A data provenance method and apparatus

Abstract

The application discloses a data tracing method and device, relates to the technical field of computers, and solves the problems of low efficiency of manual participation in the early stage of the current data tracing process and unnecessary overhead caused by tracing redundant fields or reserved fields in a database due to a database design problem. The data tracing method comprises the following steps: acquiring a data packet image of a network device, analyzing the data packet image, determining structured data of the data packet image, and generating tracing data of the network device according to header data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data traceability method and device. BACKGROUND

[0002] Data traceability refers to the process of tracing the source and flow of data. In the era of big data, due to the factors such as the periodicity, technology and characteristics of different types of data, a large amount of data with different sources and different qualities is accumulated in the process of data collection. When using the data, it is often necessary to trace the source of the data to confirm the exact meaning of the data, data calculation and error checking, etc.

[0003] At present, the methods of data traceability tracking include labeling method and reverse query method. Among them, the labeling method refers to tracing the historical state of data by recording processing related information, that is, recording some important information of the original data in an artificial labeling way, and transmitting the labeling and the original data together, and tracing the historical state of the data by viewing the labeling of the target data. The labeling method needs a lot of manual participation in the data labeling stage, and the efficiency is low, and additional storage space is needed when storing the labeling information of the original data.

[0004] The reverse query method refers to inverting the query or constructing a function to invert the query, or inversely deducing according to the conversion process, and tracing the original data according to the query result. The reverse query method needs to manually construct an inverse function, and the good or bad of the inverse function directly affects the effect and performance of the reverse query, and the reverse query method will only be calculated when the original data needs to be traced.

[0005] Secondly, the labeling method and the reverse query method are directly initiated from the database layer in the process of data traceability, and if the database design has problems, for example, there are a large number of redundant fields or reserved fields in the database, the above methods will still trace the redundant fields or reserved fields in the process of data traceability, which brings unnecessary overhead to the entire traceability work. SUMMARY

[0006] The present application provides a data traceability method and device, which is used to solve the problem of low efficiency of manual participation in the early stage of the current data traceability process, and the problem of unnecessary overhead of traceability work caused by tracing the redundant fields or reserved fields in the database due to the database design problem.

[0007] To achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0008] In a first aspect, the present application provides a data tracing method, comprising: obtaining a data packet image of a network device, parsing the data packet image, and determining structured data of the data packet image. The structured data comprises: packet header data. The packet header data is used to indicate characteristics of the data packet image. According to the packet header data, tracing data of the network device is generated.

[0009] According to the data tracing method provided by the present application, the data packet image of the network device is obtained, the data packet image is parsed, the structured data of the data packet image is determined, and the tracing data of the network device is generated according to the packet header data, so as to realize automatic monitoring of the data packet in the business process and data tracing of the data packet. The manual participation is reduced, and the data tracing efficiency is improved because only the data packet required by the business is used for data tracing, and the redundant fields or reserved fields in the database are not included in the tracing process.

[0010] In a possible implementation, the packet header data comprises: a source address of the data packet image, a target address of the data packet image, and a timestamp of the data packet reaching the network device. According to the packet header data, the tracing data of the network device is generated, comprising: generating preliminary tracing data of the structured data by using the timestamp, determining a level of the preliminary tracing data by using the source address and the target address, adding a level mark to the preliminary tracing data according to the level, and generating the tracing data according to the preliminary tracing data and the level mark.

[0011] In a possible implementation, the preliminary tracing data of the structured data is generated by using the timestamp, comprising: determining a data packet flow direction of the structured data by using the timestamp, and generating the preliminary tracing data according to the data packet flow direction.

[0012] In a possible implementation, the structured data further comprises: packet body data. The packet body data is used to indicate business data of the data packet image. The data tracing method provided by the present application further comprises: if the business data of the first structured data is the same as the business data of the second structured data, adding a same-name data mark to the first structured data and the second structured data. The first structured data is the structured data generated based on a first data packet image, the second structured data is the structured data generated based on a second data packet image, and the first data packet image is different from the second data packet image. The same-name data mark is used to indicate that the business data of the first structured data and the business data of the second structured data are different versions of the same-name data.

[0013] In this possible implementation, the structured data with the same business data is added with the same-name data mark, so as to distinguish the same data.

[0014] In a possible implementation, the data packet image of the network device is obtained, comprising: when the data packet of the network device is monitored, generating the data packet image of the data packet.

[0015] In the possible implementation manner, the data packet mirror of the data packet can be automatically generated when the data packet of the network device is monitored, so that the data in the business flow is automatically monitored, and the manual participation is reduced.

