A non-intrusive VSAT satellite network traffic monitoring system and method

Abstract

The application relates to a non-invasive VSAT satellite network flow monitoring system and method. The system comprises a protocol analysis module, a data processing module, a local database and a local file system. The protocol analysis module comprises a PCAP encapsulation module and a protocol analysis driving module. The data processing module comprises a plug-in management module and a data processing driving module. The PCAP encapsulation module is used for outputting formatted link data to the protocol analysis driving module. The protocol analysis driving module is used for extracting metadata and payload of PCAP format data according to an analysis tree of the plug-in management module, storing the metadata into the local database, and transferring the payload to the next protocol analysis plug-in of the current protocol layer. The data processing driving module is used for processing the metadata according to a formulated plug-in execution sequence, and storing generated temporary files into the local file system. The method can realize full-stack monitoring and analysis of VSAT satellite network flow.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of satellite communication, in particular to a non-intrusive VSAT satellite network flow monitoring system and method. BACKGROUND

[0002] VSAT (Very Small Aperture Terminal, very small aperture satellite terminal) is also called satellite small data station (small station) or personal earth station. The VSAT system has the characteristics of strong flexibility, high reliability, low cost, convenient use and small station directly installed at the user end. The VSAT system is composed of a master station and a plurality of remote VSATs distributed at the user sites. Without the aid of any ground line, the master station and the VSAT can directly communicate at a data rate of up to 2 Mbps, without being limited by terrain, distance and ground communication conditions. It is particularly suitable for scenarios with large information volume and multiple users. The VSAT system can provide telephone, fax, computer information and other communication services.

[0003] VSAT satellite network flow monitoring can analyze VSAT satellite network flow in real time, quickly detect abnormalities, display and alarm according to the detection results, realize VSAT satellite network flow visualization and controllability; VSAT satellite network flow monitoring helps to quickly locate VSAT satellite network abnormalities and improve VSAT satellite network operation and maintenance efficiency; satellite VSAT network flow monitoring can multi-dimensionally display network flow state and flow analysis report, provide scientific data basis for satellite capacity planning, and improve VSAT satellite network availability; VSAT satellite network flow monitoring can identify abnormal flow behavior in real time, quickly perceive the access of attackers to VSAT satellite network resources, effectively discover potential threats in the VSAT satellite network, and realize VSAT satellite network security situation awareness; VSAT satellite network flow monitoring can minimize personnel requirements for monitoring and analysis through automatic monitoring and analysis, and improve VSAT satellite network monitoring efficiency.

[0004] Currently, the network traffic monitoring technology path is mainly divided into host-based traffic monitoring, traffic mirror protocol-based traffic monitoring, hardware probe-based traffic monitoring, SNMP protocol-based traffic monitoring, Netflow-based traffic monitoring, and port mirror-based traffic monitoring. The traffic monitoring based on the host-embedded software installs the traffic monitoring software in the host to complete the traffic monitoring task. The software socket is embedded to intercept the communication content. This method can intercept all communication messages and can analyze various protocol layers. The traffic mirror protocol mirrors the traffic of a certain port (link) of a network device to a protocol analyzer, and detects the network traffic through protocol decoding. The hardware probe is a hardware device used to obtain network traffic, which is connected in series in the link where the traffic needs to be captured to obtain traffic information through the digital signal on the shunt link. The traffic monitoring based on the SNMP protocol collects some variables related to specific device and traffic information through the network device MIB. The traffic monitoring based on Netflow provides traffic information expansion to the five-tuple byte number and packet number statistics based on source IP address, destination IP address, source port, destination port, and protocol number, and can distinguish the flow on each logical channel. Port mirroring can mirror the data of one or more ports of a switch to one or more ports, so that by connecting the port and monitoring, the total traffic data of multiple ports can be captured. This method can easily obtain the traffic data of the whole network.

[0005] The above network traffic monitoring technology is not applicable to VSAT satellite networks. First, the network element devices of the VSAT satellite network do not support the traffic mirror protocol, the SNMP protocol, and the Netflow protocol; second, the network element devices of the VSAT satellite network do not support port mirroring, and there is no hardware probe device for VSAT satellite link traffic; third, the above network traffic monitoring technology works above the network layer of the protocol stack and does not involve satellite link data processing, and cannot support the full-stack monitoring requirements of the VSAT satellite network from the link layer to the application layer. The existing network traffic monitoring technology needs to deploy software or hardware in the network to collect and analyze network traffic, and cannot realize non-intrusive and non-perceptual traffic monitoring. SUMMARY

[0006] Therefore, it is necessary to provide a non-intrusive VSAT satellite network traffic monitoring system and method capable of realizing non-intrusive monitoring of full-stack traffic in view of the above technical problems.

