Network traffic processing methods, devices, computer equipment, storage media and products

Abstract

This application relates to a network traffic processing method, apparatus, computer device, storage medium, and product. The method includes: acquiring network traffic data from a network device; parsing the network traffic data according to a protocol data structure used for communication with an application; determining the network traffic protocol data structure; and sending the network traffic protocol data structure to the application to instruct the application to perform security checks on the network device. This method is implemented using a dedicated network traffic processing chip, thereby improving the speed of network traffic data parsing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, and particularly relates to a network traffic processing method and device, computer equipment, a storage medium and a product. BACKGROUND

[0002] With the rapid development of communication networks, network security is particularly important.

[0003] In the related art, a central processing unit in a computer device can analyze and process network traffic data to detect virus propagation and hacker attacks in a network environment through analysis and processing results, so as to prevent network attacks and improve network security.

[0004] However, the related technology has a problem that the network traffic data processing speed is slow, which affects the network security detection speed. SUMMARY

[0005] Therefore, it is necessary to provide a network traffic processing method and device, computer equipment, a storage medium and a product to improve the network traffic data processing speed and avoid affecting the network security detection speed.

[0006] In a first aspect, an embodiment of the present application provides a network traffic processing method applied to a network traffic analysis chip, and the method comprises the following steps.

[0007] Obtaining network traffic data of a network device;

[0008] Analyzing the network traffic data according to a protocol data structure for communication with an application program, and determining a network traffic protocol data structure;

[0009] Sending the network traffic protocol data structure to the application program to instruct the application program to perform security detection on the network device.

[0010] In one embodiment, the step of analyzing the network traffic data according to the protocol data structure for communication with the application program, and determining the network traffic protocol data structure comprises:

[0011] Obtaining a protocol header corresponding to the protocol data structure according to the protocol data structure;

[0012] Analyzing the network traffic data according to the protocol header;

[0013] Taking the analyzed network traffic data as a protocol body corresponding to the protocol header;

[0014] Generating the network traffic protocol data structure according to the protocol header and the protocol body.

[0015] In one of the embodiments, the network traffic protocol data structure is sent to the application program, comprising:

[0016] A communication mode between the application program is acquired.

[0017] According to the communication mode, the network traffic protocol data structure is sent to the application program.

[0018] In one of the embodiments, the communication mode between the application program is acquired, comprising:

[0019] In the case that the registration information of the application program exists, the communication mode between the application program is determined according to the registration information.

[0020] In one of the embodiments, the communication mode between the application program is determined according to the registration information, comprising:

[0021] If the registration information is a read hook of the application program, the communication mode is determined as a shared memory communication mode.

[0022] If the registration information is a communication interface information of the application program, the communication mode is determined as a network communication mode.

[0023] In one of the embodiments, the communication mode between the application program is acquired, comprising:

[0024] In the case that the registration information of the application program does not exist, a registration information acquisition request is sent to the application program, instructing the application program to send the registration information to the network traffic analysis chip.

[0025] The registration information is acquired, and the communication mode between the application program is determined according to the registration information.

[0026] In one of the embodiments, the network traffic protocol data structure is sent to the application program according to the communication mode, comprising:

[0027] If the communication mode is a shared memory communication mode, the network traffic protocol data structure is written into the shared memory.

[0028] A data read request is sent to the application program; the data read request is used to instruct the application program to read the network traffic protocol data structure from the shared memory.

[0029] In one of the embodiments, the network traffic protocol data structure is written into the shared memory, comprising:

[0030] According to the shared memory, a memory space is allocated in the shared memory for a protocol header and a corresponding protocol body in the network traffic protocol data structure.

[0031] The network traffic protocol data structure is written into the allocated memory space in the shared memory.

[0032] In one embodiment, memory space is allocated for the protocol header and corresponding protocol body in the network traffic protocol data structure based on shared memory, including:

[0033] If the shared memory space is full, a memory overflow release request is sent to the shared memory, instructing the shared memory to release the minimum memory space;

[0034] Based on the remaining space in the shared memory, memory space is allocated for the protocol header and the corresponding protocol body.

[0035] In one embodiment, sending a data read request to the application includes:

[0036] Invoke the application's read hook and send a data read request to the application according to the preset multi-channel transmission strategy.

[0037] In one embodiment, a network traffic protocol data structure is sent to the application according to the communication method, including:

[0038] If the communication method is network communication, then the data packets are determined according to the network traffic protocol data structure;

[0039] The data packet is sent to the application through the communication interface, instructing the application to retrieve the network traffic protocol data structure from the data packet according to the protocol data structure.

[0040] Secondly, embodiments of this application provide a network traffic processing method applied to an application, the method comprising:

[0041] Obtain the network traffic protocol data structure; the network traffic protocol data structure is determined by the network traffic parsing chip after parsing the network traffic data based on the network traffic data of the network device and the protocol data structure of the communication between the network traffic parsing chip and the application.

[0042] Security testing of network devices is performed based on network traffic protocol data structures.

[0043] In one embodiment, before obtaining the network traffic protocol data structure, the method further includes:

[0044] It sends its registration information to the network traffic analysis chip, instructing the chip to determine the communication method with the application based on the registration information.

[0045] In one embodiment, obtaining the network traffic protocol data structure includes:

[0046] When the communication method is shared memory communication, receive data read requests sent by the network traffic parsing chip;

[0047] Based on the data read request, read the network traffic protocol data structure from shared memory.

[0048] In one embodiment, obtaining the network traffic protocol data structure includes:

[0049] When the communication method is network communication, the data packets sent by the network traffic analysis chip are received through the communication interface; the data packets are determined by the network traffic analysis chip according to the network traffic protocol data structure.

[0050] Retrieve the network traffic protocol data structure from the data packets based on the protocol data structure.

[0051] In one embodiment, before performing security checks on network devices based on network traffic protocol data structures, the method further includes:

[0052] If the communication method is shared memory communication, after reading the network traffic protocol data structure, a memory release request is sent to the shared memory to instruct the shared memory to release the memory space corresponding to the network traffic protocol data structure.

[0053] Thirdly, embodiments of this application provide a network traffic processing apparatus, the apparatus comprising:

[0054] The acquisition module is used to acquire network traffic data from network devices;

[0055] The parsing module is used to parse network traffic data according to the protocol data structure of communication with the application and determine the network traffic protocol data structure.

[0056] The sending module is used to send network traffic protocol data structures to the application to instruct the application to perform security checks on network devices.

[0057] Fourthly, embodiments of this application provide a network traffic processing apparatus, the apparatus comprising:

[0058] The acquisition module is used to acquire network traffic protocol data structures. The network traffic protocol data structures are determined by the network traffic parsing chip after acquiring network traffic data from network devices and parsing the network traffic data according to the protocol data structure used for communication with the application.

[0059] The detection module is used to perform security detection on network devices based on network traffic protocol data structures.

[0060] Fifthly, embodiments of this application also provide a computer device, which includes a transceiver, a memory, and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the method in any of the embodiments of the first and second aspects.

[0061] In a sixth aspect, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method in any of the first and second aspects.

[0062] In a seventh aspect, embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the method in either the first or second aspect.

[0063] The network traffic processing method, apparatus, computer device, storage medium, and product provided in this application include: acquiring network traffic data from a network device; parsing the network traffic data according to the protocol data structure used for communication with an application to determine the network traffic protocol data structure; and sending the network traffic protocol data structure to the application to instruct the application to perform security detection of the network device. The method is implemented using a dedicated network traffic processing chip, thereby improving the parsing speed of network traffic data. Furthermore, the method can parse the network traffic data according to the protocol data structure used for communication with the application, splitting large amounts of data into smaller amounts before sending, thus improving data transmission speed and enabling the application to quickly obtain the network traffic protocol data structure. Further, based on the rapid acquisition of the network traffic protocol data structure, the method can also improve the speed of network device security detection and reduce the total time required for network device security detection. In addition, the method does not limit the application to relying on specific functional suites to achieve network device security detection, thereby improving the broad applicability of security detection. Moreover, the method enables communication between the network traffic parsing chip and the application, thereby achieving cross-network data transmission between the network traffic parsing chip and the application. Attached Figure Description

[0064] Figure 1 This is a diagram illustrating the application environment of a network traffic processing method in one embodiment.

