Evaluation method, device, equipment and medium applied to packet capture tool

Abstract

The disclosure provides an evaluation method applied to a packet capture tool, which can be applied to the field of information security technology or the field of financial technology. The evaluation method applied to the packet capture tool comprises: in response to a request for calling the packet capture tool, obtaining a packet capture tool to be evaluated, the request for calling the packet capture tool carrying packet capture attribute data associated with the packet capture tool to be evaluated; in the case that the packet capture attribute data meets a first evaluation standard, extracting a test scene associated with the packet capture tool to be evaluated from a data warehouse; based on the test scene, determining at least one feature index that the packet capture tool to be evaluated can complete in the test scene to obtain a feature index set; processing each feature index in the feature index set based on a preset evaluation rule to obtain a plurality of evaluation values; and determining an evaluation result associated with the packet capture tool to be evaluated according to the plurality of evaluation values. The disclosure also provides an evaluation device applied to a packet capture tool, equipment and a medium.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of information security or financial technology, and more particularly to an evaluation method, device, equipment, medium and program product applied to a packet capturing tool. BACKGROUND

[0002] With the development of the information age, the security of information has also been paid more and more attention. When information is transmitted in the form of messages between browsers and servers, the messages transmitted between the browsers and the servers are generally intercepted by a packet capturing tool to confirm whether the transmitted messages are correct and to perform security authentication on the transmitted information.

[0003] In the process of implementing the present disclosure, the inventors have found that in the related art, the security of a packet capturing tool needs to be evaluated manually according to experience every time the packet capturing tool is introduced or invoked, which not only reduces the evaluation efficiency but also reduces the evaluation accuracy. SUMMARY

[0004] In view of the above problems, the present disclosure provides an evaluation method, device, equipment, medium and program product applied to a packet capturing tool, which improves the evaluation efficiency and accuracy of the packet capturing tool.

[0005] One aspect of the present disclosure provides an evaluation method applied to a packet capturing tool, comprising: in response to a request for invoking a packet capturing tool, obtaining a packet capturing tool to be evaluated, wherein the request for invoking the packet capturing tool carries packet capturing attribute data associated with the packet capturing tool to be evaluated; in the case that the packet capturing attribute data meets a first evaluation standard, extracting a test scenario associated with the packet capturing tool to be evaluated from a data warehouse; based on the test scenario, determining at least one feature index that the packet capturing tool to be evaluated can complete in the test scenario to obtain a feature index set; processing each feature index in the feature index set based on a preset evaluation rule to obtain a plurality of evaluation values; and determining an evaluation result associated with the packet capturing tool to be evaluated according to the plurality of evaluation values.

[0006] According to the embodiments of the present disclosure, the case that the packet capturing attribute data meets the first evaluation standard comprises: in response to the request for invoking the packet capturing tool, obtaining the first evaluation standard, wherein the first evaluation standard includes a plurality of first evaluation indexes; in the case that the packet capturing attribute data matches the plurality of first evaluation indexes, it is considered that the packet capturing attribute data meets the first evaluation standard.

[0007] According to an embodiment of the present disclosure, the request for calling the packet capturing tool further carries a packet capturing identifier associated with the packet capturing tool to be evaluated; and the extracting the test scenario associated with the packet capturing tool to be evaluated from the data warehouse comprises: searching for a test scenario cluster corresponding to the packet capturing identifier from the data warehouse based on the packet capturing identifier, wherein the test scenario cluster is generated according to evaluation results of historical packet capturing tools; and extracting the test scenario associated with the packet capturing tool to be evaluated from the test scenario cluster based on a preset extraction rule.

[0008] According to an embodiment of the present disclosure, the test scenario is configured with a scenario identifier; and the determining at least one feature index that the packet capturing tool to be evaluated can complete in the test scenario based on the test scenario to obtain a feature index set comprises: determining a plurality of second evaluation indexes associated with the test scenario from the data warehouse based on the scenario identifier; pre-running the packet capturing tool to be evaluated in the test scenario to obtain a plurality of initial feature indexes; and generating the feature index set according to at least one initial feature index from the plurality of initial feature indexes in a case where the at least one initial feature index matches at least one second evaluation index from the plurality of second evaluation indexes.

[0009] According to an embodiment of the present disclosure, each second evaluation index from the plurality of second evaluation indexes is configured with a sub-evaluation index set; and the processing each feature index from the feature index set based on a preset evaluation rule to obtain a plurality of evaluation values comprises: performing transformation and aggregation processing on the each feature index to obtain a running result associated with the each feature index; matching the running result with the sub-evaluation index set to obtain a matching result; and assigning a value to the each feature index by using the preset evaluation rule based on the matching result to obtain the plurality of evaluation values.

[0010] According to an embodiment of the present disclosure, the determining an evaluation result associated with the packet capturing tool to be evaluated based on the plurality of evaluation values comprises: assigning a weight to each evaluation value from the plurality of evaluation values respectively, and determining a total evaluation value associated with the packet capturing tool to be evaluated according to the each evaluation value and the weight corresponding to the each evaluation value; and determining the evaluation result associated with the packet capturing tool to be evaluated based on the total evaluation value.

[0011] According to an embodiment of the present disclosure, the method further comprises: storing the evaluation result associated with the packet capturing tool to be evaluated in the data warehouse, so as to directly obtain the evaluation result associated with the packet capturing tool to be evaluated in response to the request for calling the packet capturing tool.

[0012] According to an embodiment of the present disclosure, the feature indicators include at least one of an ease-of-use indicator, a scanning indicator, an anti-replay indicator, a data encryption indicator, a data desensitization indicator, a data transcoding indicator, and a data flow conversion indicator.

[0013] Another aspect of the present disclosure further provides an evaluation device applied to a packet capturing tool, comprising: a first acquisition module configured to acquire a packet capturing tool to be evaluated in response to a request for invoking the packet capturing tool, wherein the request for invoking the packet capturing tool carries packet attribute data associated with the packet capturing tool to be evaluated; a first extraction module configured to extract a test scenario associated with the packet capturing tool to be evaluated from a data warehouse if the packet attribute data meets a first evaluation standard; a first determination module configured to determine at least one feature indicator that the packet capturing tool to be evaluated can complete in the test scenario based on the test scenario, to obtain a feature indicator set; a first processing module configured to process each feature indicator in the feature indicator set based on a preset evaluation rule, to obtain a plurality of evaluation values; and a second determination module configured to determine an evaluation result associated with the packet capturing tool to be evaluated according to the plurality of evaluation values.

