Data processing method and device of an audit system

Abstract

This application provides a data processing method and apparatus for an auditing system, relating to the field of data security technology. The data processing method includes: acquiring target traffic data to be audited; performing traffic analysis based on the target traffic data to acquire request-direction data or response-direction data; if request-direction data is acquired, storing the parsed request-direction data in a request data form; if response-direction data is acquired, storing the parsed response-direction data in a response data form; acquiring a target transaction retrieval request; performing a retrieval in the request data form based on the target transaction retrieval request to obtain a first retrieval result; if bidirectional data of the target transaction is required, performing a retrieval in the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request to obtain a second retrieval result. This data processing method can achieve the technical effect of improving audit processing efficiency.

Description

Technical Field

[0001] This application relates to the field of data security technology, and more specifically, to a data processing method and apparatus for an auditing system. Background Technology

[0002] In today's network environment, databases are used more and more widely, and database auditing systems bear the important responsibility of auditing database communication traffic. Database auditing systems audit all request statements made by database clients to the database server, as well as the server's response information to the clients, and retain the audit results for future backtracking and other operations.

[0003] In existing technologies, when monitoring database communication traffic in an environment, an auditing system simultaneously monitors data in both the request and response directions. The request data and its corresponding response data are stored as two parts of the same transaction in the auditing system's local database table, forming a transaction log. When subsequent source tracing is required, the auditing system searches for the relevant transaction based on the needs. The auditing system then returns the found transaction log to the user, typically displayed on the auditing system's front-end interface.

[0004] If the request and response traffic for the same transaction arrives at the audit system at significant intervals due to network / client / server factors—for example, request traffic arrives at the audit system 10 seconds later, or even response traffic arrives before request traffic—the audit system must cache traffic information from one direction and wait for traffic from the other to arrive. This caching consumes substantial system resources, and the waiting process causes a considerable delay before audit data is written to the local database, impacting audit efficiency.

[0005] Furthermore, the vast majority of database access traffic consists of SELECT statements. The request data in these statements is typically small, usually tens to hundreds of bytes, while the response data can range from several thousand bytes to hundreds of kilobytes depending on the query content. When the auditing system stores both request and response data for the same transaction in the same table entry, later, when there's a need for tracing, the user retrieves the target transaction in the auditing system based on certain conditions. The auditing system then displays the retrieved transaction table entries on the front-end interface, which will contain data from both the request and response sides. If the number of retrieved target transactions is very large, a massive amount of bidirectional table entry data will be returned from the auditing system's backend to the front-end page for display. This process consumes a significant amount of auditing system resources and has very low execution efficiency, requiring a considerable amount of time to display the final result. Summary of the Invention

[0006] The purpose of this application is to provide a data processing method, apparatus, electronic device, and computer-readable storage medium for an audit system, which can achieve the technical effect of improving audit processing efficiency.

[0007] In a first aspect, embodiments of this application provide a data processing method for an auditing system, including:

[0008] Obtain the target traffic data to be audited;

[0009] Perform traffic analysis based on the target traffic data to obtain request direction data or response direction data;

[0010] If request direction data is obtained, the request direction data is parsed according to the protocol to obtain request direction parsing data; the request direction parsing data is stored in the request data form, wherein the session ID and transaction ID of the request direction parsing data are used as identification information in the request data form;

[0011] If response direction data is obtained, the response direction data is parsed according to the protocol to obtain response direction parsing data; the response direction parsing data is stored in the response data form, wherein the session ID and transaction ID of the response direction parsing data are used as identification information in the response data form;

[0012] Obtain the target transaction retrieval request;

[0013] Based on the target transaction retrieval request, a search is performed in the request data form to obtain the first retrieval result;

[0014] If bidirectional data of the target transaction is required, the second search result is obtained by searching the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request.

[0015] In the above implementation process, the data processing method of this auditing system stores the request and response data in the target traffic of the database to be audited in separate tables. When data from either direction arrives at the auditing system, it can be parsed and directly stored in the corresponding data form, thereby avoiding the use of caching and waiting operations. Moreover, when storing the request and response data in separate tables, the session ID and transaction ID are used for data association to ensure that bidirectional data of the same transaction can be associated together. Thus, when performing transaction retrieval on the auditing system, only the data of the request direction of all target transactions can be retrieved and returned (first retrieval result). When it is necessary to obtain the bidirectional data of a specific transaction, the auditing system retrieves it again in the response data form based on the session ID and transaction ID of that transaction (second retrieval result), thus avoiding the return of a huge amount of bidirectional table data from the auditing system backend to the frontend page. Therefore, the data processing method of this auditing system can achieve the technical effect of improving audit processing efficiency.

