Data stream table analysis method and device, electronic equipment and storage medium

Abstract

The application provides a data flow table analysis method and device, electronic equipment and a storage medium, wherein the method comprises: obtaining an association analysis expression, the association analysis expression being used to represent an association relationship between different to-be-analyzed flow tables, the to-be-analyzed flow tables storing data flows; parsing the association analysis expression into an abstract syntax tree, wherein the abstract syntax tree comprises a flow table definition node corresponding to the to-be-analyzed flow table, and the flow table definition node comprises information used to define a type of the to-be-analyzed flow table; and determining a type corresponding to the to-be-analyzed flow table based on the flow table definition node. The flow table type of the flow table in which the data flow is located can be quickly and accurately determined, thereby laying a foundation for security analysis on data flows originating from different flow table types.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a data flow table analysis method, apparatus, electronic device, and storage medium. Background Technology

[0002] The rapid development of internet technology and the deepening digital transformation of various industries have brought tremendous convenience to people's lives and work. However, with the development of technology and the spread of knowledge, the methods and number of cyberattacks have also increased significantly, with various new attack methods emerging one after another, posing great challenges and pressure to security analysts and products.

[0003] In related technologies, when performing network security analysis on data streams, the first step is to determine the flow table type of the flow table containing the data stream. Currently, finding a method to quickly and accurately determine the flow table type of a data stream has become a hot research topic. Summary of the Invention

[0004] This invention provides a data flow table analysis method, apparatus, electronic device, and storage medium, which enables the rapid and accurate determination of the flow table type of a data flow, thereby laying the foundation for security analysis of data flows originating from different flow table types.

[0005] This invention provides a data flow table analysis method, the method comprising: obtaining an association analysis expression, the association analysis expression being used to characterize the association relationship between different flow tables to be analyzed, the flow tables to be analyzed storing data flows; parsing the association analysis expression into an abstract syntax tree, wherein the abstract syntax tree includes flow table definition nodes corresponding to the flow tables to be analyzed, the flow table definition nodes including information for defining the type of the flow tables to be analyzed; and determining the type corresponding to the flow tables to be analyzed based on the flow table definition nodes.

[0006] According to the data flow table analysis method provided by the present invention, the flow table definition node includes data flow identifiers that correspond one-to-one with the flow table to be analyzed; before determining the type corresponding to the flow table to be analyzed based on the flow table definition node, the method further includes: determining the number of data flow identifiers included in the flow table definition node in the abstract syntax tree; determining the type corresponding to the flow table to be analyzed based on the flow table definition node includes: determining the number of flow tables to be analyzed based on the number of data flow identifiers in the flow table definition node; and determining the type corresponding to the flow table to be analyzed based on the number of flow tables to be analyzed and the data flow identifiers.

[0007] According to the data flow table analysis method provided by the present invention, after determining the number of flow tables to be analyzed, the method further includes: adding the number of flow tables to be analyzed to the flow table manager.

[0008] According to the data flow table analysis method provided by the present invention, the step of determining the type of the flow table to be analyzed based on the number of flow tables to be analyzed and the data flow identifier specifically includes: determining whether the number of flow tables to be analyzed is greater than 2; if the number of flow tables to be analyzed is greater than 2, obtaining a set of data flow identifiers corresponding to each flow table to be analyzed; if the intersection of all sets of data flow identifiers is determined to be empty, determining that the type of the flow table to be analyzed is a multi-flow table type.

[0009] According to the data flow table analysis method provided by the present invention, after obtaining the set of data flow identifiers corresponding to each flow table to be analyzed, the method further includes: if it is determined that the intersection of any two sets of data flow identifiers is not empty, initiating an alarm reminder that the definition of the flow table to be analyzed has a syntax error.

[0010] According to the data flow table analysis method provided by the present invention, after determining that the number of flow tables to be analyzed is not greater than 2, the method further includes: when the number of flow tables to be analyzed is equal to 2, obtaining a set of data flow identifiers corresponding to each flow table to be analyzed; when determining that the intersection of two sets of data flow identifiers is empty, determining that the type of the flow table to be analyzed is a dual flow table type.

