CN111277567B - Intrusion prevention processing method and device - Google Patents

Abstract

Embodiments of the present invention provide an intrusion prevention processing method and device. The method includes: determining an IPS bypass threshold of an intrusion prevention system according to current network traffic conditions; and performing IPS processing on packets in a host according to the IPS bypass threshold. In the intrusion prevention processing method and device provided by the embodiments of the present invention, since the IPS bypass threshold of the intrusion prevention system is determined according to the current network traffic situation, the amount of packets currently capable of being processed by the IPS engine can be dynamically sent to the IPS engine according to the current network traffic situation. , so that the stability of network services can be guaranteed under any network traffic size.

Description

Intrusion prevention processing method and device

technical field

The invention relates to the technical field of network security, and in particular, to an intrusion prevention processing method and device.

Background technique

Intrusion prevention system (Intrusion-prevention system, IPS for short) can monitor the network data transmission behavior of the network or network equipment, and immediately interrupt, adjust or isolate some abnormal network data. The role of the current terminal IPS is to detect incoming and outgoing packets, and to block and alert malicious packets. The specific implementation is to hijack the packet in the kernel HOOK and copy it to the IPS engine at the application layer for processing. After the IPS engine decodes, preprocesses, and matches the packet, it finally informs the kernel to send the packet according to the matching result. Discard or continue processing.

Bypass is a technology that keeps the network speed stable when the IPS engine becomes the bottleneck. The idea is to directly release the packets that exceed the processing capacity of the engine. The current Bypass technical solution is as follows: a fixed-size shared memory is allocated between the IPS engine and the kernel as a packet queue. Each time the kernel receives a packet, it first checks whether the queue is full. When it is full, the packet is directly bypassed. The packets are copied to the shared queue, and the application-layer IPS engine checks the packets on the queue one by one.

The current Bypass technical solution has the following problems: the current Bypass is a fixed value based on the size of the shared memory. When the shared memory is found to be full, the current packet will be bypassed directly. However, due to the larger network traffic, the processing power of the IPS engine is lower. When the traffic reaches a certain value, the processing capability of the IPS engine will be reduced to the point that it cannot process the packets in the queue in time, resulting in an increase in the delay of the packets buffered in the queue to a certain extent, and eventually network freezes or connection failures will occur. Case.

SUMMARY OF THE INVENTION

In view of the problems in the prior art, embodiments of the present invention provide an intrusion prevention processing method and apparatus.

Specifically, the embodiments of the present invention provide the following technical solutions:

In a first aspect, an embodiment of the present invention provides an intrusion prevention processing method, including:

Determine the IPS bypass threshold of the intrusion prevention system according to the current network traffic conditions;

IPS processing is performed on the packets in the host according to the IPS bypass threshold.

Further, determining the intrusion prevention system IPS bypass threshold according to the current network traffic situation specifically includes:

Get the number of new connections per second on the current host;

Query the mapping table according to the number of new connections per second to obtain the IPS processing capability value;

Determine the IPS bypass threshold according to the IPS processing capability value;

Wherein, the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value.

Further, determining the intrusion prevention system IPS bypass threshold according to the current network traffic situation specifically includes:

Determine whether the current host has the number of connections that have been retransmitted and failed to connect, and if so, query the minimum IPS processing capability value in the mapping table, and determine the IPS bypass threshold according to the minimum IPS processing capability value;

If there are no retransmitted and failed connections, query the mapping table for the IPS bypass threshold corresponding to the current number of new connections per second;

Wherein, the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value.

Further, before querying the mapping table to obtain the IPS processing capability value of the intrusion prevention system according to the number of new connections per second, the method further includes:

Under the recommended configuration of the IPS, test the maximum number of connections that the IPS can handle under the premise that no network freezes or connection failures occur under the condition that various new connections per second are created, and the maximum number of connections is taken as the corresponding number of new connections IPS processing capability value;

The mapping table is established according to each connection number and the corresponding IPS processing capability value.

