A data security analysis method and device for single data flow

Abstract

The application provides a network security processing method and device for a single data stream. The method comprises: obtaining an association analysis expression; the association analysis expression comprises flow table information of a single data stream to be analyzed and an association expression; constructing an abstract syntax tree based on the flow table information and the association expression; traversing nodes in the abstract syntax tree, calling a target code generation process corresponding to the nodes, and generating target code corresponding to the nodes based on the target code generation process; storing the target code in a code file to obtain a target code file; and performing network security processing on the single data stream based on the target code file. The method provided by the application can compile and generate code based on the association analysis expression of the single data stream to realize association analysis of the single data stream, thereby improving the efficiency of network security analysis and processing of the single data stream.

Description

Technical Field

[0001] This invention relates to the field of computer processing technology, specifically to a network security processing method and apparatus for a single data stream. It also relates to an electronic device, a non-transitory computer-readable storage medium, and a computer program product. Background Technology

[0002] The rapid development of internet technology and the deepening digital transformation of various industries have brought tremendous convenience to people's lives and work. However, with the development of technology and the spread of knowledge, the methods and number of network attacks have also increased significantly, with various new attack methods emerging one after another. How to conduct network security analysis and processing of single data streams has brought great challenges and pressure to people.

[0003] In existing technologies, network security processing of single data streams requires manual analysis of all data within the stream to identify potential network risks, resulting in low efficiency. Therefore, designing a more efficient method for secure single data stream processing to improve both efficiency and accuracy is a pressing issue. Summary of the Invention

[0004] This invention provides a network security processing method and apparatus for single data streams, in order to solve the problem of low efficiency in existing single data stream security analysis and processing schemes.

[0005] This invention provides a network security processing method for a single data stream, comprising:

[0006] Obtain the correlation analysis expression; the correlation analysis expression includes the flow table information and correlation expression of the single data stream to be analyzed; the single data stream is network behavior data obtained from network devices;

[0007] Based on the flow table information and the associated expression, an abstract syntax tree is constructed; the abstract syntax tree contains nodes for representing the associated expression and nodes for representing the flow table information;

[0008] Traverse the nodes in the abstract syntax tree, call the pre-set target code generation process corresponding to the node, and generate the target code corresponding to the node based on the target code generation process;

[0009] The target code is stored in a code file to obtain a target code file; wherein the code file is obtained based on the initial code file configured by the abstract syntax tree;

[0010] Network security processing is performed on the single data stream based on the target code file.

[0011] Furthermore, the flow table information includes the identifier of the data flow stored in each flow table, and the single data flow corresponding to the identifier includes network behavior data obtained from the same network device; the initial code file is provided with a table configuration field, and the table configuration field includes a first subfield;

[0012] The code file is obtained through the following steps:

[0013] Based on the abstract syntax tree, if it is determined that the associative expression does not contain the target index of the flow table, the identifier is stored in the first subfield to obtain the code file; wherein, each flow table is pre-configured with a target index;

[0014] Create an index for the stored identifier, and use the index for the stored identifier as the target index.

[0015] Furthermore, the invocation of the pre-set target code generation process corresponding to the node includes:

[0016] If it is determined that the node is not in the index expression table, the target code generation process corresponding to the node is invoked based on the operation type of the node; the index expression table is pre-configured and contains nodes that represent indexes.

[0017] Furthermore, the table configuration fields also include a second subfield and a third subfield;

[0018] The code file is obtained through the following steps:

[0019] Based on the abstract syntax tree, if it is determined that the associated expression contains a first target index of a first type of flow table and a second target index of a second type of flow table, the identifier is stored in the first subfield;

[0020] The code information of the first function is generated based on the first target index, and the code information of the second function is generated based on the second target index;

[0021] The first address corresponding to the code information of the first function is stored in the second sub-field, and the second address corresponding to the code information of the second function is stored in the third sub-field to obtain the code file;

[0022] Wherein, the first address is used to call a first function to calculate a first index value of a first type; the second address is used to call a second function to calculate a second index value of a second type.

[0023] Furthermore, the initial code file also includes associated calculated fields;

[0024] After traversing the nodes in the abstract syntax tree, the process also includes:

[0025] Based on the nodes representing the association expression in the abstract syntax tree, code information for a third function used to perform association calculations is generated; the association expression includes the association relationship between the parameters of each data stream.

[0026] The third address corresponding to the code information of the third function is stored in the associated calculation field to obtain a new initial code file; based on the new initial code file, the code file is obtained; wherein, the third address is used to call the third function of the associated calculation.

[0027] Furthermore, before storing the identifier in the first sub-field to obtain the code file, the method further includes:

[0028] The identifier of the data stream stored in each flow table is stored in the flow table collection;

[0029] The step of storing the identifier in the first sub-field to obtain the code file includes:

[0030] The identifiers are obtained from the flow table set and stored in the first subfield to obtain the code file.

[0031] Furthermore, network security processing is performed on the single data stream based on the target code file, specifically including:

[0032] Based on the target code file, the deletion process is invoked to retrieve the first data stream associated with the pre-input data stream to be deleted from the data table and perform deletion processing, wherein the data stream to be deleted includes a timed-out data stream; or,

[0033] Based on the target code file, the insertion processing flow is invoked to find the second data stream associated with the input data stream to be inserted from the data table, and the second data stream is inserted into the hit table; or,

[0034] Based on the target code file, the update process is invoked to find the third data stream associated with the pre-input data stream to be updated from the data table, and the third data stream is updated.

[0035] Furthermore, the step of constructing an abstract syntax tree based on the flow table information and the associated expression includes:

[0036] Lexical parsing is performed on the flow table information and the associated expression based on predefined lexical rules to generate a word sequence;

[0037] According to predefined grammar rules, the word sequence is subjected to grammar analysis to obtain the grammar analysis results, and the grammar analysis results are stored in the nodes of the syntax tree to construct an abstract syntax tree.

