Data analysis method, device and computer readable storage medium

Abstract

The present invention discloses a data parsing method, device and computer-readable storage medium, which relate to the field of communication technology, in order to solve the problem that the existing SQL statement parsing method in Oracle traffic data is applicable to fixed scenarios. The method comprises: obtaining target database traffic data to be parsed; extracting feature values ​​according to a pre-acquired structured query language SQL statement, and determining the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature value comprises a sub-function offset value constant, a relative offset value constant of an SQL statement length identification bit and a relative offset value range of an SQL statement starting bit; extracting the SQL statement from the target database traffic data to be parsed according to the length and starting position of the SQL statement, and obtaining the SQL statement content in the target database traffic data to be parsed. The embodiment of the present invention can be applied to SQL statement parsing of target database traffic data in different scenarios.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data parsing method, device and computer-readable storage medium. Background Art

[0002] At present, many companies choose Oracle database for data storage as their backend database. At the same time, many companies need to audit the read and write access of data. In related technologies, they usually choose to use mirrored traffic to analyze the key content of the traffic data generated between the Oracle client and the server, and generate traffic analysis logs to meet audit requirements.

[0003] In the related art, the Structured Query Language (SQL) statement parsing in Oracle traffic data is mainly to obtain the offset of the SQL statement through the SQL statement offset rules in a fixed scenario, such as a certain version of the Transparent Network Substrate (TNS) protocol, a certain client's traffic data, etc., and then obtain the SQL statement based on the offset, or obtain it by retrieving the SQL statement keyword string. However, this method is only applicable to traffic data in specific scenarios. For example, the Oracle traffic data generated in various scenarios such as different versions of the TNS protocol, different operating systems, different clients, and different Oracle database versions may have different SQL statement offset rules. If each scenario is analyzed for fixed offset rules, it will take a lot of manpower.

[0004] It can be seen that the existing method of parsing SQL statements in Oracle traffic data has the problem of fixed applicable scenarios. Summary of the invention

[0005] The embodiments of the present invention provide a data parsing method, device and computer-readable storage medium to solve the problem that the existing method for parsing SQL statements in Oracle traffic data has fixed applicable scenarios.

[0006] In a first aspect, an embodiment of the present invention provides a data parsing method, comprising:

[0007] Obtain the traffic data of the target database to be analyzed;

[0008] Extracting feature values ​​according to the structured query language SQL statement acquired in advance, determining the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature values ​​include a sub-function offset value constant, a relative offset value constant of the SQL statement length identification bit, and a relative offset value range of the SQL statement starting bit;

[0009] According to the length and the starting position of the SQL statement, the SQL statement is extracted from the target database traffic data to be parsed, and the SQL statement content in the target database traffic data to be parsed is obtained.

[0010] Optionally, before extracting feature values ​​based on the pre-acquired structured query language SQL statements and determining the length and starting position of the SQL statements in the target database traffic data to be parsed, the method further includes:

[0011] Obtaining N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios;

[0012] Determine the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit;

[0013] Determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data;

[0014] Determine the relative offset value range of the start position of the SQL statement based on the relative offset value of the start position of the SQL statement in each target database sampled traffic data;

[0015] Based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data, determine the relative offset value constant of the SQL statement length identification bit;

[0016] The sub-function offset value constant, the relative offset value range of the SQL statement start bit and the relative offset value constant of the SQL statement length identification bit are determined as the SQL statement extraction feature value.

[0017] Optionally, the determining of the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit includes:

[0018] Retrieve the target sub-function value position in each target database sampled traffic data respectively, and determine the sub-function offset value of each target database sampled traffic data according to the target sub-function value position in each target database sampled traffic data;

[0019] Retrieve the starting position of each SQL statement in the sampled traffic data of the target database respectively, and determine the relative offset value of the starting position of each SQL statement in the sampled traffic data of the target database according to the starting position of each SQL statement in the sampled traffic data of the target database;

[0020] Retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data;

[0021] According to the length of the SQL statement in each target database sampled traffic data, the relative offset value of the SQL statement length identification bit in each target database sampled traffic data is determined.

[0022] Optionally, respectively retrieving the starting position of the SQL statement in each target database sampled traffic data, and determining the relative offset value of the starting position of the SQL statement in each target database sampled traffic data according to the starting position of the SQL statement in each target database sampled traffic data, includes:

[0023] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0024] Obtaining a first combination value of the M-1th byte and the Mth byte in the first target database sampled traffic data, wherein the first target database sampled traffic data is any one of the N target database sampled traffic data;

[0025] If the first combination value is the first target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters, where L is a positive integer and the initial value of j is 0;

[0026] If the M+1+jth byte is not the preset character, or the L bytes after the M+1+jth byte are not the preset character, then add 1 to the value of j, and repeat the above steps of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character, until the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character;

[0027] If the M+1+jth byte and the L bytes after the M+1+jth byte are found to be preset characters, then it is determined whether the M+1+jth byte is the starting position of the SQL statement;

[0028] If the M+1+jth byte is determined to be the starting position of the SQL statement, then the starting position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+jth byte, and the relative offset value of the starting position of the SQL statement in the first target database sampled traffic data is determined to be j.

[0029] Optionally, the determining whether the M+1+jth byte is the starting position of the SQL statement includes:

[0030] Starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+gth byte is a separator, where the initial value of g is 0;

[0031] If the M+1+j+g-th byte is not a separator, the value of g is increased by 1, and the above step of searching whether the M+1+j+g-th byte is a separator is repeated until the M+1+j+g-th byte is a separator, or g is equal to the second preset value;

[0032] If the M+1+j+gth byte is retrieved as a separator, then add the values ​​of the M+1+jth byte to the M+j+gth byte to get the total value;

[0033] It is determined whether the total value belongs to the value set of the SQL keyword, wherein if the total value belongs to the value set of the SQL keyword, the M+1+jth byte is determined as the starting position of the SQL statement.

[0034] Optionally, the method further includes:

[0035] If the total value does not belong to the value set of the SQL keyword, or the separator is not retrieved, it is determined that the M+1+jth byte is not the starting position of the SQL statement, and the value of j is updated to j+g, and the step of retrieving whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is executed.

[0036] Optionally, respectively retrieving the target sub-function value position in each target database sampled traffic data, and determining the sub-function offset value of each target database sampled traffic data according to the target sub-function value position in each target database sampled traffic data, includes:

[0037] If the first combination value is the second target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the second combination value of the M+1+ith byte and the M+i+2th byte is the first target value, and the initial value of i is 0;

[0038] If the second combined value is not the first target value, the value of i is increased by 1, and the above steps of searching whether the second combined value of the M+1+i th byte and the M+i+2 th byte is the first target value are repeated until the second combined value is retrieved to be the first target value;

[0039] If the second combined value is the first target value, the target sub-function value position in the first target database sampled traffic data is determined to be the M+1+ith byte, and the sub-function offset value of the first target database sampled traffic data is determined to be i+2.

[0040] Optionally, after determining that the position of the target sub-function value in the sampled traffic data of the first target database is the M+1+ith byte, the method further includes:

[0041] The value of M is updated to M+i+2, and the step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is performed.

[0042] Optionally, respectively retrieving the end position of the SQL statement in each target database sampled traffic data, and determining the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data, comprises:

[0043] If it is determined that the M+1+jth byte is the starting position of the SQL statement, then starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+kth byte is the end identifier of the SQL statement, and the initial value of k is 0;

[0044] If the M+1+j+kth byte retrieved is not the end identifier of the SQL statement, the value of k is increased by 1, and the above retrieval is repeated to determine whether the M+1+j+kth byte is the end identifier of the SQL statement, until the M+1+j+kth byte is retrieved to be the end identifier of the SQL statement;

[0045] If the M+1+j+kth byte is retrieved as the end identifier of the SQL statement, the end position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+j+kth byte, and the length of the SQL statement in the first target database sampled traffic data is determined to be k.

[0046] Optionally, determining the relative offset value of the SQL statement length identification bit in each target database sampled traffic data according to the SQL statement length in each target database sampled traffic data includes:

[0047] In the case where it is determined that the length of the SQL statement in the first target database sampled traffic data is k, if the value of k is less than a third preset value, a target byte whose value is k is retrieved between the q+1th byte and the q+1+jth byte in the first target database sampled traffic data, wherein q is equal to the sum of the first preset value and the sub-function offset value of the first target database sampled traffic data;

[0048] If the value of k is greater than or equal to the third preset value, two bytes whose consecutive two byte values ​​are the third target value and the fourth target value are retrieved between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database, and the first byte of the two bytes is determined as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value;

[0049] According to the position of the target byte, a relative offset value of the SQL statement length identification bit in the first target database sampled traffic data is determined.

[0050] Optionally, the sub-function offset value constant is determined based on the sub-function offset value of each target database sampled traffic data, including:

[0051] Deduplication counting statistics are performed on the sub-function offset values ​​of each target database sampled traffic data, and the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data is determined as a sub-function offset value constant.

[0052] Optionally, the determining the relative offset value range of the start bit of the SQL statement based on the relative offset value of the start bit of the SQL statement in each target database sampled traffic data includes:

[0053] Perform deduplication counting on the relative offset value of the start position of the SQL statement in each target database sampled traffic data to obtain P different relative offset values ​​of the start position of the SQL statement, and determine the count corresponding to the relative offset value of the start position of each SQL statement, where P is a positive integer less than or equal to N;

[0054] Sorting the relative offset values ​​of the P different SQL statement start positions according to the size of the values ​​to obtain a sorted set of relative offset values ​​of the SQL statement start positions;

[0055] According to a preset extraction ratio threshold, determining a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold;

[0056] The relative offset value range of the start position of the SQL statement is determined according to the maximum relative offset value and the minimum relative offset value in the minimum relative offset value subset.

[0057] Optionally, the determining of the relative offset value constant of the SQL statement length identification bit based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data includes:

[0058] Deduplication counting is performed on the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data, and the relative offset value of the SQL statement length identification bit with the highest count among the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data is determined as the relative offset value constant of the SQL statement length identification bit.

[0059] Optionally, extracting feature values ​​based on a pre-acquired structured query language SQL statement to determine the length and starting position of the SQL statement in the target database traffic data to be parsed includes:

[0060] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0061] Obtain a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed;

[0062] If the third combined value is the first target value, then according to the relative offset value constant OFF_LEN of the SQL statement length identification bit, the value of the M+OFF_LENth byte in the target database traffic data to be parsed is obtained to obtain the number of SQL statement length identification bits;

[0063] According to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit, the length of the SQL statement in the target database traffic data to be parsed is obtained;

[0064] Retrieving a SQL statement start identifier from the target database traffic data to be parsed according to the relative offset value range of the SQL statement start position;

[0065] If the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, then determine whether the M+rth byte is the starting position of the SQL statement, where r is a positive integer;

[0066] If it is determined that the M+rth byte is the starting position of the SQL statement, then the starting position of the SQL statement in the target database traffic data to be parsed is determined to be the M+rth byte.

[0067] Optionally, after obtaining the third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed, the method further includes:

[0068] If the third combined value is the second target value, the value of M is updated to M+OFF_5E according to the sub-function offset value constant OFF_5E, and the step of obtaining the value of the M+OFF_LENth byte in the target database traffic data to be parsed is executed.

[0069] Optionally, extracting the SQL statement from the target database traffic data to be parsed based on the length and starting position of the SQL statement to obtain the SQL statement content in the target database traffic data to be parsed includes:

[0070] The contents from the M+rth byte to the M+r+w-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, wherein w is the length of the SQL statement in the target database traffic data to be parsed.

[0071] Optionally, the method further includes:

[0072] If the number of bits of the SQL statement length identifier is not the fifth target value, or the SQL statement start identifier is not retrieved, or it is determined that the M+rth byte is not the starting position of the SQL statement, it is confirmed that the SQL statement extraction has failed.

[0073] Optionally, after confirming that the SQL statement extraction fails, the method further includes:

[0074] Starting from the M+o+1th byte in the target database traffic data to be parsed, search whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are preset characters, where o is the minimum value of the preset search offset range, o is a positive integer, L is a positive integer, and the initial value of s is 0;

[0075] If the M+o+1+sth byte retrieved is not the preset character, or the L bytes after the M+o+1+sth byte are not the preset character, then the value of s is increased by 1, and the above steps of searching whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character are repeated, until the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, or o+s=O, O is the maximum value of the preset search offset range, and O is an integer greater than o;

[0076] If the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are found to be preset characters, then it is determined whether the M+o+1+sth byte is the starting position of the SQL statement;

[0077] If it is determined that the M+o+1+sth byte is the starting position of the SQL statement, then the M+o+1+sth byte is recorded as the starting position of the SQL statement in the target database traffic data to be parsed;

[0078] Retrieving the SQL statement end identifier starting from the M+o+1+sth byte in the target database traffic data to be parsed;

[0079] If the Tth byte in the target database traffic data to be parsed is retrieved as an SQL statement end identifier, then the contents from the M+o+1+sth byte to the T-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, where T is an integer greater than M+o+1+s.

[0080] In a second aspect, an embodiment of the present invention further provides a data analysis device, including:

[0081] The first acquisition module is used to acquire the target database traffic data to be analyzed;

[0082] A first determination module is used to extract feature values ​​according to a pre-acquired structured query language SQL statement, and determine the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature value includes a sub-function offset value constant, a relative offset value constant of an SQL statement length identification bit, and a relative offset value range of an SQL statement starting bit;

[0083] The extraction module is used to extract the SQL statement from the target database traffic data to be parsed according to the length and starting position of the SQL statement, and obtain the SQL statement content in the target database traffic data to be parsed.

[0084] Optionally, the data analysis device further includes:

[0085] A second acquisition module is used to acquire N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios;

[0086] The second determination module is used to determine the sub-function offset value of each target database sampled flow data, the relative offset value of the SQL statement start bit and the relative offset value of the SQL statement length identification bit;

[0087] A third determination module is used to determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data;

[0088] A fourth determination module, used to determine a relative offset value range of a start position of an SQL statement based on a relative offset value of a start position of an SQL statement in each target database sampled flow data;

[0089] A fifth determination module, used to determine a relative offset value constant of a SQL statement length identification bit based on a relative offset value of a SQL statement length identification bit in each target database sampled traffic data;

[0090] The sixth determination module is used to determine the sub-function offset value constant, the relative offset value range of the SQL statement start bit and the relative offset value constant of the SQL statement length identification bit as the SQL statement extraction feature value.

[0091] Optionally, the second determining module includes:

[0092] The first determination submodule is used to retrieve the target sub-function value position in each target database sampled flow data respectively, and determine the sub-function offset value of each target database sampled flow data according to the target sub-function value position in each target database sampled flow data;

[0093] The second determination submodule is used to retrieve the starting position of the SQL statement in each target database sampled traffic data respectively, and determine the relative offset value of the starting position of the SQL statement in each target database sampled traffic data according to the starting position of the SQL statement in each target database sampled traffic data;

[0094] The third determination submodule is used to retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data;

[0095] The fourth determination submodule is used to determine the relative offset value of the SQL statement length identification bit in each target database sampled traffic data according to the SQL statement length in each target database sampled traffic data.

[0096] Optionally, the second determining submodule includes:

[0097] An assignment unit, used for assigning the offset to a first preset value M, where M is an integer greater than 1;

[0098] An acquiring unit, used for acquiring a first combination value of an M-1th byte and an Mth byte in the first target database sampled traffic data, wherein the first target database sampled traffic data is any one of the N target database sampled traffic data;

[0099] a first retrieval unit, for, if the first combined value is a first target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the M+1+jth byte and L bytes after the M+1+jth byte are preset characters, where L is a positive integer and the initial value of j is 0;

[0100] The first execution unit is used for, if the M+1+jth byte is not the preset character, or the L bytes after the M+1+jth byte are not the preset character, then adding 1 to the value of j, and repeating the above step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character, until the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character;

[0101] A judging unit, configured to judge whether the M+1+jth byte is the starting position of the SQL statement if the M+1+jth byte and the L bytes after the M+1+jth byte are found to be preset characters;

[0102] The first determination unit is used to determine that the starting position of the SQL statement in the first target database sampled traffic data is the M+1+j byte if the M+1+j byte is determined to be the starting position of the SQL statement, and to determine that the relative offset value of the starting position of the SQL statement in the first target database sampled traffic data is j.

[0103] Optionally, the judging unit includes:

[0104] A search subunit, configured to start from the M+1+jth byte in the sampled traffic data of the first target database and search whether the M+1+j+gth byte is a separator, where the initial value of g is 0;

[0105] an execution subunit, configured to, if the M+1+j+g-th byte is not a separator after being retrieved, add 1 to the value of g, and repeat the above step of retrieving whether the M+1+j+g-th byte is a separator, until the M+1+j+g-th byte is a separator after being retrieved, or g is equal to a second preset value;

[0106] A processing subunit, for adding values ​​of bytes M+1+j to M+j+g to obtain a total value if the M+1+j+g byte is found to be a separator;

[0107] The judging subunit is used to judge whether the total value belongs to the value set of the SQL keyword, wherein if the total value belongs to the value set of the SQL keyword, the M+1+jth byte is determined as the starting position of the SQL statement.

[0108] Optionally, the second determining submodule further includes:

[0109] The second execution unit is used to determine that the M+1+jth byte is not the starting position of the SQL statement if the total value does not belong to the value set of the SQL keyword, or the separator is not retrieved, and update the value of j to j+g, and execute the step of retrieving whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters.