[0011] According to the data flow table analysis method provided by the present invention, after determining that the intersection of the two sets of data flow identifiers is not empty, the method further includes: if the intersection of the two sets of data flow identifiers is completely identical, determining that the type of the flow table to be analyzed is a single flow table type.

[0012] According to the data flow table analysis method provided by the present invention, after determining that the intersection of the two sets of data flow identifiers is not empty, the method further includes: if the intersection of the two sets of data flow identifiers is not completely identical, initiating an alarm reminder that the definition of the flow table to be analyzed has a syntax error.

[0013] The present invention also provides a data flow table analysis device, the device comprising: a first module for acquiring an association analysis expression, the association analysis expression being used to characterize the association relationship between different flow tables to be analyzed, the flow tables to be analyzed storing data flows; a second module for parsing the association analysis expression into an abstract syntax tree, wherein the abstract syntax tree includes flow table definition nodes corresponding to the flow tables to be analyzed, the flow table definition nodes including information for defining the type of the flow tables to be analyzed; and a third module for determining the type corresponding to the flow tables to be analyzed based on the flow table definition nodes.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the data flow table analysis method as described above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data flow table analysis method as described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the data flow table analysis method as described above.

[0017] The data flow table analysis method, apparatus, electronic device, and storage medium provided by this invention parse the association analysis expression into an abstract syntax tree that includes flow table definition nodes corresponding to the flow table to be analyzed; then, based on the flow table definition nodes, the type of the flow table to be analyzed is determined, thereby quickly and accurately determining the flow table type of the flow table where the data flow is located, thus laying the foundation for security analysis of data flows originating from different flow table types. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts illustrating the data flow table analysis method provided by the present invention;

[0020] Figure 2 This is the second flowchart of the data flow table analysis method provided by the present invention;

[0021] Figure 3 This is a schematic diagram illustrating an application scenario of the flow table analyzer provided by the present invention;

[0022] Figure 4 This is a flowchart illustrating the flow table analysis of the association analysis expression provided by the present invention;

[0023] Figure 5 This is a schematic diagram of the data flow table analysis device provided by the present invention;

[0024] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without any creative efforts shall fall within the scope of protection of the present invention.

[0026] Figure 1 It is one of the schematic flowcharts of the data flow table analysis method provided by the present invention.

[0027] To further introduce the data flow table analysis method provided by the present invention, the following will be combined with Figure 1 for illustration.

[0028] In an exemplary embodiment of the present invention, in combination with Figure 1 as shown, the data flow table analysis method may include steps 110 to step 130. Each step will be introduced separately below.

[0029] In step 110, an association analysis expression is obtained. The association analysis expression is used to characterize the association relationship between different to-be-analyzed flow tables, and the to-be-analyzed flow tables store data streams.

[0030] In an example, the data stream may include network behavior data. It can be understood that the data stream may be a data stream that requires network behavior analysis. During application, by analyzing the flow table type of the data stream, a foundation can be laid for security analysis of data streams from different flow table types.

[0031] In one embodiment, the structure of the association analysis expression may include two parts: the flow table definition and the association expression definition. Among them, the flow table definition can be expressed as [input stream name] as [flow table name]. In an example, stream1 as table1, stream2 as table2, where stream1 and stream2 respectively correspond to the naming of two different input data streams, and left and right are the corresponding associated flow table names. stream1 is defined as table1, and stream2 is defined as table2. The association expression can be a Boolean expression, and the expression result is true or false. The example is as follows: table1.sip == table2.sip and table1.sport < table2.sport. The semantics of the expression is that the expression is true when the source ip of table1 is equal to the sip of table2 and the source port of table1 is less than that of table2, otherwise it is false.

[0032] In another example, the complete association analysis expression is defined as `join[stream table definition]if[association expression definition]`, as shown below: `join stream1 as table1,stream2 as table2 if table1.sip == table2.sip and table1.sport` <table2.sport。

[0033] It should be noted that the data stream identifier can correspond to the input stream name.

[0034] In step 120, the association analysis expression is parsed into an abstract syntax tree.

[0035] The abstract syntax tree includes flow table definition nodes corresponding to the flow table to be analyzed, and the flow table definition nodes include information used to define the type of the flow table to be analyzed.

