A method and device for analyzing temporary protocol
The Suricata engine-based method and device facilitate rapid protocol identification by generating a universal framework for temporary protocols, addressing the slow response issue in traditional systems and enhancing network security.
Patent Information
- Application Number
- CN202211267500.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-10-17
- Publication Date
- 2024-12-27
- Estimated Expiration
- 2042-10-17
AI Technical Summary
Traditional methods for identifying application layer protocols in industrial flow probes are often too slow to react effectively in emergency security scenarios, especially for unfamiliar protocols, leading to delayed responses and compromised network security.
A method and device that utilize a Suricata engine to generate a temporary protocol parsing framework based on input configuration information, allowing rapid identification of temporary protocols by reusing a general framework for all protocols, reducing the need for repeated protocol parsing framework generation.
Enables rapid and efficient identification of temporary protocols, improving response times in emergency scenarios by using a universal framework for protocol recognition, thereby enhancing network security and user experience.
Smart Images
Figure CN115766539B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of protocol analysis, and in particular to a method and device for analyzing a temporary protocol. Background Art
[0002] With the development of the industrial Internet, more and more industrial equipment are connected to the Internet, especially industrial flow probes. The connection between the internal network of enterprises and the public Internet has promoted the improvement of production efficiency on the one hand, but also made flow probes face various protocol identification challenges on the other hand. The protocol information faced by industrial flow probes changes rapidly, and the demand for the identification function of temporary protocols is becoming more and more prominent.
[0003] In traditional solutions, traffic probes are deployed on the packet transmission bearer network mainly through bypass or serial connection to identify the network application or protocol to which known traffic belongs, so as to timely discover and handle network failures and security vulnerabilities, improve network service quality and protect network space. However, when this method identifies a large number of application layer protocols, in some emergency security scenarios, it is often too late to react to unfamiliar application layer protocol traffic probes and cannot make an effective response, which greatly affects the user experience. Summary of the invention
[0004] The embodiments of the present application provide a method and device for parsing a temporary protocol, which can solve the technical problem of how to quickly identify a temporary protocol.
[0005] In a first aspect, an embodiment of the present application provides a method for parsing a temporary protocol, including:
[0006] The front-end page obtains temporary protocol information and then generates a temporary configuration file based on the temporary protocol information.
[0007] The backend application generates a Suricata configuration file based on the temporary configuration file.
[0008] The Suricata engine obtains the information of the Suricata configuration file and generates a temporary protocol parsing framework, and then adds a temporary protocol according to the information of the Suricata configuration file and the temporary protocol parsing framework. The temporary protocol parsing framework is a general framework applicable to all temporary protocols, and all temporary protocols can be used without generating the protocol parsing framework multiple times, thereby reducing the time of protocol identification and improving the efficiency of protocol identification.
[0009] In one embodiment, the Suricata configuration file information includes: input configuration information. The input configuration information includes: protocol port information, protocol name information and / or protocol feature string information. Selecting the protocol port information and the protocol feature string information can ensure the recognition effect of the protocol and prevent errors in protocol recognition.
[0010] In one embodiment, when the input configuration information is protocol port information and / or protocol name information, the above-mentioned adding a temporary protocol according to the information of the Suricata configuration file and the temporary protocol parsing framework includes:
[0011] The Suricata engine identifies any protocol in the protocol port information, uses the protocol port information to replace the identification condition information in the temporary protocol parsing frame, and uses the protocol name information to replace the protocol name information in the temporary protocol parsing frame, thereby completing the addition and registration of the temporary protocol.
[0012] In one embodiment, when the input configuration information is protocol feature string information and / or protocol name information,
[0013] The above adds temporary protocols based on the information in the Suricata configuration file and the temporary protocol parsing framework, including:
[0014] The Suricata engine identifies any protocol with protocol feature string information, uses the protocol feature string information to replace the identification condition information in the temporary protocol parsing frame, and uses the protocol name information to replace the protocol name information in the temporary protocol parsing frame, thereby completing the addition and registration of the temporary protocol.
[0015] In one embodiment, after the temporary protocol is added and registered, when the temporary protocol passes through the traffic probe again, the Suricata engine identifies the temporary protocol by comparing the protocol port information and / or the protocol feature string information.