[0007] A non-intrusive VSAT satellite network traffic monitoring system, the system comprising: a data distribution module, a protocol analysis module, a data processing module, a local database, and a local file system. The protocol analysis module comprises a PCAP encapsulation module and a protocol analysis driving module. The data processing module comprises a configuration module, a plug-in management module, and a data processing driving module.

[0008] The data distribution module is configured to send the received VSAT satellite link data to the protocol analysis module.

[0009] The PCAP packaging module is configured to format the received link data into PCAP format data and output the PCAP format data to the protocol analysis driver module.

[0010] The protocol analysis driver module is configured to extract the metadata and the payload of the received PCAP format data according to the analysis tree of the plugin management module, store the metadata in the local database, and hand over the payload to the next protocol analysis plugin of the current protocol layer to complete the protocol analysis cycle.

[0011] The data processing driver module is configured to determine the execution order of the plugin management module, process the metadata according to the execution order, obtain a temporary file, and store the temporary file in the local file system.

[0012] The configuration module is configured to load a configuration file to configure parameters of the protocol analysis module and update a configuration interface of the link data.

[0013] The plugin management module is configured to construct extensible plugins according to user monitoring requirements and perform data processing on the metadata according to a registration list of the plugins.

[0014] In one embodiment, the protocol analysis module further includes a satellite link adapter. The satellite link adapter is configured to process the data link frame, the metadata, and the IP data packet after being demodulated by the VSAT demodulator through a built-in data processing algorithm.

[0015] In one embodiment, the protocol analysis module maintains the protocol analysis driver module in a protocol tree manner and loads multiple network protocol analysis plugins through the construction of the plugin-based protocol analysis extension manner.

[0016] In one embodiment, the protocol analysis driver module is further configured to register the protocol tree node, the parent node payload filtering condition, and the metadata definition of the parsed network protocol analysis plugin to the plugin management module through a protocol registration function. The plugin management module assigns a registration identifier to the registered network protocol analysis plugin.

[0017] In one embodiment, the protocol analysis driver module is further configured to register the data payload of the network protocol analysis plugin to the plugin management module through a protocol processing registration function.

[0018] In one embodiment, the data processing driver module is further configured to obtain the plugin registration list of the plugin management module after the system is started, determine the execution order of each plugin in the plugin management module according to the plugin registration list, and adapt the data input interface of the metadata of the plugin by calling a task driver engine.

[0019] A non-invasive VSAT satellite network traffic monitoring method, the method comprising:

[0020] Obtaining link data of a VSAT satellite.

[0021] After converting the link data into PCAP format link data, sending the PCAP format link data to a protocol analysis module for data registration, and simultaneously calling a plug-in management module to load an analysis tree structure to obtain analysis identification information of the PCAP format link data. The analysis identification information includes PCAP format link metadata and a payload corresponding to the PCAP format link metadata at a current protocol layer.

[0022] The PCAP format link metadata is processed by a data processing module calling a plug-in in the plug-in management module to generate temporary storage metadata, and the temporary storage metadata and the payload are stored in a local database.

[0023] A user monitors network traffic of the local database through a WEB management service module through a transmission interface.

[0024] In one embodiment, the method further comprises: after converting the link data into PCAP format link data, sending the PCAP format link data to a protocol analysis module, and the protocol analysis module extracts PCAP format link metadata and a payload corresponding to the PCAP format link metadata at a current protocol layer according to an analysis tree structure loaded by the plug-in management module, and matches the PCAP format link metadata at the current protocol layer to a protocol analysis plug-in of the payload. Simultaneously, the plug-in management module loads the analysis tree structure, and if the protocol analysis plug-in is empty or the PCAP format link metadata has been parsed according to the analysis tree structure, analysis identification information of the PCAP format link data is obtained, and then a protocol analysis driving module is called to output the PCAP format link metadata with the analysis identification information to a local database. Otherwise, the payload is handed over to a next protocol analysis plug-in.

[0025] A computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0026] Obtaining link data of a VSAT satellite.

