Data query method, device, computer equipment and storage medium

Abstract

The present application relates to a data query method, device, computer equipment and storage medium. The method includes: obtaining the data stream of each monitored unit, filtering and obtaining target data according to the filtering and screening conditions in the preset data structure; based on the target data, counting the basic query results of each monitored unit, and storing the basic query results in the preset data structure; processing the basic query results in the preset data structure based on the data processing rules to obtain the final query results, and pushing the final query results to the terminal device so that the user can view them through the terminal device. The use of this method can improve the efficiency of data query.

Description

Technical Field

[0001] The present application relates to the technical field of database and data processing, and in particular to a data query method, device, computer equipment and storage medium. Background Art

[0002] With the vigorous development of network information technology, many different business systems will be connected to the same data platform, through which users can query, monitor and process the business data of each business system (also called monitored units).

[0003] Currently, users query and access the data of each monitored unit on the data platform by sending a query request. Since the time when users access each monitored unit is not uniform, it is usually necessary to set query conditions for each monitored unit. During the query process, the data platform updates the user access time in the access time record in real time, and only retains the most recent access time.

[0004] However, the current data query method requires setting different query filtering conditions for each monitored unit, which makes the query filtering conditions complicated and reduces the query performance of the data platform. In addition, since the data platform only retains the user's most recent access time, every time the user needs to query the data, the user needs to actively initiate a query request. The data platform recalculates the data query results based on the query request, resulting in low data query efficiency. Summary of the invention

[0005] Based on this, it is necessary to provide a data query method, device, computer equipment and storage medium to address the above technical problems.

[0006] A data query method, the method comprising:

[0007] Obtain the data stream of each monitored unit, and filter and obtain the target data according to the filtering conditions in the preset data structure;

[0008] Based on the target data, basic query results of each monitored unit are counted, and the basic query results are stored in the preset data structure;

[0009] The basic query results in the preset data structure are processed based on data processing rules to obtain final query results, and the final query results are pushed to the terminal device so that the user can view them through the terminal device.

[0010] In one embodiment, the filtering and obtaining target data according to the filtering conditions in the preset data structure includes:

[0011] According to a preset time period, and according to at least one filtering condition in a preset data structure, periodically screening the data streams of each monitored unit to obtain candidate data, and classifying the candidate data according to at least one data classification rule to obtain classified target data;

[0012] The counting of basic query results of each monitored unit based on the target data includes:

[0013] For the target data corresponding to each monitored unit, according to each event type and the number of event types contained in the target data, a new data volume statistical process is allocated;

[0014] Through the new data volume statistics process, the new data volume of each event type in the target data is counted to obtain the basic query result corresponding to each monitored unit.

[0015] In one embodiment, the basic query result includes the newly read data amount and the newly added data amount, and the newly read data amount is the amount of data in the newly added data amount that has been pushed to the terminal device; the basic query result in the preset data structure is processed based on the data processing rule to obtain the final query result, including:

[0016] In the preset data structure, obtaining the basic query result corresponding to each of the monitored units;

[0017] The newly added unread data amount of the monitored unit is calculated according to the newly added data amount and the newly added read data amount in the basic query result, and the newly added unread data amount is used as the final query result.

[0018] In one embodiment, the method further comprises:

[0019] receiving a data reading request, wherein the data reading request carries an identification of a target monitored unit;

[0020] Determining at least one filtering condition and at least one data classification rule in the preset data structure according to the target monitored unit identifier;

[0021] The step of filtering and obtaining target data according to the filtering conditions in the preset data structure includes:

[0022] According to the filtering conditions and the data classification rules, candidate data is obtained by screening the data stream corresponding to the target monitored unit;

[0023] According to the data classification rule, the candidate data is classified to obtain classified target data; the target data includes all data within a time range from the time of the last data read request to the time of the current data read request;

[0024] The target data is read and fed back to a display terminal of a terminal device for output and display.

[0025] In one embodiment, the counting of basic query results of each monitored unit based on the target data includes:

[0026] After the target data is fed back to the terminal device, the target data corresponding to the target monitored unit is marked as read, and newly added read data is obtained;

[0027] The data volume statistics of the newly added read data are performed according to the data volume statistics process to obtain the basic query result of the target monitored unit.

