Data packet analysis processing method and device, electronic equipment and storage medium

Abstract

The invention provides a data packet analysis processing method and device, electronic equipment and a storage medium. The method comprises the following steps: determining an unidentified field which is not correctly identified by a corresponding target standardized network protocol in a target protocol data packet and field data of the unidentified field; determining a plurality of target data analysis strategies based on the target general data analysis strategy and the target self-defined data analysis strategy of the associated fields of the unidentified fields; each target data analysis strategy is used for analyzing unidentified fields and field data; and performing result judgment on respective analysis results of the plurality of target data analysis strategies, and determining an analysis processing result of the target protocol data packet based on a judgment result. According to the method and the device, the traffic analysis work of the non-standard protocol modified based on the standard protocol is supported, the standard protocol field and the non-standard protocol field contained in the data packet transmitted in the protocol modified manually can be identified, and the success rate and the accuracy of analyzing the data packet are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network management and security analysis, and in particular to a data packet parsing and processing method, device, electronic device and storage medium. Background Art

[0002] Traffic analysis tools can usually capture and analyze data packets, and provide other information about network traffic, protocol usage, network performance, etc. The above information can help network managers to carry out network management tasks such as network performance analysis, abnormal traffic identification, and security threat warning. It is also important to maintain the normal operation of the network and provide a stable, safe, and reliable Internet environment for Internet users. Therefore, how to parse and process data packets is particularly important.

[0003] In the related art, traffic analysis software such as network packet analysis software (Wireshark) and network traffic analyzer (NetFlow Analyzer) are usually used to parse a variety of common network protocol data packets; however, the above-mentioned traffic analysis software can only parse network protocol data packets in standard protocol formats. When the network protocol data packet to be analyzed is a data packet transmitted in a protocol that has been manually modified, the above-mentioned traffic analysis software will treat it as an error data packet or an abnormal data packet for processing, resulting in a very low success rate and accuracy rate in parsing the data packet. Summary of the invention

[0004] The present invention provides a data packet parsing processing method, device, electronic device and storage medium, which are used to solve the defects of low success rate and accuracy of parsing data packets in the prior art. Under the basic condition of meeting the standard protocol identification and parsing, the method supports the flow parsing of non-standard protocols modified based on standard protocols. For data packets transmitted in artificially modified protocols, not only the standard protocol fields contained therein can be parsed, but also the non-standard protocol fields contained therein can be parsed. Instead of directly treating them as error data packets or abnormal data packets, the method improves the success rate and accuracy of parsing data packets.

[0005] The present invention provides a data packet analysis and processing method, comprising the following steps.

[0006] Unrecognized fields in a target protocol data packet that are not correctly recognized by a corresponding target standardized network protocol and field data of the unrecognized fields are determined.

[0007] Based on the target general data parsing strategy and the target custom data parsing strategy of the associated field of the unidentified field, a plurality of target data parsing strategies are determined; each of the target data parsing strategies is used to parse the unidentified field and the field data.

[0008] A result judgment is performed on the analysis results of each of the multiple target data analysis strategies, and a parsing processing result of the target protocol data packet is determined based on the judgment result.

[0009] According to a data packet parsing and processing method provided by the present invention, the target general data parsing strategy and the target custom data parsing strategy based on the associated fields of the unidentified fields determine multiple target data parsing strategies, including: determining multiple order adjustment methods for at least two of the unidentified fields; determining the multiple target data parsing strategies based on the multiple order adjustment methods, as well as the number of the target general data parsing strategies and the number of the target custom data parsing strategies.

[0010] According to a data packet parsing processing method provided by the present invention, the method further comprises: searching for an associated field having an associated relationship with the unidentified field from a pre-built network protocol parsing library; based on the found associated field, searching for each of the target general data parsing strategies and each of the target custom data parsing strategies from the network protocol parsing library; Among them, the network protocol parsing library includes standardized fields involved in different types of standardized protocol data packets and general data parsing strategies corresponding to the standardized fields, non-standardized fields involved in different types of non-standardized protocol data packets and custom data parsing strategies corresponding to the non-standardized fields, as well as field statistical classifications completed according to the association relationships in each of the standardized fields and each of the non-standardized fields.

