Network protocol dynamic loading method based on flow analysis

Abstract

The invention relates to the field of industrial internet, and discloses a more efficient network protocol dynamic loading method so as to improve the expandability, timeliness and stability of a network analysis function of a flow analysis system. The method comprises the following steps: developing a new protocol analysis function, and packaging the new protocol analysis function into a Linux dynamic loading library conforming to an interface specification; obtaining plug-in information by scanning a plug-in directory, and determining a protocol analysis plug-in needing to be loaded or updated; loading a protocol analysis plug-in by using a Linux dynamic loading technology, and mounting the protocol analysis plug-in into a protocol analysis engine; migrating the traffic to the updated protocol analysis engine, and cleaning the cache and related intermediate files of the old plug-in; and returning loading information through the command line framework, and recording a dynamic loading log. According to the invention, the development efficiency of the protocol analysis function is improved, the protocol support speed of the flow analysis system is improved, and more updated protocol analysis results are better provided for clients.

Description

Technical Field

[0001] The present invention relates to industrial Internet, and in particular to a network protocol dynamic loading method based on traffic analysis. Background Art

[0002] In the current traffic analysis system, development is based on existing user needs and existing Internet protocols. After development, although licenses can be used to control the number of functions of protocol analysis types, it is necessary to expand the support for updated protocols by updating the software system version, and at the same time, it is necessary to stop the service to complete the support of updated network protocol analysis functions. For developers, it takes a greater cost to maintain the existing system. For operating customers, there is a risk of service interruption, and there are defects in the experience of outdated protocol analysis services and incomplete functions. Therefore, there is an urgent need for a network protocol dynamic loading method or solution that is friendly to developers and customers, can timely expand the protocol analysis content, does not interrupt services, and is more efficient to support these functions. Summary of the invention

[0003] Purpose of the invention: The technical problem to be solved by the present invention is to provide a more efficient network protocol dynamic loading solution to address the shortcomings of the existing traffic analysis protocol analysis loading technology, which cannot provide efficient addition or reduction of protocol analysis functions. It can improve the scalability, timeliness and stability of the network analysis function of the traffic analysis system.

[0004] Technical solution: First of all, the present invention relies on the dynamic loading technology of Linux dynamic link library. Our dynamic library is a disk-level file by default. When our program starts running, when the program runs to the point where the implementation method in the library is needed, the code and data of the library will be loaded into the physical memory. The implementation method of the library must be associated with the process formed by the running of the program. After the dynamic library is loaded, it will be mapped to the address space of the process. To be precise, the mapping relationship between the corresponding virtual address and the physical address is first filled in the page table before it is mapped to the shared area in the process address space.

[0005] like Figure 1 This is the basic principle diagram of Linux dynamic library loading technology. First, use dlopen to open the dynamic library file, then read the function pointer, and then load it into the program. The program records the pointer content, and finally dlclose the dynamic library file.

[0006] like Figure 3As shown, the bypass traffic analysis system includes the source code of nta infra, INFRA protection core library, which is a collection of a series of basic C service libraries and provides high-performance data structures. nta vlibVLIB is a vector processing library that provides processing functions for Vector and various management functions for Application, including Buffers management, Graph Node management, multi-threading support, packet tracking, counters and other functions, and also implements debug CLI functions. These functions provide basic capabilities for the present invention. nta vnet provides a series of network analysis tool sets, which are not related to the description of the present invention and will not be described further. Finally, nta plugins is the target of our present invention, the protocol analysis plug-in, and the method described in the present invention serves this part.

[0007] A method for dynamically loading a network protocol based on traffic analysis comprises the following steps: 1. Develop new protocol analysis functions and encapsulate them into Linux dynamic loading libraries that comply with interface specifications; 2. Obtain plug-in information by scanning the plug-in directory and determine the protocol analysis plug-in that needs to be loaded or updated; 3. Use Linux dynamic loading technology to load the protocol analysis plug-in and mount it into the protocol analysis engine; 4. Migrate traffic to the updated protocol analysis engine and clean up the cache and related intermediate files of the old plug-in; 5. Return loading information through the command line framework and record dynamic loading logs.

[0008] Furthermore, developing a new protocol analysis function in step 1 includes: developing a corresponding function according to the RFC or specification of the new protocol, compiling it into a dynamic load library plug-in form, and storing it in a plug-in directory defined by the traffic analysis system.

[0009] Furthermore, scanning the plug-in directory in step 2 includes: counting the number and version information of plug-ins, and recording identifiers of plug-ins that need to be loaded.

[0010] Furthermore, in step 3, the plug-in is loaded using the dlopen function of the Linux dynamic library, and is mounted to the protocol analysis engine by reading the function symbol.

[0011] Furthermore, the protocol analysis engine in step 3 supports multi-task loading, merging and cutting functions to minimize business load interference.

[0012] Furthermore, when migrating traffic to the updated protocol analysis engine in step 4), the old engine and its resources are dynamically released to optimize system performance.

[0013] Furthermore, in step 4), cleaning up intermediate files includes deleting temporary files generated during the loading process and unused protocol caches.

[0014] Furthermore, the command line framework in step 5) supports dynamic task sequencing, and analyzes traffic load and business requirements through AI algorithms to optimize protocol loading time.

[0015] Furthermore, users can set the maximum time for AI decision-making and the latest effective time for protocol loading to meet different business needs.

[0016] Furthermore, the dynamic loading log records include information such as protocol loading time, plug-in identification, loading results, and system performance changes.

