Traffic data forensics analysis method and device, computer equipment and storage medium

Abstract

Embodiments of the present application disclose a traffic data forensic analysis method and device, computer equipment and a storage medium. The method comprises: converting a captured data traffic condition configuration and an operation button into a command line; executing the command line to obtain a traffic data packet; importing a historical traffic data packet; analyzing the traffic data packet and the historical traffic data packet to obtain an analysis result; saving the analysis result; obtaining a voice query request; querying corresponding content from the analysis result according to the voice query request and converting the corresponding content into a voice file; and exporting the voice file. The method of the embodiments of the present application can meet the high safety requirements of the electronic industry and the simple operation and fast evidence obtaining speed in the specific case handling process.

Description

TECHNICAL FIELD

[0001] The present application relates to an electronic evidence method, more particularly to a traffic data forensic analysis method and device, a computer equipment and a storage medium. BACKGROUND

[0002] With the continuous growth of the number of Internet of Things devices and their widespread application in various industries. At present, there are many types of Internet of Things devices involved in various cases, and the electronic data stored therein has become an important evidence source, and the traffic data is particularly important and is an important breakthrough for case evidence. It is necessary to ensure the quality and efficiency of data extraction; due to the need for security, confidentiality and data integrity in the electronic evidence industry, the requirements for the capture tool and the use of related technology in the evidence process are high;

[0003] There are many methods for extracting traffic data from Internet of Things devices and servers at present: one is a network packet capture tool, which can capture data packets passing through the server by using network packet capture tools such as Wireshark, tcpdump, etc. Online intercepts various network packets, displays detailed information of network packets, and can analyze existing message numbers. Two is a proxy server, which can forward and filter all traffic through the proxy server by configuring a proxy server on the server. Three is a firewall log, which can obtain all traffic information in and out of the server by checking the firewall log on the server. Four is an application program monitoring tool, which can monitor the traffic of all application programs on the server by using an application program monitoring tool (such as New Relic, etc.). However, the network packet capture tool requires inputting the corresponding command line, which has certain technical requirements for the operation user; the captured traffic can only obtain one type of data each time, and the efficiency of data acquisition is not high; the packet capture tool may not be able to parse some data types; the proxy server may affect the performance of the server; there may be security risks, and the proxy server needs to be configured on the server device, which may be attacked by hackers or infected with viruses, thus posing a security risk in the case handling process; the firewall log only records the traffic information in and out of the server, and does not record the data of the traffic itself, so it cannot analyze the data of the sending end; the firewall log data is complex and cannot be quickly and effectively analyzed; the application program monitoring tool needs to be installed on the server, which may affect the performance of the server device; there may be security risks, and the monitoring tool needs to be installed, which may damage the originality of the server device and may be attacked by hackers or infected with viruses, thus posing a security risk in the case handling process.

[0004] In summary, the current market traffic data acquisition methods and technologies cannot meet the high security requirements of the electronic industry and the simple operation, fast evidence speed scenarios in the specific case handling process.

[0005] Therefore, it is necessary to design a new method to meet the high security requirements of the electronic industry and the simple operation and fast evidence collection in the specific case process. SUMMARY

[0006] The present application aims to overcome the defects of the prior art and provide a traffic data forensic analysis method and device, computer equipment and storage medium.

[0007] To achieve the above-mentioned purpose, the present application adopts the following technical solution: a traffic data forensic analysis method, comprising:

[0008] The captured data flow condition configuration and the operation button are converted into a command line;

[0009] The command line is executed to obtain a traffic data packet;

[0010] The historical traffic data packet is imported;

[0011] The traffic data packet and the historical traffic data packet are parsed to obtain a parsing result;

[0012] The parsing result is saved;

[0013] A voice query request is obtained;

[0014] According to the voice query request, corresponding content is queried from the parsing result and converted into a voice file;

[0015] The voice file is exported.

[0016] Further technical solutions are as follows: the captured data flow condition configuration and the operation button are converted into a command line, comprising:

[0017] By calling the tshark tool, the terminal customized configuration condition is recognized and converted into a command line;

[0018] By calling the tshark tool, the start capture button operation and the stop capture button operation are converted into a command line.