[0016] In one embodiment, the method further includes: after completing the addition and registration of the temporary protocol, the Suricata engine outputs a JSON file or a socket connection, and the JSON file or the socket connection is used to establish a connection with a third-party data platform, so as to facilitate integration with other databases or security data analysis platforms.
[0017] In one embodiment, the method further includes: after the Suricata engine adds the temporary protocol, the addition result information is sent to the back-end application program, so as to facilitate the real-time display of the recognition result of the protocol and facilitate the user to check the result.
[0018] In a second aspect, an embodiment of the present application provides a temporary protocol parsing device, which has the function of implementing the method in the first aspect or any possible implementation thereof. Specifically, the device includes a unit that implements the method in the first aspect or any possible implementation thereof.
[0019] In one embodiment, the device includes: a front-end page, a back-end application, and a Suricata engine.
[0020] The front-end page is used to obtain temporary protocol information and then generate a temporary configuration file based on the temporary protocol information.
[0021] The backend application is used to generate Suricata configuration files based on the temporary configuration files.
[0022] The Suricata engine is used to obtain information from the Suricata configuration file and generate a temporary protocol parsing framework, and add a temporary protocol based on the information from the Suricata configuration file and the temporary protocol parsing framework.
[0023] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method of any one of the implementation modes of the first aspect or the second aspect is implemented.
[0024] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method of any one of the implementation modes of the first aspect or the second aspect described above is implemented.
[0025] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device executes a method implemented in any one of the first or second aspects above.
[0026] Compared with the prior art, the embodiments of the present application have the following beneficial effects: after the front-end page obtains the information of the temporary protocol, it configures and generates a temporary protocol configuration file; the back-end application generates a Suricata configuration file for use by the Suricata engine based on the temporary protocol configuration file; the Suricata engine executes the Suricata configuration file to generate a temporary protocol parsing framework; the temporary protocol parsing framework is a general framework applicable to all temporary protocols; all temporary protocols can use this temporary protocol parsing framework to identify and parse the protocol; there is no need to generate protocol parsing frameworks for different protocols multiple times, thereby achieving rapid identification of temporary protocols and achieving the effect of rapid response to on-site needs. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] Figure 1 It is a flowchart of a method for parsing a temporary protocol provided in one embodiment of the present application;
[0028] Figure 2 It is a schematic diagram of a flow chart of parsing a temporary protocol provided by an embodiment of the present application;
[0029] Figure 3It is a structural diagram of a temporary protocol parsing device provided in an embodiment of the present application;
[0030] Figure 4 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0031] Application layer protocol identification refers to extracting key features that can identify application layer protocols from network traffic that carries application layer protocol data, and based on these key features, grouping the same type of application layer protocol data together. Application layer protocol identification technology is an important foundation for network service providers and network administrators to provide differentiated service quality assurance, implement intrusion detection, and traffic monitoring.
[0032] At present, the application layer protocol identification technology package is mainly based on the traffic classification method based on the port number. The traffic classification method based on the port number is based on the recommendation of IANA (Internet Agency Membership Administration), and distinguishes these commonly used protocols based on the port numbers commonly used by protocols such as HTTP, FTP, and TELNET. For example, port 80 is used for HTTP protocol communication, and port 21 is used for FTP protocol communication.
[0033] Generally speaking, when identifying a large number of application layer protocols, traffic probes require developers to code and develop them before they can be identified and captured. In some emergency security scenarios, traffic probes for unfamiliar application layer protocols often have too little time to react and are unable to make effective displays and actions.
[0034] In response to the above problems, an embodiment of the present application provides a method for parsing a temporary protocol, which mainly adds a temporary protocol configuration to the existing front-end page, obtains the protocol port information and / or protocol feature string information of the protocol to be identified, and then quickly generates the parsing code of the corresponding protocol through the front-end page configuration, thereby preliminarily realizing the identification of the protocol and common field parsing.
[0035] In order to illustrate the technical solution of the present application, specific embodiments are provided below.
[0036] Figure 1 It is a flowchart of a method for parsing a temporary protocol provided by an embodiment.
[0037] like Figure 1 As shown,
[0038] S1, the front-end page obtains temporary protocol information, and then generates a temporary configuration file based on the temporary protocol information.