[0065] Figure 2 This is a flowchart illustrating a network traffic processing method in one embodiment;

[0066] Figure 3 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0067] Figure 4 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0068] Figure 5 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0069] Figure 6 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0070] Figure 7 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0071] Figure 8 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0072] Figure 9 This is a diagram illustrating the data flow of a shared memory communication method in one embodiment;

[0073] Figure 10 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0074] Figure 11 This is a diagram illustrating the data flow of a network communication method in one embodiment;

[0075] Figure 12 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0076] Figure 13 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0077] Figure 14 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0078] Figure 15 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0079] Figure 16 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0080] Figure 17 This is a flowchart illustrating a network traffic processing method in another embodiment;

[0081] Figure 18 This is a structural block diagram of a network traffic processing device in one embodiment;

[0082] Figure 19 This is a structural block diagram of a network traffic processing device in another embodiment;

[0083] Figure 20 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0084] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0085] In the field of computer security, network security is of paramount importance. Related technologies primarily utilize the Central Processing Unit (CPU) in computer devices to parse and process network traffic data. The parsing results are then used to detect virus propagation and hacker attacks within the network environment, and further, based on these detections, network attacks are prevented, thus improving network security. However, since the CPU is not a dedicated processing chip, these technologies suffer from slow network traffic data processing speeds, impacting network security detection speeds. Therefore, this application provides a network traffic processing method that improves network traffic data processing speed and avoids affecting network security detection speeds.

[0086] The network traffic processing method provided in this application embodiment can be applied to, for example, Figure 1 The network traffic processing system shown includes a network traffic parsing chip and an application program. The network traffic parsing chip can be, but is not limited to, a Field Programmable Gate Array (FPGA) chip or an Application Specific Integrated Circuit (ASIC) chip. The application program can be deployed on a computer device. It should be noted that the network traffic parsing chip and the computer device deploying the application program communicate with each other via Bluetooth, Wi-Fi, mobile network connection, etc., which is not limited in this embodiment. The computer device can be, but is not limited to, various personal computers, laptops, smartphones, and tablets; this embodiment does not limit the specific form of the computer device. The following embodiments will specifically describe the specific process of the network traffic processing method. For ease of description, in this embodiment, the computer device is directly described as an application program to illustrate the network traffic processing method. The specific process of the network traffic processing method will be described below with the execution entities being the network traffic parsing chip or the application program, respectively.

[0087] like Figure 2 The diagram shown is a flowchart of a network traffic processing method provided in an embodiment of this application. This method is applied to a network traffic parsing chip and may include the following steps:

[0088] S101. Obtain network traffic data from network devices.

[0089] Optionally, the network device can be a network device within a computer device or server. The network device can be a network card, gateway, bridge, network adapter, etc., and this embodiment does not limit the specific network device.

[0090] In practical applications, network traffic analysis chips can directly collect network traffic data from network devices. Additionally, in some scenarios, network traffic acquisition devices can collect network traffic data from network devices and send the collected data to the network traffic analysis chip in real time. Correspondingly, the network traffic analysis chip can receive the network traffic data sent by the network traffic acquisition device.

[0091] S102. Based on the protocol data structure for communication with the application, parse the network traffic data to determine the network traffic protocol data structure.

[0092] In practical applications, the above-mentioned protocol data structure for communication with the application can be understood as the communication protocol between the network traffic parsing chip and the application. The communication protocol can include two parts: a protocol header and a protocol body.

[0093] Specifically, the network traffic parsing chip can parse network traffic data based on the protocol data structure of the communication between the network traffic parsing chip and the application, and determine the network traffic protocol data structure. It should be noted that parsing can be understood as the process of encoding network traffic data.

[0094] In this embodiment, the network traffic protocol data structure may include at least one protocol header and at least one protocol body, with each protocol header having a corresponding protocol body. Optionally, the total number of protocol headers in the network traffic protocol data structure may be equal to the total number of protocol bodies in the network traffic protocol data structure, or it may be equal to the number of data packets in the protocol data structure.

[0095] It should be noted that the process of parsing network traffic data can break down large data into multiple smaller data, namely, at least one protocol header and at least one protocol body included in the network traffic protocol data structure. A protocol header and its corresponding protocol body can be referred to as a smaller data.

[0096] S103. Send a network traffic protocol data structure to the application to instruct the application to perform security checks on network devices.

[0097] Based on the network traffic protocol data structure obtained in the previous steps, the network traffic parsing chip can send the network traffic protocol data structure to the application to instruct the application to use a security detection algorithm to perform security detection on the network device according to the network traffic protocol data structure, thereby preventing attacks from malware, hackers and viruses and improving network security.

[0098] Optionally, the above security detection algorithm can be a signature detection method, behavior detection method, classification filtering method, etc., and this application embodiment does not limit it.

[0099] In one implementation, the network traffic parsing chip can directly send the network traffic protocol data structure to the application. In another implementation, the network traffic parsing chip can send the network traffic protocol data structure to a third-party device, which then sends the network traffic protocol data to the application.

[0100] It should be noted that the above embodiments are implemented through a network traffic analysis chip. In fact, implementing it through a network traffic analysis chip means implementing it through a dedicated hardware circuit set on the network traffic analysis chip.

[0101] The technical solution in this application embodiment is applied to a network traffic parsing chip, which can acquire network traffic data of network devices, parse the network traffic data according to the protocol data structure of communication with the application, determine the network traffic protocol data structure, and send the network traffic protocol data structure to the application to instruct the application to perform security detection of the network device. The above method is implemented through a dedicated network traffic processing chip, thereby improving the parsing speed of network traffic data. At the same time, this method can parse network traffic data according to the protocol data structure of communication with the application, so that large data is split into multiple smaller data before being sent, thereby improving the data transmission speed and enabling the application to quickly obtain the network traffic protocol data structure. Furthermore, based on the rapid acquisition of the network traffic protocol data structure, it can also improve the speed of network device security detection and reduce the total time required for network device security detection. In addition, this method does not limit the application to rely on specific functional suites to achieve network device security detection, thereby improving the broad adaptability of security detection. Moreover, this method enables communication between the network traffic parsing chip and the application, thereby realizing cross-network data transmission between the network traffic parsing chip and the application.

[0102] In some scenarios, network traffic parsing chips process large datasets by breaking them down into smaller datasets. Naturally, the application side also receives these smaller datasets. In practical applications, the bit width of each smaller dataset may not be equal. Furthermore, since the data needs to be distinguished by attribute information, the smaller datasets must carry corresponding attribute information when sent so that the application side can differentiate between them. The following describes how the network traffic parsing chip parses network traffic data based on the protocol data structure used for communication with the application, determining the network traffic protocol data structure. In one embodiment, as... Figure 3 As shown, the step in S102 above, which parses network traffic data according to the protocol data structure for communication with the application to determine the network traffic protocol data structure, can be implemented in the following way:

[0103] S112. Based on the protocol data structure, obtain the protocol header corresponding to the protocol data structure.

[0104] This involves obtaining the byte lengths of the protocol header and trailer in the protocol data structure, and then extracting each protocol header from the protocol data structure based on the byte lengths of the protocol header and trailer.

[0105] In practical applications, the protocol header in the above protocol data structure may include fields such as encoding format, sender, receiver, sending time, encryption algorithm, and protocol body attribute information. This attribute information may include protocol body length (i.e., the size of the protocol body chunk, or chunk_size), protocol body unique identifier (i.e., unique id, or uid), protocol body data type (i.e., the chunk type of the protocol body), protocol body digital digest verification algorithm length, protocol body cryptographic hash function, etc.

[0106] In this embodiment, the sender can be a network traffic parsing chip, and the receiver can be an application program. Optionally, the protocol body lengths corresponding to different protocol data structures can be different; the different protocol body data types can be distinguished by different enumeration values.