[0016] In a second aspect, the present application provides a data tracing device, comprising an acquisition module, a processing module and a generation module.

[0017] The acquisition module is configured to acquire the data packet mirror of the network device.

[0018] The processing module is configured to analyze the data packet mirror and determine the structured data of the data packet mirror. The structured data comprises packet header data. The packet header data is used to indicate the features of the data packet mirror.

[0019] The generation module is configured to generate the tracing data of the network device according to the packet header data.

[0020] In a possible implementation manner, the packet header data comprises the source address of the data packet mirror, the target address of the data packet mirror and the timestamp of the data packet reaching the network device.

[0021] The generation module is specifically configured to generate the preliminary tracing data of the structured data by using the timestamp, determine the level of the preliminary tracing data by using the source address and the target address, add the level mark to the preliminary tracing data according to the level, and generate the tracing data according to the preliminary tracing data and the level mark.

[0022] In a possible implementation manner, the generation module is specifically configured to determine the data packet flow direction of the structured data by using the timestamp, and generate the preliminary tracing data according to the data packet flow direction.

[0023] In a possible implementation manner, the structured data further comprises packet body data. The packet body data is used to indicate the business data of the data packet mirror. The data tracing device provided by the present application further comprises a marking module. The marking module is configured to add the same-name data mark to the first structured data and the second structured data if the business data of the first structured data is the same as the business data of the second structured data. The first structured data is the structured data generated based on the first data packet mirror, the second structured data is the structured data generated based on the second data packet mirror, and the first data packet mirror is different from the second data packet mirror. The same-name data mark is used to indicate that the business data of the first structured data and the business data of the second structured data are the same-name data of different versions of the business data.

[0024] In a possible implementation manner, the generation module is further configured to generate the data packet mirror of the data packet when the data packet of the network device is monitored.

[0025] In a third aspect, a traceability device is provided, which has a function of implementing the data traceability method according to the first aspect or any possible implementation manner. The function can be implemented by hardware, or the corresponding software is executed by hardware. The hardware or software includes one or more modules corresponding to the above functions.

[0026] In a fourth aspect, a computer readable storage medium is provided, which stores instructions, when the instructions are run on a computer, the computer can execute the data traceability method according to the first aspect or any possible implementation manner.

[0027] In a fifth aspect, a computer program product containing instructions is provided, when the instructions are run on a computer, the computer can execute the data traceability method according to the first aspect or any possible implementation manner.

[0028] The technical effects brought by any design manner of the third aspect to the fifth aspect can refer to the technical effects brought by the different possible implementation manners of the first aspect, which will not be described here.

[0029] The specific description of the second aspect to the fifth aspect and various implementation manners in the present application can refer to the detailed description in the first aspect and various implementation manners; and the beneficial effects of the second aspect to the fifth aspect and various implementation manners can refer to the beneficial effect analysis in the first aspect and various implementation manners, which will not be described here.

[0030] These aspects or other aspects of the present application will be more apparent in the following description. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0032] Figure 1 An architecture diagram of a data traceability system provided by the embodiments of the present application is provided.

[0033] Figure 2 A structural schematic diagram of a traceability device provided by the embodiments of the present application is provided.

[0034] Figure 3 A flowchart of a data traceability method provided by the embodiments of the present application is provided.

[0035] Figure 4Another flowchart of a data traceability method provided by an embodiment of the present application is shown in FIG. 2.

[0036] Figure 5 A structural diagram of a data traceability device provided by an embodiment of the present application is shown in FIG. 3.

[0037] Figure 6 Another structural diagram of a data traceability device provided by an embodiment of the present application is shown in FIG. 4.

[0038] Figure 7 A structural diagram of a traceability device provided by an embodiment of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0040] The terms "first" and "second" are only used for description purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first" and "second" can explicitly or implicitly include one or more of the features. In the description of the present application, unless otherwise specified, the meaning of "a plurality of" is two or more.

[0041] In addition, the network architecture and business scenarios described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. A person of ordinary skill in the art can know that, as the network architecture evolves and new business scenarios appear, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0042] In order to facilitate understanding, the terms designed in the present application are explained first.

[0043] Data traceability refers to the process of tracing the source and flow of data.

[0044] Redundant field refers to a repeated field in a database. For example, if field b appears in table a in the database, and field b appears in table c, then field b can be regarded as a redundant field.

[0045] Reserved field refers to a field reserved for future use in a data table.