Further, performing IPS processing on the packets in the host according to the IPS bypass threshold specifically includes:

IPS marking new connections in the host according to the IPS bypass threshold;

Correspondingly, the intrusion prevention processing method further includes:

When the IPS kernel HOOK receives the packets, it sends the packets with the IPS tag on the matching connection to the application-layer IPS engine for detection, and releases the packets with the matching connection without the IPS tag.

In a second aspect, an embodiment of the present invention further provides an intrusion prevention processing device, including:

A determination module, used for determining the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition;

The first processing module is configured to perform IPS processing on the packets in the host according to the IPS bypass threshold.

Further, the determining module is specifically used for:

Get the number of new connections per second on the current host;

Query the mapping table according to the number of new connections per second to obtain the IPS processing capability value;

Determine the IPS bypass threshold according to the IPS processing capability value;

Wherein, the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value.

In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the first program when executing the program The steps of the intrusion prevention processing method described in the aspect.

In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the intrusion prevention processing method according to the first aspect .

In a fifth aspect, an embodiment of the present invention further provides a computer program product, where the computer program product includes a computer program, which implements the steps of the intrusion prevention processing method described in the first aspect when the computer program is executed by a processor.

As can be seen from the above technical solutions, in the intrusion prevention processing method and device provided by the embodiments of the present invention, since the intrusion prevention system IPS bypass threshold is determined according to the current network traffic situation, it can dynamically send the IPS engine current information to the IPS engine according to the current network traffic situation. The amount of packets that can be processed, so that the stability of network services can be guaranteed under any network traffic size.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

FIG. 1 is a flowchart of an intrusion prevention processing method provided by an embodiment of the present invention;

Fig. 2 is the processing flow chart of the Bypass technical scheme that the prior art provides;

Fig. 3 is a processing flow chart of the Bypass technical solution provided by an embodiment of the present invention;

4 is a schematic structural diagram of an intrusion prevention processing device according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

In this embodiment, it should be noted that the function of the current terminal IPS is to detect incoming and outgoing packets, and to block and alarm malicious packets. The specific implementation is to hijack the packet in the kernel hook and copy it to the IPS engine at the application layer for processing. After the IPS engine decodes, preprocesses, and matches the packet, it finally informs the kernel to send the packet according to the matching result. Discard or continue processing. The end-to-end delay of packets is an indicator for measuring network quality. The shorter the delay, the faster the network speed, and vice versa. The packets buffered in the queue by the IPS engine are detected one by one. The faster the detection, the greater the impact on the packet delay. Small, and vice versa, the larger; and when the detection process is fixed, the detection speed is determined by two factors:

1. Hardware configuration, the higher the configuration, the faster the processing, and vice versa the slower;

2. The size of the traffic, the larger the traffic, the less time resources the IPS engine is allocated, and the slower the processing.

Therefore, under a certain hardware configuration, when the network traffic reaches a certain value, the processing capacity of the IPS engine will become a bottleneck, and the network speed will begin to decrease. Users will obviously feel stuck or failed to access. Bypass (bypass function) is a technology to keep the network speed stable when the IPS engine becomes the bottleneck. The core idea is to directly release the packets that exceed the processing capacity of the engine. As shown in Figure 2, the processing flow of the Bypass technical solution in the prior art is as follows: a shared memory of a fixed size is allocated between the IPS engine and the kernel as a message queue, and the kernel first detects whether the queue is full every time a packet is received. If it is not full, it will copy the packet to the shared queue, and the application layer IPS engine will check the packets on the queue one by one. As can be seen from the Bypass technical solution shown in Figure 2, the current Bypass technical solution is only based on the size of the shared memory. When the shared memory is found to be full, the current message will be bypassed directly. However, because the shared memory is a fixed value, it cannot be used. Adjust the rate of sending packets according to the size of network traffic. According to the principle introduced above, when the network traffic is larger, the processing capability of the IPS engine is lower. When the traffic reaches a certain value, the processing capability of the IPS engine will be reduced to the point that it cannot process the packets in the queue in time, resulting in an increase in the delay of the packets buffered in the queue to a certain extent, and eventually network freezes or connection failures will occur. Case. Therefore, it is necessary to design a mechanism that can dynamically adjust the packet sending rate according to the size of network traffic, so as to ensure that as the network traffic changes, the amount of packets currently capable of being processed by the IPS engine can be sent to the IPS engine instead of a fixed shared memory. size of packets. The intrusion prevention processing method and apparatus provided in this embodiment will be further explained in detail below through specific embodiments.

