Signaling auditing method, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a signaling auditing method, electronic equipment, a storage medium and a program product, and the method comprises the steps: obtaining signaling data sent by a client terminal, the signaling data at least comprising a target client terminal identifier; according to a pre-stored auditing rule group, determining a target auditing rule corresponding to the target client terminal, the auditing rule group comprising auditing rules of a plurality of communication protocols, and the auditing rules corresponding to the client terminal; determining keyword data in the signaling data according to a preset matching algorithm; determining a matching result of the keyword data and an audit rule according to the keyword data and the target audit rule; and determining the auditing result of the signaling data according to the matching result, thereby correspondingly auditing the signaling data of different communication protocols, and improving the auditing efficiency.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a signaling audit method, electronic equipment, storage medium and program product. Background Art

[0002] IoT signaling audit refers to the process of collecting, analyzing and evaluating signaling data in the communication network. Signaling data is information used to control and manage communication connections during network communication, including user identity, device information, communication type, etc. The purpose of IoT signaling audit is to ensure the legality, security and effectiveness of network communications. By analyzing signaling data, potential threats and abnormal behaviors can be identified, and corresponding measures can be taken to protect the network from attacks.

[0003] In the existing technology, when auditing signaling data, only the signaling of a single protocol can be audited, and then it is determined which behaviors are legal and which behaviors are abnormal or require attention, so as to issue alarms or block processing. However, it is unable to adapt to the signaling audit of multiple different protocols. How to audit the signaling of different protocols and improve the audit efficiency is an urgent problem that needs to be solved. Summary of the invention

[0004] The purpose of some embodiments of the present application is to provide a signaling audit method, electronic device, storage medium and program product. Through the technical solution of the embodiments of the present application, by obtaining signaling data sent by a client terminal, wherein the signaling data at least includes a target client terminal identifier; determining a target audit rule corresponding to the target client terminal according to a pre-stored audit rule group, wherein the audit rule group includes audit rules for multiple communication protocols, and the audit rule corresponds to the client terminal; determining keyword data in the signaling data according to a preset matching algorithm; determining a matching result between the keyword data and the audit rule according to the keyword data and the target audit rule; and determining an audit result of the signaling data according to the matching result. The embodiments of the present application audit the signaling data of different communication protocols of different client terminals by pre-establishing an audit rule group, identifying keyword data in the signaling data through a preset matching algorithm, and then auditing according to the audit rule corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited accordingly to improve audit efficiency.

[0005] In a first aspect, some embodiments of the present application provide a signaling audit method, including:

[0006] Acquire signaling data sent by a client terminal, wherein the signaling data at least includes a target client terminal identifier;

[0007] Determining a target audit rule corresponding to the target client terminal according to a pre-stored audit rule group, wherein the audit rule group includes audit rules for multiple communication protocols, and the audit rules correspond to the client terminal;

[0008] Determining keyword data in the signaling data according to a preset matching algorithm;

[0009] Determining a matching result between the keyword data and the audit rule according to the keyword data and the target audit rule;

[0010] According to the matching result, an audit result of the signaling data is determined.

[0011] Some embodiments of the present application audit the signaling data of different communication protocols of different client terminals by pre-establishing an audit rule group, identifying keyword data in the signaling data through a preset matching algorithm, and then performing an audit according to the audit rules corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited accordingly, thereby improving audit efficiency.

[0012] Optionally, the pre-stored audit rule group includes at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

[0013] Some embodiments of the present application add audit rules with the same or similar functions to the same audit rule group. The audit rule group can be associated and called by the audit object and the potential hazard module. It is not limited to the same communication protocol and can be applied to multiple different communication protocols.

[0014] Optionally, determining a matching result between the keyword data and the audit rule according to the keyword data and the target audit rule includes:

[0015] When the keyword data satisfies at least any one of the following conditions, obtaining an audit rule corresponding to the keyword, wherein the condition includes at least a variable condition and an invariant condition;

[0016] According to the audit rule, a matching result corresponding to the keyword is determined.

[0017] Some embodiments of the present application achieve different functional configurations by flexibly configuring various functions, associating statistical objects (unchanged conditions), changing fields (changing conditions) with audit rule groups, setting thresholds (number of matches) and time (within a certain time period).

