Video stream monitoring method, device, computer equipment and storage medium

Abstract

The present application provides a video stream monitoring method, apparatus, computer equipment and storage medium, the method comprising: obtaining network card data of a local network card; the network card data comprising a video stream, a source Internet Protocol address and a destination Internet Protocol address of the video stream obtained from a target streaming media server; determining a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads based on the source Internet Protocol address and the destination Internet Protocol address of the video stream; obtaining source port information and destination port information of the video stream analyzed by the target network intrusion detection and analysis thread; determining a target media data analysis thread from a plurality of candidate media data analysis threads; and obtaining media monitoring data of the video stream based on the target media data analysis thread. The present application can improve the processing efficiency of the video stream and ensure the normal operation of video stream monitoring.

Description

Technical Field

[0001] The present application relates to the field of video stream processing technology, and in particular to a video stream monitoring method, apparatus, computer equipment, and storage medium. Background Art

[0002] Video stream monitoring probe systems are usually used to monitor video streams. The video stream monitoring probe system can automatically discover and analyze video streams, support monitoring and measurement of indicators at the transport layer and transport stream (TS) layer, make accurate and timely alarms when the video stream is abnormal, and can perform post-analysis. It can be widely used in streaming media server pressure analysis, network quality assessment, streaming media playback quality monitoring, streaming media on-demand behavior analysis, and other occasions in the operation and maintenance of interactive network TV and Internet TV services.

[0003] Currently, the video stream monitoring probe system consists of a stream pulling module, a monitoring and analysis module, and a display platform. The monitoring and analysis module includes a network intrusion detection and analysis thread and a media data analysis thread. The stream pulling module pulls the video stream provided by streaming media servers such as HLS or HttpTs to the local network card. The monitoring and analysis module captures the data packets of the local network card, performs statistical monitoring and analysis on the video stream, and reports abnormal data to the display platform for alarm.

[0004] HLS stream is a major stream monitored in Internet services. The current process of analyzing HLS stream by the monitoring and analysis module is to parse the Uniform Resource Locator (URL) of the corresponding fragment according to the m3u8 file, and find the fragment data according to the fragment URL to perform statistics and monitoring analysis of relevant information. However, the current analysis process uses single-threaded analysis, and the m3u8 file and fragment data must be analyzed in sequence. Otherwise, the fragment will not match the corresponding m3u8, and the corresponding video stream information cannot be found for monitoring and statistics. Therefore, a single thread is used to process TCP streams such as HLS or HttpTs. TCP (Transmission Control Protocol, TCP) is a transmission control protocol. Although single-threaded processing can ensure normal analysis and processing of data, it greatly reduces the system's processing efficiency of video stream data, affecting the monitoring process of the video stream. Summary of the Invention

[0005] In view of this, the embodiments of the present application provide a video stream monitoring method, apparatus, computer equipment and storage medium, which can improve the processing efficiency of video streams and ensure the normal operation of video stream monitoring.

[0006] In a first aspect, an embodiment of the present application provides a video stream monitoring method, comprising the following steps:

[0007] Acquire network card data of a local network card; the network card data includes a video stream obtained from a target streaming media server, a source Internet Protocol address of the video stream, and a destination Internet Protocol address;

[0008] Determining a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads based on a source Internet Protocol address and a destination Internet Protocol address of the video stream, wherein each of the candidate network intrusion detection and analysis threads carries a matching relationship with a corresponding source Internet Protocol address and a destination Internet Protocol address;

[0009] Obtaining analysis results of the target network intrusion detection analysis thread; the analysis results include source port information and destination port information of the video stream;

[0010] Determining a target media data analysis thread from a plurality of candidate media data analysis threads according to the source port information and the destination port information of the video stream; each of the candidate media data analysis threads carries corresponding source port information and destination port information;

[0011] According to the target media data analysis thread, media monitoring data of the video stream is obtained.

[0012] In a possible implementation, before the step of obtaining the network card data of the local network card, the method further includes:

[0013] Pull the video stream from the target streaming media server through a stream pulling module;

[0014] Add a unique identifier to the pulled video stream;

[0015] The video stream with the unique identifier added is sent to the network port of the local network card.

[0016] In a possible implementation, obtaining network card data of the local network card includes:

[0017] Using a packet capture module to capture the network card data from the network port of the local network card;

[0018] The video stream and the source Internet Protocol address and destination Internet Protocol address of the video stream are extracted from the network card data.