FIG. 1 shows a flowchart of an intrusion prevention processing method provided by an embodiment of the present invention. As shown in FIG. 1 , the intrusion prevention processing method provided by the embodiment of the present invention includes the following steps:

Step 101: Determine the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition;

Step 102: Perform IPS processing on the packets in the host according to the IPS bypass threshold.

In this embodiment, just as the principle described above, when the network traffic is smaller, the more time resources are allocated to the IPS engine, and the processing is faster. When the network traffic is larger, the less time resources are allocated to the IPS engine and the slower the processing. Therefore, the IPS bypass threshold of the intrusion prevention system is determined according to the current network traffic conditions, which can avoid stalls or connection failures caused by heavy network traffic.

In this embodiment, determining the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition may refer to: taking the maximum number of connections that the IPS engine can handle under the current network traffic condition as the IPS bypass threshold according to the current network traffic condition. Here, the maximum number of connections that the IPS engine can handle refers to the maximum number of connections that the IPS engine can handle under the premise that no network freezes or connection failures occur.

In this embodiment, determining the IPS bypass threshold of the intrusion prevention system according to the current network traffic situation may also refer to: when the current network traffic is small, a larger IPS bypass threshold is used; when the current network traffic is large, a smaller IPS bypass threshold is used Bypass threshold. For example, when the number of new connections per second is 1-1000, the corresponding IPS bypass threshold can be determined to be 1000, and when the number of new connections per second is 1001-2000, the corresponding IPS bypass threshold can be determined to be 800. When the number of new connections per second is 2001-3000, the corresponding IPS bypass threshold can be determined to be 500, and when the number of new connections per second is 3001-4000, the corresponding IPS bypass threshold can be determined to be 300.

In this embodiment, the meaning of the IPS bypass threshold is: packets greater than the IPS bypass threshold will be bypassed directly, while packets less than or equal to the IPS bypass threshold will be sent to the IPS engine for IPS detection and analysis by the IPS engine . Therefore, it can be seen that when the network traffic is larger, the processing time will be slower due to the less time resources allocated to the IPS engine. Therefore, setting a smaller IPS bypass threshold at this time can reduce the processing pressure of the IPS engine, thereby avoiding the occurrence of Network freezes or connection failures caused by the inability of the IPS engine to process packets in the queue in a timely manner. It can be seen that, because this embodiment can determine the IPS bypass threshold of the intrusion prevention system according to the current network traffic situation, the amount of packets that the IPS engine can process can be dynamically sent to the IPS engine according to the current network traffic situation, so that any network traffic The stability of network services can be guaranteed in all cases.

In this embodiment, it should be noted that after the IPS bypass threshold is determined, IPS processing can be performed on the packets in the host according to the IPS bypass threshold, that is, the packets that do not exceed the IPS bypass threshold are copied to On a shared queue, the application-layer IPS engine checks the packets on the queue one by one, and directly bypasses the packets that exceed the IPS bypass threshold.

As can be seen from the above technical solutions, in the intrusion prevention processing method provided by the embodiment of the present invention, since the IPS bypass threshold of the intrusion prevention system is determined according to the current network traffic situation, it can dynamically send the IPS engine to the IPS engine according to the current network traffic situation. This ensures the stability of network services under any network traffic size.

