A method and apparatus for communication topology information modeling based on collaborative traffic monitoring

Abstract

This application relates to the field of computer technology and discloses a method and apparatus for modeling communication topology information based on collaborative traffic monitoring. The method includes: caching collected network traffic data in memory and preprocessing the network traffic data to obtain network traffic attributes corresponding to the network traffic data; merging network traffic data with the same network traffic attributes collected within a preset time period in real time to obtain merged network traffic data, and parsing the merged network traffic data to obtain initial network traffic data; modeling the initial network traffic data to generate data objects that meet database requirements, and storing the data objects in the database to generate a communication link table; and performing database materialized view processing on the communication link table to generate a database physical view. Applying this method can effectively improve retrieval efficiency, meet the requirements of high-efficiency queries, and satisfy multi-dimensional graph query needs.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification relate to the technical field of computer technology, and particularly relate to a communication topology information modeling method based on collaborative traffic monitoring. BACKGROUND

[0002] With the expansion of the dual-network fusion network of industrial control network and office network, how to ensure the real-time display and retrieval of collaborative traffic network communication information is a challenge. When the nodes in the collaborative traffic monitoring system reach a certain scale, using the traditional relational database to model the traffic data usually cannot meet the real-time and efficient requirements of data retrieval.

[0003] In order to solve the above problems, a professional third-party graph database is usually used to store graph data at present. However, the third-party graph database usually needs to occupy a large resource space, and the insertion efficiency of large traffic communication data is obviously inferior to that of the relational database. In addition, although the third-party graph database is a professional graph data carrier, it does not support professional communication data enough. Therefore, there is still a method of modeling graph data using a relational database at present, but the query efficiency is still a hard spot.

[0004] Therefore, how to provide a scheme of modeling communication graph data based on a relational database to meet the efficient query requirements of collaborative traffic monitoring and multi-dimensional graph query requirements has become a technical problem to be solved at present. SUMMARY

[0005] Therefore, the embodiments of the present specification provide a communication topology information modeling method based on collaborative traffic monitoring. One or more embodiments of the present specification also relate to a communication topology information modeling device based on collaborative traffic monitoring, a computing device, and a computer-readable storage medium to solve the problem of retrieval efficiency of modeling communication graph data based on a relational database in the prior art, and reduce the dimensionality of complex statistical queries and logical processing to single table queries.

[0006] According to a first aspect of the embodiments of the present specification, a communication topology information modeling method based on collaborative traffic monitoring is provided, including:

[0007] The collected network traffic data is cached in the memory, and the network traffic data is preprocessed to obtain network traffic attributes corresponding to the network traffic data. The network traffic data includes industrial control network traffic data and internal network traffic data.

[0008] The network traffic data collected in a preset time period is merged in real time according to the same network traffic attribute, to obtain merged network traffic data, and the merged network traffic data is parsed and processed, to obtain initial network traffic data, wherein the initial network traffic data includes communication node data, communication link data and device application data;

[0009] The initial network traffic data is modeled and processed, to generate data objects meeting database requirements, and the data objects are stored in a database, to generate a communication link table, wherein the data objects include communication node objects, communication link objects and device application objects;

[0010] The communication link table is processed by a database materialized view, to generate a database physical view.

[0011] According to a second aspect of the embodiments of the present specification, a communication topology information modeling device based on collaborative flow monitoring is provided, including:

[0012] The acquisition module is configured to cache the acquired network traffic data to the memory, and pre-process the network traffic data, to obtain network traffic attributes corresponding to the network traffic data, wherein the network traffic data includes industrial control network traffic data and internal network traffic data;

[0013] The merging module is configured to merge the network traffic data collected in a preset time period in real time according to the same network traffic attribute, to obtain merged network traffic data, and parse and process the merged network traffic data, to obtain initial network traffic data, wherein the initial network traffic data includes communication node data, communication link data and device application data;

[0014] The modeling module is configured to model and process the initial network traffic data, to generate data objects meeting database requirements, and store the data objects in a database, to generate a communication link table, wherein the data objects include communication node objects, communication link objects and device application objects;

[0015] The materialization module is configured to process the communication link table by a database materialized view, to generate a database physical view.

