Methods, devices, electronic equipment and storage media for storing agreement audit data
By establishing database tables based on public and shared key fields, the problems of low query efficiency and wasted storage space in the existing technology for protocol audit data storage are solved, achieving efficient querying and compact storage, while supporting the addition of new protocols without modifying the table structure.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2022-10-18
- Publication Date
- 2026-05-26
AI Technical Summary
Among existing methods for storing protocol audit data, narrow table methods have low query efficiency, while wide table methods waste storage space and require changes to the table structure when adding new protocols.
A database table is created based on the common and shared key fields of each protocol. Combining the advantages of narrow and wide tables, a general database table is established. The protocol audit data of all protocols are stored in the same table, with a fixed total number of table entries. The key fields of each protocol are stored in the same table entry.
It achieves high query performance and compact storage structure, supports write, query and add protocol operations without changing the table structure, and solves the problems of low query efficiency of narrow table method and storage waste of wide table method.
Smart Images
Figure CN115470215B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and more specifically, to methods, apparatus, electronic devices, and storage media for storing protocol audit data. Background Technology
[0002] The application layer protocols in the network are very diverse, with common ones including HTTP, DNS, SMTP, POP3, FTP, TELNET, IMAP, SNMP, MQTT, SSH, LDAP, RDP, and NTP. Each protocol has its specific key fields, and the values of these key fields can be stored in a database to form protocol audit data, facilitating subsequent searching and analysis, and enabling timely detection of security vulnerabilities.
[0003] There are generally two methods for storing existing protocol audit data in databases: narrow table and wide table. Narrow table uses a single database table for each protocol, with each table entry containing the protocol's key fields, and audit data for different protocols stored in separate tables. Wide table uses a generic database table where all protocol audit data is stored within the same table. However, narrow table methods require multi-table joins, resulting in low query efficiency. Wide table methods, on the other hand, waste storage space for protocols with fewer key fields due to the different fields required for each protocol, and adding new protocols necessitates changes to the table structure. Summary of the Invention
[0004] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for storing protocol audit data. A database table is established based on the common key fields and shared key fields of each protocol, which solves the problems of low query efficiency of the existing narrow table method, waste of storage space of the wide table method, and the need to change the table structure when adding a new protocol.
[0005] This application provides a method for storing protocol audit data, the method comprising:
[0006] Obtain all protocols to be audited and their corresponding key fields;
[0007] Based on the aforementioned key fields, obtain the common key fields and shared key fields;
[0008] Establish database tables based on the aforementioned common key fields and shared key fields;
[0009] Perform write, query, and add protocol operations on the database table.
[0010] In the above implementation process, the advantages of narrow tables and wide tables are combined. Database tables are established based on the common and shared key fields of each protocol. This achieves both the query performance of wide tables and the compact storage of narrow tables. Write, query, and new protocol operations can be performed without changing the table structure. This solves the problems of low query efficiency of the existing narrow table method, waste of storage space of the wide table method, and the need to change the table structure when adding new protocols.
[0011] Furthermore, the step of establishing a database table based on the common key fields and shared key fields includes:
[0012] The number of entries and the number of entries in the database table are determined based on the maximum value of the number of common key fields, the number of shared key fields, and the preset number of reserved entries.
[0013] Determine the correspondence between the key fields of the protocol and the entries in the database table: the common key fields correspond to common entries, and the shared key fields correspond to shared entries.
[0014] In the above implementation process, a database table is established based on common key fields and shared key fields. The database table includes common table entries, shared table entries and reserved table entries. The total number of table entries is fixed. The key fields of each protocol are stored in the same table entry. In this way, both the query performance of a wide table and the compact storage structure of a narrow table are obtained.
[0015] Furthermore, the write operation to the database table includes:
[0016] Retrieve the common key fields of the protocol to be written;
[0017] The common key fields are respectively mapped to the various sub-table entries in the common table entry;
[0018] Retrieve the values of the key fields in the protocol to be written;
[0019] Write the field values into the corresponding sub-table entries.