[0027] After converting the link data into PCAP format link data, sending the PCAP format link data to a protocol analysis module for data registration, and simultaneously calling a plug-in management module to load an analysis tree structure to obtain analysis identification information of the PCAP format link data. The analysis identification information includes PCAP format link metadata and a payload corresponding to the PCAP format link metadata at a current protocol layer.

[0028] The PCAP format link metadata is processed by calling the plug-in in the plug-in management module through the data processing module, temporary storage metadata is generated, and the temporary storage metadata and the payload are stored in the local database.

[0029] The user monitors the network traffic of the local database through the transmission interface by the WEB management service module.

[0030] A computer readable storage medium has a computer program stored thereon, and the computer program is executed by a processor to implement the following steps:

[0031] Link data of a VSAT satellite is acquired.

[0032] After the link data is converted into PCAP format link data, the PCAP format link data is sent to a protocol analysis module for data registration, and a plug-in management module is called to load an analysis tree structure to obtain analysis identification information of the PCAP format link data. The analysis identification information includes PCAP format link metadata and payload corresponding to the PCAP format link metadata at a current protocol layer.

[0033] The PCAP format link metadata is processed by calling the plug-in in the plug-in management module through the data processing module, temporary storage metadata is generated, and the temporary storage metadata and the payload are stored in the local database.

[0034] The user monitors the network traffic of the local database through the transmission interface by the WEB management service module.

[0035] The non-intrusive VSAT satellite network traffic monitoring system and method adopt a "full stack" type analysis system design, link data processing, IP data processing and application data business functions are integrated into the system in modules, internal data flow is transferred through the network, and "full stack" monitoring and analysis of metadata analysis, data extraction and business restoration of VSAT satellite network data from the satellite link layer, network layer, transmission layer and application layer to user business data are realized. In addition, the system adopts an open design, the protocol analysis module adopts a plug-in framework, each protocol analysis plug-in can realize a specific network protocol analysis function, is registered to the plug-in management, is called by the protocol analysis driver, the data processing module adopts a plug-in framework, and the data processing plug-in realizes metadata input, data processing and user business data output interfaces, so that the module has the extraction and restoration ability of typical business data such as webpage data, video data, voice data and email data. Based on the plug-in framework design, the system supports increasing the protocol analysis and data processing capacity of the system by loading new plug-ins, so that the system has the expansion capacity. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1A structural block diagram of a non-intrusive VSAT satellite network traffic monitoring system in an embodiment;

[0037] Figure 2 A structural block diagram of a protocol analysis module in a non-intrusive VSAT satellite network traffic monitoring system in an embodiment;

[0038] Figure 3 A flowchart of protocol registration and protocol processing in an embodiment;

[0039] Figure 4 A flowchart of data processing in a protocol analysis cycle in an embodiment;

[0040] Figure 5 A structural block diagram of a data processing module in a non-intrusive VSAT satellite network traffic monitoring system in an embodiment;

[0041] Figure 6 A flowchart of a non-intrusive VSAT satellite network traffic monitoring method in an embodiment

[0042] Figure 7 An internal structural diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0043] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0044] In an embodiment, as shown in FIG. 1, a non-intrusive VSAT satellite network traffic monitoring system is provided, Figure 1

[0045] The system includes a protocol analysis module, a data processing module, a WEB management service module, a local database and a local file storage system. System data input is demodulation and decoding data output by a satellite signal demodulation device, i.e., satellite link data. System data output includes system traffic monitoring analysis result files and traffic monitoring analysis record data. The system supports input of streaming data, real-time VSAT satellite link monitoring, data analysis and processing, protocol metadata extraction and satellite user service restoration.

[0046] The protocol analysis module mainly includes a satellite link adapter, a PCAP (Packet Capture) encapsulation, a protocol analysis driver, a plug-in management, a configuration management and a metadata output unit.

[0047] ​Specifically, a plug-in based extensible framework is adopted in the link data adapter and the protocol analysis driver unit. The satellite link adapter has multiple satellite link data processing algorithms built-in, which realize multiple VSAT demodulator demodulated data link frame analysis, metadata processing and IP packet extraction. The protocol analysis driver maintains layered protocol analysis modules in the form of a protocol tree, and constructs a plug-in protocol analysis extension mode. In addition, the protocol analysis driver loads and runs multiple network protocol analysis plug-ins by default, extracts metadata and payload for known protocols that can be processed by existing protocol analysis plug-ins, and performs preliminary identification and labeling for unknown protocols and encrypted data that cannot be processed by existing protocol analysis plug-ins, facilitating subsequent manual identification.