[0016] Furthermore, before the step of storing the request direction parsing data into the request data form, the method further includes:

[0017] Based on the requested direction parsing data, obtain the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication;

[0018] The MD5 value is calculated based on the source / destination IP data, the source / destination port data, and the transport layer protocol number data, and the MD5 value is used as the session ID for the request direction parsing data.

[0019] Furthermore, before the step of storing the request direction parsing data into the request data form, the method further includes:

[0020] The request data in the first string format is obtained by calculating based on the TCP sequence number and application layer data length field value of the parsed data in the request direction.

[0021] The second string format request data is obtained by calculating the TCP response sequence number of the data parsed in the request direction.

[0022] The transaction ID of the request direction parsing data is obtained by concatenating the request data in the first string format and the request data in the second string format.

[0023] Furthermore, before the step of storing the response direction parsing data into the response data form, the method further includes:

[0024] Based on the response direction parsing data, the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication are obtained;

[0025] The MD5 value is calculated based on the source / destination IP data, the source / destination port data, and the transport layer protocol number data, and the MD5 value is used as the session ID of the response direction parsing data.

[0026] Furthermore, prior to the step of storing the response direction parsing data into the response data form, the method further includes:

[0027] The first string format response data is obtained by calculating the TCP sequence number of the parsed data based on the response direction.

[0028] The response data in the second string format is obtained by calculating the TCP response sequence number based on the parsed data of the response direction.

[0029] The transaction ID of the response direction parsing data is obtained by concatenating the first string format response data and the second string format response data.

[0030] Further, after the step of retrieving the second retrieval result from the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request, the method further includes:

[0031] Based on the first search result and the second search result, generate bidirectional search results for the target transaction.

[0032] Secondly, embodiments of this application also provide a data processing apparatus for an auditing system, comprising:

[0033] The target traffic acquisition module is used to acquire target traffic data to be audited.

[0034] The target traffic parsing module is used to perform traffic analysis based on the target traffic data to obtain request direction data or response direction data.

[0035] The storage module is configured to, if request direction data is obtained, perform protocol parsing on the request direction data to obtain request direction parsing data; store the request direction parsing data in a request data form, wherein the session ID and transaction ID of the request direction parsing data serve as identification information in the request data form; if response direction data is obtained, perform protocol parsing on the response direction data to obtain response direction parsing data; store the response direction parsing data in a response data form, wherein the session ID and transaction ID of the response direction parsing data serve as identification information in the response data form;

[0036] The retrieval request acquisition module is used to acquire the retrieval request for the target transaction;

[0037] The first retrieval module is used to perform a retrieval in the request data form according to the target transaction retrieval request and obtain the first retrieval result;

[0038] The second retrieval module is used to retrieve bidirectional data of the target transaction from the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request if bidirectional data of the target transaction is required, and obtain the second retrieval result.

[0039] Furthermore, the data processing device further includes: a request-direction session ID module, used to obtain source / destination IP data, source / destination port data, and transport layer protocol number data of the communication based on the request-direction parsing data; calculate an MD5 value based on the source / destination IP data, the source / destination port data, and the transport layer protocol number data, and use the MD5 value as the session ID of the request-direction parsing data.

[0040] Furthermore, the data processing device further includes: a request direction transaction ID module, used to calculate based on the TCP sequence number and application layer data length field value of the request direction parsed data to obtain first string format request data; calculate based on the TCP response sequence number of the request direction parsed data to obtain second string format request data; and concatenate the first string format request data and the second string format request data to obtain the transaction ID of the request direction parsed data.

[0041] Furthermore, the data processing device further includes: a response direction session ID module, used to obtain source / destination IP data, source / destination port data, and transport layer protocol number data of the communication based on the response direction parsing data; calculate an MD5 value based on the source / destination IP data, the source / destination port data, and the transport layer protocol number data, and use the MD5 value as the session ID of the response direction parsing data.

[0042] Furthermore, the data processing device further includes: a response direction transaction ID module, used to calculate based on the TCP sequence number of the response direction parsed data to obtain first string format response data; calculate based on the TCP acknowledgment sequence number of the response direction parsed data to obtain second string format response data; and concatenate the first string format response data and the second string format response data to obtain the transaction ID of the response direction parsed data.