[0039] The temporary protocol information includes: protocol name information, protocol feature information, and protocol type information.
[0040] The protocol feature information includes protocol port information and protocol feature string information.
[0041] In one example, the front-end page can be developed using the Vue language, and a temporary protocol configuration can be added to the existing interface. During runtime, the "Add Temporary Protocol" interface will be displayed on the front-end page. Select "Add Protocol" and enter the protocol name information, protocol feature information, and protocol type information in the input box. After clicking OK, the front-end page configuration generates a temporary configuration file and updates it locally.
[0042] S2, the backend application generates a Suricata configuration file based on the temporary configuration file.
[0043] The backend application is mainly responsible for the transmission and processing of messages between the front-end page and the Suricata engine, ensuring that the front-end configuration can be sent to the Suricata configuration file.
[0044] In one example, after the front-end page configuration generates a temporary configuration file, the back-end application uses it as a basis to generate the latest Suricata configuration file for use by the Suricata engine.
[0045] In one example, the Suricata configuration file is a Suricata.yaml file, and the Suricata configuration file information includes: input configuration information. The input configuration information includes: protocol port information, protocol name information and / or protocol feature string information.
[0046] S3, the Suricata engine obtains the information of the Suricata configuration file and generates a temporary protocol parsing framework, and then adds a temporary protocol according to the information of the Suricata configuration file and the temporary protocol parsing framework.
[0047] The Suricata engine is capable of real-time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitor (NSM) and offline pcap processing. It is an open source, fast and highly stable network intrusion detection system. The Suricata engine consists of several modules, such as capture, collection, decoding, detection and output. Suricata can automatically detect protocols on any port, such as HTTP protocol, FTP protocol, etc., and apply appropriate detection and logging logic. The Suricata engine can obtain information from the Suricata configuration file multiple times and generate a temporary protocol parsing framework.
[0048] The temporary protocol parsing framework refers to the protocol framework code that can be used by any temporary protocol in an emergency situation. The temporary protocol parsing framework is a general framework applicable to all temporary protocols.
[0049] In non-emergency situations, each protocol framework code needs to be generated by executing the Suricata script. For example, when adding the HTTP protocol, you need to execute the Suricata script to generate the framework code of the HTTP protocol; when adding the FTP protocol, you need to execute the Suricata script to generate the framework code of the FTP protocol.
[0050] In emergency situations, all temporary protocols reuse a framework code, and there is no need to generate a framework code for each protocol. For example, when adding the HTTP protocol, the Suricata script is executed to generate a temporary protocol parsing framework code; when adding the FTP protocol, the temporary protocol code is still used, and there is no need to generate a temporary protocol parsing framework code again.
[0051] In one example, the Suricata engine adds a temporary protocol based on the information in the Suricata configuration file and the temporary protocol parsing framework in the following two cases.
[0052] In the first case, when the input configuration information is protocol port information and / or protocol name information, the Suricata engine identifies any protocol in the protocol port information, uses the protocol port information to replace the identification condition information in the temporary protocol parsing frame, and uses the protocol name information to replace the protocol name information in the temporary protocol parsing frame, thereby completing the addition and registration of the temporary protocol.
[0053] For example, when registering the HTTP protocol, the protocol port information is replaced with port 80, and the protocol name information is replaced with the HTTP protocol.
[0054] For example, when registering the FTP protocol, the protocol port information is replaced with port 21 or port 22, and the protocol name information is replaced with the FTP protocol.
[0055] In the second case, when the input configuration information is protocol feature string information and / or protocol name information, the Suricata engine identifies any protocol with protocol feature string information, uses the protocol feature string information to replace the identification condition information in the temporary protocol parsing framework, and uses the protocol name information to replace the protocol name information in the temporary protocol parsing framework, thereby completing the addition and registration of the temporary protocol.
[0056] For example, when identifying the SSH protocol, multiple characteristic character strings can be entered as protocol characteristic character string information for replacement. The characteristic character string can be selected according to actual conditions and is not limited here. The protocol name information is replaced with the SSH protocol.