[0018] Optionally, determining a matching result corresponding to the keyword according to the audit rule includes:

[0019] Determining whether the keyword data matches the data in the audit rule;

[0020] If the keyword data matches the data in the audit rule, the number of successful matches is recorded.

[0021] Optionally, determining an audit result of the signaling data according to the matching result includes:

[0022] Count the number of successful matches within the preset time;

[0023] If the number of successful matches is greater than a preset threshold, an audit result of the signaling data is determined, and the audit result at least includes warning information or prompt information.

[0024] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0025] Optionally, the determining whether the keyword data matches the data in the audit rule includes:

[0026] Determine whether the signaling keyword in the keyword data matches the preset signaling data in the audit rule.

[0027] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0028] Optionally, the determining whether the keyword data matches the data in the audit rule includes:

[0029] Determine whether the content keywords in the keyword data match the preset content data in the audit rule.

[0030] Some embodiments of the present application configure statistical objects, change fields, time, thresholds, etc., which are associated with audit rule groups, freely combined, and flexibly configured to cope with different specific IoT business scenarios.

[0031] In a second aspect, some embodiments of the present application provide a signaling audit device, including:

[0032] An acquisition module, used to acquire signaling data sent by a client terminal, wherein the signaling data at least includes a target client terminal identifier;

[0033] A determination module, configured to determine a target audit rule corresponding to the target client terminal according to a pre-stored audit rule group, wherein the audit rule group includes audit rules for multiple communication protocols, and the audit rules correspond to the client terminal;

[0034] An identification module, used to determine the keyword data in the signaling data according to a preset matching algorithm;

[0035] A matching module, used for determining a matching result between the keyword data and the audit rule according to the keyword data and the target audit rule;

[0036] An audit module is used to determine an audit result of the signaling data based on the matching result.

[0037] Some embodiments of the present application audit the signaling data of different communication protocols of different client terminals by pre-establishing an audit rule group, identifying keyword data in the signaling data through a preset matching algorithm, and then performing an audit according to the audit rules corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited accordingly, thereby improving audit efficiency.

[0038] Optionally, the pre-stored audit rule group includes at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

[0039] Some embodiments of the present application add audit rules with the same or similar functions to the same audit rule group. The audit rule group can be associated and called by the audit object and the potential hazard module. It is not limited to the same communication protocol and can be applied to multiple different communication protocols.

[0040] Optionally, the matching module is used to:

[0041] When the keyword data satisfies at least any one of the following conditions, obtaining an audit rule corresponding to the keyword, wherein the condition includes at least a variable condition and an invariant condition;

[0042] According to the audit rule, a matching result corresponding to the keyword is determined.

[0043] Some embodiments of the present application achieve different functional configurations by flexibly configuring various functions, associating statistical objects (unchanged conditions), changing fields (changing conditions) with audit rule groups, setting thresholds (number of matches) and time (within a certain time period).

[0044] Optionally, the matching module is used to:

[0045] Determining whether the keyword data matches the data in the audit rule;

[0046] If the keyword data matches the data in the audit rule, the number of successful matches is recorded.

[0047] Optionally, the audit module is used to:

[0048] Count the number of successful matches within the preset time;

[0049] If the number of successful matches is greater than a preset threshold, an audit result of the signaling data is determined, and the audit result at least includes warning information or prompt information.

[0050] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0051] Optionally, the matching module is used to:

[0052] Determine whether the signaling keyword in the keyword data matches the preset signaling data in the audit rule.

[0053] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0054] Optionally, the matching module is used to:

[0055] Determine whether the content keywords in the keyword data match the preset content data in the audit rule.

[0056] Some embodiments of the present application configure statistical objects, change fields, time, thresholds, etc., which are associated with audit rule groups, freely combined, and flexibly configured to cope with different specific IoT business scenarios.

[0057] In a third aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the signaling audit method as described in any embodiment of the first aspect can be implemented.

[0058] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the signaling audit method as described in any embodiment of the first aspect.