[0020] In the above implementation process, when writing to the database table, it is necessary to first determine the correspondence between each key field and the table item, and then the field values can be written into the corresponding table item.
[0021] Furthermore, the write query operation on the database table includes:
[0022] Determine whether the key field to be queried is a shared key field;
[0023] If it is a shared key field, then switch to a shared table entry and query the sub-table entries in the shared table entry corresponding to the shared key field;
[0024] The corresponding field value is obtained based on the sub-table item and the protocol name of the key field to be queried.
[0025] In the above implementation process, when querying the database table, the key fields are judged to determine whether to query directly or to query the database table entries, thereby ensuring that the corresponding field values are retrieved.
[0026] Furthermore, the step of adding a new protocol to the database table includes:
[0027] Obtain the common key fields and shared key fields of the newly added protocol;
[0028] Write the common key fields and shared key fields into the corresponding table entries;
[0029] If the number of key fields is greater than the sum of the number of common entries and shared entries, then the remaining key fields will be written into the reserved entries.
[0030] In the above implementation process, when adding a new protocol, the common key fields and shared key fields of the new protocol are written into the corresponding table entries respectively, without changing the table structure.
[0031] This application embodiment also provides a storage device for protocol audit data, the device comprising:
[0032] The first data acquisition module is used to acquire all protocols to be audited and their corresponding key fields.
[0033] The second data acquisition module acquires common key fields and shared key fields based on the key fields;
[0034] The database table creation module is used to create database tables based on the common key fields and shared key fields.
[0035] The database table operation module is used to perform write, query, and add protocol operations on the database tables.
[0036] In the above implementation process, the advantages of narrow tables and wide tables are combined. Database tables are established based on the common and shared key fields of each protocol. This achieves both the query performance of wide tables and the compact storage of narrow tables. Write, query, and new protocol operations can be performed without changing the table structure. This solves the problems of low query efficiency of the existing narrow table method, waste of storage space of the wide table method, and the need to change the table structure when adding new protocols.
[0037] Furthermore, the database table creation module includes:
[0038] The table entry determination module is used to determine the table entries and the number of table entries of the database table based on the maximum value of the number of common key fields, the number of shared key fields, and the preset number of reserved table entries;
[0039] The correspondence determination module is used to determine the correspondence between the key fields of the protocol and the entries in the database table: the common key fields correspond to common entries, and the shared key fields correspond to shared entries.
[0040] In the above implementation process, a database table is established based on common key fields and shared key fields. The database table includes common table entries, shared table entries and reserved table entries. The total number of table entries is fixed. The key fields of each protocol are stored in the same table entry. In this way, the query performance of a wide table is obtained while the compact storage of a narrow table is obtained.
[0041] Furthermore, the database table operation module includes:
[0042] The field retrieval module is used to retrieve the shared key fields of the protocol to be written.
[0043] The corresponding module is used to map the shared key fields to the respective sub-table entries in the shared table entry;
[0044] The field value retrieval module is used to retrieve the field values of key fields to be written to the protocol.
[0045] The field value writing module is used to write the field values into the corresponding sub-table items respectively.
[0046] In the above implementation process, when writing to the database table, it is necessary to first determine the correspondence between each key field and the table item, and then the field values can be written into the corresponding table item.
[0047] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor runs the computer program to enable the electronic device to perform the storage method for protocol audit data described in any of the above-described embodiments.
[0048] This application also provides a readable storage medium storing computer program instructions, which, when read and executed by a processor, perform a method for storing protocol audit data as described above. Attached Figure Description
[0049] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0050] Figure 1A flowchart illustrating a method for storing protocol audit data provided in an embodiment of this application;
[0051] Figure 2 A schematic diagram illustrating a method for storing protocol audit data provided in an embodiment of this application;
[0052] Figure 3 A flowchart illustrating the creation of database tables provided in the embodiments of this application;
[0053] Figure 4 A flowchart of a database writing method provided in an embodiment of this application;
[0054] Figure 5 A flowchart of the database table query method provided in the embodiments of this application;
[0055] Figure 6 A flowchart of the database table query provided for embodiments of this application;
[0056] Figure 7 A flowchart of the new protocol method provided in the embodiments of this application;
[0057] Figure 8 A structural block diagram of the storage device for protocol audit data provided in the embodiments of this application;
[0058] Figure 9 A structural block diagram of another protocol audit data storage device provided in an embodiment of this application.