[0016] According to a third aspect of the embodiments of the present specification, a computer device is provided, including:

[0017] A memory and a processor;

[0018] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions, and the computer executable instructions, when executed by the processor, implement the steps of the above-mentioned communication topology information modeling method based on collaborative flow monitoring.

[0019] According to a fourth aspect of the embodiments of the present disclosure, a computer readable storage medium is provided, which stores computer executable instructions, and the instructions, when executed by a processor, implement the steps of the communication topology information modeling method based on collaborative traffic monitoring.

[0020] The present application provides a communication topology information modeling method based on collaborative traffic monitoring, comprising: first, buffering the collected network traffic data to the memory, and preprocessing the network traffic data to obtain the network traffic attributes corresponding to the network traffic data, wherein the network traffic data comprises industrial control network traffic data and internal network traffic data; then, merging the network traffic data with the same network traffic attributes collected in a preset time period in real time to obtain merged network traffic data, and performing analysis processing on the merged network traffic data to obtain initial network traffic data, wherein the initial network traffic data comprises communication node data, communication link data and device application data; secondly, modeling the initial network traffic data to generate data objects meeting the requirements of the database, and storing the data objects in the database to generate a communication link table, wherein the data objects comprise communication node objects, communication link objects and device application objects; finally, performing database materialized view processing on the communication link table to generate a database physical view.

[0021] The communication topology information modeling method based on collaborative traffic monitoring provided by the embodiments of the present application first collects the traffic data of the industrial control network and the office internal network engine, and merges the traffic data belonging to the same link; then processes the collected data and abstracts the modeling into database communication objects; secondly, based on the communication objects, a communication link table is generated; finally, through database materialized view processing on the communication link table, a communication link table is obtained, the single table query of the topology information is realized, the retrieval efficiency is effectively improved to meet the efficient query requirements, and the multi-dimensional graph query requirements are met. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a flowchart of a communication topology information modeling method based on collaborative traffic monitoring provided by the embodiments of the present application;

[0023] Figure 2 is a flowchart of a communication topology information modeling method based on collaborative traffic monitoring provided by the embodiments of the present application;

[0024] Figure 3 is a structural diagram of a communication topology information modeling device based on collaborative traffic monitoring provided by the embodiments of the present application;

[0025] Figure 4This is a structural block diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0026] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0027] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0028] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0029] Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0030] Currently, there are two common basic model structures for relational database data models used to display topology graphs: the first model structure includes: communication source, communication destination, communication direction (with server and client identifiers), and other communication information; the second model structure includes: communication server, communication client, communication direction, and other communication information. The advantages of these two common data models are that they are suitable for communication log recording, the information is relatively intuitive, their structure is similar to the data acquisition structure, and they are easy to parse and store in the database. When storing communication graph data in a graph database, its basic structure includes: communication nodes and directed relationships. Other detailed information is contained within the nodes and relationship objects; therefore, it only serves to filter data when querying graph data.

[0031] The most obvious drawback of existing relational database communication graph data models is twofold: First, graph query efficiency is poor, making them only suitable for tabular data display. This is because topology graph data ultimately needs to summarize the directed relationships between communication nodes. Both common models are slow at summarizing communication nodes and directed relationships because, for cases where the nodes at both ends of a communication are the same but the sessions are different, the number of fields stored for the same node in the database is uncertain. To comprehensively and accurately summarize complex and diverse communication data, multiple queries, union queries, or retrieving the data into program memory and then summarizing and calculating it through program code are necessary. Furthermore, the uncertainty of the field positions increases the complexity of summarizing and statistically analyzing the final directions between nodes. This complexity is easily reflected in communication data between devices that are mutually source and destination, or mutually server and client. Second, due to the existence of multiple IP devices in the communication network, both models require performing join queries on device data to calculate directed relationships between multiple IP assets. For relational databases, single-table queries are the preferred method for efficiency, especially with large datasets where the efficiency difference is significant.

