A signaling auditing method, electronic equipment, storage medium and program product

Abstract

Embodiments of the present application provide a signaling auditing method, an electronic device, a storage medium and a program product, the method comprising: obtaining signaling data sent by a client terminal, wherein the signaling data at least comprises a target client terminal identifier; determining a target auditing rule corresponding to the target client terminal according to a pre-stored auditing rule set, wherein the auditing rule set comprises auditing rules of multiple communication protocols, and the auditing rules correspond to the client terminals; determining keyword data in the signaling data according to a pre-set matching algorithm; determining a matching result of the keyword data and the auditing rule according to the keyword data and the target auditing rule; and determining an auditing result of the signaling data according to the matching result, so that the signaling data of different communication protocols can be audited correspondingly, and the auditing efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a signaling auditing method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] The Internet of Things signaling auditing refers to the process of collecting, analyzing and evaluating signaling data in a communication network. Signaling data is information used to control and manage communication connections in network communication, including user identity, device information, communication type, etc. The purpose of Internet of Things signaling auditing is to ensure the legality, security and effectiveness of network communication. Through analysis of signaling data, potential threats and abnormal behaviors can be identified, and appropriate measures can be taken to protect the network from attacks.

[0003] In the prior art, when auditing signaling data, only signaling of a single protocol can be audited to determine which behaviors are legal, which behaviors are abnormal or need attention, and thus alarm or blocking processing can be performed. However, it is unable to adapt to signaling auditing of multiple different protocols. How to audit signaling of different protocols and improve auditing efficiency is a problem that needs to be solved at present. SUMMARY

[0004] Some embodiments of the present application aim to provide a signaling auditing method, an electronic device, a storage medium and a program product. Through the technical solutions of the embodiments of the present application, signaling data sent by a client terminal is acquired, wherein the signaling data at least includes a target client terminal identifier; a target auditing rule corresponding to the target client terminal is determined according to a pre-stored auditing rule group, wherein the auditing rule group includes auditing rules of multiple communication protocols, and the auditing rules correspond to client terminals; key word data in the signaling data is determined according to a pre-set matching algorithm; a matching result of the key word data and the auditing rule is determined according to the key word data and the target auditing rule; and an auditing result of the signaling data is determined according to the matching result. The embodiments of the present application audit signaling data of different communication protocols of different client terminals by pre-establishing an auditing rule group, identify key word data in the signaling data through a pre-set matching algorithm, and then audit according to the auditing rule corresponding to the client terminal. In this way, signaling data of different communication protocols can be audited correspondingly, and the auditing efficiency is improved.

[0005] In a first aspect, some embodiments of the present application provide a signaling auditing method, comprising:

[0006] acquiring signaling data sent by a client terminal, wherein the signaling data at least includes a target client terminal identifier;

[0007] determine a target audit rule corresponding to the target client terminal according to a pre-stored audit rule set, wherein the audit rule set comprises audit rules of multiple communication protocols, and the audit rules correspond to client terminals;

[0008] determine keyword data in the signaling data according to a preset matching algorithm;

[0009] determine a matching result of the keyword data and the audit rule according to the keyword data and the target audit rule;

[0010] determine an audit result of the signaling data according to the matching result.

[0011] Some embodiments of the present application audit signaling data of different communication protocols of different client terminals by pre-establishing an audit rule set, identify keyword data in the signaling data by a preset matching algorithm, and then perform auditing according to the audit rule corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited, and the auditing efficiency is improved.

[0012] Optionally, the pre-stored audit rule set comprises at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

[0013] Some embodiments of the present application add audit rules with the same or similar functions to the same audit rule set, and the audit rule set can be associated with and called by an audit object and a potential hazard module, and is not limited to the same communication protocol, but can be applied to multiple different communication protocols.

[0014] Optionally, the determination of the matching result of the keyword data and the audit rule according to the keyword data and the target audit rule comprises:

[0015] in a case where the keyword data at least satisfies any one of the following conditions, an audit rule corresponding to the keyword is obtained, wherein the conditions at least comprise variable conditions and invariable conditions;

[0016] a matching result corresponding to the keyword is determined according to the audit rule.

[0017] Some embodiments of the present application flexibly configure various functions, associate statistical objects (invariable conditions) and variable fields (variable conditions) with the audit rule set, set thresholds (the number of matches) and time (a certain time period), and realize different function configurations.