[0059] In a fifth aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein the computer program, when executed by a processor, can implement the signaling audit method as described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1 A flowchart of a signaling audit method provided in an embodiment of the present application;

[0062] Figure 2 A schematic diagram of the structure of the signaling audit system provided in the embodiment of the present application;

[0063] Figure 3 A flowchart of another signaling audit method provided in an embodiment of the present application;

[0064] Figure 4 A flowchart of another signaling audit method provided in an embodiment of the present application;

[0065] Figure 5 A schematic diagram of the structure of a signaling audit device provided in an embodiment of the present application;

[0066] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0067] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0068] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0069] IoT signaling audit refers to the process of collecting, analyzing and evaluating signaling data in the communication network. Signaling data is information used to control and manage communication connections during network communication, including user identity, device information, communication type, etc. The purpose of IoT signaling audit is to ensure the legality, security and effectiveness of network communications. By analyzing signaling data, potential threats and abnormal behaviors can be identified, and then corresponding measures can be taken to protect the network from attacks. In the prior art, when auditing signaling data, only the signaling of a single protocol can be audited, and then it is determined which behaviors are legal and which behaviors are abnormal or require attention, so as to issue an alarm or block processing. However, it is not possible to adapt to signaling audits of multiple different protocols. In view of this, some embodiments of the present application provide a signaling audit method, which obtains signaling data sent by a client terminal, wherein the signaling data at least includes a target client terminal identifier; according to a pre-stored audit rule group, a target audit rule corresponding to the target client terminal is determined, wherein the audit rule group includes audit rules for multiple communication protocols. , and the audit rules correspond to the client terminals; according to the preset matching algorithm, determine the keyword data in the signaling data; according to the keyword data and the target audit rules, determine the matching results of the keyword data and the audit rules; according to the matching results, determine the audit results of the signaling data. The embodiment of the present application audits the signaling data of different communication protocols of different client terminals by pre-establishing an audit rule group, identifies the keyword data in the signaling data through a preset matching algorithm, and then audits according to the audit rules corresponding to the client terminals. In this way, the signaling data of different communication protocols can be audited accordingly, thereby improving the audit efficiency. Figure 1 As shown, an embodiment of the present application provides a signaling audit method, the method comprising:

[0070] S101, obtaining signaling data sent by a client terminal, wherein the signaling data at least includes a target client terminal identifier;

[0071] Specifically, the gateway device obtains signaling data sent by each client terminal, and the signaling data at least includes a client terminal identifier, and the client terminal identifier may be a client name or a client IP address.

[0072] S102, determining a target audit rule corresponding to a target client terminal according to a pre-stored audit rule group, wherein the audit rule group includes audit rules for multiple communication protocols, and the audit rules correspond to the client terminals;

[0073] Specifically, an audit rule group is pre-stored on the gateway device, and the audit rule group includes audit rules for one or more communication protocols, and a corresponding communication protocol is set for a client terminal. That is to say, a communication protocol in the audit rule group corresponds to multiple client terminals, or the audit rule group includes multiple communication protocols, each communication protocol corresponds to one client terminal or multiple client terminals. The embodiments of the present application can be set according to actual needs.

[0074] After acquiring the target client terminal identifier in the signaling data, the gateway device matches the target audit rule corresponding to the target client terminal identifier in the audit rule group.

[0075] S103, determining keyword data in the signaling data according to a preset matching algorithm;

[0076] Specifically, after determining the target audit rule, the gateway device uses a preset matching algorithm to identify the keyword data in the signaling data. For example, a regular expression may be used to identify the keyword data in the signaling data.

[0077] A regular expression is a logical formula for operating on strings and special characters, including common characters (for example, letters from a to z) and "meta-characters" (special characters). It uses some pre-defined specific characters and combinations of these specific characters to form a "regular string". This "regular string" is used to express a filtering logic for strings. A regular expression is a text pattern that describes one or more strings to be matched when searching for text.

[0078] S104, determining a matching result between the keyword data and the audit rule according to the keyword data and the target audit rule;

[0079] Specifically, after acquiring the keyword data and the target audit rule, the gateway device matches the keyword data and the target audit rule to obtain a matching result.