[0038] The present invention also provides a network security processing apparatus for a single data stream, comprising:

[0039] An expression acquisition unit is used to acquire an association analysis expression; the association analysis expression includes the flow table information and association expression of the single data stream to be analyzed; the single data stream is network behavior data acquired from network devices;

[0040] The abstract syntax tree obtaining unit is used to construct an abstract syntax tree based on the flow table information and the associated expression; the abstract syntax tree includes nodes for representing the associated expression and nodes for representing the flow table information;

[0041] The target code generation unit is used to traverse the nodes in the abstract syntax tree, call the pre-set target code generation process corresponding to the node, and generate the target code corresponding to the node based on the target code generation process;

[0042] The target code file obtaining unit is used to store the target code in the code file to obtain the target code file; wherein the code file is obtained based on the initial code file configured by the abstract syntax tree;

[0043] A network security processing unit is used to perform network security processing on the single data stream based on the target code file.

[0044] Furthermore, the flow table information includes the identifier of the data flow stored in each flow table, and the single data flow corresponding to the identifier includes network behavior data obtained from the same network device; the initial code file is provided with a table configuration field, and the table configuration field includes a first subfield;

[0045] The code file is obtained through the following steps:

[0046] Based on the abstract syntax tree, if it is determined that the associative expression does not contain the target index of the flow table, the identifier is stored in the first subfield to obtain the code file; wherein, each flow table is pre-configured with a target index;

[0047] Create an index for the stored identifier, and use the index for the stored identifier as the target index.

[0048] Furthermore, the target code generation unit is specifically used for:

[0049] If it is determined that the node is not in the index expression table, the target code generation process corresponding to the node is invoked based on the operation type of the node; the index expression table is pre-configured and contains nodes that represent indexes.

[0050] Furthermore, the table configuration fields also include a second subfield and a third subfield;

[0051] The code file is obtained through the following steps:

[0052] Based on the abstract syntax tree, if it is determined that the associated expression contains a first target index of a first type of flow table and a second target index of a second type of flow table, the identifier is stored in the first subfield;

[0053] The code information of the first function is generated based on the first target index, and the code information of the second function is generated based on the second target index;

[0054] The first address corresponding to the code information of the first function is stored in the second sub-field, and the second address corresponding to the code information of the second function is stored in the third sub-field to obtain the code file;

[0055] Wherein, the first address is used to call a first function to calculate a first index value of a first type; the second address is used to call a second function to calculate a second index value of a second type.

[0056] Furthermore, the initial code file also includes associated calculated fields;

[0057] After traversing the nodes in the abstract syntax tree, the process also includes:

[0058] The code information generation unit is used to generate code information for a third function to perform association calculation based on the nodes representing the association expression in the abstract syntax tree; the association expression includes the association relationship between the parameters of each data stream;

[0059] The third address corresponding to the code information of the third function is stored in the associated calculation field to obtain a new initial code file; based on the new initial code file, the code file is obtained; wherein, the third address is used to call the third function of the associated calculation.

[0060] Furthermore, before storing the identifier in the first sub-field to obtain the code file, the apparatus further includes:

[0061] The code file obtains units for:

[0062] The identifier of the data stream stored in each flow table is stored in the flow table collection;

[0063] The step of storing the identifier in the first sub-field to obtain the code file includes:

[0064] The identifiers are obtained from the flow table set and stored in the first subfield to obtain the code file.

[0065] Furthermore, the network security processing unit is specifically used for:

[0066] Based on the target code file, the deletion process is invoked to retrieve the first data stream associated with the pre-input data stream to be deleted from the data table and perform deletion processing, wherein the data stream to be deleted includes a timed-out data stream; or,

[0067] Based on the target code file, the insertion processing flow is invoked to find the second data stream associated with the input data stream to be inserted from the data table, and the second data stream is inserted into the hit table; or,

[0068] Based on the target code file, the update process is invoked to find the third data stream associated with the pre-input data stream to be updated from the data table, and the third data stream is updated.

[0069] Furthermore, the abstract syntax tree obtaining unit is specifically used for:

[0070] Lexical parsing is performed on the flow table information and the associated expression based on predefined lexical rules to generate a word sequence;

[0071] According to predefined grammar rules, the word sequence is subjected to grammar analysis to obtain the grammar analysis results, and the grammar analysis results are stored in the nodes of the syntax tree to construct an abstract syntax tree.

[0072] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network security processing method for a single data stream as described above.

[0073] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network security processing method for a single data stream as described above.

[0074] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the network security processing method for a single data stream as described above.

[0075] This invention provides a network security processing method for single data streams. It obtains an abstract syntax tree (AST) by acquiring an association analysis expression and, based on the flow table information and the association expression, generates an abstract syntax tree (AST). The method then configures the table configuration fields of an initial code file based on the AST to obtain a first code file. Next, it traverses the nodes in the AST, calls a pre-set target code generation process corresponding to each node, and generates the target code for that node. The target code is stored in the first code file to obtain a target code file. Finally, network security processing is performed on the data stream based on the target code file. This method enables compilation and code generation based on the association analysis expression of a single data stream, thereby improving the efficiency of network security analysis and processing of single data streams. Attached Figure Description

[0076] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0077] Figure 1 This is a flowchart illustrating the network security processing method for a single data stream provided by the present invention.