[0011] According to a data packet parsing processing method provided by the present invention, the method also includes: prioritizing the multiple target data parsing strategies; determining the execution order of each target data parsing strategy based on the number of strategies of the target data parsing strategies, the number of resources of the current computing resources and the priority sorting results; and starting the corresponding target data parsing strategies in parallel based on each of the execution orders to obtain the parsing results of each of the multiple target data parsing strategies.

[0012] According to a data packet parsing and processing method provided by the present invention, the result judgment is performed on the parsing results of each of the multiple target data parsing strategies, and the parsing and processing result of the target protocol data packet is determined based on the judgment result, including: when there is a unique solution among the multiple parsing results, the parsing and processing result of the target protocol data packet is determined based on the target data parsing strategy corresponding to the unique solution and the target common data parsing strategy corresponding to the identified field in the target protocol data packet; when there are multiple solutions among the multiple parsing results or the multiple parsing results have no solution, the multiple parsing results are correlated with each other, and the parsing and processing result of the target protocol data packet is determined according to the correlated data analysis result.

[0013] According to a data packet parsing and processing method provided by the present invention, the associated data analysis is performed on multiple parsing results, and the parsing and processing result of the target protocol data packet is determined according to the associated data analysis result, including: based on a preset association principle, multiple associated protocol data packets of the target protocol data packet are obtained, and the preset association principle includes at least one of the same flow association principle, the same session association principle, the adjacent sequence number association principle, the same source address association principle and the same destination address association principle; in the case where the parsing results of each of the associated protocol data packets contain a set of parsing success strategies, if there is a unique intersection in each of the parsing success strategy sets, the parsing and processing result is determined based on the parsing success strategy corresponding to the unique intersection and the target common data parsing strategy; if there is no intersection in each of the parsing success strategy sets or there are multiple intersections, the manual parsing result of the target protocol data packet is determined as the parsing and processing result.

[0014] According to a data packet parsing and processing method provided by the present invention, the determining of unidentified fields in a target protocol data packet that are not correctly identified by a corresponding target standardized network protocol and field data of the unidentified fields comprises: parsing the target protocol data packet layer by layer based on the target standardized network protocol, and matching the initial fields and initial field data parsed out of each layer with preset protocol requirements corresponding to the target standardized network protocol; determining that the initial field corresponding to a matching failure and at least one subsequent field of the initial field are both the unidentified fields, and using the initial field data corresponding to the initial field corresponding to a matching failure and the initial field data corresponding to the at least one subsequent field as the field data.

[0015] The present invention also provides a data packet parsing and processing device, comprising a field data identification unit, a parsing strategy determination unit and a parsing strategy processing unit.

[0016] The field data identification unit is used to determine the unidentified fields in the target protocol data packet that are not correctly identified by the corresponding target standardized network protocol and the field data of the unidentified fields.

[0017] The parsing strategy determination unit is used to determine a plurality of target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated field of the unrecognized field, wherein each of the target data parsing strategies is used to parse the unrecognized field and the field data.

[0018] The parsing strategy processing unit is used to make a decision on the parsing results of each of the plurality of target data parsing strategies, and determine the parsing processing result of the target protocol data packet based on the decision result.

[0019] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above-mentioned data packet parsing and processing methods is implemented.

[0020] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the data packet parsing and processing method as described above is implemented.