[0080] Exemplarily, the audit rules include configurations of thresholds and preset time periods. For example, the keyword data may be a source IP address, and the source IP address is matched with the target audit rules. If the target audit rules include the source IP address, a matching result is obtained.

[0081] S105. Determine the audit result of the signaling data according to the matching result.

[0082] Specifically, the gateway device obtains the matching result, that is, whether the target audit rule contains the keyword data in the signaling data. If the target audit rule includes the keyword data, it records a number of successful matches and makes a judgment based on the number of successful matches in the preset time period to obtain the audit result.

[0083] Some embodiments of the present application audit the signaling data of different communication protocols of different client terminals by pre-establishing an audit rule group, identifying keyword data in the signaling data through a preset matching algorithm, and then performing an audit according to the audit rules corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited accordingly, thereby improving audit efficiency.

[0084] Another embodiment of the present application further supplements the signaling audit method provided in the above embodiment.

[0085] like Figure 2 As shown in the figure, the entire IoT potential hazard system is mainly divided into three major modules: basic configuration module, IoT traffic analysis module, and IoT business scenario free configuration module. The basic configuration module is further divided into: audit rule configuration module (divided into IoT signaling audit configuration module and content extraction configuration module), audit rule group configuration module, and audit object configuration module; the IoT business scenario free configuration module mainly includes the potential hazard configuration module, and the potential hazard module is associated with the audit rule group module.

[0086] like Figure 3 As shown, it mainly includes the following 4 steps:

[0087] (1) Configure audit rules: including the configuration of IoT signaling audit fields and content extraction fields. IoT signaling audit fields and content extraction fields are the main analysis objects of the IoT traffic analysis module, and are also the source range of statistical objects and change fields in potential hazards. Signaling fields and content extraction fields support input matching of values ​​and regular expressions. Among them, the content extraction field extracts more specific information from the IoT signaling audit field. According to the business scenario, select one or several protocols used in the business, and configure the signaling fields and content extraction fields that need to be audited according to different protocols.

[0088] (2) Configure the audit rule group: Add audit rules with the same or similar functions to the same audit rule group. The audit rule group can be associated and called by the audit object and the potential harm module, and is not limited to the same protocol.

[0089] (3) Associate audit objects: Associate the terminal objects to be audited with the audit rule group (IP). The IoT traffic analysis module mainly audits the traffic of these selected audit terminal objects and analyzes whether the traffic of these audit terminal objects matches the audit rule group. As long as any audit rule configured in the audit rule group is matched, then this audit rule group is matched. After that, the IoT traffic analysis module will push the matching results to the IoT potential harm system.

[0090] (4) To deal with specific IoT business scenarios: Flexibly configure various functions in the IoT potential hazard system, and realize different functional configurations by associating statistical objects (unchanged conditions), changing fields (changing conditions) with audit rule groups, setting thresholds (number of matches) and time (within a certain time period). The statistical objects and changing fields are the signaling fields and content extraction fields configured in all audit rules in the associated audit rule group. After the selection is completed, the IoT potential hazard system will match their contents, count the unchanged (fields selected by the statistical object) and changing (fields selected by the changing field) conditions within the configured time, and determine whether they exceed the threshold. If they exceed the threshold, an alarm message will be output.

[0091] like Figure 4 As shown, the detailed potential hazard system workflow diagram is as follows:

[0092] Step 1: Associate the potentially harmful functions with the audit rule group;

[0093] Step 2: The traffic analysis module outputs the results;

[0094] Step 3: Determine whether the selected field, time and threshold in the statistical object match; if so, proceed to step 4; if not, proceed to the next round of matching judgment;

[0095] Step 4: Determine whether the field, time and threshold selected in the change field match; if so, execute step 5; if not, proceed to the next round of matching judgment;

[0096] Step 5: Output warning information.

[0097] Optionally, the pre-stored audit rule group includes at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

[0098] Some embodiments of the present application add audit rules with the same or similar functions to the same audit rule group. The audit rule group can be associated and called by the audit object and the potential hazard module. It is not limited to the same communication protocol and can be applied to multiple different communication protocols.

