Audit data processing system, method, edge server, and computer medium

Abstract

The application discloses an audit data processing system, method, edge server and computer medium, which can be applied to various scenes such as network security technology, cloud technology, communication technology and intelligent transportation, and the system comprises a first routing device, a first edge server and a center server. The first routing device is used for providing a routing function when a first user equipment accesses a first accessed equipment, storing first audit data received when the routing function is provided, and sending the first audit data to the first edge server. The first edge server is used for processing the first audit data according to a first audit data processing rule obtained from the center server to obtain processed first target data, and sending the first target data to a first audit equipment. The center server is used for determining the first audit data processing rule and issuing the first audit data processing rule to the first edge server, so that the reliability of the first routing device in processing data can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to an audit data processing system, method, edge server, and computer medium. Background Technology

[0002] In related technologies, to enable routing devices to support wireless network auditing, system software that integrates audit data needs to be installed on the devices during the sales process. After integrating the audit data, the routing device uploads it to the auditing device for auditing. Besides integrating audit data, the routing device also needs to provide routing functionality for connected devices, placing high demands on its data processing capabilities, resulting in significant data processing pressure, susceptibility to failure, and relatively poor reliability of its data processing. Summary of the Invention

[0003] This application provides an audit data processing system, method, edge server, and computer medium, which can reduce the data processing pressure on the routing device side during the process of audit devices acquiring audit data and improve the reliability of data processing by the routing device.

[0004] On one hand, embodiments of this application provide an audit data processing system, including: a first routing device, a first edge server, and a central server, wherein the first edge server establishes communication connections with the first routing device and the central server respectively; The first routing device is connected to a first user device that accesses the first routing device and a first accessed device that the first user device accesses. It is used to provide routing functions when the first user device accesses the first accessed device, store first audit data received when providing the routing functions, and send the first audit data to the first edge server. The first edge server is configured to receive a first audit data processing rule from the central server, process the first audit data according to the first audit data processing rule to obtain processed first target data, and send the first target data to a first audit device, wherein the first audit device is a device used to audit the first target data; The central server is used to determine the first audit data processing rule and distribute the first audit data processing rule to the first edge server.

[0005] On the other hand, embodiments of this application provide an audit data processing method applicable to a first edge server in an audit data processing system. The audit data processing system includes a first routing device, the first edge server, and a central server. The method includes: The first routing device is connected to a first user device that accesses the first routing device and a first accessed device that is accessed by the first user device. The first routing device is used to provide routing functions when the first user device accesses the first accessed device and to store the first audit data received when providing the routing functions. The first audit data is processed according to the first audit data processing rules received from the central server to obtain the processed first target data; The first target data is sent to the first auditing device, which is a device used to audit the first target data; The audit data processing system can be any of the above-mentioned audit data processing systems.

[0006] On the other hand, embodiments of this application provide a first edge server included in an audit data processing system, the audit data processing system further including: a first routing device and a central server, the first edge server including: The acquisition unit is used to acquire first audit data sent by the first routing device. The first routing device is connected to a first user device that accesses the first routing device and a first accessed device accessed by the first user device. The unit is used to provide routing functionality when the first user device accesses the first accessed device and to store the first audit data received when providing the routing functionality. The processing unit is configured to process the first audit data according to the first audit data processing rules received from the central server to obtain the processed first target data; A sending unit is configured to send the first target data to a first auditing device, wherein the first auditing device is a device used to audit the first target data; The audit data processing system can be any of the above-mentioned audit data processing systems.

[0007] On the other hand, embodiments of this application provide a computer-readable storage medium storing a computer program adapted for loading by a processor to perform the methods described in any of the above embodiments.

[0008] On the other hand, embodiments of this application provide a computer device, the computer device including a processor and a memory, the memory storing a computer program, the processor executing the method described in any of the above embodiments by calling the computer program stored in the memory.

[0009] On the other hand, embodiments of this application provide a computer program product, including computer instructions, which, when executed by a processor, implement the method described in any of the above embodiments.

[0010] The audit data processing system provided in this application includes: a first routing device, a first edge server, and a central server. The first edge server establishes communication connections with both the first routing device and the central server. The first routing device is connected to a first user device accessing the first routing device and a first accessed device accessed by the first user device. It provides routing functionality when the first user device accesses the first accessed device, stores first audit data received while providing the routing functionality, and sends the first audit data to the first edge server. The first edge server receives first audit data processing rules from the central server, processes the first audit data according to the first audit data processing rules to obtain processed first target data, and sends the first target data to the first audit device, which is a device used to audit the first target data. The central server determines the first audit data processing rules and distributes the first audit data processing rules to the first edge server. This solution reduces the data processing pressure on the first routing device during the acquisition of first audit data by the first audit device, improving the reliability of the data processing by the first routing device. Attached Figure Description

[0011] Figure 1a This is a schematic diagram of the structure of an audit data processing system provided in an embodiment of this application.

[0012] Figure 1b This is a schematic diagram of another audit data processing system provided in an embodiment of this application.

[0013] Figure 1c This is a schematic diagram of a data processing procedure for first audit data provided in an embodiment of this application.

[0014] Figure 1d This is a flowchart illustrating an audit data processing method provided in an embodiment of this application.

[0015] Figure 2a This is a flowchart illustrating an audit data processing method provided in an embodiment of this application.

[0016] Figure 2b This is a schematic diagram of the architecture of EdgeXFoundry provided in an embodiment of this application.

[0017] Figure 3This is a schematic diagram of the structure of a first edge server provided in an embodiment of this application.

[0018] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0020] First, some of the nouns or terms that appear in the description of the embodiments of this application are explained as follows: Edge computing: The "edge" in edge computing refers to computing and storage resources at the network edge. This network edge is the opposite of the data center, being closer to the user both geographically and network-wise. As a new computing paradigm, edge computing deploys computing tasks close to the network edge where data originates, utilizing edge resources to provide users with numerous services and functional interfaces. This significantly reduces the amount of data uploaded to cloud data centers, alleviating network bandwidth pressure, and better addressing data security and privacy issues. In edge computing environments, data is heterogeneous and voluminous, and the applications processing the data are diverse. Different applications have different associated computing tasks, making task management highly complex. Simple middleware software structures cannot effectively guarantee the feasibility of computing tasks, the reliability of applications, and the maximization of resource utilization. Furthermore, the functionalities that edge computing systems aim to achieve vary depending on the application or scenario. Therefore, edge computing platforms have significant implications for the promotion and development of the edge computing field.

