WO2019165883A1 - Data processing method and apparatus - Google Patents

Abstract

Disclosed are a data processing method and apparatus. The method comprises: an intrusion prevention system (IPS) receiving data to be passed; matching the data according to a first type of rule and/or a second type of rule, wherein the first type of rule comprises a rule for blocking data forwarding, and the second type of rule comprises a rule for executing a data warning; and processing the data according to a result of whether it is matched.

Description

Data processing method and device

Cross-reference to related applications

The present application is filed on the basis of the Chinese Patent Application No. 20110117 s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s

Technical field

The present application relates to the field of communications, and in particular, to a method and an apparatus for processing data.

Background technique

Intrusion Prevention System (IPS) is a commonly used security device on the Internet. It can provide active protection services to the network, perform deep detection of network traffic, and intercept attack network traffic and intrusion activities to avoid attacks. loss.

IPS is to embed the device directly into the network traffic, that is, to receive traffic from the external system through a network port. After checking to confirm that it does not contain abnormal activity or suspicious content, it transmits it to the internal system through another port. In this way, problematic packets, or all subsequent packets from the same data stream, can be removed from the IPS device, eliminating attacks and threats to the network and devices.

The IPS can be deployed in the network traffic path independently or integrated into a network device such as a firewall and embedded in the network traffic path. FIG. 1 is a schematic diagram of a typical deployment manner of an IPS according to the related art. As shown in FIG. 1 , according to the scope of IPS protection, the network is divided into an external network and an internal network, for example, in a typical government enterprise network application scenario, the internal network. Refers to the internal LAN of the government or enterprise, and the external network refers to the Internet. Between the internal network and the external network, a firewall is usually deployed as a demarcation point between the internal network and the external network. When the IPS is deployed independently, it is usually deployed behind the internal network firewall, and is located on the path of internal and external network traffic. It can also be integrated into the firewall as a component.

When malicious network traffic is found, according to the type and policy of the intrusion, an alarm is sent to the alarm center to send an intrusion event log, or the data stream is blocked (such as dropping the data packet, resetting the data connection, etc.), and simultaneously sending an intrusion event log to the alarm center. .

In the related art, the rule base of IPS is the result of long-term analysis and tracking of intrusion behavior. As the network intrusion behavior continues to increase, the number of entries in the rule base continues to increase, and the number of entries in the general commercial IPS rule base is more than 10,000. Directly bring the following questions:

The number of rule entries is large, the engine matching algorithm is required to be high, the matching/traversal time is long, the transmission delay of the data packet is increased, and the service experience is affected. At the same time, since the data packet is buffered in the memory for a long time, the maximum throughput of the device is directly limited. .

In view of the problem that the use of a large number of rules in the IPS rule base in the related art may affect the forwarding performance, there is currently no effective solution.

Summary of the invention

The embodiment of the present application provides a data processing method and apparatus, so as to at least solve the problem that a large number of rules in the IPS rule base used in the related art may affect forwarding performance.

According to an embodiment of the present application, a data processing method is provided, including: an IPS receiving data to be passed; matching the data according to a first type of rule and/or a second type of rule, wherein the first class The rules include rules for blocking data forwarding, and the second type of rules include rules for performing data alerts; the data is processed according to whether the results of the matching.

According to another embodiment of the present application, there is also provided a data processing apparatus, including: a receiving module configured to receive data to be passed; a matching module configured to match according to a first type of rule and/or a second type of rule The data received by the receiving module, where the first type of rule includes a rule for blocking data forwarding, the second type of rule includes a rule for performing data alarm, and the processing module is configured to obtain according to the matching module. Whether the result of the match is processed by the data.

According to still another embodiment of the present application, there is also provided a storage medium having stored therein a computer program, wherein the computer program is configured to execute the steps of any one of the method embodiments described above.

According to still another embodiment of the present application, there is also provided an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being configured to run the computer program to perform any of the above The steps in the method embodiments.