[0110] Optionally, the first determining submodule includes:

[0111] a second retrieval unit, configured to retrieve, starting from the M+1th byte in the sampled traffic data of the first target database, whether a second combined value of the M+1+ith byte and the M+i+2th byte is the first target value if the first combined value is a second target value, wherein an initial value of i is 0;

[0112] a third execution unit, configured to, if the second combined value is not the first target value, add 1 to the value of i, and repeat the above step of searching whether the second combined value of the M+1+i th byte and the M+i+2 th byte is the first target value, until the second combined value is retrieved to be the first target value;

[0113] The second determination unit is used to determine the position of the target sub-function value in the first target database sampled traffic data as the M+1+ith byte if the second combined value is the first target value, and to determine the sub-function offset value of the first target database sampled traffic data as i+2.

[0114] Optionally, the first determining submodule further includes:

[0115] The fourth execution unit is used to update the value of M to M+i+2, and execute the step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters.

[0116] Optionally, the third determining submodule includes:

[0117] a third retrieval unit, configured to retrieve whether the M+1+j+kth byte is an end identifier of the SQL statement starting from the M+1+jth byte in the sampled traffic data of the first target database if it is determined that the M+1+jth byte is the starting position of the SQL statement, where the initial value of k is 0;

[0118] a fifth execution unit, configured to, if the M+1+j+kth byte retrieved is not the end identifier of the SQL statement, increase the value of k by 1, and repeat the above-mentioned search for whether the M+1+j+kth byte is the end identifier of the SQL statement, until the M+1+j+kth byte retrieved is the end identifier of the SQL statement;

[0119] The third determination unit is used to determine that the end position of the SQL statement in the sampled traffic data of the first target database is the M+1+j+k byte if the M+1+j+k byte is retrieved as the end identifier of the SQL statement, and determine that the length of the SQL statement in the sampled traffic data of the first target database is k.

[0120] Optionally, the fourth determining submodule includes:

[0121] a fourth retrieval unit, configured to, when determining that the SQL statement length in the sampled traffic data of the first target database is k, retrieve a target byte whose value is k between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database if the value of k is less than a third preset value, wherein q is equal to the sum of the first preset value and the sub-function offset value of the sampled traffic data of the first target database;

[0122] a fifth retrieval unit, for retrieving two bytes whose consecutive two byte values ​​are respectively a third target value and a fourth target value between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database if the value of k is greater than or equal to a third preset value, and determining the first byte of the two bytes as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value;

[0123] The fourth determining unit is used to determine the relative offset value of the SQL statement length identification bit in the first target database sampled traffic data according to the position of the target byte.

[0124] Optionally, the third determination module is used to perform deduplication counting statistics on the sub-function offset values ​​of each target database sampled traffic data, and determine the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data as the sub-function offset value constant.

[0125] Optionally, the fourth determining module includes:

[0126] A fifth determination submodule is used to perform deduplication counting statistics on the relative offset value of the starting position of the SQL statement in each target database sampled traffic data, obtain P different relative offset values ​​of the starting position of the SQL statement, and determine the count corresponding to the relative offset value of the starting position of each SQL statement, where P is a positive integer less than or equal to N;

[0127] A sorting submodule, used to sort the relative offset values ​​of the starting positions of the P different SQL statements according to the size of the values, to obtain a sorted set of relative offset values ​​of the starting positions of the SQL statements;

[0128] a sixth determination submodule, configured to determine, according to a preset extraction ratio threshold, a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold;

[0129] The seventh determination submodule is used to determine the relative offset value range of the start position of the SQL statement according to the maximum relative offset value and the minimum relative offset value in the minimum relative offset value subset.

[0130] Optionally, the fifth determination module is used to perform deduplication counting statistics on the relative offset values ​​of the SQL statement length identifier in each target database sampled traffic data, and determine the relative offset value of the SQL statement length identifier with the highest count among the relative offset values ​​of the SQL statement length identifier in each target database sampled traffic data as the relative offset value constant of the SQL statement length identifier.

[0131] Optionally, the first determining module includes:

[0132] An assignment submodule, used for assigning the offset to a first preset value M, where M is an integer greater than 1;

[0133] A first acquisition submodule is used to acquire a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed;

[0134] A second acquisition submodule is used for acquiring the value of the M+OFF_LENth byte in the target database traffic data to be parsed according to the relative offset value constant OFF_LEN of the SQL statement length identification bit if the third combination value is the first target value, so as to obtain the number of SQL statement length identification bits;

[0135] A third acquisition submodule is used to acquire the length of the SQL statement in the target database traffic data to be parsed according to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit;

[0136] A first retrieval submodule, configured to retrieve a SQL statement start identifier from the target database traffic data to be parsed according to a relative offset value range of the SQL statement start position;

[0137] The first judgment submodule is used to judge whether the M+rth byte is the starting position of the SQL statement if the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, where r is a positive integer;

[0138] The eighth determination submodule is used to determine the starting position of the SQL statement in the target database traffic data to be parsed as the M+r byte if the M+r byte is determined to be the starting position of the SQL statement.

[0139] Optionally, the first determining module further includes:

[0140] The first execution submodule is used to update the value of M to M+OFF_5E according to the sub-function offset value constant OFF_5E if the third combination value is the second target value, and execute the step of obtaining the value of the M+OFF_LENth byte in the target database traffic data to be parsed.

[0141] Optionally, the extraction module is used to extract the content from the M+rth byte to the M+r+w-1th byte from the target database traffic data to be parsed as SQL statement content, wherein w is the length of the SQL statement in the target database traffic data to be parsed.

[0142] Optionally, the data analysis device further includes:

[0143] The processing module is used to confirm that the SQL statement extraction fails if the number of bits of the SQL statement length identifier is not the fifth target value, or the SQL statement start identifier is not retrieved, or it is determined that the M+rth byte is not the starting position of the SQL statement.

[0144] Optionally, the processing module includes:

[0145] The second search submodule is used to search the M+o+1+sth byte and the L bytes after the M+o+1+sth byte for preset characters starting from the M+o+1th byte in the target database traffic data to be parsed, where o is the minimum value of the preset search offset range, o is a positive integer, L is a positive integer, and the initial value of s is 0;

[0146] The second execution submodule is used for, if the M+o+1+sth byte is not the preset character, or the L bytes after the M+o+1+sth byte are not the preset character, then adding 1 to the value of s, and repeating the above step of searching whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, until the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, or o+s=O, O is the maximum value of the preset search offset range, and O is an integer greater than o;

[0147] The second judgment submodule is used to judge whether the M+o+1+sth byte is the starting position of the SQL statement if the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset characters;

[0148] A recording submodule, for recording the M+o+1+sth byte as the starting position of the SQL statement in the target database traffic data to be parsed if the M+o+1+sth byte is determined to be the starting position of the SQL statement;

[0149] A third retrieval submodule is used to retrieve the SQL statement end identifier starting from the M+o+1+sth byte in the target database traffic data to be parsed;

[0150] The extraction submodule is used to extract the contents from the M+o+1+sth byte to the T-1th byte from the target database traffic data to be parsed as the SQL statement content if the Tth byte in the target database traffic data to be parsed is retrieved as the SQL statement end identifier, wherein T is an integer greater than M+o+1+s.

[0151] In a third aspect, an embodiment of the present invention further provides a data analysis device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the data analysis method described above when executing the computer program.

[0152] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the data parsing method as described above are implemented.

[0153] In an embodiment of the present invention, by pre-acquiring SQL statement extraction feature values, when parsing the target database traffic data, the length and starting position of the SQL statement in the target database traffic data can be determined based on the sub-function offset value constant, the relative offset value constant of the SQL statement length identification bit and the relative offset value range of the SQL statement starting bit in the SQL statement extraction feature value, and then the SQL statement can be extracted from the target database traffic data based on the length and starting position information. This method is applicable to SQL statement parsing of target database traffic data in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0154] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0155] Figure 1 is a flow chart of a data parsing method provided by an embodiment of the present invention;

[0156] Figure 2 It is a schematic diagram of the TNS protocol data structure provided by an embodiment of the present invention.

[0157] Figure 3 is a flowchart of extracting SQL key fields provided by an embodiment of the present invention;

[0158] Figure 4 is a workflow diagram of the SQL keyword judgment module provided by an embodiment of the present invention;

[0159] Figure 5 is a flow chart of extracting SQL statements based on feature values ​​of SQL statements provided by an embodiment of the present invention;

[0160] Figure 6 It is a SQL statement retrieval and extraction flow chart provided by an embodiment of the present invention;

[0161] Figure 7 It is one of the structural diagrams of the data parsing device provided by the embodiment of the present invention;

[0162] Figure 8 This is the second structural diagram of the data analysis device provided by the embodiment of the present invention;

[0163] Fig. 9 This is the third structural diagram of the data analysis device provided in the embodiment of the present invention. DETAILED DESCRIPTION

[0164] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0165] See also Figure 1 , Figure 1 is a flow chart of a data parsing method provided by an embodiment of the present invention, such as Figure 1 As shown, the following steps are included:

[0166] Step 101: Obtain target database traffic data to be analyzed.

[0167] The embodiment of the present invention is applicable to the scenario of parsing the traffic data generated when the client and the server interact using the Transparent Network Substrate (TNS) protocol (reading and writing data in the target database), and the purpose is to extract the traffic data, that is, the SQL statement in the TNS data packet. For example, the target data may be an Oracle database, and the target database traffic data to be parsed may be the traffic data generated when reading and writing the Oracle database. The embodiments of the present invention are described below using the Oracle database as an example.

[0168] The above-mentioned obtaining of the target database traffic data to be analyzed may be obtaining the target database traffic data to be analyzed by means of mirroring traffic.

[0169] Since the TNS protocol is not public and only part of the data structure is known, we can only parse some sub-function types, and the detailed structure of the specific content is unknown, such as Figure 2 As shown, the content of the first 12 bytes of the TNS protocol is known, of which the 5th byte is the type field, representing the type of the TNS data packet, the 9th byte and the 10th byte represent the data flag Data Flag, the 11th byte represents the function ID of the TNS data packet of this type, and the 12th byte represents the sub-function Sub ID of the TNS data packet of this type and function, but the content data structure of the subsequent load part is unknown. The purpose of the embodiment of the present invention is to parse out this part of the content structure in the TNS data packet, specifically, to parse the SQL statement content in the TNS data packet of the data type, so as to determine which specific accesses the client has made to the target database, thereby meeting the audit requirements of various enterprises for data read and write access.

[0170] It should be noted that this solution only focuses on the analysis of SQL statements, so the TNS protocol data content can be filtered. For example, only the traffic data with the 5th byte value of 0x06 (indicating the type is Data) and the combined value of the 11th and 12th bytes of 0x035E or 0x1169 can be analyzed. Therefore, the Oracle traffic data referred to in the subsequent content of this solution can refer to the Oracle traffic data that meets this condition (the 5th byte value is 0x06, and the combined value of the 11th and 12th bytes is 0x035E or 0x1169).

[0171] Step 102: extract feature values ​​based on the pre-acquired structured query language SQL statement, and determine the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature values ​​include a sub-function offset value constant, a relative offset value constant of the SQL statement length identification bit, and a relative offset value range of the SQL statement starting bit.

[0172] The above-mentioned SQL statement extraction feature value can be obtained in advance, specifically, by parsing Oracle traffic data in a large number of different scenarios (such as different versions of TNS protocols, different versions of databases, different clients and servers, etc.) one by one using a string search method, determining the sub-function offset value in each Oracle traffic data, the relative offset value of the SQL statement length identifier, and the relative offset value of the SQL statement start bit, and performing statistical analysis on these values ​​to obtain feature values ​​that can cover Oracle traffic data in most scenarios. Then, by extracting feature values ​​through the SQL statement, Oracle traffic data in different scenarios can be parsed.

[0173] That is, the SQL statement extraction feature value includes a sub-function offset value constant, a relative offset value constant of an SQL statement length identification bit, and a relative offset value range of an SQL statement start bit, wherein the sub-function offset value constant can be used to determine the offset bit number of a target sub-function (such as a byte bit with a value of 0x035E) in Oracle traffic data, such as the difference in bit number between a byte bit with a value of 0x1169 and a byte bit with a value of 0x035E; the relative offset value constant of an SQL statement length identification bit can be used to determine the relative offset bit number of an SQL statement length identification bit in Oracle traffic data, such as the offset bit number of an SQL statement length identification bit relative to the 12th byte bit, that is, equal to the difference in bit number between the 12th byte bit and the SQL statement length identification bit (such as Figure 2As shown, the first 12 bytes are a known data structure, and the SQL statement is located after the 12th byte). When a sub-function offset exists, the sub-function offset value constant needs to be subtracted; the relative offset value range of the starting position of the SQL statement can be used to determine the relative offset number of the starting position of the SQL statement in the Oracle traffic data, such as the offset number of the starting position of the SQL statement relative to the 12th byte position, which is equal to the difference in the number of bits between the 12th byte position and the starting position of the SQL statement. When a sub-function offset exists, the sub-function offset value constant needs to be subtracted.

[0174] In this way, the sub-function offset value constant and the relative offset value constant of the SQL statement length identification bit in the SQL statement extraction feature value can be used to determine the SQL statement length identification bit in the Oracle traffic data to be parsed, and by obtaining the value of the SQL statement length identification bit, the length of the SQL statement can be determined; the sub-function offset value constant and the relative offset value range of the SQL statement starting bit in the SQL statement extraction feature value can be used to determine the retrieval range of the SQL statement starting bit in the Oracle traffic data to be parsed, and by searching the SQL statement starting bit within the range, the starting position of the SQL statement can be determined.

[0175] Optionally, before step 102, the method further includes:

[0176] Obtaining N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios;

[0177] Determine the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit;

[0178] Determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data;

[0179] Determine the relative offset value range of the start position of the SQL statement based on the relative offset value of the start position of the SQL statement in each target database sampled traffic data;

[0180] Based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data, determine the relative offset value constant of the SQL statement length identification bit;

[0181] The sub-function offset value constant, the relative offset value range of the SQL statement start bit and the relative offset value constant of the SQL statement length identification bit are determined as the SQL statement extraction feature value.

[0182] That is, you can sample Oracle traffic data in different scenarios in advance, perform SQL statement parsing on the Oracle traffic data, and perform statistical analysis on the parsing results to determine the SQL statement extraction feature value, so as to ensure that the Oracle traffic data in different scenarios can be parsed later based on the SQL statement extraction feature value.

[0183] Specifically, N pieces of Oracle sampled traffic data may be obtained first. For example, a large amount of Oracle traffic data in different scenarios may be obtained by mirroring traffic, and some Oracle traffic data may be sampled therefrom. The sampling may be random sampling, or may be sampling of Oracle traffic data within a period of time, or sampling of Oracle traffic data within several time periods. Among them, N may take a larger value to ensure that the feature value extracted by the SQL statement determined in the end can cover the Oracle traffic data in most scenarios.

[0184] Then, each piece of Oracle sampled traffic data can be parsed one by one by using a string search method. For example, the byte position where the target sub-function (such as 0x035E) is located can be searched, the SQL statement start position can be searched, the SQL statement end position can be searched, and the SQL statement length can be determined based on the SQL statement start position and the SQL statement end position. Then, the SQL statement length identification bit can be determined, such as the byte position whose value is equal to the SQL statement length, to determine the sub-function offset value of each piece of Oracle sampled traffic data, the relative offset value of the SQL statement start position, and the relative offset value of the SQL statement length identification bit.

[0185] Next, based on the determined sub-function offset value of each Oracle sampled traffic data, a sub-function offset value constant can be determined. For example, for N Oracle sampled traffic data, multiple different sub-function offset values ​​can be obtained, and there are also some identical sub-function offset values. For example, the sub-function offset values ​​in multiple Oracle sampled traffic data are the same. Among them, the Oracle sampled traffic data without sub-function offset can have its sub-function offset value recorded as 0, or only the sub-function offset value of the Oracle sampled traffic data with sub-function offset can be recorded. In this way, the sub-function offset value with the largest count among multiple different sub-function offset values ​​can be used as the sub-function offset value constant, or the sub-function offset value with the largest count and the smallest or largest value can be used as the sub-function offset value constant.

[0186] The relative offset value range of the SQL statement start position can be determined based on the relative offset value of the SQL statement start position in each Oracle sampled traffic data. For example, for N Oracle sampled traffic data, the relative offset values ​​of the N SQL statement start positions can be obtained, so that the relative offset value range of the SQL statement start position can be determined based on the minimum and maximum values ​​of the relative offset values ​​of the N SQL statement start positions. Alternatively, the value range of the relative offset values ​​of the N SQL statement start positions can be narrowed, and the minimum and maximum values ​​of the relative offset values ​​of the SQL statement start positions with higher counts are taken to obtain the relative offset value range of the SQL statement start position, so as to narrow the range of the SQL statement start position to be retrieved during subsequent parsing and improve the retrieval speed. It should be noted that the determined relative offset value range of the SQL statement start position can also be flexibly adjusted according to actual needs.

[0187] The relative offset value constant of the SQL statement length identifier can also be determined based on the relative offset value of the SQL statement length identifier in each Oracle sampled traffic data. For example, for N Oracle sampled traffic data, N relative offset values ​​of the SQL statement length identifier can be obtained, among which there may be some identical relative offset values ​​of the SQL statement length identifier. For example, the relative offset values ​​of the SQL statement length identifiers in multiple Oracle sampled traffic data are the same. Therefore, the relative offset value of the SQL statement length identifier with the largest count among the relative offset values ​​of the N SQL statement length identifiers can be used as the relative offset value constant of the SQL statement length identifier.