[0019] Further technical solutions are as follows: the command line is executed to obtain a traffic data packet, comprising:

[0020] The command line is executed, and in the process of capturing a traffic data packet, the captured traffic data is generated into a corresponding data packet according to the configuration condition;

[0021] The data packet is stored in the form of a file to obtain a traffic data packet.

[0022] Further technical solutions are as follows: the traffic data packet and the historical traffic data packet are parsed to obtain a parsing result, including:

[0023] The historical traffic data packet is parsed by a tshark conversion command to obtain a conversion result;

[0024] The traffic data packet is classified according to different capture protocols by using a Task tool to obtain a classification result;

[0025] The classification result and the conversion result are parsed by an execution command to obtain a parsing result.

[0026] Further technical solutions are as follows: the parsing result is saved, including:

[0027] The parsing result is cached in a data list form and saved into a storage path.

[0028] Further technical solutions are as follows: the corresponding content is queried from the parsing result according to the voice query request, and converted into a voice file, including:

[0029] The corresponding id is determined by a tshark command according to the voice query request;

[0030] The payload is determined from the parsing result according to the id, and converted into a voice file.

[0031] Further technical solutions are as follows: the payload is determined from the parsing result according to the id, and converted into a voice file, including:

[0032] The payload is determined from the parsing result according to the id, and saved as a hexadecimal file;

[0033] The hexadecimal file is saved as a raw file, and the raw file is converted into a voice file by sox.

[0034] The application also provides a traffic data forensic analysis device, including:

[0035] A conversion unit is configured to convert capture data traffic condition configuration and operation buttons into command lines;

[0036] A data packet acquisition unit is configured to execute the command lines to acquire traffic data packets;

[0037] An import unit is configured to import historical traffic data packets;

[0038] A parsing unit is configured to parse the traffic data packets and the historical traffic data packets to obtain a parsing result.

[0039] A storage unit is configured to store the analysis result.

[0040] A request acquisition unit is configured to acquire a voice query request.

[0041] A query unit is configured to query corresponding content from the analysis result according to the voice query request and convert the corresponding content into a voice file.

[0042] An export unit is configured to export the voice file.

[0043] The application further provides a computer device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the method described above when executing the computer program.

[0044] The application further provides a storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method described above.

[0045] Compared with the prior art, the application has the following beneficial effects: the application converts the self-defined capture data flow condition configuration and operation button into a command line, executes the command line to capture flow data packets, supports the reimport of historical flow data packets, analyzes the flow data packets and the historical flow data packets, performs fast evidence collection, converts the query into a voice file output, and realizes the high safety requirement of the electronic industry and the simple operation and fast evidence collection in the specific case handling process.

[0046] The application will be further described below in combination with the drawings and specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0048] Figure 1 The application provides a traffic data evidence collection and analysis method and an application scenario thereof.

[0049] Figure 2 The application provides a traffic data evidence collection and analysis method and a flowchart thereof.

[0050] Figure 3 The application provides a traffic data evidence collection and analysis method and a subflowchart thereof.

[0051] Figure 4A sub-flow schematic diagram of the traffic data forensic analysis method provided by the embodiment of the present application is shown in FIG. 1;

[0052] Figure 5 A sub-flow schematic diagram of the traffic data forensic analysis method provided by the embodiment of the present application is shown in FIG. 1;

[0053] Figure 6 A sub-flow schematic diagram of the traffic data forensic analysis method provided by the embodiment of the present application is shown in FIG. 1;

[0054] Figure 7 A sub-flow schematic diagram of the traffic data forensic analysis method provided by the embodiment of the present application is shown in FIG. 1;

[0055] Figure 8 A schematic block diagram of the traffic data forensic analysis device provided by the embodiment of the present application is shown in FIG. 2;

[0056] Figure 9 A schematic block diagram of the conversion unit of the traffic data forensic analysis device provided by the embodiment of the present application is shown in FIG. 3;