According to the embodiment of the present application, the rule base of the IPS is divided into two types according to the rule type, and at least one of the two types of rules is used to match the data received by the IPS, that is, whether to separately block the forwarding of the data, whether only The alarm information is sent in the above manner, which avoids the problem that the use of a large number of rules in the IPS rule base in the related art may affect the forwarding performance. The two types of rules can be quickly invoked. When each type of rule is used for judgment, the number of rules is avoided. The second rule determines the impact on forwarding performance.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the present application, and are intended to be a part of this application. In the drawing:

1 is a schematic diagram of a typical deployment manner of an IPS according to the related art;

2 is a flowchart of a method of processing data according to an embodiment of the present application;

3 is a schematic diagram of an internal structure of an IPS according to the related art;

4 is a schematic diagram of an internal structure of an IPS Embodiment 1 according to Embodiment 1;

5 is a schematic diagram of an internal structure of an IPS implementation manner 2 after a rule base separation according to a specific embodiment 2;

FIG. 6 is a schematic diagram of a separate deployment of an IPS device after a rule base separation according to a specific embodiment 3.

Detailed ways

The present application will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or order.

The embodiment of the present application can be applied to the scenario described in FIG. 1 , that is, the two sides of the IPS are connected to the intranet external network, and the data is forwarded in the two networks.

In this embodiment, a processing method for data running in a network architecture as shown in FIG. 1 is provided. FIG. 2 is a flowchart of a data processing method according to an embodiment of the present application. As shown in FIG. 2, the flow includes the following steps. step:

Step S202, the IPS receives data to be passed;

Step S204: Matching the data according to the first type of rules and/or the second type of rules, where the first type of rules includes a rule for blocking data forwarding, and the second type of rules includes a rule for performing data alarms;

In step S206, the data is processed according to whether the result of the matching.

Through the above steps, the rule base of the IPS in the related art is divided into two types according to the rule type, and the two types of rules are used to respectively match the data received by the IPS, that is, whether to separately block the forwarding of the data, and/or whether The data is transmitted in the above manner. This avoids the problem that the large number of rules in the IPS rule base can affect the forwarding performance in the related technologies. You can quickly invoke two types of rules. When each type of rule is used for judgment, the number of rules is large. The second rule determines the impact on forwarding performance.

In an optional embodiment of the present application, the matching the data according to the first type of rules and/or the second type of rules includes: determining, according to the first type of rules, whether to block forwarding of the data; The result of the matching processes the data, including: blocking the forwarding of the data if it is determined to block forwarding of the data; and forwarding the data to the output interface of the IPS if it is determined to forward the data. It should be noted that, in this embodiment, the first type of rule matching data may be preferentially used, that is, it is first determined whether to block data forwarding, and if it is determined that the blocking data is forwarded, the data is not continuously forwarded; if the data is not blocked, Then, the data is forwarded to the output interface of the IPS to forward the data, and then the alarm rule is used for matching, thereby saving time for data to pass through the IPS.

In an optional embodiment of the present application, after determining to forward the data, the method further includes: determining, according to the second type of rule, whether to alert the data, wherein, in the case of determining to alert the data , the first alarm message is sent.

In an optional embodiment of the present application, in the case of determining to block forwarding of the data, the method further includes: issuing second alarm information. That is, in the embodiment, the second alarm information may be sent at the same time as the data is forwarded, and the second alarm information is used to notify the intrusion and perform the blocking operation on the intrusion.

In an optional embodiment of the present application, before the matching the data according to the first type of rules and/or the second type of rules, the method further includes: obtaining the first type of rules and/or respectively from the preset location. A second type of rule, wherein the first type of rule is set in a primary work area of the IPS; and the second type of rule is set in a secondary work area of the IPS. It should be noted that the first type of rules and the second type of rules can be stored in different locations. The first type of rules is more important and can be stored in the main area of the IPS work, which is convenient for quick call; the second type of rules can be In other auxiliary areas, after determining that data forwarding is not blocked, the replicated data is sent to other auxiliary areas, and the second type of rule is used for matching. At this time, the actual pressure is not formed on the IPS forwarding data.