[0032] Therefore, this application proposes a communication topology information modeling method based on collaborative traffic monitoring to solve the problem of retrieval efficiency of communication graph data modeled based on relational databases, and to reduce complex statistical queries and logical processing to single-table queries.

[0033] This application provides a communication topology information modeling method based on collaborative traffic monitoring. This specification also relates to a communication topology information modeling device based on collaborative traffic monitoring, a computer device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0034] See Figure 1 , Figure 1 This is a flowchart illustrating a communication topology information modeling method based on collaborative traffic monitoring, provided in an embodiment of this application. Figure 1 As shown, the specific steps include:

[0035] Step S102: Cache the collected network traffic data in memory and preprocess the network traffic data to obtain the network traffic attributes corresponding to the network traffic data, wherein the network traffic data includes: industrial control network traffic data and intranet traffic data.

[0036] Step S104: Merge network traffic data with the same network traffic attributes collected within a preset time period in real time to obtain merged network traffic data, and parse the merged network traffic data to obtain initial network traffic data, wherein the initial network traffic data includes: communication node data, communication link data and device application data.

[0037] Step S106: Model the initial network traffic data to generate data objects that meet the database requirements, and store the data objects in the database to generate a communication link table. The data objects include: communication node objects, communication link objects, and device application objects.

[0038] In this embodiment of the application, the method further includes: sending the obtained communication link table to the user terminal for display via a retrieval interface.

[0039] Step S108: Perform database materialization view processing on the communication link table to generate a database physical view.

[0040] In this embodiment, the method further includes: responding to receiving a communication topology information query request sent by a client, and detecting that the communication topology information query request triggers a topology interface call instruction, activating a view refresh switch to refresh the database physical view in real time and generate target communication topology information. Since the database physical view is only useful when a user queries the topology, this embodiment uses a switch to control view refresh. When a user calls a topology-related interface, the view refresh switch is activated, finding a balance between performance and data real-time performance. This improves data timeliness while ensuring a high query rate for the materialized view, reducing the high computational pressure on the database caused by frequent refreshes, and reducing energy consumption.

[0041] It should be noted that the database used here is a PostgreSQL database.

[0042] Its implementation performs data persistence processing on the data obtained after abstract modeling, that is, stores the modeled objects in a graph database.

[0043] In this embodiment, the network traffic data is preprocessed to obtain the network traffic attributes corresponding to the network traffic data, including: obtaining data feature information corresponding to each communication link in the network traffic data, wherein the data feature information is a unique identifier for each communication link, and the data feature information includes: server IP, server MAC, server port, client IP, client MAC, client port, link session direction, and application layer protocol; merging network traffic data corresponding to communication links with the same data feature information, and using the data feature information corresponding to the communication link as the network traffic attribute corresponding to the network traffic data.

[0044] In practical applications, server IP, server MAC, server port, client IP, client MAC, client port, link session direction, and application layer protocol serve as unique identifiers for the link. Other attributes are calculated together for the same link.

[0045] After obtaining the target traffic data, the target traffic data is parsed to obtain communication node objects, communication link objects, and device application objects. Among them, the communication node objects and communication link objects are used for the subsequent construction of the communication link table and the display of the communication link diagram; the device application objects are used to analyze the device's application.

[0046] In this embodiment of the application, the correspondence between the encapsulated object and the original data is as follows: the communication link is composed of application data of each device, and the application data of the device is composed of data of each communication device.

[0047] Specifically, the main structure of the object derived from the raw data encapsulation includes: communication device, device application, and communication topology data. Among them, the device application data is used to analyze and record the communication status of the applications installed on the device; the communication topology data is used for preliminary parsing of the link object.

[0048] After modeling the communication objects, the modeled communication objects are stored in the graph database, as shown in the following implementation.