[0057] Figure 10 A schematic block diagram of the data packet acquisition unit of the traffic data forensic analysis device provided by the embodiment of the present application is shown in FIG. 4;

[0058] Figure 11 A schematic block diagram of the analysis unit of the traffic data forensic analysis device provided by the embodiment of the present application is shown in FIG. 5;

[0059] Figure 12 A schematic block diagram of the query unit of the traffic data forensic analysis device provided by the embodiment of the present application is shown in FIG. 6;

[0060] Figure 13 A schematic block diagram of the file conversion sub-unit of the traffic data forensic analysis device provided by the embodiment of the present application is shown in FIG. 7;

[0061] Figure 14 A schematic block diagram of the computer device provided by the embodiment of the present application is shown in FIG. 8. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0063] It should be understood that the terms "comprises" and "comprising," when used in this specification and the following claims, indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0064] It should also be understood that the terms used in the specification and the appended claims are intended to describe particular embodiments and do not intend to limit the present application. As used in the specification and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0065] It should further be understood that the term "and / or" used in the specification and the appended claims means one or more of the associated listed items as well as all possible combinations thereof and includes these combinations.

[0066] Referring to Figure 1 and Figure 2 , Figure 1 The application scenario diagram of the traffic data forensic analysis method provided by the embodiment of the present application. Figure 2 The schematic flowchart of the traffic data forensic analysis method provided by the embodiment of the present application. The traffic data forensic analysis method is applied to a server, which performs data interaction with a terminal, realizes support for user self-defined setting of capture conditions, and realizes precise query and export saving functions on data results. The historical traffic packets can also be imported into the software again for viewing, and the forensic requirements can be quickly completed. At the same time, it is convenient for data archiving and viewing operations, and can meet the use conditions of the user in various business scenarios in the forensic process.

[0067] Figure 2 is the flowchart of the traffic data forensic analysis method provided by the embodiment of the present application. As Figure 2 shown, the method comprises the following steps S110 to S180.

[0068] S110, convert the capture data flow condition configuration and operation button into a command line.

[0069] In the embodiment, the capture data flow condition configuration is a condition for capturing which type of data flow, etc., formed by the terminal self-definition, and the operation button includes the behavior of the buttons such as operation start and stop.

[0070] In an embodiment, referring to Figure 3 , the above step S110 can comprise steps S111-S112.

[0071] S111, identify the terminal customized configuration condition by calling the tshark tool, and convert it into a command line.

[0072] In the embodiment, the user can customize the setting of the capture condition, and the data result can be accurately queried and exported and saved.

[0073] S112, convert the start capture button operation and the stop capture button operation into a command line by calling the tshark tool.

[0074] In the embodiment, the user first configures the condition of capturing the traffic data through the console of the system, i.e., the terminal. The server identifies the configuration condition by calling the tshark tool, and converts it into a command line for execution. In addition, the start capture button operation and the stop capture button operation are also converted into the start command and the stop command by the tshark tool. The server will capture the traffic data according to the command line.

[0075] S120, execute the command line to obtain the traffic data packet.

[0076] In the embodiment, the traffic data packet refers to the data packet formed by storing the relevant traffic data captured according to the configured condition.

[0077] In an embodiment, refer to Figure 4 The above step S120 can include steps S121-S122.

[0078] S121, execute the command line, and generate the corresponding data packet from the captured traffic data according to the configuration condition in the process of capturing the traffic data packet;

[0079] S122, store the data packet in the form of a file to obtain the traffic data packet.

[0080] In the embodiment, the server saves the traffic data while capturing the traffic data, generates the corresponding data packet according to the configured condition, and stores the data packet in the form of a file.

[0081] S130, import the historical traffic data packet.

[0082] In the embodiment, the historical traffic packet can be imported into the software again for viewing by setting the storage path, and the requirement of forensics can be quickly met.

[0083] S140, analyze the traffic data packet and the historical traffic data packet to obtain an analysis result.

[0084] In the embodiment, the analysis result refers to analysis of the traffic data packet and the historical traffic data packet by the execution command, and the total number of items formed thereby.