[0014] Another aspect of the present disclosure further provides an electronic device, comprising: one or more processors; a storage device configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the above-mentioned evaluation method applied to a packet capturing tool.

[0015] Another aspect of the present disclosure further provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the above-mentioned evaluation method applied to a packet capturing tool.

[0016] Another aspect of the present disclosure further provides a computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements the above-mentioned evaluation method applied to a packet capturing tool.

[0017] According to the application provided by the evaluation method, device, equipment, medium and program product applied to the packet capture tool implemented by the present disclosure, the packet capture tool to be evaluated is obtained in response to the request of calling the packet capture tool. In the case that the packet capture attribute data meets the first evaluation standard, the test scene is extracted from the data warehouse. Based on the test scene, at least one index that can be completed by the packet capture tool to be evaluated is determined. Based on the preset evaluation rule, the plurality of indexes are processed to obtain a plurality of evaluation values, and the evaluation result is determined according to the evaluation values. Because the whole scheme can be automatically executed, and in the process of evaluation, the feature index set is obtained in combination with the test scene where the packet capture tool is located, and each feature index in the feature index set is quantified as an evaluation value, so that each evaluation result has data support and no longer depends on manual operation experience. Therefore, at least part of the problems of low evaluation efficiency and low evaluation accuracy caused by manual evaluation of the packet capture tool according to experience in the related art are overcome, and the technical effects of improving the evaluation efficiency and the evaluation accuracy are realized. BRIEF DESCRIPTION OF DRAWINGS

[0018] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 A system architecture diagram of the evaluation method and device applied to the packet capture tool according to the embodiments of the present disclosure is schematically shown;

[0020] Figure 2 A flowchart of the evaluation method applied to the packet capture tool according to the embodiments of the present disclosure is schematically shown;

[0021] Figure 3 A flowchart of operation S204 according to the embodiments of the present disclosure is schematically shown;

[0022] Figure 4 A structural block diagram of the evaluation device applied to the packet capture tool according to the embodiments of the present disclosure is schematically shown; and

[0023] Figure 5 A block diagram of an electronic device suitable for implementing the evaluation method applied to the packet capture tool according to the embodiments of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. However, it would be apparent to one skilled in the art that the embodiments can be practiced without these specific details. In other instances, well-known structures and functions have been described in detail in order to avoid obscuring the concepts of the present disclosure.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. As used herein, the term "includes" and tautological expressions thereof, such as "including," "includes," "include," "contains," "containing," and so on, shall not be taken to exclude the presence of additional items or additional features.

[0026] All terms used herein, including technical and scientific terms, have the same meanings as commonly understood by one of ordinary skill in the art unless otherwise defined herein. It should be noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of the specification, and should not be interpreted in an idealized or overly formal way.

[0027] In the case where an expression similar to "at least one of A, B, and C, and the like" is used, it should generally be interpreted to include any of one, all, or a combination thereof. In the case where an expression similar to "at least one of A, B, or C, and the like" is used, it should generally be interpreted to include any of one, all, or a combination thereof. In the case where an expression similar to "at least one of A, B, and C, and the like" is used, it should generally be interpreted to include any of one, all, or a combination thereof.

[0028] There are many types of safe packet capturing tools on the market, and each time before selecting a safe test packet capturing tool, the packet capturing tool needs to be evaluated, and each evaluation index lacks uniformity, and when the packet capturing tool is re-purchased or introduced, it needs to be re-developed, repeatedly consuming evaluation manpower cost, and historical evaluation data cannot be effectively referenced, reducing the efficiency and accuracy of evaluation.

[0029] In view of this, the embodiments of the present disclosure provide an evaluation method and device applied to a packet capturing tool, a medium and program product, and the like, for improving the efficiency and accuracy of evaluation. Specifically, the method comprises: in response to a request for invoking the packet capturing tool, obtaining a packet capturing tool to be evaluated, wherein the request for invoking the packet capturing tool carries packet capturing attribute data associated with the packet capturing tool to be evaluated; in the case that the packet capturing attribute data meets a first evaluation standard, extracting a test scenario associated with the packet capturing tool to be evaluated from a data warehouse; based on the test scenario, determining at least one feature index that the packet capturing tool to be evaluated can complete in the test scenario, to obtain a feature index set; based on a preset evaluation rule, processing each feature index in the feature index set to obtain a plurality of evaluation values; and according to the plurality of evaluation values, determining an evaluation result associated with the packet capturing tool to be evaluated.

[0030] It should be noted that the evaluation method and device applied to the packet capturing tool determined by the embodiments of the present disclosure can be used in the field of information security technology or the field of financial technology, and can also be used in any field other than the field of information security technology or the field of financial technology. The embodiments of the present disclosure do not limit the application field of the determined evaluation method and device applied to the packet capturing tool.

[0031] In the technical solutions of the present disclosure, the acquisition, storage and application of the data (such as user personal information) involved all comply with the relevant legal regulations, necessary security measures are taken, and the public order and good customs are not violated. In the technical solutions of the present disclosure, the authorization or consent of the user is obtained before the user's personal information is acquired or collected.

[0032] Figure 1 The system architecture diagram of the evaluation method and device applied to the packet capturing tool according to the embodiments of the present disclosure is schematically shown.

[0033] As shown in Figure 1 According to the system architecture 100 of this embodiment, the terminal devices 101, 102 and 103, the network 104 and the server 105 can be connected to each other through the network 104.

[0034] The terminal devices 101, 102 and 103 can be various electronic devices in a public environment or various independent environments, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, and the like.

[0035] Various communication client applications can be installed on the terminal devices 101, 102 and 103, such as transfer applications, payment applications, applications for submitting orders, financial applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients and / or social platform software, and the like (only as examples).

[0036] The user can operate in the client application of the terminal device 101, 102, 103, such as transferring money, payment, submitting an order, logging in, opening a homepage, etc., to perform a business function, and based on the business function, generate and send a request for calling the packet capturing tool to the server 105.