[0107] It should be noted that the unique identifier in the protocol header is used by the application to retrieve the corresponding protocol body. The header length can be 32 bits, 64 bits, 128 bits, etc., depending on the specific application requirements.

[0108] For example, taking a protocol header including chunk_size, uid, and chunk type as an example, Table 1 below shows the specific information included in the protocol data structure, namely the length of the protocol data structure, the length of chunk_size in the protocol header, the length of uid, and the data type of the protocol body. Table 1 illustrates the specific information of the protocol data structure using an example where the length of the protocol data structure is an 8-bit unsigned integer (uint8), the chunk_size in the protocol header is an 8-bit unsigned integer (uint8), and the length of uid is a 16-bit unsigned integer (uint16). Optionally, the protocol body data type can be ip_chunk, icmp_chunk, arp_chunk, dhcp_chunk, igmp_chunk, ospf_chunk, bgp_chunk, ip6_chunk, icmpv6_chunk, ndp_chunk, dhcpv6_chunk, igmpv6_chunk, ospfv3_chunk, or mp_bgp_chunk, but in this embodiment, it is not limited to these types.

[0109] Table 1

[0110] Protocol data structure protocol (uint8) chunk_size (uint8) uid (uint16) Protocol body data type

[0111] S122. Parse the network traffic data according to the protocol header.

[0112] Furthermore, based on the protocol headers obtained in the preceding steps, the network traffic data can be parsed to obtain the protocol body corresponding to each header. Optionally, each protocol body may include the parsed network traffic data and the different sub-data obtained after parsing.

[0113] S132. Use the parsed network traffic data as the protocol body corresponding to the protocol header.

[0114] Optionally, the protocol body in the above protocol data structure may include two parts: data type and data content. The data content may include parsed network traffic data. The data content in different protocol bodies may differ. The protocol body in the protocol data structure can be custom-defined, or it can be a protocol chunk structure under Internet Protocol version 4 (IPv4), Internet Protocol version 6 (IPv6), Internet Protocol version 7 (IPv7), or Internet Protocol version 9 (IPv9).

[0115] The following uses IPv4 and IPv6 as examples to explain the protocol chunk structure length. Under IPv4, the protocol chunk structure length can be set to minimum width, small width, medium width, large width, etc., where the minimum width can be 20 bytes, the small width can be 576 bytes, the medium width can be 1500 bytes, and the large width can be 65 kilobytes. Under IPv6, the protocol chunk structure length can be set to minimum width, small width, medium width, large width, very large width, etc., where the minimum width can be 40 bytes, the small width can be 1280 bytes, the medium width can be 1500 bytes, the large width can be 9000 bytes, and the very large width can be 64 kilobytes.

[0116] In this embodiment of the application, in order to reduce the bit width of the network traffic protocol data structure, the parsed network traffic data can be used as the protocol body corresponding to the protocol header. In practical applications, the data type of the protocol body is identified by the data type in the protocol header.

[0117] S142. Generate the network traffic protocol data structure based on the protocol header and protocol body.

[0118] Furthermore, a network traffic protocol data structure can be generated based on each protocol header and its corresponding protocol body. In other words, the network traffic protocol data structure can include multiple protocol headers and corresponding multiple protocol bodies.

[0119] The technical solution in this application embodiment obtains the protocol header corresponding to the protocol data structure according to the protocol data structure, parses the network traffic data according to the protocol header, uses the parsed network traffic data as the protocol body corresponding to the protocol header, and generates a network traffic protocol data structure based on the protocol header and protocol body. This method can parse the network traffic data into multiple small data, i.e. multiple protocol bodies, according to each protocol header in the protocol data structure, and generate a network traffic protocol data structure to prepare for subsequent rapid data transmission. At the same time, this method does not require complex algorithms to participate in the parsing, and the processing is relatively simple.

[0120] The process of sending network traffic protocol data structures to the application described above is explained below. In one embodiment, as... Figure 4 As shown, the steps in S103 above can be implemented in the following ways:

[0121] S113, Obtain the communication method with the application.

[0122] Specifically, the network traffic parsing chip can acquire a preset communication method between itself and the application, and determine the preset communication method as the communication method for communication between itself and the application. Optionally, the above communication method can be serial communication, parallel communication, Ethernet communication, etc.

[0123] In one embodiment, the step of obtaining the communication method with the application in S113 above may include: if the application's registration information exists, determining the communication method with the application based on the registration information.

[0124] Optionally, the network traffic parsing chip can detect whether the application's registration information is stored in its own memory. If the application's registration information is found, it indicates that the application and the network traffic parsing chip are associated and can communicate with each other. In this case, the communication method between itself and the application can be determined based on the type of registration information.

[0125] The registration information can be of various types, such as text information, image information, video information, audio information, or a combination of these types. This application does not limit the types of registration information.

[0126] S123. Based on the communication method, send the network traffic protocol data structure to the application.

[0127] In practical applications, a communication strategy can be determined based on the communication method, and then network traffic protocol data structures can be sent to the application according to the communication strategy. Optionally, the above communication strategy may include information such as data transmission path, data transmission method, and data receiver, which is not limited in this embodiment.

[0128] In one embodiment, the step of determining the communication method with the application based on the registration information in S123 above may include: if the registration information is a read hook of the application, then the communication method is determined to be a shared memory communication method; if the registration information is the communication interface information of the application, then the communication method is determined to be a network communication method.

[0129] In this embodiment of the application, if the network traffic parsing chip detects that the registration information stored in its own memory is a read hook of the application, it can determine that the communication method is a shared memory communication method; or, if the network traffic parsing chip detects that the registration information stored in its own memory is the communication interface information of the application, it can determine that the communication method is a network communication method.

[0130] The aforementioned "hook reading" refers to the hook function; the aforementioned communication interface information may include the name, identifier, location, and other information of the communication interface that enables network communication. In this embodiment, the communication interface may be a Socket, which represents a calling interface for a standard Transmission Control Protocol (TCP) / Internet Protocol (IP) stack.

[0131] The technical solution in this application embodiment can obtain the communication method between the network traffic parsing chip and the application, and then send the network traffic protocol data structure to the application according to the corresponding communication method, thereby improving the success rate of sending the network traffic protocol data structure. In addition, the method can realize communication between the network traffic parsing chip and the application through two different communication methods, thereby improving the flexibility of the communication method between the network traffic parsing chip and the application. At the same time, the method is not limited to the shared memory communication method between the network traffic parsing chip and the application, thus improving the scalability of the communication method between the network traffic parsing chip and the application.

[0132] In some scenarios, the network traffic parsing chip may not store the application's registration information. The following describes the process of obtaining the communication method between the network traffic parsing chip and the application in this situation. In one embodiment, as... Figure 5 As shown, the step of obtaining the communication method with the application in S113 above may include:

[0133] S1131. If the application's registration information does not exist, send a registration information retrieval request to the application, instructing the application to send the registration information to the network traffic analysis chip.

[0134] If the network traffic analysis chip determines that it does not store the application's registration information in its memory, it indicates that the application has not established an association with the network traffic analysis chip. In this case, it can send a registration information retrieval request to the application to instruct the application to send registration information to the network traffic analysis chip, that is, to instruct the application to register with the network traffic analysis chip to read hook or communication interface information.

[0135] S1132. Obtain registration information and determine the communication method with the application based on the registration information.

[0136] In practical applications, after the application responds to the registration information retrieval request, it can send the registration information to the network traffic analysis chip. Correspondingly, the network traffic analysis chip can receive the registration information sent by the application and determine the communication method between itself and the application based on the type of registration information.

[0137] The technical solution in this application embodiment sends a registration information acquisition request to the application when the application's registration information does not exist. This instructs the application to send registration information to the network traffic parsing chip and acquire the registration information. Based on the registration information, the communication method between the application and the application is determined. Furthermore, the network traffic protocol data structure can be sent to the application using the corresponding data sending method according to the communication method, thereby improving the success rate of data transmission.

