed of the network firewall at the beginning of the preset time period, and performs the security rules of the network firewall to be processed according to the countermeasures of the security rules to be processed of the network firewall. Classification so that the responses to pending security rules in each said class are the same;

The second classification module divides the security rules to be processed in the category into subcategories according to the address information of the security rules to be processed in the category, so that the source addresses or destinations of the security rules to be processed in the subcategories The addresses are consecutive;

A merging module, merging all pending security rules in the subcategory into one feature security rule.

Preferably, the smart device also includes:

An acquisition module, respectively acquiring the information of the traffic hit by each feature security rule;

The sorting module sorts each of the feature security rules according to the magnitude of the traffic hit by each of the feature security rules from large to small;

The matching module sequentially matches each feature security rule with the message received by the network firewall according to the order of sorting.

Preferably, the first classification module is specifically used for:

Respectively acquire the countermeasures of the pending security rules of the network firewall;

Divide the security rules to be processed with the same countermeasure in the network firewall into the same category.

Preferably, the second classification module is specifically used for:

Respectively acquire address information of the security rules to be processed in the categories;

Divide the security rules to be processed with consecutive source addresses or destination addresses in the category into the same subcategory.

Preferably, the smart device also includes:

The receiving module receives the cycle setting information input by the user;

A setting module, configured to set the time period according to the period setting information.

By applying the technical solution of the present application, at the beginning of the preset time period, obtain the pending security rules of the network firewall, and classify the pending security rules of the network firewall according to the countermeasures of the pending security rules of the network firewall, so that the countermeasures of the security rules to be processed in each category are the same; and then divide the security rules to be processed in each category into subcategories according to the address information of the security rules to be processed in each category, so that in the subcategories The source addresses or destination addresses of the security rules to be processed are continuous; finally, all the security rules to be processed in the subcategory are merged into one feature security rule. It can be seen that pending security rules with the same countermeasures and consecutive addresses will be merged into one feature security rule, thereby greatly reducing the number of security rules in the network firewall, thereby speeding up the matching of security rules and improving the performance of the firewall.

Description of drawings

In order to illustrate the technical solution of the present application more clearly, the accompanying drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. Ordinary technicians can also obtain other drawings based on these drawings on the premise of not paying creative work.

FIG. 1 is a schematic flowchart of a method for merging security rules proposed in an embodiment of the present application;

FIG. 2 is a schematic flowchart of a security rule merging method proposed in a specific embodiment of the present application;

FIG. 3 is a schematic structural diagram of a smart device proposed in a specific embodiment of the present application.

detailed description

As mentioned in the background, in order to speed up the speed of network firewall matching security rules, there are two methods in the prior art. Firstly, the security rules are simplified based on the relationship among security rules including, included, intersecting, conflicting and so on. However, since most of the rules do not contain, be contained, intersect, conflict, etc., this method can only simplify the security rules to a certain extent. Second, use multi-dimensional models and fast search methods to improve the speed of firewall matching security rules. The second method is essentially to improve the search algorithm, which does not have any effect on reducing the number of security rules. It can be seen that there is no particularly effective method for reducing the number of security rules in the prior art, so that when the number of security rules is large, the speed of the network firewall to match the security rules is too low.

Therefore, in order to effectively reduce the number of security rules, thereby speeding up the matching of security rules and improving the performance of the firewall, this application proposes a method for merging security rules. to be processed security rules, and classify the pending security rules of the network firewall according to the countermeasures of the pending security rules of the network firewall, so that the countermeasures of the pending security rules in each category are the same; The address information of the security rules to be processed in each category divides the security rules to be processed into subcategories, so that the source addresses or destination addresses of the security rules to be processed in the subcategories are continuous; finally, all the security rules to be processed in the subcategories are Processing security rules are merged into one feature security rule. It can be seen that pending security rules with the same countermeasures and consecutive addresses will be merged into one feature security rule, thereby greatly reducing the number of security rules in the network firewall, thereby speeding up the matching of security rules and improving the performance of the firewall.

FIG. 1 is a schematic flowchart of a method for merging security rules proposed by this application. It should be noted that this application is applied to a smart device including a network firewall, and the network firewall contains multiple security rules to be processed. Pending security rules are security rules that have not been merged. Specifically, the application at least includes the following steps:

S101. At the beginning of the preset time period, obtain the pending security rules of the network firewall, and classify the pending security rules of the network firewall according to the countermeasures of the pending security rules of the network firewall, so that in each category The same actions are taken for the pending security rules of .

