A data analysis method, device and electronic equipment

Abstract

The embodiment of the application discloses a data analysis method and device and electronic equipment, relates to the computer technical field, can effectively parse and extract the query result set corresponding to the response message from the DB2 database, can perform perfect auditing on the DB2 database, and thus the safety of the DB2 database can be ensured, and the specific scheme is as follows: according to the source port number of a data packet, a response message of a database is identified, the response message comprises a message header and a message data area; according to a preset protocol, the message header is parsed to determine the length and type of the response message; according to the length and type of the response message, the message data area is parsed to obtain the query result set corresponding to the response message; and the query result set corresponding to the response message is output.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer. More particularly, relate to a data analysis method and device and electronic equipment. BACKGROUND

[0002] With the development of network and computer technology, people in the production activities of various data, these data are often stored in the database. Therefore, the security of the database is particularly important. At present, mainly through the audit (and risk control) of the database content to ensure the security of the database.

[0003] And to achieve the audit of the database, it is necessary to extract various operation instructions and content according to the database communication protocol, capture and analyze the message between the client and the server. For some open source database (for example, MYSQL), its communication protocol is public, and the decoding method can be obtained from the source code. For most commercial non-open source databases, their communication protocol and decoding method are not disclosed. Therefore, the response of the request cannot be effectively parsed, so that the database cannot be audited perfectly, and the security of the database cannot be guaranteed. SUMMARY

[0004] In view of the above problems, embodiments of the present application provide a data analysis method, device and electronic equipment, which can effectively parse the response of the request, so as to solve the problem that the database cannot be audited perfectly, and the security of the database cannot be guaranteed.

[0005] In a first aspect, the present application provides a data analysis method, which can include: identifying the response message of the database according to the source port number of the data packet, the response message including the message header and the message data area; parsing the message header according to the preset protocol, determining the length and type of the response message; parsing the message data area according to the length and type of the response message, obtaining the query result set corresponding to the response message; outputting the query result set corresponding to the response message.

[0006] In combination with the first aspect, in an optional manner, parsing the response message header according to the preset protocol to determine the type of the response message can include: parsing the format of the message header according to the preset protocol, verifying whether the response message is a DB2 response message; in the case of verifying the DB2 response message, determining the type of the response message according to the preset protocol.

[0007] In combination with the first aspect, in an optional manner, the preset protocol can include the DRDA protocol.

[0008] In combination with the first aspect, in an optional manner, the parsing of the message data area according to the length and type of the response message to obtain the query result set corresponding to the response message can include: parsing the message data area according to the type of the response message to obtain the number of columns of the message data area, the length of each column, the type of each column, and the name of each column; and parsing the message data area according to the type of the response message, the length of the response message, and the type of each column to obtain the query result set corresponding to the response message.

[0009] In combination with the first aspect, in an optional manner, the parsing of the message data area according to the type of the response message to obtain the number of columns of the message data area, the length of each column, the type of each column, and the name of each column can include: obtaining the value of a first preset byte to determine the number of columns of the message data area according to the type of the response message; determining the type of the first column of the response message data area according to the value of a second preset byte, the second preset byte being offset 14 bytes from the first preset byte; determining the column name length of the first column according to the value of a third preset byte, the third preset byte being offset 18 bytes from the second preset byte; determining the column name of the first column according to the value of a fourth preset byte, the fourth preset byte being offset 1 byte from the third preset byte; and determining the type, column name length, and column name of other columns after the first column according to a column separator and a fifth preset byte, the fifth preset byte being offset 13 bytes from the column separator.

[0010] In combination with the first aspect, in an optional manner, the parsing of the message data area according to the type of the response message, the type of each column, and the column data type of the response message to obtain the query result set corresponding to the response message can include: determining the initial position of the first row of the message data area according to the type of the response message; and parsing all rows from the initial position of the first row to obtain the query result set corresponding to the response message according to the length of the response message and the type of each column.

[0011] In combination with the first aspect, in an optional manner, the parsing of the message data area according to the type of the response message, the type of each column, and the column data type of the response message to obtain the query result set corresponding to the response message can include: parsing the first column data from the initial position of the first row to obtain the query result set corresponding to the response message of the first column of the first row according to the type of the first column; parsing the column data of other columns of the first row after the first column of the first row to obtain the query result set corresponding to the response message of the other columns of the first row according to the column separator between rows; and determining the response result set corresponding to the response message of other rows after the first row according to the row separator and the length of the response message.

[0012] The second aspect also provides a data parsing device, which can include an identification module, a determination module, a parsing module, and an output module.

[0013] The identification module can be configured to identify the response message of the database according to the source port number of the data packet, and the response message can include a message header and a message data area.

[0014] The determination module can be configured to parse the response message header according to a preset protocol, and determine the type of the response message.

[0015] The parsing module can be configured to parse the message data area according to the type of the response message data, and obtain a query result set corresponding to the response message data.

[0016] The output module can be configured to output the query result set corresponding to the response message.

[0017] In a third aspect, an electronic device is provided, including a processor and a memory storing instructions executable by the processor. The processor is configured to execute the instructions to cause the electronic device to implement the data parsing method of the first aspect or the possible implementation manners of the first aspect.

[0018] In a fourth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by an electronic device, the electronic device implements the data parsing method of the first aspect or the possible implementation manners of the first aspect.