[0043] Furthermore, the data processing device further includes a bidirectional retrieval module, used to generate bidirectional retrieval results for the target transaction based on the first retrieval result and the second retrieval result.

[0044] Thirdly, an electronic device provided in this application includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any of the first aspects.

[0045] Fourthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in any of the first aspects.

[0046] Fifthly, embodiments of this application provide a computer program product that, when run on a computer, causes the computer to perform the method described in any of the first aspects.

[0047] Other features and advantages disclosed in this application will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the above-described technology disclosed in this application.

[0048] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart illustrating a data processing method for an auditing system provided in this application embodiment;

[0051] Figure 2 A schematic diagram illustrating the process of obtaining the session ID and transaction ID of request direction parsing data provided in an embodiment of this application;

[0052] Figure 3 A schematic diagram illustrating the process of obtaining the session ID and transaction ID of response direction parsing data provided in an embodiment of this application;

[0053] Figure 4 A flowchart illustrating another data processing method for an auditing system provided in this application embodiment;

[0054] Figure 5A structural block diagram of the data processing apparatus for the audit system provided in this application embodiment;

[0055] Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0056] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0057] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0058] This application provides a data processing method, apparatus, electronic device, and computer-readable storage medium for an audit system. These can be applied to the process of storing and displaying request and response data in an audit system. The data processing method of this audit system stores request and response data from the target traffic of the database to be audited in separate tables. When data from either direction arrives at the audit system, it can be parsed and directly stored in the corresponding data form, thus avoiding caching and waiting operations. Furthermore, when storing request and response data in separate tables, session IDs and transaction IDs are used for data association, ensuring that bidirectional data within the same transaction can be associated together. Therefore, when performing transaction retrieval on the audit system, only data from all target transaction request directions can be retrieved and returned (first retrieval result). When bidirectional data from a specific retrieved transaction needs to be obtained, the audit system searches again in the response data form based on the transaction's session ID and transaction ID (second retrieval result), avoiding the return of massive amounts of bidirectional table entries from the audit system backend to the frontend page. Thus, this data processing method of the audit system can achieve the technical effect of improving audit processing efficiency.

[0059] Please see Figure 1 , Figure 1 The flowchart illustrates a data processing method for an auditing system provided in this application embodiment. The data processing method of the auditing system includes the following steps:

[0060] S100: Obtain the target traffic data to be audited.

[0061] For example, the target traffic data to be audited is the communication traffic of the database.

[0062] The system receives target traffic data to be audited, performs traffic analysis, and obtains data on the request or response directions.

[0063] S200: Perform traffic analysis based on target traffic data to obtain request direction data or response direction data.

[0064] For example, the system receives target traffic data to be audited, performs traffic analysis, and obtains data on the request or response direction.

[0065] S300: If request direction data is obtained, perform protocol parsing on the request direction data to obtain request direction parsing data; store the request direction parsing data in the request data form, wherein the session ID and transaction ID of the request direction parsing data are used as identification information in the request data form; if response direction data is obtained, perform protocol parsing on the response direction data to obtain response direction parsing data; store the response direction parsing data in the response data form, wherein the session ID and transaction ID of the response direction parsing data are used as identification information in the response data form.

[0066] For example, different processing is adopted according to the data type obtained: if request direction data is obtained, the request direction parsing data is stored in the request data form; if response direction data is obtained, the response direction parsing data is stored in the response data form; thus, the bidirectional data (request direction data or response direction data) of the audit transaction are stored in separate tables, avoiding unnecessary waiting and caching operations and improving record storage efficiency.

[0067] S400: Obtain the target transaction retrieval request;

[0068] S500: Based on the target transaction retrieval request, perform a retrieval in the request data form to obtain the first retrieval result.

[0069] For example, when retrieving a transaction, a search is performed in the request data form according to the target transaction retrieval request to obtain the first retrieval result; thus, the first retrieval result only returns the data in the request direction to reduce the amount of data processed in a short time.

[0070] S600: If bidirectional data of the target transaction is required, the second search result is obtained by searching the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request.

[0071] For example, when response direction data is needed, a second search result is obtained by retrieving the response data form using the session ID and transaction ID, thereby accurately obtaining the response direction data to ensure data integrity.