[0028] In one embodiment, the data volume statistics of the newly added read data are performed according to the data volume statistics process to obtain the basic query result of the target monitored unit, including:

[0029] Analyzing the event type of the network security event contained in the newly added read data;

[0030] According to each of the event types and the number of event types, a data volume statistics process is allocated, and the newly added read data volume of each of the event types is determined through the data volume statistics process to obtain the basic query result of the target monitored unit.

[0031] A data query device, comprising:

[0032] The acquisition module is used to obtain the data stream of each monitored unit and filter the target data according to the filtering conditions in the preset data structure;

[0033] A statistical module, used for counting the basic query results of each monitored unit based on the target data, and storing the basic query results in the preset data structure;

[0034] The push module is used to process the basic query results in the preset data structure based on data processing rules to obtain final query results, and push the final query results to the terminal device so that the user can view them through the terminal device.

[0035] In one embodiment, the basic query result includes the amount of read data and the amount of newly added data, and the amount of newly added read data is the amount of data in the newly added data that has been pushed to the terminal device; the push module is specifically used to obtain the basic query result corresponding to each monitored unit in the preset data structure;

[0036] The newly added unread data amount of the monitored unit is calculated according to the newly added data amount and the newly added read data amount in the basic query result, and the newly added unread data amount is used as the final query result.

[0037] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0038] Obtain the data stream of each monitored unit, and filter and obtain the target data according to the filtering conditions in the preset data structure;

[0039] Based on the target data, basic query results of each monitored unit are counted, and the basic query results are stored in the preset data structure;

[0040] The basic query results in the preset data structure are processed based on data processing rules to obtain final query results, and the final query results are pushed to the terminal device so that the user can view them through the terminal device.

[0041] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0042] Obtain the data stream of each monitored unit, and filter and obtain the target data according to the filtering conditions in the preset data structure;

[0043] Based on the target data, basic query results of each monitored unit are counted, and the basic query results are stored in the preset data structure;

[0044] The basic query results in the preset data structure are processed based on data processing rules to obtain final query results, and the final query results are pushed to the terminal device so that the user can view them through the terminal device.

[0045] The above-mentioned data query method, device, computer equipment and storage medium obtain the data stream of each monitored unit, and filter the target data according to the filtering and screening conditions in the preset data structure; based on the target data, the basic query results of each monitored unit are counted, and the basic query results are stored in the preset data structure; the basic query results in the preset data structure are processed based on the data processing rules to obtain the final query results, and the final query results are pushed to the terminal device so that the user can view them through the terminal device. Using this method, the basic query results of the data in the data stream are counted in real time according to the filtering and screening conditions in the preset data structure, and then the final query results of each monitored unit are counted according to the preset data processing rules and the basic query results, and pushed to the user's terminal device. There is no need for the user to initiate a data query request, nor is there any need to recalculate the query results for each data query request. The final query results of each monitored unit in the push data stream are updated in real time, thereby improving data query efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic diagram of a flow chart of a data query method in an embodiment;

[0047] Figure 2 A flowchart of a step of real-time monitoring and updating of basic query results in one embodiment;

[0048] Figure 3 A flowchart of a step of adding data filtering, screening and calculating statistical data quantity in an embodiment;

[0049] Figure 4 A flowchart of specific steps for determining a final query result in one embodiment;

[0050] Figure 5 A schematic diagram of a flow chart of a data reading step in an embodiment;

[0051] Figure 6 A schematic diagram of a flow chart of a step of performing data volume statistics for a target monitoring unit in an embodiment;

[0052] Figure 7 A flowchart of the steps of marking read data and calculating basic query results in one embodiment;

[0053] Figure 8 A flowchart of a basic query result step for determining a target monitored unit in one embodiment;

[0054] Fig. 9 A flowchart of an example of a data query method in an embodiment;

[0055] Fig.10A diagram showing the architecture of a data query method in one embodiment;

[0056] Fig.11 is a structural block diagram of a data query device in an embodiment;

[0057] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] In one embodiment, Figure 1 As shown, a data query method is provided, which can be applied to a terminal, a server, or a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. This embodiment is illustrated by applying the method to a terminal, wherein a data query processing platform is integrated on the terminal. Therefore, in each embodiment, the terminal executes each step through the data query processing platform. In this embodiment, the method includes the following steps:

[0060] Step 101, obtain the data stream of each monitored unit, and filter and obtain target data according to the filtering conditions in the preset data structure.

