Data analysis method, electronic device, and storage medium

Abstract

The application provides a data analysis method, an electronic device and a storage medium. A plurality of analysis processes are pre-configured, including a kernel data analysis process for analyzing kernel data and an application layer data analysis process for analyzing application layer data. The method comprises: determining a data type of to-be-analyzed data, wherein the data type is at least one of kernel data and application layer data; determining a target analysis process matched with the data type from the plurality of analysis processes according to the data type of the to-be-analyzed data; and analyzing the to-be-analyzed data by using the target analysis process. Even if multiple pieces of data need to be processed, they can be analyzed as to-be-analyzed data respectively, so that the corresponding target analysis process is determined for analysis. Therefore, the analysis efficiency can be improved by using the parallel processing mode.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security, in particular to a data analysis method, an electronic device and a storage medium. BACKGROUND

[0002] In practical applications, enterprises usually need to analyze data received or sent through a network to determine whether there is a security threat. However, with the continuous development of society, for large-scale enterprises, a large amount of data is often received or sent, and the current large amount of data is often analyzed by single thread and traditional relational database, resulting in low efficiency of analysis. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a data analysis method, an electronic device and a storage medium to solve the technical problems in the prior art.

[0004] The first aspect of the embodiments of the present application provides a data analysis method, a plurality of analysis processes are set in advance, the plurality of analysis processes include a kernel data analysis process for analyzing kernel data and an application layer data analysis process for analyzing application layer data, and the method comprises:

[0005] determining the data type of the data to be analyzed, wherein the data type is at least one of kernel data and application layer data;

[0006] According to the data type of the data to be analyzed, a target analysis process matched with the data type is determined from the plurality of analysis processes;

[0007] The target analysis process is used to analyze the data to be analyzed.

[0008] In an embodiment, according to the data type of the data to be analyzed, a target analysis process matched with the data type is determined from the plurality of analysis processes, specifically comprising:

[0009] According to the data type of the data to be analyzed, a plurality of candidate analysis processes matched with the data type are determined from the plurality of analysis processes;

[0010] The numerical value of the data to be analyzed is subjected to a modulo operation with the number of the plurality of candidate analysis processes;

[0011] According to the result of the modulo operation, a candidate analysis process corresponding to the result is selected as the target analysis process.

[0012] In an embodiment, the data type of the data to be parsed is application layer data; and according to the data type of the data to be parsed, a plurality of candidate parsing processes matching the data type are determined from the plurality of parsing processes, specifically including:

[0013] According to the data type of the data to be parsed, a plurality of application layer data parsing processes are determined from the plurality of parsing processes as the plurality of candidate parsing processes.

[0014] In an embodiment, the data to be parsed is parsed by the target parsing process, specifically including:

[0015] The event basic data of a security event associated with the data to be parsed is obtained from the in-memory database by the target parsing process, wherein the event basic data is generated by a log of the security event;

[0016] According to the event basic data, a target event type of the security event associated with the data to be parsed is determined, and the target event type is specifically a risk event, a vulnerability event, or a virus event;

[0017] According to the event basic data and a rating rule corresponding to the target event type, a target event rating of the security event associated with the data to be parsed is determined.

[0018] In an embodiment, the method further includes:

[0019] In the case where the target event type is a vulnerability event, a vulnerability detail description in the data to be parsed is filled by using the event basic data; or,

[0020] In the case where the target event type is a virus event, a virus detail description in the data to be parsed is filled by using the event basic data.

[0021] In an embodiment, the method further includes:

[0022] It is judged whether data of the target event type and with an event rating higher than the target event rating is stored in a preset database;

[0023] If not, the data obtained by parsing the data to be parsed is stored in the preset database.

[0024] In an embodiment, the data type of the data to be parsed is kernel data; and according to the data type of the data to be parsed, a target parsing process matching the data type is determined from the plurality of parsing processes, specifically including:

[0025] determining, according to a data type of the data to be parsed, a kernel data parsing process from a plurality of parsing processes;

[0026] performing a modulo operation on a numerical index of the data to be parsed and a quantity of the determined kernel data parsing processes;

[0027] selecting, according to a result of the modulo operation, a kernel data parsing process corresponding to the result as the target parsing process.