[0138] The process of sending network traffic protocol data structures to the application according to the communication method described above will be explained below. In one embodiment, as... Figure 6 As shown, the steps in S123 above can be implemented in the following ways:

[0139] S1231. If the communication method is shared memory communication, then write the network traffic protocol data structure into shared memory.

[0140] Specifically, when the communication method is determined to be shared memory communication, the protocol headers and corresponding protocol bodies in the network traffic protocol data structure can be written into shared memory using synchronous or asynchronous writing methods.

[0141] It should be noted that after parsing is complete, all protocol headers and corresponding protocol bodies can be synchronously written to shared memory. In this embodiment, to prevent data accumulation, after obtaining a protocol header and its corresponding protocol body, these can be written to shared memory in real time.

[0142] In one embodiment, such as Figure 7 As shown, the step of writing the network traffic protocol data structure into shared memory in S1231 above may include:

[0143] S1231a. Based on shared memory, allocate memory space in shared memory for the protocol header and corresponding protocol body in the network traffic protocol data structure.

[0144] In practical applications, the protocol header and corresponding protocol body in the network traffic protocol data structure can be written as a whole into shared memory to avoid the problem of fragmented shared memory being occupied by the protocol header and corresponding protocol body being scattered in shared memory. Naturally, the network traffic parsing chip can allocate memory space in shared memory for the protocol header and corresponding protocol body in the network traffic protocol data structure according to the remaining space of shared memory and the bit width of the protocol header and corresponding protocol body in the network traffic protocol data structure.

[0145] In this embodiment of the application, if the network traffic protocol data structure includes multiple protocol headers and corresponding protocol bodies, memory space can be allocated in shared memory for each protocol header and corresponding protocol body in turn.

[0146] In some scenarios, after at least one protocol header and corresponding protocol body from the network traffic protocol data structure are written into shared memory, and before the application has time to read the written protocol header and corresponding protocol body, the shared memory may be full while the network traffic parsing chip is writing other protocol headers and protocol bodies. The following describes the process of allocating memory space in shared memory for the protocol header and corresponding protocol body in the network traffic protocol data structure under this situation. In one embodiment, as... Figure 8 As shown, the step in S1231a above, which allocates memory space in shared memory for the protocol header and corresponding protocol body in the network traffic protocol data structure, may include:

[0147] S1231aa: If the shared memory space is full, send a memory overflow release request to the shared memory, instructing the shared memory to release the minimum memory space.

[0148] Specifically, when the shared memory is determined to be full, the network traffic parsing chip can send a memory overflow release request to the shared memory, instructing it to release the minimum memory space. Optionally, the minimum memory space can be understood as the storage space occupied by the smallest protocol header and corresponding protocol body in the shared memory.

[0149] S1231ab: Allocate memory space for the protocol header and the corresponding protocol body based on the remaining space in the shared memory.

[0150] Furthermore, based on the minimum memory space that has been released from the shared memory, i.e. the remaining space, memory space can be allocated in the shared memory for the protocol header and the corresponding protocol body.

[0151] S1231b: Write the network traffic protocol data structure into the allocated memory space in shared memory.

[0152] Furthermore, based on the memory space allocated in the previous steps, the network traffic protocol data structure can be written into the memory space allocated in shared memory.

[0153] S1232. Send a data read request to the application. The data read request instructs the application to read the network traffic protocol data structure from shared memory.

[0154] In practical applications, after the network traffic parsing chip writes the network traffic protocol data structure into shared memory, it can send a data read request to the application to instruct the application to read the network traffic protocol data structure from the shared memory.

[0155] In one embodiment, the step of sending a data read request to the application in S1232 above may include: invoking the application's read hook and sending a data read request to the application according to a preset multi-channel transmission strategy.

[0156] Alternatively, the multi-channel transmission strategy can be determined by a load balancing algorithm (i.e., IP HASH algorithm) or a source address hashing scheduling algorithm.

[0157] It should be noted that if the application includes multiple processes, the network traffic analysis chip can call the read hooks corresponding to different processes in the application, and send different data read requests to different processes in the application according to the preset multi-channel transmission strategy.

[0158] In this case, the aforementioned multi-channel transmission strategy can be a transmission strategy determined based on the total number of processes in the application. This multi-channel transmission strategy can include information such as the transmission channel identifier and name between the network traffic parsing chip and different processes.

[0159] Optionally, the protocol header and corresponding protocol body in the network traffic protocol data structure read by different processes can be different. The data read request may carry the address of the memory space; different data read requests can be understood as carrying different addresses of the memory space.

[0160] In other scenarios, there may be multiple applications. In this case, the network traffic parsing chip can call the application's read hook and send different data read requests to each application according to the preset multi-channel transmission strategy.

[0161] In this case, the aforementioned multi-channel transmission strategy can be a transmission strategy determined based on the total number of applications. This multi-channel transmission strategy can include information such as the transmission channel identifier and name between the network traffic parsing chip and different applications.

[0162] Optionally, the protocol header and corresponding protocol body in the network traffic protocol data structure read by different applications can be different; the above different data read requests can be understood as different addresses of memory space carried in the data read requests.

[0163] Regardless of whether a computer device's operating system is running multiple applications or multiple application processes, different applications or different application processes have corresponding shared memory. In other words, different applications or different application processes can read network traffic protocol data structures from different shared memory.

[0164] For example, consider an application running on the operating system of a computer device, comprising process 1 and process 2, where application process 1 sends read hook 1 to the network traffic analysis chip, and application process 2 sends read hook 2 to the network traffic analysis chip. Figure 9 The diagram illustrates the data flow between the network traffic parsing chip and application processes 1 and 2. In this embodiment, the shared memory can be located within the computer device, or it can be located within the computer device... Figure 9 This illustrates the use of shared memory within a computer device. Figure 9 The application's function is to read the network traffic protocol data structure, including the protocol header and corresponding protocol body, and to request the release of the memory space in shared memory containing the read protocol header and corresponding protocol body.

[0165] In addition, if the network traffic parsing chip fails to call the application's read hook multiple times, the read hook can be deleted to release memory. The network traffic parsing chip then sends a crash exit command to the application, instructing the application to crash and exit, thus ending the network traffic processing flow.

[0166] The technical solution in this application embodiment, when the communication method is shared memory communication, writes the network traffic protocol data structure into shared memory and sends a data read request to the application to instruct the application to read the network traffic protocol data structure from shared memory. When the communication method is determined to be shared memory communication, this method can use the data sending method corresponding to shared memory communication to send the network traffic protocol data structure to the application, thereby improving the success rate of network traffic protocol data structure transmission. Furthermore, when the communication method is determined to be shared memory communication, the method can write the network traffic protocol data structure into shared memory, and this method is not limited to shared memory being fixed memory; the size of the shared memory space can be flexibly set, thereby improving the speed of reading data from shared memory and improving the performance of network traffic data processing.

[0167] The process of sending network traffic protocol data structures to the application according to the communication method described above will be explained below. In one embodiment, as... Figure 10 As shown, the steps in S123 above can be implemented in the following ways:

[0168] S1233. If the communication method is network communication, then determine the data packet according to the network traffic protocol data structure.

[0169] In this embodiment of the application, when the communication method is determined to be network communication, the network traffic protocol data structure can be packaged to obtain a data packet, and then the network traffic protocol data structure can be sent to the application in the form of a data packet.

[0170] S1234. Send the data packet to the application through the communication interface, instructing the application to obtain the network traffic protocol data structure from the data packet according to the protocol data structure.

[0171] Optionally, communication interface information can be obtained from the registration information, and then the communication interface between the network traffic parsing chip and the application can be determined based on the communication interface information. Then, data packets can be sent to the application through the communication interface.

[0172] Correspondingly, the application can receive the data packet through the corresponding communication interface and extract the network traffic protocol data structure from the data packet according to the protocol data structure, namely at least one protocol header and the corresponding protocol body.