[0019] In a possible implementation, the method for establishing a matching relationship between each candidate network intrusion detection and analysis thread and a corresponding source Internet Protocol address and destination Internet Protocol address includes:

[0020] A TCP connection is established between each candidate network monitoring thread and the corresponding source Internet Protocol address and destination Internet Protocol address.

[0021] In a possible implementation, determining a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads according to a source Internet Protocol address and a destination Internet Protocol address of the video stream includes:

[0022] Determining a target TCP connection based on a source Internet Protocol address and a destination Internet Protocol address of the video stream;

[0023] According to the target TCP connection, a target network intrusion detection and analysis thread is determined from a plurality of candidate network intrusion detection and analysis threads.

[0024] In a possible implementation, the method further includes: if the media monitoring data of the video stream indicates that certain media indicators are abnormal, sending the abnormal media indicators and alarm prompts to a display platform for display.

[0025] In a second aspect, an embodiment of the present application provides a video stream monitoring device, comprising:

[0026] A first acquisition module is used to acquire network card data of a local network card; the network card data includes a video stream, a source Internet Protocol address, and a destination Internet Protocol address of the video stream acquired from a target streaming media server;

[0027] a first determining module, configured to determine a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads based on a source Internet Protocol address and a destination Internet Protocol address of the video stream; each of the candidate network intrusion detection and analysis threads carries a matching relationship with a corresponding source Internet Protocol address and a destination Internet Protocol address;

[0028] A second acquisition module is used to obtain the analysis result of the target network intrusion detection analysis thread; the analysis result includes the source port information and destination port information of the video stream;

[0029] A second determination module is configured to determine a target media data analysis thread from a plurality of candidate media data analysis threads based on the source port information and the destination port information of the video stream; each candidate media data analysis thread carries corresponding source port information and destination port information;

[0030] A processing module is used to obtain media monitoring data of the video stream according to the target media data analysis thread.

[0031] In a possible implementation, the adding module includes:

[0032] A pulling unit, configured to pull the video stream from the target streaming media server through a stream pulling module;

[0033] An adding unit, configured to add a unique identifier to the pulled video stream;

[0034] The sending unit is used to send the video stream with the unique identifier added to the network port of the local network card.

[0035] In a third aspect, an embodiment of the present application provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the video stream monitoring method described in any one of the first aspects when executing the computer program.

[0036] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the video stream monitoring method described in any one of the first aspects are executed.

[0037] The technical solution provided in the embodiments of the present application has the following beneficial effects:

[0038] In order to realize the monitoring of video stream, the network card data of the local network card is first obtained, and the network card data includes the video stream obtained from the target streaming media server, the source Internet Protocol address and the destination Internet Protocol address of the video stream, and then according to the source Internet Protocol address and the destination Internet Protocol address of the video stream, the target network intrusion detection analysis thread is determined from multiple candidate network intrusion detection analysis threads, and the video stream is subjected to data reorganization analysis through the thread. After the analysis is completed, the analysis result of the target network intrusion detection analysis thread is obtained, and the analysis result includes the source port information and the destination port information of the video stream. The data processing of the analysis thread occupies a large amount of memory. In order to prevent multiple video streams in the same network intrusion detection analysis thread from being processed in the same media data analysis thread and affecting the analysis process, the target media data analysis thread is determined from multiple candidate media data analysis threads according to the source port information and destination port information of the video stream. The video stream is distributed according to the source port and destination port, which can distribute all video streams more evenly to multiple media data analysis threads, thereby improving the processing efficiency of the video stream. Finally, the media monitoring data of the video stream is obtained according to the target media data analysis thread, thereby ensuring the normal operation of the video streaming media data monitoring.

[0039] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A flowchart of a video stream monitoring method provided in an embodiment of the present application;

[0042] Figure 2 A flowchart of a method for adding a video stream identifier provided in an embodiment of the present application;

[0043] Figure 3 A flowchart of a method for obtaining network card data provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of the structure of a video stream monitoring device provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of this application.