[0048] Further, the data distribution module is configured to send the received VSAT satellite link data to the protocol analysis module. The PCAP encapsulation module is configured to format the received link data to output PCAP format data to the protocol analysis driver module. The protocol analysis driver module is configured to extract metadata and payload of the received PCAP format data according to the analysis tree of the plug-in management module, store the metadata in the local database, and hand over the payload to the next protocol analysis plug-in of the current protocol layer to complete the protocol analysis cycle. The data processing driver module is configured to determine the execution order of the plug-in management module, process the metadata according to the execution order to obtain a temporary file, and store the temporary file in the local file system. The configuration module is configured to load a configuration file to configure parameters of the protocol analysis module, and update the configuration interface of the link data. The plug-in management module is configured to construct extensible plug-ins according to user monitoring requirements, and execute data processing on the metadata according to a registration list of the plug-ins.

[0049] Further, as shown in Figure 2 , the protocol analysis module includes a PCAP encapsulation module and a protocol analysis driver module. The data processing module includes a configuration module, a plug-in management module, and a data processing driver module. The protocol analysis module is responsible for loading system-provided protocol analysis modules and plug-in extended protocol analysis modules when initialized. Each protocol analysis module implements two interfaces, a protocol registration function and a data processing registration function. The protocol registration function registers protocol information, protocol tree nodes, parent node payload filtering conditions, and metadata definitions of the protocol analysis plug-in to the plug-in management submodule. The plug-in management submodule assigns a unique registration identifier to each successfully registered protocol analysis plug-in. The protocol processing registration function registers the data payload processing of the protocol analysis plug-in to the plug-in management submodule. The protocol analysis plug-in management maintains the tree structure of the protocol analysis module and provides it to the protocol analysis driver.

[0050] Further, the protocol analysis module accesses the data stream of the external VSAT satellite network demodulation device through the satellite link adapter, the satellite link adapter performs satellite link metadata analysis, data CRC check, error frame discarding processing, IP packet extraction, adds frame information, and encapsulates into the PCAP format to deliver to the protocol analysis driver for processing.

[0051] Further, as shown in Figure 3 The protocol analysis module processes the PCAP data through the protocol analysis driver. After the PCAP format data is input, the plug-in management submodule provides a tree structure of all protocol analysis modules loaded by the system, the PCAP analysis structure provides initial identification information of the input data, the protocol analysis driver finds the corresponding initial parser from the protocol analysis module tree, delivers the data to the initial parser, the initial parser performs metadata and payload extraction, the metadata is saved to the structured data stack of the PCAP analysis structure, and the payload is delivered to the next protocol analysis plug-in according to the metadata information of the protocol layer, until the data is parsed or there is no protocol analysis plug-in matching the payload data; after completing a protocol analysis cycle, the protocol analysis driver delivers the PCAP analysis structure to the metadata output submodule.

[0052] Further, the protocol analysis module saves the extracted metadata and payload stack after protocol analysis to the database table of the local database associated with each other through the metadata output, and provides a network real-time transmission interface to realize real-time VSAT satellite network data monitoring of the protocol analysis module in the WEB management service.

[0053] Further, as shown in Figure 4 The data processing module includes metadata input, data processing driver, user service data output, plug-in management, and configuration management function units. The data processing module takes the metadata result of the protocol analysis module as the module input; different data processing plug-ins are loaded to support different data processing of the metadata, such as web data extraction and recovery, voice data decoding and analysis, etc.; the data processing module stores the data processing result user service data to the local file system for external WEB management service to consult.

[0054] Further, the WEB management service module provides system configuration, real-time state monitoring, real-time processing data monitoring, situation analysis, etc. The user realizes the management of the system through the graphical interactive interface.

[0055] Further, the local file system stores the user mail, fax, web content, audio and video stream information extracted by the data processing module, and stores the corresponding index in the database.

[0056] Further, the local database stores the metadata and payload extracted by various protocol analysis plug-ins. After an IP packet is processed by multiple protocol analysis plug-ins to extract metadata, the IP packet is converted into multiple data tables for separate storage, and the multiple data tables store the hierarchical relationship of the protocol analysis stack. Meanwhile, the local database also stores the files and index information of user service class information extracted by the data processing plug-ins.