Further, based on the content of the foregoing embodiment, in this embodiment, the determining of the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition specifically includes:

Get the number of new connections per second on the current host;

Query the mapping table according to the number of new connections per second to obtain the IPS processing capability value;

Determine the IPS bypass threshold according to the IPS processing capability value;

Wherein, the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value.

In this embodiment, when the IPS bypass threshold of the intrusion prevention system is determined according to the current network traffic situation, since the number of new connections per second of the host can reflect the current network traffic situation, the IPS bypass can be determined according to the number of new connections per second of the current host. threshold, and this acquisition method is simple and efficient. Specifically, the correspondence between the number of new connections per second of the current host and the IPS bypass threshold can be determined by querying the mapping table.

In this embodiment, it should be noted that the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value, and the correspondence stored in the mapping table is obtained through experimental testing. The corresponding relationship between the number of new connections per second stored in the mapping table and the value of the IPS processing capability refers to: under the corresponding number of new connections per second, on the premise that no network freezes or connection failures occur, the IPS engine can process the number of new connections per second. The maximum number of connections, where the maximum number of connections is also the value of the IPS processing capability.

In this embodiment, after the IPS processing capability value is obtained by querying the mapping table according to the number of new connections per second, the obtained IPS processing capability value may be directly used as the IPS bypass threshold. The meaning of the IPS bypass threshold here is: packets greater than the IPS processing capability (IPS bypass threshold) will be bypassed directly, while packets less than or equal to the IPS processing capability (IPS bypass threshold) will be sent to the IPS The engine performs IPS detection analysis.

In this embodiment, it should be noted that the corresponding relationship between the number of new connections per second (CPS) and the processing capability value of the IPS engine under the IPS recommended configuration is obtained according to the experiment, and the corresponding relationship is stored in the mapping table for query.

In this embodiment, the CPS is detected in real time in the Bypass function, and then the mapping table is queried according to the detection result to obtain the processing capability value of the IPS engine under the current CPS condition, and then the Bypass threshold is dynamically adjusted according to the processing capability value obtained by the query, thereby It can ensure the stability of network services under any network traffic conditions and maximize the IPS detection rate.

Further, based on the content of the foregoing embodiment, in this embodiment, the determining of the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition specifically includes:

Determine whether the current host has the number of connections that have been retransmitted and failed to connect, and if so, query the minimum IPS processing capability value in the mapping table, and determine the IPS bypass threshold according to the minimum IPS processing capability value;

If there are no retransmitted and failed connections, query the mapping table for the IPS bypass threshold corresponding to the current number of new connections per second;

Wherein, the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value.

In this embodiment, it is determined whether the current host has the number of connections that have been retransmitted and failed to connect. If there is, it means that the host traffic has reached a high value. At this time, the processing capability of the IPS engine is reduced to the point where it cannot process the queue in time. Therefore, in this network traffic situation, in order to stabilize the stability of network services In this case, a lower IPS bypass threshold should be set. Therefore, when judging whether the current host has the number of retransmitted and failed connections, the minimum IPS processing capability value in the mapping table is directly inquired, and the minimum IPS processing capability value is determined as the IPS bypass threshold. If there are no retransmitted and failed connections, query the mapping table for the IPS bypass threshold corresponding to the current number of new connections per second. It can be seen that this embodiment provides two processing methods in the case of the number of connections that have been retransmitted and failed to connect, and the number of connections that have been retransmitted and failed to be connected, so that it can be obtained in different network situations. A more appropriate IPS bypass threshold. Especially in the case of poor network status, determining the IPS bypass threshold according to the minimum IPS processing capability value can stabilize the stability of the network service.

Further, based on the content of the foregoing embodiment, in this embodiment, before querying the mapping table according to the number of new connections per second to obtain the IPS processing capability value of the intrusion prevention system, the method further includes:

Under the recommended configuration of the IPS, test the maximum number of connections that the IPS can handle under the premise that no network freezes or connection failures occur under the condition that various new connections per second are created, and the maximum number of connections is taken as the corresponding number of new connections IPS processing capability value;

The mapping table is established according to each connection number and the corresponding IPS processing capability value.