In an optional embodiment of the present application, the first type of rule includes at least one of the following rules: a rule for discarding data; and a rule for resetting the connection. It can be understood that the first type of rule is used to detect more serious data problems, such as carrying a virus.

The present application will be described below in conjunction with specific embodiments.

FIG. 3 is a schematic diagram of an internal structure of an IPS according to the related art. As shown in FIG. 3, the internal module works and executes as follows:

Input module: configured to receive external network traffic entering the IPS and send it to the parsing filtering module.

The parsing filtering module is configured to perform protocol parsing on the received data packet, determine whether to invoke the feature matching engine to detect according to the parsing result, send the data element to be detected to the feature matching engine, and maintain the session state of the data stream where the data packet is located. .

Feature matching engine: configured to load the intrusion behavior rule base when the system is started. When called, compare the data elements of the data with the features in the feature library, and return the comparison result, that is, whether it hits, if it hits, at the same time Returns the intrusion type, action, and other information, and outputs it to the response module.

The response module is configured to perform a response operation according to the action information in the hit result, including release, alarm, block (such as discard, connection reset, etc.), and send the intrusion behavior information and the response result to the alarm system through the log system.

Output module: If the release operation is performed, the output module is used to send the data packet to the internal network host.

Rule base: configured to describe the intrusion behavior signature library. The typical description is as follows:

Rule header [action, protocol type, source ip, source port, direction, destination ip, destination port], (rule option [keyword]), information),

For example: alert tcp any any->192.168.1.0/24 111 (content: "|00 01 86 a5|"; msg: "mountd access";).

The rule base is the result of long-term analysis of intrusion behavior. As the network intrusion behavior continues to increase, the number of entries in the rule base continues to increase. Generally, the number of entries in the commercial IPS rule base is more than 10,000, which directly brings the following problems:

The number of rule entries is large, the engine matching algorithm is required to be high, the matching/traversal time is long, the transmission delay of the data packet is increased, and the service experience is affected. At the same time, since the data packet is buffered in the memory for a long time, the maximum throughput of the device is directly limited. .

In addition, the number of rule entries is large and the memory usage is large. In the scenario where the IPS device has limited memory, the rules need to be tailored, which increases the false negative rate and directly affects the protection effect.

In order to solve the above problems, further analysis of the characteristics of the IPS rule base, found that more than 90% of the rules of the action is the alarm type, that is, when hitting this type of feature, the IPS will release the data, only the alarm, the main reason is the IPS rule matching There is a certain false alarm. If the blocking operation is taken, it will affect the normal business. At this time, an alarm operation is taken to report the intrusion information to the background, so that more valuable clues can be found in the background.

The embodiment of the present application provides a high-performance intrusion prevention method, including the following features:

Feature A (the rule base in the feature A can store the rules used by the matching module of the subsequent embodiment 2), and the rule base is divided into a class rule base according to the type of action in the rules of the intrusion prevention system (can be used to store the above implementation) a first type of rule in the example) and a second type of rule base (which may be used to store the second type of rule in the above embodiment), and the rule of the type includes a rule that blocks the action (including dropping, resetting, etc.). The second type rule base contains rules for actions as alarms;

Feature B, corresponding to different rule bases, the IPS starts a first feature matching engine and a second feature matching engine, respectively, for loading a class rule library and a second class rule library;

Feature C, the parsing filtering module first sends the data element of the received data packet to the first feature matching engine, and the first feature matching engine performs feature matching if the hit is equivalent to using the first type of rule matching in the above embodiment. If the data is successful, the response module performs a blocking operation. If there is no hit, the parsing filtering module or the response module sends the data element to the second feature matching engine, and the response module performs the releasing operation;

Feature D, the second feature matching engine performs feature matching, and if a hit (equivalent to using the second type of rule in the above embodiment to match the data successfully), an alert operation is performed.

Optionally, the feature B of the foregoing high-performance intrusion prevention method further includes:

Feature B1, the first feature matching engine and the second feature matching engine are located in the same operating environment, or different operating environments, and are suggested to be located in different operating environments;

Feature B2, the two feature matching engines use the same matching algorithm or use different matching algorithms.