[0017] The present invention improves the development efficiency of the protocol analysis function, improves the protocol support speed of the traffic analysis system, better provides customers with more updated protocol analysis results, enables customers to obtain updated information from the protocol analysis results, provides more decision-making basis for actual production and life, can be fed back to, for example, a control module, implements intervention in the behavior involved in the protocol, improves the upper-layer application protocol parsing speed and quality, enables more protocols to be fully parsed and displayed, removes old protocol analysis, and improves the overall protocol analysis efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a basic principle diagram of dynamic loading of Linux dynamic link library on which the protocol analysis dynamic loading described in the present invention depends.

[0019] Figure 2 It is a complete flow chart of the dynamic loading method for protocol analysis of the traffic analysis system described in the present invention.

[0020] Figure 3 It is the location of the protocol analysis dynamic loading (green) described in the present invention in the traffic analysis system.

[0021] Figure 4 This is the relationship between the Linux dynamic loading and the protocol analysis dynamic loading as well as the traffic analysis system described in the present invention. DETAILED DESCRIPTION

[0022] The present invention is based on Figure 2 , the technical solution implementation process is as follows: 1. When a new protocol appears, we develop the protocol analysis function according to the new protocol RFC or specification. After the development is completed, we encapsulate it according to the interface specification defined by the traffic analysis system and compile it into a Linux dynamic loading library. This is the plug-in entity of our traffic analysis system. In addition, if the protocol specification is updated, we only need to modify the previous protocol analysis implementation and recompile it into a new plug-in.

[0023] 2. According to the newly added protocol analysis function in step 1, the types of protocol analysis are expanded or updated. At the same time, decisions on deleting certain protocol analysis are made based on the business conditions of Internet use, and the function of deleting certain protocol analysis is implemented.

[0024] 3. The traffic analysis system supports the command line framework mode to monitor the tasks of dynamically loading protocols, and supports the functions of intelligent task sorting, multi-task loading merging and cutting, which can minimize the interference and impact on the business load, and support autonomous decision-making on update time. The main basis is the traffic load, working hours and rest time, as well as the key business load situation. The time for automatic update of protocol loading is determined through AI learning. At the same time, the maximum AI decision time and the latest effective time can be set manually.

[0025] 4. The underlying framework of the traffic analysis system designs the physical location of the protocol analysis plug-in, that is, the folder directory, scans the entire plug-in directory, counts the plug-in information, and prepares for the next step of loading.

[0026] 5. After step 4, according to the statistical plug-in information, use Linux dynamic library loading technology to complete the loading of each dynamic library, and store all the function symbols in the dynamic library. This function symbol corresponds to the basic framework of protocol analysis, and each function corresponds to the specific content of protocol analysis. Mount the symbol of each protocol on the new protocol analysis engine, and finally delete the old analysis engine, migrate the traffic to the new protocol analysis engine, and mount the updated protocol analysis plug-in on the new engine.

[0027] 6. At this step, the entire protocol analysis function is updated. Check the results of the protocol analysis function and start cleaning up the cache of the old protocol analysis plug-in, as well as the intermediate files generated during the entire process.

[0028] 7. The return information of the dynamic loading command line task is used to feedback whether the protocol analysis update is successful, as well as the record of the entire loading process, and add log records for dynamic protocol loading.

[0029] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of the present application are described. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0030] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment and storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0031] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0032] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for dynamic loading of network protocols based on traffic analysis, characterized in that it comprises the following steps: 1.1 Develop new protocol analysis functions and encapsulate them into Linux dynamic loading libraries that comply with interface specifications; 1.2 Obtain plug-in information by scanning the plug-in directory and determine the protocol analysis plug-in that needs to be loaded or updated; 1.3 Use Linux dynamic loading technology to load the protocol analysis plug-in and mount it into the protocol analysis engine; 1.4 Migrate traffic to the updated protocol analysis engine and clean up the cache and related intermediate files of the old plug-in; 1.

5. Return loading information through the command line framework and record dynamic loading logs.

2. The method according to claim 1, characterized in that Developing a new protocol analysis function in step 1 includes: developing a corresponding function according to the RFC or specification of the new protocol, compiling it into a dynamic load library plug-in form, and storing it in a plug-in directory defined by the traffic analysis system.

3. The method according to claim 1, characterized in that Scanning the plug-in directory in step 2 includes: counting the number and version information of plug-ins, and recording the identifiers of plug-ins that need to be loaded.

4. The method according to claim 1, characterized in that: In step 3, the plug-in is loaded using the dlopen function of the Linux dynamic library, and is mounted to the protocol analysis engine by reading the function symbol.

5. The method according to claim 1, characterized in that In step 3, the protocol analysis engine supports multi-task loading, merging and cutting functions to minimize business load interference.

6. The method according to claim 1, characterized in that When migrating traffic to the updated protocol analysis engine in step 4), the old engine and its resources are dynamically released to optimize system performance.

7. The method according to claim 1, characterized in that Cleaning up the intermediate files in step 4) includes deleting temporary files generated during the loading process and unused protocol caches.

8. The method according to claim 1, characterized in that In step 5), the command line framework supports dynamic task sequencing and analyzes traffic load and business requirements through AI algorithms to optimize protocol loading time.

9. The method according to claim 8, characterized in that Users can set the maximum time for AI decision-making and the latest effective time for protocol loading to meet different business needs.

10. The method according to any one of claims 1 to 9, characterized in that Dynamic loading log records include information such as protocol loading time, plug-in identification, loading results, and system performance changes.

Images