[0061] In implementation, the data of each monitored unit (for example, network security event data) is uniformly connected to the data query processing platform, and the data query processing platform performs planning and processing. Therefore, the data query processing platform can obtain the data stream of each monitored unit, and filter the data in the data stream according to the filtering and screening conditions in the preset data structure. For example, the filtering and screening conditions in the preset data structure may include the event level, event type, and time information of the network security event of the monitored unit. The embodiment of the present application does not limit the filtering and screening conditions of the data. Then the data query processing platform filters the target data according to the filtering and screening conditions in the preset data structure.

[0062] Step 102: based on the target data, basic query results of each monitored unit are counted, and the basic query results are stored in a preset data structure.

[0063] In implementation, the data query processing platform counts the basic query results of each monitored unit based on the screened target data. The basic query results can also be called the intermediate calculation results of the data query. The determination of the intermediate calculation results depends on the intermediate calculation output of the final calculation result. For example, if the final calculation result is the amount of newly added unread data, the intermediate calculation result of the parameter includes the total amount of newly added data and the amount of read data of each monitored unit. If the final calculation result is the total amount of network security incident data, the intermediate calculation result of the parameter includes the total amount of network security incident data of each monitored unit. Therefore, this application does not limit the basic query results.

[0064] Step 103, based on the data processing rules, the basic query results in the preset data structure are processed to obtain the final query results, and the final query results are pushed to the terminal device so that the user can view them through the terminal device.

[0065] In implementation, within a preset time period, the data query processing platform obtains the final query results of each monitored unit according to the preset data processing rules and the basic query results of each monitored unit. Specifically, the data query processing platform updates the basic query results of each monitored unit in real time (for example, 5 seconds as a cycle), and then updates the final query results according to the updated basic query results at a preset time interval (15 seconds as a cycle). Among them, the data processing rules represent user query requirements. For example, if the user query requirement is the amount of newly added unread data, the data query processing platform can process the basic query results according to the data processing rules to obtain the final query result as the amount of newly added unread data. Then, the data query processing platform stores the generated final query results in the Redis (Remote Dictionary Server, remote dictionary service) database, and pushes them to the web (network) front end of the terminal device in a preset time period (for example, 15 seconds) so that the user can consult them in real time. Specifically, the data query processing platform monitors the final query results in the Redis database in real time through websocket, and pushes the monitored final query results to the web front end in real time.

[0066] In the above data query method, the data query processing platform obtains the data stream of each monitored unit, and filters the target data according to the filtering conditions in the preset data structure; based on the target data, the basic query results of each monitored unit are counted, and the basic query results are stored in the preset data structure; based on the data processing rules, the basic query results in the preset data structure are processed to obtain the final query results, and the final query results are pushed to the terminal device so that the user can view them through the terminal device. Using this method, the basic query results in the data stream are counted in real time according to the filtering conditions in the preset data structure, and then the final query results of each monitored unit are counted according to the preset data processing rules and the basic query results, and pushed to the user's terminal device. There is no need for the user to initiate a data query request, nor is there any need to recalculate the query results for each data query request. The final query results of each monitored unit in the push data stream are updated in real time, thereby improving data query efficiency.

[0067] In one embodiment, Figure 2 As shown, in step 101, the target data is obtained by filtering according to the filtering conditions in the preset data structure, including:

[0068] Step 201, according to a preset time period, periodically filter candidate data in the data stream of each monitored unit according to at least one filtering condition in a preset data structure, and classify the candidate data according to at least one data classification rule to obtain classified target data.