[0037] The network 104 is a medium for providing a communication link between the terminal device 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0038] The server 105 can be a server that provides various services, such as obtaining a packet capturing tool to be evaluated in response to a request for calling the packet capturing tool, extracting a test scenario associated with the packet capturing tool to be evaluated from a data warehouse in the case that the packet capturing attribute data meets the first evaluation standard, determining at least one feature index that the packet capturing tool to be evaluated can complete in the test scenario based on the test scenario, obtaining a feature index set, processing each feature index in the feature index set based on a preset evaluation rule, obtaining a plurality of evaluation values, and determining an evaluation result associated with the packet capturing tool to be evaluated according to the plurality of evaluation values. The server 105 can also feed back the packet capturing tool determined according to the evaluation result, the generated web page, information, or data, etc. to the terminal device 101, 102, 103.

[0039] It should be noted that the evaluation method for the packet capturing tool provided by the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the evaluation device for the packet capturing tool provided by the embodiments of the present disclosure can generally be arranged in the server 105. The evaluation method for the packet capturing tool provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, 103 and / or the server 105. Accordingly, the evaluation device for the packet capturing tool provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, 103 and / or the server 105.

[0040] It should be understood that Figure 1 The number of terminal devices, networks and servers in

[0041] The following will be based on Figure 1 the scenario described below, and the evaluation method for the packet capturing tool of the disclosed embodiments will be described in detail. Figures 2-3

[0042] Figure 2 ​A flowchart of an evaluation method applied to a packet sniffer according to an embodiment of the present disclosure is shown schematically.

[0043] As shown in Figure 2 The evaluation method applied to the packet sniffer of this embodiment includes operations S201-S205.

[0044] In operation S201, in response to a request for invoking a packet sniffer, a packet sniffer to be evaluated is acquired, wherein the request for invoking the packet sniffer carries packet attribute data associated with the packet sniffer to be evaluated.

[0045] In operation S202, in a case where the packet attribute data meets a first evaluation criterion, a test scenario associated with the packet sniffer to be evaluated is extracted from a data warehouse.

[0046] In operation S203, based on the test scenario, at least one feature index that the packet sniffer to be evaluated can complete in the test scenario is determined, to obtain a feature index set.

[0047] In operation S204, each feature index in the feature index set is processed based on a preset evaluation rule, to obtain a plurality of evaluation values.

[0048] In operation S205, according to the plurality of evaluation values, an evaluation result associated with the packet sniffer to be evaluated is determined.

[0049] According to an embodiment of the present disclosure, the request for invoking the packet sniffer can be generated each time a packet sniffer needs to be introduced or purchased. For example, a packet sniffer is generally used in transfer, payment, and order submission. Some packet sniffers are chargeable, or after a packet sniffer expires, a new packet sniffer needs to be introduced or purchased, at which time the newly introduced or newly purchased packet sniffer needs to be evaluated. In an embodiment, the evaluation method can also be used for evaluation of software. For example, according to a vulnerability library warning, it can be determined that the currently used software has a problem, and when the software is introduced again or another type of software is selected, the security of the software needs to be evaluated.

[0050] According to an embodiment of the present disclosure, packet capturing can refer to operations such as interception, retransmission, editing, and storing of data packets sent and received by network transmission. The packet capturing tool can be used for security testing, for example, testing for application security, common security issues such as unauthorized access, function bypass, SQL (Structured Query Language) injection, XXE (xml external entity injection) attack, man-in-the-middle attack, and the like. The packet capturing tool to be evaluated can be a packet capturing tool that needs to be reintroduced or a newly purchased packet capturing tool.

[0051] According to an embodiment of the present disclosure, packet capturing attribute data can refer to an operating system environment required by the packet capturing tool, software relied on, supported protocols, supported devices, whether the packet capturing tool has vulnerabilities, functional index items that can be completed by the packet capturing tool, and whether there is a restriction on procurement.

[0052] According to an embodiment of the present disclosure, the first evaluation standard can be used to evaluate the packet capturing attribute data. In the first evaluation standard, an evaluation index corresponding to each piece of packet capturing data can be included to determine whether the packet capturing attribute data and the first evaluation standard are both satisfied. The first evaluation standard can be understood as a standard that must be met to determine whether the packet capturing tool to be evaluated can be introduced. In the case where both are satisfied, subsequent processing can be performed to obtain a plurality of evaluation values. If one is not satisfied, the packet capturing tool can not be considered, and another packet capturing tool can be selected.

[0053] According to an embodiment of the present disclosure, the data warehouse can store a plurality of test scenarios and evaluation results of historical packet capturing tools. Test scenarios associated with the packet capturing tool to be evaluated can include a support scenario, a transfer scenario, an order submission scenario, a login scenario, and a scenario of opening the home page of an application.

[0054] According to an embodiment of the present disclosure, pre-running the packet capturing tool to be evaluated in the associated test scenario can obtain a plurality of characteristic indexes, such as an ease of use index, a scanning index, an anti-replay index, a data encryption index, a data desensitization index, a data transcoding index, and a data flow conversion index. The characteristic index set can be obtained according to at least one of the plurality of characteristic indexes.

[0055] According to an embodiment of the present disclosure, the preset evaluation rule can be a rule set according to each characteristic index. For example, the preset evaluation rule for the data encryption index can refer to dividing the number of encryption types supported by the packet capturing tool, and assigning a score and a weight according to the number after the division, so as to quantify the characteristic index into an evaluation value.

[0056] According to an embodiment of the present disclosure, according to the plurality of evaluation values, a total evaluation value associated with the to-be-evaluated packet capturing tool can be obtained, and according to the total evaluation value, an evaluation result can be determined. The evaluation result can include whether the to-be-evaluated packet capturing tool can be applied to the test scene, and the advantages and disadvantages of the to-be-evaluated packet capturing tool.

[0057] According to the evaluation method, device, equipment, medium and program product applied to the packet capturing tool provided by the present disclosure, the to-be-evaluated packet capturing tool is obtained in response to the request of calling the packet capturing tool. In the case that the packet capturing attribute data meets the first evaluation standard, the test scene is extracted from the data warehouse. Based on the test scene, at least one index that can be completed by the to-be-evaluated packet capturing tool is determined. Based on the preset evaluation rule, the plurality of indexes are processed to obtain a plurality of evaluation values, and the evaluation result is determined according to the evaluation values. Because the whole scheme can be automatically executed, and in the process of evaluation, the feature index set is obtained in combination with the test scene where the packet capturing tool is located, and each feature index in the feature index set is quantified as an evaluation value, so that each evaluation result has data support and no longer depends on manual operation experience. Therefore, at least part of the problems of low evaluation efficiency and low evaluation accuracy caused by the need for manual evaluation of the packet capturing tool according to experience in the related art are overcome, and the technical effects of improving the evaluation efficiency and the evaluation accuracy are realized.