In this embodiment, in order to measure the processing capability of the IPS engine under changing traffic, under the recommended configuration of the IPS, the test is conducted under the condition that various numbers of new connections are created per second, on the premise that no network freeze or connection failure occurs. The maximum number of connections that the IPS can handle, and the maximum number of connections is taken as the IPS processing capability value corresponding to the number of newly created connections, and then the mapping table is established according to each connection number and the corresponding IPS processing capability value. For example, the structure of the mapping table can be as follows:

{1000:1000, //When the number of new connections is 1-1000, the IPS processing capacity value is 1000;

2000:800, //When the number of new connections is 1001-2000, the IPS processing capacity value is 800;

3000:500, //When the number of new connections is 2001-3000, the IPS processing capacity value is 500;

4000:300, //When the number of new connections is 3001-4000, the IPS processing capacity value is 300}

In this embodiment, it should be noted that a new Bypass mechanism can be implemented according to the mapping table established above, that is, the mapping table is queried according to the number of new connections per second to obtain the IPS processing capability value, and then the IPS processing capability value is obtained according to the IPS processing capability value. Determines the IPS bypass threshold. In general, the IPS bypass threshold is the IPS processing capability value.

It can be seen that, in this embodiment, by testing the number of new connections per second under the recommended configuration of the IPS, on the premise that there is no network freeze or connection failure, the maximum number of connections that the IPS can handle will be the maximum number of connections. The number is used as the IPS processing capability value corresponding to the number of newly created connections, and based on this, a mapping table containing the mapping relationship between the number of new connections per second and the IPS processing capability value with reference value is established. The table queries the IPS bypass threshold corresponding to the current number of new connections per second.

Further, based on the content of the foregoing embodiment, in this embodiment, the performing IPS processing on the packets in the host according to the IPS bypass threshold specifically includes:

IPS marking new connections in the host according to the IPS bypass threshold;

Correspondingly, the intrusion prevention processing method further includes:

When the IPS kernel HOOK receives the packets, it sends the packets with the IPS tag on the matching connection to the application-layer IPS engine for detection, and releases the packets with the matching connection without the IPS tag.

In this embodiment, as shown in FIG. 3 , the implementation process of the Bypass technical solution provided by this embodiment includes the following contents:

①Bypass token bucket processing flow

The setup of the token bucket uses two timers.

Timer 1: Count the number of retransmitted and failed connections and the CPS of these 5s every 5 seconds. If there is a failed connection, read the minimum processing capacity value in the above mapping table, otherwise obtain the corresponding processing from the above mapping table according to CPS capacity value, and then set the bypass threshold according to the corresponding processing capacity value.

Timer 2: Read the Bypass threshold every 1 second to set the token bucket.

②Message processing flow

When the IPS kernel hook receives a packet, it first queries the connection table according to the quintuple. If it is queried, check the IPS tag of the connection. If the tag exists, it will be sent to the application layer IPS engine for detection. If it does not exist, it will be released directly. If the query cannot be found, a connection will be created and added to the connection table, and the token will be read from the token bucket. If the token can be obtained, the IPS detection flag will be set on the connection; if it cannot be obtained, it will not be set.

As can be seen from Figure 3, this solution realizes the function of dynamically adjusting the IPS Bypass threshold according to the CPS, ensuring that the network is normal under any traffic, and on this basis, the IPS detection rate can be maximized.

FIG. 4 shows a schematic structural diagram of an intrusion prevention processing apparatus provided by an embodiment of the present invention. As shown in FIG. 4 , the intrusion prevention processing apparatus provided by the embodiment of the present invention includes: a determination module 21 and a first processing module 22, wherein:

The determining module 21 is used for determining the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition;

The first processing module 22 is configured to perform IPS processing on the packets in the host according to the IPS bypass threshold.