[0019] In a fifth aspect, a computer program product is provided, and the computer program product includes computer-readable code. When the computer-readable code is executed in an electronic device, the electronic device implements the data parsing method of the first aspect or the possible implementation manners of the first aspect.

[0020] The scheme provided by the present application first identifies the response message of the database according to the source port number of the data packet, and the response message includes a message header and a message data area. Then, the message header is parsed according to a preset protocol to determine the length and type of the response message. Then, the message data area is parsed according to the length and type of the response message to obtain a query result set corresponding to the response message. Finally, the query result set corresponding to the response message is output. That is, after obtaining the response message exchanged between the database client and the server, the scheme of the present application identifies the response message of the database. The type of the response message can be determined by using the preset protocol, the response message data area is found, and the response message data area is parsed to obtain the query result set corresponding to the response message.

[0021] Therefore, the scheme of the present application can effectively parse and extract the query result set corresponding to the response message from the DB2 database, can perform perfect auditing on the DB2 database, and thus can guarantee the security of the DB2 database.

[0022] The above description is only a summary of the technical solutions of the embodiments of the present application, in order to enable the technical means of the embodiments of the present application to be more clearly understood, and can be implemented according to the content of the specification, and in order to enable the above and other purposes, characteristics and advantages of the embodiments of the present application to be more apparent and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings are included to provide a further understanding of the application, and are incorporated herein and constitute a part of the detailed description. It should be noted that in the accompanying drawings, the same or similar components have the same reference numerals, and repeated description is omitted.

[0024] Figure 1 A hardware structure schematic diagram of an electronic device provided by the embodiments of the present application is shown;

[0025] Figure 2 A flowchart of a data analysis method provided by the present application is shown;

[0026] Figure 3 A flowchart of another data analysis method provided by the present application is shown;

[0027] Figure 4 A structure schematic diagram of a BD2 response message provided by the present application is shown;

[0028] Figure 5 A structure schematic diagram of a DDM header provided by the present application is shown;

[0029] Figure 6 A structure schematic diagram of a data analysis device provided by the present application is shown. DETAILED DESCRIPTION

[0030] Exemplary embodiments of the present application will be described more fully hereinafter with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein.

[0031] The terms "first", "second", etc. are only used for descriptive purposes and should not be construed as indicating or implying relative importance or implying the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, unless otherwise stated, the meaning of "a plurality of" is two or more.

[0032] With the development of network and computer technology, people will generate various data in production activities, and these data are often stored in databases, so the security of the database is particularly important. At present, the security of the database is mainly ensured by auditing (and risk control) the content of the database.

[0033] In order to realize the audit of the database, it is necessary to capture and analyze the response messages between the client and the server according to the database communication protocol, and extract various operation instructions and contents. For some open source databases (for example, MYSQL), the communication protocol is public, and the decoding method can be obtained from the source code. However, for most commercial non-open source databases, the communication protocol and the decoding method are not public. Therefore, the databases cannot be audited perfectly, and the security of the databases cannot be guaranteed.

[0034] The DB2 (database2) database is a non-domestic non-open source large relational database, which can serve different operating system platforms and follow the SQL standard, and has been widely applied in various industries. The DB2 database can include: instance, user, data file, table, table space, mode, role, etc.

[0035] After receiving the query request command, the DB2 database extracts the SQL statement data from the query request command, and then parses the SQL statement data to obtain the query result set corresponding to the SQL statement data. The result set is a collection of running results. For example, after an electronic device receives a database request command, it extracts a SQL statement in the request command, and then runs the SQL statement, which returns a data corresponding to the query statement. If there are multiple SQL statements, multiple query results corresponding to the SQL statements will be returned, and the query results form a collection, which is the query result set.

[0036] However, due to the lack of relevant information, the parsing of the DB2 database can only extract the SQL statement data in the request command, and cannot parse the response (for example, select response) of the request, which cannot audit the content of the database, and cannot guarantee the security of the database.

[0037] In order to solve the above problems, the data parsing method provided by the application first identifies the response message of the database according to the source port number of the data packet, the response message including a message header and a message data area; then parses the message header according to a preset protocol to determine the length and type of the response message; then parses the message data area according to the length and type of the response message to obtain the query result set corresponding to the response message; and finally outputs the query result set corresponding to the response message. That is, after obtaining the response message between the database client and the server, the scheme of the application identifies the response message of the database; the type of the response message is found by using the preset protocol, and then the response message data area is parsed to obtain the query result set corresponding to the response message.

[0038] Therefore, the scheme provided in the application can effectively parse and extract the query result set corresponding to the response message from the DB2 database, can perform perfect auditing on the DB2 database, and thus can guarantee the security of the DB2 database.

[0039] The data parsing method provided in the application is described below.

[0040] The data parsing method provided in the embodiment of the application can be applied to an electronic device. The electronic device can include a processor, a memory, a communication interface, and a communication bus, and the processor, the memory, and the communication interface complete mutual communication through the communication bus. The memory can be used to store at least one executable instruction, and the executable instruction causes the processor to execute the data parsing method provided in the embodiment of the application.

[0041] For example, Figure 1 A structural schematic diagram of an electronic device provided in the embodiment of the application is shown in FIG. 1. As shown in FIG. 1, the electronic device 100 can include at least one processor 101, a communication line 102, a memory 103, and a communication interface 104. Figure 1

[0042] The processor 101 can execute various functions of the electronic device 100 by running or executing a software program stored in the memory 103 and calling data stored in the memory 103.