[0059] icon:
[0060] 100 - First Data Acquisition Module; 200 - Second Data Acquisition Module; 300 - Database / Table Creation Module; 301 - Table Entry Determination Module; 302 - Correspondence Determination Module; 400 - Database / Table Operation Module; 410 - Protocol Writing Module; 411 - Field Acquisition Module; 412 - Correspondence Module; 413 - Field Value Acquisition Module; 414 - Field Value Writing Module; 420 - Query Module; 430 - Add Protocol Module. Detailed Implementation
[0061] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.
[0062] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.
[0063] Example 1
[0064] Please refer to Figure 1 , Figure 1 A flowchart illustrating a method for storing protocol audit data provided in an embodiment of this application. Figure 2 The diagram illustrates a method for storing protocol audit data, including methods for creating, writing to, querying, and adding new protocols to the database table. This method combines the advantages of narrow and wide tables, creating a universal table where all protocol audit data is stored. The total number of entries barely exceeds the maximum number of fields for a given protocol. Key fields for each protocol are stored in the same entry, and the content of a single entry represents different key fields depending on the protocol. This approach combines the query performance of wide tables with the compact storage structure of narrow tables, thus solving the problems of low query efficiency in narrow table methods and wasted storage space in wide table methods, which require changes to the table structure when adding new protocols.
[0065] The method specifically includes the following steps:
[0066] Step S100: Obtain all protocols to be audited and their corresponding key fields;
[0067] Obtain as many details as possible about all protocols to be audited, and for each protocol, list all the key fields that need to be audited. For example, if there are four protocols to be audited: HTTP, FTP, SMTP, and NFS, then there are 11, 10, 10, and 8 key fields to be audited respectively, for a total of 39 key fields.
[0068] Step S200: Obtain common key fields and shared key fields based on the key fields;
[0069] The key fields that are present in all protocols are called common key fields. For example, there are five common key fields for the four protocols mentioned above: sip, dip, sp, dp, and proto.
[0070] Common key fields are the key fields that are stored in common table entries for each protocol. For example, the common key fields for HTTP protocol audit data are http_method, http_host, http_url, http_user_agent, http_refer, and http_xforward.
[0071] Step S300: Establish a database table based on the common key fields and shared key fields;
[0072] like Figure 3 As shown, a flowchart for establishing a database table is provided. Step S300 may specifically include the following steps:
[0073] Step S301: Determine the table entries and the number of table entries of the database table based on the maximum value of the number of common key fields, the number of shared key fields, and the preset number of reserved table entries;
[0074] Table 1 shows the intended representation of the database. The number of common key fields for the four protocols is denoted as C1, where C1 = 5; the maximum number of common key fields is the number of common key fields for the HTTP protocol, denoted as C2, where C2 = 6; and the number of preset reserved entries is denoted as C3, where C3 = 2.
[0075] The number of entries in the database table will then be C1 + C2 + C3.
[0076] Create a universal database table where protocol audit data for all protocols is stored. The total number of entries is fixed and shared across all protocols, slightly exceeding the number of fields for the protocol with the most critical fields. As shown in Table 1, this database table has 13 entries (C1 + C2 + C3), including 5 common entries, 6 shared entries, and 2 reserved entries. The number of entries slightly exceeds the number of fields for the HTTP protocol (11 critical fields), but is far less than the total number of critical fields for the four protocols combined (39 critical fields).
[0077] Step S302: Determine the correspondence between the key fields of the protocol and the entries in the database table: the common key fields correspond to common entries, and the shared key fields correspond to shared entries.
[0078] The common key fields correspond one-to-one with the common table entries. For example, the source IP address, destination IP address, source port, destination port, and application layer protocol name in the common table entries correspond to the key fields sip, dip, sp, dp, and proto, respectively.