[0058] According to an embodiment of the present disclosure, operation S202 can further include the following operations: in response to the request of calling the packet capturing tool, obtaining the first evaluation standard, wherein the first evaluation standard includes a plurality of first evaluation indexes; in the case that the packet capturing attribute data matches the plurality of first evaluation indexes, it is considered that the packet capturing attribute data meets the first evaluation standard.

[0059] According to an embodiment of the present disclosure, the first evaluation indexes included in the first evaluation standard can be as shown in Table 1. The first evaluation indexes can be the operation environment required by the packet capturing tool, the software relied on by the packet capturing tool, the security of the packet capturing tool, the functionality of the packet capturing tool, the protocol supported by the packet capturing tool, the device supported by the packet capturing tool, and the procurement restriction of the packet capturing tool.

[0060] Table 1 First evaluation standard

[0061]

[0062] According to an embodiment of the present disclosure, the packet capturing tool can be applied to a terminal device, and the operating environment required by the packet capturing tool can refer to an operating environment supporting installation of the packet capturing tool to be evaluated. It can be understood that, in a case where the operating environment required by the packet capturing tool to be evaluated is the same as an operating environment of the terminal device, or the operating environment required by the packet capturing tool to be evaluated is an operating system that can be installed by the terminal device, it can be considered that the packet capturing attribute data matches the first evaluation index, and the packet capturing attribute data satisfies the first evaluation index. The operating environment can be adaptively adjusted according to actual needs.

[0063] According to an embodiment of the present disclosure, the software relied on by the packet capturing tool can refer to other software required to be installed before the packet capturing tool to be evaluated is installed, and the other software is used to ensure smooth running of the packet capturing tool to be evaluated. For example, in a case where the other software is used in a use environment permitted by the other software, and the other software is free or is purchased in a purchase plan, and the other software is safe (no discovered vulnerability or repaired), it can be considered that the packet capturing attribute data matches the first evaluation index, and the packet capturing attribute data satisfies the first evaluation index. The other software relied on can be adaptively adjusted according to actual needs.

[0064] According to an embodiment of the present disclosure, the security of the packet capturing tool can refer to whether the security of the packet capturing tool to be evaluated meets requirements. For example, in a case where no vulnerability of the packet capturing tool is discovered or the packet capturing tool to be evaluated is repaired, it can be considered that the security of the packet capturing tool to be evaluated meets requirements, that is, the packet capturing attribute data matches the first evaluation index, and the packet capturing attribute data satisfies the first evaluation index. The security evaluation standard can be adaptively adjusted according to actual needs.

[0065] According to an embodiment of the present disclosure, the functionality of the packet capturing tool can refer to that the functionality of the packet capturing tool to be evaluated should meet basic requirements of security testing. The corresponding basic functions can include message monitoring, message interception, and message tampering functions. For example, in a case where the packet capturing tool to be evaluated has the message monitoring, message interception, and message tampering functions, it can be considered that the functionality of the packet capturing tool to be evaluated meets requirements, that is, the packet capturing attribute data matches the first evaluation index, and the packet capturing attribute data satisfies the first evaluation index. In an embodiment, in view of the fact that the security testing also needs to be directed to transaction anti-replay, data encryption, data desensitization, and other requirements, the packet capturing tool to be evaluated can also have functions such as message replay, data encryption detection, data desensitization detection, and other vulnerability scanning. The functionality can be adaptively adjusted according to actual needs.

[0066] According to an embodiment of the present disclosure, the supported protocol of the packet capturing tool can refer to the type of message that the packet capturing tool to be evaluated can collect. For example, in the case that the packet capturing tool to be evaluated should at least support the protocol required by the test environment (such as HTTP, HTTPS, FTP, etc.), it can be considered that the packet capturing attribute data matches the first evaluation index, and the packet capturing attribute data meets the first evaluation index. The protocol can be adaptively adjusted according to actual needs.

[0067] According to an embodiment of the present disclosure, the supported device of the packet capturing tool can refer to the device message that the packet capturing tool to be evaluated can collect. For example, in the case that the packet capturing tool to be evaluated should at least support the device type required by the test environment (such as a computer, a mobile phone), it can be considered that the packet capturing attribute data matches the first evaluation index, and the packet capturing attribute data meets the first evaluation index. The device can be adaptively adjusted according to actual needs.

[0068] According to an embodiment of the present disclosure, the procurement restriction of the packet capturing tool can refer to the procurement cost planning that needs to be met if the packet capturing tool to be evaluated needs to be purchased. For example, in the case that the procurement price of the packet capturing tool to be evaluated is less than or equal to the procurement cost planning, it can be considered that the packet capturing attribute data matches the first evaluation index, and the packet capturing attribute data meets the first evaluation index. The procurement restriction can be adaptively adjusted according to actual needs.

[0069] According to an embodiment of the present disclosure, in the case that the packet capturing attribute data and the first evaluation index are both met, that is, the conditions shown in Table 1 are all met, the subsequent operation of obtaining the evaluation value can be performed, and if one of them is not met, the packet capturing tool to be evaluated is not considered, and the packet capturing tool to be evaluated can be replaced.

[0070] According to an embodiment of the present disclosure, by constructing the first evaluation standard, the consistency of each evaluation can be ensured, the problem of lack of uniformity of evaluation indexes in related technologies is solved, and the efficiency and accuracy of evaluation are improved.

[0071] According to an embodiment of the present disclosure, the request for calling the packet capturing tool can also carry a packet capturing identifier associated with the packet capturing tool to be evaluated. Operation S202 can further include the following operation: based on the packet capturing identifier, searching the test scenario cluster corresponding to the packet capturing identifier from the data warehouse, wherein the test scenario cluster is generated according to the evaluation result of the historical packet capturing tool; based on a preset extraction rule, extracting the test scenario associated with the packet capturing tool to be evaluated from the test scenario cluster.

[0072] According to an embodiment of the present disclosure, the packet capturing identifier can refer to the number of the packet capturing tool to be evaluated, and is used to identify the packet capturing tool to be evaluated.