[0069] In implementation, the data query processing platform monitors the data structure in the Redis database in real time, and based on a preset time period and according to the filtering conditions contained in the data structure, performs real-time filtering on the data stream of each monitored unit to obtain candidate data. The candidate data is then classified according to the data classification rules to obtain the target data. Specifically, the data query processing platform periodically filters the data stream of each monitored unit based on at least one filtering condition in the data structure of the database Redis according to a preset time period (for example, 15 seconds) to obtain the filtered candidate data, and further classifies the candidate data according to at least one data classification rule (for example, event level data classification rule) to obtain the classified target data. Figure 3As shown, the filtering conditions included in the data structure are: time filtering conditions (same day: 0:00 to 24:00), monitored unit filtering conditions (valid monitored units: monitored unit A, monitored unit B and monitored unit C), etc. The data classification rules include: first classification rule: valid monitored units, second classification rule: event type, etc. Therefore, the data query processing platform can not only filter and filter the data in the data stream, but also aggregate and classify the filtered data. The embodiment of the present application does not limit the types and quantities of the data filtering conditions and data classification rules included in the data structure.

[0070] Optionally, in the process of data filtering and processing on the data query processing platform, filtering conditions can be pre-selected to match the data classification rules, and the matched filtering conditions and data classification rules can be encapsulated into a component. When data filtering is performed through the component, the target data in the data stream obtained according to at least one filtering condition and at least one data classification rule contained in the component can be directly output.

[0071] The specific processing process of step 102 includes:

[0072] Step 202 : for the target data corresponding to each monitored unit, a new data volume statistical process is allocated according to each event type and the number of event types contained in the target data.

[0073] In implementation, the data query processing platform allocates a new data volume statistics process for the target data corresponding to each monitored unit according to the event types and event type data contained in the target data. For example, the target data contains 5 event types, and the data volume corresponding to each event type is: event type 1: 100; event type 2: 80; event type 3: 50; event type 4: 20; event type 5: 10. Based on these 5 event types, 3 data volume statistics processes can be appropriately allocated to count the data. According to the amount of data of each event type, the load balance between the data volume statistics processes is guaranteed. For example, process 1 counts the data volume of event type 1, process 2 counts the data volume of event type 2, and process 3 counts the data volume of event types 3, 4, and 5.

[0074] like Figure 3 As shown, 10 event types are assigned N (N=10) new data volume statistics processes to perform data volume statistics on the data of each event type. Wherein, N can be equal to the number of event types, or can be greater or less than the number of event types, which is not limited in the embodiment of the present application.

[0075] Step 203 , through the new data volume statistics process, the new data volume of each event type in the target data is counted to obtain the basic query result corresponding to each monitored unit.

[0076] During implementation, the data query processing platform counts the amount of new data for each event type in the target data through the new data volume statistics process, for example, event type A: 50, event type B: 150, event type C: 40, event type D: 120, and uses this as the basic query result (new data volume query result) corresponding to each monitored unit.

[0077] In one embodiment, if Figure 4 As shown, the basic query result includes the newly added read data volume and the newly added data volume, and the newly added read data volume is the data volume that has been pushed to the terminal device in the newly added data volume; the specific processing process of step 103 includes the following steps:

[0078] Step 401, obtaining basic query results corresponding to each monitored unit in a preset data structure.

[0079] In implementation, the data query processing platform pre-plans a data structure for storing data, and stores the planned data structure in the memory database Redis, wherein the data structure not only contains the data in the data stream, but also contains the filtering conditions of the data (for example, filtering attribute value: event level) and basic query results, specifically filtering and storing the data based on the filtering conditions, and calculating the basic query results based on the filtered target data. Among them, the basic query results can also be called intermediate calculation results, for example, the total amount of new network security events, the amount of new read network security events, etc. Then, the data query processing platform monitors the data structure in the Redis database through websocket, and obtains the basic query results in the corresponding target data structure for each monitored unit in a preset time period.

[0080] Optionally, the data query processing platform can push the basic query results to the web side of the terminal device for output and display according to a preset time period.

[0081] Step 402: Calculate the newly added unread data volume of the monitored unit according to the newly added data volume and the newly added read data volume in the basic query result, and use the newly added unread data volume as the final query result.

[0082] During implementation, the data query processing platform calculates the difference between the amount of new data (total new data) and the amount of newly read data in the basic query results, and obtains the amount of new unread data of the monitored unit, which is used as the final query result of the monitored unit.