[0047] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0048] The embodiment of the present application provides a video stream monitoring method, such as Figure 1 As shown, the following steps are included:

[0049] S101, obtaining network card data of a local network card; the network card data includes a video stream obtained from a target streaming media server, a source Internet Protocol address of the video stream, and a destination Internet Protocol address;

[0050] S102, determining a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads based on the source Internet Protocol address and the destination Internet Protocol address of the video stream, wherein each of the candidate network intrusion detection and analysis threads carries a matching relationship with the corresponding source Internet Protocol address and the destination Internet Protocol address;

[0051] S103, obtaining the analysis result of the target network intrusion detection analysis thread; the analysis result includes the source port information and destination port information of the video stream;

[0052] S104, determining a target media data analysis thread from a plurality of candidate media data analysis threads according to the source port information and the destination port information of the video stream; each candidate media data analysis thread carries corresponding source port information and destination port information;

[0053] S105 : Obtain media monitoring data of the video stream according to the target media data analysis thread.

[0054] The above exemplary steps of the embodiment of the present application are described below respectively.

[0055] In step S101, network card data of a local network card is obtained; the network card data includes a video stream obtained from a target streaming server, a source Internet Protocol address of the video stream, and a destination Internet Protocol address;

[0056] Specifically, the target streaming media server refers to a server that generates the required video stream and transmits data to the local network card. The network card data is a MAC frame, which is a type of data frame. The MAC frame contains information about the source Internet Protocol address and the destination Internet Protocol address of the corresponding video stream, which can be obtained by parsing the MAC frame. When obtaining the network card data of the local network card, a packet capture module or a packet capture tool is used to obtain it; the source Internet Protocol address of the video stream refers to the Internet Protocol Address (IP) of the source that sends the video stream or generates the video stream, and the destination Internet Protocol address refers to the IP of the destination where the video stream is sent.

[0057] In step S102, a target network intrusion detection and analysis thread is determined from a plurality of candidate network intrusion detection and analysis threads according to the source Internet Protocol address and the destination Internet Protocol address of the video stream; each of the candidate network intrusion detection and analysis threads carries a matching relationship with the corresponding source Internet Protocol address and the destination Internet Protocol address;

[0058] Specifically, in order to solve the problem of low efficiency of existing single-thread processing, this embodiment sets multiple network intrusion detection and analysis threads as candidate network intrusion detection and analysis threads, and finds a matching target network intrusion detection and analysis thread based on the matching relationship between the source Internet Protocol address and the destination Internet Protocol address of the video stream and the candidate network intrusion detection and analysis threads, and then transmits the video stream to the target network intrusion detection and analysis thread for processing, wherein the network intrusion detection and analysis thread can be a network intrusion detection system (Library Network Intrusion Detection System, libnids) analysis thread.

[0059] In some embodiments, each video stream corresponds to an m3u8 file and a fragment. The video stream can be an m3u8 file or a fragment. If the m3u8 file and the fragment belong to the same source Internet Protocol address and destination Internet Protocol address, they will be assigned to the same network intrusion detection and analysis thread. If they do not belong to the same source Internet Protocol address and destination Internet Protocol address, they will be assigned to different network intrusion detection and analysis threads.

[0060] In some embodiments, the acquired network card data includes multiple video streams, which are transmitted to corresponding network intrusion detection and analysis threads for processing based on the matching relationship between the source Internet Protocol address and destination Internet Protocol address of each video stream and the candidate network intrusion detection and analysis thread. Since the data volume of the video stream is relatively large, when the number of network intrusion detection and analysis threads is less than the number of video streams, the source Internet Protocol address and destination Internet Protocol address of the video stream are averaged to establish a matching relationship with the network intrusion detection and analysis thread. That is, the source Internet Protocol address and destination Internet Protocol address of one video stream can only correspond to one network intrusion detection and analysis thread, and one network intrusion detection and analysis thread can correspond to the source Internet Protocol address and destination Internet Protocol address of one or more video streams.

[0061] For distributing multiple video streams to multiple candidate network intrusion detection and analysis threads, this embodiment also provides another method. After obtaining the network card data of the streaming media server and obtaining the source Internet Protocol address and destination Internet Protocol address of the video stream, the video streams belonging to the same source Internet Protocol address and the same destination Internet Protocol address are divided into a group to obtain multiple groups of video streams, and the multiple groups of video streams are evenly distributed to multiple candidate network intrusion detection and analysis threads.