Optionally, the feature C of the foregoing high-performance intrusion prevention method further includes:

Feature C1, the parsing filtering module needs to cache the data packet when sending the data element of the data packet to the first feature matching engine, and wait for the first matching engine to return the hitting result to execute the subsequent process;

Feature C2, the parsing filter module directly executes the subsequent process after sending the data element of the data packet to the first feature matching engine, that is, sending the response module to perform the release operation, without waiting for the second matching engine to return the hit result;

Feature C3, the response module directly performs the subsequent operation after sending the data element of the data packet to the first feature matching engine, that is, performing the release operation, without waiting for the second matching engine to return the hit result.

Optionally, the feature D of the foregoing high-performance intrusion prevention method further includes:

Feature D1, if there is no hit, the second feature matching engine ends the match and does not perform any action.

A high performance intrusion prevention system provided in the embodiment of the present application includes a class rule base and a second class rule base, a first feature matching engine and a second feature matching engine, an input module, a parsing filter module, a response module, and an output. Module, log system.

The input module, the output module, and the log system are the same as those described in FIG.

A type of rule base: a rule containing actions to block operations (such as dropping, resetting, etc.) (equivalent to the first type of rules in the above embodiment);

The second type rule base: the rule containing the action as an alarm (corresponding to the second type of rule in the above embodiment);

The parsing filter module (corresponding to some functions of the matching module in the subsequent embodiment 2): after performing protocol parsing and filtering on the received data packet, preferentially calling the first feature matching engine, and then calling the second feature matching engine according to the matching result, Or call the response module;

The first feature matching engine (corresponding to some functions of the matching module in the subsequent embodiment 2) is configured to load a class rule base, perform matching detection on the data elements, and return a matching result;

The second feature matching engine (which is equivalent to the partial function of the matching module in the subsequent embodiment 2) is configured to load the second type rule base and perform matching detection on the data elements. If the hit occurs, the alarm operation is performed, otherwise no operation is performed.

a response module (corresponding to a part of the functions of the processing module in the subsequent embodiment 2): configured to perform an operation according to a matching result of the first feature engine, and if a hit, perform a blocking operation (such as discarding, resetting, etc.), otherwise executing Release the operation, optionally calling the second feature matching engine.

The following is a specific embodiment of the embodiment of the present application.

Specific embodiment 1

FIG. 4 is a schematic diagram of an internal structure of an IPS implementation manner according to a specific embodiment 1. As shown in FIG. 4, the small reference numeral 123456789 is used to indicate the interaction order of the following modules, and may correspond to the following module descriptions. The internal structure of the IPS implementation mode after the rule base of the embodiment is separated, and the functions of each module are as follows:

The input module, the output module, the log system, and the like are the same as the related art described in FIG.

The rule base is divided into a class rule base and a second type rule base. One type of rule base includes rules for blocking (such as discarding, resetting, etc.), and the second class rule library includes rules for actions as alarms, and one type of rule. The rule base has a higher priority than the second type rule base. That is, the input data packet is preferentially matched with the rules in a type of rule base. If it is hit, the defense function is executed, including performing a blocking operation, including dropping the data packet, resetting the data flow connection, and the like, and then hitting no hit. The data packet is matched with the rules in the second-class rule base. If it is hit, an alarm operation is performed to send an alarm message to the log system.

Corresponding to different rule bases, the first feature matching engine and the second feature matching engine are started, and a class rule library and a second class rule library are respectively loaded.

The parsing filter module, based on the original packet parsing and filtering function, preferentially invokes the first feature matching engine to perform feature matching according to the priority of the rule base, and caches the data packet, waiting for the matching result; when the first feature matching engine returns a match As a result, if the hit, the parsing filter module calls the response module, and sends the data packet and the matching result to the response module. If there is no hit, the second feature matching engine is called to send the data element to the second feature matching engine, and the data packet and The matching result is sent to the response module, and in the second feature matching engine matching process, the data packet is no longer needed to be cached.