[0072] In some implementations, the data processing method of this auditing system stores the request and response data in the target traffic of the database to be audited in separate tables. When data from either direction arrives at the auditing system, it can be parsed and directly stored in the corresponding data form, thereby avoiding the use of caching and waiting operations. Moreover, when storing the request and response data in separate tables, the session ID and transaction ID are used for data association to ensure that bidirectional data of the same transaction can be associated together. Thus, when performing transaction retrieval on the auditing system, only the data of the request direction of all target transactions can be retrieved and returned (first retrieval result). When it is necessary to obtain the bidirectional data of a specific transaction, the auditing system retrieves it again in the response data form based on the session ID and transaction ID of that transaction (second retrieval result), thus avoiding the return of a huge amount of bidirectional table entries from the auditing system backend to the frontend page. Therefore, the data processing method of this auditing system can achieve the technical effect of improving audit processing efficiency.

[0073] Please see Figure 2 , Figure 2 This is a schematic diagram illustrating the process of obtaining the session ID and transaction ID of the request direction parsing data, as provided in an embodiment of this application.

[0074] For example, prior to the step of storing the request direction parsing data into the request data form, the data processing method of the audit system further includes:

[0075] S310: Obtain the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication based on the request direction parsing data;

[0076] S320: Calculate the MD5 value based on the source / destination IP data, source / destination port data, and transport layer protocol number data, and use the MD5 value as the session ID for resolving data in the request direction.

[0077] For example, before the step of storing the request direction parsing data into the request data form, the method further includes:

[0078] S330: Calculate the first string format request data based on the TCP sequence number and application layer data length field value of the parsed data in the request direction.

[0079] S340: Calculate the second string format request data based on the TCP response sequence number of the data parsed in the request direction;

[0080] S350: Concatenate the request data in the first string format and the request data in the second string format to obtain the transaction ID of the request direction parsing data.

[0081] For example, since database communication protocols are typically based on the TCP protocol, they do not provide transaction ID information at the application layer. Therefore, the auditing system needs to calculate a transaction ID based on the information from the TCP layer.

[0082] Please see Figure 3 , Figure 3 This is a schematic diagram illustrating the process of obtaining the session ID and transaction ID of the response direction parsing data, as provided in an embodiment of this application.

[0083] For example, before the step of storing the response direction parsing data into the response data form, the method further includes:

[0084] S410: Obtain the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication based on the response direction parsing data;

[0085] S420: Calculate the MD5 value based on the source / destination IP data, source / destination port data, and transport layer protocol number data, and use the MD5 value as the session ID for parsing data in the response direction.

[0086] For example, before the step of storing the response direction parsing data into the response data form, the method further includes:

[0087] S430: Calculate the first string format response data based on the TCP sequence number parsed from the response direction data;

[0088] S440: Calculate the response data in the second string format based on the TCP acknowledgment sequence number parsed from the response direction data;

[0089] S450: Concatenate the response data in the first string format and the response data in the second string format to obtain the transaction ID of the response direction parsing data.

[0090] Please see Figure 4 , Figure 4 This is a flowchart illustrating another data processing method for an auditing system provided in an embodiment of this application.

[0091] For example, after step S600: retrieving the second retrieval result from the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request, the method further includes:

[0092] S700: Generate bidirectional search results for the target transaction based on the first and second search results.

[0093] For example, bidirectional retrieval results of request-direction data and response-direction data are obtained to ensure data integrity.

[0094] For example, combined Figures 1 to 4 This application is primarily used in auditing systems where, after an audit system detects data from either direction, it can directly analyze the data and write it to the corresponding form without caching and waiting for data from the other direction. Data from the request and response directions are associated using dual IDs (session ID and transaction ID). When retrieving transactions, the auditing system only retrieves data from the request direction and returns it to the system front-end. If it needs to obtain response data for a specific transaction, it will perform a secondary retrieval from the response data form based on the dual ID information in the request direction data and return it to the system front-end.

[0095] In some implementation scenarios, combined with Figures 1 to 4 The method shown below has the following specific steps:

[0096] Step #1:

[0097] The auditing system monitors database traffic. If request data is detected, proceed to step #2. If response data is detected, proceed to step #3.