[0046] Mirror, a file storage form, is a type of redundancy, and a complete copy of the data on one disk exists on another disk.

[0047] At present, the traditional data traceability method needs a large amount of manual participation in the early stage of data traceability, and the traceability efficiency is too low. At the same time, the traditional data traceability method is based on the existing data of the database for traceability, and if there are a large number of redundant fields or reserved fields in the database, unnecessary overheads will be brought to the data traceability. Based on this, the application provides a data traceability method and device, acquires a data packet mirror of a network device, analyzes the data packet mirror, determines the structured data of the data packet mirror, generates traceability data of the network device according to the packet header data, so as to realize automatic monitoring of the data packet in the business process and data traceability of the data packet, reduce the participation of manual work, and at the same time, only the data packet required by the business is used for data traceability, and the redundant fields or reserved fields in the database will not be included in the traceability process, thereby improving the data traceability efficiency.

[0048] The implementation manners of the embodiments of the application will be described in detail below with reference to the drawings.

[0049] The scheme provided by the application can be applied to Figure 1 The data traceability system 100 is shown in the schematic diagram. As shown in the figure, the data traceability system 100 includes a client 101, a first layer network device 102, a second layer network device 103, a third layer network device 104, and a traceability device 105. Figure 1 The client 101 can be used to provide a business operation interface for a user, and the user can input a business request in the operation interface provided by the client 101, generate a data packet of the business request, and send the data packet to the first layer network device 102. The client 101 can be a computer or the like.

[0050] The first layer network device 102 can be used to receive the data packet sent by the client 101, and forward the data packet to the second layer network device. The first layer network device 102 can be an access switch, a router or the like.

[0051] The second layer network device 103 can be used to receive the data packet forwarded by the first layer network device 102, and forward the data packet sent by the first layer network device 103 to the third layer network device. The second layer network device 103 can be a convergence switch, a router or the like.

[0052] The third layer network device 104 can be used to receive the data packet forwarded by the second layer network device 103. The third layer network device 105 can be a core switch, a server or the like.

[0053]

[0054] ​The traceability device 105 is used to mirror data packets from the first-layer network device 102, the second-layer network device 103, and the third-layer network device 104, and process the mirrored data packets using the data traceability method provided in this application to generate traceability data. The traceability device 105 can be a device with data traceability functionality; for example, it can include any device with traceability functionality known in the current art, such as a server, a computer, etc.; or, the computing device can also refer to a chip with traceability functionality; for example, a chip configured in a server, a chip in a computer, etc.

[0055] The solution provided in this application can be applied to... Figure 2 In the illustrated traceability device 105, the traceability device 105 can be deployed in Figure 1 The data traceability system 100 shown includes a traceability device 105 comprising: a data mirroring module 21, a data processing module 22, a data analysis module 23, and a data relationship display module 24.

[0056] Among them, the data mirroring module 21 can be used to obtain the data packet image of the network device.

[0057] The data processing module 22 can be used to parse the data packet image obtained by the data image module 21 and determine the structured data of the data packet image.

[0058] Data analysis module 23 can be used to generate traceability data based on the structured data of the data packet image determined by data processing module 22.

[0059] The data relationship display module 24 can be used to display the traceability data to the user.

[0060] It should be noted that the above Figure 2 The traceability device 105 shown is only an example to illustrate the application scenario of the solution in this application, and is not intended to limit the application scenario of the solution in this application.

[0061] On the one hand, this application discloses a data traceability method, which can be executed by traceability devices, such as those provided by... Figure 2 The traceability device 105 shown in the diagram is executed. For example... Figure 3 As shown, the method may include the following steps:

[0062] S301, the tracing device obtains the data packet image of the network device.

[0063] Specifically, the process of determining a packet image is as follows: when the tracing device detects a packet from a network device, it generates a packet image of that packet.

[0064] For example, when the traceability device acquires the data packet of the first layer network device, the data packet of the second layer network device, or the data packet of the third layer network device, the traceability device generates a data packet mirror image of the data packet.

[0065] It should be noted that the data packet of the first layer network device, the data packet of the second layer network device, and the data packet of the third layer network device can be one or more data packets, which are not limited in the present application.

[0066] S302, the traceability device parses the data packet mirror image to determine the structured data of the data packet mirror image.

[0067] The structured data includes packet header data and packet body data. The packet header data is used to indicate the characteristics of the data packet mirror image, and the packet body data is used to indicate the service data of the data packet mirror image.