[0062] For allocating multiple video streams to multiple candidate network intrusion detection and analysis threads, this embodiment also provides another method. After obtaining the network card data of the streaming media server and obtaining the source Internet Protocol address and destination Internet Protocol address of the video stream, the first arriving video stream is allocated to multiple candidate network intrusion detection and analysis threads in order. After the allocation, a connection relationship between the source Internet Protocol address and destination Internet Protocol address of the video stream and the corresponding network intrusion detection and analysis thread is established. If the video stream sent later already exists in the previous connection relationship, the network intrusion detection and analysis thread corresponding to the video stream is found, and the video stream is transmitted to the corresponding network intrusion detection and analysis thread.

[0063] In some embodiments, the number of candidate network intrusion detection and analysis threads is determined based on the performance parameters of the corresponding central processing unit. The performance parameters may be the main frequency of the central processing unit. The main frequency, i.e., the clock frequency, refers to the number of pulses emitted by the central processing unit per unit time. For a central processing unit with a high main frequency, relatively more network intrusion detection and analysis threads are set. For a central processing unit with a low main frequency, the number of network intrusion detection and analysis threads set is reduced. The specific number of settings is determined in actual operation. This method is to utilize the processing power of the corresponding central processing unit as much as possible and improve the processing efficiency of video stream data.

[0064] In step S103, the analysis result of the target network intrusion detection analysis thread is obtained; the analysis result includes the source port information and the destination port information of the video stream;

[0065] Specifically, when the target network intrusion detection and analysis thread processes the video stream data, the video stream data is reorganized into TCP and User Datagram Protocol (UDP), which saves the application layer the trouble of considering data fragmentation and retransmission. It also has the function of detecting abnormal datagrams. This process belongs to the existing technology and will not be described here. After obtaining the reorganized data, the source port information and destination port information of the video stream are extracted from the reorganized data. The source port information and the destination port information can be the source port number and the destination port number respectively. The source port number and the destination port number are included in the message sending the video stream, so they can be directly applied after parsing.

[0066] In step S104, a target media data analysis thread is determined from a plurality of candidate media data analysis threads according to the source port information and the destination port information of the video stream; each candidate media data analysis thread carries corresponding source port information and destination port information;

[0067] In some embodiments, the candidate media data analysis thread and the corresponding source port information and destination port information are set in advance; there may be multiple video streams belonging to the same source Internet Protocol address and destination Internet Protocol address, so they will be assigned to the same network intrusion detection and analysis thread for processing, and the distribution is uneven. The processing of this process consumes little memory, so this method has almost no effect on the data processing efficiency of the network intrusion detection and analysis thread, but the amount of data that the media data analysis thread needs to process is large, so the video stream needs to be distributed more evenly to multiple candidate media data analysis threads. This embodiment adopts the distribution method according to the source port and destination port to distribute the video stream to the corresponding media data analysis thread, improves the distribution uniformity, and is conducive to the rational use of the media data analysis thread and the improvement of processing efficiency.

[0068] In step S105, media monitoring data of the video stream is obtained according to the target media data analysis thread;

[0069] Specifically, after receiving the m3u8 file and fragment corresponding to the video stream, the target media data analysis thread can parse the m3u8 file to obtain the URL of the corresponding fragment, and find the media monitoring data corresponding to the fragment through the URL of the fragment. The processing process of the media data analysis thread belongs to the existing technology and will not be repeated here.

[0070] The above-mentioned video stream monitoring method, in order to realize the monitoring of the video stream, first obtains the network card data of the local network card, the network card data includes the video stream obtained from the target streaming server, the source Internet Protocol address and the destination Internet Protocol address of the video stream, and then determines the target network intrusion detection analysis thread from multiple candidate network intrusion detection analysis threads based on the source Internet Protocol address and the destination Internet Protocol address of the video stream, and performs data reorganization analysis on the video stream through the thread. After the analysis is completed, obtains the analysis result of the target network intrusion detection analysis thread, the analysis result includes the source port information and the destination port information of the video stream. The data processing of the media data analysis thread occupies a large amount of memory. In order to prevent multiple video streams in the same network intrusion detection analysis thread from being processed in the same media data analysis thread and affecting the analysis process, the target media data analysis thread is determined from multiple candidate media data analysis threads based on the source port information and destination port information of the video stream. The video stream is distributed through the source port and destination port, which can distribute all video streams more evenly to multiple media data analysis threads, thereby improving the processing efficiency of the video stream. Finally, according to the target media data analysis thread, the media monitoring data of the video stream is obtained, ensuring the normal operation of the video streaming media data monitoring.