[0073] According to an embodiment of the present disclosure, a plurality of similar application scenarios can be included in a test scenario cluster, for example, a transfer and a payment are similar, and can be in the same test scenario cluster. The test scenario cluster can be obtained according to the evaluation result or the actual running result of the historical transfer tool, and has reference value for the newly introduced packet capture tool. For example, in response to a request for generating an introduced packet capture tool based on a payment situation, a larger test scenario range associated with the transfer tool to be evaluated, that is, a test scenario cluster, can be determined first, and the test scenario cluster can include a payment test scenario, a transfer test scenario, a login interface test scenario, a submission order test scenario, an opening homepage test scenario, and the like.

[0074] According to an embodiment of the present disclosure, the preset extraction rule can include extracting a test scenario with a high use frequency and a simple and not cumbersome process during evaluation from the test scenario cluster. The preset rule can be adaptively adjusted according to actual needs.

[0075] According to an embodiment of the present disclosure, the test scenario is extracted by the preset extraction rule, so that the evaluation of the packet capture tool is more targeted, and the accuracy of evaluating the packet capture tool is improved.

[0076] According to an embodiment of the present disclosure, each test scenario can be configured with a scenario identifier, based on which the operation S203 can further include the following operations: determining, based on the scenario identifier, a plurality of second evaluation indexes associated with the test scenario from the data warehouse; pre-running the packet capture tool to be evaluated under the test scenario to obtain a plurality of initial feature indexes; in a case where at least one initial feature index in the plurality of initial feature indexes matches at least one second evaluation index in the plurality of second evaluation indexes, generating a feature index set according to the at least one initial feature index.

[0077] According to an embodiment of the present disclosure, the scenario identifier can be a scenario number corresponding to the test scenario, used to identify the test scenario.

[0078] According to an embodiment of the present disclosure, the second evaluation index can be as shown in Table 2. The second evaluation index and the initial feature index obtained by pre-running the packet capture tool to be evaluated under the test scenario can each include an ease of use index, a scanning index, an anti-replay index, a data encryption index, a data desensitization index, a data transcoding index, and a data flow conversion index. Each second evaluation index can include a sub-evaluation index set, and the sub-evaluation index set can include a plurality of sub-evaluation indexes.

[0079] Table 2

[0080]

[0081]

[0082] According to an embodiment of the present disclosure, the usability index can be determined according to the number of points that can be met, to indicate whether the to-be-evaluated packet capture is easy to use. The sub-evaluation indexes of the usability index can include: automatically starting and stopping the proxy by the switch software, supporting the export of message information, conveniently switching the interception and monitoring mode (operation steps <= 3), prompting the configurable information of the message header setting, supporting the fuzzy matching and searching of messages, and the like. If the to-be-evaluated packet capture tool meets any of the above points when the to-be-evaluated packet capture tool is pre-run, it can be considered that the usability index of the to-be-evaluated packet capture tool matches the usability index in the second evaluation index, and based on the matched index, a characteristic index set can be generated. The usability index can be adaptively adjusted according to actual needs.

[0083] According to an embodiment of the present disclosure, the scanning index can refer to the types of vulnerabilities and the types of vulnerability sub-classifications that can be scanned. Specifically, the sub-evaluation indexes of the scanning function index can include: message header insecurity, existence of SQL injection vulnerabilities, existence of file upload vulnerabilities, and the like. The vulnerability sub-classification corresponds to the vulnerability of which field of the message header (X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, and the like), the type of vulnerability of the SQL injection (numeric type, text type, Boolean blind injection, time blind injection, and the like), and the type of vulnerability of the file upload (size, type, file name, and the like). If the to-be-evaluated packet capture tool can scan any of the above vulnerabilities when the to-be-evaluated packet capture tool is pre-run, it can be considered that the scanning function index of the to-be-evaluated packet capture tool matches the scanning function index in the second evaluation index, and based on the matched index, a characteristic index set can be generated. The scanning function index can be adaptively adjusted according to actual needs.

[0084] According to an embodiment of the present disclosure, the anti-replay index can refer to the usability of the anti-replay function of the to-be-evaluated packet capture tool. The sub-evaluation indexes of the anti-replay function index can include: configuring variables for multiple times of replaying a single packet, multiple times of replaying a single packet, and once replaying a single packet. If the to-be-evaluated packet capture tool can exhibit any of the above manners when the to-be-evaluated packet capture tool is pre-run, it can be considered that the anti-replay function index of the to-be-evaluated packet capture tool matches the anti-replay function index in the second evaluation index, and based on the matched index, a characteristic index set can be generated. The anti-replay function index can be adaptively adjusted according to actual needs.

[0085] According to an embodiment of the present disclosure, the data encryption indicator can be a kind of encryption algorithm supported by the packet capture tool to be evaluated, and should cover encryption and decryption operations of different secret key lengths of different encryption algorithms, and decryption operations or encryption judgments are performed according to the packet. The sub-evaluation indicators of the data encryption indicator can include AES (Advanced Encryption Standard), DES (Data Encryption Standard), 3DES (Triple Data Encryption Standard), RSA (Rivest, Shamirh, Adleman RSA algorithm), DSA (DIgital Signature Algorithm), ECC (Ellipse Curve Cryptography), SM1 (SM1 cryptographic algorithm), SM2 (elliptic curve algorithm), SM3 (hash algorithm), SM4 (block cipher algorithm), and the like. If the packet capture tool to be evaluated can perform any of the above encryption methods when the packet capture tool to be evaluated is pre-run, it can be considered that the data encryption indicator of the packet capture tool to be evaluated matches the data encryption indicator in the second evaluation indicator, and based on the matched indicator, a feature indicator set can be generated. The data encryption indicator can be adaptively adjusted according to actual needs.

[0086] According to an embodiment of the present disclosure, the data desensitization indicator can be a kind of desensitization supported by the packet capture tool to be evaluated. The sub-evaluation indicators of the data desensitization indicator can include desensitization of names, addresses, ID numbers, contact numbers, account numbers, and email addresses. If the packet capture tool to be evaluated can perform any of the above desensitization methods when the packet capture tool to be evaluated is pre-run, it can be considered that the data desensitization indicator of the packet capture tool to be evaluated matches the data desensitization indicator in the second evaluation indicator, and based on the matched indicator, a feature indicator set can be generated. The data desensitization indicator can be adaptively adjusted according to actual needs.