[0021] Rule engine: Evolved from inference engine, it is a component embedded in an application that separates business decisions from application code and uses predefined semantic modules to write business decisions. It accepts data input, interprets business rules, and makes business decisions based on those rules.

[0022] Cybersecurity auditing: International internet security auditing (internet registration) aims to strengthen and standardize internet security technology prevention work, ensure internet network security and information security, promote the healthy and orderly development of the internet, and safeguard social order and public interests. Cybersecurity auditing (Audit) refers to the process of examining, reviewing, and verifying the environment and activities of operational events using information such as records, system activities, and user activities, according to certain security strategies, thereby discovering system vulnerabilities, intrusion behaviors, or improving system performance. It is also a process of reviewing and assessing system security risks and taking corresponding measures. Simply put, security auditing is the process of recording and reviewing user activities on computers and network systems, and is an important measure to improve system security. System activities include operating system activities and application process activities. User activities include user activities within the operating system and applications, such as the resources used, usage time, and operations performed. Security auditing independently reviews and estimates system records and behaviors, and its main functions and purposes include five aspects: (1) It serves as a deterrent and warning to potential attackers, with risk assessment as its core function.

[0023] (2) Test the control status of the system and make timely adjustments to ensure that it is consistent with the safety strategy and operating procedures.

[0024] (3) To assess the damage that has occurred and provide a basis for effective disaster recovery and accountability.

[0025] (4) Evaluate and provide feedback on changes to system control, security policies and procedures in order to revise decisions and deployments.

[0026] (5) Assist system administrators in timely detection of network system intrusions or potential system vulnerabilities and hidden dangers.

[0027] Transmission Control Protocol (TCP) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol designed to adapt to layered protocol hierarchies that support multiple network applications.

[0028] Hypertext Transfer Protocol (HTTP): A simple request-response protocol that typically runs on top of TCP, specifying what messages a client might send to a server and what responses it might receive.

[0029] Transmission protocol: The rules that both parties must follow during data transmission. Each layer in the transmission protocol provides service functions to the layer above it. To provide these service functions, the next layer incorporates data from the previous layer into its own data field, adding headers or trailers to achieve the service function; this process is called data encapsulation. User data undergoes multiple encapsulation processes, ultimately transforming it into a signal that can be transmitted over the network before being sent. Upon reaching the destination device, the reverse unpacking process is then performed.

[0030] Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Based on the cloud computing business model, cloud technology encompasses network technology, information technology, integration technology, management platform technology, and application technology. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will require robust system support, which can only be achieved through cloud computing.

[0031] Intelligent transportation fully utilizes next-generation information technologies such as the Internet of Things, spatial sensing, cloud computing, and mobile internet across the entire transportation sector. It comprehensively applies theories and tools from transportation science, systems methods, artificial intelligence, and knowledge mining. With the goals of comprehensive perception, deep integration, proactive service, and scientific decision-making, it builds a real-time dynamic information service system, deeply mines transportation-related data, forms problem analysis models, and enhances the industry's ability to optimize resource allocation, improve public decision-making capabilities, enhance industry management capabilities, and improve public service capabilities. This promotes safer, more efficient, more convenient, more economical, more environmentally friendly, and more comfortable operation and development of transportation, and drives the transformation and upgrading of transportation-related industries.

[0032] Intelligent Traffic Systems (ITS), also known as Intelligent Transportation Systems, effectively integrate advanced science and technology (information technology, computer technology, data communication technology, sensor technology, electronic control technology, automatic control theory, operations research, artificial intelligence, etc.) into transportation, service control, and vehicle manufacturing. This strengthens the connection between vehicles, roads, and users, thereby forming a comprehensive transportation system that ensures safety, improves efficiency, enhances the environment, and saves energy.

[0033] Wireless AP (Access Point): A wireless access point is a wireless switch used in wireless networks and is the core of the wireless network. A wireless AP is the access point for mobile computer users to access a wired network, mainly used in broadband homes, buildings, and campuses, with a coverage range of tens to hundreds of meters. Wireless AP (also known as session point or access bridge) is a broad term, encompassing not only simple wireless access points (wireless APs) but also wireless routers (including wireless gateways and wireless bridges) and other similar devices.

[0034] AC (Wireless Access Point Controller): A wireless controller is a network device used to centrally control wireless access points (APs). It is the core of a wireless network and is responsible for managing all wireless APs in the network. AP management includes: issuing configurations, modifying relevant configuration parameters, intelligent radio frequency management, and access security control.

[0035] The embodiments of this application can be applied to various scenarios such as network security technology, cloud technology, communication technology, and intelligent transportation.

[0036] This application provides an audit data processing system, method, edge server, and computer media. Please refer to... Figure 1a and Figure 1b As shown, Figure 1a and Figure 1b The schematic diagram of the audit data processing system provided in this application shows that, in some optional embodiments, the audit data processing system 100 includes: a first routing device 11, a first edge server 12, and a central server 13, wherein the first edge server 12 establishes communication connections with the first routing device 11 and the central server 13 respectively. The first routing device 11 is connected to a first user device 111 that accesses the first routing device 11 and a first accessed device 112 accessed by the first user device 111. It is used to provide routing functions when the first user device 111 accesses the first accessed device 112, store the first audit data received when providing the routing functions, and send the first audit data to the first edge server 12. The first edge server 12 is configured to receive a first audit data processing rule from the central server 13, process the first audit data according to the first audit data processing rule to obtain processed first target data, and send the first target data to the first audit device 14, wherein the first audit device 14 is a device for auditing the first target data. The central server 13 is used to determine the first audit data processing rule and send the first audit data processing rule to the first edge server 12.