The security rules to be processed refer to the security rules in the network firewall that have not been merged. In the embodiment of the present application, the aim is to achieve the effect of reducing the number of security rules in the network firewall by classifying and merging the security rules to be processed. The process of classifying and merging security rules to be processed will be introduced in detail below.

One of the prerequisites for merging security rules is that the countermeasures of the security rules before merging are the same. The countermeasure of the security rule means that the countermeasure refers to a measure (executed action) performed by the network firewall when the information of the data packet matches the security rule. Specifically, the countermeasures include preventing the data packet from passing through, allowing the data packet to pass through, allowing but sending a warning to the user, and the like.

In the embodiment of the present application, firstly, the security rules to be processed of the network firewall are divided into categories according to the countermeasures of the security rules to be processed, so that the security rules to be processed with the same countermeasure are in the same category. The pending security rules in each category are then processed further in turn.

In a preferred embodiment of the present application, the above-mentioned method of classifying the pending security rules of the network firewall according to countermeasures can be realized through the following preferred solution, specifically, the solution includes the following steps:

(1) Obtain the countermeasures of the pending security rules of the network firewall;

The pending security rules of the network firewall are parsed in turn, and the countermeasures of all the pending security rules of the network firewall are obtained according to the result of the parsing.

(2) Divide the security rules to be processed with the same countermeasures in the network firewall into the same category.

After obtaining the countermeasures of all pending security rules of the network firewall, the pending security rules with the same countermeasures are classified into the same category. Obviously, the above preferred solution can ensure that the security rules to be processed in each category have the same countermeasures, which provides an important basis for merging security rules of the same category below.

It should be noted that the above disclosed method of classifying the security rules to be processed according to the countermeasures is only a preferred implementation solution proposed by this application. Based on the core idea of this application, those skilled in the art can also adopt other security rules to be processed The method of classifying according to the countermeasures will not affect the protection scope of this application.

In a preferred embodiment of the present application, before the preset time period starts, the solution of the present application also includes the following preferred steps:

(1) Receive cycle setting information input by the user;

Since the security rules in the network firewall change dynamically, it is necessary to sort out (classify, merge) the pending security rules of the network firewall periodically.

In a preferred embodiment of the present application, before the preset time period begins, the period setting information input by the user needs to be received, and the period setting information is analyzed to obtain the period set by the user for sorting out security rules to be processed.

(2) Set the time period for sorting out the security rules to be processed according to the period setting information input by the user.

After the time period for sorting out the security rules to be processed is acquired, the time period is set, so that the smart device sorts out the security rules to be processed every time the time period passes.

S102. Divide the security rules to be processed in each category into subcategories according to the address information of the security rules to be processed in each category, so that the source addresses or destination addresses of the security rules to be processed in each subcategory are continuous.

Through the above step S101, the security rules to be processed can be divided into categories with the same countermeasures. In the embodiment of the present application, the security rules to be processed in each category will be further divided into subcategories, and the process of dividing will be described in detail below.

For the security rules to be processed in the same category, according to the address information of the security rules to be processed in this category, each security rule to be processed in this category is further divided into subcategories, so that the security rules to be processed with continuous source addresses or destination addresses are in the same subcategory. The pending security rules in each subcategory are then processed further in turn.

In a preferred embodiment of the present application, the above-mentioned method of classifying the security rules to be processed in each category according to the address information can be realized through the following preferred solution, specifically, the solution includes the following steps:

(1) Respectively acquire address information of security rules to be processed in the category.

By analyzing the security rules to be processed in a certain category in sequence, and obtaining the countermeasures of all the security rules to be processed in the category according to the result of the analysis.

(2) Divide the security rules to be processed with consecutive source addresses or destination addresses in the category into the same subcategory.

After obtaining the countermeasures of all pending security rules of the category, the pending security rules with source addresses or destination addresses consecutively are classified into the same subcategory. Obviously, the above preferred solution can ensure that the source addresses or destination addresses of the security rules to be processed in each subcategory are continuous, which provides an important basis for merging security rules of the same subcategory below.