[0043] In a specific implementation, as an embodiment, the electronic device 100 can include one processor, and can also include multiple processors. Each of the processors can be a single-CPU or a multi-CPU. The processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (for example, computer program instructions).

[0044] ​The memory 103 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium capable of storing desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 103 can exist independently, and is connected to the processor 101 through the communication line 102. The memory 103 can also be integrated with the processor 101.

[0045] The memory 103 can be used to store a software program for implementing the scheme of the present application, and the processor 201 controls the execution.

[0046] The communication interface 104 can be a device using any transceiver, and can be used to communicate with other devices or communication networks.

[0047] The communication line 102 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 1 Only one line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0048] Figure 1 The device structure shown in the figure does not constitute a limitation on the electronic device 100, which can include more or fewer components than shown, or combine certain components, or different component arrangements.

[0049] Figure 2 A flowchart of a data analysis method provided by an embodiment of the present application is shown. As shown in Figure 2 The data analysis method can include S201-S204.

[0050] S201, identifying a response message of the database according to a source port number of the data packet, the response message comprising a message header and a message data area.

[0051] After receiving the query request command, the source port number can be obtained from the transport layer of the response message thereof, and other messages are filtered according to the source port number, so as to identify the response message of the database.

[0052] The response message can comprise the message header and the message data area. The message header can be used to indicate the length, type and code point of the message, and the message data area can be used to store the message data.

[0053] In some embodiments, the response message can be obtained by software or hardware, the response message between the database client and the server on the transmission link of the network card is obtained by listening to the query request, and the response message is stored or recorded, so that the response message can be parsed.

[0054] In some embodiments, different acquisition strategies can be set for obtaining the response message. Different acquisition strategies can filter out corresponding response messages. Different query request commands are sent to different IPs and source ports of the electronic device, and accordingly, the IP and port information are included in the response message. Therefore, the response message to be parsed can be filtered out according to the source port number, so as to obtain the query result set corresponding to the response message.

[0055] In some embodiments, the source port number of the data packet in the present application can be default, that is, the response message corresponding to the database can be identified by the default source port number of the data packet.

[0056] S202, parsing the message header according to a preset protocol to determine the length and type of the response message.

[0057] After identifying the response message of the database, the electronic device can parse the message header in the response message according to a preset protocol to determine the length and type of the response message, so that the query result set corresponding to the response message can be obtained according to the length and type of the response message.

[0058] In some embodiments, parsing the response message header according to the preset protocol to determine the type of the response message can comprise: performing format parsing on the message header according to the preset protocol to verify whether the response message is a DB2 response message; and in the case of verifying that the response message is a DB2 response message, determining the type of the response message according to the preset protocol.

[0059] In some embodiments, the preset protocol can include a distributed relational database architecture (DRDA) protocol.

[0060] S203, according to the length and type of the response message, parsing the message data area to obtain the query result set corresponding to the response message.

[0061] After determining the length and type of the response message, the message data area can be parsed to obtain the query result set corresponding to the response message.

[0062] In some embodiments, according to the length and type of the response message, parsing the message data area to obtain the query result set corresponding to the response message can include: according to the type of the response message, parsing the message data area to obtain the number of columns, the length of each column, the type of each column and the column name; according to the type of the response message, the length of the response message and the type of each column, parsing the message data area to obtain the query result set corresponding to the response message.

[0063] In some embodiments, according to the type of the response message, parsing the message data area to obtain the number of columns, the length of each column, the type of each column and the column name can include: according to the type of the response message, obtaining the value of the first preset byte to determine the number of columns in the message data area; according to the value of the second preset byte, determining the type of the first column in the response message data area, the second preset byte being 14 bytes offset from the first preset byte; according to the value of the third preset byte, determining the column name length of the first column, the third preset byte being 18 bytes offset from the second preset byte; according to the value of the fourth preset byte, determining the column name of the first column, the fourth preset byte being 1 byte offset from the third preset byte; according to the column separator and the fifth preset byte, determining the type, column name length and column name of other columns after the first column, the fifth preset byte being 13 bytes offset from the column separator.

[0064] In some embodiments, according to the type of the response message, the length of the response message and the type of each column, parsing the message data area to obtain the query result set corresponding to the response message can include: according to the type of the response message, determining the initial position of the first row of the message data area; according to the length of the response message and the type of each column, parsing all rows from the initial position of the first row to obtain the query result set corresponding to the response message.

[0065] In some embodiments, the parsing all rows from the initial position of the first row according to the length of the response message and the types of the columns can include: parsing the first column data from the initial position of the first row according to the first column type to obtain the query result set corresponding to the response message of the first column of the first row; and parsing the other column data of the first row after the first column according to the column separator between rows to obtain the query result set corresponding to the response message of the other columns of the first row; and determining the response result set corresponding to the response message of the other rows after the first row according to the row separator and the length of the response message.

[0066] According to the length and type of the response message, the column information of the message data area is acquired first, and then all row information of the message data area is acquired based on the column information, so that the query result set corresponding to the response message of the message data area is effectively parsed.

[0067] S204, output the query result set corresponding to the response message.

[0068] After obtaining the query result set corresponding to the response message, the query result set corresponding to the response message can be output.

[0069] In some embodiments, the query result set corresponding to the response message can be displayed, so that the database content can be audited to ensure the security of the database.