[0037] Optionally, the aforementioned first user equipment 111 can be a terminal that can access the aforementioned first routing device 11. The terminal can be a smartphone, tablet computer, laptop computer, smart voice interaction device, smart home appliance, wearable smart device, aircraft, smart vehicle terminal, etc. The terminal can also include a client, which can be a video client, browser client, or instant messaging client, etc.

[0038] Optionally, the aforementioned first routing device 11 is an AC (Access Controller, wireless controller).

[0039] Optionally, the aforementioned first routing device 11 may also be an AP (Access Point) device.

[0040] Optionally, the aforementioned first auditing device 14 can be a smartphone, tablet computer, laptop computer, smart voice interaction device, smart home appliance, wearable smart device, aircraft, smart vehicle terminal, etc. The terminal may also include a client, which may be a video client, browser client, or instant messaging client, etc.

[0041] Optionally, the first audit device 14 can be used to perform the aforementioned network security audit functions, such as: according to certain security policies, using information such as records, system activities and user activities to check, review and examine the environment and activities of operational events, thereby discovering system vulnerabilities, intrusion behaviors or improving system performance.

[0042] Optionally, the first auditing device 14 can record and review user activities on the computer and network system to improve system security. System activities include operating system activities and application process activities. User activities include user activities within the operating system and applications, such as the resources used, usage time, and operations performed by the user.

[0043] The aforementioned central server 13 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0044] The solution provided in this application can transfer the function of processing the first audit data originally performed by the first routing device 11 to the first edge server 12. Based on the edge computing function of the first edge server 12, the pressure on the first routing device 11 can be reduced, which not only improves the reliability of data processing on the first routing device 11, but also saves the cost of implementing security audit.

[0045] In some optional embodiments of this application, the first audit data processing rule includes at least one of the following first audit data processing sub-rules: Encryption rules for the first audit data; The compression method for the first audit data; The first audit data is sent from the first edge server 12 to the first audit device 14 via a transmission protocol. The classification rules for classifying the first audit data into files.

[0046] The encryption rules can be symmetric or asymmetric encryption; the compression method can be zip or zar compression; and the transmission protocol can be TCP or HTTP.

[0047] Optionally, the aforementioned classification rule is a rule for classifying the first audit data according to the type of the first audit data. Optionally, the aforementioned first audit data includes at least one of the following: The first user equipment 111 accesses the authentication information of the first routing device 11; The URL information accessed by the first user equipment 111 when accessing the first accessed device 112; When the first accessed device 112 is a server corresponding to an application, the application information of the application includes at least one of the following: the name of the application and the address of the server.

[0048] Optionally, when classifying the first audit data according to its type, the aforementioned classification rule can be as follows: multiple authentication information of multiple first user devices 111 accessing the first routing device 11 can be classified into the first category; multiple URL information accessed by each of the multiple first user devices 111 accessing the first accessed device 112 can be classified into the second category; and when the first accessed device 112 of each of the multiple first user devices 111 accessing the first routing device 11 is a server corresponding to an application, the application information of the application can be classified into the third category.

[0049] Optionally, the classification rule can also be: classify the first audit data according to the time period. For example, the first audit data collected every 24 hours can be classified into an independent category.

[0050] Optionally, the first target data is the data to be sent to the first audit device 14 after the first audit data has been processed.

[0051] Optionally, after classifying the first audit data, the first edge server 12 can package multiple types of first audit data according to the principle of packaging the first audit data of the same type into the same data packet, thereby obtaining multiple packaging results, and then the first edge server 12 can send the multiple packaging results to the first audit device 14, wherein the first target data includes the aforementioned multiple packaging results.

[0052] Optionally, after classifying the first audit data, the first edge server 12 can also store the first audit data of different categories into different files according to the principle of storing the first audit data of the same category into the same file, thereby obtaining multiple files, and then the first edge server 12 can send the multiple files to the first audit device 14, wherein the first target data includes the aforementioned multiple files.

[0053] Optionally, after classifying the first audit data, the first edge server 12 can also concatenate multiple types of first audit data according to the principle of concatenating the first audit data of the same type into a single string, thereby obtaining multiple strings, and then the first edge server 12 can send multiple strings to the first audit device 14, wherein the first target data includes multiple strings.

[0054] Optionally, the aforementioned principles of packaging first audit data of the same type into the same data packet, storing first audit data of the same type into the same file, and concatenating first audit data of the same type into a single string can be included in the aforementioned first audit data processing principles.

[0055] Optionally, when concatenating the first audit data into a single string, the first audit data can be concatenated into a single string according to a preset format. Optionally, the preset format may include the time sorting rules for multiple first audit data items contained in the same category of first audit data.

[0056] Specifically, the aforementioned first user equipment 111 can be a terminal that can access the aforementioned first routing device 11, and the aforementioned first routing device 11 is an AC (Access Controller, wireless controller).

[0057] Optionally, the aforementioned first routing device 11 may also be an AP (Access Point) device.

[0058] Optionally, the aforementioned authentication information may also be the account and password information entered by the user; Optionally, the aforementioned authentication information may also include a MAC address.

[0059] Alternatively, the aforementioned application can be a game application, or a shopping application, etc.

[0060] In some optional embodiments of this application, see Figure 1b As shown, the system further includes: a first configuration device 15, optionally, the first configuration device 15 is used for: In response to the configuration instructions input by the object, configure the first audit data processing rule; The first audit data processing rule is sent to the central server 13.

[0061] Optionally, the aforementioned first configuration device 15 is a device corresponding to the first audit device 14. The first configuration device 15 is used to configure first audit data processing rules for the first audit device 14 to audit the first target data for relevant personnel.

[0062] Optionally, the first configuration device 15 is further configured to: Displays multiple alternative first audit data processing sub-rules; When the configuration instruction of the object for selecting at least some of the candidate first audit data processing sub-rules from the plurality of candidate first audit data processing sub-rules is detected, the at least some candidate first audit data processing sub-rules are used as the first audit data processing rule.