The second feature matching engine performs feature matching. If the hit occurs, the alarm operation is performed to send an alarm message to the log system, otherwise no operation is performed.

The response module, according to the matching result, performs a defense operation if a rule in a type of rule base is hit, such as performing a blocking operation, and simultaneously sending an alarm message to the log system, otherwise performing a release operation. If a rule in a type of rule base is hit, the first feature matching engine may also send an alert message to the log system.

Specific embodiment 1 may include the following workflow:

Step 1. When the system starts or the rule base is updated, the first feature matching engine loads a class rule library into the memory, and the second feature matching engine loads the second class rule library into the memory;

Step 2: the input module receives the data packet of the input port and sends the data packet to the parsing filtering module.

Step 3: After parsing and filtering the received data packet, the parsing filtering module calls the first feature matching engine to perform matching, and returns a matching result;

Step 4: If the hit, the step 7 parsing filtering module sends the matching result of the data packet and the first feature matching engine to the response module;

Step 5: If there is no hit, the parsing filtering module calls the second feature matching engine to copy the data element and sends the data element to the second feature matching engine, and performs step 7 to send the data packet to the response module;

Step 6. The second feature matching engine performs feature matching. If the hit occurs, the alarm operation is performed to send an alarm message to the log system, otherwise no operation is performed.

Step 7, the parsing filter module data packet is sent to the response module, and the matching result of the first feature matching engine is included;

Step 8: The response module performs a blocking operation according to the matching result, if a rule in a type of rule base is hit, specifically includes dropping or resetting the connection, and sending an alarm message to the log system, otherwise performing step 9 to send the data packet to Output module.

If a rule in a type of rule base is hit, the first feature matching engine may also send an alert message to the log system.

In step 9, the response module sends the data packet that does not perform the blocking operation to the output port and transmits the data packet to the next hop device.

From the above processing process, since there is no need to wait for the matching result in the second feature matching engine matching process, there is no need to cache the data packet, and since the size of the second type rule base is relatively large, the matching is time consuming, thereby reducing the transmission. Delay, improve the utilization of the cache, directly improve the throughput of the device.

At the same time, the rule base is separated, so that different types of feature matching engines can be deployed independently, for example, the first feature matching engine is deployed in a main work area (such as a core program working on a main central processing unit (CPU) core or a host), and the second feature Matching the engine to deploy the secondary workspace (such as working with other CPU cores or non-core programs of the host) will greatly reduce the memory footprint of the main workspace (about 90% reduction) and reduce the memory requirements for the main workspace.

Specific embodiment 2

FIG. 5 is a schematic diagram of the internal structure of the second embodiment of the IPS implementation according to the second embodiment of the rule base. As shown in FIG. 5, it is basically the same as the specific embodiment 1. Only the difference from the specific embodiment 1 is described herein.

Input module, output module, log system: same as the prior art.

A class rule base, a second class rule base, a first feature matching engine, and a second feature matching engine are the same as in the specific embodiment 1.

Parsing the filtering module, on the basis of the original packet parsing and filtering function, calling the first feature matching engine to perform feature matching, and buffering the data packet, waiting for the matching result; when the first feature matching engine returns the matching result, the data packet and the data element are And the matching result is sent to the response module.

The response module, according to the matching result, performs a blocking operation, such as discarding or resetting the connection, and sends an alarm message to the log system, otherwise the duplicate data element is sent to the second feature matching engine. At the same time, the release operation is performed, and the data packet is sent to the output module.

The difference between the specific embodiment 1 and the specific embodiment 2 is that, in the specific embodiment 1, the second feature matching engine is invoked by the parsing filtering module. In the specific embodiment 2, the second feature matching engine is invoked by the response module.

The working process is similar to that of the specific embodiment 2 and will not be described again.

From the above processing process, since there is no need to wait for the matching result in the second feature matching engine matching process, there is no need to cache the data packet, and since the size of the second type rule base is relatively large, the matching is time consuming, thereby reducing the transmission. Delay, improve cache utilization, directly increase the throughput of the device.