For example, if the pending security rules of a certain category are as shown in Table 1 below,

pending security rules Source address IP action Pending Security Rule 1 2.2.2.1 ACCEPT Pending Security Rule 2 2.2.2.2 ACCEPT Pending Security Rule 3 2.2.2.3 ACCEPT Pending Security Rule 4 3.3.3.8 ACCEPT Pending Security Rule 5 4.4.4.4 ACCEPT Pending Security Rule 6 5.5.5.5 ACCEPT Pending Security Rule 7 2.2.2.4 ACCEPT Pending Security Rule 8 5.5.5.6 ACCEPT Pending Security Rule 9 4.4.4.5 ACCEPT

Table 1 Table of safety rules for specified categories

Then, the result of subcategorying the security rules to be processed according to the address information of the security rules to be processed proposed by this application will be shown in Table 2 below:

Table 2 Subcategory division table of security rules of specified category

It can be known from the above Table 2 that the source IP addresses of the security rules to be processed in each subcategory are continuous.

It should be noted that the above disclosed method of dividing the security rules to be processed into subcategories according to address information is only a preferred implementation solution proposed by this application. Based on the core idea of this application, those skilled in the art can also use other The method of dividing rules into subcategories according to address information will not affect the scope of protection of this application.

S103. Merge all pending security rules in the subcategories into one feature security rule.

Through the above step S102, the security rules to be processed in each category can be divided into subcategories, and the source addresses or target addresses of the security rules to be processed in each subcategory are continuous. In the embodiment of the present application, all the security rules to be processed in the subcategories are further combined into one feature security rule, so as to achieve the effect of reducing the number of security rules. The merging process will be described in detail below.

Since the source addresses or destination addresses of the security rules to be processed in each subcategory are continuous, an address range may be used to include the source addresses or destination addresses of all the security rules to be processed in the subcategory. For example, for subcategory 1 in Table 2, the source IP addresses of the security rules to be processed are 2.2.2.1, 2.2.2.2, 2.2.2.3, 2.2.2.4, and the address range "2.2.2.1～2.2 .2.4" as the source address of the signature security rules for this subcategory. And the countermeasure of the source address of the characteristic security rule of this subcategory is the same as the countermeasure of the pending security rule of this subcategory. It can be seen that after the above merging process, pending security rules with the same countermeasures and continuous addresses will be merged into feature security rules, thereby greatly reducing the number of security rules in the network firewall, thereby speeding up the matching of security rules and improving Firewall performance.

In a preferred embodiment of the present application, after step S103, the present application may also include the following preferred solutions, specifically, including the following steps:

(1) Obtain the information of traffic hit by each feature security rule respectively.

After the security rules to be processed in each subcategory are merged into feature security rules, the information of traffic hit by each feature security rule is obtained. Then compare the size of traffic hit by each characteristic security rule.

(2) Sort the feature security rules according to the magnitude of the traffic hit by each feature security rule from large to small.

(3) Match each feature security rule with the message received by the network firewall according to the order of sorting.

In a preferred embodiment of the present application, when the network firewall receives the message, it will sequentially match each characteristic security rule with the message received by the network firewall according to the sorted order. It can be seen that if the packets are matched according to the order of the sorting, the packets with the larger hit traffic are more likely to be matched, so that the network firewall preferably processes the packets with a large flow, thereby preventing the packets with a large flow from being blocked by the firewall. The network firewall performance is negatively affected by staying in the network for too long.

It can be seen from the description of the above embodiments that by applying the technical solution of the present application, at the beginning of the preset time period, the pending security rules of the network firewall are obtained, and the network firewall's security rules are processed according to the countermeasures of the pending security rules of the network firewall. The security rules to be processed are divided into categories, so that the countermeasures of the security rules to be processed in each category are the same; and then the security rules to be processed in each category are subdivided according to the address information of the security rules to be processed Classification, so that the source addresses or destination addresses of the security rules to be processed in the subcategories are continuous; finally, all the security rules to be processed in the subcategories are merged into one feature security rule. It can be seen that pending security rules with the same countermeasures and consecutive addresses will be merged into one feature security rule, thereby greatly reducing the number of security rules in the network firewall, thereby speeding up the matching of security rules and improving the performance of the firewall.