[0036] In one embodiment, the association analysis expression `join[flow table definition]if[association expression definition]` can be obtained. Then, based on the lexical definition, the association analysis expression is lexically parsed to generate a word sequence, and based on the grammatical definition, the word sequence is parsed to construct an abstract syntax tree (AST). Further, based on semantic and contextual definitions, the AST is subjected to semantic analysis, type checking, and function call validity verification. When the AST meets the corresponding conditions, the final constructed AST can be output. It is understood that the final output AST is a syntax tree about the association analysis expression, and it includes multiple nodes. Further, the AST also includes flow table definition nodes corresponding to the flow table to be analyzed.

[0037] In step 130, the type of the flow table to be analyzed is determined based on the flow table definition node.

[0038] In one embodiment, the type of each flow table to be analyzed can be determined based on the flow table definition node. The type of the flow table can be a single flow table type, a dual flow table type, or a multi-flow table type.

[0039] In this embodiment, the association analysis expression is transformed into an abstract syntax tree, which makes it easier for users to quickly and accurately determine the flow table definition node. Then, based on the flow table definition node, the type of each flow table to be analyzed can be determined. This allows for the quick and accurate determination of the flow table type of the flow table where the data flow is located, thus laying the foundation for security analysis of data flows originating from different flow table types.

[0040] The data flow table analysis method, apparatus, electronic device, and storage medium provided by this invention parse the association analysis expression into an abstract syntax tree that includes flow table definition nodes corresponding to the flow table to be analyzed; then, based on the flow table definition nodes, the type of the flow table to be analyzed is determined, thereby quickly and accurately determining the flow table type of the flow table where the data flow is located, thus laying the foundation for security analysis of data flows originating from different flow table types.

[0041] In yet another exemplary embodiment of the present invention, the flow table definition node may include a data flow identifier that corresponds one-to-one with the flow table to be analyzed.

[0042] To further illustrate the data flow table analysis method provided by this invention, the following will describe the process of the data flow table analysis method, which includes a data flow identifier corresponding to a one-to-one flow table to be analyzed, in conjunction with the following embodiments.

[0043] Figure 2 This is the second flowchart of the data flow table analysis method provided by the present invention.

[0044] In an exemplary embodiment of the present invention, the data flow table analysis method may further include steps 210 to 250, wherein steps 210 to 220 are the same as or similar to steps 110 to 120, and their specific implementation and beneficial effects are described above. They will not be repeated in this embodiment. Steps 230 to 250 will be described below.

[0045] In step 230, the number of data flow identifiers included in the flow table definition node in the abstract syntax tree is determined.

[0046] In step 240, the number of flow tables to be analyzed is determined based on the number of data flow identifiers in the flow table definition node.

[0047] In one embodiment, the number of data flow identifiers included in a flow table definition node can be quickly determined based on the abstract syntax tree. Furthermore, based on the number of data flow identifiers in the flow table definition node, the number of flow tables to be analyzed is determined, thus laying the foundation for determining the type of each flow table to be analyzed based on the number of flow tables to be analyzed and the data flow identifiers.

[0048] In step 250, the type of the flow table to be analyzed is determined based on the number of flow tables to be analyzed and the data flow identifier.

[0049] In an exemplary embodiment of the present invention, the type of the flow table to be analyzed is determined based on the number of flow tables to be analyzed and the data flow identifier. This can be achieved in the following way:

[0050] Determine if the number of flow tables to be analyzed is greater than 2;

[0051] If the number of flow tables to be analyzed is greater than 2, obtain the set of data flow identifiers corresponding to each flow table to be analyzed;

[0052] If the intersection of the sets of all data flow identifiers is found to be empty, the type of the flow table to be analyzed is determined to be a multi-flow table type.

[0053] In yet another exemplary embodiment of the present invention, continuing with Figure 2 The above embodiment is used as an example for illustration. After determining the number of flow tables to be analyzed, the data flow table analysis method may further include:

[0054] Add the number of flow tables to be analyzed to the flow table manager.

[0055] The flow table manager can also store a set of input flow names corresponding to a table, using the table name as the key.