[0188] Finally, the determined sub-function offset value constant, the relative offset value range of the SQL statement start bit, and the relative offset value constant of the SQL statement length identification bit can be determined as the SQL statement extraction feature value.

[0189] Further, the determination of the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit includes:

[0190] Retrieve the target sub-function value position in each target database sampled traffic data respectively, and determine the sub-function offset value of each target database sampled traffic data according to the target sub-function value position in each target database sampled traffic data;

[0191] Retrieve the starting position of each SQL statement in the sampled traffic data of the target database respectively, and determine the relative offset value of the starting position of each SQL statement in the sampled traffic data of the target database according to the starting position of each SQL statement in the sampled traffic data of the target database;

[0192] Retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data;

[0193] According to the length of the SQL statement in each target database sampled traffic data, the relative offset value of the SQL statement length identification bit in each target database sampled traffic data is determined.

[0194] The above-mentioned target sub-function value can be a function and sub-function number in a TNS data packet carrying an SQL statement. For example, in a TNS data packet carrying an SQL statement field, the target sub-function value is 0x035E, that is, the combined value of the ID and SubID fields is 0x035E.

[0195] In this implementation, the sub-function offset value in each Oracle sampled traffic data can be determined by respectively retrieving the position of the target sub-function value in each Oracle sampled traffic data. Specifically, for each Oracle sampled traffic data, the byte whose combined value of two consecutive bytes is the target sub-function value can be retrieved, the position of the byte can be determined, and the corresponding sub-function offset value can be determined based on the position. For example, starting from the 11th byte in a certain Oracle sampled traffic data, the value of each byte can be retrieved in turn. When the combined value of two consecutive bytes retrieved is 0x035E (that is, the values ​​of the two bytes are 0x03 and 0x5E respectively), the sub-function offset value is determined based on these two bytes. For another example, in the TNS protocol, when there is no sub-function offset, the combined value of the 11th byte and the 12th byte is usually 0x035E. If the combined value of the 11th byte and the 12th byte is retrieved as 0x035E, it is determined that there is no sub-function offset, or the sub-function offset value is 0. If the combined value of the p-th byte and the p+1-th byte is retrieved as 0x035E, the sub-function offset value can be determined as p-11 based on the number of offset bits of the p-th byte relative to the 11th byte, or the sub-function offset value can be determined as p+1-12=p-11 based on the number of offset bits of the p+1-th byte relative to the 12th byte.

[0196] When retrieving the position of the target sub-function value in each Oracle sampled traffic data, the starting position of the SQL statement in each Oracle sampled traffic data can be further retrieved to determine the relative offset value of the starting position of the SQL statement in each Oracle sampled traffic data. Specifically, since the SQL statement field is usually after the target sub-function field, for each Oracle sampled traffic data, after retrieving the target sub-function value, the starting position of the SQL statement can be retrieved from the next byte of the byte. For example, the byte position where the character corresponding to multiple consecutive byte values ​​is a letter can be retrieved, and the relative offset value of the corresponding starting position of the SQL statement can be determined based on the first byte in the consecutive bytes. For another example, the combined value of the 11th byte and the 12th byte is 0x035E, and the mth byte is retrieved as the starting position of the SQL statement, then the relative offset value of the starting position of the SQL statement is m-13.

[0197] After retrieving the starting position of the SQL statement in each Oracle sampled traffic data, you can continue to retrieve the ending position of the SQL statement in each Oracle sampled traffic data. Specifically, for each Oracle sampled traffic data, you can retrieve the ending position of the SQL statement after the retrieved starting position of the SQL statement. For example, retrieve the SQL statement end identifier, such as retrieving bytes with byte values ​​of 0x00 or 0x01, and determine the corresponding SQL statement length based on the retrieved SQL statement end bit and SQL statement start bit. For example, if the mth byte is retrieved as the SQL statement start bit and the lth byte is retrieved as the SQL statement start bit, you can determine that the SQL statement length is ml.

[0198] After determining the SQL statement length in each Oracle sampled traffic data, the byte whose byte value matches the SQL statement length can be retrieved from each Oracle sampled traffic data again to determine the position of its SQL statement length identification bit in the Oracle sampled traffic data, and based on the position, determine the relative offset value of the SQL statement length identification bit. Specifically, since the value range that a byte can store is 0 to 255, and the SQL statement length identification bit is usually located after the target sub-function byte and before the SQL statement start bit, for Oracle sampled traffic data with an SQL statement length less than 256, the byte whose value is equal to its SQL statement length can be retrieved from the target sub-function byte to the SQL statement start bit, and for Oracle sampled traffic data with an SQL statement length greater than 256, two consecutive bytes whose values ​​are equal to its SQL statement length after being calculated according to a specific formula can be retrieved from the target sub-function byte to the SQL statement start bit, and the byte is the SQL statement length identification bit, and the relative offset value of the SQL statement length identification bit can be determined based on the offset of the byte relative to the target sub-function bit. For example, the combined value of the 11th byte and the 12th byte is 0x035E, and the hth byte is retrieved as the SQL statement length identifier, then the relative offset value of the SQL statement length identifier can be determined to be h-13.

[0199] In this way, by respectively retrieving the target sub-function value position, SQL statement starting position and SQL statement ending position in each Oracle sampled traffic data, it can be ensured that based on these position information, the sub-function offset value of each Oracle sampled traffic data, the relative offset value of the SQL statement starting position and the relative offset value of the SQL statement length identification position can be determined more accurately.

[0200] Further, respectively retrieving the starting position of the SQL statement in each target database sampled traffic data, and determining the relative offset value of the starting position of the SQL statement in each target database sampled traffic data according to the starting position of the SQL statement in each target database sampled traffic data, includes:

[0201] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0202] Obtaining a first combination value of the M-1th byte and the Mth byte in the first target database sampled traffic data, wherein the first target database sampled traffic data is any one of the N target database sampled traffic data;

[0203] If the first combination value is the first target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters, where L is a positive integer and the initial value of j is 0;

[0204] If the M+1+jth byte is not the preset character, or the L bytes after the M+1+jth byte are not the preset character, then add 1 to the value of j, and repeat the above steps of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character, until the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character;

[0205] If the M+1+jth byte and the L bytes after the M+1+jth byte are found to be preset characters, then it is determined whether the M+1+jth byte is the starting position of the SQL statement;

[0206] If the M+1+jth byte is determined to be the starting position of the SQL statement, then the starting position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+jth byte, and the relative offset value of the starting position of the SQL statement in the first target database sampled traffic data is determined to be j.

[0207] In the TNS protocol content, every two numbers represent a byte of content. Assume that the byte ordered set in a TNS protocol content is {byte1, byte2, ..., byte n}, the set can be represented as a byte array data, and the content of each byte is represented in the form of data[off], where off represents the offset. For example, the content offset of the first byte is 0, which is represented by data[0], that is, data[0] = byte1, data[1] = byte2, and data[n-1] = byte n The entire Oracle sampling traffic data set is represented as {data1, data2, ..., data n}.

[0208] For any one of the N Oracle sampled traffic data, assuming it is the first Oracle sampled traffic data, the offset off can be first assigned to the first preset value M, where the value of M can be determined based on the offset value of the target sub-function byte when there is no sub-function offset. For example, the values ​​of the 11th byte data

[10] and the 12th byte data

[11] are 0x035E, which are the target sub-function bytes. Then, the value of the first preset value M can be determined to be 12, that is, the SQL statement start bit is subsequently retrieved from the 13th byte data

[12] .

[0209] Specifically, before retrieving the start bit of the SQL statement, you can first obtain the combined value of the M-2th byte and the M-1th byte in the first Oracle sampled traffic data, recorded as the first combined value. After obtaining it, you can determine whether the first combined value is the first target value. The first target value can be a target sub-function value. For example, M=12, the first target value is 0x035E, then you can obtain the combined value of the data

[10] and data

[11] bytes to determine whether it is 0x035E.

[0210] If the first combination value is the first target value, the SQL statement start position can be retrieved from the M+1th byte, data[M], in the first Oracle sampled traffic data. Specifically, the byte whose ASCII code corresponds to a preset character corresponding to a plurality of consecutive byte values ​​can be retrieved first, such as 0x73 corresponding to character s. The preset character can include letters a-z and A-Z. That is, the M+1th byte data[M] and the L bytes after the M+1th byte can be retrieved first to see if they are letters (in this case, j=0). L can be determined according to the difference between the SQL statement and other contents. For example, If the SQL statement includes at least three consecutive letters, L can be 2. At this time, you can search whether data[M], data[M+1] and data[M+2] are all letters. If so, you can determine that the M+1th byte data[M] may be the starting position of the SQL statement. If the M+1th byte data[M] or the L bytes after the M+1th byte are not letters, you can add 1 to the offset value (i.e. j=0+1) and continue to search whether the next byte and the L bytes after it are letters, until the L+1 consecutive bytes are all letters.

[0211] Assuming that the retrieved M+1+jth byte data[M+j] and the L bytes after the M+1+jth byte are all preset characters, it can be determined that the M+1+jth byte data[M+j] may be the starting position of the SQL statement. To ensure accuracy, it can be further determined whether the M+1+jth byte data[M+j] is the starting position of the SQL statement. For example, the first word can be obtained from the M+1+jth byte data[M+j]. Assuming that the bytes data[M+j] to the bytes data[M+j+g-1] are all consecutive letters, and the byte data[M+j+g] is not a letter, the word composed of these g letters can be obtained to determine whether the word is a keyword of the SQL statement. If so, the M+1+jth byte data[M+j] is determined to be the starting position of the SQL statement.

[0212] When it is determined that the M+1+jth byte, i.e., data[M+j], is the starting position of the SQL statement, it can be determined that the starting position of the SQL statement in the first Oracle sampled traffic data is data[M+j], and the SQL statement starting offset value sqlstart can be recorded as M+j. Further, it can be determined that the offset value of the SQL statement starting position data[M+j] in the first Oracle sampled traffic data relative to data[M] is M+jM=j, and the relative offset value offsql of the SQL statement starting position can be recorded as j.

[0213] In this way, through this implementation, the starting position of the SQL statement in each Oracle sampled traffic data can be accurately retrieved, and the relative offset value of the starting position of the SQL statement can be determined according to its offset.

[0214] Further, the determining whether the M+1+jth byte is the starting position of the SQL statement includes:

[0215] Starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+gth byte is a separator, where the initial value of g is 0;

[0216] If the M+1+j+g-th byte is not a separator, the value of g is increased by 1, and the above step of searching whether the M+1+j+g-th byte is a separator is repeated until the M+1+j+g-th byte is a separator, or g is equal to the second preset value;

[0217] If the M+1+j+gth byte is retrieved as a separator, then add the values ​​of the M+1+jth byte to the M+j+gth byte to get the total value;

[0218] It is determined whether the total value belongs to the value set of the SQL keyword, wherein if the total value belongs to the value set of the SQL keyword, the M+1+jth byte is determined as the starting position of the SQL statement.

[0219] That is, the first word can be obtained by searching for the separator from the M+1+jth byte in the first Oracle sampled traffic data, and then by judging whether the word belongs to the SQL keyword, it is judged whether the M+1+jth byte data[M+j] is the starting position of the SQL statement.

[0220] Specifically, it is possible to sequentially search whether each byte is a separator from the M+1+j byte data[M+j] to data[M+j+G]. If not, the offset is increased by 1, that is, the value of g is increased by 1, and the next byte is searched until a separator is found, or no separator is found. The separator may include a space, a line feed, and a tab. G is a second preset value, which may be determined according to the maximum length of the SQL keyword. For example, generally, the SQL keyword will not exceed 10 characters, so the second preset value G=10 may be set.

[0221] Assuming that the M+1+j+g byte data[M+j+g] retrieved is a separator, the byte content from data[M+j] to data[M+j+g-1] can be recorded as the first word in the SQL statement, and the values ​​of the bytes from data[M+j] to data[M+j+g-1] can be added to obtain the total value, and then it is determined whether the total value belongs to the value set of the SQL keyword. If it does, the M+1+j byte data[M+j] is determined to be the starting position of the SQL statement, wherein the value set of the SQL keyword can be obtained by counting all SQL keywords and adding the ASCII code values ​​corresponding to the letters in each SQL keyword to obtain the value corresponding to each SQL keyword, and these values ​​are combined together to obtain the value set of the SQL keyword.

[0222] For example, the value set of the SQL keyword determined by statistics includes but is not limited to the following: 640, 627, 661, 643, 437, 628, 536, 540, 652, 649, 842, 421, 412, 332, 870, 517. The 20 bytes of oracle traffic data starting from offset off (off=M+j) are: select'x'from dual, then the content from data[off] to data[off+19] is: [115,101,108,101,99,116,32,39,120,39,32,102,114,111,109,32,100,117,97,108]. So we can search from data[off] to data[off+6] which is the space character 32. Then we can add the values ​​of the first 6 bits, that is, 115+101+108+101+99+116=640. 640 is in the value set of the SQL keyword, so we can determine that data[off] is the starting position of the SQL statement.

[0223] In this way, by obtaining whether the first word in the Oracle sampled traffic data belongs to an SQL keyword, it can be more accurately determined whether the currently retrieved byte data[M+j] is the start position of the SQL statement.

[0224] Furthermore, the method further comprises:

[0225] If the total value does not belong to the value set of the SQL keyword, or the separator is not retrieved, it is determined that the M+1+jth byte is not the starting position of the SQL statement, and the value of j is updated to j+g, and the step of retrieving whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is executed.

[0226] That is, when determining whether the M+1+j byte data[M+j] is the starting position of the SQL statement by using the above-mentioned search separator method, if the total value obtained by adding the values ​​of the bytes data[M+j] to data[M+j+g-1] does not belong to the value set of the SQL keyword, it can be determined that the byte data[M+j] is not the starting position of the SQL statement and needs to be re-searched. Specifically, the value of j can be updated to j+g, that is, the offset is updated to M+j+g, and data[M+j+g] and the subsequent L bytes are retrieved to see if they are preset characters, so as to re-search the bytes that may be the starting position of the SQL statement.

[0227] Alternatively, when no separator is found between bytes data[M+j] and data[M+j+G], it can also be determined that the byte data[M+j] is not the starting position of the SQL statement and needs to be re-searched. Specifically, the value of j can be updated to j+g (g=G at this time), that is, the offset is updated to M+j+g, and data[M+j+g] and the subsequent L bytes are retrieved to see if they are preset characters, so as to re-search the bytes that may be the starting position of the SQL statement.

[0228] In this way, it can be ensured that the accurate starting position of the SQL statement can be retrieved in different ways under different retrieval situations.

[0229] Optionally, respectively retrieving the target sub-function value position in each target database sampled traffic data, and determining the sub-function offset value of each target database sampled traffic data according to the target sub-function value position in each target database sampled traffic data, includes:

[0230] If the first combination value is the second target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the second combination value of the M+1+ith byte and the M+i+2th byte is the first target value, and the initial value of i is 0;

[0231] If the second combined value is not the first target value, the value of i is increased by 1, and the above steps of searching whether the second combined value of the M+1+i th byte and the M+i+2 th byte is the first target value are repeated until the second combined value is retrieved to be the first target value;

[0232] If the second combined value is the first target value, the target sub-function value position in the first target database sampled traffic data is determined to be the M+1+ith byte, and the sub-function offset value of the first target database sampled traffic data is determined to be i+2.

[0233] That is, when searching for the target sub-function value in the first Oracle sampled traffic data, if the first combination value of the M-1th byte and the Mth byte is not the first target value but the second target value, it means that there is a sub-function offset in the first Oracle sampled traffic data. Therefore, it is necessary to search for two bytes whose combination value is the first target value starting from the M+1th byte. For example, M=12, the first target value is 0x035E, and the second target value is 0x1169. When the combination value of the 11th byte data

[10] and the 12th byte data

[11] is 0x1169, it is necessary to search for two bytes whose combination value is 0x035E starting from the 13th byte.

[0234] If the combined value of the retrieved M+1th byte data[M] and the M+2th byte data[M+1] is not the first target value, the offset off can be increased by 1, that is, continue to search for the combined value of the next byte data[off] and the byte data[off+1] (at this time off=M+1) until two bytes whose combined value is the second target value are retrieved.

[0235] Assuming that the combined value of the retrieved M+1+ith byte data[M+i] and the M+i+2th byte data[M+i+1] is the first target value, the target sub-function value position in the first Oracle sampling traffic data can be recorded as the M+1+ith byte data[M+i], and the corresponding sub-function offset value off5e can be determined to be M+1+i-(M-1)=i+2.

[0236] In this way, when the first combination value is the second target value, the sub-function offset value can be determined by retrieving the byte position of the combination value as the first target value, and the sub-function offset value in the Oracle sampled traffic data where the sub-function offset exists can be accurately determined in this way.

[0237] Further, after determining that the position of the target sub-function value in the sampled traffic data of the first target database is the M+1+ith byte, the method includes:

[0238] The value of M is updated to M+i+2, and the step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is performed.

[0239] That is, when it is determined that there is a sub-function offset in the first Oracle sampled traffic data, after determining its sub-function offset value off5e, the offset value can be updated to M+i+2, and starting from the M+i+3th byte data[M+i+2], L+1 consecutive bytes with preset characters can be retrieved to determine the byte in the first Oracle sampled traffic data that may be the starting position of the SQL statement.