[0070] The scheme of the application first identifies the response message of the database according to the source port number of the data packet, the response message including a message header and a message data area; then parses the message header according to a preset protocol to determine the length and type of the response message; then parses the message data area according to the length and type of the response message to obtain the query result set corresponding to the response message; and finally outputs the query result set corresponding to the response message. That is, after obtaining the response message exchanged between the database client and the server, the scheme of the application identifies the response message of the database; using the preset protocol, the type of the response message is determined to find the response message data area, and then the response message data area is parsed to obtain the query result set corresponding to the response message. Therefore, the scheme of the application can effectively parse and extract the query result set corresponding to the response message from the database, and can perform perfect auditing on the database, so as to ensure the security of the database.

[0071] For ease of understanding, the following will be described in detail with reference to the accompanying drawings. Figure 3 Taking the DRDA protocol as an example, the specific implementation of the data parsing method provided by the application will be described in detail. As shown in FIG. 3, Figure 3 The data parsing method provided by the embodiment of the application can include S301-S313.

[0072] S301, identifying a response message of the DB2 database according to a source port number of the data packet, the response message comprising a message header and a message data area.

[0073] After receiving the query request command, the source port number can be obtained from a transport layer of a response message thereof, and other messages are filtered according to the source port number, so as to identify the response message of the DB2 database.

[0074] The response message can comprise the message header and the message data area. The message header can be used to indicate a length, a type and a code point of the response message, and the message data area can be used to store response message data.

[0075] In an embodiment, the response message can be obtained by using software or hardware, the response message is obtained by listening to the query request on a transmission link of a network card, and the response message is stored or recorded, so that the response message can be parsed.

[0076] In some embodiments, different acquisition strategies can be set for obtaining the response message. Different acquisition strategies can filter out corresponding response messages. Different query request commands are sent to different IPs and source ports of the electronic device, and accordingly, the IP and port information are included in the response message. Therefore, the response message to be parsed in the DB2 database can be filtered out according to the source port number.

[0077] In some embodiments, the source port number of the data packet in the present application can be default, that is, the corresponding response message of the database can be identified by using the default source port number of the data packet.

[0078] In some embodiments, the source port number can be set to 50000. After the query request command is sent to the 50000 source port on the electronic device, the query request command is identified by the source port to obtain the response message of the DB2 database.

[0079] By setting the source port number of the data packet, the response message of the DB2 database can be filtered out, so as to realize parsing of the query result set corresponding to the DB2 response message, which can ensure the accuracy of the parsing.

[0080] It should be noted that S301 in the present embodiment corresponds to S201 in the above-mentioned embodiments.

[0081] S302, performing format parsing on the message header according to the DRDA protocol, and checking whether the response message is a DB2 response message.

[0082] After obtaining the response message, the electronic device can perform format parsing on the message header of the response message according to the DRDA protocol, and then check the magic field parsed to further determine whether the response message is a DB2 response message.

[0083] The DB2 database can adopt a communication protocol, which is DRDA protocol, and adopt a TCP protocol for carrying. Generally, the DB2 response message can include multiple DRDA messages, and one DRDA message can include one or more DRDA data structures. One DRDA structure can include a distributed data management (DDM) header and a message data area.

[0084] The distributed data management header, i.e., the message header, can be used to indicate the length, type and code point of the DB2 response message; and the message data area is used to indicate the data content of the DRDA message. The message data area can be a full parameter structure, which can be used to store the DRDA message data. The message data area can also be directly used as a byte stream. The message data area can include information of rows and columns.

[0085] The length of one DDM header is 10 bytes. The DDM header can include a length field, a check field, a format field, a connection ID field, a second length field and a code point field.

[0086] For example, Figure 4 A structure diagram of a DB2 response message is shown. One DB2 response message can include multiple DRDA messages, and one DRDA message can include multiple DRDA structures. Each DRDA structure includes a DDM header and a data area. The DDM header can be used to indicate the length, type and code point of the response message, and the data area can be used to indicate the storage of the DRDA message data content.

[0087] Figure 5 A structure diagram of a DDM header is shown. The DDM header can include a length field, a check field, a format field, a connection ID field, a code point field and the like.

[0088] The length (length) field occupies 2 bytes, and the length field can be used to indicate the length of the entire DRDA message.

[0089] The check (magic) field occupies 1 byte, and the check field can be used to check whether the response message is a DB2 response message.

[0090] The format (format) field occupies 1 byte, and the format field can be used to describe some format information of the DDM header in the DRDA message.

[0091] The connection ID (correlID) field occupies 2 bytes, and the connection ID field can be used to indicate the connection ID of the DRDA message.

[0092] The second length (length2) field occupies 2 bytes, and the second length field can be used to represent the remaining length of the entire DRDA message length except the check field, the format field, and the connection ID field.

[0093] The code point field occupies 2 bytes, and the code point can be used to represent the type of the DRDA message. The code point field is the most important field and can be used to describe the purpose of the entire DRDA message.

[0094] In some embodiments, after obtaining the response message of the DB2 database, the electronic device can parse the DDM header in each DRDA in the response message of the DB2 database according to the DRDA protocol, determine the value of the parsed magic field, and check the value of the parsed magic field.

[0095] In the case where the value of the magic field is 0XD0, the response message is a DB2 response message, and according to the DRDA protocol, the type of the response message is determined, that is, S303 is executed.