[0071] For the above-mentioned multiple network intrusion detection and analysis threads, some threads have fast processing speeds and some threads have slow processing speeds, which often leads to some problems. For example, for HLS streams, the m3u8 file has not been parsed out, and its corresponding fragment has been sent over, and the m3u8 file corresponding to the fragment cannot be found. For Http+TS streams, the redirect request is received later than the actual transmission time of the stream. Therefore, it is necessary to add identification to m3u8 and fragments. In some embodiments, Figure 2 As shown, before the step of obtaining the network card data of the local network card, the method further includes:

[0072] S201, pulling the video stream from the target streaming media server through a stream pulling module;

[0073] S202, adding a unique identifier to the pulled video stream;

[0074] S203, sending the video stream with the unique identifier added to the network port of the local network card;

[0075] Concrete, for m3u8 file and fragmentation corresponding to same described video stream, the sign of m3u8 is identical with the sign of fragmentation, the sign of any two different video streams is all different, do not belong to the situation of same source internet protocol address and destination internet protocol address for m3u8 file and fragmentation, can be assigned in different network intrusion detection analysis threads, when different analysis thread processing rates are different, the time of receiving m3u8 file and corresponding fragmentation may be inconsistent, therefore the present embodiment is by the mode of adding sign, when guaranteeing to receive the time inconsistent of fragmentation and corresponding m3u8 file, can find corresponding m3u8 file according to the unique identification of fragmentation, and determine that m3u8 file or fragmentation belong to which video stream, need not to parse m3u8 file again after adding unique identification, just can accurately find which video stream fragmentation belongs to, no longer subject to the restriction of m3u8 file and corresponding fragmentation sending time or order inconsistency simultaneously, be convenient to statistics and analysis to video stream data, data processing can be normally carried out.

[0076] For ease of understanding, the following example illustrates the request header of a video stream and the m3u8 request header:

[0077] GET / CCTV1HD / 27_27,CCTV1HD_hls_pull_8000K_live.m3u8 HTTP / 1.1

[0078] User-Agent:BOHUI_HLS:[http: / / 172.28.159.6:6520 / CCTV1HD / index.m3u8]

[0079] Host:172.28.159.6:6520

[0080] Accept:* / *

[0081] The request headers for the shards are as follows:

[0082] GET / CCTV1HD / 27_27,CCTV1HD_hls_pull_8000K / 274 / 984 / 461.tsHTTP / 1.1

[0083] User-Agent:BOHUI_HLS:[http: / / 172.28.159.6:6520 / CCTV1HD / index.m3u8]

[0084] Host:172.28.159.6:6520

[0085] Accept:* / *

[0086] In the above two request headers, the stream pulling module uses the HTTP User-Agent field information to add a unique identifier to identify the same stream. The unique identifier of the request header of the m3u8 file and fragment corresponding to the same stream is the same. When parsing the video stream, it can quickly locate which video stream the current m3u8 file or fragment belongs to, thereby realizing rapid media data statistics and analysis.

[0087] In some embodiments, as Figure 3 As shown, step S102 includes the following steps:

[0088] S301, using a packet capture module to capture the network card data from the network port of the local network card;

[0089] In some embodiments, the packet capture module uses the pfring network packet capture library, which has the characteristic of high packet capture rate.

[0090] S302, extracting the video stream and the source Internet Protocol address and destination Internet Protocol address of the video stream from the network card data;

[0091] Specifically, the network card data includes the source Internet Protocol address information and the destination Internet Protocol address information of the video stream. In order to facilitate the distribution of the video stream, the source Internet Protocol address and the destination Internet Protocol address of the video stream are extracted from the network card data.

[0092] In some embodiments, the method for establishing a matching relationship between each candidate network intrusion detection and analysis thread and the corresponding source Internet Protocol address and destination Internet Protocol address includes:

[0093] A TCP connection is established between each candidate network monitoring thread and the corresponding source Internet Protocol address and destination Internet Protocol address.

[0094] Specifically, for reliable data transmission, a TCP connection is established in the application process. This is a logical relationship established between two transmission targets, making both communicating parties their own transmission connection endpoints. The establishment of TCP connections has been relatively mature and will not be introduced in detail here.