[0079] The shared table entries store the key fields of each protocol, meaning that the key fields of each protocol are stored in the same table entry. Therefore, the content of a certain table entry represents different key fields depending on the protocol.
[0080] For example, for shared entries (H1, H2, H3, H4, H5, H6), when the application layer protocol name is HTTP, they correspond to the key fields http_method, http_host, http_url, http_user_agent, http_refer, and http_xforward, respectively. When the application layer protocol name is FTP, they correspond to the key fields ftp_cmd, ftp_banner, ftp_ret, ftp_username, and ftp_passwd, respectively.
[0081]
[0082] Table 1 Database Representation Intent
[0083] Step S400: Perform write, query, and add protocol operations on the database table.
[0084] like Figure 4 The diagram shown is a flowchart of the database writing method, which includes the following steps:
[0085] Step S400 may specifically include:
[0086] Step S411: Obtain the common key fields of the protocol to be written;
[0087] For example, the data to be written is HTTP protocol audit data, which has 11 key fields. Among them, http_method, http_host, http_url, http_user_agent, http_refer, and http_xforward are shared key fields.
[0088] Step S412: Assign the shared key fields to the respective sub-table entries in the shared table entry;
[0089] If the data to be written is HTTP protocol audit data, then the common key fields http_method, http_host, http_url, http_user_agent, http_refer, and http_xforward correspond to the common table entries H1, H2, H3, H4, H5, and H6, respectively.
[0090] Step S413: Obtain the field values of the key fields to be written to the protocol;
[0091] Step S414: Write the field values into the corresponding sub-table entries respectively.
[0092] If the data to be written is HTTP protocol audit data, there are 11 key fields (sip, dip, sp, dp, proto, http_method, http_host, http_url, http_user_agent, http_refer, http_xforward) that correspond to 11 database entries (source IP address, destination IP address, source port, destination port, application layer protocol name, H1, H2, H3, H4, H5, H6). When writing, the values of these key fields are written to the corresponding database entries.
[0093] If the data to be written is NFS protocol audit data, there are 8 key fields (sip, dip, sp, dp, proto, nfs_program_name, nfs_cmd, nfs_filename) that correspond to 8 database entries (source IP address, destination IP address, source port, destination port, application layer protocol name, H1, H2, H3). When writing, the values of these key fields are written to the corresponding database entries.
[0094] like Figure 5 The diagram shown is a flowchart of the method for querying a database table, which includes the following steps:
[0095] Step S421: Determine whether the key field to be queried is a shared key field;
[0096] Step S422: If it is a shared key field, then switch to a shared table entry and query the sub-table entries in the shared table entry corresponding to the shared key field;
[0097] Step S423: Obtain the corresponding field value based on the sub-table item and the protocol name of the key field to be queried.
[0098] The sub-table entries here refer to H1, H2, H3, H4, H5, and H6.
[0099] Based on the correspondence between the key fields of each protocol and the database table entries determined in the database table creation method, determine whether the key field to be queried belongs to a shared key field. If so, proceed to step S422; otherwise, perform the query directly. Figure 6 The diagram shown is a flowchart of the database table query process.
[0100] For example, in Table 1, if the field to be queried is http_method, it is determined to be a shared field, and step S422 is continued. If the field to be queried is dip, it is determined not to be a shared field, and the query is performed directly.
[0101] Step S422 involves converting to a database table entry. For shared key fields, direct querying is not possible; conversion to the corresponding database table entry is required to correctly retrieve the content. For example, in Table 1, the field to be queried is `http_method`, a shared key field corresponding to database table entry H1. The query should retrieve the value of database table entry H1, where the application layer protocol name is HTTP.
[0102] Common key fields can be queried directly, and the query results will be the values corresponding to the common key fields of all protocols. However, shared fields require conversion to correctly retrieve the content. For example, to query the `dip` field, you can directly query the IP address of the database table item, and the result will be the destination IP addresses corresponding to all protocols where "destination IP address = xxx". To query the `http_method` field, the query must be "H1 = xxx and application layer protocol name = HTTP protocol" to retrieve the content where "http_method = xxx". Simply querying `H1` will return the content corresponding to `H1` for all protocols, resulting in an error, because only the HTTP protocol has an `http_method` field.