[0099] Optionally, according to the keyword data and the target audit rule, determining a matching result of the keyword data and the audit rule includes:

[0100] When the keyword data satisfies at least one of the following conditions, obtaining the audit rules corresponding to the keyword, wherein the conditions include at least a variable condition and an invariant condition;

[0101] According to the audit rules, determine the matching results corresponding to the keywords.

[0102] Some embodiments of the present application achieve different functional configurations by flexibly configuring various functions, associating statistical objects (unchanged conditions), changing fields (changing conditions) with audit rule groups, setting thresholds (number of matches) and time (within a certain time period).

[0103] Optionally, according to the audit rules, a matching result corresponding to the keyword is determined, including:

[0104] Determine whether the keyword data matches the data in the audit rules;

[0105] If the keyword data matches the data in the audit rules, the number of successful matches is recorded.

[0106] Optionally, based on the matching result, an audit result related to the signaling data is determined, including:

[0107] Count the number of successful matches within the preset time;

[0108] If the number of successful matches is greater than a preset threshold, the audit result of the signaling data is determined, and the audit result at least includes an alarm message or a prompt message.

[0109] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0110] Optionally, determining whether the keyword data matches the data in the audit rule includes:

[0111] Determine whether the signaling keywords in the keyword data match the preset signaling data in the audit rules.

[0112] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0113] Optionally, determining whether the keyword data matches the data in the audit rule includes:

[0114] Determine whether the content keywords in the keyword data match the preset content data in the audit rules.

[0115] Some embodiments of the present application configure statistical objects, change fields, time, thresholds, etc., which are associated with audit rule groups, freely combined, and flexibly configured to cope with different specific IoT business scenarios.

[0116] Exemplarily, the present invention can detect excessive frequency access to the same IP through the http GET method through the Internet of Things potential hazard system.

[0117] The signaling audit method provided in the embodiment of the present application includes:

[0118] 1. Configure audit rules. The IoT signaling audit field is the http method, the matching content is GET, and the content extraction field is the source IP address. The specific content of the IP address can be extracted through regular expressions.

[0119] 2. Add the audit rules in 1 to an audit rule group.

[0120] 3. Associate the object terminal that needs to be audited with the audit rule group in 2, and use the IoT traffic analysis module to analyze the traffic in the actual business.

[0121] 4. Select the audit rule group in 2 in the potential harm of the Internet of Things, and select the source IP address of the audit rule content extraction field in 1 as the statistical object. At this time, there is no need to count the change field, so you can choose not to do so. The time can be set to 60s, and the threshold can be set to 10. In this way, the function of counting frequency overlimit is configured through the potential harm system of the Internet of Things. Specifically, it counts whether the same IP accesses the audit object terminal in 3 more than 10 times through the http GET method within 60s. If the same IP accesses the audit object terminal in 3 more than 10 times through the http GET method within 60s, an alarm message will be triggered.

[0122] Exemplarily, the embodiments of the present application can detect remote login of the camera through the Internet of Things potential hazard system.

[0123] The signaling audit method provided in the embodiment of the present application includes:

[0124] 1. Configure audit rules. The IoT signaling audit field is the video protocol, and the content extraction field is the user name, source IP address, and destination IP address. The specific content of the user name, source IP address, and destination IP address can be extracted through regular expressions. Multiple audit rules for multiple protocols can be configured.

[0125] 2. Add the audit rules in 1 to an audit rule group.

[0126] 3. Associate the object terminal that needs to be audited with the audit rule group in 2, and use the IoT traffic analysis module to analyze the traffic in the actual business.

[0127] 4. Select the audit rule group in 2 in the potential harm of the Internet of Things, select the audit rule content extraction field user name user and destination IP address in 1 for statistical objects, select the audit rule content extraction field source IP address in 1 for change fields, the time can be set to 600s, and the threshold can be set to 1. In this way, the function of statistical remote login is configured through the potential harm system of the Internet of Things. Specifically, it is to count the same user name user accessing the same destination IP address, and whether there is a change frequency of more than 1 access to the audit object terminal in 3 within 600s, that is, whether there is a remote login for the camera. If the same user name user accesses the same destination IP address and visits the audit object terminal in 3 more than once within 600s, an alarm message will be triggered, indicating that the camera has a remote login.