[0056] In another embodiment, the number of flow tables to be analyzed stored in the flow table manager can be determined. When it is determined that the number of flow tables to be analyzed stored in the flow table manager is greater than 2, the set of data flow identifiers corresponding to each flow table to be analyzed can be obtained. When it is determined that the intersection of all sets of data flow identifiers is empty, the type of the flow table to be analyzed can be determined to be a multi-flow table type.

[0057] In one embodiment, input streams can be specified in a scenario with multiple flow table types. Three or more different flow table names can be defined, where the input streams of these flow tables can be completely different. In one example, `stream1 as table1, stream2 as table1, stream3 as table1, stream4 as table2, stream5 as table3, stream6 as table4`. In this example, three flow tables, `table1`, `table2`, and `table3`, are defined. The input streams corresponding to `table1` are [stream1, stream2, stream3], the input stream corresponding to `table2` is [stream4], and the input streams corresponding to `table3` are [stream5, stream6]. The input streams (corresponding data stream identifiers) of `table1`, `table2`, and `table3` are completely different.

[0058] In yet another exemplary embodiment of the present invention, continuing with the examples described above, after obtaining the set of data flow identifiers corresponding to each flow table to be analyzed, the data flow table analysis method further includes:

[0059] If it is determined that the intersection of any two sets of data flow identifiers is not empty, an alert is issued indicating that there is a syntax error in the definition of the flow table to be analyzed.

[0060] In one embodiment, if the number of flow tables to be analyzed is greater than two, and it is determined that the intersection of any two sets of data flow identifiers is not empty, it indicates that multiple flow tables to be analyzed share the same situation. Therefore, this contradicts the concept of multiple data flow tables; in other words, the definition of the flow tables to be analyzed contains a syntax error. During application, an alert can be issued regarding the syntax error in the definition of the flow tables to be analyzed for user reference.

[0061] In an exemplary embodiment of the present invention, after determining that the number of flow tables to be analyzed is no greater than 2, the data flow table analysis method may further include the following steps:

[0062] When the number of flow tables to be analyzed is equal to 2, obtain the set of data flow identifiers corresponding to each flow table to be analyzed;

[0063] If the intersection of the sets of two data flow identifiers is determined to be empty, the type of the flow table to be analyzed is determined to be a dual flow table type.

[0064] In one embodiment, if it is determined that the number of flow tables to be analyzed is no greater than 2, and further determined that the number of flow tables to be analyzed is equal to 2, then a set of data flow identifiers corresponding to each flow table to be analyzed can be obtained. If it is determined that the intersection of the two sets of data flow identifiers is empty, then the type of the flow table to be analyzed can be determined to be a dual flow table type.

[0065] In one embodiment, in a dual-flow-table scenario, input streams can be specified, and two different flow table names (corresponding to data stream identifiers) can be defined, where the input streams of the two flow tables must be completely different. In one example, `stream1 as table1, stream2 as table1, stream3 as table1, stream4 as table2, stream5 as table`. In this example, two flow tables, `table1` and `table2`, are defined. The input streams corresponding to `table1` are [stream1, stream2, stream3], and the input streams corresponding to `table2` are [stream4, stream5]. The input streams of `table1` and `table2` are completely different.

[0066] In yet another exemplary embodiment of the present invention, after determining that the intersection of the sets of two data stream identifiers is not empty, the data stream analysis method further includes:

[0067] If the intersection of the sets of two data flow identifiers is completely identical, the type of the flow table to be analyzed is determined to be a single flow table type.

[0068] In one embodiment, when the number of flow tables to be analyzed is equal to 2, if it is determined that the intersection of the sets of two data flow identifiers is exactly the same, then it can be determined that the two flow tables to be analyzed are of the single flow table type.

[0069] In one embodiment, a single-stream table type can be divided into two scenarios: specifying input streams and not specifying input streams. In one example, specifying input streams can be represented as stream1 as table1, stream2 as table1, ..., streamN as table1, stream1 as table2, stream2 as table2, ..., streamN as table2. In the scenario of specifying input streams, only two different stream table names can be defined, and the input streams of the two stream tables must be the same. In the example above, the input stream sets corresponding to table1 and table2 are the same, both being stream1, stream2, ..., streamN.

[0070] In scenarios where no input stream is specified, the input stream will be divided into a predefined left (left table) and right (right table) by default.