[0049] In practical applications, from the perspective of topology display, the three core fields of device IDs at both ends of the communication and communication direction can display the topology relationship diagram. In this embodiment, to achieve a richer display effect and support the display of communication details, the topology data is stored using the device IDs, IP addresses, MAC addresses, ports, communication direction, and communication protocols at both ends of the communication as a combined unique key to summarize the stored link data. The communication direction is stored using -1, 0, and 1 to indicate the direction, abandoning the server-client concept inherent in the source data, so that it only represents the direction. It should be noted that the direction here represents the direction from device 1 in field 1 to device 2 in field 2, which needs to be calculated from the source data.

[0050] The step of storing the data object in the database and generating a communication link table includes: in response to the absence of the communication node object in the database, adding the communication device corresponding to the communication node object to the database; and in response to the absence of the communication link object in the database, adding the communication link data corresponding to the communication link object to the database based on the database's insert and update syntax.

[0051] In this embodiment, based on the database insert-update syntax, the communication link data corresponding to the communication link object is added to the database, including: adding the communication link object to the database through merging, inserting, and modifying methods. In practical applications, if the communication device object does not exist, it is added to the database; for the communication link object, the database insert-update syntax ON CONFLIT DO UPDATE is used to merge the insert and modify steps, improving processing efficiency, and the unique key of the topology table is used to ensure the uniqueness of the data of the same link in the database.

[0052] Specifically, adding the communication link data corresponding to the communication link object to the database includes:

[0053] Using the combined unique key corresponding to the communication link table, it is determined that there are no other communication link objects in the database that are the same as the communication link object. The combined unique key is determined based on the server IP, server MAC, server port, client IP, client MAC, client port, link session direction, and application layer protocol.

[0054] More specifically, storing data objects that meet the data requirements into the database includes: obtaining the first communication device ID and the second communication device ID at both ends of the communication link corresponding to the communication node object carried by the data object; determining the entry format corresponding to the first communication device ID and the second communication device ID based on a preset entry rule, wherein the preset entry rule is a rule that ensures consistency when the first communication device and the second communication device are entered into the database for the same communication link, based on the first communication device ID information and the second communication device ID information at both ends of the communication link; and storing the data object into the database based on the entry format.

[0055] In practical applications, storing more detailed data requires greater consideration of query efficiency. To improve the efficiency of topology data statistics and queries, and to avoid inefficient queries such as multiple queries and union queries, link data is compared with the device IDs of both communication ends when it is entered into the database. The final data entry format is determined according to specified entry rules, ensuring that link data with the same devices at both ends are placed in the same field during entry, thereby improving data aggregation and calculation efficiency. It should be noted that the entry rules here can be lexicographical order of device IDs or other easily computable sorting methods, while the direction represents the direction of the communication device corresponding to field 1 and the communication device corresponding to field 2, which can be calculated from the source data.

[0056] Furthermore, after storing the modeled objects in the database, a retrieval interface is provided for display by the web front-end.

[0057] In this embodiment of the application, the step of performing database materialized view processing on the communication link table to generate a database physical view includes:

[0058] Based on the communication node objects and communication link objects corresponding to each communication link in the communication link table, determine the first communication device ID, the second communication ID, and the communication direction;

[0059] The topology direction is determined by summarizing the communication directions in the communication link table;

[0060] A physical view of the database is generated based on the first communication device ID, the second communication device ID, and the topology direction.

[0061] To improve retrieval efficiency, a materialized view of the communication link table is created. The communication link table stores the details of each link session, representing the details of each directional line in the topology diagram. The directional lines themselves need to be summarized and statistically derived from the communication link table. The communication directions are stored as -1, 0, and 1, making it possible to calculate the final communication direction through the view summary. This is because (-1) + 1 = 0, which represents that unidirectional communication with different directions combined constitutes bidirectional communication, avoiding the need for a large amount of data to be loaded into memory to calculate the communication direction.

[0062] In this embodiment of the application, the step of determining the topology direction by summarizing the communication directions in the communication link table includes: summarizing the communication directions in the communication link table using an addition function to determine a first topology direction; summarizing the communication directions in the communication link table using a counting function to determine a second topology direction; and determining a topology direction based on the first topology direction and the second topology direction, wherein, when the topology direction is zero, the topology direction is determined to be bidirectional communication, and when the topology direction is non-zero, the topology direction is determined to be unidirectional communication.