[0240] And when there is a sub-function offset, the relative offset value of the start position of the SQL statement is the offset value of the start position of the SQL statement minus M+1 and the sub-function offset value needs to be subtracted. For example, when it is determined that the byte data[off] is the start position of the SQL statement (at this time off=M+1+i+2+j), the relative offset value of the start position of the SQL statement can be determined as off-M-off5e=M+1+i+2+j-(M+1)-(i+2)=j.

[0241] Further, respectively retrieving the end position of the SQL statement in each target database sampled traffic data, and determining the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data, comprises:

[0242] If it is determined that the M+1+jth byte is the starting position of the SQL statement, then starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+kth byte is the end identifier of the SQL statement, and the initial value of k is 0;

[0243] If the M+1+j+kth byte retrieved is not the end identifier of the SQL statement, the value of k is increased by 1, and the above retrieval is repeated to determine whether the M+1+j+kth byte is the end identifier of the SQL statement, until the M+1+j+kth byte is retrieved to be the end identifier of the SQL statement;

[0244] If the M+1+j+kth byte is retrieved as the end identifier of the SQL statement, the end position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+j+kth byte, and the length of the SQL statement in the first target database sampled traffic data is determined to be k.

[0245] That is, when the M+1+jth byte is determined as the starting position of the SQL statement in the aforementioned manner, the end identifier of the SQL statement can be retrieved from the M+1+jth byte in the first Oracle sampled traffic data. For example, a byte with a value of 0x00 or 0x01 can be retrieved to determine the end position of the SQL statement. Of course, since the L bytes after the M+1+jth byte are also preset characters, the end identifier of the SQL statement can also be retrieved from the M+1+j+Lth byte.

[0246] If the retrieved M+1+jth byte data[M+j] is not the end identifier of the SQL statement, the offset off can be increased by 1, that is, the next byte data[M+j+1] is searched to see if it is the end identifier of the SQL statement until the byte of the end identifier of the SQL statement is retrieved.

[0247] Assuming that the M+1+j+kth byte data[M+j+k] retrieved is the end identifier of the SQL statement, the end position of the SQL statement in the first Oracle sampling traffic data can be recorded as the M+1+j+kth byte data[M+j+k], and based on the SQL statement starting position data[M+j] and the SQL statement ending position data[M+j+k], the SQL statement length sqllen can be determined to be M+j+k-(M+j)=k, that is, the SQL statement length is equal to the difference between the SQL statement end bit offset value and the SQL statement starting bit offset value.

[0248] In this way, by retrieving the end identifier of the SQL statement in each Oracle sampled traffic data, the end position of the SQL statement is determined, and then the length of the SQL statement in each Oracle sampled traffic data can be determined in combination with the start position and the end position of the SQL statement.

[0249] Combine the following Figure 3 and Figure 4 , the process of performing SQL statement parsing on Oracle sampled traffic data introduced in the above implementation mode is illustrated by way of example:

[0250] in Figure 3 The SQL key field extraction process shown is as follows:

[0251] Step 31: Assign the offset off to 12.

[0252] Step 32: Get the function and sub-function value func of the TNS protocol content in the Oracle sampled traffic data, which is the combined value of the data

[10] and data

[11] bytes.

[0253] Step 33, determine whether func is 0x035E, if so, go to step 37, otherwise go to step 34.

[0254] Step 34, determine whether func is 0x1169, if so, go to step 35.

[0255] Step 35: Starting from data[off], within a certain range (such as 12 bytes), search for the position where two consecutive bytes are 0x03 and 0x5E in the subsequent content.

[0256] Step 36: Assuming that the retrieved data[off+i] value is 0x03 and the data[off+i+1] value is 0x5E, record the offset value off5e=i+2 from the sub-function identifier 0x1169 to 0x035e, and update the offset value off to off+i+2. If not retrieved, ignore the data, i.e., give up parsing the data.

[0257] Step 37, start searching for letters from data[off] (i.e., search whether the value of the byte is a-z or A-Z after being converted into ACSII code) until the end of data.

[0258] Step 38, determine whether the retrieved data[off+j] is a letter and the subsequent two bytes are also letters. If so, go to step 310, otherwise go to step 39.

[0259] Step 39: Assign off to off+j+1 and repeat the previous step 37.

[0260] Step 310: Update the offset off to off+j, and proceed to Figure 4 The process of the SQL keyword judgment module shown determines whether the offset is the starting position of the SQL statement.

[0261] Step 311: If the judgment result is false, update off to off + separator offset (if Figure 4 If no separator is found in the process, off is updated to off+g) and the process returns to step 37.

[0262] Step 312: If the judgment result is true, the current offset off is recorded as the starting offset value sqlstart of the SQL statement, and the relative offset value of the SQL statement offsql=sqlstart-12 is recorded (if the bytes of data

[10] and data

[11] are 0x1169, then offsql=sqlstart-off5e-12).

[0263] Step 313: Start searching for the SQL statement terminator (such as 0x00 or 0x01) from data[off] until the end of data. Each time a byte is searched, the value of off is updated to off+1.

[0264] Step 314: After the SQL statement terminator is retrieved, the length of the SQL statement sqllen=off-sqlstart may be recorded.

[0265] in Figure 4 The workflow of the keyword judgment module shown is as follows:

[0266] Step 41, starting from data[off], searching for separators (including space, line feed characters " / r", " / n", and tab character " / t") until data[off+g], for example, g=10.

[0267] Step 42, determine whether the separator is retrieved, if it is retrieved, go to step 43, otherwise go to step 46.

[0268] Step 43: record the current offset as offspace, add the values ​​of all bytes from data[off] to data[off+offspace-1], and record it as K.

[0269] Step 44: determine whether K is in the value set of the SQL keyword, where if so, proceed to step 45, otherwise proceed to step 46.

[0270] Step 45: The result of the judgment is true.

[0271] Step 46: The judgment result is false.

[0272] Further, the determining of the relative offset value of the SQL statement length identification bit in each target database sampled traffic data according to the SQL statement length in each target database sampled traffic data includes:

[0273] In the case where it is determined that the length of the SQL statement in the first target database sampled traffic data is k, if the value of k is less than a third preset value, a target byte whose value is k is retrieved between the q+1th byte and the q+1+jth byte in the first target database sampled traffic data, wherein q is equal to the sum of the first preset value and the sub-function offset value of the first target database sampled traffic data;

[0274] If the value of k is greater than or equal to the third preset value, two bytes whose consecutive two byte values ​​are the third target value and the fourth target value are retrieved between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database, and the first byte of the two bytes is determined as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value;

[0275] According to the position of the target byte, a relative offset value of the SQL statement length identification bit in the first target database sampled traffic data is determined.

[0276] That is to say, after determining the SQL statement length in each Oracle sampled traffic data, the SQL statement length identification bit in each Oracle sampled traffic data can be determined based on the determined SQL statement length value, that is, the byte bit in which the byte value matches the SQL statement length value is determined, and the relative offset value of the SQL statement length identification bit can be determined based on the position of the SQL statement length identification byte in each Oracle sampled traffic data.

[0277] Specifically, when it is determined that the length of the SQL statement in the first Oracle sampling traffic data is k, it can be determined first whether the value of k is greater than a third preset value. The third preset value can be determined based on the value range that can be stored in a byte. For example, the value range that can be stored in a byte is 0 to 255, so the third preset value can be 256.

[0278] When the value of k is less than the third preset value, a byte with a value equal to k can be retrieved from the first Oracle sampled traffic data. Specifically, since the SQL statement length identifier is usually located after the target sub-function bit and before the SQL statement start bit, the target byte with a value of k can be retrieved from the q+1th byte data[q] to the q+1+jth byte data[q+j], where q can be equal to the sum of the first preset value M and the sub-function offset value, that is, when there is no sub-function offset in the first Oracle sampled traffic data, the target byte with a value of k can be retrieved from data[M] to data[M+j], and data[M+j] is the SQL statement start bit. When there is a sub-function offset in the first Oracle sampled traffic data, the target byte with a value of k can be retrieved from data[M+off5e] to data[M+off5e+j], and data[M+off5e+j] is the SQL statement start bit.

[0279] When the value of k is greater than or equal to the third preset value, the SQL statement length identifier requires two bytes to represent. The first byte stores the quotient of k divided by the third preset value, which is recorded as the third target value, and the second byte stores the remainder of k divided by the third preset value, which is recorded as the fourth target value. Therefore, the values ​​of the two bytes to be retrieved can be determined based on the value of k, and two bytes whose consecutive byte values ​​are the third target value and the fourth target value are retrieved from the first Oracle sampling traffic data. Similarly, the search can be performed from the q+1th byte data[q] to the q+1+jth byte data[q+j], and the first byte of the two retrieved bytes can be determined as the target byte.

[0280] For example, if the value of k is 123, which is less than 256, then the byte with a value of 123 can be retrieved. If the value of k is 1232, which is greater than 256, then two consecutive bytes need to be retrieved, where the first byte is the quotient 4 of 1232 divided by 256, and the second byte is the remainder 208 of 1232 divided by 256.

[0281] When the target byte is retrieved, the relative offset value of the SQL statement length identifier in the first Oracle sampled traffic data can be determined based on the offset value of the target byte. For example, when there is no sub-function offset in the first Oracle sampled traffic data, the target byte offset value retrieved is W, and the relative offset value of the SQL statement length identifier offlen can be determined to be WM. When there is a sub-function offset in the first Oracle sampled traffic data, the target byte offset value retrieved is W, and the relative offset value of the SQL statement length identifier offlen can be determined to be WM-off5e.

[0282] In this way, by retrieving the target byte whose value matches the SQL statement length in each Oracle database sampled traffic data, the relative offset value of the SQL statement length identification bit can be accurately determined according to the location of the target byte.

[0283] Optionally, the sub-function offset value constant is determined based on the sub-function offset value of each target database sampled traffic data, including:

[0284] Deduplication counting statistics are performed on the sub-function offset values ​​of each target database sampled traffic data, and the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data is determined as a sub-function offset value constant.

[0285] That is, for the Oracle sampling traffic data set {data1, data2, ..., data n}, after determining the sub-function offset value of each Oracle sampling traffic data, the sub-function offset value set {off5e1,off5e2,…,off5e n}, by performing deduplication counting on the values ​​in the set, different sub-function offset values ​​and their counts can be obtained, and the sub-function offset value with the highest count can be recorded as the sub-function offset value constant OFF_5E to ensure that the sub-function offset value constant can cover the sub-function offset values ​​in most traffic data.

[0286] Optionally, the determining the relative offset value range of the start bit of the SQL statement based on the relative offset value of the start bit of the SQL statement in each target database sampled traffic data includes:

[0287] Perform deduplication counting on the relative offset value of the start position of the SQL statement in each target database sampled traffic data to obtain P different relative offset values ​​of the start position of the SQL statement, and determine the count corresponding to the relative offset value of the start position of each SQL statement, where P is a positive integer less than or equal to N;

[0288] Sorting the relative offset values ​​of the P different SQL statement start positions according to the size of the values ​​to obtain a sorted set of relative offset values ​​of the SQL statement start positions;

[0289] According to a preset extraction ratio threshold, determining a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold;

[0290] The relative offset value range of the start position of the SQL statement is determined according to the maximum relative offset value and the minimum relative offset value in the minimum relative offset value subset.

[0291] That is, for the Oracle sampling traffic data set {data1, data2, ..., data n}, after determining the relative offset value of the start position of the SQL statement in each Oracle sampling traffic data, the relative offset value set of the start position of the SQL statement {offsql1,offsql2,…,offsql n By performing deduplication counting on the values ​​in the set, we can obtain the relative offset values ​​of the starting positions of different SQL statements and their counts. The relative offset value of the starting position of each SQL statement and its count can be recorded as a tuple A i =(a i ,c i), a represents the relative offset value of the start position of the SQL statement, and c represents the count. These tuples can be sorted by value size. For example, sorting by value from small to large can obtain a set of SQL statement relative offset value count tuples {A1, A2, ..., A t}, where t is less than or equal to n.

[0292] Then, based on a preset extraction ratio threshold, a minimum relative offset value subset in which the sum of counts in the relative offset value set is greater than a target count value can be determined, wherein the target count value is the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold, wherein the extraction ratio threshold can be set to ensure retrieval speed and reduce resource consumption, and specifically, a suitable threshold can be set through multiple tests, for example, it can be defined as 80%, and the test result offset value range is not greater than 10.

[0293] Specifically, after sorting the tuples in ascending order of value, we obtain the SQL statement relative offset value count tuple set {A1, A2, ..., A t}, you can start from A1 and search in order to find the columns that meet the formula The relative offset value subset is , V is the extraction ratio threshold, for example, It is possible to first determine whether c1 divided by C is greater than or equal to V. If so, record the relative offset value subset {A1} and stop searching for the relative offset value subset that satisfies the formula from A1. Otherwise, continue to determine whether c1+c2 divided by C is greater than or equal to V. If so, record the relative offset value subset {A1, A2} and stop searching for the relative offset value subset that satisfies the formula from A1. Otherwise, continue to determine whether c1+c2+c3 divided by C is greater than or equal to V. In a similar manner, determine the relative offset value subset that satisfies the formula and contains the least number of relative offset values ​​retrieved from A1. Then, start searching for the relative offset value subset that satisfies the formula and contains the least number of relative offset values ​​from A2 until the relative offset value subset that satisfies the formula and contains the least number of relative offset values ​​is retrieved. t The search is completed. Then, based on the recorded relative offset value subsets, determine the relative offset value subset with the smallest relative offset value range, that is, a v -a u The relative offset value subset with the smallest difference, where a v is the maximum value in the relative offset value subset, a u is the minimum value in the relative offset value subset.

[0294] Assume that the minimum relative offset value subset is {a u ,a u+1 ,……,a v}, then the minimum offset value extracted by the SQL statement can be recorded as OFF_SQL_MIN = a u , the maximum is OFF_SQL_MAX = a v , that is, the relative offset value range of the start position of the SQL statement is from OFF_SQL_MIN to OFF_SQL_MAX.

[0295] In this way, through this implementation, the offset value range of the extracted SQL statement can be determined, and a faster search speed can be achieved when the start position of the SQL statement is subsequently searched, thereby reducing resource consumption.

[0296] Optionally, the determining of the relative offset value constant of the SQL statement length identification bit based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data includes:

[0297] Deduplication counting is performed on the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data, and the relative offset value of the SQL statement length identification bit with the highest count among the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data is determined as the relative offset value constant of the SQL statement length identification bit.

[0298] That is, for the Oracle sampling traffic data set {data1, data2, ..., data n}, after determining the relative offset value of the SQL statement length identifier in each Oracle sampled traffic data, the relative offset value set of the SQL statement length identifier {offlen1,offlen2,…,offlen n By performing deduplication counting on the values ​​in the set, different relative offset values ​​of SQL statement length identifiers and their counts can be obtained, and the relative offset value of the SQL statement length identifier with the highest count can be recorded as the relative offset value constant OFF_LEN of the SQL statement length identifier, so as to ensure that the relative offset value constant of the SQL statement length identifier can cover the relative offset values ​​of the SQL statement length identifier in most of the traffic data.

[0299] Optionally, the determining of the relative offset value constant of the SQL statement length identification bit based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data includes:

[0300] Deduplication counting is performed on the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data, and the relative offset value of the SQL statement length identification bit with the highest count among the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data is determined as the relative offset value constant of the SQL statement length identification bit.

[0301] That is, for the Oracle sampling traffic data set {data1, data2, ..., data n}, after determining the relative offset value of the SQL statement length identifier in each Oracle sampled traffic data, the relative offset value set of the SQL statement length identifier {offlen1,offlen2,…,offlen n By performing deduplication counting on the values ​​in the set, different relative offset values ​​of SQL statement length identifiers and their counts can be obtained, and the relative offset value of the SQL statement length identifier with the highest count can be recorded as the relative offset value constant OFF_LEN of the SQL statement length identifier, so as to ensure that the relative offset value constant of the SQL statement length identifier can cover the relative offset values ​​of the SQL statement length identifier in most of the traffic data.

[0302] Step 103: extract the SQL statement from the target database traffic data to be parsed according to the length and starting position of the SQL statement, and obtain the SQL statement content in the target database traffic data to be parsed.

[0303] Then, the SQL statement can be extracted from the Oracle traffic data to be parsed according to the determined length and starting position of the SQL statement. Specifically, the ending position of the SQL statement can be determined based on the length and starting position of the SQL statement, and then the content between the starting position and the ending position of the SQL statement extracted from the Oracle traffic data to be parsed is obtained to obtain the SQL statement content in the Oracle traffic data to be parsed. The extracted SQL statement content can be used by the enterprise for data access auditing.

[0304] Optionally, step 102 includes:

[0305] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0306] Obtain a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed;

[0307] If the third combined value is the first target value, then according to the relative offset value constant OFF_LEN of the SQL statement length identification bit, the value of the M+OFF_LENth byte in the target database traffic data to be parsed is obtained to obtain the number of SQL statement length identification bits;

[0308] According to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit, the length of the SQL statement in the target database traffic data to be parsed is obtained;

[0309] Retrieving a SQL statement start identifier from the target database traffic data to be parsed according to the relative offset value range of the SQL statement start position;

[0310] If the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, then determine whether the M+rth byte is the starting position of the SQL statement, where r is a positive integer;

[0311] If it is determined that the M+rth byte is the starting position of the SQL statement, then the starting position of the SQL statement in the target database traffic data to be parsed is determined to be the M+rth byte.

[0312] The content of each byte of the Oracle traffic data to be parsed is represented in the form of data[off], where off represents the offset. For example, the content offset of the first byte is 0, which is represented by data[0], that is, data[0] = byte1, data[1] = byte2, and data[n-1] = byte n .