[0085] In an embodiment, referring to Figure 5 The step S140 can include steps S141-S143.

[0086] S141, the historical traffic data packet is parsed by the tshark conversion command to obtain a conversion result.

[0087] In the embodiment, the conversion result refers to the result formed by parsing the historical traffic data packet by the tshark conversion command.

[0088] Specifically, the return value thereof is obtained by the command, and the conversion result is obtained by performing segmentation according to a specific character.

[0089] S142, the traffic data packet is classified according to different capture protocols by using the Task tool to obtain a classification result.

[0090] In the embodiment, the classification result refers to the result formed by classifying the traffic data packet according to different capture protocols (SSH, Http, SIP) by using the Task tool.

[0091] Specifically, the return value of each protocol thereof is obtained by the command, the segmented character result is found, and finally the result is obtained by parsing the command.

[0092] Specifically, the traffic data packet is segmented by tshark-n-r.

[0093] S143, the classification result and the conversion result are parsed by the execution command to obtain an analysis result.

[0094] In the embodiment, the classification result and the conversion result are parsed by the execution command, and then the total number of parsed items progress is presented.

[0095] Specifically, the return value of each protocol thereof is obtained by the command, the segmented character result is found, and finally the result is obtained by parsing the command.

[0096] S150, the analysis result is saved.

[0097] In the embodiment, the analysis result is cached in the form of a data list, and saved to a storage path. Query and storage in the form of a csv file are realized.

[0098] S160, a voice query request is obtained.

[0099] In the embodiment, the voice query request refers to a request input by the terminal for querying the traffic data.

[0100] S170, querying the corresponding content from the analysis result according to the voice query request and converting into a voice file.

[0101] In an embodiment, referring to Figure 6 The step S170 can include steps S171-S172.

[0102] S171, determining the corresponding id by the tshark command according to the voice query request.

[0103] In the embodiment, the payload of the analysis result has a unique id, so the corresponding payload can be queried by determining the id.

[0104] S172, determining the payload from the analysis result according to the id and converting into a voice file.

[0105] Specifically, the method of determining the payload is to determine the payload by the search command based on the condition of the id.

[0106] In an embodiment, referring to Figure 7 The step S172 can include steps S1721-S1722.

[0107] S1721, determining the payload from the analysis result according to the id and saving the payload as a hexadecimal file;

[0108] S1722, saving the hexadecimal file as a raw file and converting the raw file into a voice file by sox.

[0109] S180, exporting the voice file.

[0110] The method of the embodiment can assist the forensic personnel to quickly and effectively capture the traffic data information of the Internet of Things or server equipment in the case handling site, and analyze the data in time. The operation is simple and convenient for non-technical personnel to operate. It supports the clue source information in the case handling process, breaks the difficulty of low speed of the past evidence collection, and provides a safe use environment for users. The protocol selection and capture setting are adopted, so that the configuration dimension of the traffic data capture condition is comprehensive; the capture traffic packet and the analysis speed are fast; the accurate query, csv export, and voice export functions of the traffic data analysis are supported; and the historical traffic data packet is supported to be imported again.

[0111] The flow data forensic analysis method disclosed by the application can meet the high safety requirement of the electronic industry and the simple operation and fast evidence obtaining in the specific case handling process.

[0112] Figure 8 is a schematic block diagram of a flow data forensic analysis device 300 provided by an embodiment of the application. As shown in Figure 8 corresponding to the flow data forensic analysis method, the application further provides a flow data forensic analysis device 300. The flow data forensic analysis device 300 comprises units for executing the flow data forensic analysis method, and the device can be configured in a server. Specifically, referring to Figure 8 , the flow data forensic analysis device 300 comprises a conversion unit 301, a data packet acquisition unit 302, an import unit 303, an analysis unit 304, a saving unit 305, a request acquisition unit 306, a query unit 307 and an export unit 308.