[0083] In this embodiment, the data query processing platform monitors the data structure in the Redis database in real time, and uses the basic query results of each monitored unit contained in the data structure to perform real-time statistics on the final query results of each monitored unit, and pushes them to the user for output display, without the user initiating a data query request, thereby improving data query efficiency.

[0084] In one embodiment, Figure 5 As shown, when a user needs to read data in a data stream of a monitored unit, a data reading request needs to be initiated, and the method further includes:

[0085] Step 501: receiving a data read request.

[0086] The data reading request carries the identification of the target monitored unit.

[0087] In practice, when a user needs to read the data of a monitored unit, the user sends a data reading request to the backend server through the terminal device web terminal. Then, the data query processing platform receives the data reading request and identifies the monitored unit to be read according to the data reading request.

[0088] Step 502: Determine at least one filtering condition and at least one data classification rule in a preset data structure according to the target monitored unit identifier.

[0089] In implementation, the data query processing platform identifies the target data structure in the overall data structure according to the target monitored unit identifier, and determines at least one target filtering condition of the target monitored unit in the target data structure, for example, Figure 6 As shown, the target filtering condition determined is the time condition: start time (0 o'clock) to end time (24 o'clock), the effective monitored unit (for example, monitored unit A), and then, the data classification rule (also called aggregation rule) group by () (for example, network security incident level classification rule) matching the target filtering condition is determined according to the target filtering condition. Among them, the data classification rule (aggregation rule) is a rule for classifying and counting data. For example, the data classification rule is the network security incident level. If the network security incident level is divided into 3 levels, the data of the same monitored unit is divided into the first level of network security incidents, the second level of network security incidents and the third level of network security incidents.

[0090] The specific processing process of step 101 includes:

[0091] Step 503: According to the filtering conditions and data classification rules, candidate data is screened in the data stream corresponding to the target monitored unit.

[0092] In implementation, the data query processing platform filters the candidate data in the data stream corresponding to the target monitored unit according to the filtering conditions and data classification rules. For example, if the filtering conditions include the valid monitoring unit information (i.e., the target monitored unit) and the data time filtering conditions limited by the complete time of the day (0:00 to 24:00), all the newly added data up to the time when the data reading request is sent (e.g., 8:00 on the day) (the subsequent time period has not yet arrived) are filtered out as candidate data.

[0093] Step 504, classify the candidate data according to the data classification rules to obtain classified target data.

[0094] The target data includes all data within a time range from the time of the last data read request to the time of the current data read request.

[0095] In implementation, the data query processing platform classifies the candidate data according to the data classification rules that match the filtering conditions to obtain the classified target data. For example, if the data classification rule is an event level classification rule, the candidate data can be classified according to the event level classification rule to obtain the target data divided by the security event level in the data stream of the target monitored unit.

[0096] Step 505, read the target data, and feed the target data back to the display end of the terminal device for output display.

[0097] During implementation, the data query processing platform reads the target data and feeds the target data back to the terminal device display for output display, so that the user can read and further process the data of the target monitored unit.

[0098] In one embodiment, Figure 7 As shown, the specific processing process of step 102 includes the following steps:

[0099] Step 701: After the target data is fed back to the terminal device, the target data corresponding to the target monitored unit is marked as read, and newly added read data is obtained.

[0100] In implementation, after the target data is fed back to the terminal device, the data query processing platform marks the target data of the read target monitored unit as read, and obtains the newly added read data. Specifically, for the newly added read data of a certain monitored unit (target monitored unit), the newly added unread data recorded in the data structure is updated to zero. For example, the newly added data volume of the day is counted from 0 o'clock, and the user sends a data reading request at 8 o'clock in the morning. Then, within the time range of 0 o'clock to 8 o'clock, the data query result of the target monitored unit is pushed to the web end in real time (15 seconds), and as of 8 o'clock, the data query result is updated to: 500 new data, 500 new unread data, and 0 new read data. At the same time, after the user initiates a data reading request at 8 o'clock, all unread data is read and pushed in response to the data reading request, so that all unread data is marked as read, and the data query result is updated to: 500 new data, 0 new unread data, and 500 new read data, that is, the obtained read data volume is 500.