[0063] Optionally, the configuration instructions may include at least some of the selected alternative first audit data processing sub-rules.

[0064] Optionally, the first configuration device 15 may include a display screen that can display a variety of alternative first audit data processing sub-rules; different alternative first audit data processing sub-rules correspond to different selection buttons, and relevant personnel can select the corresponding alternative first audit data processing sub-rule by clicking the selection button.

[0065] In some optional embodiments of this application, the central server 13 is further configured to: obtain the rule synchronization request sent by the first configuration device 15; The shared processing rule corresponding to the first configuration device 15 is determined according to the rule synchronization request and the preset first correspondence; The shared processing rule is fed back to the first configuration device 15 so that the first configuration device 15 configures the first audit data processing rule in response to the configuration instruction input by the object according to the shared processing rule. The shared processing rule includes at least some of the alternative first audit data processing sub-rules among the multiple alternative first audit data processing sub-rules.

[0066] Optionally, the subject of this application may be relevant personnel.

[0067] The first correspondence includes the mapping relationship between the first configuration device 15 and the shared processing rules.

[0068] Optionally, the shared processing rule is a rule obtained by the central server 13 from the second configuration device 16. For example, the aforementioned shared processing rule can be a second audit data processing rule received by the central server 13 from the second configuration device 16.

[0069] The second configuration device 16 is a device corresponding to the second audit device. The second configuration device 16 is used for relevant personnel to configure the second audit data processing rules for the second audit device to audit the second target data.

[0070] Accordingly, the aforementioned audit data processing system further includes: a second routing device (not shown in the figure) and a second edge server (not shown in the figure), wherein the second edge server establishes communication connections with the second routing device and the central server 13 respectively; the second routing device is connected to a second user device accessing the second routing device and a second accessed device accessed by the second user device, and is used to provide routing functions when the second user device accesses the second accessed device, store the second audit data received when providing the routing functions, and send the second audit data to the second edge server; the second edge server is used to receive second audit data processing rules from the central server 13, process the second audit data according to the second audit data processing rules to obtain processed second target data, and send the second target data to the second audit device, the second audit device being a device used to audit the second target data; the central server 13 is also used to determine the second audit data processing rules and distribute the second audit data processing rules to the second edge server.

[0071] Optionally, the second routing device and the first routing device, the second edge server and the first edge server, and the second auditing device and the first auditing device have the same functions except for the data they process.

[0072] The second audit device and the first audit device 14 can be the same device or different devices.

[0073] Optionally, the shared processing rule is a rule obtained by the central server 13 from the second configuration device 16, and the central server 13 is further used for: The first configuration device 15 sends a request to the second configuration device 16 to share the sharing processing rules, and the sharing request includes the address information of the second configuration device 16; Send request information to the second configuration device 16 according to the sharing request; If the second configuration device 16 receives consent information in response to the request information, the first correspondence is created. The first correspondence includes the first correspondence between the first configuration device 15 and the sharing processing rule.

[0074] In some scenarios, due to the special nature of audit data, different regions may correspond to different audit devices. For example, the first audit device 14 is an audit device used to audit audit data (first target data) in the first region, and the second audit device is an audit device used to audit audit data (second target data) in the second region.

[0075] Optionally, the geographical scope of the first region and the second region are not inclusive of each other.

[0076] Optionally, the geographical extent of the first region may also include the geographical extent of the second region.

[0077] Optionally, the geographical scope of the first region may also be included within the geographical scope of the second region.

[0078] Specifically, the central server 13 is also used for: Obtain rule query information of the first configuration device 15, wherein the rule query information includes the location information of the first configuration device 15; The location information of the first configured device 15 is determined based on the location information; Obtain adjacent region information of the region information according to a preset second correspondence relationship; Obtain the address information of the second configured device 16 within the adjacent area information; The address information of the second configuration device 16 is fed back to the first configuration device 15, so that when the first configuration device 15 receives an instruction to send the sharing request, it generates the sharing request based on the address information of the second configuration device 16.

[0079] The area information where the first configuration device 15 is located is the geographical range of the first region corresponding to the first configuration device 15.

[0080] The neighboring area information of the area where the first configuration device 15 is located can be determined by the pre-stored proximity relationship of the area information.

[0081] Optionally, the devices corresponding to the first region include: a first configuration device 15, a first audit device 14, a first routing device 11, and a first edge server 12. The devices corresponding to the first region are used to process the first audit data or the first target data.

[0082] Optionally, the devices corresponding to the second region include: a second configuration device 16, a second audit device, a second routing device, and a second edge server. The devices corresponding to the second region are used to process the second audit data or the second target data.

[0083] Optionally, the first routing device 11 may upload the first target data to the first edge server 12 according to a preset period to reduce the overhead of frequent network calls.

[0084] Optionally, the address information of the second configuration device 16 can be the IP address information of the second configuration device 16.

[0085] Optionally, the first edge server 12 may be located in an edge data center within a first region.

[0086] In some optional embodiments of this application, the system further includes the first audit device 14, which is further configured to determine the corresponding audit result based on the first target data. The audit result includes at least one of the following: a prompt message indicating whether the audit has passed, and abnormal data information in the first target data.

[0087] Optionally, the first audit data processing rules also specify filtering rules for the first audit data.

[0088] Optionally, first audit data that does not belong to a preset data type can be filtered out in advance. The preset data type can be at least one of the following: authentication information of the first user equipment 111 accessing the first routing device 11; URL information accessed by the first user equipment 111 when accessing the first accessed device 112; and application information of the application when the first accessed device 112 is a server corresponding to an application. The application information includes at least one of the following: the name of the application and the address of the server.

[0089] Optionally, when the first edge server 12 processes the first audit data according to the first audit data processing rules, it may also include function computation and streaming computation.

[0090] Optionally, the first audit data processing rule also includes the address information of the first audit device 14.

[0091] Optionally, the address information of the first audit device 14 can be the IP address information of the second configuration device 16.

[0092] Optionally, the first audit data processing rules also include rules for parsing the first audit data, wherein parsing is for parsing the first audit data into data readable by the first audit device 14.