[0028] In an embodiment, the data to be parsed is parsed by the target parsing process, specifically including:

[0029] acquiring, by the target parsing process, event basic data of a security event associated with the data to be parsed from a memory database, wherein the event basic data is generated by a log of the security event;

[0030] determining a classification category of the security event associated with the data to be parsed by using the event basic data;

[0031] filling the data to be parsed by using the event basic data and the classification category of the data to be parsed.

[0032] In an embodiment, the method further includes storing the data to be parsed after filling into a preset database.

[0033] In an embodiment, the method further includes:

[0034] acquiring a data compression package sent by a terminal;

[0035] decompressing the data compression package to acquire a plurality of pieces of data;

[0036] performing data cleaning on the plurality of pieces of data to acquire the data to be parsed.

[0037] A second aspect of an embodiment of the present application provides an electronic device, including:

[0038] a processor;

[0039] a memory for storing processor-executable instructions; wherein the processor is configured to execute the method of any one of the first aspect.

[0040] A third aspect of an embodiment of the present application provides a computer-readable storage medium, the storage medium storing a computer program, the computer program being executable by a processor to complete the method of any one of the first aspect.

[0041] By using the method provided in the embodiments of the present application, since a plurality of parallel analysis processes are set in advance, and each analysis process includes a kernel data analysis process for analyzing kernel data and an application layer data analysis process for analyzing application layer data, for the to-be-analyzed data, the data type of the to-be-analyzed data can be determined first, the data type being at least one of kernel data and application layer data, then a target analysis process matched with the data type of the to-be-analyzed data is determined from the plurality of analysis processes, and then the to-be-analyzed data can be analyzed by using the target analysis process. At this time, even if there are a plurality of data to be processed, the plurality of data can be analyzed as to-be-analyzed data respectively, so that the corresponding target analysis process is determined for analysis, and therefore the analysis efficiency can be improved by using the parallel processing mode. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly introduced as follows. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and other related drawings can also be obtained by those skilled in the art without creative labor on the basis of the drawings.

[0043] Figure 1 The specific structure schematic diagram of the electronic device provided in an embodiment of the present application is shown in the figure.

[0044] Figure 2 The interaction schematic diagram of the server and the terminal provided in an embodiment of the present application is shown in the figure.

[0045] Figure 3 The specific structure schematic diagram of the data analysis method provided in an embodiment of the present application is shown in the figure.

[0046] Figure 4 The specific structure schematic diagram of the data analysis method device provided in an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application will be described in detail below with reference to the drawings in the embodiments of the present application. In the description of the present application, the terms "first", "second", etc. are only used for differentiation and description, and cannot be understood as indicating or implying relative importance or sequence.

[0048] As described above, for a large-scale enterprise, a large amount of data is often received or sent, and the efficiency of analyzing the large amount of data is usually low at present. For example, the amount of data on a computer can be more than 5000, if a large-scale enterprise has 100,000 computers, the total amount of data can be more than 500 million, and the efficiency of analyzing the large amount of data is usually low at present.

[0049] Based on this, the embodiment of the present application provides a data analysis method, device, electronic equipment and storage medium, which can be used for analyzing massive data. As shown in Figure 1 The specific structure diagram of the electronic equipment 1 provided by the embodiment of the present application is shown in the figure, which includes at least one processor 11 and a memory 12, Figure 1 The processor 11 and the memory 12 can be connected through the bus 10, and the memory 12 stores instructions executable by the processor 11, and the instructions are executed by the processor 11 to enable the electronic equipment 1 to execute all or part of the processes of the method in the following embodiment. In actual application, the electronic equipment 1 can be a notebook computer, a desktop computer, a server or a server cluster composed of the same, etc.