[0313] That is, after obtaining the Oracle traffic data to be parsed, the offset off can be assigned to the first preset value M. The value of M is the same as the M value used when parsing the Oracle sampled traffic data. It can also be determined based on the offset value of the target sub-function byte when there is no sub-function offset. For example, the value of the 11th byte data

[10] and the 12th byte data

[11] is 0x035E, which is the target sub-function byte. Then, the value of the first preset value M can be determined to be 12, that is, the SQL statement length identifier and the SQL statement start bit are subsequently retrieved starting from the 13th byte data

[12] .

[0314] Specifically, the combined value of the M-1th byte and the Mth byte in the Oracle traffic data to be parsed can be obtained first, recorded as the third combined value. After obtaining, it can be determined whether the third combined value is the first target value. The first target value can be a target sub-function value. For example, M=12, the first target value is 0x035E, then the combined value of the data

[10] and data

[11] bytes can be obtained to determine whether it is 0x035E.

[0315] If the third combination value is the first target value, the SQL statement length identification bit can be obtained by obtaining the value of the M+OFF_LENth byte, i.e., data[M+OFF_LEN-1], in the Oracle traffic data to be parsed based on the relative offset value constant OFF_LEN of the SQL statement length identification bit in the SQL statement extraction feature value, wherein the byte data[M+OFF_LEN] is the SQL statement length identification bit, and the byte before the SQL statement length identification bit stores the SQL statement length identification bit. Therefore, the SQL statement length identification bit can be obtained by obtaining the value of the byte data[M+OFF_LEN-1]. The SQL statement length identification bit is 1 or 2. For example, when the SQL statement length in the Oracle traffic data to be parsed is less than 256, the SQL statement length identification bit is 1 bit, and when the SQL statement length in the Oracle traffic data to be parsed is greater than or equal to 256, the SQL statement length identification bit is 2 bits.

[0316] Then, the length of the SQL statement in the Oracle traffic data to be parsed can be obtained based on the obtained number of SQL statement length identification bits and the relative offset value constant of the SQL statement length identification bit. Specifically, if the number of SQL statement length identification bits is 1, the value of the M+OFF_LEN+1th byte, i.e., data[M+OFF_LEN], can be obtained to obtain the length of the SQL statement in the Oracle traffic data to be parsed. The byte data[M+OFF_LEN] stores the length value of the SQL statement; if the number of SQL statement length identification bits is 2, the values ​​of the M+OFF_LEN+1th byte, i.e., data[M+OFF_LEN] and the M+OFF_LEN+2th byte, i.e., data[M+OFF_LEN+1], can be obtained, and the length of the SQL statement = data[M+OFF_LEN]×256+data[M+OFF_LEN+1].

[0317] Next, the SQL statement start identifier can be retrieved from the Oracle traffic data to be parsed according to the relative offset value range of the SQL statement start bit in the SQL statement extraction feature value. Specifically, the SQL statement start identifier can be retrieved from the M+OFF_SQL_MIN+1 byte data[M+OFF_SQL_MIN], and the search range is data[M+OFF_SQL_MIN] to data[M+OFF_SQL_MAX], wherein OFF_SQL_MIN is the minimum relative offset value of the SQL statement start bit, and OFF_SQL_MAX is the maximum relative offset value of the SQL statement start bit. The SQL statement start identifier can include three types, one is the combined value of two consecutive bytes of 0xFE40, the second is the SQL statement length value when the SQL statement length identification bit is 1 (that is, the first bit before the SQL statement start bit is the SQL statement length identification bit), and the third is the value of multiple consecutive bytes of 0x00, but the next byte is a visible character.

[0318] Assuming that the M+r-1th byte data[M+r-2] in the Oracle traffic data to be parsed is retrieved as the SQL statement start identifier, it can be further determined whether the next byte of the SQL statement start identifier, that is, the M+rth byte data[M+r-1], is the starting position of the SQL statement. The specific determination method can be referred to the SQL statement starting position determination method used when parsing Oracle sample traffic data introduced in the aforementioned implementation method, which will not be repeated here.

[0319] If it is determined that the M+rth byte data[M+r-1] is the starting position of the SQL statement, then it can be determined that the starting position of the SQL statement in the Oracle traffic data to be parsed is the M+rth byte data[M+r-1].

[0320] In this way, through this implementation, the feature value can be extracted based on the SQL statement, and the SQL statement length identifier and the SQL statement starting position in the Oracle traffic data to be parsed can be quickly retrieved, and then the SQL statement length and the SQL statement starting position in the Oracle traffic data to be parsed can be quickly determined.

[0321] Furthermore, after obtaining the third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed, the method further includes:

[0322] If the third combined value is the second target value, the value of M is updated to M+OFF_5E according to the sub-function offset value constant OFF_5E, and the step of obtaining the value of the M+OFF_LENth byte in the target database traffic data to be parsed is executed.

[0323] That is, when the third combination value of the M-1th byte and the Mth byte in the Oracle traffic data to be parsed is not the first target value but the second target value, it can be determined that there is a sub-function offset in the Oracle traffic data, so the sub-function offset value constant OFF_5E in the feature value can be extracted according to the SQL statement, and after updating the offset, the aforementioned implementation method is used to quickly retrieve the SQL statement length identification bit and the SQL statement start bit in the Oracle traffic data to be parsed. That is, the offset is updated to M+OFF_5E, and then the value of the M+OFF_5E+OFF_LENth byte in the Oracle traffic data to be parsed is obtained to obtain the SQL statement length identification bit, and the SQL statement start identifier can be retrieved from the M+OFF_5E+OFF_SQL_MIN+1th byte data[M+OFF_5E+OFF_SQL_MIN] to data[M+OFF_5E+OFF_SQL_MAX] in the Oracle traffic data to be parsed according to the relative offset value range of the SQL statement start bit to determine the SQL statement start position.

[0324] In this way, when there is a sub-function offset in the Oracle traffic data to be parsed, by extracting the sub-function offset value constant in the feature value based on the SQL statement, the SQL statement length identifier and the SQL statement start position can be quickly and accurately retrieved, and then the SQL statement length and SQL statement start position in the Oracle traffic data to be parsed can be quickly determined.

[0325] Furthermore, the step 103 includes:

[0326] The contents from the M+rth byte to the M+r+w-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, wherein w is the length of the SQL statement in the target database traffic data to be parsed.

[0327] When it is determined that the starting position of the SQL statement in the Oracle traffic data to be parsed is the M+rth byte and the length of the SQL statement is w, the content between the M+rth byte data[M+r-1] and the M+r+w-1th byte data[M+r+w-1] can be directly extracted from the Oracle traffic data to be parsed to obtain the SQL statement content in the Oracle traffic data to be parsed.

[0328] In this way, based on the determined starting position and length information of the SQL statement, the SQL statement content can be quickly and accurately extracted from the Oracle traffic data to be parsed.

[0329] Furthermore, the method further comprises:

[0330] If the number of bits of the SQL statement length identifier is not the fifth target value, or the SQL statement start identifier is not retrieved, or it is determined that the M+rth byte is not the starting position of the SQL statement, it is confirmed that the SQL statement extraction has failed.

[0331] In the process of extracting SQL statements from the Oracle traffic data to be parsed according to the SQL statement extraction feature value, there may be a case where the extraction fails. For example, when the number of SQL statement length identifier bits obtained is not the fifth target value, such as not 1 or 2, it can be determined that the extraction fails in this way, or when the SQL statement start identifier is not retrieved between data[M+OFF_SQL_MIN] and data[M+OFF_SQL_MAX] or between data[M+OFF_5E+OFF_SQL_MIN] and data[M+OFF_5E+OFF_SQL_MAX], it can also be determined that the extraction fails in this way, or when it is determined that the M+rth byte is not the starting position of the SQL statement, it is also determined that the extraction fails in this way. When the extraction fails, an extraction failure prompt can be output to prompt the user that the Oracle traffic data has not been parsed successfully.

[0332] In this way, by confirming that the extraction fails in these cases, it is possible to avoid the parsing process of the Oracle traffic data to be parsed from falling into an endless loop.

[0333] Optionally, after confirming that the SQL statement extraction fails, the method further includes:

[0334] Starting from the M+o+1th byte in the target database traffic data to be parsed, search whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are preset characters, where o is the minimum value of the preset search offset range, o is a positive integer, L is a positive integer, and the initial value of s is 0;

[0335] If the M+o+1+sth byte retrieved is not the preset character, or the L bytes after the M+o+1+sth byte are not the preset character, then the value of s is increased by 1, and the above steps of searching whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character are repeated, until the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, or o+s=O, O is the maximum value of the preset search offset range, and O is an integer greater than o;

[0336] If the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are found to be preset characters, then it is determined whether the M+o+1+sth byte is the starting position of the SQL statement;

[0337] If it is determined that the M+o+1+sth byte is the starting position of the SQL statement, then the M+o+1+sth byte is recorded as the starting position of the SQL statement in the target database traffic data to be parsed;

[0338] Retrieving the SQL statement end identifier starting from the M+o+1+sth byte in the target database traffic data to be parsed;

[0339] If the Tth byte in the target database traffic data to be parsed is retrieved as an SQL statement end identifier, then the contents from the M+o+1+sth byte to the T-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, where T is an integer greater than M+o+1+s.

[0340] In this implementation, when it is confirmed that the extraction fails, another SQL extraction process can be entered to ensure that the SQL statement can be successfully extracted for each piece of Oracle traffic data to be parsed.

[0341] Specifically, a search offset range can be predefined, assuming it is o~O, where o is the minimum search offset value and O is the maximum search offset value. The value of O is not greater than the difference between the total length of the Oracle traffic data and the first preset value M. If the value of O is too large, the search range will increase, affecting the search efficiency. If it is too small, there may be omissions. For example, it can be defined as around 400. The value of o can be less than or equal to the minimum SQL statement starting position relative offset value a1 calculated when parsing the Oracle sampled traffic data. If the value is too small, the search range will increase, affecting the search efficiency. If it is too large, there may be omissions. For example, it can be defined as a1-10.

[0342] Then, according to the predefined search offset range, the offset off can be assigned to M+o, and continuous preset characters such as letters can be retrieved starting from the M+o+1th byte data[M+o] in the Oracle traffic data to be parsed. Specifically, the bytes whose ASCII codes corresponding to multiple consecutive byte values ​​are preset characters can be retrieved, that is, the bytes data[M+o] and the L (such as 2) bytes after data[M+o] can be first retrieved to see if they are preset characters (at this time s=0). If so, it can be determined that data[M+o] may be the starting position of the SQL statement; if the retrieved data[M+o] or the L bytes after data[M+o] are not preset characters, the offset value can be increased by 1 (that is, s=0+1), and the next byte and the L bytes after it can be retrieved to see if they are preset characters, until the retrieved L+1 consecutive bytes are all preset characters.

[0343] It should be noted that, when the combined value of the M-1th byte data[M-2] and the Mth byte data[M-1] is the second target value, it indicates that there is a sub-function offset. At this time, the byte whose combined value of two consecutive bytes is the first target value can be retrieved starting from data[M]. Assuming that the retrieved value of data[M+i] is 0x03, and the value of data[M+i+1] is 0x5E, the offset can be updated to M+i+2+o (i.e., M is replaced by M+i+2) to retrieve consecutive preset characters starting from the byte data[M+i+2+o] in the Oracle traffic data to be parsed. The specific retrieval method is similar to the above and will not be repeated here.

[0344] Assuming that the retrieved byte data[M+o+s] and the L bytes after data[M+o+s] are all preset characters, it can be further determined whether data[M+o+s] is the starting position of the SQL statement. The specific determination method can be referred to the SQL statement starting position determination method used when parsing Oracle sampled traffic data described in the aforementioned implementation method, which will not be repeated here.

[0345] In the case where it is determined that the byte data[M+o+s] is the starting position of the SQL statement, data[M+o+s] can be recorded as the starting position of the SQL statement in the Oracle traffic data to be parsed, and the SQL statement end identifier can be retrieved from data[M+o+s] in the Oracle traffic data to be parsed, such as the byte with the search value 0x00 or 0x01, wherein the offset value is increased by 1 for each byte retrieved. It should be noted that, in the case where it is determined that the byte data[M+o+s] is not the starting position of the SQL statement, the offset value can be updated to increase to the length of the separator when parsing the Oracle sampled traffic data as described in the aforementioned implementation mode, and the bytes that may be the starting position of the SQL statement are continued to be retrieved until the starting position of the SQL statement is retrieved. The specific implementation mode can be referred to the aforementioned introduction, and will not be described in detail here.

[0346] If the Tth byte in the Oracle traffic data to be parsed is retrieved as the SQL statement end identifier, the SQL statement start bit, that is, the M+o+1+sth byte data[M+o+s], to the SQL statement end bit, that is, the T-1th byte data[T-2], can be extracted from the Oracle traffic data to be parsed as the SQL statement content.

[0347] In this way, through this implementation, it can be ensured that when the extraction of the SQL statement from the Oracle traffic data to be parsed fails based on the feature value extracted from the SQL statement, the SQL statement content in the Oracle traffic data to be parsed can be extracted by retrieving the SQL statement. Through the complementary combination of these two extraction methods, it can be ensured that the SQL statement can be successfully extracted for the Oracle traffic data in different scenarios.

[0348] Combine the following Figure 4 , Figure 5 and Figure 6 , the process of extracting SQL statements from Oracle traffic data to be parsed described in the above implementation mode is illustrated by way of example:

[0349] in Figure 5 The process of extracting feature values ​​according to SQL statements is as follows:

[0350] Step 51: Assign the offset off to 12.

[0351] Step 52: Obtain the function and sub-function value func of the TNS protocol content in the Oracle traffic data to be parsed, which is the combined value of the data

[10] and data

[11] bytes.

[0352] Step 53, determine whether func is 0x035E, if so, go to step 56, otherwise go to step 54.

[0353] Step 54, determine whether func is 0x1169, if so, go to step 55.

[0354] Step 55: Update the value of off to off+OFF_5E, where OFF_5E is the sub-function offset value constant in the feature value extracted from the SQL statement.

[0355] Step 56, obtain the number of bits of the SQL statement length identifier, that is, obtain the value of data[off+OFF_LEN-1], and determine whether the bit value is 1 or 2. If so, proceed to step 57, otherwise proceed to step 512. Among them, OFF_LEN is the relative offset value constant of the SQL statement length identifier in the SQL statement extraction feature value.

[0356] Step 57: Obtain the length sqlLen of the SQL statement according to the bit value of the SQL statement length. Specifically, if the bit value is 1, then sqlLen=data[off+OFF_LEN]; if the bit value is 2, then sqlLen=data[off+OFF_LEN]×256+data[off+OFF_LEN+1].

[0357] Step 58: Retrieve the SQL statement start identifier from data[off+OFF_SQL_MIN] to data[off+OFF_SQL_MAX], where OFF_SQL_MIN and OFF_SQL_MAX are respectively the minimum value and the maximum value in the relative offset value range of the SQL statement start bit in the SQL statement extraction feature value.

[0358] Step 59, determine whether the SQL statement start identifier is retrieved, if so, go to step 510, otherwise go to step 512.

[0359] Step 510: Assume that data[off+i] is the first byte after the retrieved SQL statement start identifier, update the offset off to off+i, and proceed to Figure 4 The process of the SQL keyword judgment module shown in the figure judges whether the offset is the starting position of the SQL statement, wherein if the judgment result is true, the process proceeds to step 511, and if the judgment result is false, the process proceeds to step 512.

[0360] Step 511: record the current offset off as the starting offset value sqlstart of the SQL statement, and extract the content of the interval from data[sqlstart] to data[sqlstart+sqlLen] as the SQL statement.

[0361] Step 512: Confirm that the extraction failed and proceed to Figure 6 The SQL statement shown retrieves the extraction process.

[0362] in Figure 6 The SQL statement retrieval and extraction process shown is as follows:

[0363] Step 61: Assign the offset off to 12.

[0364] Step 62: Define the maximum retrieval relative offset O and the minimum retrieval relative offset o.

[0365] Step 63: Obtain the function and sub-function value func of the TNS protocol content in the Oracle traffic data to be parsed, which is the combined value of the data

[10] and data

[11] bytes.

[0366] Step 64, determine whether func is 0x035E, if so, go to step 68, otherwise go to step 65.

[0367] Step 65, determine whether func is 0x1169, if so, go to step 67.

[0368] Step 66: Starting from data[off], within a certain range (eg, 12 bytes), search for the position where two consecutive bytes are 0x03 and 0x5E in the subsequent content.

[0369] Step 67: Assuming that the retrieved data[off+i] value is 0x03 and the data[off+i+1] value is 0x5E, the offset off value is updated to off+i+2. If not retrieved, the data is ignored, that is, the parsing of the data is abandoned.

[0370] Step 68: Update the offset off value to off+o.

[0371] Step 69, starting from data[off], searching for letters (i.e. searching whether the value of the byte is a-z or A-Z after being converted into ACSII code) until data[off+O].

[0372] Step 610: If the retrieved data[off+j] is a letter and the subsequent two bytes are also letters, go to step 612; otherwise, go to step 611.

[0373] Step 611, assign off to off+j+1, and repeat the previous step 69.

[0374] Step 612: Update the offset off to off+j, and proceed to Figure 4 The process of the SQL keyword judgment module shown determines whether the offset is the starting position of the SQL statement.

