A general method of HTTP protocol element extraction based on user-defined label language

Abstract

The invention discloses an HTTP protocol element universal extraction method based on a user-defined label language, comprising the following steps: S1, an interactive splicing stage: if there is a response data packet, the request data packet and the response data packet being combined to be spliced into an interactive unit; if there is no response packet, the request packet being treated as an interaction unit alone; S2: a decoding stage: decoding the interactive unit obtained in the interactive splicing stage; S3: a rule matching stage: matching the decoded interactive unit with the rule set to obtain the rule of element extraction; S4, an element extraction stage: extracting elements from decoded interactive units according to the element extraction rules obtained in the rule matchingstage; S5: a Detail Document Output Phase: filling in the corresponding fields of detail document structure according to the elements extracted in the element extraction phase and output to the database. The invention greatly reduces the development and maintenance workload.

Description

technical field [0001] The invention relates to a general extraction method of HTTP protocol elements, in particular to a general extraction method of HTTP protocol elements based on a self-defined label language. Background technique [0002] With the development of the Internet, more and more network applications are implemented based on the HTTP hypertext transfer protocol, and the update frequency is getting faster and faster, which brings great challenges to cyberspace security monitoring. According to the HTTP protocol message format of each network application, a set of codes including complete interactive splicing, decoding, rule matching, protocol element extraction and detailed list output are customized, which is the traditional method of extracting elements of web applications based on the HTTP protocol. Requires a lot of development and maintenance workload; every new HTTP-based network application needs to be recompiled and started, which has a great impact on ...

AI Technical Summary

Problems solved by technology

According to the HTTP protocol message format of each network application, a set of codes including complete interactive splicing, decoding, rule matching, protocol element extraction and detailed list output are customized, which is the traditional HTTP protocol-based network application element extraction method. Requires a lot of development and maintenance workload; each new HTTP-based network application needs to be recompiled and started, which has a great impact on the customer's on-site use; at the same time, the extraction of each HTTP-based network application Modules will also affect each other's stability, which will have a huge impact on the entire protocol element extraction platform

The reason is mainly because the traditional HTTP protocol-based network application element extraction method is to customize the whole set of codes according to the HTTP protocol message characteristics of each network application program, and does not extract each element based on the HTTP protocol from a macro perspective. The stage is abstracted into a general processing platform, and the element extraction rules are not abstracted into a set of custom label language, so as to perform general processing and platform management on the element extraction of web applications based on the HTTP protocol

Images