[0093] It should be noted that a central server 13 can distribute the corresponding rules to multiple first edge servers 12, a first edge server 12 can process the first audit data received from multiple first routing devices 11, and a first routing device 11 can connect to multiple first user devices 111.

[0094] Optionally, different first edge servers 12 may use different transmission protocols to send the first target data to the first audit device 14.

[0095] In response to updates to the first audit data processing rules, in some optional embodiments of this application, the aforementioned first configuration device 15 may also be used for: Obtain update instructions from relevant personnel to update the first audit data processing rules; The third audit data processing rule is determined according to the update instruction, and the third audit data processing rule is the updated first audit data processing rule. The third audit data processing rule is sent to the central server 13, so that the central server 13 distributes the third audit data processing rule to the first edge server 12. The update instruction includes the updated first audit data processing rules.

[0096] In some other optional embodiments of this application, the aforementioned first configuration device 15 may also be used for: Obtain update instructions from relevant personnel to update the first audit data processing rules; According to the update instruction, the target portion of the first audit data processing sub-rules corresponding to the portion of the first audit data processing sub-rules to be updated in the first audit data processing rules are determined, wherein the target portion of the first audit data processing sub-rules is the portion of the first audit data processing sub-rules after updating the portion of the first audit data processing sub-rules; wherein, the target portion of the first audit data processing sub-rules corresponds one-to-one with the updated first audit data processing sub-rules; The first audit data processing sub-rule of the target part is sent to the central server 13, so that the central server 13 distributes the first audit data processing sub-rule of the target part to the first edge server 12.

[0097] The solution proposed in this application utilizes a cloud-edge-device collaborative approach, enabling relevant personnel to easily update and distribute rules.

[0098] Furthermore, Figure 1c This is a schematic diagram of a data processing process for first audit data provided in this application. After multiple first routing devices 11 collect the first audit data, they send the first audit data to a first edge server 12. The first edge server 12 processes the first audit data based on the first audit data processing rules and then transmits the obtained first target data to the first audit device 14 via TCP or HTTP protocol.

[0099] The following is combined with a specific scene diagram. Figure 1d This plan will be further explained. Figure 1d This is a flowchart illustrating an audit data processing method provided in an embodiment of this application. Specifically, relevant personnel can configure audit rules (i.e., first audit data processing rules) through a first configuration device 15. The first configuration device 15 sends the configured first audit data processing rules to a central server 13, and the central server 13 further distributes the first audit data processing rules to a first edge server 12. When a first routing device 11 goes online and collects first audit data from a first user device 111 connected to the first routing device 11, it uploads the first audit data to the first edge server 12. The first edge server 12 performs edge computing on the first audit data, that is, processes the first audit data according to the first audit data processing rules, and sends the calculated data to the first audit device 14.

[0100] The audit data processing system provided in this application includes: a first routing device 11, a first edge server 12, and a central server 13. The first edge server 12 establishes communication connections with both the first routing device 11 and the central server 13. The first routing device 11 is connected to a first user device 111 accessing the first routing device 11 and a first accessed device 112 accessed by the first user device 111. It provides routing functionality when the first user device 111 accesses the first accessed device 112, stores first audit data received while providing the routing functionality, and sends the first audit data to the first edge server 12. The first edge server 12 receives first audit data processing rules from the central server 13, processes the first audit data according to the first audit data processing rules to obtain processed first target data, and sends the first target data to the first audit device 14, which is a device for auditing the first target data. The central server 13 determines the first audit data processing rules and distributes the first audit data processing rules to the first edge server 12. The solution proposed in this application can reduce the data processing pressure on the first routing device 11 during the process of the first audit device 14 acquiring the first audit data, and improve the reliability of the data processing by the first routing device 11.

[0101] Furthermore, the solution of this application also supports encryption of the first audit data, improving its security. The first audit data processing rules can also include settings for the transmission format, data type, and compression method of the first audit data, further enhancing the integration process and flexibility of the first audit data. Moreover, the solution of this application supports sharing of first audit data processing rules among configuration devices corresponding to multiple audit devices, improving the flexibility of configuring the first audit data processing rules.

[0102] This application provides an audit data processing method. Figure 2a This is a flowchart illustrating an audit data processing method provided in an embodiment of this application. The method is applicable to a first edge server 12 in an audit data processing system. The audit data processing system includes a first routing device 11, the first edge server 12, and a central server 13. The method includes the following steps: S201. Obtain the first audit data sent by the first routing device 11. The first routing device 11 is connected to the first user device 111 accessing the first routing device 11 and the first accessed device 112 accessed by the first user device 111. It is used to provide routing function when the first user device 111 accesses the first accessed device 112 and to store the first audit data received when providing the routing function. S202. The first audit data is processed according to the first audit data processing rule received from the central server 13 to obtain the processed first target data; S203. The first target data is sent to the first audit device 14, whereby the first audit device 14 is a device used to audit the first target data.

[0103] Optionally, the aforementioned audit data processing system can be Figure 1a or Figure 1b The audit data processing system in the system.

[0104] In some embodiments, the first audit data processing rule includes at least one of the following first audit data processing sub-rules: Encryption rules for the first audit data; The compression method for the first audit data; The first audit data is sent from the first edge server 12 to the first audit device 14 via a transmission protocol. Classification rules for classifying the first audit data into files.

[0105] Optionally, the first audit data includes at least one of the following: The first user equipment 111 accesses the authentication information of the first routing device 11; The URL information accessed by the first user equipment 111 when accessing the first accessed device 112; When the first accessed device 112 is a server corresponding to an application, the application information of the application includes at least one of the following: the name of the application and the address of the server.

[0106] For specific implementation details of this embodiment, please refer to the corresponding embodiment of the aforementioned system, which will not be repeated here.

[0107] The embodiments of this application can leverage the advantages of edge computing to accelerate data processing and device linkage on the first edge server side, while placing tasks such as rule determination on a central server, such as in the cloud, and then sending them down to the edge for execution. This leverages the advantages of cloud-edge collaboration, reduces bandwidth pressure, and effectively lowers latency. Furthermore, the first edge server provided in this application is compatible with the differences in processing data across various device types and protocols, resulting in high data processing efficiency.