[0063] Therefore, the aggregated calculation of the final direction is obtained by calculating the comparison value between the summation function sum(direction) and the counting function count(direction).

[0064] If abs(sum(direction)) < count(direction), that is, if the absolute value of the sum of the directions is less than the number of directions, the final communication direction of the device is two-way 0.

[0065] In addition, if sum(direction) < 0, the final communication direction is -1, which is one-way communication.

[0066] If sum(direction) > 0, the final communication direction is 1, which is one-way communication.

[0067] Through this algorithm, the topological direction can be directly calculated from the database.

[0068] The query efficiency of the materialized view is high while the data timeliness is low. To improve the data timeliness, the view needs to be refreshed when the source data changes. However, frequent view refreshing will increase the database calculation pressure and is also prone to waste, especially when the data traffic is large, which will cause a large performance consumption.

[0069] By applying the method provided in the embodiments of this application, the real-time traffic data of the industrial control network and office intranet reported by the traffic acquisition engine is modeled in the form of graph data to realize the function of viewing the real-time network communication topology map; the communication graph data is scientifically modeled based on a relational database and the modeling data is persisted to the database, thus solving the problem of efficiency in drawing and retrieving traffic topology maps based on relational databases. The method provided in this application embodiment has the following beneficial effects: 1. Real-time drawing of the communication topology diagram of industrial control network and office intranet, facilitating timely detection of network risks and troubleshooting of network problems; 2. Using relational data storage for topology data, avoiding the problem of extremely low efficiency in inputting large amounts of traffic data into graph databases such as Neo4j, and scientifically designing the data model to balance data input efficiency and topology query efficiency; 3. Network nodes in the communication topology diagram support merging and multiple IP devices, closely resembling the real network environment; 4. All complex and diverse communication information between communication nodes is saved, and information such as IP, MAC, port, protocol, PPS, BPS, and alarms can be viewed and retrieved in real time, providing more detailed information; 5. Due to the detailed information storage, coupled with the support of dedicated functions for IP and MAC data types provided by the relational database (Postgres), efficient query support is provided for displaying topology diagrams from special perspectives; 6. Topology data is stored using a table + materialized view method, balancing performance overhead and query efficiency.

[0070] See Figure 2 , Figure 2 This is a schematic diagram of the flowchart of a communication topology information modeling method based on collaborative traffic monitoring provided in an embodiment of this application. Figure 2 As shown, the communication topology information modeling method provided in this application embodiment is as follows: First, industrial control network process collection and office network traffic collection are performed; then, traffic data is aggregated and cached in memory, and identical links are merged; second, traffic data in the cache is pulled every minute; third, device data, device application data, and topology data are parsed; fourth, data objects are added or matched and updated in batches and stored in the database; fifth, it is determined whether the topology physical view of the database needs to be refreshed. If so, the physical view is refreshed; if not, the parsing is confirmed to be completed.

[0071] Corresponding to the above method embodiments, this specification also provides an embodiment of a communication topology information modeling device based on collaborative traffic monitoring. Figure 3 This is a schematic diagram of a communication topology information modeling device based on collaborative traffic monitoring, provided in an embodiment of this application. Figure 3 As shown, the device includes:

[0072] The acquisition module 302 is configured to cache the acquired network traffic data in memory and preprocess the network traffic data to obtain the network traffic attributes corresponding to the network traffic data. The network traffic data includes: industrial control network traffic data and intranet traffic data.

[0073] The merging module 304 is configured to merge network traffic data with the same network traffic attributes collected within a preset time period in real time to obtain merged network traffic data, and to parse the merged network traffic data to obtain initial network traffic data, wherein the initial network traffic data includes: communication node data, communication link data and device application data.

[0074] The modeling module 306 is configured to model the initial network traffic data, generate data objects that meet the database requirements, store the data objects in the database, and generate a communication link table. The data objects include: communication node objects, communication link objects, and device application objects.