[0101] Step 702: Perform data volume statistics on the newly added read data according to the data volume statistics process to obtain a basic query result of the target monitored unit.

[0102] During implementation, the data query processing platform assigns the corresponding data volume statistics process to the acquired target data, performs data volume statistics on the target data (newly added read data) according to the data volume statistics process, and then obtains the basic query results (i.e., the newly added read data volume) of the target monitored unit.

[0103] In one embodiment, Figure 8 As shown, the specific processing steps of step 702 include:

[0104] Step 801: parse the event type of the network security event included in the newly added read data.

[0105] In implementation, the data query processing platform can further divide and process the newly acquired read data to meet the diverse data query needs of users, such as Figure 6 As shown, when the newly added read data is network security data, the network security data contains multiple different network security event types (for example, 10 types). Then, the data query processing platform can parse the network security event types contained in the newly added read data to further divide the newly added read data according to the network security event types.

[0106] Step 802, according to each event type and the number of event types, a data volume statistics process is allocated, and the newly added read data volume of each event type is determined through the data volume statistics process to obtain a basic query result of the target monitored unit.

[0107] In implementation, the data query processing platform allocates data volume statistics processes according to the event type and the data volume of each event type. For example, the newly added read data contains 10 event types. Based on these 10 event types, 3 data volume statistics processes can be appropriately allocated to count the data. According to the amount of data of each event type, the load balance between the data volume statistics processes is ensured. Then, the data query processing platform obtains the newly added read data volume of each event type based on the statistics of the data volume statistics process, and uses this as the basic query result of the target monitored unit.

[0108] Optionally, the data processing platform updates the recalculated basic query results to the read field of the data structure of the target monitored unit in the Redis database, so as to update the basic query results in real time and push them to the user web terminal for output display.

[0109] It should be understood that although Figures 1 to 8 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figures 1 to 8 At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0110] In one embodiment, Fig. 9 As shown, an example of a data query method is provided. The specific implementation architecture of the example is as follows Fig.10 As shown, Fig. 9 and Fig.10 The specific scheme includes the following steps:

[0111] Step 901, monitor the data structure in the Redis database.

[0112] Step 902: parsing the filtering conditions contained in the data structure of each monitored unit.

[0113] Step 903, according to the comprehensive filtering conditions assembled from the filtering conditions and aggregation rules in the data structure, the data in the data stream is filtered, screened and classified, and the filtered target data and the corresponding basic query results and final query results are updated in real time.

[0114] Step 904: Push the updated target data, basic query results and final query results to the web front end in real time via websocket.

[0115] Step 905: web front-end output presentation.

[0116] In one embodiment, Fig.11 As shown, a data query device 1100 is provided, including: an acquisition module 1110, a statistics module 1120 and a push module 1130, wherein:

[0117] The acquisition module 1110 is used to acquire the data stream of each monitored unit and filter and obtain the target data according to the filtering conditions in the preset data structure;

[0118] A statistics module 1120, for counting the basic query results of each of the monitored units based on the target data, and storing the basic query results in the preset data structure;

[0119] The push module 1130 is used to process the basic query results in the preset data structure based on data processing rules to obtain final query results, and push the final query results to the terminal device so that the user can view them through the terminal device.

[0120] In one embodiment, the acquisition module 1110 is specifically used to periodically filter the candidate data in the data stream of each monitored unit according to at least one filtering condition in the preset data structure according to a preset time period, and classify the candidate data according to at least one data classification rule to obtain the classified target data;

[0121] The statistical module 1120 is specifically used to allocate a new data volume statistical process for the target data corresponding to each monitored unit according to the event types and the number of event types contained in the target data; through the new data volume statistical process, the new data volume of each event type in the target data is counted to obtain the basic query results corresponding to each monitored unit.

[0122] In one embodiment, the basic query result includes the newly added read data volume and the newly added data volume, and the newly added read data volume is the amount of data in the newly added data volume that has been pushed to the terminal device; the push module 1130 is specifically used to obtain the basic query result corresponding to each monitored unit in the preset data structure;

[0123] The newly added unread data amount of the monitored unit is calculated according to the newly added data amount and the newly added read data amount in the basic query result, and the newly added unread data amount is used as the final query result.