[0173] For example, taking four application processes as an example, namely application process 1, application process 2, application process 3, and application process 4, where application process 1 and application process 2 both run on operating system 1, and application process 3 and application process 4 both run on operating system 2, specifically, application process 1 and application process 2 send communication interface 1 and communication interface 2 to the network traffic analysis chip respectively, and application process 3 and application process 4 send communication interface 3 and communication interface 4 to the network traffic analysis chip respectively. Figure 11 The data flow between the network traffic analysis chip and application processes 1, 2, 3, and 4 is shown. Figure 11 The application's function is to receive data packets and extract the protocol header and corresponding protocol body from the network traffic protocol data structure. In this embodiment, the communication interface information can be socket information.

[0174] In the technical solution of this application embodiment, when the communication method is determined to be network communication, the data packet is determined according to the network traffic protocol data structure, and the data packet is sent to the application through the communication interface, instructing the application to obtain the network traffic protocol data structure from the data packet according to the protocol data structure; when the communication method is determined to be network communication, the method can use the data sending method corresponding to the network communication method to send the network traffic protocol data structure to the application, thereby improving the success rate of network traffic protocol data structure transmission.

[0175] In one embodiment, this application also provides a network traffic processing method applied to a network traffic parsing chip, such as... Figure 12 As shown, the method includes the following procedures:

[0176] S10. Obtain network traffic data from network devices.

[0177] S11. Based on the protocol data structure, obtain the protocol header corresponding to the protocol data structure.

[0178] S12. Parse the network traffic data according to the protocol header.

[0179] S13. Use the parsed network traffic data as the protocol body corresponding to the protocol header.

[0180] S14. Generate the network traffic protocol data structure based on the protocol header and protocol body.

[0181] S15, Obtain the communication method with the application.

[0182] The steps in S15 above can be implemented in two ways:

[0183] The first approach may include:

[0184] S151. If the application registration information exists, and the registration information is an application read hook, then the communication method is determined to be shared memory communication.

[0185] S152. If the registration information is the communication interface information of the application, then the communication method is determined to be network communication.

[0186] The second approach may include:

[0187] S153. If the application's registration information does not exist, send a registration information retrieval request to the application, instructing the application to send the registration information to the network traffic analysis chip;

[0188] S154. Obtain registration information. If the registration information is an application read hook, then determine that the communication method is shared memory communication.

[0189] S155. If the registration information is the communication interface information of the application, then the communication method is determined to be network communication.

[0190] S16. Based on the communication method, send a network traffic protocol data structure to the application to instruct the application to perform security checks on network devices.

[0191] The steps in S16 above can be implemented in the following two ways:

[0192] The first method includes:

[0193] S161. If the communication method is shared memory communication and the shared memory space is full, send a memory overflow release request to the shared memory to instruct the shared memory to release the minimum memory space.

[0194] S162. Allocate memory space for the protocol header and the corresponding protocol body based on the remaining space in the shared memory;

[0195] S163. Write the network traffic protocol data structure into the memory space allocated in shared memory;

[0196] S164. Invoke the application's read hook and send a data read request to the application according to the preset multi-channel transmission strategy; the data read request is used to instruct the application to read the network traffic protocol data structure from shared memory.

[0197] The second method includes:

[0198] S165. If the communication method is network communication, then determine the data packet according to the network traffic protocol data structure;

[0199] S166. Send the data packet to the application through the communication interface, instructing the application to obtain the network traffic protocol data structure from the data packet according to the protocol data structure.

[0200] The specific execution process of S10 to S16 can be found in the description of the above embodiments. The implementation principle and technical effect are similar, and will not be repeated here.

[0201] like Figure 13 The diagram shown is a flowchart of a network traffic processing method provided in an embodiment of this application. This method is applied to an application and may include the following steps:

[0202] S201. Obtain the network traffic protocol data structure. The network traffic protocol data structure is determined by the network traffic parsing chip after parsing the network traffic data from the network device and the protocol data structure used for communication between the network traffic parsing chip and the application.

[0203] In this embodiment, the aforementioned network traffic protocol data structure can be determined by the network traffic parsing chip after parsing the network traffic data based on the network traffic data of the network device and the protocol data structure for communication between the network traffic parsing chip and the application.

[0204] Optionally, the network device can be a network device within a computer device or server. The network device can be a network card, gateway, bridge, network adapter, etc., and this embodiment does not limit the specific network device.

[0205] In practical applications, network traffic analysis chips can directly collect network traffic data from network devices. Additionally, in some scenarios, network traffic acquisition devices can collect network traffic data from network devices and send the collected data to the network traffic analysis chip in real time. Correspondingly, the network traffic analysis chip can receive the network traffic data sent by the network traffic acquisition device.

[0206] Optionally, the above-mentioned protocol data structure for communication with the application can be understood as a communication protocol between the network traffic parsing chip and the application, wherein the communication protocol may include a protocol header and a protocol body.

[0207] Specifically, the network traffic parsing chip can parse network traffic data based on the protocol data structure of the communication between the network traffic parsing chip and the application, and determine the network traffic protocol data structure. It should be noted that parsing can be understood as the process of encoding network traffic data.

[0208] In this embodiment, the network traffic protocol data structure may include at least one protocol header and at least one protocol body, with each protocol header having a corresponding protocol body. Optionally, the total number of protocol headers in the network traffic protocol data structure may be equal to the total number of protocol bodies in the network traffic protocol data structure, or it may be equal to the number of data packets in the protocol data structure.

[0209] It should be noted that the process of parsing network traffic data can break down large data into multiple smaller data, namely, at least one protocol header and at least one protocol body included in the network traffic protocol data structure. A protocol header and its corresponding protocol body can be referred to as a smaller data.

[0210] In this embodiment, the application can obtain the network traffic protocol data structure directly sent by the network traffic parsing chip. Alternatively, the network traffic parsing chip can send the network traffic protocol data structure to a third-party device, which then sends the network traffic protocol data to the application. Correspondingly, the application can also obtain the network traffic protocol data sent by the third-party device.

[0211] S202. Perform security testing on network devices based on network traffic protocol data structures.

[0212] In practical applications, based on the network traffic protocol data structure obtained in the preceding steps, security detection algorithms can be used to perform security detection on network devices according to the network traffic protocol data structure, so as to prevent attacks by malware, hackers and viruses based on the detection results and improve network security.

[0213] Optionally, the above security detection algorithm can be a signature detection method, behavior detection method, classification filtering method, etc., and this application embodiment does not limit it.

[0214] The technical solution in this application embodiment obtains a network traffic protocol data structure and performs security detection on network devices based on the network traffic protocol data structure. The network traffic protocol data structure obtained by this method is determined after parsing by a dedicated network traffic processing chip, thereby improving the parsing speed of network traffic data and further improving the acquisition speed of the network traffic protocol data structure. Simultaneously, the network traffic protocol data structure includes parsing network traffic data based on the protocol data structure used for communication with the application, splitting large data into smaller data, thereby improving the data transmission speed of the network traffic processing chip. This allows the application to quickly obtain the network traffic protocol data structure, further improving the speed of network device security detection and reducing the total time required for network device security detection. Furthermore, this method does not limit the application to relying on specific functional suites to achieve network device security detection, thus improving the broad applicability of security detection.

[0215] In practical applications, in order to establish a communication connection between the network traffic parsing chip and the application, it is necessary to first establish an association between the network traffic parsing chip and the application. The process of establishing the association between the network traffic parsing chip and the application is described below. In one embodiment, before performing the steps in S201 above, the method may further include: sending its own registration information to the network traffic parsing chip, instructing the network traffic parsing chip to determine the communication method with the application based on the registration information.

[0216] Specifically, the application can send its registration information to the network traffic analysis chip, instructing the chip to determine the communication method between itself and the application based on the registration information. Optionally, this registration information can be a read hook or communication interface information.

[0217] In one implementation, the network traffic parsing chip can determine the communication method between itself and the application based on the type of registration information.