[0071] In yet another exemplary embodiment of the present invention, after determining that the intersection of the sets of two data flow identifiers is not empty, the data flow table analysis method further includes:

[0072] If the intersection of the sets of two data flow identifiers is not completely identical, an alert is issued indicating a syntax error in the definition of the flow table to be analyzed.

[0073] In one embodiment, when the number of flow tables to be analyzed is equal to two, after determining that the intersection of the sets of two data flow identifiers is not empty, it indicates that the two data flow tables to be analyzed are not of the dual-flow table type. Furthermore, if it is determined that the intersection of the sets of two data flow identifiers is not completely identical (or, partially identical), it indicates that the two data flow tables to be analyzed are not of the single-flow table type either, suggesting a syntax error in the definition of the flow table to be analyzed. During application, an alert can be issued regarding syntax errors in the definition of the flow table to be analyzed for user reference.

[0074] In yet another exemplary embodiment of the present invention, the data flow table analysis method provided by the present invention can also be executed by a flow table analyzer to determine the type of the flow table.

[0075] Figure 3 This is a schematic diagram illustrating an application scenario of the flow table analyzer provided by the present invention.

[0076] In an exemplary embodiment of the present invention, combined with Figure 3As can be seen, the application scenarios of the flow table analyzer can include steps 301 to 312, and each step will be described below.

[0077] In step 301, the input flow table manager is entered.

[0078] In one embodiment, the flow table manager can be represented as a tableManager. The flow table manager stores a set of input flow names corresponding to a table, using the table name as the key.

[0079] In step 302, it is determined whether the number of tables in the flow table manager is less than 2.

[0080] In step 303, if the number is not less than 2, it is determined whether the number of tables in the flow table manager is equal to 2.

[0081] In step 304, if the quantity is less than 2, the process exits and returns a flow table definition syntax error.

[0082] In one embodiment, the number of flow tables to be analyzed can be added to the flow table manager. Further, the type of each flow table to be analyzed is determined based on the number of flow tables and the data flow identifier.

[0083] In one example, determine the flow table manager. <tablemanager>If the number of tables (corresponding to the number of flow tables to be analyzed) is less than 2, it indicates that the process input is incorrect, and the process will be exited and returned as a flow table definition syntax error.

[0084] In yet another example, when the quantity flow table manager is determined... <tablemanager>If the number of tables in the flow table manager is not less than 2, it can be further determined whether the number of tables in the flow table manager is equal to 2.

[0085] In step 305, when the quantity is not equal to 2, it is determined whether the intersection of each pair of the input flow table name sets corresponding to all flow tables is empty.

[0086] In step 306, when the quantity is equal to 2, it is determined whether the intersection of the corresponding input flow name sets of the two flow tables is empty.

[0087] In step 307, when the intersection of all pairs of the input flow table name sets corresponding to all flow tables is empty, the process exits and returns a flow table definition syntax error.

[0088] In step 308, when the intersection of all pairs of input flow table name sets corresponding to all flow tables is empty, the process exits and returns to multi-flow table.

[0089] In one embodiment, when it is determined that the number of tables in the flow table manager is not equal to 2, it can be further determined whether the intersection of each pair of the input flow table name sets corresponding to all flow tables is empty. If the intersection of each pair of the input flow table name sets corresponding to all flow tables is not empty, the process exits and returns a flow table definition syntax error; if the intersection of each pair of the input flow table name sets corresponding to all flow tables is empty, the process exits and returns a multi-flow table.

[0090] In another instance, when it is determined that the number of tables in the flow table manager is not equal to 2, it can be further determined whether the intersection of the corresponding input flow name sets of the two flow tables is empty.

[0091] In step 309, when the intersection of the sets of input flow names corresponding to the two flow tables is empty, the process exits and returns to the dual flow table.

[0092] In step 310, if the intersection of the corresponding input stream name sets of the two flow tables is not empty, it is determined that the intersection of the corresponding input stream name sets of the two flow tables is completely identical.

[0093] In step 311, when the intersection of the input flow name sets corresponding to the two flow tables is exactly the same, the process exits and returns to a single flow table.

[0094] In step 312, if the intersection of the input flow name sets corresponding to the two flow tables is not completely identical, the process exits and returns a flow table definition syntax error.