[0108] In some optional embodiments of this application, the first edge server may be deployed with: edge infrastructure services, an operating system, and a hardware platform.

[0109] Optionally, the first edge server in this solution can be deployed with an edge computing engine, such as EdgeXFoundry. EdgeXFoundry is a standardized interoperability framework for industrial IoT edge computing development, deployed on edge devices such as routers and switches. It provides plug-and-play functionality for various sensors, devices, or other IoT devices and manages them, thereby collecting and analyzing their data, or exporting it to edge computing applications or cloud computing centers for further processing. EdgeXFoundry addresses the interoperability problem of IoT devices. Currently, the IoT with a large number of devices generates a large amount of data, urgently requiring the integration of edge computing applications. However, the diversity of IoT hardware and software and access methods poses difficulties for data access functionality, affecting the deployment of edge computing applications. The main goal of EdgeXFoundry is to simplify and standardize the architecture of industrial IoT edge computing and create an ecosystem around interoperable components.

[0110] Optionally, the architecture diagram of EdgeXFoundry provided in this application can be found in [reference needed]. Figure 2b As shown, where, Figure 2b In the diagram, the bottom layer, the "South Side," refers to all IoT devices and the edge network that communicates directly with these devices, sensors, or other IoT components. The top layer, the "North Side," refers to the cloud computing center or enterprise system and the network portion that communicates with the cloud center. The South Side is the data generation source, while the North Side collects, stores, aggregates, and analyzes data from the South Side. EdgeXFoundry sits between the South and North Sides and consists of a series of microservices, which can be divided into four service layers and two underlying enhancement system services. These microservices communicate with each other through a common RESTful application programming interface (API).

[0111] Among them, there are four service layers: device server layer 21, core server layer 22, support service layer 23, and export service layer 24, specifically: Device Service Layer 21: Device Service Layer 21 primarily provides device access functionality and consists of multiple device services. Each device service is a microservice generated by the user based on the Device Service Software Development Kit (SDK). EdgeXFoundry uses device files to define relevant information about a southbound device, including the source data format, the data format stored in EdgeXFoundry, and operation commands for that device. The device service converts the data from the device and sends it to the core service layer. Currently, EdgeXFoundry provides multiple access methods, including Message Queuing Telemetry Transport Protocol (MQTT), ModBus serial communication protocol, and Bluetooth Low Energy Protocol (BLE). Here, REST refers to RESTful application programming interface; OPC-UA refers to OPC unified framework; Modbus is a serial communication protocol; BACNET refers to building automation and control network; ZigBee is a low-speed, short-range wireless network protocol; BLE refers to Bluetooth Low Energy; MQTT refers to Message Queuing Telemetry Transport; SNMP is Simple Network Management Protocol; VIRTUAL refers to virtual device; and SDK refers to Software Development Kit.

[0112] Core Service Layer 22: Core Service Layer 22 consists of four microservice components: Core Data, Command, Metadata, Registry, and Configuration. The Core Data microservice stores and manages data from the southbound device; the Metadata microservice stores and manages the device's metadata; the Command microservice translates operation commands defined in the device file into a generic API, providing users with the means to monitor and control the device; and the Registry and Configuration microservices store information related to device services.

[0113] Service Layer 23 Support: Service Layer 23 provides edge analytics and intelligent services. Taking the rules engine microservice as an example, it allows users to set rules that trigger a specific action when data meets the rule requirements. For instance, the rules engine can monitor and control a temperature sensor; when the temperature is detected to be below 25 degrees Celsius, it can trigger the shutdown of the air conditioner.

[0114] Export Service Layer 24: The Export Service Layer 24 is used to transfer data to the cloud computing center and consists of microservice components such as client registration and distribution. The former records relevant information of the registered backend systems, while the latter exports the corresponding data from the core service layer to the specified client.

[0115] Two underlying enhanced system services are System Management Service 25 and Security Service 26: System Management Service 25 provides the functionality to install, upgrade, start, stop, and monitor EdgeXFoundry microservices. Security Service 26 is used to ensure the security of data from devices and the operation of devices.

[0116] Optionally, the function computation in this embodiment is based on the serverless architecture theory framework and is an implementation of serverless architecture. Serverless architecture is an internet-based technical architecture concept where application logic is not entirely implemented on the server side, but rather adopts a FAAS (Function as a Service) architecture, implementing application logic through function combination. At the same time, serverless architecture allows developers to focus on the acquisition and maintenance of computing resources during application construction, as the platform allocates computing resources on demand, effectively saving application costs.

[0117] Optionally, in this embodiment, streaming computing refers to streaming data (or data streams) as an infinitely large and dynamic collection of data in terms of time distribution and quantity. The value of the data decreases over time, therefore, real-time computation with a response time in seconds is necessary. Streaming computing is the processing of data streams and is real-time computation. Streaming computing has the following characteristics: it is real-time and has low latency; the data used in streaming computing is generally dynamic and boundless; it is applied in real-time scenarios with high timeliness requirements, such as real-time recommendations and business detection; and the tasks in streaming computing are continuous.

[0118] In this application, since the first audit data is continuously generated, the first edge server receives a large amount of first audit data. Therefore, streaming computing is well-suited for data processing. Commonly used streaming computing engines include Flink, Spark, Storm, and Kafka Stream. This application recommends using Kafka Stream. Because the first audit data also involves Kafka message queue buffering on the first edge server, and Kafka Stream uses a package-based approach, it eliminates the need for additional framework deployment and maintenance, making it more lightweight and reducing subsequent maintenance costs.

[0119] In some optional embodiments, the first audit data, after being packaged and connected to the first edge server via Kafka, can be converted into a stream. Each data packet is deserialized into a data structure according to its corresponding data format using a Map process. Since each data packet may contain batches of data, a Flat Map is then used to map the batch data into individual data entries. Window calculation is then used to package the data within a period into a string or generate it into a file. Finally, the message is forwarded to the first audit device according to a specific format through the egress point.