Further, based on the content of the foregoing embodiment, in this embodiment, the determining module 21 is specifically configured to:

Get the number of new connections per second on the current host;

Query the mapping table according to the number of new connections per second to obtain the IPS processing capability value;

Determine the IPS bypass threshold according to the IPS processing capability value;

Wherein, the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value.

Further, based on the content of the foregoing embodiment, in this embodiment, the determining module 21 is specifically configured to:

Determine whether the current host has the number of connections that have been retransmitted and failed to connect, and if so, query the minimum IPS processing capability value in the mapping table, and determine the IPS bypass threshold according to the minimum IPS processing capability value;

If there are no retransmitted and failed connections, query the mapping table for the IPS bypass threshold corresponding to the current number of new connections per second;

Wherein, the mapping table stores the correspondence between the number of new connections per second and the IPS processing capability value.

Further, based on the content of the foregoing embodiment, in this embodiment, the apparatus further includes: a building module for:

Under the recommended configuration of the IPS, test the maximum number of connections that the IPS can handle under the premise that no network freezes or connection failures occur under the condition that various new connections per second are created, and the maximum number of connections is taken as the corresponding number of new connections IPS processing capability value;

The mapping table is established according to each connection number and the corresponding IPS processing capability value.

Further, based on the content of the foregoing embodiment, in this embodiment, the first processing module 22 is specifically configured to: perform IPS marking on the newly created connection in the host according to the IPS bypass threshold;

Correspondingly, the intrusion prevention processing device further includes:

The second processing module is configured to, when the IPS kernel HOOK receives the packet, send the packet with the IPS tag on the matching connection to the application layer IPS engine for detection, and release the packet with the matching connection without the IPS tag.

Since the intrusion prevention processing device provided by the embodiment of the present invention can be used to execute the intrusion prevention processing method described in the above-mentioned embodiment, the working principle and beneficial effect thereof are similar, so they are not described in detail here. introduce.

Based on the same inventive concept, another embodiment of the present invention provides an electronic device, see FIG. 5 , the electronic device specifically includes the following: a processor 501, a memory 502, a communication interface 503, and a communication bus 504;

The processor 501, the memory 502, and the communication interface 503 communicate with each other through the communication bus 504;

The processor 501 is configured to call a computer program in the memory 502, and when the processor executes the computer program, all steps of the above-mentioned intrusion prevention processing method are implemented, for example, when the processor executes the computer program. The following process: determine the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition; perform IPS processing on the packets in the host according to the IPS bypass threshold.

It can be understood that, for the refined functions and extended functions that can be performed by the computer program, reference may be made to the descriptions of the above embodiments.

Based on the same inventive concept, another embodiment of the present invention provides a non-transitory computer-readable storage medium, where a computer program is stored on the non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the above-mentioned All steps of the intrusion prevention processing method, for example, when the processor executes the computer program, the following processes are implemented: determining the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition; IPS processing is performed.

It can be understood that, for the refined functions and extended functions that can be performed by the computer program, reference may be made to the descriptions of the above embodiments.

Based on the same inventive concept, another embodiment of the present invention provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, all steps of the above-mentioned intrusion prevention processing method are implemented. When the processor executes the computer program, the following processes are implemented: determining the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition; and performing IPS processing on the packets in the host according to the IPS bypass threshold.

It can be understood that, for the refined functions and extended functions that can be performed by the computer program, reference may be made to the descriptions of the above embodiments.

In addition, the above-mentioned logic instructions in the memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solutions of the embodiments of the present invention. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the intrusion prevention processing method described in each embodiment or some part of the embodiment.