[0018] Optionally, the determination of the matching result corresponding to the keyword according to the audit rule comprises:

[0019] determining whether the keyword data matches data in the audit rule;

[0020] If the keyword data matches the data in the audit rule, recording the number of successful matches.

[0021] Optionally, the determining the audit result of the signaling data according to the matching result comprises:

[0022] counting the number of successful matches in a preset time;

[0023] If the number of successful matches is greater than a preset threshold, determining the audit result of the signaling data, the audit result at least comprising alarm information or prompt information.

[0024] Some embodiments of the present application realize the audit function by configuring the audit rule, customizing the signaling field and the content extraction field, and using multiple matching methods such as value or regular expression, and are not limited to the rule library.

[0025] Optionally, the determining whether the keyword data matches data in the audit rule comprises:

[0026] determining whether a signaling keyword in the keyword data matches preset signaling data in the audit rule.

[0027] Some embodiments of the present application realize the audit function by configuring the audit rule, customizing the signaling field and the content extraction field, and using multiple matching methods such as value or regular expression, and are not limited to the rule library.

[0028] Optionally, the determining whether the keyword data matches data in the audit rule comprises:

[0029] determining whether a content keyword in the keyword data matches preset content data in the audit rule.

[0030] Some embodiments of the present application realize the audit function by configuring the audit rule, customizing the signaling field and the content extraction field, and using multiple matching methods such as value or regular expression, and are not limited to the rule library.

[0031] In a second aspect, some embodiments of the present application provide a signaling audit device, comprising:

[0032] an acquisition module configured to acquire signaling data sent by a client terminal, wherein the signaling data at least comprises a target client terminal identifier;

[0033] determining a target audit rule corresponding to the target client terminal according to a pre-stored audit rule set, wherein the audit rule set comprises audit rules of multiple communication protocols, and the audit rules correspond to client terminals;

[0034] identifying keyword data in the signaling data according to a pre-set matching algorithm;

[0035] matching the keyword data with the target audit rule to determine a matching result of the keyword data and the audit rule;

[0036] auditing the signaling data according to the matching result.

[0037] Some embodiments of the present application audit signaling data of different communication protocols of different client terminals by pre-establishing an audit rule set, identify keyword data in the signaling data by a pre-set matching algorithm, and then audit the signaling data according to the audit rule corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited, and the auditing efficiency is improved.

[0038] Optionally, the pre-stored audit rule set comprises at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

[0039] Some embodiments of the present application add audit rules with the same or similar functions to the same audit rule set, and the audit rule set can be associated with the calling object and the potential hazard module, and is not limited to the same communication protocol, but can be applied to multiple different communication protocols.

[0040] Optionally, the matching module is configured to:

[0041] acquire the audit rule corresponding to the keyword when the keyword data at least satisfies any one of the following conditions, wherein the conditions comprise at least variable conditions and invariable conditions;

[0042] determine a matching result corresponding to the keyword according to the audit rule.

[0043] Some embodiments of the present application flexibly configure various functions, associate the statistical object (invariable conditions) and the variable field (variable conditions) with the audit rule set, set the threshold (the number of matches) and the time (within a certain time period), and realize different function configurations.

[0044] Optionally, the matching module is configured to:

[0045] determining whether the keyword data matches the data in the audit rule;

[0046] if the keyword data matches the data in the audit rule, recording the number of successful matches.

[0047] Optionally, the audit module is configured to:

[0048] count the number of successful matches in a preset time period;

[0049] if the number of successful matches is greater than a preset threshold, determining an audit result of the signaling data, the audit result at least including alarm information or prompt information.

[0050] Some embodiments of the present application implement the audit function by configuring the audit rule, customizing the signaling field and the content extraction field, and using multiple matching methods such as values or regular expressions, and are not limited to a rule library.

[0051] Optionally, the matching module is configured to:

[0052] determine whether a signaling keyword in the keyword data matches preset signaling data in the audit rule.

[0053] Some embodiments of the present application implement the audit function by configuring the audit rule, customizing the signaling field and the content extraction field, and using multiple matching methods such as values or regular expressions, and are not limited to a rule library.

[0054] Optionally, the matching module is configured to:

[0055] determine whether a content keyword in the keyword data matches preset content data in the audit rule.

[0056] Some embodiments of the present application associate the audit rule group with statistics objects, change fields, time, thresholds, and the like, and freely combine and flexibly configure them to cope with different specific Internet of Things business scenarios.