[0113] The conversion unit 301 is configured to convert the capture data flow condition configuration and the operation button into a command line; the data packet acquisition unit 302 is configured to execute the command line to acquire the flow data packet; the import unit 303 is configured to import the historical flow data packet; the analysis unit 304 is configured to analyze the flow data packet and the historical flow data packet to obtain an analysis result; the saving unit 305 is configured to save the analysis result; the request acquisition unit 306 is configured to acquire a voice query request; the query unit 307 is configured to query the corresponding content from the analysis result according to the voice query request and convert the corresponding content into a voice file; and the export unit 308 is configured to export the voice file.

[0114] In an embodiment, as shown in Figure 9 , the conversion unit 301 comprises a first conversion subunit 3011 and a second conversion subunit 3012.

[0115] The first conversion subunit 3011 is configured to identify the configuration condition customized by the terminal by calling the tshark tool and convert the configuration condition into a command line; and the second conversion subunit 3012 is configured to convert the start capture button operation and the stop capture button operation into a command line by calling the tshark tool.

[0116] In an embodiment, as shown in Figure 10 , the data packet acquisition unit 302 comprises a data packet generation subunit 3021 and a storage subunit 3022.

[0117] The data packet generation subunit 3021 is configured to execute the command line and generate corresponding data packets from the captured traffic data according to the configuration condition in the process of capturing the traffic data packets; and the storage subunit 3022 is configured to store the data packets in the form of files to obtain the traffic data packets.

[0118] In an embodiment, as shown in Figure 11 The analysis unit 304 includes a history analysis subunit 3041, a classification subunit 3042, and a command analysis subunit 3043.

[0119] The history analysis subunit 3041 is configured to analyze the history traffic data packets by tshark conversion command to obtain a conversion result; the classification subunit 3042 is configured to classify the traffic data packets according to different capture protocols by using a Task tool to obtain a classification result; and the command analysis subunit 3043 is configured to analyze the classification result and the conversion result according to the execution command to obtain an analysis result.

[0120] In an embodiment, the saving unit 305 is configured to cache the analysis result in the form of a data list and save it into a storage path.

[0121] In an embodiment, as shown in Figure 12 The query unit 307 includes an ID determination subunit 3071 and a file conversion subunit 3072.

[0122] The ID determination subunit 3071 is configured to determine a corresponding id by tshark command according to the voice query request; and the file conversion subunit 3072 is configured to determine a payload from the analysis result according to the id and convert it into a voice file.

[0123] In an embodiment, as shown in Figure 13 The file conversion subunit 3072 includes a first saving module 30721 and a second saving module 30722.

[0124] The first saving module 30721 is configured to determine a payload from the analysis result according to the id and save the payload as a hexadecimal file; and the second saving module 30722 is configured to save the hexadecimal file as a raw file and convert the raw file into a voice file by sox.

[0125] It should be noted that the specific implementation process of the traffic data forensics analysis device 300 and each unit can be clearly understood by those skilled in the art, which can be referred to the corresponding description in the foregoing method embodiments. For the convenience and brevity of description, it will not be described here.

[0126] The flow data forensics analysis device 300 can be implemented in the form of a computer program, which can run on a computer device as shown in the figure. Figure 14 The flow data forensics analysis device 300 can be implemented in the form of a computer program, which can run on a computer device as shown in the figure.

[0127] Please refer to Figure 14 , Figure 14 is a schematic block diagram of a computer device provided by an embodiment of the present application. The computer device 500 can be a server, wherein the server can be a stand-alone server or a server cluster composed of multiple servers.

[0128] Referring to Figure 14 , the computer device 500 includes a processor 502, a memory, and a network interface 505 connected through a system bus 501, wherein the memory can include a non-volatile storage medium 503 and an internal memory 504.

[0129] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, which, when executed, can cause the processor 502 to perform a flow data forensics analysis method.

[0130] The processor 502 is configured to provide computing and control capabilities to support the operation of the entire computer device 500.

[0131] The internal memory 504 provides an environment for the running of the computer program 5032 in the non-volatile storage medium 503, which, when executed by the processor 502, can cause the processor 502 to perform a flow data forensics analysis method.