[0095] In one example, if the intersection of the input stream name sets corresponding to the two flow tables is found to be empty, the process can exit and return to a dual flow table. In another example, if the intersection of the input stream name sets corresponding to the two flow tables is not found to be empty, it can be further determined that the intersection of the input stream name sets corresponding to the two flow tables is exactly the same. When the intersection of the input stream name sets corresponding to the two flow tables is exactly the same, the process can exit and return to a single flow table; when the intersection of the input stream name sets corresponding to the two flow tables is not exactly the same, the process can exit and return to a flow table definition syntax error.

[0096] Figure 4 This is a flowchart illustrating the flow table analysis of the association analysis expression provided by the present invention.

[0097] The following will combine Figure 4 The process of analyzing flow tables in relational analysis expressions is explained.

[0098] In an exemplary embodiment of the present invention, combined with Figure 4 As can be seen, the association analysis expression flow table analysis may include steps 410 to 480, and each step will be described below.

[0099] In step 410, input the association analysis expression.

[0100] In step 420, the association analysis expression is parsed into an abstract syntax tree, and the syntax tree node where the flow table definition is located is located.

[0101] In one embodiment, the association analysis expression `join[flow table definition]if[association expression definition]` can be entered. Further, the association analysis expression can be parsed into an abstract syntax tree, and the syntax tree node containing `[flow table definition]` can be located.

[0102] In step 430, it is determined whether the flow table definition syntax tree node has child nodes.

[0103] In step 440, if there are child nodes, then traverse all child nodes of the syntax tree node defined in the flow table.

[0104] In step 450, if there are no child nodes, the left built-in flow table name and the empty flow table name set are added to the table manager, and the right built-in flow table name and the empty flow table name set are added to the table manager.

[0105] In step 460, it is determined whether the flow table definition syntax tree node still has any child nodes that have not been traversed.

[0106] In step 470, if there are still untraversed child nodes, the input stream name and stream table name structure is parsed, and the stream table name and the corresponding input stream name are added to the table manager.

[0107] In step 480, if there are no untraversed child nodes, the flow table analyzer is invoked to analyze the table manager and output the results.

[0108] In one embodiment, it can be determined whether the [flow table definition] syntax tree node has child nodes. If it does, the step of traversing all child nodes of the flow table definition syntax tree node is performed. If it has no child nodes, the built-in flow table name `left` and the set of empty flow table names are added to the table manager. <tablemanager>In the middle, add the built-in flow table name "right" and the empty flow table name set to the table manager. <tablemanager>After completion, the flow table analyzer will be called to analyze... <tablemanger>Perform analysis and output results (corresponding) Figure 3 (The described embodiment).

[0109] In one embodiment, after performing the step of traversing all child nodes of the stream table definition syntax tree node if any, it can be determined whether the [stream table definition] syntax tree node still has any child nodes that have been traversed. If so, the [input stream name] as [stream table name] structure is parsed, and the [stream table name] and the corresponding [input stream name] are added to the table manager. <tablemanager>In the middle, after completion, the step of judging whether the [flow table definition] syntax tree node still has untraversed child nodes will continue to be executed until all child nodes have been traversed.

[0110] In another embodiment, if the [flow table definition] syntax tree node does not have any untraversed child nodes, then the flow table analyzer can be invoked to... <tablemanger>Perform analysis and output results (corresponding) Figure 3 (The described embodiment).

[0111] As described above, the data flow table analysis method provided by this invention parses the association analysis expression into an abstract syntax tree that includes flow table definition nodes corresponding to the flow table to be analyzed; then, based on the flow table definition nodes, it determines the type of the flow table to be analyzed, thereby quickly and accurately determining the flow table type of the flow table where the data flow is located, thus laying the foundation for security analysis of flow data flows originating from different flow table types.

[0112] The data flow table analysis apparatus provided by the present invention is described below. The data flow table analysis apparatus described below can be referred to in correspondence with the data flow table analysis method described above.

[0113] Figure 5 This is a schematic diagram of the data flow table analysis device provided by the present invention.

[0114] In an exemplary embodiment of the present invention, combined with Figure 5 As can be seen, the data flow table analysis device may include the first module 510 to the third module 530, and each module will be described below.