[0103] like Figure 7 The diagram shows a flowchart of the newly added protocol method, which includes the following steps:
[0104] Step S431: Obtain the common key fields and shared key fields of the newly added protocol;
[0105] Identify the common and shared key fields for the new protocol. As shown in Table 2, this is the database table after adding the new protocol. If you need to add a protocol called xx, which has 7 key fields (sip, dip, proto, xx_1, xx_2, xx_3, xx_4), determine that sip, dip, and proto are common key fields, and xx_1, xx_2, xx_3, and xx_4 are shared key fields.
[0106] Step S432: Write the common key fields and shared key fields into the corresponding table entries;
[0107] When adding a new protocol, there is no need to modify the database table structure, and the database table entries do not need to be changed or added. It is only necessary to determine the correspondence between the key fields of the new protocol and the database table entries. As shown in Table 2, if a protocol xx needs to be added, its 7 key fields (sip, dip, proto, xx_1, xx_2, xx_3, xx_4) correspond to 7 database table entries (source IP address, destination IP address, application layer protocol name, H1, H2, H3, H4).
[0108] Step S433: If the number of key fields is greater than the sum of the number of common entries and shared entries, then write the remaining key fields into the reserved entries.
[0109] If the number of key fields in the new protocol is large, reserved table entries can be used. If even with reserved table entries, it is still insufficient, then table entries in the database table need to be added and the table structure modified. Therefore, when creating the database table, sufficient reserved table entries should be designed to ensure the storage of key fields of the new protocol without modifying the table structure.
[0110]
[0111]
[0112] Table 2 Database tables after adding the new protocol
[0113] The storage method for audit data in this protocol combines the advantages of existing narrow table and wide table methods, ensuring high-efficiency query performance of the database while minimizing null values in database table entries and reducing storage waste. Furthermore, no changes to the table structure are required when adding a new protocol.
[0114] Example 2
[0115] This application provides a storage device for protocol audit data, applied to the protocol audit data storage method described in Embodiment 1, such as... Figure 8 The diagram shown is a structural block diagram of a storage device for protocol audit data, which includes, but is not limited to:
[0116] The first data acquisition module 100 is used to acquire all protocols to be audited and their corresponding key fields;
[0117] The second data acquisition module 200 acquires common key fields and shared key fields based on the key fields;
[0118] The database table creation module 300 is used to create database tables based on the common key fields and shared key fields.
[0119] The database table operation module 400 is used to perform write, query, and add protocol operations on the database tables.
[0120] This device combines the advantages of narrow and wide tables, establishing database tables based on common and shared key fields of various protocols. It achieves both the query performance of wide tables and the compact storage of narrow tables, allowing for write, query, and new protocol addition operations without changing the table structure. This solves the problems of low query efficiency in the existing narrow table method and wasted storage space in the wide table method, as well as the need to change the table structure when adding new protocols.
[0121] like Figure 9 The diagram shown is a structural block diagram of a storage device for audit data of another protocol, wherein... Figure 8 Based on this, the database table creation module 300 includes, but is not limited to:
[0122] The table entry determination module 301 is used to determine the table entries and the number of table entries of the database table based on the maximum value of the number of common key fields, the number of shared key fields, and the preset number of reserved table entries;
[0123] The correspondence determination module 302 is used to determine the correspondence between the key fields of the protocol and the entries in the database table: the common key fields correspond to common entries, and the shared key fields correspond to shared entries.
[0124] The database operation module 400 includes a protocol writing module 410, a query module 420, and a new protocol module 430. The protocol writing module 410 includes:
[0125] Field acquisition module 411 is used to acquire the common key fields of the protocol to be written;
[0126] The corresponding module 412 is used to associate the common key field with each sub-table item in the common table item;
[0127] The field value acquisition module 413 is used to acquire the field values of key fields to be written to the protocol;
[0128] The field value writing module 414 is used to write the field values into the corresponding sub-table items respectively.