[0078] Figure 2 This is a flowchart of the compilation and code generation process for association analysis expressions provided by this invention;

[0079] Figure 3 This is a flowchart of the process for constructing an abstract syntax tree provided by the present invention;

[0080] Figure 4 This is a flowchart of the flow table definition and analysis provided by the present invention;

[0081] Figure 5 This is a flowchart of the expression index analysis and code generation provided by the present invention;

[0082] Figure 6 This is a flowchart of the expression definition analysis and code generation provided by the present invention;

[0083] Figure 7 This is the data flow diagram of the inserted data stream provided by the present invention;

[0084] Figure 8 This is a data flow diagram for deleting data streams provided by the present invention;

[0085] Figure 9 This is a data flow diagram of the update data stream provided by the present invention;

[0086] Figure 10 This is a flowchart of the notification data stream deletion process provided by the present invention;

[0087] Figure 11 This is a schematic diagram of the network security processing device for a single data stream provided by the present invention;

[0088] Figure 12 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0089] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0090] The following is a detailed description of embodiments of the network security processing method for a single data stream described in this invention. For example... Figure 1 The diagram shown is a flowchart illustrating a network security processing method for a single data stream provided in an embodiment of the present invention. The specific process includes the following steps:

[0091] Step 101: Obtain the correlation analysis expression; the correlation analysis expression includes the flow table information and correlation expression of the single data stream to be analyzed; the single data stream is network behavior data obtained from network devices. The flow table information includes the identifier of the data stream stored in each flow table, and the correlation expression is used to represent the correlation relationship between the parameters of each data stream.

[0092] In an embodiment of the present invention, before performing this step, a correlation analysis expression input by a user or a pre-stored correlation analysis expression may be obtained in advance. Specifically, the structure of said correlation analysis expression can be defined as: join[flow table definition]if[correlation expression definition]. That is, the structure of the correlation analysis expression includes two parts: the flow table definition and the correlation expression definition, so as to obtain corresponding flow table information and a correlation expression. Wherein, the flow table definition is [input stream name]as[flow table name], and examples are as follows: stream1 as left, stream1 as right, wherein stream1 corresponds to the name of the input data stream, left and right are the names of the corresponding flow tables, stream1 is defined as left, and meanwhile stream1 is defined as right. The correlation expression is a Boolean expression, and the result of the expression is true or false. An example is as follows: left.sip==right.sip and left.sport<right.sport, the semantics of this correlation expression is that when the source IP of the left table (i.e., the left flow table) is equal to the sip of the right table (i.e., the right flow table) and the source port of the left table is smaller than that of the right table, the expression is true, otherwise it is false. A specific example is as follows: join stream1 as left, stream1 as right if left.sip==right.sip and left.sport<right.sport. Said network device may refer to devices such as computers, smart phones, and tablet computers.

[0093] Step 102: constructing an abstract syntax tree based on said flow table information and said correlation expression; said abstract syntax tree comprises nodes for characterizing said correlation expression and nodes for characterizing said flow table information.

[0094] Specifically, parsing the flow table information and the correlation analysis expression and constructing the abstract syntax tree therefrom. By locating the root node of the flow table definition syntax tree, i.e., the root node of the flow table information syntax tree, analyzing the abstract syntax tree with a preset flow table analyzer to generate a flow table configuration. By locating the root node of the correlation expression definition syntax tree, analyzing the abstract syntax tree with a preset expression index analyzer: if there is an index in the correlation expression, generating function code for the index expression according to the index interface, and recording the function into the flow table configuration; if there is no index, no operation is performed.

[0095] In the specific implementation of this step, lexical analysis may be performed on said flow table information and said correlation expression based on predefined lexical rules to generate a word sequence; syntactic analysis is performed on the word sequence according to predefined grammatical rules to obtain a syntactic analysis result, and said syntactic analysis result is stored in nodes of the syntax tree to construct the abstract syntax tree. For example, as Figure 4 As shown, the process first obtains the input association analysis expression using the join[flow table definition]if[association expression definition]. Then, based on the lexical definition, the association analysis expression is lexically parsed to generate a word sequence. Based on the grammatical definition, the word sequence is parsed, and an abstract syntax tree is constructed. Based on the semantic and context definitions, the abstract syntax tree is subjected to semantic analysis, type checking, and function call validity verification. Finally, the constructed abstract syntax tree is output.

[0096] This invention can write corresponding association analysis expressions based on data streams, then transform the association analysis expressions into abstract syntax trees, and based on the parsing of the abstract syntax trees, call the code generation process to obtain the target code file. Thus, the data stream can be automatically analyzed based on the target code file, making network security analysis more efficient.

[0097] Step 103: Traverse the nodes in the abstract syntax tree, call the pre-set target code generation process corresponding to the node, and generate the target code corresponding to the node based on the target code generation process.

[0098] In this step, by traversing the nodes in the abstract syntax tree, if it is determined that the node is not in the index expression table, the target code generation process corresponding to the node is invoked based on the operation type of the node, and the target code corresponding to the node is generated based on the target code generation process. The index expression table contains nodes representing indexes. If it is determined that the node is in the index expression table, the index expression code generation process can also be invoked, and this process is used as the target code generation process. Specifically, the abstract syntax tree can be traversed starting from the root node of the associative expression definition syntax tree, analyzing all nodes and generating corresponding code. The flow table configuration (i.e., table configuration field) and the code generated by the associative expression definition are encapsulated into a code file, providing a calling interface. The table configuration field includes a first subfield. Specifically, if it is determined based on the abstract syntax tree that the associative expression does not contain the target index of the flow table, the identifier is stored in the first subfield, resulting in the first code file. In addition, the table configuration field also includes a second subfield and a third subfield. Accordingly, the specific implementation process of obtaining the first code file based on the table configuration field of the initial code file configured by the abstract syntax tree includes: when it is determined from the abstract syntax tree that the associated expression contains a first target index of the first type of stream table and a second target index of the second type of stream table, the identifier is stored in the first sub-field; code information of a first function is generated based on the first target index, and code information of a second function is generated based on the second target index; the first address corresponding to the code information of the first function is stored in the second sub-field, and the second address corresponding to the code information of the second function is stored in the third sub-field, thus obtaining the first code file; the first address is used to call the first function to calculate the first index value of the first type; the second address is used to call the second function to calculate the second index value of the second type. The table configuration field corresponds to the table configuration codeclass.tableconfig. It should be noted that the first sub-field is codeclass.tableconfig.inputStreamIDSet; the second sub-field is caculateLeftIndexValueFunction in codeclass.tableconfig; and the third sub-field is caculateRightIndexValueFunction in codeclass.tableconfig. The nodes include the syntax tree node containing the [flow table definition] and the syntax tree node containing the [associative expression definition].