[0057] For example, when identifying the JTT808 protocol, multiple feature strings can be entered as protocol feature string information for replacement. The feature string can be selected based on actual conditions and is not limited here; the protocol name information is replaced with the JTT808 protocol.
[0058] In one embodiment, after the temporary protocol is added and registered, when the temporary protocol passes through the traffic probe again, the Suricata engine identifies the temporary protocol by comparing the protocol port information and / or the protocol feature string information.
[0059] For example, after the HTTP protocol is added and registered, when the HTTP protocol passes through the traffic probe again through a link or a loading packet, the Suricata engine compares the port information of the protocol with the port information registered in the temporary protocol parsing framework. The comparison result is port 80, which means that the protocol name information of the protocol is the HTTP protocol.
[0060] For example, after the FTP protocol is added and registered, when the FTP protocol passes through the traffic probe again through a link or a loading packet, the Suricata engine compares the port information of the protocol with the port information registered in the temporary protocol parsing framework. The comparison result is port 21 or port 22, and the protocol name information of the protocol can be identified as the FTP protocol.
[0061] In one embodiment, after completing the addition and registration of the temporary protocol, the Suricata engine outputs a JSON file or a socket connection, and the JSON file or the socket connection is used to establish a connection with a third-party data platform.
[0062] JSON file stands for Java Script Object Notation, which is a lightweight data exchange format file. JSON files can store simple data structures and objects and can be easily sent to and from the server.
[0063] After a Socket connection is established, the two communicating parties can start sending data to each other until the connection between the two parties is disconnected.
[0064] For example, when the protocol name information of the protocol is identified as the HTTP protocol, the logging logic can be used to output a JSON file or a socket connection to facilitate integration with other databases or security data analysis platforms.
[0065] In one embodiment, after the Suricata engine adds the temporary protocol, it sends the addition result information to the backend application.
[0066] The backend application can correctly display the processing results of the Suricata engine in real time according to the added result information, so that users can understand the recognition status of the temporary protocol and can intuitively know the protocol name and other information of the temporary protocol.
[0067] Figure 2 FIG. 1 is a flow chart of a temporary protocol analysis method provided by an embodiment of the present application. Figure 2 As shown,
[0068] In the Start-A phase: Deploy the traffic component environment, prepare to add a temporary protocol. At this time, click the Temporary Protocol Add column on the front-end page, select Add Protocol, enter the protocol name information, protocol feature information (protocol port information or feature string information) and protocol type information, and click OK to update the configuration to the local temporary configuration file.
[0069] In the AB stage: the backend service code generates the latest Suricata.yaml file for the Suricata engine to use based on the temporary configuration file generated by the front-end page configuration.
[0070] In the BC phase, the Suricata engine obtains and executes the corresponding Suricata.yaml file in the background, and reads the content of the temporary protocol configuration file. The Suricata engine generates the temporary protocol parsing framework code locally. After the temporary protocol framework is added, the protocol feature information (protocol port information or protocol feature string information) is registered in the temporary protocol framework code, that is, the protocol is added successfully.
[0071] When the protocol after adding registration passes through the traffic probe again, the protocol can be identified.
[0072] In emergency situations, taking HTTP and FTP protocols as examples, the above process can be understood as follows: First, the name, port (port 80) and type of the HTTP protocol are entered through the temporary protocol configuration newly added on the front-end page. The front-end page configuration generates a temporary configuration file, and the back-end application uses this as a basis to generate the corresponding Suricata.yaml file. Then, the Suricata engine obtains and executes the corresponding Suricata.yaml file, reads the name, port (port 80) and type of the HTTP protocol, generates a temporary protocol parsing framework code, and then replaces the identification condition information in the temporary protocol parsing framework with port 80, and replaces the protocol name information with the HTTP protocol. Finally, when the HTTP protocol passes through the traffic probe again, the Suricata engine can identify the HTTP protocol by comparing the port information, and can display the protocol identification results in real time.