[0075] Materialization module 308 is configured to perform database materialization view processing on the communication link table to generate a database physical view.

[0076] In one optional embodiment, the acquisition module 302 is further configured to:

[0077] Obtain data feature information corresponding to each communication link in the network traffic data, wherein the data feature information is a unique identifier for each communication link, and the data feature information includes: server IP, server MAC, server port, client IP, client MAC, client port, link session direction, and application layer protocol;

[0078] Merge network traffic data corresponding to communication links with the same data feature information, and use the data feature information corresponding to the communication link as the network traffic attribute corresponding to the network traffic data.

[0079] In one optional embodiment, the modeling module 306 is further configured to:

[0080] If the communication node object does not exist in the database, the communication device corresponding to the communication node object is added to the database.

[0081] If the communication link object does not exist in the database, the communication link data corresponding to the communication link object is added to the database based on the database's insert / update syntax.

[0082] In one optional embodiment, the modeling module 306 is further configured to:

[0083] Using the combined unique key corresponding to the communication link table, it is determined that there are no other communication link objects in the database that are the same as the communication link object. The combined unique key is determined based on the server IP, server MAC, server port, client IP, client MAC, client port, link session direction, and application layer protocol.

[0084] In one optional embodiment, the modeling module 306 is further configured to:

[0085] Obtain the first communication device ID and the second communication device ID at both ends of the communication link corresponding to the communication node object carried by the data object;

[0086] Based on preset entry rules, the entry format corresponding to the first communication device ID and the second communication device ID is determined. The preset entry rules are rules that ensure consistency when the first communication device and the second communication device are entered into the database based on the first communication device ID information and the second communication device ID information at both ends of the communication link.

[0087] Based on the aforementioned data entry method, the data object is stored in the database.

[0088] In one optional embodiment, the materialization module 308 is further configured to:

[0089] Based on the communication node objects and communication link objects corresponding to each communication link in the communication link table, determine the first communication device ID, the second communication ID, and the communication direction;

[0090] The topology direction is determined by summarizing the communication directions in the communication link table;

[0091] A physical view of the database is generated based on the first communication device ID, the second communication device ID, and the topology direction.

[0092] In one optional embodiment, the materialization module 308 is further configured to:

[0093] By summing up the communication directions in the communication link table using an addition function, a first topology direction is determined;

[0094] The second topology direction is determined by summarizing the communication directions in the communication link table using a counting function.

[0095] Based on the first topology direction and the second topology direction, a topology direction is determined, wherein when the topology direction is zero, the topology direction is determined to be bidirectional communication, and when the topology direction is non-zero, the topology direction is determined to be unidirectional communication.

[0096] In one optional embodiment, the modeling module 306 is further configured to:

[0097] The obtained communication link table is sent to the user terminal for display via the retrieval interface.

[0098] In one optional embodiment, the apparatus further includes:

[0099] The refresh module is configured to respond to a communication topology information query request sent by a client, and to activate the view refresh switch to refresh the physical view of the database in real time when the communication topology information query request triggers a topology interface call instruction.

[0100] The apparatus provided in this application uses real-time traffic data from industrial control networks and office intranets reported by the traffic acquisition engine to model the network topology in the form of graph data, thereby enabling the viewing of real-time network communication topology diagrams. It also scientifically models communication graph data based on relational databases and persists the modeling data to the database, thus solving the problem of efficiency in drawing and retrieving traffic topology diagrams based on relational databases.

[0101] The above is a schematic scheme of a communication topology information modeling device based on collaborative traffic monitoring according to this embodiment. It should be noted that the technical solution of this communication topology information modeling device based on collaborative traffic monitoring and the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above belong to the same concept. For details not described in detail in the technical solution of the communication topology information modeling device based on collaborative traffic monitoring, please refer to the description of the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above.

[0102] Figure 4 This is a structural block diagram of a computing device 400 provided in an embodiment of this application. The components of the computing device 400 include, but are not limited to, a memory 410 and a processor 420. The processor 420 is connected to the memory 410 via a bus 430, and a database 450 is used to store data.