[0099] The initial code file includes an association calculation field. In this embodiment, after traversing all nodes in the abstract syntax tree, code information for a third function used for association calculation is generated based on the nodes representing the association expression in the abstract syntax tree, and the third address corresponding to the code information of the third function is stored in the association calculation field. The third address is used to call the third function for association calculation. The third function can be a Join function. It should be noted that, in this embodiment, before storing the identifier in the first sub-field to obtain the first code file, the method further includes: storing the identifier of each data stream stored in the flow table in a flow name set; storing the identifier in the first sub-field to obtain the first code file includes: obtaining each identifier from the flow table set, storing the identifier in the first sub-field to obtain the first code file. The identifier of the data stream corresponds to the input flow name.

[0100] like Figure 5 As shown, it is a flowchart of the flow table definition analysis. It includes: (1) Obtaining the abstract syntax tree constructed from the input association analysis expression. (2) Locating the syntax tree node where [flow table definition] is located on the abstract syntax tree, and traversing all the corresponding child nodes from the node (i.e., the syntax tree node where [flow table definition] is located). (3) Whether the [flow table definition] syntax tree node has any untraversed child nodes. If so, proceed to step (4). If not, end the process. (4) Parse the [input stream name] as [flow table name] structure, add [input stream name] to the collection inputStreamNameSet, set tableName = [flow table name], and determine whether the left flow table name leftTableName is null. If so, proceed to step (5). If not, proceed to step (6). (5) Set the left flow table name leftTableName = tableName. After completion, proceed to step (3). (6) Determine whether the right flow table name rightTableName is null. If so, proceed to step (7). If not, proceed to step (8). (7) Set the right flow table name rightTableName = tableName, and then execute step (3). (8) If tableName is not equal to the left flow table name leftTableName and tableName is not equal to the right flow table name rightTableName, then report an error and exit the process; otherwise, do not perform any operation and execute step (3) after completion.

[0101] Figure 6As shown, it is a flowchart of expression index analysis and target code generation. It includes: (1) Obtaining the abstract syntax tree constructed from the input association analysis expression. (2) Locating the syntax tree node where the [association expression definition] is located on the abstract syntax tree. (3) Determining the node of the current abstract syntax tree and performing index analysis using the preset single data stream association analysis expression index analyzer. (4) Determining whether the association analysis expression has an index. If it does, proceed to step (5). If not, proceed to step (8). (5) Creating a code file codeClass with data type OneStreamJoinCodeClass, setting the analysis interface of codeClass to IndexedOneStreamJoinInterface, and then proceeding to step (6). (6) Setting the table configuration field codeClass.tableConfig to IndexedTableConfig, traversing the input stream name set inputStreamNameSet, and saving the input data stream numbers mapped to all input stream names in the set to the input data stream number set codeClass.tableConfig.inputStreamIDSet, and then proceeding to step (7). (7) Record the expression tree node corresponding to the index into the index expression table indexExpressionMap. Generate the code of the interface functions caculateLeftIndexValue and caculateRightIndexValue based on the index expression, and record the address of the interface function into caculateLeftIndexValueFunction and caculateRightIndexValueFunction in the table configuration field codeClass.tableConfig. After completion, end the process. (8) Create a code file codeClass with data type OneStreamJoinCodeClass. Set the analysis interface of codeClass to OneStreamJoinInterface. After completion, execute step (9). (9) Set the table configuration field codeClass.tableConfig to TableConfig. Traverse the input stream name set inputStreamNameSet. Save the input data stream number mapped to all input stream names in the set into the input data stream number set codeClass.tableConfig.inputStreamIDSet. After completion, end the process and output the target code corresponding to the obtained node.

[0102] like Figure 7The flowchart for expression definition analysis and target code generation is shown below. It includes: (1) Obtaining the abstract syntax tree constructed from the input association analysis expression. (2) Locating the syntax tree node where the [association expression definition] is located on the abstract syntax tree, and traversing all child nodes starting from the node (i.e., the syntax tree node where the [association expression definition] is located). (3) Determining whether there are any child nodes that have not been traversed. If there are, proceed to step (4); otherwise, proceed to step (7). (4) Determining whether the current syntax tree node is in the index expression table indexExpressionMap. If it is, proceed to step (5); otherwise, proceed to step (6). (5) Calling the index expression code generation process to generate code. After completion, proceed to step (3). (6) Calling the corresponding code generation process to generate code according to the node type, that is, calling the target code generation process corresponding to the node based on the operation type of the node. After completion, proceed to step (3). (7) Generating the interface function join according to the code generated by the root node of the [association expression definition], and recording the address of the interface function in the table configuration field codeClass.joinFunction. After completion, the process ends.

[0103] It should be noted that the expression definition analysis and target code generation process is as follows: (1) Index expression code generation, which involves processing the index expression and generating code; (2) Logical expression code generation, which involves generating corresponding code for the logical expression; (3) Comparison expression code generation, which involves generating corresponding code for the comparison expression; (4) Table field expression code generation, which involves generating corresponding code for the table field expression; (5) Constant value code generation, which involves generating corresponding code for the constant value; and (6) Function call code generation, which involves generating corresponding code for the function call. During the index expression code generation process, the generated code is set to "true", the data type is set to Boolean, and the code is set to a constant. During the logical expression code generation process, for AND / OR logical expressions, the code generation process is first invoked to generate the code for the left and right child nodes. For AND logical expressions, the generated code is: left child node code && right child node code; for OR logical expressions, the generated code is: left child node code || right child node code. The code data type is set to Boolean. If both the left and right child nodes are constant values, the code is set to a constant. For NOT logical expressions, the code generation process is invoked to generate the code for the right child node, generating the code: ! right child node code. The code data type is set to Boolean. If both the left and right child nodes are constant, the code is set to a constant. During the comparison expression code generation process, the code generation process generates the code for the left and right child nodes. Then, based on the comparison operator type, the corresponding code is generated: left child node code [comparison operator] right child node code. The code data type is set to Boolean. If both the left and right child nodes are constant values, the code is set to a constant. During the table field expression code generation process, the expression field is parsed into [table name].[field name]. First, it checks if the table name is equal to `leftTableName`. If they are, code is generated: `left row data field value retrieval function (field name)`, and the code data type is set to object value. If they are not equal, it checks if the table name is equal to `rightTableName`. If they are, code is generated: `right row data field value retrieval function (field name)`. If they are not equal, an error is reported and the process exits. During the constant value code generation process, constant variables are generated in the code file `codeClass`, and constant values ​​are assigned to these variables. Code is generated: `constant variable name`, and the code data type is set to the corresponding constant data type. The code is also set to constant. During the function call code generation process, the function parameters are iterated, and code is generated for each parameter using the code generation process. Code is generated: `function name (parameter 1 code, parameter 2 code, ..., parameter n code)`, and the code data type is set to the data type corresponding to the function definition.