[0057] The non-invasive VSAT satellite network traffic monitoring system and method described above adopts a "full stack" type analysis system design, integrates link data processing, IP data processing and application data service functions into modules in the system, and realizes "full stack" monitoring and analysis of metadata analysis, data extraction and service restoration of VSAT satellite network data from the satellite link layer, network layer, transport layer, application layer to user service data through internal data flow conversion in the network. In addition, the system adopts an open design, the protocol analysis module adopts a plug-in framework, each protocol analysis plug-in can realize a specific network protocol analysis function, is registered to the plug-in management, and is called by the protocol analysis driver, the data processing module adopts a plug-in framework, the data processing plug-in realizes metadata input, data processing, and user service data output interface, so that the module has the extraction and restoration capability of typical service data such as web page data, video data, voice data and email data. Based on the plug-in framework design described above, the system supports increasing the protocol analysis and data processing capability of the system by loading new plug-ins, so that the system has the extension capability.

[0058] In one embodiment, the protocol analysis module further includes a satellite link adapter. The satellite link adapter is configured to process the data link frame, metadata and IP data packet after demodulation by the VSAT demodulator through a built-in data processing algorithm.

[0059] In one embodiment, the protocol analysis module adopts a protocol tree type protocol analysis driving module to maintain the protocol hierarchy, and loads multiple network protocol analysis plug-ins through a plug-in type protocol analysis extension mode.

[0060] In one embodiment, the protocol analysis driving module is further configured to register the protocol tree node, parent node payload filtering condition and metadata definition of the analyzed network protocol analysis plug-in to the plug-in management module through a protocol registration function. The plug-in management module assigns a registration identifier to the registered network protocol analysis plug-in.

[0061] In one embodiment, the protocol analysis driving module is further configured to register the data payload of the network protocol analysis plug-in to the plug-in management module through a protocol processing registration function.

[0062] In one of the embodiments, the data processing driving module is further configured to obtain a plug-in registration list of the plug-in management module after the system is started, call the task driving engine to determine the execution sequence of each plug-in in the plug-in management module according to the plug-in registration list, and adapt the data input interface of the metadata of the plug-in.

[0063] It is worth mentioning that the data processing module determines the customized behavior of the system after deployment through configuration, the configuration management module implements the function of loading configuration items from configuration files and provides an interface for dynamically refreshing configurations, supports users to configure parameters through WEB management services and dynamically take effect.

[0064] In one of the embodiments, the data processing module is driven by the task driving data processing module, after the system is started, the data processing driving obtains the registered plug-in list from the plug-in management submodule, all the application data processing plug-ins registered to the system will be scheduled for the task, put into different priority task queues, and sequentially scheduled by the task driving engine; when scheduling to a certain data processing plug-in, the metadata input interface of the plug-in is called to judge whether the task execution condition is met, if yes, the metadata input interface of the plug-in is called to realize the adaptation of plug-in data input, then the data processing interface of the plug-in is called, after the data processing is completed, a temporary file or memory data is generated, and the file system output interface of the plug-in is called to complete the persistent storage of the content and write the data table of the file index and related information.

[0065] In one of the embodiments, the data processing module adopts an extensible framework, a component plug-in data processing extension mode, and processes and restores user business class information materials such as text, voice, video, and email in known protocol payloads.

[0066] In one of the embodiments, the data processing module framework supports task scheduling, and specific businesses are completed by plug-ins. The input of the application data restoration function is the metadata and payload table after clearing, and the output is various formats of files. A unified structure is adopted to realize the extension of the application data restoration function, the restoration function of each specific application data is realized in the form of plug-ins, and dynamic loading is realized; each data restoration plug-in needs to realize a metadata input interface, a data processing interface, and a file data output interface, which are used to adapt the operations of the metadata input submodule and the file system output submodule, and at the same time realize a plug-in registration function to register the information of the plug-in itself in the plug-in table. The plug-in management is responsible for maintaining the plug-in management table.

[0067] The modules in the non-intrusive VSAT satellite network traffic monitoring system can be realized by software, hardware, or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so that the processor can call and execute the operations corresponding to the modules.

[0068] In one embodiment, as shown in Figure 6 a non-intrusive VSAT satellite network traffic monitoring method is provided, applied to a non-intrusive VSAT satellite network traffic monitoring system, and specifically includes the following steps:

[0069] Step 602: Obtain link data of a VSAT satellite.