[0120] In some optional embodiments of this application, the central server 13 can run various services. These services make reasonable use of the resources of the central server 13 to centrally manage the edge terminals or to process services that require a lot of computing resources, such as rule engine configuration, on the central server 13 and then distribute them to the first edge server 12 for execution.

[0121] Optionally, in some optional embodiments of this application, the aforementioned system 100 may include multiple first edge servers 12, which may belong to a first edge server cluster. When the operating information of one or more first edge servers 12 in the cluster reaches a preset condition, the system may forward the data received by the system after reaching the preset condition to other first edge servers 12 in the cluster that have not reached the preset condition, so that the other first edge servers 12 that have not reached the preset condition can process the data. Alternatively, when the operating information of one or more first edge servers in the first edge server cluster reaches the preset condition, the system may report the corresponding prompt information to the central server. After receiving the prompt information, the central server may reassign other first edge servers 12 to process the data received by one or more servers after the operating information has reached the preset condition.

[0122] The preset conditions may include: CPU utilization is greater than a preset value, and / or the current computing workload is greater than a preset workload, etc.

[0123] All of the above technical solutions can be combined in any way to form optional embodiments of this application, and will not be described in detail here.

[0124] To facilitate better implementation of the methods in the embodiments of this application, the embodiments of this application also provide a first edge server, included in an audit data processing system. The audit data processing system further includes a first routing device and a central server. Please refer to [link to relevant documentation]. Figure 3 , Figure 3 This is a schematic diagram of the structure of a first edge server provided in an embodiment of this application. The first edge server 12 may include: The acquisition unit 31 is used to acquire the first audit data sent by the first routing device. The first routing device is connected to a first user device that accesses the first routing device and a first accessed device accessed by the first user device. The unit is used to provide routing functions when the first user device accesses the first accessed device and to store the first audit data received when providing the routing functions. Processing unit 32 is used to process the first audit data according to the first audit data processing rules received from the central server to obtain the processed first target data; The sending unit 33 is used to send the first target data to the first auditing device, which is a device used to audit the first target data.

[0125] Optionally, the first audit data processing rule includes at least one of the following first audit data processing sub-rules: Encryption rules for the first audit data; The compression method for the first audit data; The first audit data is sent from the first edge server to the first audit device via a transmission protocol. The classification rules for classifying the first audit data into files.

[0126] Optionally, the first audit data includes at least one of the following: The authentication information of the first user equipment accessing the first routing device; The URL information accessed by the first user equipment when accessing the first accessed device; When the first accessed device is a server corresponding to an application, the application information of the application includes at least one of the following: the name of the application and the address of the server.

[0127] Each unit in the first edge server described above can be implemented entirely or partially through software, hardware, or a combination thereof. Each unit can be embedded in or independent of the processor in the first edge server in hardware form, or stored in the memory of the first edge server in software form, so that the processor can call and execute the operations corresponding to each unit.

[0128] Optionally, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0129] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The computer device may be... Figure 1a The first edge server in the system shown. For example... Figure 4 As shown, the computer device 400 may include: a communication interface 401, a memory 402, a processor 403, and a communication bus 404. The communication interface 401, memory 402, and processor 403 communicate with each other via the communication bus 404. The communication interface 401 is used for data communication between the device 700 and external devices. The memory 402 can be used to store software programs and modules, and the processor 403 runs the software programs and modules stored in the memory 402, such as the software programs for the corresponding operations in the foregoing method embodiments.

[0130] Optionally, the processor 403 can invoke software programs and modules stored in the memory 402 to perform the following operations: The first routing device is connected to a first user device that accesses the first routing device and a first accessed device that is accessed by the first user device. The first routing device is used to provide routing functions when the first user device accesses the first accessed device and to store the first audit data received when providing the routing functions. The first audit data is processed according to the first audit data processing rules received from the central server to obtain the processed first target data; The first target data is sent to the first auditing device, which is a device used to audit the first target data.

[0131] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0132] This application also provides a computer-readable storage medium for storing a computer program. This computer-readable storage medium can be applied to a computer device, and the computer program causes the computer device to execute the corresponding processes in the methods described in the embodiments of this application; for brevity, further details are omitted here.

[0133] This application also provides a computer program product including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the corresponding processes in the methods described in the embodiments of this application. For brevity, further details are omitted here.

[0134] This application also provides a computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the corresponding flow in the method described in the embodiments of this application. For the sake of brevity, further details are omitted here.

[0135] It should be understood that the processor in the embodiments of this application may be an integrated circuit chip with signal processing capabilities. In implementation, the steps of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor described above can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0136] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0137] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0138] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0140] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0141] In addition, the functional units in the embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0142] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer or a server) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0143] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An audit data processing system, characterized in that, include: A first routing device, a first edge server, and a central server, wherein the first edge server establishes communication connections with the first routing device and the central server respectively; The first routing device is connected to a first user device that accesses the first routing device and a first accessed device that the first user device accesses. It is used to provide routing functions when the first user device accesses the first accessed device, store first audit data received when providing the routing functions, and send the first audit data to the first edge server. The first edge server is configured to receive a first audit data processing rule from the central server, process the first audit data according to the first audit data processing rule to obtain processed first target data, and send the first target data to a first audit device, wherein the first audit device is a device used to audit the first target data; The central server is used to determine the first audit data processing rule and distribute the first audit data processing rule to the first edge server; The audit data processing system further includes a first configuration device, used to configure the first audit data processing rule in response to a configuration command input by an object, and send the first audit data processing rule to the central server; The central server is further configured to acquire the rule synchronization request sent by the first configuration device, determine the shared processing rule corresponding to the first configuration device according to the rule synchronization request and the preset first correspondence, and feed back the shared processing rule to the first configuration device so that the first configuration device can configure the first audit data processing rule in response to the configuration instruction input by the object according to the shared processing rule. The shared processing rule includes at least some of the alternative first audit data processing sub-rules among a variety of alternative first audit data processing sub-rules. The sharing processing rule is a rule obtained by the central server from the second configuration device. The central server is also used to obtain a request sent by the first configuration device and a sharing request from the second configuration device to share the sharing processing rule. The sharing request includes the address information of the second configuration device. The central server sends request information to the second configuration device according to the sharing request. If the central server receives consent information from the second configuration device in response to the request information, it creates the first correspondence. The first correspondence includes the first correspondence between the first configuration device and the sharing processing rule.