[0132] The network interface 505 is configured to perform network communication with other devices. Those skilled in the art can understand that Figure 14 the structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device 500 to which the scheme of the present application is applied. The specific computer device 500 can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0133] The processor 502 is configured to run the computer program 5032 stored in the memory to implement the following steps:

[0134] The captured data flow condition configuration and operation button are converted into a command line; the command line is executed to obtain a traffic data packet; historical traffic data packets are imported; the traffic data packet and the historical traffic data packet are parsed to obtain a parsing result; the parsing result is saved; a voice query request is obtained; corresponding content is queried from the parsing result according to the voice query request, and is converted into a voice file; and the voice file is exported.

[0135] In an embodiment, the processor 502, when implementing the step of converting the captured data flow condition configuration and operation button into a command line, specifically implements the following steps:

[0136] The terminal customized configuration condition is identified by calling a tshark tool, and is converted into a command line; the start capturing button operation and the stop capturing button operation are converted into a command line by calling the tshark tool.

[0137] In an embodiment, the processor 502, when implementing the step of executing the command line to obtain a traffic data packet, specifically implements the following steps:

[0138] The command line is executed, and in the process of capturing a traffic data packet, the captured traffic data is generated into a corresponding data packet according to the configuration condition; and the data packet is stored in the form of a file to obtain a traffic data packet.

[0139] In an embodiment, the processor 502, when implementing the step of parsing the traffic data packet and the historical traffic data packet to obtain a parsing result, specifically implements the following steps:

[0140] The historical traffic data packet is parsed to obtain a conversion result by using a tshark conversion command; the traffic data packet is classified according to different capturing protocols to obtain a classification result by using a Task tool; and the classification result and the conversion result are parsed according to an execution command to obtain a parsing result.

[0141] In an embodiment, the processor 502, when implementing the step of saving the parsing result, specifically implements the following steps:

[0142] The parsing result is cached in the form of a data list and is saved to a storage path.

[0143] In an embodiment, the processor 502, when implementing the step of querying corresponding content from the parsing result according to the voice query request and converting the corresponding content into a voice file, specifically implements the following steps:

[0144] The corresponding id is determined according to the voice query request by using a tshark command; and the payload is determined from the parsing result according to the id and is converted into a voice file.

[0145] In an embodiment, the processor 502 implements the following steps when implementing the step of determining the payload from the parsing result according to the id and converting into a voice file:

[0146] determining the payload from the parsing result according to the id, saving the payload as a hexadecimal file, saving the hexadecimal file as a raw file, and converting the raw file into a voice file through sox.

[0147] It should be understood that, in the embodiments of the present application, the processor 502 can be a central processing unit (CPU), and the processor 502 can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0148] It can be understood by those skilled in the art that all or part of the processes in the method of the above embodiment can be completed by a computer program instructing related hardware. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the above-mentioned embodiment of the method.

[0149] Therefore, the present application also provides a storage medium. The storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program is executed by a processor to make the processor perform the following steps:

[0150] The captured data flow condition configuration and the operation button are converted into a command line, the command line is executed to obtain a flow data packet, historical flow data packets are imported, the flow data packet and the historical flow data packet are parsed to obtain a parsing result, the parsing result is saved, a voice query request is obtained, corresponding content is queried from the parsing result according to the voice query request, and a voice file is converted.

[0151] In an embodiment, the processor, when executing the computer program to implement the step of configuring the capture data flow condition and converting the operation button into a command line, implements the following steps:

[0152] The terminal custom configuration condition is identified and converted into a command line by calling the tshark tool; the start capture button operation and the stop capture button operation are converted into a command line by calling the tshark tool.

[0153] In an embodiment, the processor, when executing the computer program to implement the step of executing the command line to obtain the traffic data packet, implements the following steps:

[0154] The command line is executed, and the captured traffic data is generated into a corresponding data packet according to the configuration condition in the process of capturing the traffic data packet; the data packet is stored in the form of a file to obtain the traffic data packet.

[0155] In an embodiment, the processor, when executing the computer program to implement the step of analyzing the traffic data packet and the historical traffic data packet to obtain an analysis result, implements the following steps:

[0156] The historical traffic data packet is analyzed by a tshark conversion command to obtain a conversion result; the traffic data packet is classified according to different capture protocols by using a Task tool to obtain a classification result; the classification result and the conversion result are analyzed according to an execution command to obtain an analysis result.