[0057] In a third aspect, some embodiments of the present application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the signaling audit method according to any one of the embodiments of the first aspect when executing the program.

[0058] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, wherein the program is executable by a processor to implement the signaling audit method according to any one of the embodiments of the first aspect.

[0059] In a fifth aspect, some embodiments of the present application provide a computer program product, which comprises a computer program, wherein the computer program, when executed by a processor, can implement the signaling auditing method according to any one of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required to be used in some embodiments of the present application will be briefly introduced as follows. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0061] Figure 1 A flowchart of a signaling auditing method provided by some embodiments of the present application;

[0062] Figure 2 A structural diagram of a signaling auditing system provided by some embodiments of the present application;

[0063] Figure 3 A flowchart of another signaling auditing method provided by some embodiments of the present application;

[0064] Figure 4 A flowchart of still another signaling auditing method provided by some embodiments of the present application;

[0065] Figure 5 A structural diagram of a signaling auditing device provided by some embodiments of the present application;

[0066] Figure 6 An electronic device provided by some embodiments of the present application. DETAILED DESCRIPTION

[0067] The technical solutions of some embodiments of the present application will be described in detail below with reference to the drawings of some embodiments of the present application.

[0068] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used for distinguishing description, and cannot be understood as indicating or implying relative importance.

[0069] The Internet of Things signaling audit refers to the process of collecting, analyzing and evaluating signaling data in a communication network. Signaling data is information used to control and manage communication connections in the network communication process, including user identity, device information, communication type, etc. The purpose of the Internet of Things signaling audit is to ensure the legality, security and effectiveness of network communication. Through analysis of signaling data, potential threats and abnormal behavior can be identified, and appropriate measures can be taken to protect the network from attacks. In the prior art, when auditing signaling data, only signaling of a single protocol can be audited to determine which behaviors are legal, which behaviors are abnormal or need attention, and thus alarm or blocking processing can be performed. However, it is unable to adapt to signaling audit of multiple different protocols. In view of this, some embodiments of the present application provide a signaling audit method. The method comprises the following steps: Figure 1 As shown in FIG. 10, the embodiments of the present application provide a signaling audit method. The method comprises the following steps:

[0070] S101, acquiring signaling data sent by a client terminal, wherein the signaling data at least comprises a target client terminal identifier;

[0071] Specifically, the gateway device acquires signaling data sent by each client terminal. The signaling data at least comprises a client terminal identifier, which can be a client name or a client IP address.

[0072] S102, determining a target audit rule corresponding to the target client terminal according to a pre-stored audit rule group, wherein the audit rule group comprises audit rules of multiple communication protocols, and the audit rules correspond to the client terminals;

[0073] Specifically, the gateway device pre-stores an audit rule group including one or more audit rules of communication protocols, and sets a corresponding communication protocol for one client terminal, that is, one communication protocol in the audit rule group corresponds to multiple client terminals, or the audit rule group includes multiple communication protocols, and each communication protocol corresponds to one or more client terminals. In the embodiment of the application, the actual needs can be set.

[0074] After obtaining the target client terminal identifier in the signaling data, the gateway device matches the target audit rule corresponding to the target client terminal identifier in the audit rule group.

[0075] S103, determining the keyword data in the signaling data according to a preset matching algorithm;

[0076] Specifically, after determining the target audit rule, the gateway device identifies the keyword data in the signaling data by using a preset matching algorithm, for example, a regular expression can be used to identify the keyword data in the signaling data.

[0077] The regular expression is a logical formula for operating on strings and special characters, which includes normal characters (for example, letters between a and z) and "meta characters" (special characters). Some specific characters and combinations of these specific characters are defined in advance to form a "rule string", and the "rule string" is used to express a filtering logic for a string. The regular expression is a text pattern that describes one or more strings to be matched when searching for a text.

[0078] S104, determining a matching result of the keyword data and the audit rule according to the keyword data and the target audit rule;

[0079] Specifically, after obtaining the keyword data and the target audit rule, the gateway device matches the keyword data and the target audit rule to obtain a matching result.

[0080] For example, the audit rule includes a threshold value and a preset time period, and the keyword data can be a source IP address. The source IP address is matched with the target audit rule, and if the source IP address is included in the target audit rule, a matching result is obtained.

[0081] S105, determining an audit result of the signaling data according to the matching result.