[0218] In this embodiment, if the network traffic parsing chip detects that the registration information stored in its own memory is an application's read hook, it can determine that the communication method is shared memory communication; or, if the network traffic parsing chip detects that the registration information stored in its own memory is an application's communication interface information, it can determine that the communication method is network communication. Here, the aforementioned read hook refers to a hook function; the aforementioned communication interface information may include the name, identifier, location, etc., of the communication interface capable of implementing network communication. In this embodiment, the communication interface can be a Socket, which represents a standardized Transmission Control Protocol (TCP) / Internet Protocol (IP) stack calling interface.

[0219] The technical solution in this application embodiment can send its own registration information to the network traffic parsing chip, instructing the network traffic parsing chip to determine the communication method with the application based on the registration information, so that the network traffic parsing chip can send the network traffic protocol data structure to the application according to the corresponding communication method, thereby improving the success rate of the network traffic parsing chip sending the network traffic protocol data structure.

[0220] In one embodiment, such as Figure 14 As shown, the step of obtaining the network traffic protocol data structure in S201 above can be implemented in the following way:

[0221] S211. When the communication mode is shared memory communication mode, receive the data read request sent by the network traffic parsing chip.

[0222] It should be noted that when the communication method is shared memory communication, the network traffic parsing chip can write the network traffic protocol data structure into the shared memory, and after the writing is completed, it can send a data read request to the application. Correspondingly, the application can receive the data read request sent by the network traffic parsing chip.

[0223] S221. Based on the data read request, read the network traffic protocol data structure from the shared memory.

[0224] Furthermore, the application can respond to data read requests and read network traffic protocol data structures from shared memory.

[0225] In some scenarios, to avoid the invalidation of shared memory space, in practical applications, the shared memory space can be released promptly after reading the network traffic protocol data structure from the shared memory. Based on this, in one embodiment, before executing the steps in S202 above, the method may further include: if the communication method is shared memory communication, then after reading the network traffic protocol data structure, a memory release request is sent to the shared memory, instructing the shared memory to release the memory space corresponding to the network traffic protocol data structure.

[0226] The technical solution in this application embodiment can receive data read requests sent by the network traffic parsing chip when the communication mode is shared memory communication mode, thereby enabling timely reading of network traffic protocol data structures from shared memory according to the data read requests, and improving the acquisition speed of network traffic protocol data structures.

[0227] In one embodiment, such as Figure 15 As shown, the step of obtaining the network traffic protocol data structure in S201 above can be implemented in the following way:

[0228] S231. When the communication method is network communication, the data packets sent by the network traffic parsing chip are received through the communication interface; the data packets are determined by the network traffic parsing chip according to the network traffic protocol data structure.

[0229] Specifically, when the communication method is network communication, the network traffic parsing chip can package the network traffic protocol data structure into a data packet, and then send the network traffic protocol data structure to the application in the form of a data packet.

[0230] Correspondingly, the application can receive data packets sent by the network traffic analysis chip through the communication interface.

[0231] S241. Obtain the network traffic protocol data structure from the data packet according to the protocol data structure.

[0232] Furthermore, the application can extract the network traffic protocol data structure from the data packet based on the protocol data structure, namely at least one protocol header and the corresponding protocol body.

[0233] The technical solution in this application embodiment, when the communication method is network communication, receives data packets sent by the network traffic parsing chip through the communication interface, and obtains the network traffic protocol data structure from the data packets according to the protocol data structure; when the communication method is network communication, the method can use the corresponding data sending method to enable the application to successfully obtain the network traffic protocol data structure, thereby improving the success rate of the application side in obtaining the network traffic protocol data structure.

[0234] In one embodiment, this application also provides a network traffic processing method, applied to an application, such as... Figure 16 As shown, the method includes the following procedures:

[0235] S20. Send its own registration information to the network traffic analysis chip, instructing the network traffic analysis chip to determine the communication method with the application based on the registration information.

[0236] S21. Obtain the network traffic protocol data structure; the network traffic protocol data structure is determined by the network traffic parsing chip after parsing the network traffic data of the network device and the protocol data structure of the communication between the network traffic parsing chip and the application.

[0237] The steps in S21 above can be implemented in two ways:

[0238] The first approach may include:

[0239] S211. When the communication mode is shared memory communication, receive the data read request sent by the network traffic parsing chip;

[0240] S212. Based on the data read request, read the network traffic protocol data structure from the shared memory.

[0241] The second approach may include:

[0242] S213. When the communication method is network communication, the data packets sent by the network traffic parsing chip are received through the communication interface; the data packets are determined by the network traffic parsing chip according to the network traffic protocol data structure.

[0243] S214. Obtain the network traffic protocol data structure from the data packet according to the protocol data structure.

[0244] S22. If the communication method is shared memory communication, after reading the network traffic protocol data structure, a memory release request is sent to the shared memory to instruct the shared memory to release the memory space corresponding to the network traffic protocol data structure.

[0245] S23. Perform security testing on network devices based on network traffic protocol data structures.

[0246] The specific execution process of S20 to S23 can be found in the description of the above embodiments. The implementation principle and technical effect are similar, and will not be repeated here.

[0247] For ease of understanding, an interactive embodiment is used to illustrate the network traffic processing method. In one embodiment, this application also provides a network traffic processing method applied to a network traffic processing system, which includes a network traffic parsing chip and an application program, such as... Figure 17 As shown, the method includes the following procedures:

[0248] S30, the network traffic analysis chip, acquires network traffic data from network devices.

[0249] S31. The network traffic parsing chip obtains the protocol header corresponding to the protocol data structure based on the protocol data structure.

[0250] S32, the network traffic parsing chip parses network traffic data according to the protocol header.

[0251] S33, The network traffic parsing chip uses the parsed network traffic data as the protocol body corresponding to the protocol header.

[0252] S34. The network traffic parsing chip generates the network traffic protocol data structure based on the protocol header and protocol body.

[0253] S35, the network traffic analysis chip obtains the communication method between the application and the network traffic analysis chip.

[0254] The steps in S35 above can be implemented in two ways:

[0255] The first approach may include:

[0256] S351. If the application registration information exists, and the registration information is an application read hook, then the communication method is determined to be shared memory communication.

[0257] S352. If the registration information is the communication interface information of the application, then the communication method is determined to be network communication.

[0258] The second approach may include:

[0259] S353. If the application's registration information does not exist, send a registration information retrieval request to the application, instructing the application to send the registration information to the network traffic analysis chip;

[0260] S354. Obtain registration information. If the registration information is an application read hook, then determine that the communication method is shared memory communication.

[0261] S355. If the registration information is the communication interface information of the application, then the communication method is determined to be network communication.

[0262] S36 The network traffic parsing chip sends network traffic protocol data structures to the application based on the communication method.

[0263] The steps in S36 above can be implemented in two ways:

[0264] The first approach may include:

[0265] S361. If the communication method is shared memory communication, then if the shared memory space is full, a memory overflow release request is sent to the shared memory to instruct the shared memory to release the minimum memory space.

[0266] S362. Allocate memory space for the protocol header and the corresponding protocol body based on the remaining space in the shared memory;

[0267] S363. Write the network traffic protocol data structure into the memory space allocated in shared memory;

[0268] S364. Invoke the application's read hook and send a data read request to the application according to the preset multi-channel transmission strategy; the data read request is used to instruct the application to read the network traffic protocol data structure from shared memory.

[0269] The second approach may include:

[0270] S365. If the communication method is network communication, then determine the data packet according to the network traffic protocol data structure;

[0271] S366. Send data packets to the application through the communication interface, instructing the application to obtain the network traffic protocol data structure from the data packets according to the protocol data structure.

[0272] S37. The application obtains the network traffic protocol data structure.

[0273] The steps in S37 above can be implemented in two ways:

[0274] The first approach may include:

[0275] S371. When the communication mode is shared memory communication, receive the data read request sent by the network traffic parsing chip;

[0276] S372. Based on the data read request, read the network traffic protocol data structure from the shared memory.

[0277] The second approach may include:

[0278] S373. When the communication method is network communication, the data packets sent by the network traffic parsing chip are received through the communication interface; the data packets are determined by the network traffic parsing chip according to the network traffic protocol data structure.

[0279] S374. Obtain the network traffic protocol data structure from the data packet according to the protocol data structure.