[0375] Step 613: If the judgment result is false, update off to off + separator offset (if Figure 4 If no separator is found in the process, off is updated to off+g) and the process returns to step 69.

[0376] Step 614: If the judgment result is true, the current offset off is recorded as the SQL statement starting offset value sqlstart.

[0377] Step 615: Start searching for the SQL statement terminator (such as 0x00 or 0x01) from data[off] until the end of data. Each time a byte is searched, the value of off is updated to off+1.

[0378] Step 616: Get the content from data[sqlstart] to data[off] as a SQL statement.

[0379] The data parsing method in the embodiment of the present invention obtains the target database traffic data to be parsed; extracts feature values ​​according to the pre-acquired structured query language SQL statement, and determines the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extraction feature value includes a sub-function offset value constant, a relative offset value constant of the SQL statement length identification bit, and a relative offset value range of the SQL statement starting bit; extracts the SQL statement from the target database traffic data to be parsed according to the length and starting position of the SQL statement, and obtains the SQL statement content in the target database traffic data to be parsed. In this way, by pre-acquiring the SQL statement extraction feature value, when parsing the target database traffic data, the length and starting position of the SQL statement in the target database traffic data can be determined according to the sub-function offset value constant, the relative offset value constant of the SQL statement length identification bit, and the relative offset value range of the SQL statement starting bit in the SQL statement extraction feature value, and then the SQL statement can be extracted from the target database traffic data based on the length and starting position information. This method can be applied to SQL statement parsing of target database traffic data in different scenarios.

[0380] In addition, the method in the embodiment of the present invention can not only parse the Oracle traffic generated in various scenarios, but also does not need to associate the data packets of the database connection process to obtain version information, and can also parse a single Oracle traffic data packet.

[0381] The embodiment of the present invention also provides a data analysis device. Figure 7 , Figure 7 It is a structural diagram of a data analysis device provided by an embodiment of the present invention.

[0382] The data analysis device includes two parts: a SQL statement extraction feature value calculation module 710 and a SQL statement analysis module 720. When the SQL statement extraction feature value calculation module 710 is deployed to a system or network along with the traffic analysis function, it is necessary to first run the SQL statement extraction feature value calculation module 710 to generate a SQL statement extraction feature value combination for TNS protocol analysis of the system or network. The SQL statement extraction feature value calculation module 710 includes a key field extraction submodule 711, a feature value calculation submodule 712, and a feature value storage submodule 713. The SQL statement analysis module 720 analyzes the SQL statements in all oracle traffic data after calculating the SQL statement extraction feature value, and includes a SQL statement extraction submodule 721 and a SQL statement retrieval matching submodule 722.

[0383] The function of the key field extraction submodule 711 is mainly to parse the TNS protocol for the input Oracle traffic data, extract key fields such as the function and sub-function values, the sub-function offset value from 0x1169 to 0x035E when the function and sub-function values ​​are 0x1169, the relative offset value of the start bit of the SQL statement, the length of the SQL statement, and the relative offset value of the SQL statement length identifier, and record them.

[0384] The function of the feature value calculation submodule 712 is mainly to count and calculate the key fields extracted in the key field extraction submodule 711, and generate a SQL statement extraction feature value combination for TNS protocol parsing of the system or network, including the subfunction offset value constant OFF_5E, the SQL statement extraction offset value range (i.e., the relative offset value range of the SQL statement starting position) [OFF_SQL_MIN, OFF_SQL_MAX], and the relative offset value constant OFF_LEN of the SQL statement length identifier.

[0385] The function of the eigenvalue storage submodule 712 is mainly to extract the eigenvalue combination from the SQL statement generated by the eigenvalue calculation submodule 712, and store it in combination with the system or network identifier for subsequent use.

[0386] The function of the SQL statement extraction submodule 721 is mainly to directly extract SQL statements from the Oracle traffic data that meets the offset rules. The main steps are to combine the sub-function offset value constant OFF_5E and the relative offset value constant OFF_LEN of the SQL statement length identifier to obtain the SQL statement length, extract the offset value range in combination with the SQL statement, search for the starting offset of the SQL statement that meets the rules in a small range, and extract the SQL statement content in combination with the obtained SQL statement length.

[0387] The function of the SQL statement retrieval and matching submodule 722 is mainly to obtain the SQL statement through character retrieval and matching of the Oracle traffic data that does not meet the offset rule. The main steps are to directly retrieve and match the starting offset of the SQL statement, then retrieve the end mark of the SQL statement, and extract the SQL statement content in combination with the starting offset.

[0388] The embodiment of the present invention also provides another data analysis device. Figure 8 , Figure 8 1 is a structural diagram of a data analysis device provided by an embodiment of the present invention. Since the principle of solving the problem by the data analysis device is similar to that of the data analysis method in the embodiment of the present invention, the implementation of the data analysis device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0389] like Figure 8 As shown, the data analysis device 800 includes:

[0390] The first acquisition module 801 is used to acquire the target database traffic data to be analyzed;

[0391] The first determination module 802 is used to extract feature values ​​according to the pre-acquired structured query language SQL statement, and determine the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature value includes a sub-function offset value constant, a relative offset value constant of the SQL statement length identification bit, and a relative offset value range of the SQL statement starting bit;

[0392] The extraction module 803 is used to extract the SQL statement from the target database traffic data to be parsed according to the length and starting position of the SQL statement, and obtain the SQL statement content in the target database traffic data to be parsed.

[0393] Optionally, the data analysis device 800 further includes:

[0394] A second acquisition module is used to acquire N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios;

[0395] The second determination module is used to determine the sub-function offset value of each target database sampled flow data, the relative offset value of the SQL statement start bit and the relative offset value of the SQL statement length identification bit;

[0396] A third determination module is used to determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data;

[0397] A fourth determination module, used to determine a relative offset value range of a start position of an SQL statement based on a relative offset value of a start position of an SQL statement in each target database sampled flow data;

[0398] A fifth determination module, used to determine a relative offset value constant of a SQL statement length identification bit based on a relative offset value of a SQL statement length identification bit in each target database sampled traffic data;

[0399] The sixth determination module is used to determine the sub-function offset value constant, the relative offset value range of the SQL statement start bit and the relative offset value constant of the SQL statement length identification bit as the SQL statement extraction feature value.

[0400] Optionally, the second determining module includes:

[0401] The first determination submodule is used to retrieve the target sub-function value position in each target database sampled flow data respectively, and determine the sub-function offset value of each target database sampled flow data according to the target sub-function value position in each target database sampled flow data;

[0402] The second determination submodule is used to retrieve the starting position of the SQL statement in each target database sampled traffic data respectively, and determine the relative offset value of the starting position of the SQL statement in each target database sampled traffic data according to the starting position of the SQL statement in each target database sampled traffic data;

[0403] The third determination submodule is used to retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data;

[0404] The fourth determination submodule is used to determine the relative offset value of the SQL statement length identification bit in each target database sampled traffic data according to the SQL statement length in each target database sampled traffic data.

[0405] Optionally, the second determining submodule includes:

[0406] An assignment unit, used for assigning the offset to a first preset value M, where M is an integer greater than 1;

[0407] An acquiring unit, used for acquiring a first combination value of an M-1th byte and an Mth byte in the first target database sampled traffic data, wherein the first target database sampled traffic data is any one of the N target database sampled traffic data;

[0408] a first retrieval unit, for, if the first combined value is a first target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the M+1+jth byte and L bytes after the M+1+jth byte are preset characters, where L is a positive integer and the initial value of j is 0;

[0409] The first execution unit is used for, if the M+1+jth byte is not the preset character, or the L bytes after the M+1+jth byte are not the preset character, then adding 1 to the value of j, and repeating the above step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character, until the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character;

[0410] A judging unit, configured to judge whether the M+1+jth byte is the starting position of the SQL statement if the M+1+jth byte and the L bytes after the M+1+jth byte are found to be preset characters;

[0411] The first determination unit is used to determine that the starting position of the SQL statement in the first target database sampled traffic data is the M+1+j byte if the M+1+j byte is determined to be the starting position of the SQL statement, and to determine that the relative offset value of the starting position of the SQL statement in the first target database sampled traffic data is j.

[0412] Optionally, the judging unit includes:

[0413] A search subunit, configured to start from the M+1+jth byte in the sampled traffic data of the first target database and search whether the M+1+j+gth byte is a separator, where the initial value of g is 0;

[0414] an execution subunit, configured to, if the M+1+j+g-th byte is not a separator after being retrieved, add 1 to the value of g, and repeat the above step of retrieving whether the M+1+j+g-th byte is a separator, until the M+1+j+g-th byte is a separator after being retrieved, or g is equal to a second preset value;

[0415] A processing subunit, for adding values ​​of bytes M+1+j to M+j+g to obtain a total value if the M+1+j+g byte is found to be a separator;

[0416] The judging subunit is used to judge whether the total value belongs to the value set of the SQL keyword, wherein if the total value belongs to the value set of the SQL keyword, the M+1+jth byte is determined as the starting position of the SQL statement.

[0417] Optionally, the second determining submodule further includes:

[0418] The second execution unit is used to determine that the M+1+jth byte is not the starting position of the SQL statement if the total value does not belong to the value set of the SQL keyword, or the separator is not retrieved, and update the value of j to j+g, and execute the step of retrieving whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters.

[0419] Optionally, the first determining submodule includes:

[0420] a second retrieval unit, configured to retrieve, starting from the Mth byte in the sampled traffic data of the first target database, whether a second combined value of the M+1+ith byte and the M+i+2th byte is the first target value if the first combined value is a second target value, wherein an initial value of i is 0;

[0421] a third execution unit, configured to, if the second combined value is not the first target value, add 1 to the value of i, and repeat the above step of searching whether the second combined value of the M+1+i th byte and the M+i+2 th byte is the first target value, until the second combined value is retrieved to be the first target value;

[0422] The second determination unit is used to determine the position of the target sub-function value in the first target database sampled traffic data as the M+1+ith byte if the second combined value is the first target value, and to determine the sub-function offset value of the first target database sampled traffic data as i+2.

[0423] Optionally, the first determining submodule further includes:

[0424] The fourth execution unit is used to update the value of M to M+i+2, and execute the step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters.

[0425] Optionally, the third determining submodule includes:

[0426] a third retrieval unit, configured to retrieve whether the M+1+j+kth byte is an end identifier of the SQL statement starting from the M+1+jth byte in the sampled traffic data of the first target database if it is determined that the M+1+jth byte is the starting position of the SQL statement, where the initial value of k is 0;

[0427] a fifth execution unit, configured to, if the M+1+j+kth byte retrieved is not the end identifier of the SQL statement, increase the value of k by 1, and repeat the above-mentioned search for whether the M+1+j+kth byte is the end identifier of the SQL statement, until the M+1+j+kth byte retrieved is the end identifier of the SQL statement;

[0428] The third determination unit is used to determine that the end position of the SQL statement in the sampled traffic data of the first target database is the M+1+j+k byte if the M+1+j+k byte is retrieved as the end identifier of the SQL statement, and determine that the length of the SQL statement in the sampled traffic data of the first target database is k.

[0429] Optionally, the fourth determining submodule includes:

[0430] a fourth retrieval unit, configured to, when determining that the SQL statement length in the sampled traffic data of the first target database is k, retrieve a target byte whose value is k between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database if the value of k is less than a third preset value, wherein q is equal to the sum of the first preset value and the sub-function offset value of the sampled traffic data of the first target database;

[0431] a fifth retrieval unit, for retrieving two bytes whose consecutive two byte values ​​are respectively a third target value and a fourth target value between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database if the value of k is greater than or equal to a third preset value, and determining the first byte of the two bytes as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value;

[0432] The fourth determining unit is used to determine the relative offset value of the SQL statement length identification bit in the first target database sampled traffic data according to the position of the target byte.

[0433] Optionally, the third determination module is used to perform deduplication counting statistics on the sub-function offset values ​​of each target database sampled traffic data, and determine the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data as the sub-function offset value constant.

[0434] Optionally, the fourth determining module includes:

[0435] A fifth determination submodule is used to perform deduplication counting statistics on the relative offset value of the starting position of the SQL statement in each target database sampled traffic data, obtain P different relative offset values ​​of the starting position of the SQL statement, and determine the count corresponding to the relative offset value of the starting position of each SQL statement, where P is a positive integer less than or equal to N;

[0436] A sorting submodule, used to sort the relative offset values ​​of the starting positions of the P different SQL statements according to the size of the values, to obtain a sorted set of relative offset values ​​of the starting positions of the SQL statements;

[0437] a sixth determination submodule, configured to determine, according to a preset extraction ratio threshold, a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold;

[0438] The seventh determination submodule is used to determine the relative offset value range of the start position of the SQL statement according to the maximum relative offset value and the minimum relative offset value in the minimum relative offset value subset.

[0439] Optionally, the fifth determination module is used to perform deduplication counting statistics on the relative offset values ​​of the SQL statement length identifier in each target database sampled traffic data, and determine the relative offset value of the SQL statement length identifier with the highest count among the relative offset values ​​of the SQL statement length identifier in each target database sampled traffic data as the relative offset value constant of the SQL statement length identifier.

[0440] Optionally, the first determining module 802 includes:

[0441] An assignment submodule, used for assigning the offset to a first preset value M, where M is an integer greater than 1;

[0442] A first acquisition submodule is used to acquire a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed;

[0443] A second acquisition submodule is used for acquiring the value of the M+OFF_LENth byte in the target database traffic data to be parsed according to the relative offset value constant OFF_LEN of the SQL statement length identification bit if the third combination value is the first target value, so as to obtain the number of SQL statement length identification bits;

[0444] A third acquisition submodule is used to acquire the length of the SQL statement in the target database traffic data to be parsed according to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit;

[0445] A first retrieval submodule, configured to retrieve a SQL statement start identifier from the target database traffic data to be parsed according to a relative offset value range of the SQL statement start position;

[0446] The first judgment submodule is used to judge whether the M+rth byte is the starting position of the SQL statement if the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, where r is a positive integer;

[0447] The eighth determination submodule is used to determine the starting position of the SQL statement in the target database traffic data to be parsed as the M+r byte if the M+r byte is determined to be the starting position of the SQL statement.

[0448] Optionally, the first determining module 802 further includes:

[0449] The first execution submodule is used to update the value of M to M+OFF_5E according to the sub-function offset value constant OFF_5E if the third combination value is the second target value, and execute the step of obtaining the value of the M+OFF_LENth byte in the target database traffic data to be parsed.

[0450] Optionally, the extraction module 803 is used to extract the content from the M+rth byte to the M+r+w-1th byte from the target database traffic data to be parsed as the SQL statement content, wherein w is the length of the SQL statement in the target database traffic data to be parsed.

[0451] Optionally, the data analysis device 800 further includes:

[0452] The processing module is used to confirm that the SQL statement extraction fails if the number of bits of the SQL statement length identifier is not the fifth target value, or the SQL statement start identifier is not retrieved, or it is determined that the M+rth byte is not the starting position of the SQL statement.

[0453] Optionally, the processing module includes:

[0454] The second search submodule is used to search the M+o+1+sth byte and the L bytes after the M+o+1+sth byte for preset characters starting from the M+o+1th byte in the target database traffic data to be parsed, where o is the minimum value of the preset search offset range, o is a positive integer, L is a positive integer, and the initial value of s is 0;

[0455] The second execution submodule is used for, if the M+o+1+sth byte is not the preset character, or the L bytes after the M+o+1+sth byte are not the preset character, then adding 1 to the value of s, and repeating the above step of searching whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, until the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, or o+s=O, O is the maximum value of the preset search offset range, and O is an integer greater than o;

[0456] The second judgment submodule is used to judge whether the M+o+1+sth byte is the starting position of the SQL statement if the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset characters;

[0457] A recording submodule, for recording the M+o+1+sth byte as the starting position of the SQL statement in the target database traffic data to be parsed if the M+o+1+sth byte is determined to be the starting position of the SQL statement;

[0458] A third retrieval submodule is used to retrieve the SQL statement end identifier starting from the M+o+1+sth byte in the target database traffic data to be parsed;

[0459] The extraction submodule is used to extract the contents from the M+o+1+sth byte to the T-1th byte from the target database traffic data to be parsed as the SQL statement content if the Tth byte in the target database traffic data to be parsed is retrieved as the SQL statement end identifier, wherein T is an integer greater than M+o+1+s.

[0460] The data analysis device provided in the embodiment of the present invention can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated in this embodiment.

[0461] The data parsing device 800 of the embodiment of the present invention obtains SQL statement extraction feature values ​​in advance, so that when parsing the target database traffic data, it can determine the length and starting position of the SQL statement in the target database traffic data based on the sub-function offset value constant, the relative offset value constant of the SQL statement length identification bit and the relative offset value range of the SQL statement starting bit in the SQL statement extraction feature value, and then can extract the SQL statement from the target database traffic data based on the length and starting position information. This method can be applied to SQL statement parsing of target database traffic data in different scenarios.

[0462] The embodiment of the present invention also provides a data analysis device. Since the principle of solving the problem by the data analysis device is similar to that of the data analysis method in the embodiment of the present invention, the implementation of the data analysis device can refer to the implementation of the method, and the repeated parts will not be repeated. Fig. 9 As shown, the data parsing device of the embodiment of the present invention includes: a processor 900, which is used to read the program in the memory 910 and execute the following process:

[0463] Obtain the traffic data of the target database to be analyzed;

[0464] Extracting feature values ​​according to the structured query language SQL statement acquired in advance, determining the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature values ​​include a sub-function offset value constant, a relative offset value constant of the SQL statement length identification bit, and a relative offset value range of the SQL statement starting bit;

[0465] According to the length and the starting position of the SQL statement, the SQL statement is extracted from the target database traffic data to be parsed, and the SQL statement content in the target database traffic data to be parsed is obtained.