At the same time, the rule base is separated, so that different types of feature matching engines can be deployed independently, for example, the first feature matching engine is deployed in the main work area (such as a core program working on the main CPU core or the host), and the second feature matching engine is deployed in the auxiliary work. Areas (such as working with other CPU cores or non-core programs of the host) will greatly reduce the memory footprint of the group work area (about 90% reduction) and reduce the memory requirements for the main work area.

Specific embodiment 3

FIG. 6 is a schematic diagram of the separation and deployment of the IPS device after the rule base is separated according to the third embodiment. As shown in FIG. 6 , after the rule base is separated and the feature matching engine is separated, the defense function and the alarm detection function in the IPS are decoupled. The basic deployment of equipment lays the foundation.

The white background frame in Figure 6 represents the main function module of the IPS defense function, which is composed of an input module, a detection filtering module, a first feature matching engine, a class rule library, a response module, an output module, and a log system, and is located in the same defense device. .

The gray bottom frame in FIG. 6 represents the main function mode of the IPS alarm detection, and is composed of an input module, a detection filtering module, a second feature matching engine, a second type rule base, and a log system, and is located in the same alarm detecting device.

The packet is preferentially routed to the IPS defense device. The IPS defense device matches the rules in a type of rule base. If it hits, it performs blocking (such as dropping, resetting, etc.) operations and alarm operations. If there is no hit, the packet is forwarded. The data packet is sent to the IPS alarm detection device, and the data packet sent to the IPS alarm detection device can further carry the data element or data element and the matching result parsed by the IPS defense device.

After receiving the IPS defense device's data packet, the IPS alarm detection device matches the rules in the second-class rule base. If it hits, the alarm is triggered. Otherwise, no operation is performed. If the data element is carried in the data packet, the data element can be directly used without further parsing, thereby reducing the parsing workload.

After the IPS defense and alarm detection function is used in the independent deployment mode, the matching workload on the data transmission path is reduced, the delay is reduced, the user experience and device throughput are improved, and the device is decoupled and deployed flexibly.

Based on the above method, a system and method for efficient intrusion prevention is proposed in the present application. According to the type of action in the rule, the rule base is divided into a class library and a second class library, corresponding to different feature libraries, and different calls are adopted. The feature matching engine method overcomes the problem of the original solution and achieves the effect of improving the IPS processing performance without affecting the IPS function, and realizes an efficient intrusion prevention system with good user experience and high device performance. High reliability and flexible deployment.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present application.

In the embodiment, a data processing device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

According to another embodiment of the present application, there is also provided a data processing apparatus, which can be applied to an IPS, including:

a receiving module configured to receive data to be passed;

The matching module is configured to match the data received by the receiving module according to the first type of rule and/or the second type of rule, where the first type of rule includes a rule for blocking data forwarding, and the second type of rule Including rules for performing data alerts;

And a processing module configured to process the data according to a result of whether the matching module obtains a match.

In an optional embodiment of the present application, the matching module is further configured to determine, according to the first type of rule, whether to block forwarding of the data; and the processing module is configured to determine a resistance in the matching module. In the case of forwarding the data, the forwarding of the data is blocked; in the case of determining to forward the data, the data is forwarded to the output interface of the IPS.

In an optional embodiment of the present application, the processing module is further configured to: after the matching module determines to forward the data, determine whether to alert the data according to the second type of rule, where In the case of determining to alert the data, the first alarm information is sent.

In an optional embodiment of the present application, the processing module is further configured to issue the second alarm information if the matching module determines to block forwarding of the data.

In an optional embodiment of the present application, the receiving module is further configured to: before the matching module matches the data according to the first type rule and/or the second type rule, respectively acquiring the a first type of rule and/or a second type of rule, wherein the first type of rule is set in a primary work area of the IPS; and the second type of rule is set in a secondary work area of the IPS.

In an optional embodiment of the present application, the first type of rule includes at least one of the following rules: a rule for discarding data; and a rule for resetting a connection.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination. The forms are located in different processors.