[0129] The specific implementation process of the query module 420 and the new protocol module 430 has been described in detail in Example 1, and will not be repeated here.
[0130] This device presents a better storage structure than existing narrow table and wide table methods, which not only ensures high-efficiency query performance of the database, but also minimizes null values in database table entries, reduces storage waste, and does not require modification of the database table structure when adding new protocols.
[0131] This application also provides an electronic device, which includes a memory and a processor. The memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the protocol audit data storage method described in Embodiment 1.
[0132] This application also provides a readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the storage method for storing protocol audit data described in Embodiment 1 is performed.
[0133] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
[0134] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.
[0135] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0136] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0137] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
[0138] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
Claims
1. A method for storing protocol audit data, characterized in that, The method includes: Obtain all protocols to be audited and their corresponding key fields; Based on the aforementioned key fields, common key fields and shared key fields are obtained. The common key fields are key fields that are present in all protocols, including: source IP address, destination IP address, source port, destination port, and application layer protocol name. The shared key fields are key fields that are stored in a shared table entry for each protocol. Establishing a database table based on the common key fields and shared key fields specifically includes: determining the table entries and the number of table entries based on the maximum value of the number of common key fields and the number of shared key fields and the preset number of reserved table entries; determining the correspondence between the key fields of the protocol and each table entry in the database table: the common key fields correspond to common table entries, and the shared key fields correspond to shared table entries; Perform write, query, and add protocol operations on the database table.
2. The method for storing protocol audit data according to claim 1, characterized in that, The write operation to the database table includes: Retrieve the common key fields of the protocol to be written; The common key fields are respectively mapped to the various sub-table entries in the common table entry; Retrieve the values of the key fields in the protocol to be written; Write the field values into the corresponding sub-table entries.
3. The method for storing protocol audit data according to claim 1, characterized in that, The write query operation on the database table includes: Determine whether the key field to be queried is a shared key field; If it is a shared key field, then switch to a shared table entry and query the sub-table entries in the shared table entry corresponding to the shared key field; The corresponding field value is obtained based on the sub-table item and the protocol name of the key field to be queried.
4. The method for storing protocol audit data according to claim 1, characterized in that, The operation of adding a new protocol to the database table includes: Obtain the common key fields and shared key fields of the newly added protocol; Write the common key fields and shared key fields into the corresponding table entries; If the number of key fields is greater than the sum of the number of common entries and shared entries, then the remaining key fields will be written into the reserved entries.
5. A storage device for protocol audit data, characterized in that, The device includes: The first data acquisition module is used to acquire all protocols to be audited and their corresponding key fields. The second data acquisition module acquires common key fields and shared key fields based on the key fields. The common key fields are key fields that are present in all protocols, including: source IP address, destination IP address, source port, destination port, and application layer protocol name. The shared key fields are key fields that are stored in a shared table entry for each protocol. The database table creation module is used to create database tables based on the common key fields and shared key fields. Specifically, it includes: an item determination module, used to determine the items and the number of items in the database table based on the maximum value of the number of common key fields and the number of shared key fields and the preset number of reserved items; and a correspondence determination module, used to determine the correspondence between the key fields of the protocol and each item in the database table: the common key fields correspond to common items, and the shared key fields correspond to shared items. The database table operation module is used to perform write, query, and add protocol operations on the database tables.
6. The storage device for protocol audit data according to claim 5, characterized in that, The database table operation module includes: The field retrieval module is used to retrieve the common key fields of the protocol to be written. The corresponding module is used to map the shared key fields to the respective sub-table entries in the shared table entry; The field value retrieval module is used to retrieve the field values of key fields to be written to the protocol. The field value writing module is used to write the field values into the corresponding sub-table items respectively.
7. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform the method for storing protocol audit data according to any one of claims 1 to 4.
8. A readable storage medium, characterized in that, The readable storage medium stores computer program instructions, which, when read and executed by a processor, perform the method for storing protocol audit data as described in any one of claims 1 to 4.