[0466] Among them, Fig. 9 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 900 and memory represented by memory 910. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The processor 900 is responsible for managing the bus architecture and general processing, and the memory 910 may store data used by the processor 900 when performing operations.

[0467] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0468] Obtaining N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios;

[0469] Determine the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit;

[0470] Determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data;

[0471] Determine the relative offset value range of the start position of the SQL statement based on the relative offset value of the start position of the SQL statement in each target database sampled traffic data;

[0472] Based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data, determine the relative offset value constant of the SQL statement length identification bit;

[0473] The sub-function offset value constant, the relative offset value range of the SQL statement start bit and the relative offset value constant of the SQL statement length identification bit are determined as the SQL statement extraction feature value.

[0474] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0475] Retrieve the target sub-function value position in each target database sampled traffic data respectively, and determine the sub-function offset value of each target database sampled traffic data according to the target sub-function value position in each target database sampled traffic data;

[0476] Retrieve the starting position of each SQL statement in the sampled traffic data of the target database respectively, and determine the relative offset value of the starting position of each SQL statement in the sampled traffic data of the target database according to the starting position of each SQL statement in the sampled traffic data of the target database;

[0477] Retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data;

[0478] According to the length of the SQL statement in each target database sampled traffic data, the relative offset value of the SQL statement length identification bit in each target database sampled traffic data is determined.

[0479] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0480] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0481] Obtaining a first combination value of the M-1th byte and the Mth byte in the first target database sampled traffic data, wherein the first target database sampled traffic data is any one of the N target database sampled traffic data;

[0482] If the first combination value is the first target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters, where L is a positive integer and the initial value of j is 0;

[0483] If the M+1+jth byte is not the preset character, or the L bytes after the M+1+jth byte are not the preset character, then add 1 to the value of j, and repeat the above steps of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character, until the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character;

[0484] If the M+1+jth byte and the L bytes after the M+1+jth byte are found to be preset characters, then it is determined whether the M+1+jth byte is the starting position of the SQL statement;

[0485] If the M+1+jth byte is determined to be the starting position of the SQL statement, then the starting position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+jth byte, and the relative offset value of the starting position of the SQL statement in the first target database sampled traffic data is determined to be j.

[0486] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0487] Starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+gth byte is a separator, where the initial value of g is 0;

[0488] If the M+1+j+g-th byte is not a separator, the value of g is increased by 1, and the above step of searching whether the M+1+j+g-th byte is a separator is repeated until the M+1+j+g-th byte is a separator, or g is equal to the second preset value;

[0489] If the M+1+j+gth byte is retrieved as a separator, then add the values ​​of the M+1+jth byte to the M+j+gth byte to get the total value;

[0490] It is determined whether the total value belongs to the value set of the SQL keyword, wherein if the total value belongs to the value set of the SQL keyword, the M+1+jth byte is determined as the starting position of the SQL statement.

[0491] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0492] If the total value does not belong to the value set of the SQL keyword, or the separator is not retrieved, it is determined that the M+1+jth byte is not the starting position of the SQL statement, and the value of j is updated to j+g, and the step of retrieving whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is executed.

[0493] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0494] If the first combination value is the second target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the second combination value of the M+1+ith byte and the M+i+2th byte is the first target value, and the initial value of i is 0;

[0495] If the second combined value is not the first target value, the value of i is increased by 1, and the above steps of searching whether the second combined value of the M+1+i th byte and the M+i+2 th byte is the first target value are repeated until the second combined value is retrieved to be the first target value;

[0496] If the second combined value is the first target value, the target sub-function value position in the first target database sampled traffic data is determined to be the M+1+ith byte, and the sub-function offset value of the first target database sampled traffic data is determined to be i+2.

[0497] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0498] The value of M is updated to M+i+2, and the step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is performed.

[0499] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0500] If it is determined that the M+1+jth byte is the starting position of the SQL statement, then starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+kth byte is the end identifier of the SQL statement, and the initial value of k is 0;

[0501] If the M+1+j+kth byte retrieved is not the end identifier of the SQL statement, the value of k is increased by 1, and the above retrieval is repeated to determine whether the M+1+j+kth byte is the end identifier of the SQL statement, until the M+1+j+kth byte is retrieved to be the end identifier of the SQL statement;

[0502] If the M+1+j+kth byte is retrieved as the end identifier of the SQL statement, the end position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+j+kth byte, and the length of the SQL statement in the first target database sampled traffic data is determined to be k.

[0503] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0504] In the case where it is determined that the length of the SQL statement in the first target database sampled traffic data is k, if the value of k is less than a third preset value, a target byte whose value is k is retrieved between the q+1th byte and the q+1+jth byte in the first target database sampled traffic data, wherein q is equal to the sum of the first preset value and the sub-function offset value of the first target database sampled traffic data;

[0505] If the value of k is greater than or equal to the third preset value, two bytes whose consecutive two byte values ​​are the third target value and the fourth target value are retrieved between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database, and the first byte of the two bytes is determined as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value;

[0506] According to the position of the target byte, a relative offset value of the SQL statement length identification bit in the first target database sampled traffic data is determined.

[0507] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0508] Deduplication counting statistics are performed on the sub-function offset values ​​of each target database sampled traffic data, and the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data is determined as a sub-function offset value constant.

[0509] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0510] Perform deduplication counting on the relative offset value of the start position of the SQL statement in each target database sampled traffic data to obtain P different relative offset values ​​of the start position of the SQL statement, and determine the count corresponding to the relative offset value of the start position of each SQL statement, where P is a positive integer less than or equal to N;

[0511] Sorting the relative offset values ​​of the P different SQL statement start positions according to the size of the values ​​to obtain a sorted set of relative offset values ​​of the SQL statement start positions;

[0512] According to a preset extraction ratio threshold, determining a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold;

[0513] The relative offset value range of the start position of the SQL statement is determined according to the maximum relative offset value and the minimum relative offset value in the minimum relative offset value subset.

[0514] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0515] Deduplication counting is performed on the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data, and the relative offset value of the SQL statement length identification bit with the highest count among the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data is determined as the relative offset value constant of the SQL statement length identification bit.

[0516] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0517] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0518] Obtain a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed;

[0519] If the third combined value is the first target value, then according to the relative offset value constant OFF_LEN of the SQL statement length identification bit, the value of the M+OFF_LENth byte in the target database traffic data to be parsed is obtained to obtain the number of SQL statement length identification bits;

[0520] According to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit, the length of the SQL statement in the target database traffic data to be parsed is obtained;

[0521] Retrieving a SQL statement start identifier from the target database traffic data to be parsed according to the relative offset value range of the SQL statement start position;

[0522] If the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, then determine whether the M+rth byte is the starting position of the SQL statement, where r is a positive integer;

[0523] If it is determined that the M+rth byte is the starting position of the SQL statement, then the starting position of the SQL statement in the target database traffic data to be parsed is determined to be the M+rth byte.

[0524] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0525] If the third combined value is the second target value, the value of M is updated to M+OFF_5E according to the sub-function offset value constant OFF_5E, and the step of obtaining the value of the M+OFF_LENth byte in the target database traffic data to be parsed is executed.

[0526] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0527] The contents from the M+rth byte to the M+r+w-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, wherein w is the length of the SQL statement in the target database traffic data to be parsed.

[0528] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0529] If the number of bits of the SQL statement length identifier is not the fifth target value, or the SQL statement start identifier is not retrieved, or it is determined that the M+rth byte is not the starting position of the SQL statement, it is confirmed that the SQL statement extraction has failed.

[0530] The processor 900 is further configured to read the program in the memory 910 and execute the following steps:

[0531] Starting from the M+o+1th byte in the target database traffic data to be parsed, search whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are preset characters, where o is the minimum value of the preset search offset range, o is a positive integer, L is a positive integer, and the initial value of s is 0;

[0532] If the M+o+1+sth byte retrieved is not the preset character, or the L bytes after the M+o+1+sth byte are not the preset character, then the value of s is increased by 1, and the above steps of searching whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character are repeated, until the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, or o+s=O, O is the maximum value of the preset search offset range, and O is an integer greater than o;

[0533] If the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are found to be preset characters, then it is determined whether the M+o+1+sth byte is the starting position of the SQL statement;

[0534] If it is determined that the M+o+1+sth byte is the starting position of the SQL statement, then the M+o+1+sth byte is recorded as the starting position of the SQL statement in the target database traffic data to be parsed;

[0535] Retrieving the SQL statement end identifier starting from the M+o+1+sth byte in the target database traffic data to be parsed;

[0536] If the Tth byte in the target database traffic data to be parsed is retrieved as an SQL statement end identifier, then the contents from the M+o+1+sth byte to the T-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, where T is an integer greater than M+o+1+s.

[0537] The data analysis device provided in the embodiment of the present invention can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated in this embodiment.

[0538] In addition, the computer-readable storage medium of the embodiment of the present invention is used to store a computer program, and the computer program can be executed by a processor to implement the following steps:

[0539] Obtain the traffic data of the target database to be analyzed;

[0540] Extracting feature values ​​according to the structured query language SQL statement acquired in advance, determining the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature values ​​include a sub-function offset value constant, a relative offset value constant of the SQL statement length identification bit, and a relative offset value range of the SQL statement starting bit;

[0541] According to the length and the starting position of the SQL statement, the SQL statement is extracted from the target database traffic data to be parsed, and the SQL statement content in the target database traffic data to be parsed is obtained.

[0542] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0543] Obtaining N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios;

[0544] Determine the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit;

[0545] Determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data;

[0546] Determine the relative offset value range of the start position of the SQL statement based on the relative offset value of the start position of the SQL statement in each target database sampled traffic data;

[0547] Based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data, determine the relative offset value constant of the SQL statement length identification bit;

[0548] The sub-function offset value constant, the relative offset value range of the SQL statement start bit and the relative offset value constant of the SQL statement length identification bit are determined as the SQL statement extraction feature value.

[0549] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0550] Retrieve the target sub-function value position in each target database sampled traffic data respectively, and determine the sub-function offset value of each target database sampled traffic data according to the target sub-function value position in each target database sampled traffic data;

[0551] Retrieve the starting position of each SQL statement in the sampled traffic data of the target database respectively, and determine the relative offset value of the starting position of each SQL statement in the sampled traffic data of the target database according to the starting position of each SQL statement in the sampled traffic data of the target database;

[0552] Retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data;

[0553] According to the length of the SQL statement in each target database sampled traffic data, the relative offset value of the SQL statement length identification bit in each target database sampled traffic data is determined.

[0554] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0555] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0556] Obtaining a first combination value of the M-1th byte and the Mth byte in the first target database sampled traffic data, wherein the first target database sampled traffic data is any one of the N target database sampled traffic data;

[0557] If the first combination value is the first target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters, where L is a positive integer and the initial value of j is 0;

[0558] If the M+1+jth byte is not the preset character, or the L bytes after the M+1+jth byte are not the preset character, then add 1 to the value of j, and repeat the above steps of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character, until the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character;

[0559] If the M+1+jth byte and the L bytes after the M+1+jth byte are found to be preset characters, then it is determined whether the M+1+jth byte is the starting position of the SQL statement;

[0560] If the M+1+jth byte is determined to be the starting position of the SQL statement, then the starting position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+jth byte, and the relative offset value of the starting position of the SQL statement in the first target database sampled traffic data is determined to be j.

[0561] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0562] Starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+gth byte is a separator, where the initial value of g is 0;

[0563] If the M+1+j+g-th byte is not a separator, the value of g is increased by 1, and the above step of searching whether the M+1+j+g-th byte is a separator is repeated until the M+1+j+g-th byte is a separator, or g is equal to the second preset value;

[0564] If the M+1+j+gth byte is retrieved as a separator, then add the values ​​of the M+1+jth byte to the M+j+gth byte to get the total value;

[0565] It is determined whether the total value belongs to the value set of the SQL keyword, wherein if the total value belongs to the value set of the SQL keyword, the M+1+jth byte is determined as the starting position of the SQL statement.

[0566] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0567] If the total value does not belong to the value set of the SQL keyword, or the separator is not retrieved, it is determined that the M+1+jth byte is not the starting position of the SQL statement, and the value of j is updated to j+g, and the step of retrieving whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is executed.

[0568] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0569] If the first combination value is the second target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the second combination value of the M+1+ith byte and the M+i+2th byte is the first target value, and the initial value of i is 0;

[0570] If the second combined value is not the first target value, the value of i is increased by 1, and the above steps of searching whether the second combined value of the M+1+i th byte and the M+i+2 th byte is the first target value are repeated until the second combined value is retrieved to be the first target value;

[0571] If the second combined value is the first target value, the target sub-function value position in the first target database sampled traffic data is determined to be the M+1+ith byte, and the sub-function offset value of the first target database sampled traffic data is determined to be i+2.

[0572] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0573] The value of M is updated to M+i+2, and the step of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters is performed.

[0574] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0575] If it is determined that the M+1+jth byte is the starting position of the SQL statement, then starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+kth byte is the end identifier of the SQL statement, and the initial value of k is 0;

[0576] If the M+1+j+kth byte retrieved is not the end identifier of the SQL statement, the value of k is increased by 1, and the above retrieval is repeated to determine whether the M+1+j+kth byte is the end identifier of the SQL statement, until the M+1+j+kth byte is retrieved to be the end identifier of the SQL statement;

[0577] If the M+1+j+kth byte is retrieved as the end identifier of the SQL statement, the end position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+j+kth byte, and the length of the SQL statement in the first target database sampled traffic data is determined to be k.

[0578] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0579] In the case where it is determined that the length of the SQL statement in the first target database sampled traffic data is k, if the value of k is less than a third preset value, a target byte whose value is k is retrieved between the q+1th byte and the q+1+jth byte in the first target database sampled traffic data, wherein q is equal to the sum of the first preset value and the sub-function offset value of the first target database sampled traffic data;

[0580] If the value of k is greater than or equal to the third preset value, two bytes whose consecutive two byte values ​​are the third target value and the fourth target value are retrieved between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database, and the first byte of the two bytes is determined as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value;

[0581] According to the position of the target byte, a relative offset value of the SQL statement length identification bit in the first target database sampled traffic data is determined.

[0582] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0583] Deduplication counting statistics are performed on the sub-function offset values ​​of each target database sampled traffic data, and the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data is determined as a sub-function offset value constant.

[0584] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0585] Perform deduplication counting on the relative offset value of the start position of the SQL statement in each target database sampled traffic data to obtain P different relative offset values ​​of the start position of the SQL statement, and determine the count corresponding to the relative offset value of the start position of each SQL statement, where P is a positive integer less than or equal to N;

[0586] Sorting the relative offset values ​​of the P different SQL statement start positions according to the size of the values ​​to obtain a sorted set of relative offset values ​​of the SQL statement start positions;

[0587] According to a preset extraction ratio threshold, determining a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold;

[0588] The relative offset value range of the start position of the SQL statement is determined according to the maximum relative offset value and the minimum relative offset value in the minimum relative offset value subset.

[0589] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0590] Deduplication counting is performed on the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data, and the relative offset value of the SQL statement length identification bit with the highest count among the relative offset values ​​of the SQL statement length identification bits in each target database sampled traffic data is determined as the relative offset value constant of the SQL statement length identification bit.

[0591] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0592] Assigning the offset to a first preset value M, where M is an integer greater than 1;

[0593] Obtain a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed;

[0594] If the third combined value is the first target value, then according to the relative offset value constant OFF_LEN of the SQL statement length identification bit, the value of the M+OFF_LENth byte in the target database traffic data to be parsed is obtained to obtain the number of SQL statement length identification bits;

[0595] According to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit, the length of the SQL statement in the target database traffic data to be parsed is obtained;

[0596] Retrieving a SQL statement start identifier from the target database traffic data to be parsed according to the relative offset value range of the SQL statement start position;

[0597] If the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, then determine whether the M+rth byte is the starting position of the SQL statement, where r is a positive integer;

[0598] If it is determined that the M+rth byte is the starting position of the SQL statement, then the starting position of the SQL statement in the target database traffic data to be parsed is determined to be the M+rth byte.

[0599] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0600] If the third combined value is the second target value, the value of M is updated to M+OFF_5E according to the sub-function offset value constant OFF_5E, and the step of obtaining the value of the M+OFF_LENth byte in the target database traffic data to be parsed is executed.

[0601] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0602] The contents from the M+rth byte to the M+r+w-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, wherein w is the length of the SQL statement in the target database traffic data to be parsed.

[0603] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0604] If the number of bits of the SQL statement length identifier is not the fifth target value, or the SQL statement start identifier is not retrieved, or it is determined that the M+rth byte is not the starting position of the SQL statement, it is confirmed that the SQL statement extraction has failed.