[0073] After recognizing the HTTP protocol, when recognizing the FTP protocol, the name, port (port 21 or port 22) and type of the FTP protocol are input through the temporary protocol configuration newly added on the front-end page. The front-end page generates a temporary configuration file, and the back-end application uses this as a basis to generate the corresponding Suricata.yaml file. The Suricata engine obtains and executes the corresponding Suricata.yaml file, reads the name, port (port 80) and type of the FTP protocol, and does not need to generate a new temporary protocol parsing framework code at this time. The temporary protocol framework code generated when recognizing the HTTP protocol can continue to be used (that is, the temporary protocol framework code is universal), and then the identification condition information in the temporary protocol parsing framework is replaced with port 21 or port 22, and the protocol name information is replaced with the FTP protocol. When the FTP protocol passes through the flow probe again, the Suricata engine can identify the FTP protocol by comparing the port information, and can display the recognition results of the protocol in real time.
[0074] By analogy, when faced with the parsing of multiple protocols, this method is adopted, utilizing the interaction of the front-end page, the back-end application and the Suricata engine. It is only necessary to obtain the temporary protocol information and configure it on the front-end page to realize the protocol identification, thus shortening the parsing time of the temporary protocol and improving the parsing efficiency of the temporary protocol.
[0075] Compared with non-emergency situations, in non-emergency situations, the addition of each protocol framework code requires the execution of Suricata script generation, registering the protocol feature information (protocol port information or protocol feature string information) in the generated protocol framework code, and each protocol is divided into public field parsing and private field parsing. It is necessary to manually write code in the generated framework, and then repackage the Suricata engine (executable file) to replace the old engine (executable file) in the on-site environment.
[0076] In emergency scenarios, all temporary protocols reuse a framework code (dedicated to temporary protocols). Suricata receives the temporary protocol configuration (protocol port information or protocol feature string information) from the front end and registers the protocol feature information (protocol port information or protocol feature string information) in the temporary protocol framework code. Since it is a temporary protocol parsing, the temporary protocol only performs public field parsing, such as IP and other information, which can achieve rapid response of protocol parsing.
[0077] The above mainly introduces a method for parsing a temporary protocol of an embodiment of the present application in conjunction with the accompanying drawings. It should be understood that although the various steps in the flowcharts involved in the embodiments described above are displayed in sequence, these steps are not necessarily executed in sequence in the order shown in the figure. Unless clearly stated in this article, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the embodiments described above may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps. The following is an introduction to a device of an embodiment of the present application in conjunction with the accompanying drawings. For the sake of brevity, when introducing the device below, it will be appropriately omitted, and the relevant content can refer to the relevant description in the method above, and will not be repeated. Figure 3 It is a structural schematic diagram of a device provided in an embodiment of the present application.
[0078] like Figure 3 As shown, a temporary protocol parsing device 1000 includes: a front-end page 1001, a back-end application 1002 and a Suricata engine 1003.
[0079] The front-end 1001 page is used to obtain temporary protocol information, and then generate a temporary configuration file based on the temporary protocol information. Figure 2 The beginning of the A phase.
[0080] The backend application 1002 is used to generate a Suricata configuration file based on the temporary configuration file. Figure 2 The AB phase.
[0081] The Suricata engine 1003 is used to obtain information of the Suricata configuration file, generate a temporary protocol parsing framework, and add a temporary protocol according to the information of the Suricata configuration file and the temporary protocol parsing framework. Figure 2 The BC stage.
[0082] It should be noted that the information interaction, execution process and other contents between the above-mentioned units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.
[0083] An embodiment of the present application also provides a computer device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on at least one processor, and when the processor executes the computer program, the steps in any of the above-mentioned method embodiments are implemented.
[0084] Figure 4 Schematic diagram of the structure of the computer device provided in the embodiment of the present application. Figure 4 As shown, the computer device 3000 of this embodiment includes: at least one processor 3100 ( Figure 4 Only one processor is shown in the figure, a memory 3200, and a computer program 3210 stored in the memory 3200 and executable on at least one processor 3100. When the processor 3100 executes the computer program 3210, the steps in the above embodiments are implemented.
[0085] The processor 3100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
[0086] In some embodiments, the memory 3200 may be an internal storage unit of the computer device 3000, such as a hard disk or memory of the computer device 3000. In other embodiments, the memory 3200 may also be an external storage device of the computer device 3000, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 3000. Further, the memory 3200 may also include both an internal storage unit of the computer device 3000 and an external storage device. The memory 3200 is used to store an operating system, an application program, a boot loader (Boot Loader) data, and other programs, such as a program code of a computer program, etc. The memory 3200 may also be used to temporarily store data that has been output or is to be output.
