Traffic mirroring method, device and equipment

Abstract

The embodiment of the invention provides a traffic mirroring method, device and equipment. The method comprises the following steps: acquiring flow data from a service extension implementation layer of the target data plane agent, wherein the traffic data comprises request traffic data and / or response traffic data; depending on traffic data, determining a target mirroring strategy corresponding tothe traffic data, performing mirroring processing on the traffic data based on a determined target mirroring strategy corresponding to the traffic data to generate mirroring data corresponding to thetraffic data, and then forwarding the mirroring data corresponding to the traffic data to a mirroring pipeline, so that a data analysis server obtains the mirroring data from the mirroring pipeline and analyzes and processes the mirroring data.

Description

technical field [0001] This document relates to the field of computer technology, in particular to a flow mirroring method, device and equipment. Background technique [0002] At present, the analysis of mirrored data obtained by mirroring traffic data plays a very important role in business security risk insight, system security vulnerability and intrusion detection, and data security asset flow monitoring. [0003] However, due to the above-mentioned process of obtaining traffic data, it is often difficult to recombine and restore data, difficult to extract business data, and cannot be parsed under encrypted communication, which leads to excessive consumption of computing resources in the process of obtaining traffic data. Therefore, it is necessary to provide a technical solution that consumes less computing resources when acquiring traffic data. Contents of the invention [0004] The purpose of the embodiments of this specification is to provide a traffic mirroring me...

AI Technical Summary

Problems solved by technology

[0003] However, due to the above-mentioned process of obtaining traffic data, it is often difficult to recombine and restore data, it is difficult to extract business data, and it cannot be parsed under encrypted communication, which leads to excessive consumption of computing resources in the process of obtaining traffic data.

Images