[0050] As shown in Figure 2 In actual application, the electronic equipment 1 can also be connected to one or more terminals 2, and the electronic equipment 1 can communicate data with each terminal 2 respectively. The terminal can be a customer's mobile phone, notebook computer, desktop computer, etc. In an embodiment, the customer can send a data compression package to the electronic equipment 1 through the terminal 2, the data compression package includes multiple data, and then execute the method provided by the embodiment of the present application through the electronic equipment 1 to analyze the data.

[0051] For example, in actual application, the terminal 2 can be a customer's computer, which may face security threats, including various security incidents, etc. At this time, the security incidents can be recorded through logs to form data, and the multiple data formed can be generated into a data compression package and sent to the electronic equipment 1, so that the method provided by the embodiment of the present application is executed through the electronic equipment 1 to analyze the data.

[0052] As shown in Figure 2 The specific flowchart of the data analysis method provided by the embodiment of the present application is shown in the figure, which can be executed by the electronic equipment shown in Figure 1 As a server or server cluster, here the electronic equipment as a server is taken as an example to describe the method, wherein the server is pre-set with multiple parallel analysis processes, and the analysis processes include kernel data analysis process and application layer data analysis process, wherein the kernel data analysis process is used to analyze kernel data, and the application layer data analysis process is used to analyze application layer data, in addition, the number of kernel data analysis process and application layer data analysis process can also be multiple respectively, that is, the analysis process corresponding to each data type can be multiple, so as to facilitate the parallel calling of multiple analysis processes for processing in the case of massive data to be analyzed, so as to improve the analysis efficiency. The method includes the following steps:

[0053] Step S31: Obtain the data compression package uploaded by the terminal.

[0054] As mentioned above, the electronic device as the server can connect multiple terminals. When facing various security events, these terminals can record these security events through logs to form data, and periodically (or at some specified time point) compress multiple generated data to obtain a data compression package, and then send the data compression package to the server, so that the server can obtain the data compression package sent by the terminal.

[0055] It needs to be further explained that since the server connects multiple terminals, these terminals can send data compression packages to the server in a short time, resulting in a large operation pressure of the server. Therefore, a data queue can be constructed in the server. When the data compression package sent by the terminal is received, the data compression package can be stored in the data queue according to the order of receipt. Then in step S31, the data compression package can be obtained according to the order of the data compression package in the data queue for subsequent processing, so as to reduce the operation pressure of the server.

[0056] Step S32: Decompress the data compression package to obtain multiple data.

[0057] Step S33: Data cleaning is performed on the multiple data to obtain to-be-analyzed data.

[0058] Here, the step S32 and the step S33 can be uniformly explained. After obtaining the data compression package in the above step S31, the data compression package can be decompressed to obtain multiple data, and then the multiple data can be data cleaned to obtain to-be-analyzed data, and then the to-be-analyzed data can be analyzed.

[0059] According to actual needs, the data cleaning manner of the multiple data can include eliminating data in the multiple data that does not conform to a time range, filling default values, etc. The to-be-analyzed data obtained after data cleaning of the multiple data has a more standardized data format, which is convenient for subsequent analysis.

[0060] It should be noted that in the process of decompressing the data compression package, a compression password is usually needed, which can be a preset password. At this time, the terminal uses the preset password to compress multiple data, thereby obtaining the data compression. The server can also use the preset password to decompress the data compression, thereby obtaining the multiple data. At this time, if the server fails to decompress using the compression password, such as due to incorrect input of the compression password, etc., the compression password can be re-input. If the compression password fails to be decompressed after multiple (such as 3 times) inputs, it indicates that the compression password is incorrect, at which time the data compression package can be discarded to prevent security risks.

[0061] Step S34: Determine the data type of the data to be parsed.

[0062] The data type of the data to be parsed is at least one of kernel data and application layer data. In actual application, the kernel data can include registry, driver data, etc., and the application layer data can include service data, etc. The data type of the data to be parsed can be determined according to the file name of the data to be parsed, including the suffix in the file name, etc.