[0087] According to an embodiment of the present disclosure, the data transcoding index can be a transcoding algorithm type supported by the to-be-evaluated packet capturing tool. The sub-evaluation indexes of the data transcoding index can include Unicode encoding, American Standard Code for Information Interchange (ASCII), uniform resource locator (URL) encoding, Native encoding, hex encoding, base64 encoding, and the like. If the to-be-evaluated packet capturing tool can exhibit any of the above transcoding modes when pre-running the to-be-evaluated packet capturing tool, it can be considered that the data transcoding index of the to-be-evaluated packet capturing tool matches the data transcoding index in the second evaluation index, and based on the matched index, a feature index set can be generated. The data transcoding index can be adaptively adjusted according to actual needs.

[0088] According to an embodiment of the present disclosure, the data stream conversion index can be a data stream conversion type supported by the to-be-evaluated packet capturing tool, and the sub-evaluation indexes of the data stream conversion index can include jpg, png, svg, mp3, mp4, txt, csv, and the like. If the to-be-evaluated packet capturing tool can exhibit any of the above data stream conversion modes when pre-running the to-be-evaluated packet capturing tool, it can be considered that the data stream conversion index of the to-be-evaluated packet capturing tool matches the data stream conversion index in the second evaluation index, and based on the matched index, a feature index set can be generated. The data stream conversion index can be adaptively adjusted according to actual needs.

[0089] According to an embodiment of the present disclosure, by constructing the second evaluation index and the sub-evaluation index, consistency of each evaluation can be ensured, the problem of lack of uniformity of evaluation indexes in related technologies is solved, and the efficiency and accuracy of evaluation are improved.

[0090] Figure 3 A flowchart of operation S204 according to an embodiment of the present disclosure is schematically shown.

[0091] As shown in Figure 3 Operation S204 can include operations S301-S303.

[0092] In operation S301, each feature index is subjected to a transformation and aggregation process to obtain a running result associated with each feature index.

[0093] In operation S302, the running result is matched with the sub-evaluation index set to obtain a matching result.

[0094] In operation S303, based on the matching result, each feature index is assigned a value using a preset evaluation rule to obtain a plurality of evaluation values.

[0095] According to an embodiment of the present disclosure, the conversion aggregation processing can refer to sorting and collating the pre-run results of the packet capture tool to be evaluated, deleting duplicate result data, unifying the format of the result data, and unifying the results belonging to the same type of index to obtain the running results associated with each feature index.

[0096] According to an embodiment of the present disclosure, the matching results can be as shown in Table 2. Comparing the pre-run results of the packet capture tool to be evaluated with the sub-evaluation indexes, the actual point satisfaction number, the scanned types, the anti-replay method, the type of supported encryption algorithms, the type of data desensitization, the type of supported transcoding algorithms, and the type of supported data flow conversion can be obtained. After confirming the matching results, each matching result can be assigned a value, and the assignment rule can be as shown in Table 2. The preset evaluation rule can include the assignment rule shown in Table 2.

[0097] According to an embodiment of the present disclosure, the operation S205 can further include assigning a weight to each of the plurality of evaluation values, respectively, and determining a total evaluation value associated with the packet capture tool to be evaluated according to each of the evaluation values and the weight corresponding to each of the evaluation values; and determining an evaluation result associated with the packet capture tool to be evaluated according to the total evaluation value.

[0098] According to an embodiment of the present disclosure, the preset evaluation rule can include a weight assignment rule, and the weight assignment rule can be as shown in Table 2. Each of the second evaluation indexes can have a different weight. According to the matching results of each feature index, the corresponding matching results can be determined, the values of each feature index can be determined according to the matching results, the total evaluation value can be obtained by multiplying the values and the weights and summing the products of the values and the weights, and the higher the total evaluation value is, the better the performance of the packet capture tool to be evaluated is, or the packet capture tool to be evaluated can be introduced, and the actual normal running effect is better after the packet capture tool to be evaluated is introduced.

[0099] According to an embodiment of the present disclosure, by quantifying each feature index of the packet capture tool to be evaluated into an evaluation value, the evaluation result has data support, so that the evaluation efficiency and accuracy can be improved without relying on manual operation experience.

[0100] According to an embodiment of the present disclosure, after obtaining the evaluation result, the evaluation result associated with the packet capture tool to be evaluated can be stored in a data warehouse, so that the evaluation result associated with the packet capture tool to be evaluated can be directly obtained in response to a request for calling the packet capture tool.

[0101] According to the embodiment of the present disclosure, the evaluation result of the packet capturing tool to be evaluated is stored in the data warehouse, so that when the packet capturing tool to be evaluated is reintroduced or purchased, the historical evaluation data can be effectively referred to without reevaluating the reintroduced or purchased packet capturing tool each time, and the consumption of human cost is reduced.

[0102] According to the embodiment of the present disclosure, by quantifying the characteristic indicators of the packet capturing tool to be evaluated into evaluation values, when evaluation is performed, the evaluation result of the packet capturing tool to be evaluated is obtained according to the evaluation values, so that the final evaluation result has data support, and is no longer dependent on manual operation experience, and the accuracy of evaluation is improved. The whole evaluation method can be automatically executed, liberating manpower, reducing human cost, and improving the efficiency of evaluation. In addition, for the same version of the packet capturing tool, if it has been evaluated before, there is no need to repeat the evaluation, and the historical data can be effectively referred to. The evaluation method applied to the packet capturing tool provided in the embodiment of the present disclosure can still have consistency at different time points.

[0103] It should be noted that, unless it is explicitly stated that there is an execution sequence between different operations or there is an execution sequence in the technical implementation of different operations, the execution sequence of multiple operations can not be distinguished, and multiple operations can be executed simultaneously.

[0104] Based on the above-mentioned evaluation method applied to the packet capturing tool, the present disclosure further provides an evaluation device applied to the packet capturing tool. The following will be described in combination with Figure 4 The device will be described in detail.

[0105] Figure 4 The structure block diagram of the evaluation device applied to the packet capturing tool according to the embodiment of the present disclosure is schematically shown.

[0106] As Figure 4 shown, the evaluation device applied to the packet capturing tool 400 of the embodiment includes a first acquisition module 410, a first extraction module 420, a first determination module 430, a first processing module 440, and a second determination module 450.

[0107] The first acquisition module 410 is configured to acquire a packet capturing tool to be evaluated in response to a request for calling the packet capturing tool, wherein the request for calling the packet capturing tool carries packet capturing attribute data associated with the packet capturing tool to be evaluated.

[0108] The first extraction module 420 is configured to extract a test scene associated with the packet capturing tool to be evaluated from the data warehouse in a case where the packet capturing attribute data meets a first evaluation standard.