[0068] Specifically, after the traceability device acquires the data packet mirror image of the data packet, the traceability device parses the data packet mirror image to determine the structured data of the data packet mirror image.

[0069] For example, after the traceability device acquires the data packet mirror image of the data packet, the traceability device parses the data packet mirror image to determine the source IP address, the target IP address, the port number of the data packet stored in the data packet mirror image, and the service data of the data packet mirror image. The traceability device also acquires the timestamp of the data packet reaching the network device, and then uses the source IP address, the target IP address, and the timestamp of the data packet reaching the network device to form the packet header of the structured data. At the same time, the traceability device uses the service data of the data packet to form the packet body data of the structured data.

[0070] Further, the traceability device uses the packet header data and the packet body data to form the structured data of the data packet mirror image.

[0071] S303, the traceability device generates traceability data of the network device according to the packet header data.

[0072] Specifically, the traceability device uses the timestamp of the data packet reaching the network device in the packet header data to generate preliminary traceability data of the structured data. If the service data of the first structured data and the service data of the second structured data are the same, the traceability device adds a same name mark to the first structured data and the second structured data. The first structured data is the structured data generated based on the first data packet, and the second structured data is the structured data generated based on the second data packet. The same name data mark is used to indicate that the service data of the first structured data and the service data of the second structured data are the same name data of different versions of service data.

[0073] The traceability device determines the level of the preliminary traceability data by using the source address and the target address in the header data after the preliminary traceability data is generated, adds a level mark to the preliminary traceability data according to the level, and finally generates traceability data according to the preliminary traceability data and the level mark.

[0074] For example, the traceability device sorts the structured data according to the timestamp of the data packet reaching the network device at the level of the data packet by using the timestamp of the data packet reaching the network device at the level of the data packet in the header data, and generates the preliminary traceability data according to the sorting. When the traceability device receives multiple structured data generated according to the data packet mirror, the multiple structured data includes first structured data, second structured data, and the like. If the service data of the first structured data is the same as the service data of the second structured data, the same data mark is added to the first structured data and the second structured data to mark the first structured data and the second structured data with the same service data but different versions, so as to facilitate the distinction.

[0075] Further, the traceability device determines the level network where the preliminary traceability data is located by using the source address and the target address in the header data, and adds the level mark to the preliminary traceability data to generate traceability data with the level mark.

[0076] Further, after the traceability device generates the traceability data of the network device according to the header data, the traceability device returns the traceability data to the user interface and displays it to the user.

[0077] The application obtains the data packet mirror of the network device, analyzes the data packet mirror, determines the structured data of the data packet mirror, and generates the traceability data of the network device according to the header data in the structured data, so as to automatically monitor the data packet in the business process and perform data traceability on the data packet, reduce the participation of manual work, and only perform data traceability on the data packet required by the business, so that the redundant fields or reserved fields in the database are not included in the traceability process, and the data traceability efficiency is improved.

[0078] The scheme of the application will be described in detail below through specific examples.

[0079] For example, as shown in Figure 4 When the user needs to handle a business, the user submits a business request by accessing a client, the client generates at least one data packet according to the business request, and sends the data packet to a first layer network device, the first layer network device receives the data packet and forwards the data packet to a second layer network device. At this time, the traceability device mirrors and stores the data packet when monitoring the data packet of the first layer network device to obtain the data packet mirror of the data packet.

[0080] The tracing device parses the data packet image to generate structured data of the data packet image. The structured data includes packet header data and packet body data, wherein the packet header data is a source IP address, a target IP address of a data packet corresponding to the data packet image, and a timestamp of the data packet reaching the first layer network device.

[0081] Further, the tracing device sorts all data packets in the first layer network device by using the timestamp in the packet header data of the structured data, to generate preliminary tracing data of all structured data of the first layer network device. The preliminary tracing data belongs to a level is determined by using the source IP address and the target IP address in the structured data, and the preliminary tracing data is added with a first level mark according to the level, to obtain preliminary tracing data with the first level mark.

[0082] The second layer network device forwards the data packet received from the first layer network device to the third layer network device. At this time, the tracing device mirrors and stores the data packet when monitoring the data packet of the second layer network device, to obtain a data packet image of the data packet.

[0083] The tracing device parses the data packet image to generate structured data of the data packet image. The structured data includes packet header data and packet body data, wherein the packet header data is a source IP address, a target IP address of a data packet corresponding to the data packet image, and a timestamp of the data packet reaching the first layer network device.