[0063] It should be noted that the data to be parsed can be one or more data, and the data type corresponding to each data to be parsed is determined, either kernel data or application layer data. When the data to be parsed is multiple, the types of these data to be parsed can all be kernel data or application layer data, of course, part of them can be kernel data and the other part can be application layer data. Regardless of the situation, the data type corresponding to each data in the data to be parsed is determined in this step, so as to call the corresponding parsing process for data parsing subsequently.

[0064] In actual application, each data can be assigned a corresponding numerical value number, which uniquely identifies the corresponding data. Therefore, the numerical value number of the data to be parsed can uniquely identify the data to be parsed. It should be noted that the numerical value number can be represented by a specific numerical value.

[0065] Therefore, in this step S34, the numerical value number of the data to be parsed can be determined, and the data type of the data to be parsed can be determined according to the suffix in the file name of the data to be parsed.

[0066] Step S35: According to the data type of the data to be parsed, determine the target parsing process matched with the data type from the multiple parsing processes.

[0067] As mentioned above, the server is pre-configured with multiple parallel analysis processes, each of which can be used to analyze the to-be-analyzed data. Therefore, even if multiple pieces of data need to be analyzed at this time, the multiple pieces of data can be respectively determined as to-be-analyzed data, and the corresponding target analysis process can be determined through the step S35, and then the multiple pieces of data can be respectively analyzed through the corresponding target analysis process.

[0068] The specific manner of determining the target analysis process of the to-be-analyzed data in the step S35 can be that the target analysis process is determined from the multiple analysis processes according to the data type of the to-be-analyzed data, wherein the data type of the to-be-analyzed data matches the target analysis process. For example, if the data type of the to-be-analyzed data is application layer data, the determined target analysis process is an application layer data analysis process, so that the to-be-analyzed data can be analyzed; if the data type of the to-be-analyzed data is kernel layer data, the determined target analysis process is a kernel data analysis process, so that the to-be-analyzed data can be analyzed.

[0069] It needs to be further explained that, in order to further improve the efficiency, the multiple analysis processes pre-configured in the server can include multiple kernel data analysis processes and multiple application layer data analysis processes, so as to respectively and in parallel process multiple kernel layer data and multiple application layer data.

[0070] At this time, the implementation manner of the step S35 can be that the multiple candidate analysis processes matching the data type of the to-be-analyzed data are determined from the multiple analysis processes according to the data type of the to-be-analyzed data. For example, if the data type of the to-be-analyzed data is application layer data, multiple application layer data analysis processes are determined from the multiple analysis processes as the multiple candidate analysis processes; if the data type of the to-be-analyzed data is kernel layer data, multiple kernel data analysis processes are determined from the multiple analysis processes as the multiple candidate analysis processes.

[0071] After the multiple candidate analysis processes are determined, the numerical value number of the to-be-analyzed data is further subjected to a modulo operation with the number of the multiple candidate analysis processes; and then, according to the result of the modulo operation, the candidate analysis process corresponding to the result is selected as the target analysis process. For example, the numerical value number of the to-be-analyzed data is 1685, and the number of the multiple candidate analysis processes is 30 (each analysis process can be numerically numbered, such as numerical numbers 1-30). At this time, 1685 is subjected to a modulo operation with 30, so that the result of the modulo operation is 5, and the candidate analysis process corresponding to the result 5 (i.e., the fifth candidate analysis process) is selected as the target analysis process.

[0072] Step S36: analyzing the to-be-analyzed data through the target analysis process.

[0073] As mentioned above, each analysis process includes a kernel data analysis process and an application layer data analysis process, and the target analysis process matches the data type of the data to be analyzed. Therefore, in this step S36, the data to be analyzed is analyzed by the target analysis process. For example, if the data type of the data to be analyzed is application layer data, the target analysis process matching the data type is the application layer data analysis process, and the data to be analyzed can be analyzed by using the application layer data analysis process; if the data type of the data to be analyzed is kernel layer data, the target analysis process matching the data type is the kernel layer data analysis process, and the data to be analyzed can be analyzed by using the kernel layer data analysis process.