In order to further illustrate the technical idea of the present invention, the technical solution of the present invention will now be described in combination with a specific implementation process.

As shown in FIG. 2, it is a schematic flow diagram of a method for merging security rules proposed in a specific embodiment of the present application. As can be seen from the figure, it includes the following steps:

S201, start a periodic timer.

The period of the timer can be modified, and configuration items are provided for users to adjust according to actual scenarios.

S202, scanning system security rules.

Scan system security rules, load all lists so far into memory.

S203. Classify the scanned security rules according to the countermeasures, and cache the classified results at the first level.

S204, divide the security rules in each category into subcategories according to the address information, and perform secondary cache for the divided results.

S205. Merge the security rules in the subcategories into special security rules, obtain the size of traffic hit by the special security rules, and perform three-level caching on the combined results.

S206. Sort the special security rules according to the traffic from large to small, and fork (write) the sorting result into the kernel of the firewall system.

It can be seen that through the execution of the above steps, the number of security rules can be greatly reduced, and packets with larger traffic volumes are easier to be matched, thereby greatly improving the performance of the firewall.

It can be seen from the description of the above specific embodiments that by applying the technical solution of the present application, at the beginning of the preset time period, the pending security rules of the network firewall are obtained, and the network firewall is processed according to the countermeasures of the pending security rules of the network firewall. The security rules to be processed are divided into categories, so that the countermeasures of the security rules to be processed in each category are the same; and then the security rules to be processed in each category are classified according to the address information of the security rules to be processed in each category The subcategories are divided so that the source addresses or destination addresses of the security rules to be processed in the subcategories are continuous; finally, all the security rules to be processed in the subcategories are merged into one characteristic security rule. It can be seen that pending security rules with the same countermeasures and consecutive addresses will be merged into one feature security rule, thereby greatly reducing the number of security rules in the network firewall, thereby speeding up the matching of security rules and improving the performance of the firewall.

In order to achieve the above technical objectives, as shown in Figure 3, the present application proposes a smart device, the smart device includes a network firewall, and the smart device includes at least:

The first classification module 301, at the beginning of the preset time period, acquires the security rules to be processed of the network firewall, and classifies the security rules to be processed of the network firewall according to the countermeasures for the security rules to be processed of the network firewall Classification is done so that the responses to pending security rules in each said class are the same;

The second classification module 302 divides the security rules to be processed in the category into subcategories according to the address information of the security rules to be processed in the category, so that the source addresses of the security rules to be processed in the subcategory or The target address is continuous;

The merging module 303 merges all the security rules to be processed in the subcategories into one feature security rule.

In a specific application scenario, the smart device also includes:

An acquisition module, respectively acquiring the information of the traffic hit by each feature security rule;

The sorting module sorts each of the feature security rules according to the magnitude of the traffic hit by each of the feature security rules from large to small;

The matching module sequentially matches each feature security rule with the message received by the network firewall according to the order of sorting.

In a specific application scenario, the first classification module is specifically used for:

Respectively acquire the countermeasures of the pending security rules of the network firewall;

Divide the security rules to be processed with the same countermeasure in the network firewall into the same category.

In a specific application scenario, the second classification module is specifically used for:

Respectively acquire address information of the security rules to be processed in the categories;

Divide the security rules to be processed with consecutive source addresses or destination addresses in the category into the same subcategory.

In a specific application scenario, the smart device also includes:

The receiving module receives the cycle setting information input by the user;

A setting module, configured to set the time period according to the period setting information.

It can be seen from the description of the specific equipment above that by applying the technical solution of the present application, at the beginning of the preset time period, the pending security rules of the network firewall are acquired, and the network firewall's security rules are processed according to the countermeasures of the pending security rules of the network firewall. The security rules to be processed are divided into categories, so that the countermeasures of the security rules to be processed in each category are the same; and then the security rules to be processed in each category are subdivided according to the address information of the security rules to be processed Classification, so that the source addresses or destination addresses of the security rules to be processed in the subcategories are continuous; finally, all the security rules to be processed in the subcategories are merged into one feature security rule. It can be seen that pending security rules with the same countermeasures and consecutive addresses will be merged into one feature security rule, thereby greatly reducing the number of security rules in the network firewall, thereby speeding up the matching of security rules and improving the performance of the firewall.