[0095] In some embodiments, determining a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads according to a source Internet Protocol address and a destination Internet Protocol address of the video stream includes:

[0096] Determining a target TCP connection based on a source Internet Protocol address and a destination Internet Protocol address of the video stream;

[0097] According to the target TCP connection, a target network intrusion detection and analysis thread is determined from a plurality of candidate network intrusion detection and analysis threads.

[0098] In the above method, the TCP connection is established in advance based on the source Internet Protocol address and the destination Internet Protocol address. Therefore, the corresponding target TCP connection can be found according to the source Internet Protocol address and the destination Internet Protocol address of the video stream. The other communication port of the target TCP connection is the network intrusion detection and analysis thread.

[0099] In some embodiments, the method further includes: if the media monitoring data of the video stream indicates that certain media indicators are abnormal, sending the abnormal media indicators and alarm prompts to a display platform for display.

[0100] Specifically, statistics and analysis are performed on the media monitoring data of the video stream. When data abnormalities of certain media indicators are determined, an alarm prompt for the media indicator is generated, and the media indicator and the alarm prompt are sent together to the display platform for display, so that the staff can understand the situation in a timely manner and take corresponding measures.

[0101] In summary, the embodiments of the present application have the following beneficial effects:

[0102] In order to realize the monitoring of video stream, the network card data of the local network card is first obtained, and the network card data includes the video stream obtained from the target streaming media server, the source Internet Protocol address and the destination Internet Protocol address of the video stream, and then according to the source Internet Protocol address and the destination Internet Protocol address of the video stream, the target network intrusion detection analysis thread is determined from multiple candidate network intrusion detection analysis threads, and the video stream is subjected to data reorganization analysis through the thread. After the analysis is completed, the analysis result of the target network intrusion detection analysis thread is obtained, and the analysis result includes the source port information and the destination port information of the video stream. The data processing of the analysis thread occupies a large amount of memory. In order to prevent multiple video streams in the same network intrusion detection analysis thread from being processed in the same media data analysis thread and affecting the analysis process, the target media data analysis thread is determined from multiple candidate media data analysis threads according to the source port information and destination port information of the video stream. The video stream is distributed according to the source port and destination port, which can distribute all video streams more evenly to multiple media data analysis threads, thereby improving the processing efficiency of the video stream. Finally, the media monitoring data of the video stream is obtained according to the target media data analysis thread, thereby ensuring the normal operation of the video streaming media data monitoring.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a video stream monitoring device corresponding to the video stream monitoring method in the first embodiment. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned video stream monitoring method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0104] like Figure 4 As shown, Figure 4 This is a schematic diagram of the structure of the video stream monitoring device provided by this application. The video stream monitoring device includes:

[0105] The first acquisition module 401 is used to acquire network card data of a local network card; the network card data includes a video stream, a source Internet Protocol address, and a destination Internet Protocol address of the video stream obtained from a target streaming media server;

[0106] A first determining module 402 is configured to determine a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads based on a source Internet Protocol address and a destination Internet Protocol address of the video stream; each candidate network intrusion detection and analysis thread carries a matching relationship with a corresponding source Internet Protocol address and a destination Internet Protocol address;

[0107] The second acquisition module 403 is used to obtain the analysis result of the target network intrusion detection analysis thread; the analysis result includes the source port information and destination port information of the video stream;

[0108] A second determining module 404 is configured to determine a target media data analysis thread from a plurality of candidate media data analysis threads based on the source port information and the destination port information of the video stream; each candidate media data analysis thread carries corresponding source port information and destination port information;

[0109] The processing module 405 is configured to obtain media monitoring data of the video stream according to the target media data analysis thread.

[0110] It should be understood by those skilled in the art that Figure 4 The implementation functions of each module in the video stream monitoring device shown can be understood by referring to the relevant description of the aforementioned video stream monitoring method. Figure 4 The functions of the various units in the video stream monitoring device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0111] In a possible implementation, the device further includes an adding module, which, before being configured to obtain the network card data of the local network card, includes:

[0112] A pulling unit, configured to pull the video stream from the target streaming media server through a stream pulling module;

[0113] An adding unit, configured to add a unique identifier to the pulled video stream;

[0114] The sending unit is used to send the video stream with the unique identifier added to the network port of the local network card.

[0115] In a possible implementation, the first acquisition module 401 includes:

[0116] A capture unit, configured to capture the network card data from the network port of the local network card using a packet capture module;

[0117] The extraction unit is used to extract the video stream and the source Internet Protocol address and destination Internet Protocol address of the video stream from the network card data.