[0070] The system supports VSAT satellite network data stream input, real-time VSAT satellite link monitoring, data analysis and processing, protocol metadata extraction, and satellite user service restoration.

[0071] Specifically, the system receives demodulated and decoded data output by an external satellite signal demodulation device, i.e., satellite link data, through data distribution.

[0072] Step 604: After converting the link data into PCAP format link data, send the PCAP format link data to the protocol analysis module for data registration, and call the plug-in management module to load the analysis tree structure to obtain parsing identification information of the PCAP format link data.

[0073] The parsing identification information includes PCAP format link metadata and the payload corresponding to the PCAP format link metadata at the current protocol layer.

[0074] Step 606: The PCAP format link metadata is processed by the plug-in in the plug-in management module through the data processing module to generate temporary storage metadata, and the temporary storage metadata and the payload are stored in the local database.

[0075] Step 608: The user monitors the network traffic of the local database through the WEB management service module through the transmission interface.

[0076] It should be understood that, although Figure 3 , Figure 4 , Figure 6 the steps in the flowcharts are displayed in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, Figure 3 , Figure 4 , Figure 6At least one of the steps in the method can include a plurality of sub-steps or a plurality of stages, which are not necessarily executed at the same time, but can be executed at different times, and the order of execution of the sub-steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least one of the other steps or sub-steps or stages of the other steps.

[0077] It is worth noting that the VSAT satellite network traffic monitoring system flow protocol analysis and data processing supports access to the front satellite signal device through the satellite link adapter of the protocol analysis module, and realizes non-intrusive VSAT satellite network traffic monitoring.

[0078] In one of the embodiments, after the link data is converted into PCAP format link data and sent to the protocol analysis module, the protocol analysis module extracts the PCAP format link metadata and the corresponding payload of the PCAP format link metadata at the current protocol layer according to the analysis tree structure loaded by the plug-in management module, and matches the PCAP format link metadata of the current protocol layer to the payload protocol analysis plug-in. At the same time, the plug-in management module is called to load the analysis tree structure, and if the protocol analysis plug-in is empty or the PCAP format link metadata has been parsed according to the analysis tree structure, the analysis identification information of the PCAP format link data is obtained, then the protocol analysis driving module is called to output the PCAP format link metadata with the analysis identification information to the local database. Otherwise, the payload is handed over to the next protocol analysis plug-in.

[0079] In one embodiment, a computer device, which can be a terminal, can have an internal structure diagram as shown in Figure 7 The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The network interface of the computer device is used to communicate with external terminals through network connection. The computer program is executed by the processor to implement a non-intrusive VSAT satellite network traffic monitoring method. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad provided on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0080] Those skilled in the art can understand that Figure 1 , Figure 2 , Figure 5 ,Figure 7 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0081] In one embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0082] Obtaining link data of a VSAT satellite.

[0083] After converting the link data into PCAP format link data, the PCAP format link data is sent to a protocol analysis module for data registration, and a plugin management module is called to load an analysis tree structure to obtain analysis identification information of the PCAP format link data. The analysis identification information includes PCAP format link metadata and a payload corresponding to the PCAP format link metadata at a current protocol layer.

[0084] The PCAP format link metadata is processed by a plugin in the plugin management module through a data processing module to generate temporary storage metadata, and the temporary storage metadata and the payload are stored in a local database.

[0085] A user monitors network traffic of the local database through a transmission interface through a WEB management service module.

[0086] In one embodiment, a computer readable storage medium is provided, having a computer program stored thereon, and the computer program is executed by a processor to implement the following steps:

[0087] Obtaining link data of a VSAT satellite.

[0088] After converting the link data into PCAP format link data, the PCAP format link data is sent to a protocol analysis module for data registration, and a plugin management module is called to load an analysis tree structure to obtain analysis identification information of the PCAP format link data. The analysis identification information includes PCAP format link metadata and a payload corresponding to the PCAP format link metadata at a current protocol layer.

[0089] The PCAP format link metadata is processed by a plugin in the plugin management module through a data processing module to generate temporary storage metadata, and the temporary storage metadata and the payload are stored in a local database.

[0090] A user monitors network traffic of the local database through a transmission interface through a WEB management service module.