[0115] The first module 510 can be configured to obtain association analysis expressions, which are used to characterize the association relationships between different flow tables to be analyzed, and the flow tables to be analyzed store data streams.

[0116] The second module 520 can be configured to parse association analysis expressions into abstract syntax trees, wherein the abstract syntax tree includes flow table definition nodes corresponding to the flow table to be analyzed, and the flow table definition nodes include information for defining the type of the flow table to be analyzed;

[0117] The third module 530 can be configured to determine the type of the flow table to be analyzed based on the flow table definition node.

[0118] In an exemplary embodiment of the present invention, the flow table definition node may include a data flow identifier that corresponds one-to-one with the flow table to be analyzed;

[0119] The third module 530 can also be configured to:

[0120] Determine the number of data flow identifiers included in the flow table definition nodes in the abstract syntax tree;

[0121] The third module 530 can determine the type of the flow table to be analyzed by defining nodes based on the flow table:

[0122] The number of flow tables to be analyzed is determined based on the number of data flow identifiers in the flow table definition node.

[0123] Based on the number of flow tables to be analyzed and the data flow identifier, the type of the flow table to be analyzed is determined.

[0124] In an exemplary embodiment of the present invention, the third module 530 may further be configured to:

[0125] Add the number of flow tables to be analyzed to the flow table manager.

[0126] In an exemplary embodiment of the present invention, the third module 530 can determine the type of the flow table to be analyzed based on the number of flow tables to be analyzed and the data flow identifier in the following manner:

[0127] Determine if the number of flow tables to be analyzed is greater than 2;

[0128] If the number of flow tables to be analyzed is greater than 2, obtain the set of data flow identifiers corresponding to each flow table to be analyzed;

[0129] If the intersection of the sets of all data flow identifiers is found to be empty, the type of the flow table to be analyzed is determined to be a multi-flow table type.

[0130] In an exemplary embodiment of the present invention, the third module 530 may further be configured to:

[0131] If it is determined that the intersection of any two sets of data flow identifiers is not empty, an alert is issued indicating that there is a syntax error in the definition of the flow table to be analyzed.

[0132] In an exemplary embodiment of the present invention, the third module 530 may further be configured to:

[0133] When the number of flow tables to be analyzed is equal to 2, obtain the set of data flow identifiers corresponding to each flow table to be analyzed;

[0134] If the intersection of the sets of two data flow identifiers is determined to be empty, the type of the flow table to be analyzed is determined to be a dual flow table type.

[0135] In an exemplary embodiment of the present invention, the third module 530 may further be configured to:

[0136] If the intersection of the sets of two data flow identifiers is completely identical, the type of the flow table to be analyzed is determined to be a single flow table type.

[0137] In an exemplary embodiment of the present invention, the third module 530 may further be configured to:

[0138] If the intersection of the sets of two data flow identifiers is not completely identical, an alert is issued indicating a syntax error in the definition of the flow table to be analyzed.

[0139] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, communications interface 620, and memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a data flow table analysis method. This method includes: obtaining an association analysis expression, which characterizes the association relationship between different flow tables to be analyzed, wherein the flow tables to be analyzed store data flows; parsing the association analysis expression into an abstract syntax tree, wherein the abstract syntax tree includes flow table definition nodes corresponding to the flow tables to be analyzed, and the flow table definition nodes include information for defining the type of the flow tables to be analyzed; and determining the type corresponding to the flow tables to be analyzed based on the flow table definition nodes.

[0140] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data flow table analysis method provided by the above methods. The method includes: obtaining an association analysis expression, which is used to characterize the association relationship between different flow tables to be analyzed, wherein the flow tables to be analyzed store data flows; parsing the association analysis expression into an abstract syntax tree, wherein the abstract syntax tree includes flow table definition nodes corresponding to the flow tables to be analyzed, and the flow table definition nodes include information for defining the type of the flow tables to be analyzed; and determining the type corresponding to the flow tables to be analyzed based on the flow table definition nodes.