[0128] The IoT signaling audit of the embodiment of the present application can be applied in various fields and is not limited to a certain protocol; there is no need to maintain a rule base, and the signaling audit function can be realized by configuring audit rules; various functions can be flexibly configured through the IoT potential hazard system to cope with specific IoT business scenarios;

[0129] The IoT signaling audit system captures traffic that flows through or bypasses the gateway device. This traffic includes various network communication data, such as HTTP, HTTPS, FTP, etc. Then, the IoT signaling audit system will perform protocol analysis on the captured traffic and extract the keyword values ​​of the application layer protocol. These keyword values ​​may include URL, request parameters, response code, etc. The parsed keyword values ​​will be matched with the pre-configured audit rules. These audit rules usually define which behaviors are legal, which behaviors are abnormal or need attention. According to the matching results, the IoT signaling audit system will process the traffic accordingly. If the traffic meets the characteristics of abnormal behavior or potential threats, the system will issue an alarm or block it. At the same time, the IoT signaling audit system may also record relevant log information for subsequent analysis. IoT signaling audit is characterized by real-time, accuracy, and flexibility. IoT signaling audit can capture and analyze network traffic in real time and discover potential threats in a timely manner. By accurately matching the keyword values ​​of the application layer protocol, the accuracy of detection is improved. Audit rules can be configured and adjusted as needed to adapt to different network environments and security requirements. Based on the IoT signaling audit, the potential harm of the IoT can be more flexibly configured with business-related functions on the basis of the IoT signaling audit, and the IoT signaling audit can be truly applied to the actual IoT business scenarios to improve the security and reliability of the IoT business. By flexibly configuring business-related functions and truly applying the IoT signaling audit to the actual IoT business scenarios, it can further play its important role in IoT security.

[0130] It should be noted that each implementable method in this embodiment may be implemented separately, or may be implemented in combination in any combination without conflict, and this application is not limited thereto.

[0131] Another embodiment of the present application provides a signaling audit device for executing the signaling audit method provided in the above embodiment.

[0132] like Figure 5 , which is a schematic diagram of the structure of a signaling audit device provided in an embodiment of the present application. The signaling audit device includes an acquisition module 501, a determination module 502, an identification module 503, a matching module 504 and an audit module 505, wherein:

[0133] The acquisition module 501 is used to acquire signaling data sent by the client terminal, wherein the signaling data at least includes a target client terminal identifier;

[0134] The determination module 502 is used to determine the target audit rule corresponding to the target client terminal according to the pre-stored audit rule group, wherein the audit rule group includes audit rules of multiple communication protocols, and the audit rules correspond to the client terminal;

[0135] The identification module 503 is used to determine the keyword data in the signaling data according to a preset matching algorithm;

[0136] The matching module 504 is used to determine the matching result between the keyword data and the audit rule according to the keyword data and the target audit rule;

[0137] The audit module 505 is used to determine the audit result of the signaling data according to the matching result.

[0138] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0139] Some embodiments of the present application audit the signaling data of different communication protocols of different client terminals by pre-establishing an audit rule group, identifying keyword data in the signaling data through a preset matching algorithm, and then performing an audit according to the audit rules corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited accordingly, thereby improving audit efficiency.

[0140] Another embodiment of the present application further supplements the signaling audit device provided in the above embodiment.

[0141] Optionally, the pre-stored audit rule group includes at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

[0142] Some embodiments of the present application add audit rules with the same or similar functions to the same audit rule group. The audit rule group can be associated and called by the audit object and the potential hazard module. It is not limited to the same communication protocol and can be applied to multiple different communication protocols.

[0143] Optionally, a matching module is used to:

[0144] When the keyword data satisfies at least one of the following conditions, obtaining the audit rules corresponding to the keyword, wherein the conditions include at least a variable condition and an invariant condition;

[0145] According to the audit rules, determine the matching results corresponding to the keywords.

[0146] Some embodiments of the present application achieve different functional configurations by flexibly configuring various functions, associating statistical objects (unchanged conditions), changing fields (changing conditions) with audit rule groups, setting thresholds (number of matches) and time (within a certain time period).