[0096] In the case where the value of the magic field is not 0XD0, it is indicated that the response message is not a DB2 response message, and the parsing of the response message can be ended.

[0097] The value of the magic field in the DB2 response message is determined by the DRDA protocol to further determine whether the DB2 response message belongs to the DB2 database, which can further ensure the accuracy of the parsing.

[0098] S303, in the case where the check is a DB2 response message, according to the DRDA protocol, the type of the DB2 response message is determined.

[0099] In the case where the check is a DB2 response message, according to the DRDA protocol, the type of the parsed DB2 response message is determined to parse the data area of the DB2 response message.

[0100] In some embodiments, the electronic device parses the DDM header in each DRDA in the response message of the DB2 data according to the DRDA protocol, and determines the type of the code point.

[0101] The type of the code point can include: SQLDARD type and QRYDTA type. The SQLDARD type can represent the information of the message data area column. The QRYDTA type can represent the information of the message data area row.

[0102] It should be noted that S302 to S303 in this embodiment correspond to S202 in the above embodiment. That is, S202 in the above embodiment can be implemented by S302 to S303 in this embodiment.

[0103] S304, according to the type of the DB2 response message, the value of the first preset byte is obtained, and the number of columns of the message data area is determined.

[0104] After determining the type of the DB2 response message, according to the type of the DB2 response message, the value of the first preset byte is obtained, and the number of columns of the message data area is determined.

[0105] In some embodiments, in the case of determining that the response message is a DB2 response message and the type of the message data area is a SQLDARD type, the value of the first preset byte is obtained, and the number of columns of the message data area is determined.

[0106] In some embodiments, the first preset byte can be the 105th byte. That is, in the case of determining that the response message is a DB2 response message and the type of the message data area is a SQLDARD type, the value of the 105th byte can be obtained from the message data area of each DRDA message, and the number of columns of the message data area of each DRDA message can be determined by the value of the 105th byte.

[0107] S305, according to the value of the second preset byte, the type of the first column of the DB2 response message data area is determined, and the second preset byte is 14 bytes offset from the first preset byte.

[0108] After determining the number of columns of the message data area of each DRDA message, the type of the first column of the message data area of each DRDA message in the DB2 response message can be determined according to the value of the second preset byte. Wherein, the second preset byte is 14 bytes offset from the first preset byte.

[0109] In some embodiments, in the case of the first preset byte being the 105th byte, the second preset byte can be 14 bytes offset from the 105th byte, that is, the second preset byte can be the 119th byte.

[0110] After determining the number of columns of the message data area of each DRDA message, according to the value of the 119th byte in each DRDA message, the type of the first column in the message data area of each DRDA message can be determined.

[0111] In some embodiments, the type of the DB2 database can be integer, long integer and character type, that is, the type of the first column of the message data area is one or more of integer, long integer and character type.

[0112] For example, the types of the first column are shown in Table 1 below: the types of the first column can be integer, long integer, and character. The type value corresponding to the integer can be 0xf0 or 0xf1, and the value length corresponding to the integer can be 4 bytes. The type value corresponding to the long integer can be 0xec or 0xed, and the value length corresponding to the long integer can be 9 bytes. The type value corresponding to the character can be 0xc0 or 0xc1, and the value length corresponding to the character can be a variable length.

[0113] Table 1

[0114] Type Type value Value length Integer 0xf0 or 0xf1 4 bytes Long integer 0xec or 0xed 8 bytes Character 0xc0 or 0xc1 Variable

[0115] S306, determining the column name length of the first column according to the value of the third preset byte, the third preset byte being 18 bytes offset from the second preset byte.

[0116] After determining the type of the first column in the message data area of each DRDA message, the length of the first column in the message data area of each DRDA message in the DB2 response message can be determined according to the value of the third preset byte.

[0117] The third preset byte can be 18 bytes offset from the second preset byte.

[0118] In some embodiments, when the second preset byte is the 119th byte, the third preset byte can be 18 bytes offset from the 119th byte, i.e., the third preset byte can be the 137th byte.

[0119] After determining the type of the first column in the message data area of each DRDA message, the column name length of the first column in the message data area of each DRDA message can be determined according to the value of the 137th byte in the message data area of each DRDA message.

[0120] S307, determining the column name of the first column according to the value of the fourth preset byte, the fourth preset byte being 1 byte offset from the third preset byte.

[0121] After determining the column name length of the first column in the message data area of each DRDA message, the column name of the first column in the message data area of each DRDA message in the DB2 response message can be determined according to the value of the fourth preset byte. The fourth preset byte can be 1 byte offset from the third preset byte.

[0122] In some embodiments, when the third preset byte is the 137th byte, the fourth preset byte can be 1 byte offset from the 137th byte, i.e., the fourth preset byte can be the 138th byte.

[0123] After determining the column name length of the first column in the message data area of each DRDA message, the column name length of the first column in each DRDA message can be determined according to the value of the 138th byte in the message data area of each DRDA message.

[0124] S308, determining the type, column name length and column name of the other columns after the first column according to the column separator and the fifth preset byte, the fifth preset byte being 13 bytes offset from the column separator.

[0125] After determining the information of the first column in the message data area of each DRDA message (i.e. the type, column name length and column name of the first column), the type, column name length and column name of the other columns after the first column in the message data area of each DRDA message can be determined according to the column separator and the fifth preset byte.