[0142] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the data flow table analysis method provided by the above methods. The method includes: obtaining an association analysis expression, the association analysis expression being used to characterize the association relationship between different flow tables to be analyzed, the flow tables to be analyzed storing data flows; parsing the association analysis expression into an abstract syntax tree, wherein the abstract syntax tree includes flow table definition nodes corresponding to the flow tables to be analyzed, the flow table definition nodes including information for defining the type of the flow tables to be analyzed; and determining the type corresponding to the flow tables to be analyzed based on the flow table definition nodes.

[0143] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0144] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0145] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.< / tablemanger> < / tablemanager> < / tablemanger> < / tablemanager> < / tablemanager> < / tablemanager> < / tablemanager>

Claims

1. A data flow table analysis method, characterized in that, The method includes: Obtain the association analysis expression, which is used to characterize the association relationship between different flow tables to be analyzed, and the flow tables to be analyzed store data streams; The association analysis expression is parsed into an abstract syntax tree, wherein the abstract syntax tree includes a flow table definition node corresponding to the flow table to be analyzed, and the flow table definition node includes information for defining the type of the flow table to be analyzed; Based on the flow table definition node, the type of the flow table to be analyzed is determined, wherein the flow table definition node includes a data flow identifier that corresponds one-to-one with the flow table to be analyzed; Before determining the type of the flow table to be analyzed based on the flow table definition node, the method further includes: Determine the number of data flow identifiers included in the flow table definition node in the abstract syntax tree; The step of determining the type of the flow table to be analyzed based on the flow table definition node includes: The number of flow tables to be analyzed is determined based on the number of data flow identifiers in the flow table definition node. Based on the number of flow tables to be analyzed and the set of data flow identifiers, the type corresponding to the flow table to be analyzed is determined.

2. The data flow table analysis method according to claim 1, characterized in that, After determining the number of flow tables to be analyzed, the method further includes: Add the number of flow tables to be analyzed to the flow table manager.

3. The data flow table analysis method according to any one of claims 1 or 2, characterized in that, The step of determining the type of the flow table to be analyzed based on the number of flow tables to be analyzed and the data flow identifier specifically includes: Determine whether the number of flow tables to be analyzed is greater than 2; If the number of flow tables to be analyzed is greater than 2, obtain a set of data flow identifiers corresponding to each flow table to be analyzed; If the intersection of the sets of all the data flow identifiers is determined to be empty, the type of the flow table to be analyzed is determined to be a multi-flow table type.

4. The data flow table analysis method according to claim 3, characterized in that, After obtaining the set of data flow identifiers corresponding to each of the flow tables to be analyzed, the method further includes: If it is determined that the intersection of any two sets of the data flow identifiers is not empty, an alert is issued indicating that the definition of the flow table to be analyzed contains a syntax error.

5. The data flow table analysis method according to claim 3, characterized in that, After determining that the number of flow tables to be analyzed is no greater than 2, the method further includes: When the number of flow tables to be analyzed is equal to 2, obtain the set of data flow identifiers corresponding to each flow table to be analyzed; If the intersection of the two sets of data flow identifiers is determined to be empty, the type of the flow table to be analyzed is determined to be a dual flow table type.

6. The data flow table analysis method according to claim 5, characterized in that, After determining that the intersection of the two sets of data stream identifiers is not empty, the method further includes: If the intersection of the two sets of data flow identifiers is completely identical, the type of the flow table to be analyzed is determined to be a single flow table type.

7. The data flow table analysis method according to claim 5, characterized in that, After determining that the intersection of the two sets of data stream identifiers is not empty, the method further includes: If the intersection of the two sets of data flow identifiers is not completely identical, an alert is issued indicating a syntax error in the definition of the flow table to be analyzed.

8. A data flow table analysis device, characterized in that, The apparatus is used to implement the data flow table analysis method according to any one of claims 1 to 7, and the apparatus comprises: The first module is used to obtain association analysis expressions, which are used to characterize the association relationships between different flow tables to be analyzed, and the flow tables to be analyzed store data streams. The second module is used to parse the association analysis expression into an abstract syntax tree, wherein the abstract syntax tree includes a flow table definition node corresponding to the flow table to be analyzed, and the flow table definition node includes information for defining the type of the flow table to be analyzed; The third module is used to determine the type of the flow table to be analyzed based on the flow table definition node.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the data flow table analysis method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the data flow table analysis method as described in any one of claims 1 to 7.

Images