Dynamic rule chained recursive triggering method based on message content awareness and system

Abstract

The invention discloses a dynamic rule chained recursive triggering method based on message content awareness and a system. According to main technical characteristics, on the basis of establishing adynamic rule chained recursive triggering system, for the problem that an existing TAP device cannot carry out dynamic association analysis on message streams, triggers and an association relationshipbetween the triggers and triggering rules are added, through adoption of steps such as trigger configuration, static rule and trigger definition configuration, message matching, new dynamic rule generation, rule aging deletion and rule table updating, dynamic information such as such as IP addresses, ports and user identities in the externally input message streams are dynamically extracted, andthe new dynamic rules are recursively triggered, so the message streams can be precisely output to a rear end analysis system, input bandwidths of the rear end analysis can be clearly saved, and the performance loss of the rear end analysis system is avoided. The method and the system have the advantages that the realization method is simple, the rule triggering is rapid and efficient, and the message traffic of the rear end analysis system can be clearly reduced.

Description

technical field [0001] The invention belongs to the technical field of network visualization, and in particular relates to a dynamic rule chain recursive triggering method based on message content perception, and a system composition for realizing the method. Background technique [0002] In the background technology, in the field of network visualization, the TAP device is used to collect the message flow of the user's business network, and the flow of interest is screened through the static rules configured by the user, and the network is transmitted to the back-end analysis system for real-time processing based on the split collection network. The analysis system hopes that the front-end TAP device can accurately filter the packet flow, and only output the flow of interest to the backend for processing, so as to avoid unnecessary bandwidth and performance loss caused by irrelevant data packets. In many cases, the back-end analysis system hopes to process the access traffi...

AI Technical Summary

Problems solved by technology

[0003] The above problems determine that the static domain rule filtering mode of the existing TAP device cannot meet the precise filtering requirements of the back-end analysis system. The maximum rule set can only be statically configured on the front-end TAP device to output all possible packet flows to the back-end analysis system. The system recognizes

Images