[0118] In a possible implementation, the method for establishing a matching relationship between each candidate network intrusion detection and analysis thread and a corresponding source Internet Protocol address and destination Internet Protocol address includes:

[0119] A TCP connection is established between each candidate network monitoring thread and the corresponding source Internet Protocol address and destination Internet Protocol address.

[0120] In a possible implementation, the first determining module 402 includes:

[0121] a first determining unit, configured to determine a target TCP connection according to a source Internet Protocol address and a destination Internet Protocol address of the video stream;

[0122] The second determining unit is configured to determine a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads according to the target TCP connection.

[0123] In a possible implementation, the device further includes an alarm module, wherein the alarm module is configured to:

[0124] If the media monitoring data of the video stream indicates that certain media indicators are abnormal, the abnormal media indicators and alarm prompts are sent to the display platform for display.

[0125] In order to monitor the video stream, the above-mentioned video stream monitoring device first obtains the network card data of the local network card through the first acquisition module 401. The network card data includes the video stream obtained from the target streaming server, the source Internet Protocol address of the video stream, and the destination Internet Protocol address of the video stream. Then, based on the source Internet Protocol address and the destination Internet Protocol address of the video stream, the first determination module 402 determines the target network intrusion detection and analysis thread from multiple candidate network intrusion detection and analysis threads, and performs data reorganization analysis on the video stream through the thread. After the analysis is completed, the second acquisition module 403 obtains the analysis result of the target network intrusion detection and analysis thread, and the analysis result includes the source port information and destination Internet Protocol address of the video stream. Port information. Since the data processing of the media data analysis thread occupies a large amount of memory, in order to prevent multiple video streams in the same network intrusion detection analysis thread from being processed in the same media data analysis thread and affecting the analysis process, the target media data analysis thread is determined in multiple candidate media data analysis threads through the second determination module 404 according to the source port information and destination port information of the video stream. The video stream is distributed according to the source port and destination port, which can distribute all video streams more evenly to multiple media data analysis threads, thereby improving the processing efficiency of the video stream. Finally, according to the target media data analysis thread, the media monitoring data of the video stream is obtained through the processing module 405, thereby ensuring the normal operation of the video streaming media data monitoring.

[0126] Corresponding to Figure 1 The video stream monitoring method in the present application embodiment also provides a computer device 500, such as Figure 5 As shown, the device includes a memory 501, a processor 502, and a computer program stored in the memory 501 and executable on the processor 502, wherein the processor 502 implements the video stream monitoring method when executing the computer program.

[0127] Specifically, the above-mentioned memory 501 and processor 502 can be general-purpose memories and processors, which are not specifically limited here. When the processor 502 runs the computer program stored in the memory 501, it can execute the above-mentioned video stream monitoring method, which solves the problem of low processing efficiency caused by the use of a single thread to process the media data of the video stream in the existing technology.

[0128] Corresponding to Figure 1 The video stream monitoring method in the embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is run by a processor, the steps of the above-mentioned video stream monitoring method are executed.

[0129] Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the storage medium is run, the above-mentioned video stream monitoring method can be executed, solving the problem of low processing efficiency caused by using a single thread to process the media data of the video stream in the existing technology.

[0130] The computer-readable storage medium, in order to monitor the video stream, first obtains the network card data of the local network card, the network card data including the video stream obtained from the target streaming server, the source Internet Protocol address and the destination Internet Protocol address of the video stream, and then determines the target network intrusion detection and analysis thread from multiple candidate network intrusion detection and analysis threads based on the source Internet Protocol address and the destination Internet Protocol address of the video stream, and performs data reorganization analysis on the video stream through the thread. After the analysis is completed, the analysis result of the target network intrusion detection and analysis thread is obtained, the analysis result including the source port information and the destination port information of the video stream, and the target network intrusion detection and analysis thread is obtained. Since data processing in the media data analysis thread occupies a large amount of memory, in order to prevent multiple video streams in the same network intrusion detection analysis thread from being processed in the same media data analysis thread and affecting the analysis process, the target media data analysis thread is determined from multiple candidate media data analysis threads based on the source port information and destination port information of the video stream. The video stream is distributed through the source port and destination port, which can distribute all video streams more evenly to multiple media data analysis threads, thereby improving the processing efficiency of the video stream. Finally, according to the target media data analysis thread, the media monitoring data of the video stream is obtained, thereby ensuring the normal operation of the video streaming media data monitoring.