[0280] S38. If the communication method is shared memory communication, after the application reads the network traffic protocol data structure, it sends a memory release request to the shared memory, instructing the shared memory to release the memory space corresponding to the network traffic protocol data structure.

[0281] S39. The application performs security checks on network devices based on the network traffic protocol data structure.

[0282] The specific execution process of S30 to S39 can be found in the description of the above embodiments. The implementation principle and technical effect are similar, and will not be repeated here.

[0283] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0284] Based on the same inventive concept, this application also provides a network traffic processing apparatus for implementing the network traffic processing method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more network traffic processing apparatus embodiments provided below can be found in the limitations of the network traffic processing method described above, and will not be repeated here.

[0285] In one embodiment, Figure 18 This is a schematic diagram of a network traffic processing device in one embodiment of this application. The network traffic processing device provided in this embodiment can be applied to a network traffic parsing chip. Figure 18 As shown, the network traffic processing device of this application embodiment may include: an acquisition module 11, a parsing module 12, and a sending module 13, wherein:

[0286] Module 11 is used to acquire network traffic data of network devices;

[0287] Parsing module 12 is used to parse network traffic data according to the protocol data structure of communication with the application and determine the network traffic protocol data structure;

[0288] The sending module 13 is used to send network traffic protocol data structures to the application to instruct the application to perform security checks on network devices.

[0289] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0290] In one embodiment, the parsing module 12 includes: a protocol header acquisition unit, a parsing unit, a determination unit, and a data structure generation unit, wherein:

[0291] The protocol header acquisition unit is used to acquire the protocol header corresponding to the protocol data structure based on the protocol data structure.

[0292] The parsing unit is used to parse network traffic data according to the protocol header;

[0293] The determining unit is used to use the parsed network traffic data as the protocol body corresponding to the protocol header;

[0294] The data structure generation unit is used to generate network traffic protocol data structures based on the protocol header and protocol body.

[0295] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0296] In one embodiment, the sending module 13 comprises a communication mode acquisition unit and a data structure generation unit, wherein:

[0297] The communication method acquisition unit is used to acquire the communication method with the application.

[0298] The data structure generation unit is used to send network traffic protocol data structures to the application based on the communication method.

[0299] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0300] In one embodiment, the communication method acquisition unit includes: a first determining subunit, wherein:

[0301] The first determining subunit is used to determine the communication method with the application based on the registration information if the application's registration information exists.

[0302] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0303] In one embodiment, the first determining subunit is specifically used for:

[0304] If the registration information is an application read hook, then the communication method is determined to be shared memory communication.

[0305] If the registration information is the application's communication interface information, then the communication method is determined to be network communication.

[0306] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0307] In one embodiment, the communication method acquisition unit includes: a sending subunit and a second determining subunit, wherein:

[0308] The sending subunit is used to send a registration information retrieval request to the application when the application's registration information does not exist, instructing the application to send the registration information to the network traffic parsing chip;

[0309] The second determining subunit is used to obtain registration information and determine the communication method with the application based on the registration information.

[0310] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0311] In one embodiment, the data structure generation unit includes: a writing subunit and a sending subunit, wherein:

[0312] The write sub-unit is used to write network traffic protocol data structures into shared memory when the communication mode is shared memory communication.

[0313] The sending subunit is used to send a data read request to the application; the data read request is used to instruct the application to read the network traffic protocol data structure from shared memory.

[0314] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0315] In one embodiment, the write subunit includes: a space allocation subunit and a third determination subunit, wherein:

[0316] The space allocation subunit is used to allocate memory space in shared memory for the protocol header and corresponding protocol body in the network traffic protocol data structure, based on shared memory.

[0317] The third determining subunit is used to write the network traffic protocol data structure into the memory space allocated in shared memory.

[0318] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0319] In one embodiment, the space allocation subunit is specifically used for:

[0320] If the shared memory space is full, a memory overflow release request is sent to the shared memory, instructing the shared memory to release the minimum memory space;

[0321] Based on the remaining space in the shared memory, memory space is allocated for the protocol header and the corresponding protocol body.

[0322] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0323] In one embodiment, the transmitting subunit is specifically used for:

[0324] Invoke the application's read hook and send a data read request to the application according to the preset multi-channel transmission strategy.

[0325] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0326] In one embodiment, the second determining subunit is specifically used for:

[0327] If the communication method is network communication, then the data packets are determined according to the network traffic protocol data structure;

[0328] The data packet is sent to the application through the communication interface, instructing the application to retrieve the network traffic protocol data structure from the data packet according to the protocol data structure.

[0329] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0330] In one embodiment, Figure 19 This is a schematic diagram of a network traffic processing device in one embodiment of this application. The network traffic processing device provided in this embodiment can be applied to applications. Figure 19 As shown, the network traffic processing device in this embodiment of the application may include: an acquisition module 21 and a detection module 22, wherein:

[0331] The acquisition module 21 is used to acquire the network traffic protocol data structure. The network traffic protocol data structure is determined by the network traffic parsing chip after acquiring the network traffic data of the network device and parsing the network traffic data according to the protocol data structure for communication with the application.

[0332] The detection module 22 is used to perform security detection of network devices based on the network traffic protocol data structure.

[0333] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0334] In one embodiment, the network traffic processing device further includes: a registration information sending module, wherein:

[0335] The registration information sending module is used to send its own registration information to the network traffic analysis chip, instructing the network traffic analysis chip to determine the communication method with the application based on the registration information.

[0336] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0337] In one embodiment, the acquisition module 21 includes a receiving unit and a reading unit, wherein:

[0338] The receiving unit is used to receive data read requests sent by the network traffic parsing chip when the communication mode is shared memory communication.

[0339] The read unit is used to read network traffic protocol data structures from shared memory according to data read requests.

[0340] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0341] In one embodiment, the acquisition module 21 includes: a receiving unit and an acquisition unit, wherein:

[0342] The receiving unit is used to receive data packets sent by the network traffic analysis chip through the communication interface when the communication mode is network communication; the data packets are determined by the network traffic analysis chip according to the network traffic protocol data structure.

[0343] The acquisition unit is used to obtain the network traffic protocol data structure from the data packet according to the protocol data structure.

[0344] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0345] In one embodiment, the network traffic processing apparatus further includes a sending module, wherein:

[0346] The sending module is used to send a memory release request to the shared memory after reading the network traffic protocol data structure when the communication mode is shared memory communication, instructing the shared memory to release the memory space corresponding to the network traffic protocol data structure.

[0347] The network traffic processing device provided in this application embodiment can be used to execute the technical solutions in the above-described network traffic processing method embodiments of this application. Its implementation principle and technical effect are similar, and will not be repeated here.

[0348] Specific limitations regarding the network traffic processing device can be found in the limitations of the network traffic processing method described above, and will not be repeated here. Each module in the aforementioned network traffic processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0349] In one embodiment, a computer device is provided, see [link to previous embodiment]. Figure 20 . Figure 20 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Figure 20The computer device shown includes a transceiver, at least one processor, memory, at least one network interface, and a user interface. The various components of the computer device are coupled together via a bus system. It is understood that the bus system is used to implement communication between these components. In addition to a data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 20 In this application, all types of buses are labeled as bus systems. Furthermore, in the embodiments of this application, a transceiver may be multiple elements, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium.

[0350] The user interface may include a display, keyboard, or clicking device (e.g., mouse, trackball, touchpad, or touchscreen).

[0351] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory of the systems and methods described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0352] In some implementations, the memory stores elements such as executable modules or data structures, or other subsets or extensions thereof: operating systems and applications.

[0353] The operating system includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application programs include various applications, such as media players and browsers, used to implement various application functions. Programs implementing the methods of the embodiments of this application can be included in the application programs.

[0354] In the embodiments of this application, a program or instruction stored in the memory is invoked; specifically, it may be a program or instruction stored in an application program.

[0355] The methods disclosed in the embodiments of this application can be applied to a processor, implemented by a processor, or implemented by a processor in conjunction with other components (e.g., a transceiver). The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0356] It is understood that the embodiments described in this application can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in this application, or combinations thereof.