[0104] It should be noted that the table field expression consists of the table name (left table / right table) followed by a period (.) and then the field name. For example, the source IP field of the table (i.e., the flow table): table.sip, indicates that the value of the corresponding field is obtained from the input data. The constant values ​​include constant strings, constant numbers, and other constant data. The function call may or may not have function parameters. For example: abs(table.value), indicates that the absolute value function abs is used to calculate the absolute value of the value field of the flow table table.

[0105] The code interfaces and data definitions related to expression compilation and target code generation include code interface definitions, stream table configuration definitions, and stream table configuration definitions. The code interface definitions include a real-time single data stream association analysis interface definition (OneStreamJoinInterface) and an indexed real-time single data stream association analysis interface definition. The join(leftRowData, rightRowData) code interface in OneStreamJoinInterface is used to associate and calculate the left and right rows of input data. If the association condition is met, it returns a boolean value of true; otherwise, it returns a boolean value of false.

[0106] The `caculateLeftIndexValue(leftRowData)` method in the `IndexedOneStreamJoinInterface` calculates the left index value, taking `leftRowData` as the input parameter of the left row and returning the calculated left index value. The `caculateRightIndexValue(rightRowData)` method calculates the right index value, taking `rightRowData` as the input parameter of the right row and returning the calculated right index value. The `join(leftRowData, rightRowData)` method joins the input left and right rows; it returns `true` if the join condition is met, and `false` otherwise.

[0107] The stream table configuration definition includes a regular table (TableConfig) and an index table (IndexedTableConfig). The regular table parameter `inputStreamIDSet` is a set of input data stream IDs, recording all IDs of the input data streams for filtering all input data stream data. The index table parameter `inputStreamIDSet` is also a set of input data stream IDs, recording all IDs of the input data streams for filtering all input data stream data; the parameter `caculateLeftIndexValueFunction` is a function for calculating the left index value, recording the function for calculating the left index value.

[0108] The `caculateRightIndexValueFunction` is a function that calculates the right index value; it records the function used to calculate the right index value. In the code file definition (`OneStreamJoinCodeClass`), the parameter `tableConfig` is used for table configuration. If it's a join expression without an index, the parameter data type is `TableConfig`; if it's a join expression with an index, the parameter data type is `IndexedTableConfig`. The parameter `joinFunction` is the join calculation function; it records the function used for join calculations.

[0109] Step 104: Store the target code in a code file to obtain the target code file. Specifically, the code file can be obtained based on the initial code file configured by the abstract syntax tree.

[0110] In this embodiment of the invention, expression compilation and code generation includes four processes, the specific processes of which are shown in the table below: (1) Constructing an abstract syntax tree, the process of which involves constructing an abstract syntax tree from the input association analysis expression, and performing lexical analysis, syntax analysis, and semantic analysis during the construction; (2) Flow table definition analysis, the process of which involves using a flow table analyzer to analyze the syntax tree and generate flow table configurations; (3) Expression index analysis and target code generation, the process of which involves using an expression index analyzer to analyze the syntax tree and generate target code. The code; (4) Expression definition analysis and code generation, the process of which is to traverse the syntax tree, analyze all nodes and generate the corresponding code (i.e., target code). The core parameters for expression compilation and code generation are defined as follows: parameter inputStreamNameSet, which is defined as a set of input stream names, recording all input stream names; parameter leftTableName, which is defined as recording the left stream table name; parameter rightTableName, which is defined as recording the right stream table name; parameter indexExpressionMap, which is defined as an index expression table, recording the expression syntax tree nodes used for indexing; parameter codeClass, which records the final generated code (i.e., target code file), and the data type is OneStreamJoinCodeClass.

[0111] In the parameter definition of real-time single data stream association analysis, the parameter streamFilter is defined as a stream filter, which filters the data of the input stream and filters out the data that does not meet the filtering conditions; the parameter table is defined as a data table, which is used to store the input data that meets the conditions, and one data corresponds to one row in the table; the parameter matchedTable is defined as a match table, which stores the data that has been successfully associated, and one row in the table corresponds to one pair of successfully associated data; joinFilter is defined as an association filter, which calculates the data pair that needs to be associated. If the value is true, it means that the association is successful, and if it is false, it means that the association has failed. The real-time single data stream association analysis method includes four processes, and the process is shown in the table below: (1) Insert data stream data insertStreamData(data), the process content is to insert the corresponding data stream data. <data>(2) Delete the data stream data using deleteStreamData(data), which deletes the corresponding data stream data. <data>(3) Update the data stream data updateStreamData(oldData, newData), the process of which is to update the corresponding data stream data, including two steps: 1. Delete the data stream data <olddata>2. Insert data stream data <newdata>(4) Notify the data stream of data timeout onStreamDataExpire(data), the process of which is to receive data stream data. <data>Upon receiving a timeout notification, the corresponding data stream data will be deleted. <data>.

[0112] Step 105: Perform network security processing on the single data stream based on the target code file.