[0084] Further, the tracing device sorts all data packets in the first layer network device by using the timestamp in the packet header data of the structured data, to generate preliminary tracing data of all structured data of the first layer network device. The preliminary tracing data belongs to a level is determined by using the source IP address and the target IP address in the structured data, and the preliminary tracing data is added with a first level mark according to the level, to obtain preliminary tracing data with the first level mark.

[0085] The third layer network device receives the data packet sent by the second layer network device. The tracing device mirrors and stores the data packet when monitoring the data packet of the second layer network device, to obtain a data packet image of the data packet.

[0086] The tracing device parses the data packet image to generate structured data of the data packet image. The structured data includes packet header data and packet body data, wherein the packet header data is a source IP address, a target IP address of a data packet corresponding to the data packet image, and a timestamp of the data packet reaching the first layer network device.

[0087] Further, the traceability device sorts all data packets in the third layer network device by using the time stamp in the header data of the structured data, and generates preliminary traceability data of all structured data of the first layer network device. Then, the traceability device determines the level to which the preliminary traceability data belongs by using the source IP address and the target IP address in the structured data, and adds a third level mark to the preliminary traceability data according to the level, to obtain preliminary traceability data with the third level mark.

[0088] Finally, the traceability device collects the preliminary traceability data with the first level mark, the preliminary traceability data with the second level mark, and the preliminary traceability data with the third level mark, and displays them in different dimensions. For example, the preliminary traceability data of each level is displayed according to the order, or all the preliminary traceability data is displayed according to the level mark.

[0089] For example, the preliminary traceability data of each level is displayed according to the order, or all the preliminary traceability data is displayed according to the level mark.

[0090] The above mainly introduces the scheme provided by the embodiments of the present application from the perspective of the working principle of the device. It can be understood that the computing device contains the hardware structure and / or software module corresponding to each function in order to realize the above functions. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed in the present text, the present application can be realized in the form of hardware or the combination of hardware and computer software. Whether a certain function is realized in the form of hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0091] The embodiments of the present application can divide the functional modules of the computing device according to the above method examples. For example, each functional module can be divided according to each function, or two or more functions can be integrated in one processing module. The above integrated module can be realized in the form of hardware or software functional module. It should be noted that the division of the modules in the embodiments of the present application is illustrative, and is only a logical functional division. There can be another division method when actually implemented.

[0092] In the case of dividing each functional module according to each function, A possible composition schematic diagram of the data traceability device involved in the above and embodiments is shown, as shown in the figure, the data traceability device 50 can include an acquisition module 51, a processing module 52, and a generation module 53.

[0093] Figure 5 The acquisition module 51 is configured to support the data traceability device 50 to perform the following steps. Figure 5 The processing module 52 is configured to support the data traceability device 50 to perform the following steps.

[0094] The generation module 53 is configured to support the data traceability device 50 to perform the following steps.Figure 3 S301 in the data tracing method shown.

[0095] 5. Processing module 52, used to support the execution of data traceability device 50 Figure 3 S302 in the data tracing method shown.

[0096] Generation module 53 is used to support the execution of data traceability device 50. Figure 3 S303 in the data tracing method shown.

[0097] In the embodiments of this application, further, such as Figure 6 As shown, the data traceability device 50 may also include: a tagging module 54.

[0098] The tagging module 54 is used to support the data traceability device 50 in performing the step of adding a data tag with the same name to the first structured data and the second structured data if the business data of the first structured data is the same as the business data of the second structured data.

[0099] It should be noted that all relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0100] The data traceability device 50 provided in this application embodiment is used to execute the above-described data traceability method, and therefore can achieve the same effect as the above-described data traceability method.

[0101] This application embodiment also provides a traceability device 700, such as... Figure 7 As shown, the traceability device 700 may include a memory 701, a processor 702, and a transceiver 703, wherein the memory 701 and the processor 702 can be connected via a bus, network, or other means. Figure 7 Taking the example of a connection between China and Israel via a bus.

[0102] Processor 702 can be a central processing unit (CPU). Processor 702 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0103] The memory 701 can be a volatile memory (volatile memory), such as a random access memory (random-access memory, RAM); or a non-volatile memory (non-volatile memory), such as a read-only memory (read-only memory, ROM), a flash memory (flash memory), a hard disk drive (hard disk drive, HDD) or a solid-state drive (solid-state drive, SSD); or a combination of the above types of memories, for storing application program codes, configuration files, data information or other contents that can implement the method of the present application.