[0126] In some embodiments, the column separator can include a separator and an end symbol. The separator can include 10 bytes of 0x00, and the end symbol can include one 0xff. The fifth preset byte can be 13 bytes offset from the column separator.

[0127] After determining the information of the first column in the message data area of each DRDA message, other information of the first column can be displayed. After the information of 6 consecutive 0x00 and one 0xff appears, it indicates the end of the information of the first column.

[0128] In some embodiments, if there are multiple columns of data in the message data area of each DRDA message, the information of the other columns (i.e. the type, column name length and column name of the other columns) other than the first column can be determined by S305 to S308.

[0129] For example, after the end of the first column (i.e. the appearance of the column separator), 13 bytes offset from the column separator can obtain the information of the second column (i.e. the type, column name length and column name of the second column).

[0130] S309, determining the initial position of the first row of the message data area according to the type of the DB2 response message.

[0131] After obtaining the type, column name length and column name information of all columns in the message data area of each DRDA message, the initial position of the first row of the message data area can be determined according to the type of the DB2 response message.

[0132] In some embodiments, after obtaining the type, column name length and column name information of all columns in the message data area of each DRDA message, in the case that the data type of the message data area is QRYDTA type, the first three bytes of the data area of this type can be obtained to determine the initial position of the first row.

[0133] In some embodiments, the first three bytes of the QRYDTA type data can be 0xff0000. That is, when 0xff0000 appears in the message data area of the DRDA message of the QRYDTA type, it indicates that the byte is the initial position of the first row of data.

[0134] S310, according to the first column type, parsing the first column data from the initial position of the first row to obtain the query result set corresponding to the DB2 response message of the first column of the first row.

[0135] After determining the initial position of the first row of the message data area, the first column data from the initial position of the first row can be parsed according to the determined first column type to obtain the query result set corresponding to the DB2 response message of the first column of the first row.

[0136] In some embodiments, in the case where the data type of the first column is an integer type, the value at the byte offset by 4 bytes from the initial position of the first row of the first column is obtained to determine the query result set corresponding to the DB2 response message of the first column of the first row.

[0137] It should be noted that the four bytes are sorted in little-endian byte order and need to be paid attention to when converting.

[0138] In some embodiments, in the case where the data type of the first column is a long integer type, the value at the byte offset by 8 bytes from the initial position of the first row of the first column is obtained to determine the query result set corresponding to the DB2 response message of the first column of the first row.

[0139] It should be noted that the eight bytes are sorted in little-endian byte order and need to be paid attention to when converting.

[0140] In some embodiments, in the case where the data type of the first column is a character type, the value at the byte offset by 2 bytes from the initial position of the first row of the first column is obtained to determine the value of the first column of the first row.

[0141] S311, according to the row-column separator, parsing other column data after the first column of the first row to obtain the query result set corresponding to the response message of the other columns of the first row.

[0142] After obtaining the first column data of the first row in the message data area, the other column data after the first column of the first row can be parsed according to the row-column separator to obtain the query result set corresponding to the response message of the other columns of the first row.

[0143] In some embodiments, the inter-row column separator can be 0x00, that is, the columns in the first row of the data area of the message can be separated by 0x00. After determining the value of the first column of the first row, when the inter-row separator 0x00 appears, it indicates that the data of the first column of the first row ends, and the data of the columns after the first column of the first row can be parsed.

[0144] It should be noted that the values of all columns in the first row of the data area of the obtained DRDA message are the response result set of a DRDA message.

[0145] S312, according to the row separator and the length of the DB2 response message, determining the response result set corresponding to the DB2 response message of the other rows after the first row.

[0146] After obtaining the data of all columns of the first row, the response result set corresponding to the DB2 response message of the other rows after the first row can be determined according to the row separator and the length of the DB2 response message.

[0147] In some embodiments, if the DB2 response message has one DRDA message, the DRDA includes multiple DRDA structures, and the number of rows of data in a DRDA structure needs to be determined according to the length of the DRDA. When a DRDA structure includes multiple rows of data, the row separator can be 0xff0000, that is, the rows can be separated by 0xff0000.

[0148] In some embodiments, if the DB2 response message has multiple DRDA messages (i.e., the DB2 response message has multiple rows), the data of the other rows after the first row, that is, the response result set corresponding to the DB2 response message, can be determined through the above S310 to S311.

[0149] Since the DB2 response message does not indicate the number of rows, the length of the DRDA can only be used to determine whether all columns of data have been obtained. During the parsing process, the remaining length is recorded, and when the remaining length is less than one row of data, it is determined that all rows of data have been obtained.

[0150] It should be noted that S304 to S312 in the present embodiment correspond to S203 in the above embodiment. That is, S203 in the above embodiment can be implemented by S304 to S312 in the present embodiment.

[0151] S313, outputting the query result set corresponding to the DB2 response message.

[0152] After obtaining all column data and row data of the DB2 response message (i.e., the query result set corresponding to all DB2 response messages), the electronic device can output the query result set corresponding to the DB2 response message.

[0153] In some embodiments, the electronic device can display the query result set corresponding to the DB2 response message on the display, so that the user can understand the query result set, thereby ensuring the security of the DB2 database.

[0154] It should be noted that S313 in this embodiment corresponds to S204 in the above-mentioned embodiments.

[0155] The scheme of the present application obtains the response message interacted between the DB2 database client and the server, judges the type of the response message, finds the message data area of the query command query result, respectively parses the type, length and column name of each column of the message data area, and then parses the data of each row according to the type and overall length of each column of the message data area, thereby obtaining the query result set corresponding to the DB2 response message, and further providing an important data source for the audit of the DB2 database.

