Processing method of parent-child connection in full-flow storage backtracking analysis system

Abstract

The present invention relates to the technical field of data analysis and processing, and specifically provides a method for processing parent-child connections in a full-flow storage backtracking analysis system, including the following steps: determining the port range of each worker thread, and establishing a mapping relationship between each worker thread and the port ;Based on the above-mentioned mapping relationship, configure two directions of traffic, one direction selects the source port configuration, and the other direction selects the destination port configuration; builds a local data connection hash mapping table for each worker thread; Connections and storage threads are processed. The present invention ensures the accuracy of the application identification of the parent-child connection message, and at the same time avoids the robustness problem caused by the load balancing caused by the allocation of the same ip address to the same thread, and can also improve the overall high concurrent performance.

Description

technical field [0001] The invention relates to the technical field of data analysis and processing, and specifically provides a method for processing parent-child connections in a full flow storage backtracking analysis system. Background technique [0002] For security vendors, although firewalls and full-traffic storage backtracking analysis systems both analyze and process traffic, their processing logic for data connection packets is different. This is because systems such as firewalls can guarantee the packet timing of control connections and data connections, while the full-flow storage backtracking analysis system is a mirror image processing of the packets. The thread cannot guarantee that the control connection and the data connection are received by the same worker thread, and there is no guarantee that the control connection will be processed before the data connection. For the traffic analysis system, the data connection needs to rely on the control connection ...

AI Technical Summary

Problems solved by technology

However, this design scheme will increase process switching and message flow between threads, and will also cause cache misses, thus affecting performance

[0006] Due to the disadvantages of separating the capture thread from the analysis thread, another practice in the industry is to capture the thread for analysis and processing at the same time, that is, the two are combined into one, but it is necessary to ensure that the parent-child connection is received by the same capture thread, which requires hardware capture. Packet-driven configuration, so that the same (sip, dip) or the same sip or the same dip packets are received by the same capture thread, but this can easily cause load imbalance, thus affecting the robustness of the system

Images