[0109] The first determination module 430 is configured to determine, based on the test scenario, at least one feature index that the to-be-evaluated packet capturing tool can complete in the test scenario, to obtain a feature index set.

[0110] The first processing module 440 is configured to process each feature index in the feature index set based on a preset evaluation rule, to obtain a plurality of evaluation values.

[0111] The second determination module 450 is configured to determine, according to the plurality of evaluation values, an evaluation result associated with the to-be-evaluated packet capturing tool.

[0112] According to the evaluation method, device, equipment, medium and program product applied to the packet capturing tool provided in the present disclosure, the to-be-evaluated packet capturing tool is obtained in response to a request for calling the packet capturing tool; the test scenario is extracted from the data warehouse in the case where the packet capturing attribute data meets the first evaluation standard; at least one index that the to-be-evaluated packet capturing tool can complete is determined based on the test scenario; a plurality of evaluation values are obtained by processing a plurality of indexes based on a preset evaluation rule, and an evaluation result is determined according to the evaluation values. Because the whole scheme can be automatically executed, and in the process of evaluation, the feature index set is obtained in combination with the test scenario in which the packet capturing tool is located, and each feature index in the feature index set is quantified as an evaluation value, so that each evaluation result has data support and no longer depends on manual operation experience. Therefore, at least part of the problems of low evaluation efficiency and low evaluation accuracy caused by the need for manual evaluation of the packet capturing tool according to experience in the related art are overcome, and the technical effects of improving the evaluation efficiency and the evaluation accuracy are achieved.

[0113] According to an embodiment of the present disclosure, the first extraction module can further include a first acquisition unit and a first determination unit.

[0114] The first acquisition unit is configured to obtain the first evaluation standard in response to a request for calling the packet capturing tool, wherein the first evaluation standard includes a plurality of first evaluation indexes.

[0115] The first determination unit is configured to consider that the packet capturing attribute data meets the first evaluation standard in the case where the packet capturing attribute data and the plurality of first evaluation indexes are matched.

[0116] According to an embodiment of the present disclosure, the first extraction module can further include a finding unit and an extraction unit.

[0117] The finding unit is configured to find, based on the packet capturing identifier, a test scenario cluster corresponding to the packet capturing identifier from the data warehouse, wherein the test scenario cluster is generated according to the evaluation results of the historical packet capturing tools.

[0118] The extraction unit is configured to extract, based on a preset extraction rule, a test scenario associated with the to-be-evaluated packet capturing tool from the test scenario cluster.

[0119] According to an embodiment of the present disclosure, the first determining module can further include a second determining unit, a running unit and a generating unit.

[0120] The second determining unit is configured to determine, based on the scenario identifier, a plurality of second evaluation indexes associated with the test scenario from the data warehouse.

[0121] The running unit is configured to pre-run the to-be-evaluated packet capturing tool under the test scenario to obtain a plurality of initial feature indexes.

[0122] The generating unit is configured to, in a case where at least one initial feature index in the plurality of initial feature indexes matches at least one second evaluation index in the plurality of second evaluation indexes, generate a feature index set according to the at least one initial feature index.

[0123] According to an embodiment of the present disclosure, the first processing module can further include a processing unit, a matching unit and a first assigning unit.

[0124] The processing unit is configured to perform a transformation and aggregation process on each feature index to obtain a running result associated with each feature index.

[0125] The matching unit is configured to match the running result with the sub-evaluation index set to obtain a matching result.

[0126] The first assigning unit is configured to assign a value to each feature index based on the matching result by using a preset evaluation rule to obtain a plurality of evaluation values.

[0127] According to an embodiment of the present disclosure, the second determining module can further include a second assigning unit, a third determining unit and a fourth determining unit.

[0128] The second assigning unit is configured to assign a weight to each evaluation value in the plurality of evaluation values respectively.

[0129] The third determining unit is configured to determine a total evaluation value associated with the to-be-evaluated packet capturing tool according to each evaluation value and the weight corresponding to each evaluation value.

[0130] The fourth determining unit is configured to determine an evaluation result associated with the to-be-evaluated packet capturing tool according to the total evaluation value.

[0131] According to an embodiment of the present disclosure, the evaluation device applied to the packet capturing tool can further include a storage module.

[0132] The storage module is configured to store the evaluation result associated with the to-be-evaluated packet capturing tool into the data warehouse, so as to directly obtain the evaluation result associated with the to-be-evaluated packet capturing tool in response to a request of calling the packet capturing tool.

[0133] According to an embodiment of the present disclosure, any multiple of the first obtaining module 410, the first extracting module 420, the first determining module 430, the first processing module 440 and the second determining module 450 can be combined in one module, or any one of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first obtaining module 410, the first extracting module 420, the first determining module 430, the first processing module 440 and the second determining module 450 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of hardware or firmware that can be integrated or packaged with a circuit, or any one of software, hardware and firmware or any appropriate combination of any of them. Alternatively, at least one of the first obtaining module 410, the first extracting module 420, the first determining module 430, the first processing module 440 and the second determining module 450 can be at least partially implemented as a computer program module that can perform corresponding functions when it is run.

[0134] It should be noted that the part of the evaluation device applied to the packet sniffer in the embodiments of the present disclosure corresponds to the part of the evaluation method applied to the packet sniffer in the embodiments of the present disclosure, and the description of the part of the evaluation device applied to the packet sniffer specifically refers to the part of the evaluation method applied to the packet sniffer, which will not be described here.

[0135] Figure 5 A block diagram of an electronic device suitable for implementing the evaluation method applied to the packet sniffer according to an embodiment of the present disclosure is schematically shown.

[0136] As shown in Figure 5 The electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset, and / or a special-purpose microprocessor (such as an application specific integrated circuit (ASIC)), and the like. The processor 501 can also include an on-board memory for cache use. The processor 501 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0137] In the RAM 503, various programs and data required for the operation of the electronic device 500 are stored. The processor 501, the ROM 502, and the RAM 503 are connected to each other via the bus 504. The processor 501 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 502 and / or the RAM 503. It should be noted that the programs can also be stored in one or more memories other than the ROM 502 and the RAM 503. The processor 501 can also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0138] According to an embodiment of the present disclosure, the electronic device 500 can further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 can further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 510 as necessary, so that a computer program read out therefrom is installed in the storage portion 508 as necessary.