[0074] By using the method provided in the embodiments of the present application, since a plurality of parallel analysis processes are set in advance, and each analysis process includes a kernel data analysis process for analyzing kernel data and an application layer data analysis process for analyzing application layer data, for the data to be analyzed, the data type of the data to be analyzed can be determined first, which is at least one of kernel data and application layer data, then the target analysis process matching the data type of the data to be analyzed is determined from the plurality of analysis processes, and then the data to be analyzed can be analyzed by using the target analysis process. At this time, even if there are multiple data to be processed, they can be analyzed as data to be analyzed respectively, so that the corresponding target analysis process is determined for analysis, and therefore the analysis efficiency can be improved by using the parallel processing method.

[0075] It should be noted that when the data to be analyzed is one, the corresponding data type is determined to be kernel data or application layer data; and when the data to be analyzed is multiple, the corresponding data type can contain both kernel data and application layer data, or only contain kernel data or application layer data, which is not limited in the embodiments of the present application. In any case, according to the determined data type, the corresponding analysis process is called to analyze the corresponding data to be analyzed. Since a plurality of analysis processes can be called simultaneously in parallel, the analysis efficiency can be effectively improved.

[0076] As mentioned above in step S36, the data to be analyzed is analyzed by the target analysis process. For the analysis method, it can be specified here. For example, if the data type of the data to be analyzed is application layer data, the event basic data of the security event associated with the data to be analyzed can be obtained from the memory database (such as redis) by using the target analysis process, wherein the event basic data is generated by the log of the security event.

[0077] For example, logs on a server collection computer or other device can be collected first, which are generated when a security event occurs on the computer or other device, thereby recording relevant information of the security event through the logs. Therefore, the event basic data can be generated by analyzing the logs, and the event basic data is generated through the logs of the security event, such as by structuring the relevant information of the security event in the logs to obtain the event basic data. After obtaining the event basic data, the event basic data can be usually read into the memory, so that the target analysis process can obtain the event basic data of the security event associated with the to-be-analyzed data from the memory database, and the event basic data also reflects the relevant information of the security event, including the event occurrence time, the attacking end IP address, the attacking end port, the attacked end IP address, the attacked end port, the event description information or other relevant information, etc.

[0078] After obtaining the event basic data, the target analysis process can determine the target event type of the security event associated with the to-be-analyzed data according to the event basic data, wherein the target event type can be specifically a risk event, a vulnerability event or a virus event, such as the target event type can be determined according to the event occurrence time, the supply end IP address, etc. in the event basic data. The risk event can include hacking, electronic extortion, etc., the vulnerability event can include a security event caused by a vulnerability on a terminal, and the virus event can include a security event caused by a network virus.

[0079] Usually, different rating rules are set for different event types, such as for the event type of the risk event, the event level can be determined according to the event result (including success or failure) of the risk event, the degree of harm caused, etc.; for the event type of the vulnerability event, the event level can be determined according to the function description of the electronic system with the vulnerability, the difficulty of vulnerability repair, the influence of the vulnerability, etc.; for the event type of the virus event, the event level can be determined according to the influence caused by the virus, the virus infection time, the importance of the electronic system infected by the virus, etc.

[0080] The event level can be high, medium and low, and different levels reflect the high and low of the influence caused by the security event, such as when the event level is high, it means that a higher influence is caused, when the event level is medium, it means that a medium influence is caused, and when the event level is low, it means that a lower influence is caused. Therefore, after determining the target event type, the target event level of the security event associated with the to-be-analyzed data can be further determined according to the event basic data and the rating rules corresponding to the target event type.

[0081] For example, if the target event type is a risk event, the target event level can be determined according to the event result, the degree of harm caused, and the rating rules of the risk event in the event basic data of the risk event; if the target event type is a vulnerability event, the target event level can be determined according to the vulnerability repair difficulty, the influence of the vulnerability, and the rating rules of the vulnerability event in the event basic data of the vulnerability event; if the target event type is a virus event, the target event level can be determined according to the influence caused by the virus, the virus infection time, and the rating rules of the virus event in the event basic data of the virus event.