[0113] Specifically, based on the target code file, a deletion process can be invoked to find a first data stream associated with a pre-input data stream to be deleted from the data table and perform deletion processing, wherein the data stream to be deleted includes a timeout data stream; or, based on the target code file, an insertion process can be invoked to find a second data stream associated with an input data stream to be inserted from the data table and insert the second data stream into the hit table; or, based on the target code file, an update process can be invoked to find a third data stream associated with a pre-input data stream to be updated from the data table and perform update processing on the third data stream.

[0114] Specifically, such as Figure 7 As shown, it is a flowchart of the data stream insertion process. It includes: (1) calling insertStreamData(data) to input the data stream. <data>(2) Flow filter <streamfilter>For the input data <data>Perform filtering calculations. If the result is true, proceed to step (3); otherwise, discard the data. (3) Traverse the data table. <row>and input data <data>Perform the association calculation. If there is still data in the table, proceed to step (4); otherwise, proceed to step (6). (4) For <row>and <data>Perform left correlation calculation, i.e. <data>As an lvalue <row>As an rvalue, the parameter<data,row> Input correlation filter <joinfilter>Perform an association calculation; if the result is true, then...<data,row> Insert into the hit table <matchedtable>And execute step (3), if the result is false, then execute step (5). (5) For <row>and <data>Perform right correlation calculation, i.e. <row>As an lvalue <data>As an rvalue, the parameter<row,data> Input correlation filter <joinfilter>Perform an association calculation; if the result is true, then...<row,data> Insert into the hit table <matchedtable>, and execute step (3), if the result is false, then execute step (3). (6) After the traversal is complete, <data> Insert into< / data> < / matchedtable> < / joinfilter> < / data> < / row> < / data> < / row> < / matchedtable> < / joinfilter> < / row> < / data> < / data> < / row> < / data> < / row> For each row of data in the table <data>Register and delete listeners

[0115] like Figure 8 As shown, this is a flowchart of the data stream deletion process. It includes: (1) calling deleteStreamData(data) and inputting the data stream to be deleted. <data>(2) Cancel the process <data>Registered listener deletion. (3) From <matchedtable> Check if there are any related hit rows; if so, delete the corresponding hit data. (4) From< / matchedtable> < / data> < / data> < / data> At the end, and towards Delete the corresponding data. (5) If

[0116] Figure 9 <olddata>(3) Call the insertStreamData(NewData) function to insert data. <newdata>.

[0117] like Figure 10 As shown, it is a flowchart of the notification data stream data deletion process. It includes: (1) calling onStreamExpire(data) and inputting the timed-out data stream data. <data>(2) From <matchedtable> Query whether there are any related hit rows; if so, delete the corresponding hit data. (3) From< / matchedtable> < / data> < / newdata> < / olddata> If empty, the current calculation unit is deleted. As shown, it is the data flow diagram for updating the data stream. It includes: (1) calling updateStreamData(oldData, newData) and inputting the data stream data to be updated.<oldData,newData> (2) Call deleteStreamData(oldData) to delete the data stream. Delete the corresponding data. (4) If

[0118]

[0119] Figure 11

[0120]

[0121]

[0122]

[0123]

[0124]

[0125]

[0126]

[0127]

[0128]

[0129]

[0130]

[0131]

[0132]

[0133]

[0134]

[0135]

[0136]

[0137]

[0138]

[0139]

[0140]

[0141]

[0142]

[0143]

[0144]

[0145]

[0146]

[0147]

[0148]

[0149]

[0150]

[0151]

[0152]

[0153]

[0154]

[0155] Figure 12

[0156]

[0157]

[0158]

[0159]

[0160]

[0161]