[0021] The data packet parsing processing method, device, electronic device and storage medium provided by the present invention, wherein the data packet parsing processing method first determines the unidentified fields in the target protocol data packet that are not correctly identified by the corresponding target standardized network protocol and the field data of the unidentified fields; and further determines multiple target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated field of the unidentified field. Since each target data parsing strategy is used to parse the unidentified fields and field data, the result judgment is made on the parsing results of each of the multiple target data parsing strategies, and the parsing processing result of the target protocol data packet can be determined based on the judgment result. In this way, under the basic condition of meeting the standard protocol identification and parsing, it supports the flow parsing work of the non-standard protocol modified based on the standard protocol. For the data packet transmitted in the artificially modified protocol, it can not only parse the standard protocol field contained therein, but also parse the non-standard protocol field contained therein, instead of directly treating it as an error data packet or an abnormal data packet, thereby improving the success rate and accuracy of parsing the data packet. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 This is one of the flow charts of the data packet parsing and processing method provided by the present invention.

[0024] Figure 2 It is a schematic diagram of the architecture of the data packet parsing and processing system provided by the present invention.

[0025] Figure 3 This is the second flow chart of the data packet parsing and processing method provided by the present invention.

[0026] Figure 4 It is a structural schematic diagram of the data packet parsing and processing device provided by the present invention.

[0027] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] In the embodiments of the present invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B may be singular or plural. In the textual description of the present invention, the character " / " generally indicates that the previous and next associated objects are in an "or" relationship. In addition, it should be noted that the serial numbers themselves, such as "first", "second", etc., used to distinguish the objects described in the present invention are only used to distinguish the objects described, and do not have any order or technical meaning.

[0030] Traffic analysis tools can usually capture and analyze data packets, and provide other information about network traffic, protocol usage, network performance, etc. The above information can help network managers to carry out network management tasks such as network performance analysis, abnormal traffic identification, and security threat warning. It is also important to maintain the normal operation of the network and provide a stable, safe, and reliable Internet environment for Internet users. Therefore, how to parse and process data packets is particularly important.

[0031] In the related technology, traffic analysis software such as Wireshark and NetFlow Analyzer can be used. Wireshark can analyze a variety of common network protocol data packets, including but not limited to data packets of protocols such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Address Resolution Protocol (ARP), Internet Control Message Protocol (ICMP), and view detailed information of data packets, including source address (Source IP Address), destination address (Destination IP Address), protocol type (Protocol), data payload (Data Payload) and size (Length), etc.; NetFlow Analyzer can analyze network traffic for network administrators to view network performance and network usage.

[0032] In addition to the above-mentioned traffic analysis software, the relevant technologies can also include traffic detection methods based on technologies such as machine learning, data mining and artificial intelligence. Such traffic detection methods mainly classify or analyze network protocol data packets (or traffic) through models (or functional modules) trained with a large number of data sets, and have a certain ability to identify unknown traffic; but since the recognition accuracy of the above-mentioned models depends on the training of the data set, the model recognition effect has great uncertainty, there are recognition and analysis errors, and it is not suitable for use in scenarios where deterministic analysis results need to be given.

[0033] Therefore, the above-mentioned traffic parsing software can only parse network protocol data packets in standard protocol formats. When the network protocol data packet to be parsed is a data packet transmitted in a protocol that has been artificially modified, the above-mentioned traffic parsing software will treat it as an error data packet or an abnormal data packet for processing. In addition, the use of pre-trained models to parse data packets also has the defect of low recognition accuracy, which leads to very low success rate and accuracy of parsing data packets.

[0034] In order to solve the above technical problems, the present invention provides a data packet parsing and processing method, device, electronic device and storage medium. Figure 1-Figure 5 The data packet parsing and processing method, device, electronic device and storage medium of the present invention are described, wherein the execution subject of the data packet parsing and processing method can be an electronic device or a server, and the electronic device can be a personal computer (PC), a portable device, a laptop computer, a smart phone, a tablet computer, a portable wearable device and other devices such as a cloud server, and the server can refer to a single server, or a server cluster composed of multiple servers, a cloud server, and the like. The present invention does not specifically limit the specific form of the electronic device or server. Furthermore, the data packet parsing and processing method can also be applied to a data packet parsing and processing device provided in an electronic device or a server, and the data packet parsing and processing device can be implemented by software, hardware or a combination of the two. The data packet parsing and processing method is described below by taking the execution subject of the data packet parsing and processing method as an electronic device as an example.