[0098] Step #2:

[0099] Parse the request data and store the parsed data in the request data form, such as the SQL statement: "SELECT 'YES' FROM USER_ROLE_PRIVS WHERE GRANTED_ROLE='DBA'", and write the session ID and transaction ID as unique and related identifiers for this table entry. The session ID is calculated as in step #2.1, and the transaction ID is calculated as in step #2.2.

[0100] Step #2.1:

[0101] The session ID is calculated by combining the source / destination IP addresses, source / destination ports, and transport layer protocol number, resulting in an MD5 hash. For example, if the source IP address for the requesting data is 1.1.1.1, the destination IP address is 2.2.2.2, the source port is 33333, the destination port is 1521, and the protocol is TCP (protocol number: 6), then the calculated session ID would be: 1c6b3d03d9e8583fcb02412906201507.

[0102] Step #2.2:

[0103] The process of calculating the transaction ID for the request data is as follows: In the TCP packet containing the request data, the sequence number is d74e5637, and the application layer data length field value is 132 bytes. Adding these values ​​together and converting them to a string format, the resulting string s1 is: "d74e56bb". The response sequence number is 77725ede, and after converting it to a string format, the resulting string s2 is: "77725ede". Concatenating s1 and s2, the final transaction ID is "d74e56bb77725ede".

[0104] Step #3:

[0105] The response data is parsed, and the parsed request data is stored in the response data form. A session ID and a transaction ID are written as unique identifiers and association identifiers for each entry. The session ID is calculated as in step #3.1, and the transaction ID is calculated as in step #3.2.

[0106] Step #3.1:

[0107] The session ID is calculated by combining the source / destination IP addresses, source / destination ports, and transport layer protocol number, resulting in an MD5 hash. For example, if the source IP address in the response data is 2.2.2.2, the destination IP address is 1.1.1.1, the source port is 1521, the destination port is 33333, and the protocol is TCP (protocol number: 6), then the calculated session ID would be: 1c6b3d03d9e8583fcb02412906201507.

[0108] Step #3.2:

[0109] The process of calculating the transaction ID for the response data is as follows: In the TCP packets of the response data, the acknowledgment sequence number is d74e56bb. After converting it to a string format, the resulting string s1 is "d74e56bb". The sequence number is 77725ede. After converting it to a string format, the resulting string s2 is "77725ede". Concatenating s1 and s2, the final transaction ID is "d74e56bb77725ede".

[0110] Step #4:

[0111] Retrieve target transactions on the audit system, such as retrieving all select transactions within the past week. The audit system backend only retrieves relevant transactions from the request data form. If, for example, 1 million request data entries for the target transaction are retrieved, all data is returned to the audit system frontend, such as a web page. When it is necessary to obtain the response direction data for a specific retrieved transaction, such as the transaction in step #2, proceed to step #5.

[0112] Step #5:

[0113] At the audit system front end, the system retrieves the response direction data of the target transaction. Then, using the session ID (1c6b3d03d9e8583fcb02412906201507) and transaction ID (d74e56bb77725ede) as search criteria, the audit system retrieves the response data entries from the response data form and returns them to the audit system front end.

[0114] In summary, the data processing method of the audit system provided in this application embodiment has at least the following beneficial effects:

[0115] 1) Avoid using caching and wait operations for database traffic that needs to be audited, and improve the efficiency of transaction record storage;

[0116] 2) When performing transaction retrieval on the auditing system, the amount of data retrieved / returned / displayed is significantly reduced, effectively improving processing efficiency. Furthermore, it can retrieve targeted response direction data for specific transactions when needed by the user, while still ensuring data integrity.

[0117] Please see Figure 5 , Figure 5 This is a structural block diagram of the data processing apparatus for an audit system provided in this application embodiment. The data processing apparatus for the audit system includes:

[0118] The target traffic acquisition module 100 is used to acquire target traffic data to be audited.

[0119] The target traffic parsing module 200 is used to perform traffic analysis based on target traffic data and obtain request direction data or response direction data.

[0120] The storage module 300 is used to, if request direction data is obtained, parse the request direction data according to the protocol to obtain request direction parsing data; store the request direction parsing data in a request data form, wherein the session ID and transaction ID of the request direction parsing data are used as identification information in the request data form; if response direction data is obtained, parse the response direction data according to the protocol to obtain response direction parsing data; store the response direction parsing data in a response data form, wherein the session ID and transaction ID of the response direction parsing data are used as identification information in the response data form;

[0121] The retrieval request acquisition module 400 is used to acquire the target transaction retrieval request;

[0122] The first retrieval module 500 is used to perform a retrieval in the request data form according to the target transaction retrieval request and obtain the first retrieval result;

[0123] The second retrieval module 600 is used to retrieve the second retrieval result by searching the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request if bidirectional data of the target transaction is required.