[0131] In the embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0132] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0133] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0134] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0135] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0136] It should be noted that the term "comprising" used in the embodiments of the present application is used to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0137] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. The terms used herein are for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0138] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The scope of protection of the present application is not limited thereto. Although the present application has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed in the present application, or perform equivalent replacements for some of the technical features thereof. However, these modifications, changes, or replacements do not deviate from the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the scope of protection of the claims.

Claims

1. A video stream monitoring method, characterized in that: The following steps are involved: Pull the video stream from the target streaming server through the stream pulling module; The m3u8 file and the fragment corresponding to the video stream pulled are respectively added with a unique identifier; wherein, the unique identifier is used to find the corresponding m3u8 file according to the unique identifier of the fragment when the time of receiving the fragment and the corresponding m3u8 file is inconsistent, and determine the video stream to which the m3u8 file or the fragment belongs; Sending the video stream with the unique identifier added to the network port of the local network card; Acquire network card data of a local network card; the network card data includes a video stream obtained from a target streaming media server, a source Internet Protocol address of the video stream, and a destination Internet Protocol address; Determining a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads based on a source Internet Protocol address and a destination Internet Protocol address of the video stream, wherein each of the candidate network intrusion detection and analysis threads carries a matching relationship with a corresponding source Internet Protocol address and a destination Internet Protocol address; Obtaining analysis results of the target network intrusion detection analysis thread; the analysis results include source port information and destination port information of the video stream; Determining a target media data analysis thread from a plurality of candidate media data analysis threads according to the source port information and the destination port information of the video stream; each of the candidate media data analysis threads carries corresponding source port information and destination port information; Obtaining media monitoring data of the video stream according to the target media data analysis thread; If the media monitoring data of the video stream indicates that certain media indicators are abnormal, the abnormal media indicators and alarm prompts are sent to the display platform for display.

2. The video stream monitoring method according to claim 1, wherein: The obtaining of network card data of the local network card includes: Using a packet capture module to capture the network card data from the network port of the local network card; The video stream and the source Internet Protocol address and destination Internet Protocol address of the video stream are extracted from the network card data.

3. The video stream monitoring method according to claim 1, wherein: The method for establishing a matching relationship between each candidate network intrusion detection and analysis thread and the corresponding source Internet Protocol address and destination Internet Protocol address includes: A TCP connection is established between each candidate network monitoring thread and the corresponding source Internet Protocol address and destination Internet Protocol address.

4. The video stream monitoring method according to claim 3, wherein: The step of determining a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads according to a source Internet Protocol address and a destination Internet Protocol address of the video stream comprises: Determining a target TCP connection based on a source Internet Protocol address and a destination Internet Protocol address of the video stream; According to the target TCP connection, a target network intrusion detection and analysis thread is determined from a plurality of candidate network intrusion detection and analysis threads.

5. A video stream monitoring device, characterized in that: include: A first acquisition module is used to acquire network card data of a local network card; the network card data includes a video stream, a source Internet Protocol address, and a destination Internet Protocol address of the video stream acquired from a target streaming media server; a first determining module, configured to determine a target network intrusion detection and analysis thread from a plurality of candidate network intrusion detection and analysis threads based on a source Internet Protocol address and a destination Internet Protocol address of the video stream; each of the candidate network intrusion detection and analysis threads carries a matching relationship with a corresponding source Internet Protocol address and a destination Internet Protocol address; A second acquisition module is used to obtain the analysis result of the target network intrusion detection analysis thread; the analysis result includes the source port information and destination port information of the video stream; A second determination module is configured to determine a target media data analysis thread from a plurality of candidate media data analysis threads based on the source port information and the destination port information of the video stream; each candidate media data analysis thread carries corresponding source port information and destination port information; a processing module configured to obtain media monitoring data of the video stream according to the target media data analysis thread, and if the media monitoring data of the video stream indicates that certain media indicators are abnormal, send the abnormal media indicators and alarm prompts to the display platform for display; The device further includes an adding module, wherein the adding module includes: A pulling unit, configured to pull the video stream from the target streaming media server through a stream pulling module; An adding unit, configured to add a unique identifier to the pulled video stream; The sending unit is used to send the video stream with the unique identifier added to the network port of the local network card.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are executed.

Images