Finally, it is noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand; it still Modifications may be made to the technical solutions described in the foregoing embodiments, or some or all of the technical features thereof may be equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the scope defined by the claims of the present invention.

Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be realized by hardware, or by software plus a necessary general hardware platform. Based on this understanding, the technical solution of the present invention can be embodied in the form of software products, which can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.), including several The instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute the methods described in various implementation scenarios of the present invention.

Those skilled in the art can understand that the accompanying drawing is only a schematic diagram of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present invention.

Those skilled in the art can understand that the modules in the devices in the implementation scenario can be distributed among the devices in the implementation scenario according to the description of the implementation scenario, or can be located in one or more devices different from the implementation scenario according to corresponding changes. The modules of the above implementation scenarios can be combined into one module, or can be further split into multiple sub-modules.

The above serial numbers of the present invention are for description only, and do not represent the pros and cons of the implementation scenarios.

The above disclosures are only some specific implementation scenarios of the present invention, however, the present invention is not limited thereto, and any changes conceivable by those skilled in the art shall fall within the protection scope of the present invention.

Claims (10)

1. A method for merging security rules, characterized in that it is applied to an intelligent device comprising a network firewall, and the method at least includes: At the beginning of the preset time period, obtain the pending security rules of the network firewall, and classify the pending security rules of the network firewall according to the countermeasures of the pending security rules of the network firewall, so that Actions are the same for pending security rules in each of the described categories; dividing the security rules to be processed in the category into subcategories according to the address information of the security rules to be processed in the category, so that the source addresses or destination addresses of the security rules to be processed in the subcategories are continuous; Merge all pending security rules in the subcategory into one feature security rule. 2. The method according to claim 1, wherein after said merging the security rules to be processed in the subcategories into feature security rules, the method further comprises: Respectively acquire information about traffic hit by each feature security rule; Sorting each of the feature security rules according to the magnitude of the traffic hit by each of the feature security rules from large to small; Match each feature security rule with the message received by the network firewall in sequence according to the sorting order. 3. The method according to claim 1, wherein the countermeasures according to the pending security rules of the network firewall classify the pending security rules of the network firewall, specifically comprising: Respectively acquire the countermeasures of the pending security rules of the network firewall; Divide the security rules to be processed with the same countermeasure in the network firewall into the same category. 4. The method according to claim 3, wherein the subcategory of the security rules to be processed in the category according to the address information of the security rules to be processed in the category specifically comprises: Respectively acquire address information of the security rules to be processed in the categories; Divide the security rules to be processed with consecutive source addresses or destination addresses in the category into the same subcategory. 5. The method according to any one of claims 1-4, wherein, before the time period begins, the method further comprises: Receive cycle setting information input by the user; The time period is set according to the period setting information. 6. A smart device, characterized in that the smart device comprises a network firewall, and the smart device includes at least: The first classification module acquires the security rules to be processed of the network firewall at the beginning of the preset time period, and performs the security rules of the network firewall to be processed according to the countermeasures of the security rules to be processed of the network firewall. Classification so that the responses to pending security rules in each said class are the same; The second classification module divides the security rules to be processed in the category into subcategories according to the address information of the security rules to be processed in the category, so that the source addresses or destinations of the security rules to be processed in the subcategories The addresses are consecutive; A merging module, merging all pending security rules in the subcategory into one feature security rule. 7. The smart device according to claim 6, further comprising: An acquisition module, respectively acquiring the information of the traffic hit by each feature security rule; The sorting module sorts each of the feature security rules according to the magnitude of the traffic hit by each of the feature security rules from large to small; The matching module sequentially matches each feature security rule with the message received by the network firewall according to the order of sorting. 8. The smart device according to claim 6, wherein the first classification module is specifically used for: Respectively acquire the countermeasures of the pending security rules of the network firewall; Divide the security rules to be processed with the same countermeasure in the network firewall into the same category. 9. The smart device according to claim 8, wherein the second classification module is specifically used for: Respectively acquire address information of the security rules to be processed in the categories; Divide the security rules to be processed with consecutive source addresses or destination addresses in the category into the same subcategory. 10. The smart device according to any one of claims 6-9, wherein the smart device further comprises: The receiving module receives the cycle setting information input by the user; A setting module, configured to set the time period according to the period setting information.