[0124] For example, the data processing apparatus further includes: a request-direction session ID module, configured to obtain source / destination IP data, source / destination port data, and transport layer protocol number data of the communication based on the request-direction parsing data; calculate an MD5 value based on the source / destination IP data, source / destination port data, and transport layer protocol number data; and use the MD5 value as the session ID of the request-direction parsing data.

[0125] For example, the data processing apparatus further includes: a request-direction transaction ID module, configured to calculate and obtain request data in a first string format based on the TCP sequence number and the application layer data length field value of the request-direction parsed data; calculate and obtain request data in a second string format based on the TCP response sequence number of the request-direction parsed data; and concatenate the request data in the first string format and the request data in the second string format to obtain the transaction ID of the request-direction parsed data.

[0126] For example, the data processing apparatus further includes: a response direction session ID module, used to obtain the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication based on the response direction parsing data; calculate an MD5 value based on the source / destination IP data, source / destination port data, and transport layer protocol number data, and use the MD5 value as the session ID of the response direction parsing data.

[0127] For example, the data processing apparatus further includes: a response direction transaction ID module, configured to calculate based on the TCP sequence number of the response direction parsing data to obtain response data in a first string format; calculate based on the TCP acknowledgment sequence number of the response direction parsing data to obtain response data in a second string format; and concatenate the first string format response data and the second string format response data to obtain the transaction ID of the response direction parsing data.

[0128] For example, the data processing apparatus further includes a bidirectional retrieval module for generating bidirectional retrieval results for the target transaction based on the first retrieval result and the second retrieval result.

[0129] It should be noted that the data processing device of the audit system provided in this application embodiment is related to... Figures 1 to 4 The methods described in the examples are corresponding to each other, and will not be repeated here to avoid repetition.

[0130] This application also provides an electronic device, please refer to [link to application]. Figure 6 , Figure 6This is a structural block diagram of an electronic device provided in an embodiment of this application. The electronic device may include a processor 510, a communication interface 520, a memory 530, and at least one communication bus 540. The communication bus 540 is used to enable direct communication between these components. In this embodiment, the communication interface 520 of the electronic device is used for signaling or data communication with other node devices. The processor 510 may be an integrated circuit chip with signal processing capabilities.

[0131] The processor 510 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 510 can be any conventional processor.

[0132] Memory 530 may be, but is not limited to, random access memory (RAM).

[0133] Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc. The memory 530 stores computer-readable instructions, and when the computer-readable instructions are...

[0134] When the processor 510 executes, the electronic device can perform the above-mentioned... Figures 1 to 4 The method implementation involves various steps.

[0135] Alternatively, the electronic device may also include a storage controller and an input / output unit.

[0136] The memory 530, memory controller, processor 510, peripheral interface, and input / output unit are electrically connected directly or indirectly to each other to achieve data transmission or interaction. For example,

[0137] These components are electrically connected to each other via one or more communication buses 540. The processor 510 is used to execute executable modules stored in the memory 530, such as software function modules or computer programs included in electronic devices.

[0138] The input / output unit is used to provide users with the ability to create tasks and to set optional start periods or preset execution times for those tasks, thereby enabling user-server interaction. The input / output unit may be, but is not limited to, a mouse and keyboard.

[0139] 0 is understandable. Figure 6 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 6

[0140] The more or fewer components shown, or having the same Figure 6 The different configurations shown. Figure 6 The components shown can be implemented using hardware, software, or a combination thereof.

[0141] This application also provides a storage medium storing instructions. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in embodiment 5. To avoid repetition, it will not be described again here.