[0103] The computing device 400 also includes an access device 440, which enables the computing device 400 to communicate via one or more networks 460. Examples of such networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. Access device 440 may include one or more of any type of wired or wireless network interface (e.g., network interface controller), such as IEEE 802.11 Wireless Local Area Network (WLAN) interface, Wi-MAX (World Microwave Interoperability for Microwave Access) interface, Ethernet interface, Universal Serial Bus (USB) interface, cellular network interface, Bluetooth interface, and Near Field Communication (NFC).

[0104] In one embodiment of this specification, the aforementioned components of the computing device 400 and Figure 4 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 4 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0105] Computing device 400 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). Computing device 400 can also be a mobile or stationary server.

[0106] The processor 420 is used to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-described communication topology information modeling method based on collaborative traffic monitoring.

[0107] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above belong to the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above.

[0108] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described communication topology information modeling method based on collaborative traffic monitoring.

[0109] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above. Details not described in detail in the technical solution of the storage medium can be found in the description of the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above.

[0110] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described communication topology information modeling method based on collaborative traffic monitoring.

[0111] The above is an illustrative example of a computer program in this embodiment. It should be noted that the technical solution of this computer program belongs to the same concept as the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above. Details not described in detail in the computer program's technical solution can be found in the description of the technical solution of the communication topology information modeling method based on collaborative traffic monitoring described above.

[0112] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0113] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0114] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0115] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0116] The preferred embodiments disclosed above are merely illustrative of this specification. Optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A communication topology information modeling method based on collaborative traffic monitoring, characterized in that, Including: Caching the collected network traffic data in memory and preprocessing the network traffic data to obtain the network traffic attributes corresponding to the network traffic data, where the network traffic data includes industrial control network traffic data and internal network traffic data; Real-time merging of the network traffic data with the same network traffic attributes collected within a preset time period to obtain merged network traffic data, and performing parsing processing on the merged network traffic data to obtain initial network traffic data, where the initial network traffic data includes communication node data, communication link data, and device application data; Performing modeling processing on the initial network traffic data to generate data objects that meet the requirements of the database, and storing the data objects in the database to generate a communication link table, where the data objects include communication node objects, communication link objects, and device application objects; Performing database materialized view processing on the communication link table to generate a database physical view; The performing database materialized view processing on the communication link table to generate a database physical view includes: Based on the communication node objects and communication link objects corresponding to each communication link in the communication link table, determining the first communication device ID, the second communication device ID, and the communication direction; Determining the topology direction by summarizing each communication direction in the communication link table; Generating a database physical view based on the first communication device ID, the second communication device ID, and the topology direction; The determining the topology direction by summarizing each communication direction in the communication link table includes: Summarizing each communication direction in the communication link table through a summation function to determine the first topology direction; Summarizing each communication direction in the communication link table through a counting function to determine the second topology direction; Based on the first topology direction and the second topology direction, determining the topology direction. Specifically, when the topology direction is zero, it is determined that the topology direction is two-way communication; when the topology direction is non-zero, it is determined that the topology direction is one-way communication. Specifically, in the storage of the communication direction, -1, 0, and 1 are used to mark the direction, and it is calculated by comparing the comparison value of the summation function sum(direction) and the counting function count(direction): If abs(sum(direction)) < count(direction), that is, if the absolute value of the sum of the directions is less than the number of directions, the final communication direction of the device is two-way 0; if sum(direction) < 0, the final communication direction is -1, which is one-way communication; if sum(direction) > 0, the final communication direction is 1, which is one-way communication; The method further includes: In response to receiving a communication topology information query request sent by a client and detecting that the communication topology information query request triggers a topology interface call instruction, starting a view refresh switch to refresh the database physical view in real time and generating target communication topology information.