[0147] Optionally, a matching module is used to:

[0148] Determine whether the keyword data matches the data in the audit rules;

[0149] If the keyword data matches the data in the audit rules, the number of successful matches is recorded.

[0150] Optionally, an audit module to:

[0151] Count the number of successful matches within the preset time;

[0152] If the number of successful matches is greater than a preset threshold, the audit result of the signaling data is determined, and the audit result at least includes an alarm message or a prompt message.

[0153] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0154] Optionally, a matching module is used to:

[0155] Determine whether the signaling keywords in the keyword data match the preset signaling data in the audit rules.

[0156] Some embodiments of the present application implement the audit function by configuring audit rules, customizing signaling fields and content extraction fields, and using multiple matching methods such as values ​​or regular expressions, and are not limited to the rule base.

[0157] Optionally, a matching module is used to:

[0158] Determine whether the content keywords in the keyword data match the preset content data in the audit rules.

[0159] Some embodiments of the present application configure statistical objects, change fields, time, thresholds, etc., which are associated with audit rule groups, freely combined, and flexibly configured to cope with different specific IoT business scenarios.

[0160] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0161] It should be noted that each implementable method in this embodiment may be implemented separately, or may be implemented in combination in any combination without conflict, and this application is not limited thereto.

[0162] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the operation of the method corresponding to any embodiment of the signaling audit method provided in the above embodiments can be implemented.

[0163] An embodiment of the present application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations of the method corresponding to any embodiment of the signaling audit method provided in the above embodiments.

[0164] like Figure 6 As shown, some embodiments of the present application provide an electronic device 600, which includes: a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620, wherein the processor 620 can implement a method of any embodiment included in the above-mentioned signaling audit method when reading the program from the memory 610 through a bus 630 and executing the program.

[0165] Processor 620 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 620 can be a microprocessor.

[0166] The memory 610 may be used to store instructions executed by the processor 620 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 620 of the disclosed embodiment may be used to execute instructions in the memory 610 to implement the method shown above. The memory 610 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0167] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0168] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0169] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A signaling audit method, characterized in that: The method comprises: Acquire signaling data sent by a client terminal, wherein the signaling data at least includes a target client terminal identifier; Determining a target audit rule corresponding to the target client terminal according to a pre-stored audit rule group, wherein the audit rule group includes audit rules for multiple communication protocols, and the audit rules correspond to the client terminal; Determining keyword data in the signaling data according to a preset matching algorithm; Determining a matching result between the keyword data and the audit rule according to the keyword data and the target audit rule; According to the matching result, an audit result of the signaling data is determined.

2. The signaling audit method according to claim 1, characterized in that: The pre-stored audit rule group includes at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

3. The signaling audit method according to claim 1, characterized in that: Determining the matching result between the keyword data and the audit rule according to the keyword data and the target audit rule includes: When the keyword data satisfies at least any one of the following conditions, obtaining an audit rule corresponding to the keyword, wherein the condition includes at least a variable condition and an invariant condition; According to the audit rule, a matching result corresponding to the keyword is determined.

4. The signaling audit method according to claim 3, characterized in that: Determining the matching result corresponding to the keyword according to the audit rule includes: Determining whether the keyword data matches the data in the audit rule; If the keyword data matches the data in the audit rule, the number of successful matches is recorded.

5. The signaling audit method according to claim 4, characterized in that: Determining the audit result of the signaling data according to the matching result includes: Count the number of successful matches within the preset time; If the number of successful matches is greater than a preset threshold, an audit result of the signaling data is determined, and the audit result at least includes warning information or prompt information.

6. The signaling audit method according to claim 4, characterized in that: The determining whether the keyword data matches the data in the audit rule includes: Determine whether the signaling keyword in the keyword data matches the preset signaling data in the audit rule.

7. The signaling audit method according to claim 4, characterized in that: The determining whether the keyword data matches the data in the audit rule includes: Determine whether the content keywords in the keyword data match the preset content data in the audit rule.

8. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor can implement the signaling audit method described in any one of claims 1 to 7 when executing the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the program, when executed by a processor, can implement the signaling audit method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, wherein: When the computer program is executed by a processor, it can implement the signaling audit method described in any one of claims 1 to 7.

Images