[0357] For software implementation, the techniques described in the embodiments of this application can be implemented by modules (e.g., procedures, functions, etc.) that perform the functions described in the embodiments of this application. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or externally.

[0358] Those skilled in the art will understand that Figure 20 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0359] In one embodiment, a computer device is also provided, including a transceiver, a memory, and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method in any of the above embodiments.

[0360] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in any of the above embodiments.

[0361] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method in any of the above embodiments.

[0362] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0363] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0364] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A network traffic processing method, characterized by, The method is applied to a network traffic analysis chip, and comprises the following steps: Obtaining network traffic data of a network device in a computer device; According to a protocol data structure for communication with an application program, the network traffic data is analyzed to split large data into multiple small data, and a network traffic protocol data structure is determined; the protocol data structure is a communication protocol between the network traffic analysis chip and the application program in communication, a protocol header in the protocol data structure includes a protocol body length, an identification of a protocol body, and a protocol body data type; the large data is network traffic data, and the small data is a protocol header and a corresponding protocol body; a protocol header and a corresponding protocol body in the network traffic protocol data structure read by different processes of the application program are different; different processes correspond to different reading hooks, or different processes correspond to different communication interfaces; The network traffic protocol data structure is sent to the application program to instruct the application program to perform security detection of the network device; the application program is deployed on the computer device.

2. The method of claim 1, wherein, According to the protocol data structure, the network traffic data is analyzed to split large data into multiple small data, and a network traffic protocol data structure is determined, comprising: According to the protocol data structure, a protocol header corresponding to the protocol data structure is obtained; According to the protocol header, the network traffic data is analyzed; The analyzed network traffic data is taken as a protocol body corresponding to the protocol header; According to the protocol header and the protocol body, the network traffic protocol data structure is generated.

3. The method according to claim 1 or 2, characterized in that, The network traffic protocol data structure is sent to the application program, comprising: Obtaining a communication mode between the application program; According to the communication mode, the network traffic protocol data structure is sent to the application program.

4. The method of claim 3, wherein, The communication mode between the application program is obtained, comprising: In a case where registration information of the application program exists, the communication mode between the application program is determined according to the registration information.

5. The method of claim 4, wherein, According to the registration information, the communication mode between the application program is determined, comprising: If the registration information is a reading hook of the application program, it is determined that the communication mode is a shared memory communication mode; If the registration information is communication interface information of the application program, it is determined that the communication mode is a network communication mode.

6. The method of claim 3, wherein, The communication mode between the application program is obtained, comprising: In a case where registration information of the application program does not exist, a registration information obtaining request is sent to the application program to instruct the application program to send the registration information to the network traffic analysis chip; The registration information is obtained, and the communication mode between the application program is determined according to the registration information.

7. The method of claim 3, wherein, According to the communication mode, the network traffic protocol data structure is sent to the application program, comprising: If the communication mode is a shared memory communication mode, the network traffic protocol data structure is written into shared memory; sending a data read request to the application; the data read request is used to instruct the application to read the network traffic protocol data structure from the shared memory.

8. The method of claim 7, wherein, The writing of the network traffic protocol data structure into shared memory comprises: allocating memory space for the protocol header and the corresponding protocol body in the network traffic protocol data structure in the shared memory according to the shared memory; writing the network traffic protocol data structure into the allocated memory space in the shared memory.

9. The method of claim 8, wherein, The allocating of memory space for the protocol header and the corresponding protocol body in the network traffic protocol data structure according to the shared memory comprises: if the space of the shared memory is full, sending a memory overflow release request to the shared memory to instruct the shared memory to release the minimum memory space; allocating memory space for the protocol header and the corresponding protocol body according to the remaining space in the shared memory.

10. The method of claim 7, wherein, The sending of the data read request to the application comprises: calling the read hook of the application to send the data read request to the application according to the preset multi-channel transmission strategy.

11. The method of claim 3, wherein, The sending of the network traffic protocol data structure to the application according to the communication mode comprises: if the communication mode is a network communication mode, determining a data packet according to the network traffic protocol data structure; sending the data packet to the application through a communication interface to instruct the application to obtain the network traffic protocol data structure from the data packet according to the protocol data structure.

12. A network traffic processing method, characterized by, The method applied to an application comprises: obtaining a network traffic protocol data structure; the network traffic protocol data structure is determined after a network traffic analysis chip analyzes network traffic data of a network device in a computer device and a protocol data structure for communication between the network traffic analysis chip and the application, and splits big data into multiple small data; the protocol data structure is a communication protocol between the network traffic analysis chip and the application, a protocol header in the protocol data structure comprises a protocol body length, a protocol body identifier, and a protocol body data type; the big data is network traffic data, and the small data is a protocol header and a corresponding protocol body; protocol headers and corresponding protocol bodies in the network traffic protocol data structures read by different processes of the application are different; different processes correspond to different read hooks or different communication interfaces; performing security detection on the network device according to the network traffic protocol data structure; the application is deployed on the computer device.

13. The method of claim 12, wherein, Before the obtaining of the network traffic protocol data structure, the method further comprises: sending registration information of the application to the network traffic analysis chip to instruct the network traffic analysis chip to determine a communication mode between the network traffic analysis chip and the application according to the registration information.

14. The method of claim 13, wherein, The obtaining of the network traffic protocol data structure comprises: in a case where the communication mode is a shared memory communication mode, receiving a data read request sent by the network traffic analysis chip; According to the data read request, the network traffic protocol data structure is read from the shared memory.

15. The method of claim 13, wherein, The network traffic protocol data structure is obtained, including: In the case of network communication, the data packet sent by the network traffic analysis chip is received through the communication interface; the data packet is determined by the network traffic analysis chip according to the network traffic protocol data structure; According to the protocol data structure, the network traffic protocol data structure is obtained from the data packet.

16. The method according to any one of claims 12-15, characterized in that, Before the network device security detection according to the network traffic protocol data structure, the method further comprises: If the communication mode is shared memory communication mode, after reading the network traffic protocol data structure, a memory release request is sent to the shared memory, instructing the shared memory to release the memory space corresponding to the network traffic protocol data structure.

17. A network traffic processing device, comprising: The device comprises: An acquisition module is configured to acquire network traffic data of a network device in a computer device; An analysis module is configured to analyze the network traffic data according to a protocol data structure for communication with an application program, to split large data into multiple small data, and to determine a network traffic protocol data structure; the protocol data structure is a communication protocol between a network traffic analysis chip and the application program communication, a protocol header in the protocol data structure includes a protocol body length, a protocol body identifier, and a protocol body data type; the large data is network traffic data, and the small data is a protocol header and a corresponding protocol body; the protocol header and the corresponding protocol body in the network traffic protocol data structure read by different processes of the application program are different; different processes correspond to different reading hooks, or different processes correspond to different communication interfaces; A sending module is configured to send the network traffic protocol data structure to the application program, to instruct the application program to perform network device security detection; the application program is deployed on the computer device.

18. A network traffic processing device, comprising: The device comprises: An acquisition module is configured to acquire a network traffic protocol data structure; the network traffic protocol data structure is determined by a network traffic analysis chip acquiring network traffic data of a network device in a computer device, analyzing the network traffic data according to a protocol data structure for communication with an application program, and splitting large data into multiple small data; the protocol data structure is a communication protocol between a network traffic analysis chip and the application program communication, a protocol header in the protocol data structure includes a protocol body length, a protocol body identifier, and a protocol body data type; the large data is network traffic data, and the small data is a protocol header and a corresponding protocol body; the protocol header and the corresponding protocol body in the network traffic protocol data structure read by different processes of the application program are different; different processes correspond to different reading hooks, or different processes correspond to different communication interfaces; A detection module is configured to perform network device security detection according to the network traffic protocol data structure; the application program is deployed on the computer device. 19.A computer device, comprising a transceiver, a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-18. The computer program is executed by the processor to implement the steps of the method of any one of claims 1-16.

20. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-16.

21. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-16.

Images