[0139] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0140] According to an embodiment of the present disclosure, the computer readable storage medium can be a nonvolatile computer readable storage medium, for example, can include but not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), a portable compact disc read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories of the ROM 502 and / or the RAM 503 described above and / or in addition to the ROM 502 and the RAM 503.

[0141] Embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the evaluation method applied to the packet capture tool provided by the embodiments of the present disclosure.

[0142] The above functions defined in the system / device of the embodiments of the present disclosure are performed when the computer program is executed by the processor 501. According to an embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0143] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, downloaded and installed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the detachable medium 511. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to wireless, wired, etc., or any suitable combination of the foregoing.

[0144] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the detachable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0145] According to embodiments of the present disclosure, program code of the computer program for performing the methods provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and can be implemented in a computer program product. Specifically, the computer program can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. The programming language includes, but is not limited to, Java, C++, python, “C” language, or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, and partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider (ISP).

[0146] The computer program product of the present disclosure can be a computer program product, which is a machine-readable medium (or computer readable medium) having stored therein a sequence of instructions readable by a machine (e.g., a computer). The instructions in the machine-readable medium focus on the function of the computer program (e.g., in the form of a program unit) and on the cooperation behavior between such program units. The program can be distributed over networks coupled to one or more processors or computers, and can be stored on computer readable media including computer program products, hard drives, RAMs, or any other device (internal or external) from which a processor or computer reads incoming data or instructions. In addition to being distributed over the Internet, or over any other publicly or privately accessed network, the aforementioned program product can also be stored in the memory of the respective machine and / or processor.

[0147] Those skilled in the art will understand that features of the various embodiments and / or claims of the present disclosure can be combined or / and integrated with one another, even though such a combination or integration is not expressly disclosed in the present disclosure. In particular, the features of the various embodiments and / or claims of the present disclosure can be combined or / and integrated with one another in any combination, without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations are within the scope of the present disclosure.

[0148] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. An evaluation method for packet capture tools, comprising: In response to a request to retrieve a packet capture tool, a packet capture tool to be evaluated is obtained, wherein the request to retrieve the packet capture tool carries packet capture attribute data associated with the packet capture tool to be evaluated, and a packet capture identifier associated with the packet capture tool to be evaluated. If the packet capture attribute data meets the first evaluation criterion, based on the packet capture identifier, the test scenario cluster corresponding to the packet capture identifier is searched in the data warehouse. The test scenario cluster is generated based on the evaluation results of historical packet capture tools. Based on the usage frequency and evaluation process of the test scenarios, the test scenarios associated with the packet capture tool to be evaluated are extracted from the test scenario cluster. Based on the test scenario, at least one feature indicator that the packet capture tool to be evaluated can complete in the test scenario is determined, and a feature indicator set is obtained. Each feature index in the feature index set is processed based on preset evaluation rules to obtain multiple evaluation values; and Based on the multiple evaluation values, an evaluation result associated with the packet capture tool to be evaluated is determined.

2. The method according to claim 1, wherein, The condition that the packet capture attribute data meets the first evaluation criterion includes: In response to the request to invoke the packet capture tool, the first evaluation standard is obtained, wherein the first evaluation standard includes multiple first evaluation indicators; If the packet capture attribute data matches all of the first evaluation indicators, the packet capture attribute data is considered to meet the first evaluation criteria.

3. The method according to claim 1, wherein, The test scenario is configured with a scenario identifier; Based on the test scenario, at least one characteristic indicator is determined that the packet capture tool to be evaluated can perform in the test scenario, resulting in a set of characteristic indicators including: Based on the scenario identifier, multiple second evaluation indicators associated with the test scenario are determined from the data warehouse; The packet capture tool to be evaluated was pre-run in the test scenario to obtain several initial characteristic indicators; If at least one of the plurality of initial feature indicators matches at least one of the plurality of second evaluation indicators, the feature indicator set is generated based on the at least one initial feature indicator.

4. The method according to claim 3, wherein, Each of the multiple second evaluation indicators is configured with a set of sub-evaluation indicators; The process of processing each feature indicator in the feature indicator set based on preset evaluation rules yields multiple evaluation values, including: Each feature indicator is transformed and aggregated to obtain the running results associated with each feature indicator; The running results are matched with the sub-evaluation index set to obtain the matching results; Based on the matching results, each feature indicator is assigned a value using the preset evaluation rules to obtain the multiple evaluation values.

5. The method according to claim 4, wherein, The step of determining the evaluation result associated with the packet capture tool to be evaluated based on the multiple evaluation values ​​includes: Each of the plurality of evaluation values ​​is assigned a weight. Based on each evaluation value and the weight corresponding to each evaluation value, a total evaluation value associated with the packet capture tool to be evaluated is determined; Based on the total evaluation value, the evaluation result associated with the packet capture tool to be evaluated is determined.

6. The method according to claim 5, further comprising: The evaluation results associated with the packet capture tool to be evaluated are stored in the data warehouse so that the evaluation results associated with the packet capture tool to be evaluated can be directly obtained in response to the request to retrieve the packet capture tool.

7. The method according to claim 1, wherein, The feature indicators include at least one of the following: usability indicators, scanning indicators, anti-replay indicators, data encryption indicators, data desensitization indicators, data transcoding indicators, and data stream conversion indicators.

8. An evaluation device for packet capture tools, comprising: The first acquisition module is used to acquire the packet capture tool to be evaluated in response to a request to retrieve the packet capture tool, wherein the request to retrieve the packet capture tool carries packet capture attribute data associated with the packet capture tool to be evaluated, and a packet capture identifier associated with the packet capture tool to be evaluated. The first extraction module is used to search for a test scenario cluster corresponding to the packet capture identifier in the data warehouse based on the packet capture identifier when the packet capture attribute data meets the first evaluation criteria. The test scenario cluster is generated based on the evaluation results of historical packet capture tools. Based on the usage frequency and evaluation process of the test scenarios, the module extracts test scenarios associated with the packet capture tool to be evaluated from the test scenario cluster. The first determining module is used to determine, based on the test scenario, at least one feature indicator that the packet capture tool to be evaluated can complete in the test scenario, and obtain a feature indicator set; The first processing module is used to process each feature index in the feature index set based on preset evaluation rules to obtain multiple evaluation values; and The second determining module is used to determine the evaluation result associated with the packet capture tool to be evaluated based on the multiple evaluation values.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images