[0091] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, databases, or other media in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0092] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0093] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A non-intrusive VSAT satellite network traffic monitoring system, characterized in that: The system includes: a data distribution module, a protocol analysis module, a data processing module, a local database and a local file system; wherein the protocol analysis module includes: a PCAP encapsulation module and a protocol analysis driver module; the data processing module includes: a configuration module, a plug-in management module and a data processing driver module; The data distribution module is used to send the received link data of the VSAT satellite to the protocol analysis module; The PCAP encapsulation module is used to format the received link data and output PCAP format data to the protocol analysis driver module; The protocol analysis driver module is used to extract metadata and payload of the received PCAP format data according to the analysis tree of the plug-in management module, store the metadata in the local database, and transfer the payload to the next protocol analysis plug-in of the current protocol layer to complete the protocol analysis cycle; The data processing driving module is used to formulate an execution order of the plug-in management module, process the metadata according to the execution order, obtain a temporary file, and store the temporary file in the local file system; The configuration module is used to load a configuration file to configure parameters of the protocol analysis module and update the configuration interface of the link data; The plug-in management module is used to construct an extensible plug-in according to user monitoring requirements, and perform data processing on the metadata according to the registration list of the plug-in.

2. A non-intrusive VSAT satellite network traffic monitoring system according to claim 1, characterized in that: The protocol analysis module further comprises a satellite link adapter; the satellite link adapter is used to process the data link frames, metadata and IP data packets demodulated by the VSAT demodulator through a built-in data processing algorithm.

3. A non-intrusive VSAT satellite network traffic monitoring system according to claim 1, characterized in that: The protocol analysis module maintains the protocol analysis driver module of the protocol layer in a protocol tree manner, and loads a variety of network protocol analysis plug-ins by constructing a plug-in protocol analysis extension manner.

4. A non-intrusive VSAT satellite network traffic monitoring system according to claim 1, characterized in that: The protocol analysis driver module is further configured to register the parsed protocol tree node, parent node load filtering condition, and metadata definition of the network protocol analysis plug-in to the plug-in management module through a protocol registration function; The plug-in management module allocates a registration identifier to the registered network protocol analysis plug-in.

5. A non-intrusive VSAT satellite network traffic monitoring system according to claim 1, characterized in that: The protocol analysis driver module is further configured to register the data payload of the network protocol analysis plug-in to the plug-in management module through a protocol processing registration function.

6. A non-intrusive VSAT satellite network traffic monitoring system according to claim 1, characterized in that: The data processing driver module is also used to obtain the plug-in registration list of the plug-in management module after the system is started, call the task driving engine according to the plug-in registration list to formulate the execution order of each plug-in in the plug-in management module, and adapt the data input interface of the metadata of the plug-in.

7. A non-intrusive VSAT satellite network traffic monitoring method, characterized in that: The method comprises: Obtain link data from VSAT satellites; After converting the link data into PCAP format link data, the link data is sent to the protocol analysis module for data registration, and the plug-in management module is called to load the analysis tree structure to obtain parsing identification information of the PCAP format link data; the parsing identification information includes: PCAP format link metadata and the payload corresponding to the PCAP format link metadata at the current protocol layer; The data processing module calls the plug-in in the plug-in management module to process the PCAP format link metadata, generates temporary storage metadata, and stores the temporary storage metadata and the payload in the local database; The user monitors the network traffic of the local database through the transmission interface via the WEB management service module.

8. The method according to claim 7, characterized in that After the link data is converted into PCAP format link data, it is sent to the protocol analysis module for data registration, and the plug-in management module is called to load the analysis tree structure to obtain the parsing identification information of the PCAP format link data, including: Converting the link data into PCAP format link data and sending it to the protocol analysis module, the protocol analysis module extracting the PCAP format link metadata and the payload corresponding to the PCAP format link metadata at the current protocol layer according to the analysis tree structure loaded by the plug-in management module, and matching the PCAP format link metadata of the current protocol layer to the protocol analysis plug-in of the payload; At the same time, the plug-in management module is called to load the analysis tree structure. If the protocol analysis plug-in is empty or the PCAP format link metadata has been parsed according to the analysis tree structure to obtain the parsing identification information of the PCAP format link data, the protocol analysis driver module is called to output the PCAP format link metadata with the parsing identification information to the local database; otherwise, the payload is transferred to the next protocol analysis plug-in.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 7 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 7 to 8 are implemented.

Images