[0082] Specifically, the gateway device determines whether the keyword data in the signaling data is included in the target audit rule according to the obtained matching result. If the keyword data is included in the target audit rule, a matching success number is recorded, and the audit result is determined according to the matching success number and the preset time period.

[0083] Some embodiments of the present application audit signaling data of different communication protocols of different client terminals by pre-establishing a set of audit rules, identify key word data in the signaling data through a preset matching algorithm, and then perform auditing according to the audit rules corresponding to the client terminals. In this way, the signaling data of different communication protocols can be audited, and the auditing efficiency is improved.

[0084] Another embodiment of the present application further supplements the signaling auditing method provided in the above embodiment.

[0085] As shown in Figure 2 The entire Internet of Things potential hazard system is mainly divided into three modules: a basic configuration module, an Internet of Things traffic analysis module, and an Internet of Things business scenario free configuration module. The basic configuration module is further divided into an audit rule configuration module (divided into an Internet of Things signaling audit configuration module and a content extraction configuration module), an audit rule group configuration module, and an audit object configuration module. The Internet of Things business scenario free configuration module mainly includes a potential hazard configuration module, which is associated with the audit rule group module.

[0086] As shown in Figure 3 The method mainly includes the following four steps:

[0087] (1) Configure audit rules: including the configuration of Internet of Things signaling audit fields and content extraction fields. The Internet of Things signaling audit fields and content extraction fields are the main analysis objects of the Internet of Things traffic analysis module, and are also the source range of the statistical objects and change fields in the potential hazard. The signaling fields and content extraction fields support the input matching of values and regular expressions. The content extraction field extracts more specific information from the Internet of Things signaling audit field. According to the business scenario, one or several protocols used in the business are selected, and the signaling fields and content extraction fields that need to be audited are configured according to different protocols.

[0088] (2) Configure audit rule groups: add audit rules with the same or similar functions to the same audit rule group. The audit rule group can be associated with and called by the audit object and the potential hazard module, and is not limited to the same protocol.

[0089] (3) Associate audit objects: associate the terminal objects that need to be audited with the audit rule group (IP). The Internet of Things traffic analysis module mainly audits the traffic of the selected audit terminal objects, analyzes whether the traffic of the audit terminal objects matches the audit rule group, and matches the audit rule group as long as it matches any audit rule configured in the audit rule group. Then, the Internet of Things traffic analysis module pushes the matching result to the Internet of Things potential hazard system.

[0090] (4) Coping with specific Internet of Things business scenarios: flexibly configuring various functions in the Internet of Things potential hazard system, associating statistical objects (unchanging conditions) and change fields (changing conditions) with audit rule groups, setting thresholds (the number of matches) and time (within a certain time period), and realizing different function configurations. Among them, the statistical objects and the change fields are selected from the signaling fields and the content extraction fields configured in all the audit rules in the associated audit rule group. After selection, the Internet of Things potential hazard system will match their contents, and judge whether the unchanging (fields selected by the statistical objects) and changing (fields selected by the change fields) conditions within the configured time exceed the threshold. If they exceed the threshold, an alarm message will be output.

[0091] As shown in Figure 4 , the detailed potential hazard system workflow diagram is as follows:

[0092] Step 1, associate the potential hazard function with the audit rule group;

[0093] Step 2, the traffic analysis module outputs the result;

[0094] Step 3, judge whether the fields selected in the statistical object, the time and the threshold match; if yes, execute step 4, if no, enter the next round of matching judgment;

[0095] Step 4, judge whether the fields selected in the change field, the time and the threshold match; if yes, execute step 5, if no, enter the next round of matching judgment;

[0096] Step 5, output the alarm message.

[0097] Optionally, the pre-stored audit rule group at least includes a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

[0098] Some embodiments of the present application add audit rules with the same or similar functions to the same audit rule group, and the audit rule group can be associated with and called by the audit object and the potential hazard module, and is not limited to the same communication protocol, and can be applied to multiple different communication protocols.

[0099] Optionally, according to the keyword data and the target audit rule, the matching result of the keyword data and the audit rule is determined, including:

[0100] In the case that the keyword data at least meets any one of the following conditions, the audit rule corresponding to the keyword is obtained, wherein the conditions at least include variable conditions and unchanging conditions;

[0101] According to the audit rule, the matching result corresponding to the keyword is determined.