It should be noted that, when the data processing apparatus provided in the above embodiment performs data processing, only the division of each of the above-mentioned program modules is illustrated. In actual applications, the above processing may be allocated to different program modules as needed. Upon completion, the internal structure of the device is divided into different program modules to perform all or part of the processing described above. In addition, the data processing device and the data processing method embodiment provided by the foregoing embodiments are in the same concept, and the specific implementation process is described in detail in the method embodiment, and details are not described herein again.

According to another embodiment of the present application, there is also provided a storage medium having stored therein a computer program, the computer program being arranged to perform the method of any of the above embodiments when executed.

According to another embodiment of the present application, there is also provided an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being arranged to execute the computer program to perform the above embodiment One of the methods described.

It will be appreciated that the memory can be either volatile memory or non-volatile memory, and can include both volatile and nonvolatile memory. The non-volatile memory may be a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), or an Erasable Programmable Read (EPROM). Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM), Ferromagnetic Random Access Memory (FRAM), Flash Memory, Magnetic Surface Memory , CD-ROM, or Compact Disc Read-Only Memory (CD-ROM); the magnetic surface memory can be a disk storage or a tape storage. The volatile memory can be a random access memory (RAM) that acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access (SSRAM). DRAM (Dynamic Random Access Memory), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), enhancement Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Synchronous Dynamic Random Access Memory (SLDRAM), Direct Memory Bus Random Access Memory (DRRAM) ). The memories described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

The method disclosed in the foregoing embodiments of the present invention may be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general purpose processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or the like. The processor may implement or perform the methods, steps, and logic blocks disclosed in the embodiments of the present invention. A general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiment of the present invention may be directly implemented as a hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, the storage medium being located in the memory, the processor reading the information in the memory, and completing the steps of the foregoing methods in combination with the hardware thereof.

Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.

The above description is only an optional embodiment of the present application, and is not intended to limit the present application, and various changes and modifications may be made to the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application are intended to be included within the scope of the present application.

Claims (10)

A method of processing data, including: The intrusion prevention system IPS receives the data to be passed; Matching the data according to the first type of rules and/or the second type of rules, wherein the first type of rules includes rules for blocking data forwarding, and the second type of rules includes rules for performing data alarms; The data is processed according to the result of the match. The method of claim 1 wherein said matching said data in accordance with a first type of rule and/or a second type of rule comprises: Determining whether to block forwarding of the data according to the first type of rule; The processing the data according to the result of the matching, including: In the case of determining to block forwarding of the data, the forwarding of the data is blocked; in the case of determining to forward the data, the data is forwarded to an output interface of the IPS. The method of claim 2, wherein after the determining to forward the data, the method further comprises: Determining whether to alert the data according to the second type of rule, wherein, in the case of determining to alert the data, the first alarm information is sent. The method of claim 2, wherein in the case of determining to block forwarding of the data, the method further comprises: issuing second alert information. The method of claim 1, wherein the method further comprises: before the matching the data according to the first type of rules and/or the second type of rules: Obtaining the first type of rule and/or the second type of rule from a preset location, where the first type of rule is set in a main working area of the IPS; and the second type of rule is set in the IPS Auxiliary work area. The method of claim 1 wherein said first type of rule comprises at least one of the following rules: Rules for dropping data; rules for resetting connections. A data processing device comprising: a receiving module configured to receive data to be passed; The matching module is configured to match the data received by the receiving module according to the first type of rule and/or the second type of rule, where the first type of rule includes a rule for blocking data forwarding, and the second type of rule Including rules for performing data alerts; And a processing module configured to process the data according to a result of whether the matching module obtains a match. The apparatus according to claim 7, wherein the matching module is configured to determine whether to block forwarding of the data according to the first type of rule; The processing module is configured to block forwarding of the data if the matching module determines to block forwarding of the data; and forward the data to an output interface of the IPS when determining to forward the data . A storage medium having stored therein a computer program, wherein the computer program is arranged to execute the method of any one of claims 1 to 6 at runtime. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being arranged to run the computer program to perform the method of any one of claims 1 to 6.

Images