[0156] Corresponding to the method in the above-mentioned embodiments, the present embodiment further provides a data parsing device. The data parsing device can be applied to an electronic device, and is used to implement the method in the above-mentioned embodiments. The functions of the data parsing device can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

[0157] For example, Figure 6 A structural schematic diagram of a data parsing device is shown. As Figure 6 shown, the data parsing device 600 can include an identification module 601, a determination module 602, a parsing module 603 and an output module 604, etc.

[0158] The identification module 601 can be used to identify the response message of the database according to the source port number of the data packet. The response message can include a message header and a message data area.

[0159] The determination module 602 can be used to parse the response message header according to a preset protocol, and determine the type of the response message.

[0160] The parsing module 603 can be used to parse the message data area according to the type of the response message data, and obtain the query result set corresponding to the response message data.

[0161] The output module 604 can be used to output the query result set corresponding to the response message.

[0162] In a possible implementation manner, the determination module 602 can also be used to format analyze the message header according to the preset protocol, and verify whether the response message is a DB2 response message; in the case of verifying that the response message is a DB2 response message, determine the type of the response message according to the preset protocol.

[0163] In a possible implementation, the preset protocol can include a DRDA protocol.

[0164] In a possible implementation, the parsing module 603 can be further configured to parse the message data area according to the type of the response message, to obtain the number of columns of the message data area, the length of each column, the type of each column, and the name of each column; and parse the message data area according to the type of the response message, the length of the response message, and the type of each column, to obtain the query result set corresponding to the response message.

[0165] In a possible implementation, the parsing module 603 can be further configured to obtain the value of a first preset byte to determine the number of columns of the message data area according to the type of the response message; obtain the type of the first column of the response message data area according to the value of a second preset byte, the second preset byte being 14 bytes offset from the first preset byte; obtain the length of the name of the first column according to the value of a third preset byte, the third preset byte being 18 bytes offset from the second preset byte; obtain the name of the first column according to the value of a fourth preset byte, the fourth preset byte being 1 byte offset from the third preset byte; and obtain the type, the length of the name, and the name of the other columns after the first column according to a column separator and a fifth preset byte, the fifth preset byte being 13 bytes offset from the column separator.

[0166] In a possible implementation, the parsing module 603 can be further configured to determine the initial position of the first row of the message data area according to the type of the response message; and parse all rows from the initial position of the first row according to the length of the response message and the type of each column, to obtain the query result set corresponding to the response message.

[0167] In a possible implementation, the parsing module 603 can be further configured to parse the data of the first column from the initial position of the first row according to the type of the first column, to obtain the query result set corresponding to the response message of the first column of the first row; parse the data of the other columns of the first row after the first column according to an inter-row column separator, to obtain the query result set corresponding to the response message of the other columns of the first row; and determine the response result set corresponding to the response message of the other rows after the first row according to a row separator and the length of the response message.

[0168] It should be understood that the division of the units or modules (hereinafter referred to as units) in the above apparatus is only a logical functional division, and all or part of the units can be integrated onto one physical entity, or can be physically separated. The units in the apparatus can all be implemented in the form of software invoked by a processing element; or all can be implemented in the form of hardware; or some units can be implemented in the form of software invoked by a processing element, and some units can be implemented in the form of hardware.

[0169] For example, each unit can be a separately established processing element, or can be integrated in a chip of the apparatus, or can be stored in a memory in the form of a program, and the function of the unit can be invoked and executed by a processing element of the apparatus. In addition, all or part of the units can be integrated together, or can be implemented independently. The processing element described herein can also be referred to as a processor, which can be an integrated circuit with signal processing capability. In implementation, each step of the above method or each unit described above can be implemented by integrated logic circuit of hardware in the processing element, or in the form of software invoked by the processing element.

[0170] In one example, the units in the apparatus described above can be one or more integrated circuits configured to implement the above method, for example: one or more ASICs, or one or more DSPs, or one or more FPGAs, or a combination of at least two of these integrated circuit forms.

[0171] For another example, when the units in the apparatus can be implemented in the form of a program scheduled by a processing element, the processing element can be a general-purpose processor, such as a CPU or other processor that can invoke a program. For another example, the units can be integrated together to implement a system-on-a-chip (SOC).

[0172] In one implementation, the units of the apparatus implementing the corresponding steps of the above method can be implemented in the form of a program scheduled by a processing element. For example, the apparatus can include a processing element and a storage element, and the processing element invokes a program stored in the storage element to execute the method described in the above method embodiments. The storage element can be a storage element on the same chip as the processing element, i.e., an on-chip storage element.

[0173] In another implementation, the program for executing the above method can be in a storage element on a different chip from the processing element, i.e., an off-chip storage element. At this time, the processing element invokes or loads the program from the off-chip storage element to the on-chip storage element to invoke and execute the method described in the above method embodiments.

[0174] For example, the embodiments of the present application can also provide an apparatus, such as an electronic device, which can include a processor and a memory storing instructions executable by the processor. The processor is configured to execute the above instructions, so that the electronic device implements the data analysis method as described in the foregoing embodiments. The memory can be located inside the electronic device, or can be located outside the electronic device. The processor includes one or more.