[0102] Some embodiments of the present application achieve different function configurations by flexibly configuring various functions, associating statistical objects (unchanging conditions), changing fields (changing conditions) with audit rule groups, setting thresholds (number of matches) and time (within a certain time period).

[0103] Optionally, according to the audit rule, the matching result corresponding to the keyword is determined, including:

[0104] It is judged whether the keyword data matches the data in the audit rule.

[0105] If the keyword data and the data in the audit rule match, the number of successful matches is recorded once.

[0106] Optionally, according to the matching result, the audit result of the signaling data is determined, including:

[0107] The number of successful matches within a preset time is counted.

[0108] If the number of successful matches is greater than a preset threshold, the audit result of the signaling data is determined, and the audit result at least includes alarm information or prompt information.

[0109] Some embodiments of the present application achieve audit functions by configuring audit rules, customizing signaling fields and content extraction fields, and using various matching methods such as values or regular expressions, and are not limited to rule libraries.

[0110] Optionally, it is judged whether the keyword data matches the data in the audit rule, including:

[0111] It is judged whether the signaling keyword in the keyword data matches the preset signaling data in the audit rule.

[0112] Some embodiments of the present application achieve audit functions by configuring audit rules, customizing signaling fields and content extraction fields, and using various matching methods such as values or regular expressions, and are not limited to rule libraries.

[0113] Optionally, it is judged whether the keyword data matches the data in the audit rule, including:

[0114] It is judged whether the content keyword in the keyword data matches the preset content data in the audit rule.

[0115] Some embodiments of the present application achieve audit functions by configuring statistical objects, changing fields, time, thresholds, etc., and associating them with audit rule groups, freely combining, flexibly configuring, and coping with different specific Internet of Things business scenarios.

[0116] Exemplarily, the application can detect the access of the same IP through the GET method of http by the potential hazard system of the Internet of Things.

[0117] The signaling auditing method provided by the embodiment of the application comprises:

[0118] 1. The auditing rule is configured, the Internet of Things signaling auditing field is the method of http, the matching content is GET, and the content extraction field is the source IP address. The specific content of the IP address can be extracted by using a regular expression.

[0119] 2. The auditing rule in 1 is added to an auditing rule group.

[0120] 3. The object terminal to be audited is associated with the auditing rule group in 2, and the traffic in actual business is analyzed by using the traffic analysis module of the Internet of Things.

[0121] 4. The auditing rule group in 2 is selected in the potential hazard of the Internet of Things, the source IP address of the content extraction field of the auditing rule in 1 is counted, at this time, the change field does not need to be counted, and can not be selected, the time can be set to 60 s, and the threshold can be set to 10. In this way, the function of counting the frequency overrun is configured by the potential hazard system of the Internet of Things, and specifically, whether the same IP accesses the object terminal in 3 through the GET method of http for more than 10 times within 60 s is counted. If the same IP accesses the object terminal in 3 through the GET method of http for more than 10 times within 60 s, an alarm information is triggered.

[0122] Exemplarily, the application can detect the access of the same IP through the GET method of http by the potential hazard system of the Internet of Things.

[0123] The signaling auditing method provided by the embodiment of the application comprises:

[0124] 1. The auditing rule is configured, the Internet of Things signaling auditing field is the method of http, the matching content is GET, and the content extraction field is the source IP address. The specific content of the IP address can be extracted by using a regular expression.

[0125] 2. The auditing rule in 1 is added to an auditing rule group.

[0126] 3. The object terminal to be audited is associated with the auditing rule group in 2, and the traffic in actual business is analyzed by using the traffic analysis module of the Internet of Things.

[0127] 4. In the IoT Potential Hazards section, select audit rule group 2. For the statistical objects, select the extracted fields from audit rule 1: username (user) and destination IP address. For the change field, select the extracted field from audit rule 1: source IP address. The time period can be set to 600 seconds, and the threshold can be set to 1. This configures the IoT Potential Hazards system to detect unauthorized logins. Specifically, it counts whether the same username (user) accesses the same destination IP address more than once within a 600-second period, indicating whether the camera is experiencing unauthorized login activity. If the same username (user) accesses the same destination IP address more than once within a 600-second period, an alarm will be triggered, indicating unauthorized login activity by the camera.