2. The method according to claim 1, characterized in that, The network traffic data is preprocessed to obtain the network traffic attributes corresponding to the network traffic data, including: Obtain data feature information corresponding to each communication link in the network traffic data, wherein the data feature information is a unique identifier for each communication link, and the data feature information includes: server IP, server MAC, server port, client IP, client MAC, client port, link session direction, and application layer protocol; Merge network traffic data corresponding to communication links with the same data feature information, and use the data feature information corresponding to the communication link as the network traffic attribute corresponding to the network traffic data.

3. The method according to claim 1, characterized in that, The step of storing the data object in the database and generating a communication link table includes: If the communication node object does not exist in the database, the communication device corresponding to the communication node object is added to the database. If the communication link object does not exist in the database, the communication link data corresponding to the communication link object is added to the database based on the database's insert / update syntax.

4. The method according to claim 3, characterized in that, Adding the communication link data corresponding to the communication link object to the database includes: Using the combined unique key corresponding to the communication link table, it is determined that there are no other communication link objects in the database that are the same as the communication link object. The combined unique key is determined based on the server IP, server MAC, server port, client IP, client MAC, client port, link session direction, and application layer protocol.

5. The method according to claim 1, characterized in that, The process of storing the data object in the database includes: Obtain the first communication device ID and the second communication device ID at both ends of the communication link corresponding to the communication node object carried by the data object; Based on preset entry rules, the entry format corresponding to the first communication device ID and the second communication device ID is determined. The preset entry rules are rules that ensure consistency when the first communication device and the second communication device are entered into the database based on the first communication device ID information and the second communication device ID information at both ends of the communication link. Based on the aforementioned data entry method, the data object is stored in the database.

6. The method according to claim 1, characterized in that, After storing the data object in the database, the process also includes: The obtained communication link table is sent to the user terminal for display via the retrieval interface.

7. A communication topology information modeling device based on collaborative traffic monitoring, characterized in that, include: The acquisition module is configured to cache the acquired network traffic data in memory and preprocess the network traffic data to obtain the network traffic attributes corresponding to the network traffic data. The network traffic data includes: industrial control network traffic data and intranet traffic data. The merging module is configured to merge network traffic data with the same network traffic attributes collected within a preset time period in real time to obtain merged network traffic data, and to parse the merged network traffic data to obtain initial network traffic data, wherein the initial network traffic data includes: communication node data, communication link data and device application data. A modeling module, configured to perform modeling processing on the initial network traffic data, generate data objects that meet the requirements of the database, store the data objects in the database, and generate a communication link table. The data objects include: communication node objects, communication link objects, and device application objects; A materialization module, configured to perform database materialized view processing on the communication link table to generate a database physical view; The performing database materialized view processing on the communication link table to generate a database physical view includes: Based on the communication node objects and communication link objects corresponding to each communication link in the communication link table, determining a first communication device ID, a second communication device ID, and a communication direction; By summarizing each communication direction in the communication link table, determining a topology direction; Based on the first communication device ID, the second communication device ID, and the topology direction, generating a database physical view; The determining a topology direction by summarizing each communication direction in the communication link table includes: By using a summation function, summarizing each communication direction in the communication link table to determine a first topology direction; By using a counting function, summarizing each communication direction in the communication link table to determine a second topology direction; Based on the first topology direction and the second topology direction, determining the topology direction. In the case where the topology direction is zero, determining that the topology direction is two-way communication; in the case where the topology direction is non-zero, determining that the topology direction is one-way communication. Specifically, when storing the communication direction, -1, 0, 1 are used to mark the direction, and it is calculated using the comparison value between the summation function sum(direction) and the counting function count(direction): If abs(sum(direction)) < count(direction), that is, if the absolute value of the sum of the directions is less than the number of directions, the final communication direction of the device is two-way 0; if sum(direction) < 0, the final communication direction is -1, which is one-way communication; if sum(direction) > 0, the final communication direction is 1, which is one-way communication; It further includes: In response to receiving a communication topology information query request sent by a client and monitoring that the communication topology information query request triggers a topology interface call instruction, starting a view refresh switch, and refreshing the database physical view in real time to generate target communication topology information.

Images