[0175] In yet another implementation, the units implementing the various steps of the above method can be one or more processing elements configured to be on the electronic device as described above. The processing elements can be integrated circuits, such as one or more ASICs, or one or more DSPs, or one or more FPGAs, or combinations of these integrated circuits. The integrated circuits can be integrated together, for example, in a chip.

[0176] For example, the embodiments of the present application also provide a chip which can be applied to the electronic device described above. The chip comprises one or more interface circuits and one or more processors; the interface circuit and the processor are connected through a line; the processor receives and executes computer instructions from the memory of the electronic device through the interface circuit, so as to realize the data analysis method described in the above method embodiments.

[0177] The embodiments of the present application also provide a computer program product comprising computer instructions run by the electronic device described above.

[0178] Through the description of the above implementation, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of functional modules is taken as an example for illustration. In actual application, the above-mentioned functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0179] In the several embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the modules or units is only a logical function division. There can be another division way in actual implementation. For example, a plurality of units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0180] The units described as separate components can or can not be physically separate, and the components shown as units can be one physical unit or multiple physical units, that is, can be located in one place, or can be distributed in multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0181] In addition, each of the function units in the embodiments of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware, or in the form of a software function unit.

[0182] When the integrated unit is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on such an understanding, the technical solutions of the embodiments of the present application essentially, or the part that contributes to the prior art, or all or a part of the technical solutions can be embodied in the form of a software product. The software product stores a series of instructions for causing an apparatus (which can be a single chip, a chip, etc.) or a processor to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, and various other media that can store program codes.

[0183] For example, the embodiments of the present application can also provide a computer readable storage medium, which stores computer program instructions. When the computer program instructions are executed by an electronic device, the electronic device implements the data analysis method as described in the foregoing method embodiments.

[0184] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the present application should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data parsing method, characterized in that, The data parsing method includes: Based on the source port number of the data packet, identify the database response message, which includes a message header and a message data area; According to the preset protocol, the message header is parsed to determine the length and type of the response message; Based on the type of the response message, obtain the value of the first preset byte and determine the number of columns in the message data area; The type of the first column of the response message data area is determined based on the value of the second preset byte, where the second preset byte is the first preset byte offset by 14 bytes. The column name length of the first column is determined based on the value of the third preset byte, wherein the third preset byte is the second preset byte offset by 18 bytes. The column name of the first column is determined based on the value of the fourth preset byte, wherein the fourth preset byte is the third preset byte offset by 1 byte; Based on the column separator and the fifth preset byte, determine the type, column name length, and column name of the columns after the first column. The fifth preset byte is the column separator offset by 13 bytes. Based on the type of the response message, the length of the response message, and the types of each column, the message data area is parsed to obtain the query result set corresponding to the response message; Output the query result set corresponding to the response message.

2. The data parsing method according to claim 1, characterized in that, The step of parsing the response header according to a preset protocol to determine the type of the response message includes: According to the preset protocol, the message header is formatted and the response message is verified to be a DB2 response message. If the verification indicates that the response message is a DB2 response message, the type of the response message is determined according to the preset protocol.

3. The data parsing method according to claim 2, characterized in that, The preset protocol includes the DRDA protocol.

4. The data parsing method according to claim 1, characterized in that, The step of obtaining the query result set corresponding to the response message based on the type of the response message, the types of each column, and the data type of the column in the response message includes: Determine the initial position of the first line of the message data area based on the type of the response message; Based on the length of the response message and the types of each column, all rows are parsed from the initial position of the first row to obtain the query result set corresponding to the response message.

5. The data parsing method according to claim 4, characterized in that, The step involves parsing all rows from the initial position of the first row based on the length of the response message and the types of each column to obtain the query result set corresponding to the response message, including: Based on the type of the first column, the data in the first column is parsed from the initial position of the first row to obtain the query result set corresponding to the response message in the first column of the first row; Based on the row and column separator, parse the data of the other columns in the first row after the first column of the first row to obtain the query result set corresponding to the response message of the other columns in the first row; Based on the line separator and the length of the response message, determine the response result set corresponding to the response messages of the other lines after the first line.

6. A data parsing device, characterized in that, The data parsing device includes: an identification module, a determination module, a parsing module, and an output module; The identification module is used to identify the database response message based on the source port number of the data packet. The response message includes a message header and a message data area. The determining module is used to parse the response message header according to a preset protocol to determine the type of the response message; The parsing module is used to: obtain the value of a first preset byte based on the type of the response message; determine the number of columns in the message data area based on the value of a second preset byte, wherein the second preset byte is offset by 14 bytes from the first preset byte; determine the column name length of the first column based on the value of a third preset byte, wherein the third preset byte is offset by 18 bytes from the second preset byte; determine the column name of the first column based on the value of a fourth preset byte, wherein the fourth preset byte is offset by 1 byte from the third preset byte; determine the type, column name length, and column name of other columns after the first column based on the column separator and a fifth preset byte, wherein the fifth preset byte is offset by 13 bytes from the column separator; and parse the message data area based on the type of the response message, the length of the response message, and the types of each column to obtain the query result set corresponding to the response message. The output module is used to output the query result set corresponding to the response message.

7. An electronic device, characterized in that, The electronic device includes a processor and a memory for storing processor-executable instructions; the processor is configured to, when executing the instructions, cause the electronic device to implement the data parsing method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction that runs on an electronic device, causing the electronic device to implement the data parsing method as described in any one of claims 1-5.

Images