[0157] In an embodiment, the processor, when executing the computer program to implement the step of saving the analysis result, implements the following steps:

[0158] The analysis result is cached in the form of a data list and saved to a storage path.

[0159] In an embodiment, the processor, when executing the computer program to implement the step of querying the corresponding content from the analysis result according to the voice query request and converting the corresponding content into a voice file, implements the following steps:

[0160] The corresponding id is determined according to the voice query request by using a tshark command; the payload is determined from the analysis result according to the id and converted into a voice file.

[0161] In an embodiment, the processor, when executing the computer program to implement the step of querying the corresponding content from the analysis result according to the voice query request and converting the corresponding content into a voice file, implements the following steps:

[0162] According to the id, a payload is determined from the resolution result, the payload is saved as a hexadecimal file, the hexadecimal file is saved as a raw file, and the raw file is converted into a voice file by sox.

[0163] The storage medium can be a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk, and various computer readable storage media that can store program codes.

[0164] Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in general terms in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0165] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and actual implementation can have another division manner. For example, a plurality of units or components can be combined or integrated into another system, or some features can be omitted or not executed.

[0166] The steps in the method embodiments of the present application can be adjusted, combined and deleted in sequence according to actual needs. The units in the device embodiments of the present application can be combined, divided and deleted according to actual needs. In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0167] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a terminal or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application.

[0168] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any skilled person in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements shall be covered within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A traffic data forensic analysis method, characterized by, The method comprises the following steps: configuring a data flow capture condition and converting an operation button into a command line; executing the command line to obtain a traffic data packet; importing a historical traffic data packet; parsing the traffic data packet and the historical traffic data packet to obtain a parsing result; saving the parsing result; obtaining a voice query request; querying corresponding content from the parsing result according to the voice query request and converting the corresponding content into a voice file; exporting the voice file. The method comprises the following steps: recognizing a terminal self-defined configuration condition by calling a tshark tool and converting the terminal self-defined configuration condition into a command line; converting a start capture button operation and a stop capture button operation into command lines by calling the tshark tool; The method comprises the following steps: parsing the historical traffic data packet by tshark conversion command to obtain a conversion result; classifying the traffic data packet according to different capture protocols by using a Task tool to obtain a classification result; performing command parsing on the classification result and the conversion result to obtain a parsing result; The method comprises the following steps: determining a corresponding id according to the voice query request by using a tshark command; determining a payload from the parsing result according to the id and converting the payload into a voice file; The method comprises the following steps: determining a payload from the parsing result according to the id and saving the payload as a hexadecimal file; saving the hexadecimal file as a raw file and converting the raw file into a voice file by using a sox.

2. The flow data forensic analysis method of claim 1, wherein, The method comprises the following steps: executing the command line to generate a corresponding data packet from captured traffic data according to the configuration condition during the process of capturing the traffic data packet; storing the data packet in a file form to obtain a traffic data packet.

3. The flow data forensic analysis method of claim 1, wherein, The method comprises the following steps: caching the parsing result in a data list form and saving the parsing result into a storage path.

4. A traffic data forensic analysis apparatus, characterized by, The method comprises the following steps: a conversion unit configured to configure a data flow capture condition and convert an operation button into a command line; a data packet obtaining unit configured to execute the command line to obtain a traffic data packet; an importing unit configured to import a historical traffic data packet; a parsing unit configured to parse the traffic data packet and the historical traffic data packet to obtain a parsing result; a saving unit configured to save the parsing result; a request obtaining unit configured to obtain a voice query request; a querying unit configured to query corresponding content from the parsing result according to the voice query request and convert the corresponding content into a voice file; an exporting unit configured to export the voice file.

5. A computer device, comprising: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 3 when executing the computer program.

6. A storage medium, characterized by The storage medium stores a computer program, and the computer program is executed by the processor to implement the method according to any one of claims 1 to 3.

Images