2. The system according to claim 1, characterized in that, The first audit data processing rule includes at least one of the following first audit data processing sub-rules: Encryption rules for the first audit data; The compression method for the first audit data; The first audit data is sent from the first edge server to the first audit device via a transmission protocol. Classification rules for classifying the first audit data into files.

3. The system according to claim 1, characterized in that, The first audit data includes at least one of the following: The authentication information of the first user equipment accessing the first routing device; The URL information accessed by the first user equipment when accessing the first accessed device; When the first accessed device is a server corresponding to an application, the application information of the application includes at least one of the following: the name of the application and the address of the server.

4. The system according to claim 1, characterized in that, The first configuration device is further configured to: Displays multiple alternative first audit data processing sub-rules; When the configuration instruction of the object for selecting at least some of the candidate first audit data processing sub-rules from the plurality of candidate first audit data processing sub-rules is detected, the at least some candidate first audit data processing sub-rules are used as the first audit data processing rule.

5. The system according to claim 1, characterized in that, The central server is also used for: Obtain rule query information for the first configured device, wherein the rule query information includes the location information of the first configured device; The location information is used to determine the area information where the first configured device is located. Obtain adjacent region information of the region information according to a preset second correspondence relationship; Obtain the address information of the second configured device within the adjacent area information; The address information of the second configuration device is fed back to the first configuration device, so that when the first configuration device receives an instruction to send the sharing request, it generates the sharing request based on the address information of the second configuration device.

6. The system according to claim 2, characterized in that, The system further includes the first auditing device, which is also used to determine the corresponding audit result based on the first target data. The audit result includes at least one of the following: a prompt message indicating whether the audit has passed, and abnormal data information in the first target data.

7. An audit data processing method, characterized in that, A first edge server is applicable to an audit data processing system, the audit data processing system comprising: a first routing device, a first edge server, a central server, a first configuration device, and a second configuration device, the method comprising: The first routing device is connected to a first user device that accesses the first routing device and a first accessed device that is accessed by the first user device. The first routing device is used to provide routing functions when the first user device accesses the first accessed device and to store the first audit data received when providing the routing functions. The first audit data is processed according to the first audit data processing rules received from the central server to obtain the processed first target data; The first target data is sent to the first auditing device, which is a device used to audit the first target data; The first audit data processing rule is configured by the first configuration device in response to a configuration instruction input by an object and sent to the central server. The central server is further configured to obtain a rule synchronization request sent by the first configuration device, determine the shared processing rule corresponding to the first configuration device according to the rule synchronization request and a preset first correspondence, and feed back the shared processing rule to the first configuration device so that the first configuration device configures the first audit data processing rule in response to the configuration instruction input by the object according to the shared processing rule. The shared processing rule includes at least some of the candidate first audit data processing sub-rules among a variety of candidate first audit data processing sub-rules. The shared processing rule is a rule obtained by the central server from the second configuration device. The central server is further configured to obtain a request sent by the first configuration device and a sharing request from the second configuration device to share the shared processing rule. The sharing request includes the address information of the second configuration device. The central server sends request information to the second configuration device according to the sharing request. If the central server receives consent information from the second configuration device in response to the request information, it creates the first correspondence, which includes the first correspondence between the first configuration device and the shared processing rule.

8. The method according to claim 7, characterized in that, The first audit data processing rule includes at least one of the following first audit data processing sub-rules: Encryption rules for the first audit data; The compression method for the first audit data; The first audit data is sent from the first edge server to the first audit device via a transmission protocol. Classification rules for classifying the first audit data into files.

9. The method according to claim 8, characterized in that, The first audit data includes at least one of the following: The authentication information of the first user equipment accessing the first routing device; The URL information accessed by the first user equipment when accessing the first accessed device; When the first accessed device is a server corresponding to an application, the application information of the application includes at least one of the following: the name of the application and the address of the server.

10. A first edge server, characterized in that, Included in the audit data processing system, the audit data processing system further includes: a first routing device, a central server, a first configuration device, and a second configuration device, wherein the first edge server includes: The acquisition unit is used to acquire first audit data sent by the first routing device. The first routing device is connected to a first user device that accesses the first routing device and a first accessed device accessed by the first user device. The unit is used to provide routing functionality when the first user device accesses the first accessed device and to store the first audit data received when providing the routing functionality. The processing unit is configured to process the first audit data according to the first audit data processing rules received from the central server to obtain the processed first target data; A sending unit is configured to send the first target data to a first auditing device, wherein the first auditing device is a device used to audit the first target data; The first audit data processing rule is configured by the first configuration device in response to a configuration instruction input by an object and sent to the central server. The central server is further configured to obtain a rule synchronization request sent by the first configuration device, determine the shared processing rule corresponding to the first configuration device according to the rule synchronization request and a preset first correspondence, and feed back the shared processing rule to the first configuration device so that the first configuration device configures the first audit data processing rule in response to the configuration instruction input by the object according to the shared processing rule. The shared processing rule includes at least some of the candidate first audit data processing sub-rules among a variety of candidate first audit data processing sub-rules. The shared processing rule is a rule obtained by the central server from the second configuration device. The central server is further configured to obtain a request sent by the first configuration device and a sharing request from the second configuration device to share the shared processing rule. The sharing request includes the address information of the second configuration device. The central server sends request information to the second configuration device according to the sharing request. If the central server receives consent information from the second configuration device in response to the request information, it creates the first correspondence, which includes the first correspondence between the first configuration device and the shared processing rule.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted for loading by a processor to perform the method of any one of claims 7-9.

12. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing a computer program, and the processor executing the method according to any one of claims 7-9 by calling the computer program stored in the memory.

Images