[0162] If empty, the current computing unit is deleted. The network security processing method for a single data stream described in this embodiment of the invention obtains an association analysis expression and, based on the flow table information and association expression in the association analysis expression, obtains an abstract syntax tree; configures the table configuration fields of the initial code file based on the abstract syntax tree to obtain a first code file; traverses the nodes in the abstract syntax tree, calls the pre-set target code generation process corresponding to the node, and generates the target code corresponding to the node based on the target code generation process; stores the target code in the first code file to obtain a target code file; and performs network security processing on the data stream based on the target code file. This method can compile and generate code based on the association analysis expression of a single data stream to achieve association analysis of a single data stream, thereby improving the efficiency of network security analysis and processing of a single data stream. Corresponding to the network security processing method for a single data stream provided above, this invention also provides a network security processing device for a single data stream. Since the embodiments of this device are similar to the above method embodiments, the description is relatively simple. For relevant details, please refer to the description in the above method embodiment section. The embodiments of the network security processing device for a single data stream described below are only illustrative. Please refer to the diagram shown, which is a structural schematic of a network security processing device for a single data stream provided in an embodiment of the present invention. The network security processing device for a single data stream according to the present invention specifically includes the following parts: an expression acquisition unit 1101, used to acquire an association analysis expression; the association analysis expression includes flow table information of the single data stream to be analyzed and an association expression; the single data stream is network behavior data acquired from a network device; an abstract syntax tree acquisition unit 1102, used to construct an abstract syntax tree based on the flow table information and the association expression; the abstract syntax tree includes nodes for representing the association expression and nodes for representing the flow table information; a target code generation unit 1103, used to traverse the nodes in the abstract syntax tree, call a pre-set target code generation process corresponding to the node, and generate target code corresponding to the node based on the target code generation process; a target code file acquisition unit 1104, used to store the target code in the code file to obtain a target code file; wherein the code file is obtained based on an initial code file configured by the abstract syntax tree; and a network security processing unit 1105, used to perform network security processing on the single data stream based on the target code file.Furthermore, the flow table information includes the identifier of the data flow stored in each flow table, and the single data flow corresponding to the identifier includes network behavior data obtained from the same network device; the initial code file is provided with a table configuration field, which includes a first subfield; the code file is obtained through the following steps, including: based on the abstract syntax tree, when it is determined that the association expression does not contain the target index of the flow table, storing the identifier in the first subfield to obtain the code file; wherein, each flow table is pre-configured with a target index; creating an index of the stored identifier, and using the index of the stored identifier as the target index. Furthermore, the target code generation unit is specifically used for: when it is determined that the node is not in the index expression table, calling the target code generation process corresponding to the node based on the operation type of the node; the index expression table is pre-configured and contains nodes representing the index. Furthermore, the table configuration field also includes a second subfield and a third subfield; the code file is obtained through the following steps: based on the abstract syntax tree, if it is determined that the associated expression contains a first target index of a first type of flow table and a second target index of a second type of flow table, the identifier is stored in the first subfield; code information of a first function is generated based on the first target index, and code information of a second function is generated based on the second target index; the first address corresponding to the code information of the first function is stored in the second subfield, and the second address corresponding to the code information of the second function is stored in the third subfield to obtain the code file; wherein, the first address is used to call the first function to calculate the first index value of the first type; the second address is used to call the second function to calculate the second index value of the second type. Furthermore, the initial code file also includes an association calculation field; after traversing the nodes in the abstract syntax tree, it further includes: a code information generation unit, used to generate code information for a third function used for association calculation based on the nodes in the abstract syntax tree that represent the association expression; the association expression includes the association relationship between the parameters of each data stream; the third address corresponding to the code information of the third function is stored in the association calculation field to obtain a new initial code file; based on the new initial code file, the code file is obtained; wherein, the third address is used to call the third function of association calculation. Further, before storing the identifier in the first sub-field to obtain the code file, the device further includes: a code file obtaining unit, used to: store the identifier of each data stream stored in the flow table in the flow table set; storing the identifier in the first sub-field to obtain the code file includes: obtaining each identifier from the flow table set, storing the identifier in the first sub-field to obtain the code file.Furthermore, the network security processing unit is specifically configured to: based on the target code file, invoke a deletion processing flow to find a first data stream associated with a pre-input data stream to be deleted from the data table and perform deletion processing, wherein the data stream to be deleted includes a timeout data stream; or, based on the target code file, invoke an insertion processing flow to find a second data stream associated with an input data stream to be inserted from the data table and insert the second data stream into the hit table; or, based on the target code file, invoke an update processing flow to find a third data stream associated with a pre-input data stream to be updated from the data table and perform update processing on the third data stream. Furthermore, the abstract syntax tree obtaining unit is specifically configured to: perform lexical parsing on the flow table information and the associated expression based on predefined lexical rules to generate a word sequence; perform syntactic analysis on the word sequence according to predefined syntactic rules to obtain syntactic analysis results, and store the syntactic analysis results in the nodes of the syntax tree to construct an abstract syntax tree. The network security processing apparatus for a single data stream described in this embodiment of the invention obtains an association analysis expression and, based on the flow table information and association expression in the association analysis expression, obtains an abstract syntax tree; configures the table configuration fields of the initial code file based on the abstract syntax tree to obtain a first code file; traverses the nodes in the abstract syntax tree, calls the pre-set target code generation process corresponding to the node, and generates the target code corresponding to the node based on the target code generation process; stores the target code in the first code file to obtain a target code file; and performs network security processing on the data stream based on the target code file. This method can compile and generate code based on the association analysis expression of a single data stream to achieve association analysis of a single data stream, thereby improving the efficiency of network security analysis and processing of a single data stream. Corresponding to the network security processing method for a single data stream provided above, this invention also provides an electronic device. Since the embodiment of this electronic device is similar to the above method embodiment, it is described simply. For relevant details, please refer to the description in the above method embodiment section. The electronic device described below is only illustrative. As shown, it is a schematic diagram of the physical structure of an electronic device disclosed in this embodiment of the invention. The electronic device may include a processor 1201, a memory 1202 and a communication bus 1203, wherein the processor 1201 and the memory 1202 communicate with each other through the communication bus 1203 and communicate with the outside through the communication interface 1204.The processor 1201 can invoke logical instructions in the memory 1202 to execute a network security processing method for a single data stream. This method includes: acquiring an association analysis expression; the association analysis expression includes flow table information and an association expression for the single data stream to be analyzed; the single data stream is network behavior data acquired from a network device; constructing an abstract syntax tree based on the flow table information and the association expression; the abstract syntax tree contains nodes representing the association expression and nodes representing the flow table information; traversing the nodes in the abstract syntax tree, invoking a pre-set target code generation process corresponding to the node, and generating target code corresponding to the node based on the target code generation process; storing the target code in a code file to obtain a target code file; wherein the code file is obtained based on an initial code file configured by the abstract syntax tree; and performing network security processing on the single data stream based on the target code file. Furthermore, the logical instructions in the memory 1202 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as memory chips, USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks. On the other hand, the embodiments of the present invention also provide a computer program product, which includes a computer program stored on a processor-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute the network security processing method for a single data stream provided in the above-described method embodiments.The method includes: obtaining an association analysis expression; the association analysis expression includes flow table information and an association expression of a single data stream to be analyzed; the single data stream is network behavior data obtained from a network device; constructing an abstract syntax tree based on the flow table information and the association expression; the abstract syntax tree contains nodes for representing the association expression and nodes for representing the flow table information; traversing the nodes in the abstract syntax tree, calling a pre-set target code generation process corresponding to the node, and generating target code corresponding to the node based on the target code generation process; storing the target code in a code file to obtain a target code file; wherein the code file is obtained based on an initial code file configured by the abstract syntax tree; and performing network security processing on the single data stream based on the target code file. In another aspect, embodiments of the present invention also provide a processor-readable storage medium storing a computer program, which, when executed by a processor, implements the network security processing method for a single data stream provided in the above embodiments. The method includes: obtaining an association analysis expression; the association analysis expression includes flow table information and an association expression of a single data stream to be analyzed; the single data stream is network behavior data obtained from a network device; constructing an abstract syntax tree based on the flow table information and the association expression; the abstract syntax tree contains nodes for representing the association expression and nodes for representing the flow table information; traversing the nodes in the abstract syntax tree, calling a pre-set target code generation process corresponding to the node, and generating target code corresponding to the node based on the target code generation process; storing the target code in a code file to obtain a target code file; wherein the code file is obtained based on an initial code file configured by the abstract syntax tree; and performing network security processing on the single data stream based on the target code file. The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic storage (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (e.g., CD, DVD, BD, HVD, etc.), and semiconductor storage (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD), etc.). The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. < / data> < / streamfilter> < / data> < / data> < / data> < / newdata> < / olddata> < / data> < / data>