[0142] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0143] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0144] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0145] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0146] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0147] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0148] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A data processing method for an auditing system, characterized in that, include: Obtain the target traffic data to be audited; Perform traffic analysis based on the target traffic data to obtain request direction data or response direction data; If request direction data is obtained, the request direction data is parsed according to the protocol to obtain request direction parsing data; The request direction parsing data is stored in the request data form, wherein the session ID and transaction ID of the request direction parsing data serve as identification information in the request data form, the session ID is the information corresponding to the source / destination IP data, source / destination port data and transport layer protocol number data of the communication, and the transaction ID is the information corresponding to the TCP sequence number and TCP acknowledgment sequence number; If response direction data is obtained, the response direction data is parsed according to the protocol to obtain response direction parsing data; The response direction parsing data is stored in a response data form, wherein the session ID and transaction ID of the response direction parsing data serve as identification information in the response data form; Obtain the target transaction retrieval request; According to the target transaction retrieval request, a search is performed in the request data form to obtain a first retrieval result, which includes data in the direction of the target transaction request. If bidirectional data of the target transaction is required, the session ID and transaction ID of the target transaction in the target transaction retrieval request are used to search the response data form to obtain a second retrieval result, which includes data in the response direction of the target transaction.

2. The data processing method of the audit system according to claim 1, characterized in that, Before the step of storing the request direction parsing data into the request data form, the method further includes: The source / destination IP data, source / destination port data, and transport layer protocol number data of the communication are obtained based on the requested direction parsing data. The MD5 value is calculated based on the source / destination IP data, the source / destination port data, and the transport layer protocol number data, and the MD5 value is used as the session ID for the request direction parsing data.

3. The data processing method of the audit system according to claim 1 or 2, characterized in that, Before the step of storing the request direction parsing data into the request data form, the method further includes: The request data in the first string format is obtained by calculating based on the TCP sequence number and application layer data length field value of the parsed data in the request direction. The second string format request data is obtained by calculating the TCP response sequence number of the data parsed in the request direction. The transaction ID of the request direction parsing data is obtained by concatenating the request data in the first string format and the request data in the second string format.

4. The data processing method of the audit system according to claim 1, characterized in that, Before the step of storing the response direction parsing data into the response data form, the method further includes: Based on the response direction parsing data, the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication are obtained; The MD5 value is calculated based on the source / destination IP data, the source / destination port data, and the transport layer protocol number data, and the MD5 value is used as the session ID of the response direction parsing data.

5. The data processing method of the auditing system according to claim 1 or 4, characterized in that, Before the step of storing the response direction parsing data into the response data form, the method further includes: The first string format response data is obtained by calculating the TCP sequence number of the parsed data based on the response direction. The response data in the second string format is obtained by calculating the TCP response sequence number based on the parsed data of the response direction. The transaction ID of the response direction parsing data is obtained by concatenating the first string format response data and the second string format response data.

6. The data processing method of the audit system according to claim 1, characterized in that, After the step of retrieving the second retrieval result from the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request, the method further includes: Based on the first search result and the second search result, generate bidirectional search results for the target transaction.

7. A data processing device for an auditing system, characterized in that, include: The target traffic acquisition module is used to acquire target traffic data to be audited. The target traffic parsing module is used to perform traffic analysis based on the target traffic data to obtain request direction data or response direction data. The storage module is used to perform protocol parsing on the request direction data if request direction data is obtained, to obtain request direction parsing data; The request direction parsing data is stored in the request data form, wherein the session ID and transaction ID of the request direction parsing data serve as identification information in the request data form; if response direction data is obtained, the response direction data is parsed according to the protocol to obtain response direction parsing data; The response direction parsing data is stored in a response data form, wherein the session ID and transaction ID of the response direction parsing data serve as identification information in the response data form; the session ID is the information corresponding to the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication, and the transaction ID is the information corresponding to the TCP sequence number and TCP acknowledgment sequence number; The retrieval request acquisition module is used to acquire the retrieval request for the target transaction; The first retrieval module is used to perform a retrieval in the request data form according to the target transaction retrieval request and obtain a first retrieval result, the first retrieval result including data in the direction of the target transaction request; The second retrieval module is used to retrieve bidirectional data of the target transaction from the response data form based on the session ID and transaction ID of the target transaction in the target transaction retrieval request if bidirectional data of the target transaction is required, and to obtain a second retrieval result, which includes data of the target transaction response direction.

8. The data processing apparatus for the auditing system according to claim 7, characterized in that, The data processing device further includes: The request direction session ID module is used to obtain the source / destination IP data, source / destination port data, and transport layer protocol number data of the communication based on the request direction parsing data; calculate the MD5 value based on the source / destination IP data, the source / destination port data, and the transport layer protocol number data, and use the MD5 value as the session ID of the request direction parsing data.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the data processing method of the audit system as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the data processing method of the audit system as described in any one of claims 1 to 6.

Images