[0128] The IoT signaling auditing of this application embodiment can be applied to various fields and is not limited to a certain protocol; it does not require the maintenance of a rule base, and the signaling auditing function can be realized by configuring auditing rules; it can flexibly configure various functions through the IoT potential hazard system to deal with specific IoT business scenarios;

[0129] The IoT signaling auditing system captures traffic flowing through or bypassing gateway devices. This traffic includes various network communication data, such as HTTP, HTTPS, and FTP. The system then performs protocol parsing on the captured traffic, extracting application layer protocol keywords. These keywords may include URLs, request parameters, and response codes. The parsed keywords are matched against pre-configured audit rules, which typically define which behaviors are legitimate and which are abnormal or require attention. Based on the matching results, the system processes the traffic accordingly. If the traffic matches characteristics of abnormal behavior or potential threats, the system will issue an alarm or block the traffic. Simultaneously, the system may also log relevant information for subsequent analysis. IoT signaling auditing is characterized by real-time performance, accuracy, and flexibility. It can capture and analyze network traffic in real time, promptly identifying potential threats. Precise matching of application layer protocol keywords improves detection accuracy. Audit rules can be configured and adjusted as needed to adapt to different network environments and security requirements. Furthermore, IoT signaling auditing, which addresses potential IoT threats, allows for more flexible configuration of business-related functions, enabling the true application of IoT signaling auditing in real-world IoT business scenarios and enhancing the security and reliability of IoT services. By flexibly configuring business-related functions, IoT signaling auditing can be effectively applied to real-world IoT business scenarios, further enhancing its crucial role in IoT security.

[0130] It should be noted that each implementable manner in the embodiment can be implemented alone or in any combination without conflict.

[0131] Another embodiment of the present application provides a signaling auditing device for performing the signaling auditing method provided in the above embodiment.

[0132] As shown in Figure 5 FIG. 1 is a structural schematic diagram of the signaling auditing device provided in the embodiment of the present application. The signaling auditing device comprises an acquisition module 501, a determination module 502, an identification module 503, a matching module 504 and an auditing module 505, wherein:

[0133] The acquisition module 501 is configured to acquire signaling data sent by a client terminal, wherein the signaling data at least comprises a target client terminal identifier.

[0134] The determination module 502 is configured to determine a target auditing rule corresponding to the target client terminal according to a pre-stored auditing rule set, wherein the auditing rule set comprises auditing rules of multiple communication protocols, and the auditing rules correspond to the client terminals.

[0135] The identification module 503 is configured to determine keyword data in the signaling data according to a pre-set matching algorithm.

[0136] The matching module 504 is configured to determine a matching result of the keyword data and the auditing rule according to the keyword data and the target auditing rule.

[0137] The auditing module 505 is configured to determine an auditing result of the signaling data according to the matching result.

[0138] As for the device in the embodiment, the specific manners in which each module performs operations have been described in detail in the embodiment related to the method, and thus will not be described in detail here.

[0139] Some embodiments of the present application audit the signaling data of different communication protocols of different client terminals by pre-establishing an auditing rule set, identify keyword data in the signaling data by a pre-set matching algorithm, and then perform auditing according to the auditing rule corresponding to the client terminal. In this way, the signaling data of different communication protocols can be audited correspondingly, and the auditing efficiency is improved.

[0140] Still another embodiment of the present application further supplements the signaling auditing device provided in the above embodiment.

[0141] Optionally, the pre-stored auditing rule set at least comprises a client terminal identifier and an auditing rule corresponding to the client terminal identifier, wherein each auditing rule corresponds to one or more communication protocols.

[0142] Some embodiments of the present application add audit rules with the same or similar functions into the same audit rule group, which can be called by the audit object and the potential hazard module, and is not limited to the same communication protocol, and can be applied to various different communication protocols.

[0143] Optionally, the matching module is configured to:

[0144] In a case where the keyword data at least meets any one of the following conditions, the audit rule corresponding to the keyword is obtained, wherein the conditions at least include variable conditions and invariable conditions.

[0145] According to the audit rule, the matching result corresponding to the keyword is determined.

[0146] Some embodiments of the present application flexibly configure various functions, associate the statistical object (invariable conditions) and the variable field (variable conditions) with the audit rule group, set the threshold (the number of matching times) and the time (a certain time period), and realize different function configurations.

[0147] Optionally, the matching module is configured to:

[0148] Determine whether the keyword data matches the data in the audit rule.

[0149] If the keyword data matches the data in the audit rule, the number of matching successes is recorded.

[0150] Optionally, the audit module is configured to:

[0151] Count the number of matching successes in a preset time.