[0087] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units in the embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.
[0088] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.
[0089] The embodiments of the present application provide a computer program product, which can implement the above methods when the computer program product is run on a computer.
[0090] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.
[0091] It should be understood that the size of the sequence number of each step in the above-described embodiment does not mean the order of execution, and the order of execution of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiment of the present application. In the description, for the purpose of explanation rather than for limitation, specific details such as specific system structure, technology and the like are proposed, so as to thoroughly understand the embodiment of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, the detailed description of well-known systems, devices, circuits and methods is omitted to prevent unnecessary details from hindering the description of the present application.
[0092] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.
[0093] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.
[0094] Additionally, in the specification of the present application and the description of the appended claims, the terms “include,” “comprise,” “have,” and their variations all mean “including but not limited to,” unless otherwise specifically emphasized.
[0095] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0096] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0097] In the embodiments provided in the present application, it should be understood that the disclosed devices, computer equipment and methods can be implemented in other ways. For example, the device and computer equipment embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0098] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.
Claims
1. A method for parsing a temporary protocol, characterized in that: include: The front-end page obtains temporary protocol information, and then generates a temporary configuration file according to the temporary protocol information; The back-end application generates a Suricata configuration file according to the temporary configuration file, wherein the Suricata configuration file information includes: input configuration information, wherein the input configuration information includes: protocol port information, protocol name information and / or protocol feature string information; Obtain information of the Suricata configuration file and generate a temporary protocol parsing framework, wherein the temporary protocol parsing framework is a general framework applicable to all temporary protocols; When the input configuration information is the protocol port information and / or the protocol name information, the Suricata engine identifies any protocol in the protocol port information, uses the protocol port information to replace the identification condition information in the temporary protocol parsing framework, uses the protocol name information to replace the protocol name information in the temporary protocol parsing framework, and completes the addition and registration of the temporary protocol; and / or When the input configuration information is the protocol feature string information and / or the protocol name information, the Suricata engine identifies any protocol that has the protocol feature string information, uses the protocol feature string information to replace the identification condition information in the temporary protocol parsing framework, and uses the protocol name information to replace the protocol name information in the temporary protocol parsing framework, thereby completing the addition and registration of the temporary protocol.
2. The method according to claim 1, characterized in that The method further comprises: after completing the addition registration of the temporary protocol, When the temporary protocol passes through the flow probe again, the Suricata engine identifies the temporary protocol by comparing the protocol port information and / or the protocol feature string information.
3. The method according to claim 2, characterized in that The method further comprises: After completing the addition and registration of the temporary protocol, the Suricata engine outputs a JSON file or a socket connection, and the JSON file or the socket connection is used to establish a connection with a third-party data platform.
4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: After adding the temporary protocol, the Suricata engine sends the adding result information to the backend application.
5. A temporary protocol parsing device, characterized in that: The device includes a front-end page, a back-end application and a Suricata engine; The front-end page is used to obtain temporary protocol information, and then generate a temporary configuration file according to the temporary protocol information; The back-end application is used to generate a Suricata configuration file according to the temporary configuration file, and the Suricata configuration file information includes: input configuration information, and the input configuration information includes: protocol port information, protocol name information and / or protocol feature string information; The Suricata engine is used to obtain information of the Suricata configuration file and generate a temporary protocol parsing framework, which is a general framework applicable to all temporary protocols; When the input configuration information is the protocol port information and / or the protocol name information, the Suricata engine is used to: identify any protocol in the protocol port information, use the protocol port information to replace the identification condition information in the temporary protocol parsing framework, and use the protocol name information to replace the protocol name information in the temporary protocol parsing framework to complete the addition and registration of the temporary protocol; and / or When the input configuration information is the protocol feature string information and / or the protocol name information, the Suricata engine is used to: identify any protocol having the protocol feature string information, use the protocol feature string information to replace the identification condition information in the temporary protocol parsing framework, and use the protocol name information to replace the protocol name information in the temporary protocol parsing framework to complete the addition and registration of the temporary protocol.
6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.
7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.