[0605] Optionally, the computer program may also be executed by a processor to implement the following steps:

[0606] Starting from the M+o+1th byte in the target database traffic data to be parsed, search whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are preset characters, where o is the minimum value of the preset search offset range, o is a positive integer, L is a positive integer, and the initial value of s is 0;

[0607] If the M+o+1+sth byte retrieved is not the preset character, or the L bytes after the M+o+1+sth byte are not the preset character, then the value of s is increased by 1, and the above steps of searching whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character are repeated, until the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, or o+s=O, O is the maximum value of the preset search offset range, and O is an integer greater than o;

[0608] If the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are found to be preset characters, then it is determined whether the M+o+1+sth byte is the starting position of the SQL statement;

[0609] If it is determined that the M+o+1+sth byte is the starting position of the SQL statement, then the M+o+1+sth byte is recorded as the starting position of the SQL statement in the target database traffic data to be parsed;

[0610] Retrieving the SQL statement end identifier starting from the M+o+1+sth byte in the target database traffic data to be parsed;

[0611] If the Tth byte in the target database traffic data to be parsed is retrieved as an SQL statement end identifier, then the contents from the M+o+1+sth byte to the T-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, where T is an integer greater than M+o+1+s.

[0612] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0613] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0614] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the sending and receiving method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0615] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data analysis method, characterized in that: include: Obtain the target database traffic data to be analyzed; Extracting feature values ​​according to the structured query language SQL statement acquired in advance, determining the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature values ​​include a sub-function offset value constant, a relative offset value constant of the SQL statement length identification bit, and a relative offset value range of the SQL statement starting bit; Extracting the SQL statement from the target database traffic data to be parsed according to the length and the starting position of the SQL statement, and obtaining the SQL statement content in the target database traffic data to be parsed; Before extracting feature values ​​based on the pre-acquired structured query language SQL statements and determining the length and starting position of the SQL statements in the target database traffic data to be parsed, the method further includes: Acquire N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios; Determine the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit; Determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data; Determine the relative offset value range of the start position of the SQL statement based on the relative offset value of the start position of the SQL statement in each target database sampled traffic data; Based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data, determine the relative offset value constant of the SQL statement length identification bit; Determine the sub-function offset value constant, the relative offset value range of the SQL statement start bit, and the relative offset value constant of the SQL statement length identification bit as the SQL statement extraction feature value; The sub-function offset value constant is determined based on the sub-function offset value of each target database sampled flow data, including: Performing deduplication counting statistics on the sub-function offset values ​​of each target database sampled traffic data, and determining the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data as the sub-function offset value constant; The step of determining the relative offset value constant of the SQL statement length identification bit based on the relative offset value of the SQL statement length identification bit in each target database sampled traffic data includes: Performing deduplication counting statistics on the relative offset values ​​of the SQL statement length identification bits in each of the target database sampled traffic data, and determining the relative offset value of the SQL statement length identification bit with the highest count among the relative offset values ​​of the SQL statement length identification bits in each of the target database sampled traffic data as the relative offset value constant of the SQL statement length identification bit; The method of determining the sub-function offset value of each target database sampled traffic data, the relative offset value of the SQL statement start bit, and the relative offset value of the SQL statement length identification bit includes: Retrieve the target sub-function value position in each target database sampled traffic data respectively, and determine the sub-function offset value of each target database sampled traffic data according to the target sub-function value position in each target database sampled traffic data; Retrieve the starting position of each SQL statement in the sampled traffic data of the target database respectively, and determine the relative offset value of the starting position of each SQL statement in the sampled traffic data of the target database according to the starting position of each SQL statement in the sampled traffic data of the target database; Retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data; Determine the relative offset value of the SQL statement length identifier in each target database sampled traffic data according to the SQL statement length in each target database sampled traffic data; The step of determining the relative offset value of the SQL statement length identification bit in each target database sampled traffic data according to the SQL statement length in each target database sampled traffic data comprises: In the case where it is determined that the length of the SQL statement in the sampled traffic data of the first target database is k, if the value of k is less than a third preset value, a target byte whose value is k is retrieved between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database, wherein q is equal to the sum of the first preset value and the sub-function offset value of the sampled traffic data of the first target database, and the third preset value is determined according to the value range that can be stored in one byte; If the value of k is greater than or equal to the third preset value, two bytes whose consecutive two byte values ​​are the third target value and the fourth target value are retrieved between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database, and the first byte of the two bytes is determined as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value; Determine the relative offset value of the SQL statement length identification bit in the first target database sampled traffic data according to the position of the target byte; The step of determining the relative offset value range of the start position of the SQL statement based on the relative offset value of the start position of the SQL statement in each target database sampled traffic data includes: Perform deduplication counting on the relative offset value of the start position of the SQL statement in each target database sampled traffic data to obtain P different relative offset values ​​of the start position of the SQL statement, and determine the count corresponding to the relative offset value of the start position of each SQL statement, where P is a positive integer less than or equal to N; Sorting the relative offset values ​​of the P different SQL statement start positions according to the size of the values ​​to obtain a sorted set of relative offset values ​​of the SQL statement start positions; According to a preset extraction ratio threshold, determining a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold; Determine the relative offset value range of the start position of the SQL statement according to the maximum relative offset value and the minimum relative offset value in the minimum relative offset value subset; The extracting feature values ​​according to the pre-acquired structured query language SQL statements and determining the length and starting position of the SQL statements in the target database traffic data to be parsed includes: Assigning the offset to a first preset value M, where M is an integer greater than 1; Obtaining a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed; If the third combined value is the first target value, then according to the relative offset value constant OFF_LEN of the SQL statement length identifier, the value of the M+OFF_LENth byte in the target database traffic data to be parsed is obtained to obtain the number of SQL statement length identifier bits, and the first target value is the target sub-function value; According to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit, the length of the SQL statement in the target database traffic data to be parsed is obtained; Retrieving a SQL statement start identifier from the target database traffic data to be parsed according to the relative offset value range of the SQL statement start position; If the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, then determine whether the M+rth byte is the starting position of the SQL statement, where r is a positive integer; If it is determined that the M+rth byte is the starting position of the SQL statement, then the starting position of the SQL statement in the target database traffic data to be parsed is determined to be the M+rth byte.

2. The method according to claim 1, characterized in that The step of respectively retrieving the starting position of the SQL statement in each target database sampled traffic data, and determining the relative offset value of the starting position of the SQL statement in each target database sampled traffic data according to the starting position of the SQL statement in each target database sampled traffic data, comprises: Assigning the offset to a first preset value M, where M is an integer greater than 1; Obtaining a first combination value of the M-1th byte and the Mth byte in the first target database sampled traffic data, wherein the first target database sampled traffic data is any one of the N target database sampled traffic data; If the first combined value is the first target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are preset characters, L is a positive integer, the initial value of j is 0, and the first target value is the target sub-function value; If the M+1+jth byte is not the preset character, or the L bytes after the M+1+jth byte are not the preset character, then add 1 to the value of j, and repeat the above steps of searching whether the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character, until the M+1+jth byte and the L bytes after the M+1+jth byte are the preset character; If the M+1+jth byte and the L bytes after the M+1+jth byte are found to be preset characters, then it is determined whether the M+1+jth byte is the starting position of the SQL statement; If the M+1+jth byte is determined to be the starting position of the SQL statement, then the starting position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+jth byte, and the relative offset value of the starting position of the SQL statement in the first target database sampled traffic data is determined to be j.

3. The method according to claim 2, characterized in that The determining whether the M+1+jth byte is the starting position of the SQL statement includes: Starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+gth byte is a separator, where the initial value of g is 0; If the M+1+j+g-th byte is not a separator, add 1 to the value of g, and repeat the above step of searching whether the M+1+j+g-th byte is a separator, until the M+1+j+g-th byte is a separator, or g is equal to a second preset value, which is determined according to the maximum length of the SQL keyword; If the M+1+j+gth byte is retrieved as a separator, then add the values ​​of the M+1+jth byte to the M+j+gth byte to get the total value; It is determined whether the total value belongs to the value set of the SQL keyword, wherein if the total value belongs to the value set of the SQL keyword, the M+1+jth byte is determined as the starting position of the SQL statement.

4. The method according to claim 2, characterized in that: The method of respectively retrieving the position of the target sub-function value in each target database sampled traffic data and determining the sub-function offset value of each target database sampled traffic data according to the position of the target sub-function value in each target database sampled traffic data comprises: If the first combination value is the second target value, starting from the M+1th byte in the sampled traffic data of the first target database, searching whether the second combination value of the M+1+ith byte and the M+i+2th byte is the first target value, the initial value of i is 0, and the second target value is different from the first target value; If the second combined value is not the first target value, the value of i is increased by 1, and the above steps of searching whether the second combined value of the M+1+i th byte and the M+i+2 th byte is the first target value are repeated until the second combined value is retrieved to be the first target value; If the second combined value is the first target value, the target sub-function value position in the first target database sampled traffic data is determined to be the M+1+ith byte, and the sub-function offset value of the first target database sampled traffic data is determined to be i+2.

5. The method according to claim 2, characterized in that: The step of respectively retrieving the end position of the SQL statement in each target database sampled traffic data, and determining the length of the SQL statement in each target database sampled traffic data according to the start position and the end position of the SQL statement in each target database sampled traffic data, comprises: If it is determined that the M+1+jth byte is the starting position of the SQL statement, then starting from the M+1+jth byte in the sampled traffic data of the first target database, searching whether the M+1+j+kth byte is the end identifier of the SQL statement, and the initial value of k is 0; If the M+1+j+kth byte retrieved is not the end identifier of the SQL statement, the value of k is increased by 1, and the above retrieval is repeated to determine whether the M+1+j+kth byte is the end identifier of the SQL statement, until the M+1+j+kth byte is retrieved to be the end identifier of the SQL statement; If the M+1+j+kth byte is retrieved as the end identifier of the SQL statement, the end position of the SQL statement in the first target database sampled traffic data is determined to be the M+1+j+kth byte, and the length of the SQL statement in the first target database sampled traffic data is determined to be k.

6. The method according to claim 1, characterized in that After obtaining the third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed, the method further includes: If the third combined value is the second target value, then according to the sub-function offset value constant OFF_5E, the value of M is updated to M+OFF_5E, and the step of obtaining the value of the M+OFF_LENth byte in the target database traffic data to be parsed is executed, and the second target value is different from the first target value.

7. The method according to claim 1, characterized in that The method further comprises: If the number of bits of the SQL statement length identifier is not the fifth target value, or the SQL statement start identifier is not retrieved, or it is determined that the M+rth byte is not the starting position of the SQL statement, then the SQL statement extraction fails and the fifth target value is 1 or 2.

8. The method according to claim 7, characterized in that After confirming that the SQL statement extraction fails, the method further includes: Starting from the M+o+1th byte in the target database traffic data to be parsed, search whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are preset characters, where o is the minimum value of the preset search offset range, o is a positive integer, L is a positive integer, and the initial value of s is 0; If the M+o+1+sth byte retrieved is not the preset character, or the L bytes after the M+o+1+sth byte are not the preset character, then the value of s is increased by 1, and the above steps of searching whether the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character are repeated, until the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are the preset character, or o+s=O, O is the maximum value of the preset search offset range, and O is an integer greater than o; If the M+o+1+sth byte and the L bytes after the M+o+1+sth byte are found to be preset characters, then it is determined whether the M+o+1+sth byte is the starting position of the SQL statement; If it is determined that the M+o+1+sth byte is the starting position of the SQL statement, then the M+o+1+sth byte is recorded as the starting position of the SQL statement in the target database traffic data to be parsed; Retrieving the SQL statement end identifier starting from the M+o+1+sth byte in the target database traffic data to be parsed; If the Tth byte in the target database traffic data to be parsed is retrieved as an SQL statement end identifier, then the contents from the M+o+1+sth byte to the T-1th byte are extracted from the target database traffic data to be parsed as SQL statement contents, where T is an integer greater than M+o+1+s.

9. A data analysis device, characterized in that: include: The first acquisition module is used to acquire the target database traffic data to be analyzed; A first determination module is used to extract feature values ​​according to a pre-acquired structured query language SQL statement, and determine the length and starting position of the SQL statement in the target database traffic data to be parsed, wherein the SQL statement extracted feature value includes a sub-function offset value constant, a relative offset value constant of an SQL statement length identification bit, and a relative offset value range of an SQL statement starting bit; An extraction module, used to extract the SQL statement from the target database traffic data to be parsed according to the length and starting position of the SQL statement, and obtain the SQL statement content in the target database traffic data to be parsed; The data analysis device also includes: A second acquisition module is used to acquire N pieces of sampled traffic data of a target database, where N is an integer greater than 1, and the N pieces of sampled traffic data of the target database include traffic data of the target database in different scenarios; The second determination module is used to determine the sub-function offset value of each target database sampled flow data, the relative offset value of the SQL statement start bit and the relative offset value of the SQL statement length identification bit; A third determination module is used to determine a sub-function offset value constant based on the sub-function offset value of each target database sampled flow data; A fourth determination module, used to determine a relative offset value range of a start position of an SQL statement based on a relative offset value of a start position of an SQL statement in each target database sampled flow data; A fifth determination module, used to determine a relative offset value constant of a SQL statement length identification bit based on a relative offset value of a SQL statement length identification bit in each target database sampled traffic data; A sixth determination module, used to determine the sub-function offset value constant, the relative offset value range of the SQL statement start bit and the relative offset value constant of the SQL statement length identification bit as the SQL statement extraction feature value; The third determination module is used to perform deduplication counting statistics on the sub-function offset value of each target database sampled traffic data, and determine the sub-function offset value with the highest count among the sub-function offset values ​​of each target database sampled traffic data as the sub-function offset value constant; The fifth determination module is used to perform deduplication counting statistics on the relative offset values ​​of the SQL statement length identification bits in each of the target database sampled traffic data, and determine the relative offset value of the SQL statement length identification bit with the highest count among the relative offset values ​​of the SQL statement length identification bits in each of the target database sampled traffic data as the relative offset value constant of the SQL statement length identification bit; The second determining module comprises: The first determination submodule is used to retrieve the target sub-function value position in each target database sampled flow data respectively, and determine the sub-function offset value of each target database sampled flow data according to the target sub-function value position in each target database sampled flow data; The second determination submodule is used to retrieve the starting position of the SQL statement in each target database sampled traffic data respectively, and determine the relative offset value of the starting position of the SQL statement in each target database sampled traffic data according to the starting position of the SQL statement in each target database sampled traffic data; The third determination submodule is used to retrieve the end position of the SQL statement in each target database sampled traffic data respectively, and determine the length of the SQL statement in each target database sampled traffic data according to the start position and end position of the SQL statement in each target database sampled traffic data; The fourth determination submodule is used to determine the relative offset value of the SQL statement length identification bit in each target database sampled traffic data according to the SQL statement length in each target database sampled traffic data; The fourth determining submodule includes: a fourth retrieval unit, for, when it is determined that the length of the SQL statement in the sampled traffic data of the first target database is k, if the value of k is less than a third preset value, retrieving a target byte whose value is k between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database, wherein q is equal to the sum of the first preset value and the sub-function offset value of the sampled traffic data of the first target database, and the third preset value is determined according to a range of values ​​that can be stored in one byte; a fifth retrieval unit, for retrieving two bytes whose consecutive two byte values ​​are respectively a third target value and a fourth target value between the q+1th byte and the q+1+jth byte in the sampled traffic data of the first target database if the value of k is greater than or equal to a third preset value, and determining the first byte of the two bytes as the target byte, wherein the third target value is the quotient of k divided by the third preset value, and the fourth target value is the remainder of k divided by the third preset value; A fourth determining unit, configured to determine a relative offset value of an SQL statement length identifier in the sampled traffic data of the first target database according to a position of the target byte; The fourth determination module comprises: A fifth determination submodule is used to perform deduplication counting statistics on the relative offset value of the starting position of the SQL statement in each target database sampled traffic data, obtain P different relative offset values ​​of the starting position of the SQL statement, and determine the count corresponding to the relative offset value of the starting position of each SQL statement, where P is a positive integer less than or equal to N; A sorting submodule, used to sort the relative offset values ​​of the starting positions of the P different SQL statements according to the size of the values, to obtain a sorted set of relative offset values ​​of the starting positions of the SQL statements; a sixth determination submodule, configured to determine, according to a preset extraction ratio threshold, a minimum relative offset value subset whose sum of counts in the relative offset value set is greater than a target count value, wherein the target count value is equal to the product of the sum of counts of all relative offset values ​​in the relative offset value set and the extraction ratio threshold; A seventh determination submodule, configured to determine a relative offset value range of a start position of an SQL statement according to a maximum relative offset value and a minimum relative offset value in the minimum relative offset value subset; The first determining module comprises: An assignment submodule, used for assigning the offset to a first preset value M, where M is an integer greater than 1; A first acquisition submodule is used to acquire a third combination value of the M-1th byte and the Mth byte in the target database traffic data to be parsed; A second acquisition submodule is used for acquiring the value of the M+OFF_LENth byte in the target database traffic data to be parsed according to the relative offset value constant OFF_LEN of the SQL statement length identification bit if the third combination value is the first target value, and obtaining the number of SQL statement length identification bits, wherein the first target value is a target sub-function value; A third acquisition submodule is used to acquire the length of the SQL statement in the target database traffic data to be parsed according to the number of bits of the SQL statement length identification bit and the relative offset value constant of the SQL statement length identification bit; A first retrieval submodule, configured to retrieve a SQL statement start identifier from the target database traffic data to be parsed according to a relative offset value range of the SQL statement start position; The first judgment submodule is used to judge whether the M+rth byte is the starting position of the SQL statement if the M+r-1th byte in the target database traffic data to be parsed is retrieved as the SQL statement start identifier, where r is a positive integer; The eighth determination submodule is used to determine the starting position of the SQL statement in the target database traffic data to be parsed as the M+r byte if the M+r byte is determined to be the starting position of the SQL statement.

10. A data analysis device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps in the data analysis method as claimed in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the data parsing method according to any one of claims 1 to 8 are implemented.

Images