[0124] In one embodiment, the data query device 1100 further includes:

[0125] A receiving module, used for receiving a data reading request, wherein the data reading request carries an identification of a target monitored unit;

[0126] A determination module, configured to determine at least one filtering condition and at least one data classification rule in the preset data structure according to the target monitored unit identifier;

[0127] The statistical module 1120 is further used to filter and obtain candidate data from the data stream corresponding to the target monitored unit according to the filtering condition;

[0128] According to the data classification rule, the candidate data is classified to obtain classified target data; the target data includes all data within a time range from the time of the last data read request to the time of the current data read request;

[0129] The target data is read and fed back to a display terminal of a terminal device for output and display.

[0130] In one embodiment, the statistical module 1120 is further configured to mark the target data corresponding to the target monitored unit as read after the target data is fed back to the terminal device, thereby obtaining newly added read data;

[0131] The data volume statistics of the newly added read data are performed according to the data volume statistics process to obtain the basic query result of the target monitored unit.

[0132] In one embodiment, the statistics module 1120 is further used to parse the event type of the network security event contained in the newly added read data;

[0133] According to each of the event types and the number of event types, a data volume statistics process is allocated, and the newly added read data volume of each of the event types is determined through the data volume statistics process to obtain the basic query result of the target monitored unit.

[0134] For the specific definition of the data query device 1100, please refer to the definition of the data query method above, which will not be repeated here. Each module in the above-mentioned data query device 1100 can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0135] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.12 As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a data query method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0136] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0137] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0138] Obtain the data stream of each monitored unit, and filter and obtain the target data according to the filtering conditions in the preset data structure;

[0139] Based on the target data, basic query results of each monitored unit are counted, and the basic query results are stored in the preset data structure;

[0140] The basic query results in the preset data structure are processed based on data processing rules to obtain final query results, and the final query results are pushed to the terminal device so that the user can view them through the terminal device.

[0141] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0142] According to a preset time period, and according to at least one filtering condition in a preset data structure, periodically screening the data streams of each monitored unit to obtain candidate data, and classifying the candidate data according to at least one data classification rule to obtain classified target data;

[0143] For the target data corresponding to each monitored unit, according to each event type and the number of event types contained in the target data, a new data volume statistical process is allocated;

[0144] Through the new data volume statistics process, the new data volume of each event type in the target data is counted to obtain the basic query result corresponding to each monitored unit.

[0145] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0146] In the preset data structure, obtaining the basic query result corresponding to each of the monitored units;

[0147] The newly added unread data amount of the monitored unit is calculated according to the newly added data amount and the newly added read data amount in the basic query result, and the newly added unread data amount is used as the final query result.

[0148] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0149] receiving a data reading request, wherein the data reading request carries an identification of a target monitored unit;

[0150] Determining at least one filtering condition and at least one data classification rule in the preset data structure according to the target monitored unit identifier;

[0151] According to the filtering condition, candidate data is obtained by filtering the data stream corresponding to the target monitored unit;

[0152] According to the data classification rule, the candidate data is classified to obtain classified target data; the target data includes all data within a time range from the time of the last data read request to the time of the current data read request;

[0153] The target data is read and fed back to a display terminal of a terminal device for output and display.

[0154] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0155] After the target data is fed back to the terminal device, the target data corresponding to the target monitored unit is marked as read, and newly added read data is obtained;

[0156] The data volume statistics of the newly added read data are performed according to the data volume statistics process to obtain the basic query result of the target monitored unit.

[0157] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0158] Analyzing the event type of the network security event contained in the newly added read data;

[0159] According to each of the event types and the number of event types, a data volume statistics process is allocated, and the newly added read data volume of each of the event types is determined through the data volume statistics process to obtain the basic query result of the target monitored unit.