Furthermore, in the present invention, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply existence between these entities or operations any such actual relationship or sequence. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion such that a process, method, article or device comprising a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

Furthermore, in the present invention, description with reference to the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples", etc., mean specific features described in connection with the embodiment or example , structure, material or feature is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and combine the different embodiments or examples described in this specification, as well as the features of the different embodiments or examples, without conflicting each other.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (7)

1. An intrusion prevention processing method, comprising:

determining an intrusion prevention system IPS bypass threshold according to the current network traffic condition; the IPS bypass threshold is used for directly passing the messages larger than the IPS bypass threshold, sending the messages smaller than or equal to the IPS bypass threshold to an IPS engine and carrying out IPS detection analysis by the IPS engine; the larger the current network flow is, the smaller the IPS bypass threshold value is; the method for determining the IPS bypass threshold of the intrusion prevention system according to the current network traffic condition comprises the following steps: judging whether the current host has the retransmitted connection number which fails in connection, if so, inquiring the lowest IPS processing capability value in a mapping table, and determining an IPS bypass threshold according to the lowest IPS processing capability value;

if the connection number which is retransmitted and failed in connection does not exist, inquiring an IPS (in-plane switching) bypass threshold value corresponding to the number of newly-built connections per second in the mapping table;

the mapping table stores a corresponding relation between the number of newly established connections per second and the IPS processing capability value;

according to the IPS bypass threshold value, performing IPS marking on the newly-built connection in the host;

when the IPS kernel HOOK receives the message, the message matched and connected with the IPS mark is sent to an application layer IPS engine for detection, and the message matched and connected without the IPS mark is released.

2. The intrusion prevention processing method according to claim 1, wherein the determining an intrusion prevention system IPS bypass threshold according to the current network traffic condition specifically includes:

acquiring the number of newly established connections per second of the current host;

inquiring a mapping table according to the newly established connection number per second to obtain an IPS processing capability value;

determining an IPS bypass threshold according to the IPS processing capability value;

and the mapping table stores the corresponding relation between the newly established connection number per second and the IPS processing capability value.

3. The intrusion prevention processing method according to claim 2, before obtaining the IPS processing capability value of the intrusion prevention system according to the newly created connection number query mapping table per second, the method further comprises:

under the recommended configuration of the IPS, testing the maximum connection quantity which can be processed by the IPS under the condition of newly building various connection quantities per second on the premise of not generating network blockage or connection failure, and taking the maximum connection quantity as the IPS processing capacity value under the corresponding newly built connection quantity;

and establishing the mapping table according to each connection number and the corresponding IPS processing capability value.

4. An intrusion prevention processing apparatus, comprising:

the determining module is used for determining an intrusion prevention system IPS bypass threshold according to the current network traffic condition; the IPS bypass threshold is used for directly passing the messages larger than the IPS bypass threshold, sending the messages smaller than or equal to the IPS bypass threshold to an IPS engine and carrying out IPS detection analysis by the IPS engine; the larger the current network flow is, the smaller the IPS bypass threshold value is; the determining module is further configured to determine whether the current host has a connection number which is retransmitted and failed in connection, if so, query a lowest IPS processing capability value in a mapping table, and determine an IPS bypass threshold according to the lowest IPS processing capability value;

if the connection number which is retransmitted and failed in connection does not exist, inquiring an IPS (in-plane switching) bypass threshold value corresponding to the number of newly-built connections per second in the mapping table;

the mapping table stores a corresponding relation between the number of newly established connections per second and the IPS processing capability value;

the first processing module is used for carrying out IPS marking on the newly-built connection in the host according to the IPS bypass threshold value; when the IPS kernel HOOK receives the message, the message matched and connected with the IPS mark is sent to an application layer IPS engine for detection, and the message matched and connected without the IPS mark is released.

5. The intrusion prevention processing device according to claim 4, wherein the determining module is specifically configured to:

acquiring the number of newly established connections per second of the current host;

inquiring a mapping table according to the newly established connection number per second to obtain an IPS processing capability value;

determining an IPS bypass threshold according to the IPS processing capacity value;

and the mapping table stores the corresponding relation between the newly established connection number per second and the IPS processing capability value.

6. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the intrusion prevention processing method according to any one of claims 1 to 3 when executing the program.

7. A non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor implements the steps of the intrusion prevention processing method according to any one of claims 1 to 3.

Images