[0082] In addition, the target analysis process can obtain the event basic data of the security event associated with the to-be-analyzed data from a memory database (such as redis) in the following manner: first, according to the numerical code of the to-be-analyzed data, it is determined whether the memory database stores the event basic data of the corresponding security event; if so, the event basic data is obtained; or, if not, the event basic data is obtained from a preset database. Since the data storage efficiency of the memory database is usually high, the above-mentioned manner of first determining whether the memory database stores the event basic data and then obtaining the event basic data from the preset database in the case of non-existence can improve the processing efficiency. The preset database can be a postgres database or a clickhouse database.

[0083] In actual applications, the same numerical code can usually be assigned to the to-be-analyzed data. After the server obtains the log of the security event, the log of the security event can be used to generate the event basic data of the security event, and the event basic data of the security event is associated with the numerical code of the security event. Thus, the numerical code of the to-be-analyzed data can be used to query whether the memory database stores the event basic data of the corresponding security event.

[0084] After the target event type is determined, in the case where the target event type is specifically a vulnerability event, the vulnerability details in the to-be-analyzed data can be further filled according to the event basic data; or, in the case where the target event type is specifically a virus event, the virus details in the to-be-analyzed data can be filled according to the event basic data. After the to-be-analyzed data is filled, the filled to-be-analyzed data can be directly stored in a preset database.

[0085] In actual application, after the target analysis process analyzes the to-be-analyzed data in step S36, it is usually determined whether the preset database stores data of the target event type and data of an event level higher than the target event level. If yes, it indicates that the security event associated with the to-be-analyzed data is not the highest level, and the data obtained by analyzing the to-be-analyzed data can be discarded. If no, it indicates that the security event associated with the to-be-analyzed data is the highest level, and the data obtained by analyzing the to-be-analyzed data can be stored in the preset database.

[0086] The preset database can be a clickhouse database. The clickhouse database is a columnar storage database (DBMS: Database Management System) for online analytical processing query (OLAP: Online Analytical Processing) MPP architecture open sourced by Yandex of Russia in 2016, which can use SQL queries to generate real-time analysis data reports. The postgres database is a very powerful, open-source client / server relational database management system (RDBMS).

[0087] For example, if the preset database does not store data of the target event type, or although it stores data of the target event type, the event level of the security event associated with the data is lower than the target event level, the data obtained by analyzing the to-be-analyzed data can replace the data in the preset database and be stored in the preset database.

[0088] Of course, if the data type of the to-be-analyzed data is kernel data, when the target analysis process analyzes the to-be-analyzed data, the target analysis process can first load a kernel data analysis tool, and then use the kernel data analysis tool to analyze the to-be-analyzed data. The kernel data analysis tool can first obtain event basic data of the security event associated with the to-be-analyzed data from the memory database. The event basic data is also generated by the log of the security event. Then, the classification category of the security event associated with the to-be-analyzed data is determined by using the event basic data, and the to-be-analyzed data is filled by using the event basic data and the classification category of the to-be-analyzed data.

[0089] The method for obtaining the event basic data of the security event associated with the to-be-analyzed data from the memory database can also be that the memory database is queried whether the event basic data of the corresponding security event is stored according to the numerical value of the to-be-analyzed data. If yes, the event basic data is obtained. If no, the event basic data is obtained from the preset database.

[0090] Of course, the filled data to be parsed (i.e. the parsed data to be parsed) can also be stored in the preset database.

[0091] Based on the same inventive concept as the data parsing method provided by the embodiments of the present application, the embodiments of the present application can also provide a data parsing device. For the content of the device embodiments, if there is any ambiguity, please refer to the corresponding content in the method embodiments. The device 40 can be used for a server, and the server is pre-configured with multiple parallel parsing processes. Each parsing process includes a kernel data parsing process for parsing kernel data and an application layer data parsing process for parsing application layer data. As shown in the following figure, the device 40 includes a data type determination unit 401, a parsing process determination unit 402, and a parsing unit 403. Figure 4

[0092] The data type determination unit 401 is configured to determine the data type of the data to be parsed, wherein the data type is at least one of kernel data and application layer data.