[0152] If the number of matching successes is greater than a preset threshold, the audit result of the signaling data is determined, and the audit result at least includes alarm information or prompt information.

[0153] Some embodiments of the present application configure the audit rule, customize the signaling field and the content extraction field, realize the audit function by various matching modes such as values or regular expressions, and are not limited to the rule library.

[0154] Optionally, the matching module is configured to:

[0155] Determine whether the signaling keyword in the keyword data matches the preset signaling data in the audit rule.

[0156] Some embodiments of the present application configure the audit rule, customize the signaling field and the content extraction field, realize the audit function by various matching modes such as values or regular expressions, and are not limited to the rule library.

[0157] Optionally, the matching module is configured to:

[0158] Determine whether the keywords in the keyword data match the preset content data in the audit rules.

[0159] Some embodiments of this application configure statistical objects, change fields, time, thresholds, etc., and associate them with audit rule groups, allowing for free combination and flexible configuration to address different specific IoT business scenarios.

[0160] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0161] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0162] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, can perform the operation of any of the methods corresponding to the signaling auditing methods provided in the above embodiments.

[0163] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the signaling auditing methods provided in the above embodiments.

[0164] like Figure 6 As shown, some embodiments of this application provide an electronic device 600, which includes a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620. When the processor 620 reads the program from the memory 610 via a bus 630 and executes the program, it can implement any of the methods included in the above-described signaling auditing method.

[0165] Processor 620 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 620 can be a microprocessor.

[0166] The memory 610 can be used to store instructions executed by the processor 620 or data related to the instructions execution process. The instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 620 of the embodiments of the present disclosure can be configured to execute the instructions in the memory 610 to implement the methods shown in the above. The memory 610 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory or other memory well known to those skilled in the art.

[0167] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0168] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0169] It should be noted that, in the present document, the relationship terms such as first and second are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitation, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

Claims

1. A method of signaling auditing, characterized by, The method comprises: acquiring signaling data sent by a client terminal, wherein the signaling data comprises at least a target client terminal identifier; determining a target audit rule corresponding to the target client terminal according to a pre-stored audit rule set, wherein the audit rule set comprises audit rules of multiple communication protocols, and the audit rules correspond to client terminals; determining keyword data in the signaling data according to a pre-set matching algorithm; determining a matching result of the keyword data and the audit rule according to the keyword data and the target audit rule; determining an audit result of the signaling data according to the matching result.

2. The signaling audit method of claim 1, wherein, The pre-stored audit rule set comprises at least a client terminal identifier and an audit rule corresponding to the client terminal identifier, wherein each audit rule corresponds to one or more communication protocols.

3. The signaling audit method of claim 1, wherein, The determination of the matching result of the keyword data and the audit rule according to the keyword data and the target audit rule comprises: acquiring an audit rule corresponding to the keyword data if the keyword data satisfies at least one of the following conditions, wherein the conditions comprise at least variable conditions and constant conditions; determining a matching result corresponding to the keyword according to the audit rule.

4. The signaling audit method of claim 3, wherein, The determination of the matching result corresponding to the keyword according to the audit rule comprises: determining whether the keyword data matches data in the audit rule; if the keyword data matches the data in the audit rule, recording a number of successful matches.

5. The signaling audit method of claim 4, wherein, The determination of the audit result of the signaling data according to the matching result comprises: counting the number of successful matches within a pre-set time; if the number of successful matches is greater than a pre-set threshold, determining the audit result of the signaling data, wherein the audit result comprises at least alarm information or prompt information.

6. The signaling audit method of claim 4, wherein, The determination of whether the keyword data matches the data in the audit rule comprises: determining whether a signaling keyword in the keyword data matches pre-set signaling data in the audit rule.

7. The signaling audit method of claim 4, wherein, The determination of whether the keyword data matches the data in the audit rule comprises: determining whether a content keyword in the keyword data matches pre-set content data in the audit rule.

8. An electronic device, comprising: The computer program is stored in the memory and can be run on the processor, wherein the processor can implement the signaling audit method of any one of claims 1-7 when executing the program.

9. A computer-readable storage medium, characterized in that, The computer program is stored in the memory and can be run on the processor, wherein the processor can implement the signaling audit method of any one of claims 1-7 when executing the program.

10. A computer program product comprising a computer program, wherein, The computer program is stored in the memory and can be run on the processor, wherein the processor can implement the signaling audit method of any one of claims 1-7 when executing the program.

Images