[0104] The memory 701 as a kind of non-transient computer readable storage medium, it can be used to store non-transient software programs, non-transient computer executable programs and modules, such as metadata acquisition module and the like in the embodiment of the present application. The processor 702 executes the various functions of the processor and data processing by running the non-transient software programs, instructions and modules stored in the memory 701.

[0105] The memory 701 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application program required by a function; the data storage area can store data created by the processor 702 and the like. In addition, the memory 701 can include a high-speed random access memory, and can also include a non-transient memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transient solid-state memory device. In some embodiments, the memory 701 can optionally include a memory disposed remotely with respect to the processor 702, and these remote memories can be connected to the processor 702 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0106] The transceiver 703 is used for information interaction between the traceability device 700 and other devices.

[0107] The one or more modules are stored in the memory 701, and when executed by the processor 702, the data traceability method is executed as Figure 3 The data traceability method in the embodiment shown.

[0108] The embodiment of the present application also provides a computer readable storage medium, which stores instructions, and the instructions are executed to perform the data traceability method and related steps in the above method embodiment.

[0109] The embodiment of the present application also provides a computer program product, when the computer program product runs on the computer, so that the computer executes the related steps of the data traceability method in the above method embodiment.

[0110] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0112] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0113] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0114] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, in essence, or the part that contributes, or all or part of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0115] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any change or replacement within the technical scope disclosed by the present application should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data tracing method, characterized in that, include: Acquire data packets from network devices and generate a data packet image of those data packets; Parse the packet image to determine the structured data of the packet image; The structured data includes: packet header data; the packet header data is used to indicate the characteristics of the packet mirroring, and the packet header data includes: the source address of the packet mirroring, the destination address of the packet mirroring, and the timestamp of the packet arriving at the network device; Using the timestamp, preliminary source data for the structured data is generated; Using the source address and the target address, the hierarchy of the preliminary tracing data is determined; Add hierarchical tags to the preliminary source tracing data according to the described hierarchy; The source data is generated based on the preliminary source data and the hierarchical markers; The structured data further includes: packet body data; the packet body data is used to indicate the service data of the data packet mirror; the method further includes: If the business data of the first structured data is the same as the business data of the second structured data, add a data tag with the same name to the first structured data and the second structured data; the first structured data is the structured data generated based on the first data packet image; the second structured data is the structured data generated based on the second data packet image; the first data packet image and the second data packet image are different; the data tag with the same name is used to indicate that the business data of the first structured data and the business data of the second structured data are different versions of the same data.

2. The method according to claim 1, characterized in that, The process of generating preliminary source data for the structured data using the timestamp includes: The timestamp is used to determine the data packet flow direction of the structured data; The preliminary source tracing data is generated based on the data packet flow direction.

3. The method according to claim 1, characterized in that, The step of acquiring data packets from network devices and generating data packet mirrors includes: When a data packet is detected from a network device, a data packet mirror is generated.

4. A data traceability device, characterized in that, include: The acquisition module is used to acquire data packets from network devices and generate a data packet image of the data packets; The processing module is used to parse the data packet image and determine the structured data of the data packet image; The structured data includes: packet header data; the packet header data is used to indicate the characteristics of the packet mirroring, and the packet header data includes: the source address of the packet mirroring, the destination address of the packet mirroring, and the timestamp of the packet arriving at the network device; A generation module is used to generate preliminary source data of the structured data using the timestamp; determine the hierarchy of the preliminary source data using the source address and the target address; add hierarchy markers to the preliminary source data according to the hierarchy; and generate the source data based on the preliminary source data and the hierarchy markers. The structured data further includes: packet body data; the packet body data is used to indicate the service data of the packet image; the device further includes: a tagging module, used to add a data tag with the same name to the first structured data and the second structured data if the service data of the first structured data is the same as the service data of the second structured data; the first structured data is the structured data generated based on the first packet image; the second structured data is the structured data generated based on the second packet image; the first packet image and the second packet image are different; the data tag with the same name is used to indicate that the service data of the first structured data and the service data of the second structured data are different versions of the same data.

5. The apparatus according to claim 4, characterized in that, The generation module is specifically used to: determine the data packet flow direction of the structured data using the timestamp; and generate the preliminary source tracing data based on the data packet flow direction.

6. The apparatus according to claim 4, characterized in that, The generation module is also used to generate a data packet image of the network device when a data packet is detected.

7. A traceability device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the data tracing method as described in any one of claims 1-3.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the data tracing method as described in any one of claims 1-3.

9. A computer program product, characterized in that, When the computer program product is run on a computer, the computer performs the data tracing method as described in any one of claims 1-3.

Images