[0093] The parsing process determination unit 402 is configured to determine a target parsing process matched with the data type from the multiple parsing processes according to the data type of the data to be parsed.

[0094] The parsing unit 403 is configured to parse the data to be parsed by using the target parsing process.

[0095] Obviously, the device 40 can also solve the problems of the prior art, which will not be repeated here. In addition, the technical effects achieved by the device 40 by combining physical devices, cloud technology, etc. also belong to the protection scope of the present application, which will not be repeated here.

[0096] The parsing process determination unit 402 can specifically include a candidate parsing process determination subunit, a modulo operation subunit, and a process selection subunit.

[0097] The candidate parsing process determination subunit is configured to determine multiple candidate parsing processes matched with the data type from the multiple parsing processes according to the data type of the data to be parsed.

[0098] The modulo operation subunit is configured to perform a modulo operation on the numerical value of the data to be parsed and the number of the multiple candidate parsing processes.

[0099] The process selection subunit is configured to select a candidate parsing process corresponding to the result of the modulo operation as the target parsing process according to the result of the modulo operation.

[0100] ​The data type of the data to be parsed can be application layer data, and the candidate parsing process determination subunit can include a candidate parsing process determination submodule configured to determine a plurality of application layer data parsing processes from the plurality of parsing processes as the plurality of candidate parsing processes according to the data type of the data to be parsed.

[0101] The parsing unit 403 can include an event basic data obtaining subunit, a target event type determination subunit, and a target event level determination subunit, wherein:

[0102] The event basic data obtaining subunit is configured to obtain event basic data of a security event associated with the data to be parsed from an in-memory database through the target parsing process, wherein the event basic data is generated through a log of the security event.

[0103] The target event type determination subunit is configured to determine a target event type of the security event associated with the data to be parsed according to the event basic data, wherein the target event type is a risk event, a vulnerability event, or a virus event.

[0104] The target event level determination subunit is configured to determine a target event level of the security event associated with the data to be parsed according to a rating rule corresponding to the target event type and the event basic data.

[0105] The apparatus 40 can further include a filling unit configured to fill a vulnerability detail description in the data to be parsed with the event basic data when the target event type is a vulnerability event, or fill a virus detail description in the data to be parsed with the event basic data when the target event type is a virus event.

[0106] The apparatus 40 can further include a judgment storage unit configured to judge whether the preset database stores data of the target event type and an event level higher than the target event level, and store data obtained by parsing the data to be parsed to the preset database if the judgment result is negative.

[0107] The data type of the data to be parsed can be kernel data, and the parsing process determination unit 402 can further include a parsing process determination subunit configured to determine a plurality of kernel data parsing processes from the plurality of parsing processes according to the data type of the data to be parsed, perform a modulo operation on a numerical value of the data to be parsed and a number of the determined kernel data parsing processes, and select a kernel data parsing process corresponding to a result of the modulo operation as the target parsing process according to the result of the modulo operation.

[0108] The parsing of the to-be-parsed data by the target parsing process can specifically include: acquiring, by the target parsing process, event basic data of a security event associated with the to-be-parsed data from an in-memory database, wherein the event basic data is generated by a log of the security event; determining a classification category of the security event associated with the to-be-parsed data by using the event basic data; and filling the to-be-parsed data by using the event basic data and the classification category of the to-be-parsed data.

[0109] The apparatus 40 can further include a storage unit configured to store the to-be-parsed data after filling into a preset database.

[0110] The apparatus 40 can further include a to-be-parsed data acquisition unit configured to acquire a data compression package sent by a terminal; decompress the data compression package to acquire a plurality of pieces of data; and perform data cleaning on the plurality of pieces of data to acquire the to-be-parsed data.