[0160] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0161] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0162] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0163] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A data query method, characterized in that: The method comprises: Obtain the data stream of each monitored unit, and filter and obtain the target data according to the filtering conditions in the preset data structure; Based on the target data, basic query results of each monitored unit are counted, and the basic query results are stored in the preset data structure; Processing the basic query results in the preset data structure based on data processing rules to obtain final query results, and pushing the final query results to a terminal device so that the user can view them through the terminal device; The counting of basic query results of each monitored unit based on the target data includes: After the target data is fed back to the terminal device, the target data corresponding to the target monitored unit is marked as read, and newly added read data is obtained; The data volume statistics of the newly added read data are performed according to the data volume statistics process to obtain the basic query result of the target monitored unit.

2. The method according to claim 1, characterized in that The step of filtering and obtaining target data according to the filtering conditions in the preset data structure includes: According to a preset time period, and according to at least one filtering condition in a preset data structure, periodically screening the data streams of each monitored unit to obtain candidate data, and classifying the candidate data according to at least one data classification rule to obtain classified target data; The counting of basic query results of each monitored unit based on the target data includes: For the target data corresponding to each monitored unit, according to each event type and the number of event types contained in the target data, a new data volume statistical process is allocated; Through the new data volume statistics process, the new data volume of each event type in the target data is counted to obtain the basic query result corresponding to each monitored unit.

3. The method according to claim 1, characterized in that The basic query result includes the newly added read data volume and the newly added data volume, and the newly added read data volume is the data volume of the newly added data volume that has been pushed to the terminal device; The step of processing the basic query result in the preset data structure based on the data processing rule to obtain the final query result includes: In the preset data structure, obtaining the basic query result corresponding to each of the monitored units; The newly added unread data amount of the monitored unit is calculated according to the newly added data amount and the newly added read data amount in the basic query result, and the newly added unread data amount is used as the final query result.

4. The method according to claim 1, characterized in that: The method further comprises: receiving a data reading request, wherein the data reading request carries an identification of a target monitored unit; Determining at least one filtering condition and at least one data classification rule in the preset data structure according to the target monitored unit identifier; The step of filtering and obtaining target data according to the filtering conditions in the preset data structure includes: According to the filtering condition, candidate data is obtained by filtering the data stream corresponding to the target monitored unit; According to the data classification rule, the candidate data is classified to obtain classified target data; the target data includes all data within a time range from the time of the last data read request to the time of the current data read request; The target data is read and fed back to a display terminal of a terminal device for output and display.

5. The method according to claim 1, characterized in that The step of performing data volume statistics on the newly added read data according to the data volume statistics process to obtain a basic query result of the target monitored unit includes: Analyzing the event type of the network security event contained in the newly added read data; According to each of the event types and the number of event types, a data volume statistics process is allocated, and the newly added read data volume of each of the event types is determined through the data volume statistics process to obtain the basic query result of the target monitored unit.

6. A data query device, characterized in that: The device comprises: The acquisition module is used to obtain the data stream of each monitored unit and filter the target data according to the filtering conditions in the preset data structure; A statistical module, used for counting the basic query results of each monitored unit based on the target data, and storing the basic query results in the preset data structure; A push module, used for processing the basic query results in the preset data structure based on data processing rules to obtain final query results, and pushing the final query results to a terminal device so that a user can view them through the terminal device; The statistical module is specifically used to mark the target data corresponding to the target monitored unit as read after the target data is fed back to the terminal device, so as to obtain newly added read data; The data volume statistics of the newly added read data are performed according to the data volume statistics process to obtain the basic query result of the target monitored unit.

7. The device according to claim 6, characterized in that The basic query result includes the newly added read data volume and the newly added data volume, and the newly added read data volume is the amount of data in the newly added data volume that has been pushed to the terminal device; the push module is specifically used to obtain the basic query result corresponding to each monitored unit in the preset data structure; The newly added unread data amount of the monitored unit is calculated according to the newly added data amount and the newly added read data amount in the basic query result, and the newly added unread data amount is used as the final query result.

8. The device according to claim 6, characterized in that The statistical module is further used to analyze the event type of the network security event contained in the newly added read data; According to each of the event types and the number of event types, a data volume statistics process is allocated, and the newly added read data volume of each of the event types is determined through the data volume statistics process to obtain the basic query result of the target monitored unit.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images