Claims

1. A network security processing method for a single data stream, characterized in that, include: Obtain the correlation analysis expression; the correlation analysis expression includes the flow table information and correlation expression of the single data stream to be analyzed; the single data stream is network behavior data obtained from network devices; the flow table information includes the identifier of the data stream stored in each flow table, and the single data stream corresponding to the identifier includes network behavior data obtained from the same network device; the correlation expression includes the correlation relationship between the parameters of each data stream; Based on the flow table information and the associated expression, an abstract syntax tree is constructed; The abstract syntax tree contains nodes for representing the associated expressions and nodes for representing the flow table information; Traverse the nodes in the abstract syntax tree, call the pre-set target code generation process corresponding to the node, and generate the target code corresponding to the node based on the target code generation process; The target code is stored in a code file to obtain a target code file; wherein the code file is obtained based on the initial code file configured by the abstract syntax tree; Network security processing is performed on the single data stream based on the target code file.

2. The network security processing method for a single data stream according to claim 1, characterized in that, The initial code file contains table configuration fields, which include a first subfield. The code file is obtained through the following steps: Based on the abstract syntax tree, if it is determined that the associative expression does not contain the target index of the flow table, the identifier is stored in the first subfield to obtain the code file; wherein, each flow table is pre-configured with a target index; Create an index for the stored identifier, and use the index for the stored identifier as the target index.

3. The network security processing method for a single data stream according to claim 1, characterized in that, The process of generating the target code corresponding to the node includes: If it is determined that the node is not in the index expression table, the target code generation process corresponding to the node is invoked based on the operation type of the node; the index expression table is pre-configured and contains nodes that represent indexes.

4. The network security processing method for a single data stream according to claim 2, characterized in that, The table configuration fields also include a second subfield and a third subfield; The code file is obtained through the following steps: Based on the abstract syntax tree, if it is determined that the associated expression contains a first target index of a first type of flow table and a second target index of a second type of flow table, the identifier is stored in the first subfield; The code information of the first function is generated based on the first target index, and the code information of the second function is generated based on the second target index; The first address corresponding to the code information of the first function is stored in the second sub-field, and the second address corresponding to the code information of the second function is stored in the third sub-field to obtain the code file; Wherein, the first address is used to call a first function to calculate a first index value of a first type; the second address is used to call a second function to calculate a second index value of a second type.

5. The network security processing method for a single data stream according to claim 1, characterized in that, The initial code file also includes associated calculated fields; After traversing the nodes in the abstract syntax tree, the process also includes: Based on the nodes in the abstract syntax tree that represent the associative expression, code information for a third function used to perform associative calculations is generated. The third address corresponding to the code information of the third function is stored in the associated calculation field to obtain a new initial code file; based on the new initial code file, the code file is obtained; wherein, the third address is used to call the third function of the associated calculation.

6. The network security processing method for a single data stream according to claim 2, characterized in that, Before storing the identifier in the first subfield to obtain the code file, the method further includes: The identifier of the data stream stored in each flow table is stored in the flow table collection; The step of storing the identifier in the first sub-field to obtain the code file includes: The identifiers are obtained from the flow table set and stored in the first subfield to obtain the code file.

7. The network security processing method for a single data stream according to claim 1, characterized in that, Based on the target code file, network security processing is performed on the single data stream, specifically including: Based on the target code file, the deletion process is invoked to retrieve the first data stream associated with the pre-input data stream to be deleted from the data table and perform deletion processing, wherein the data stream to be deleted includes a timed-out data stream; or, Based on the target code file, the insertion processing flow is invoked to find the second data stream associated with the input data stream to be inserted from the data table, and the second data stream is inserted into the hit table; or, Based on the target code file, the update process is invoked to find the third data stream associated with the pre-input data stream to be updated from the data table, and the third data stream is updated.

8. The network security processing method for a single data stream according to claim 1, characterized in that, The step of constructing an abstract syntax tree based on the flow table information and the associated expression includes: Lexical parsing is performed on the flow table information and the associated expression based on predefined lexical rules to generate a word sequence; According to predefined grammar rules, the word sequence is subjected to grammar analysis to obtain the grammar analysis results, and the grammar analysis results are stored in the nodes of the syntax tree to construct an abstract syntax tree.

9. A network security processing device for a single data stream, characterized in that, include: An expression acquisition unit is used to acquire correlation analysis expressions; the correlation analysis expressions include flow table information and correlation expressions of a single data stream to be analyzed; the single data stream is network behavior data acquired from a network device; the flow table information includes the identifier of the data stream stored in each flow table, and the single data stream corresponding to the identifier includes network behavior data acquired from the same network device; the correlation expressions include the correlation relationships between the parameters of each data stream. The abstract syntax tree acquisition unit is used to construct an abstract syntax tree based on the flow table information and the associated expression; The abstract syntax tree contains nodes for representing the associated expressions and nodes for representing the flow table information; The target code generation unit is used to traverse the nodes in the abstract syntax tree, call the pre-set target code generation process corresponding to the node, and generate the target code corresponding to the node based on the target code generation process; The target code file obtaining unit is used to store the target code in the code file to obtain the target code file; wherein the code file is obtained based on the initial code file configured by the abstract syntax tree; A network security processing unit is used to perform network security processing on the single data stream based on the target code file.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the network security processing method for a single data stream as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the network security processing method for a single data stream as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the network security processing method for a single data stream as described in any one of claims 1 to 8.

Images