[0111] The embodiment of the present application further provides a computer readable storage medium, the storage medium stores a computer program, the computer program can be executed by a processor to complete all or part of the processes of the method in the above embodiment. The storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above types of memories.

[0112] Although the embodiments of the present application are described in conjunction with the drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A data parsing method, characterized in that, The method includes: pre-setting multiple parsing processes, including a kernel data parsing process for parsing kernel data and an application layer data parsing process for parsing application layer data; and pre-setting multiple parsing processes. Determine the data type of the data to be parsed, wherein the data type is at least one of kernel data and application layer data; Based on the data type of the data to be parsed, a target parsing process that matches the data type is determined from the plurality of parsing processes; The data to be parsed is parsed through the target parsing process; When the data type of the data to be parsed is specifically application-layer data, the data to be parsed is parsed through the target parsing process, specifically including: obtaining basic event data of the security events associated with the data to be parsed from the memory database through the target parsing process, wherein the basic event data is generated from the logs of the security events; determining the target event type of the security events associated with the data to be parsed based on the basic event data, wherein the target event type is specifically a risk event, a vulnerability event, or a virus event; determining the target event level of the security events associated with the data to be parsed based on the rating rules corresponding to the basic event data and the target event type; if the target event type is specifically a vulnerability event, filling the vulnerability details description in the data to be parsed with the basic event data; or, if the target event type is specifically a virus event, filling the virus details description in the data to be parsed with the basic event data. When the data type of the data to be parsed is specifically kernel data, the data to be parsed is parsed by the target parsing process, which specifically includes: obtaining basic event data of the security events associated with the data to be parsed from the memory database through the target parsing process, wherein the basic event data is generated from the logs of the security events; determining the classification category of the security events associated with the data to be parsed using the basic event data; and filling the data to be parsed with the basic event data and the classification category of the data to be parsed.

2. The method according to claim 1, characterized in that, Based on the data type of the data to be parsed, a target parsing process matching the data type is determined from the plurality of parsing processes, specifically including: Based on the data type of the data to be parsed, a plurality of candidate parsing processes that match the data type are determined from the plurality of parsing processes; Perform a modulo operation between the numerical ID of the data to be parsed and the number of the multiple candidate parsing processes; Based on the result of the modulo operation, the candidate parsing process corresponding to the result is selected as the target parsing process.

3. The method according to claim 2, characterized in that, The data type of the data to be parsed is specifically application layer data; and, based on the data type of the data to be parsed, a plurality of candidate parsing processes matching the data type are determined from the plurality of parsing processes, specifically including: Based on the data type of the data to be parsed, multiple application-layer data parsing processes are determined from the multiple parsing processes as multiple candidate parsing processes.

4. The method according to claim 1, characterized in that, The method further includes: Determine whether the target event type is stored in the preset database, and whether the event level is higher than the target event level; If not, the data obtained from parsing the data to be parsed will be stored in the preset database.

5. The method according to claim 1, characterized in that, The data type of the data to be parsed is specifically kernel data; and, based on the data type of the data to be parsed, a target parsing process matching the data type is determined from the plurality of parsing processes, specifically including: Based on the data type of the data to be parsed, each kernel data parsing process is determined from multiple parsing processes; Perform a modulo operation between the numerical number of the data to be parsed and the determined number of kernel data parsing processes; Based on the result of the modulo operation, the kernel data parsing process corresponding to the result is selected as the target parsing process.

6. The method according to claim 1, characterized in that, When the data type of the data to be parsed is specifically kernel data, the method further includes: storing the padded data to be parsed into a preset database.

7. The method according to claim 1, characterized in that, The method further includes: Obtain the compressed data packet sent by the terminal; The data package is decompressed to obtain multiple data entries; The multiple data entries are cleaned to obtain the data to be parsed.

8. An electronic device, characterized in that, include: processor; Memory for storing processor-executable instructions; wherein the processor is configured to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to perform the method described in any one of claims 1-7.

Images