[0035] In order to facilitate understanding of the data packet parsing and processing method provided by the embodiment of the present invention, the data packet parsing and processing method provided by the present invention will be described in detail below through the following exemplary embodiments. It can be understood that the following exemplary embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0036] Reference Figure 1 , which is one of the flow charts of the data packet parsing and processing method provided by the present invention, such as Figure 1 As shown, the data packet parsing and processing method includes the following steps 110 to 130.

[0037] Step 110: Determine unrecognized fields in the target protocol data packet that are not correctly recognized by the corresponding target standardized network protocol and field data of the unrecognized fields.

[0038] Among them, the number of target protocol data packets can be one or more, and each target protocol data packet can include but is not limited to one of a first non-standardized protocol data packet representing a custom private protocol and a second non-standardized protocol data packet obtained by modifying a standardized protocol data packet.

[0039] The protocol content of the custom private protocol is not public and is mainly used in internal networks, such as industrial control networks, the Internet of Things, etc.

[0040] The standardized protocol data packet may include but is not limited to at least one protocol data packet from other standardized network protocol data packets such as TCP data packets, UDP data packets, ARP data packets, and ICMP data packets.

[0041] It should be noted that the second non-standardized protocol data packet obtained by modifying the standardized protocol data packet is a non-standardized network protocol based on a standardized network protocol. This type of protocol is usually modified from a standardized network protocol stack and has the characteristics of easy adjustment of data structure, rapid implementation of functions, and partial compatibility with standard protocols. It is more suitable for communication on the Internet. Therefore, it is more practical to carry out automated traffic parsing on the second non-standardized protocol data packet obtained by modifying the standardized network protocol.

[0042] Specifically, for a target protocol data packet, a corresponding target standardized network protocol template may be first determined according to the protocol type of the target protocol data packet, wherein the target standardized network protocol template includes a target standardized network protocol for parsing the target protocol data packet.

[0043] For example, when the protocol type of the target protocol data packet is UDP, the UDP protocol template may be determined as the target standardized network protocol template, and the UDP protocol template includes a UDP standardized network protocol for parsing a target protocol data packet of the UDP type.

[0044] The target standardized network protocol is used to parse all fields contained in the target protocol data packet and the field data of their fields. When the target protocol data packet cannot be correctly parsed by the target standardized network protocol, at least one field that cannot be parsed will be determined as an unidentified field, and the value of each unidentified field will be extracted as the field data of the unidentified field.

[0045] It should be noted that when the target protocol data packet can be parsed by the target standardized network protocol, the target protocol data packet and its corresponding parsing quantity results are output as the final result to complete the parsing and processing operation of this data packet. In addition, the identified fields in the target protocol data packet that are identified by the target standardized network protocol are all recorded as standard protocol fields; accordingly, each unidentified field is a non-standard protocol field.

[0046] Step 120 : Determine a plurality of target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated fields of the unidentified fields; each target data parsing strategy is used to parse the unidentified fields and field data.

[0047] The number of associated fields may be one or more, which is not specifically limited here. The number of target general data parsing strategies is at least one, and the number of target custom data parsing strategies is at least one.

[0048] Each target universal data parsing strategy may be a standardized data protocol method for parsing corresponding associated fields, and the standardized data protocol method complies with international, national, association, industry standards or specific rules.

[0049] Each target customized data parsing strategy can be a knowledge-based or expert experience-based data parsing method, and the data parsing method adopts the protocol construction method and method commonly used in the industry. The data parsing method is used to attempt to parse non-standardized protocol data packets modified based on a certain standardized protocol.

[0050] Specifically, considering that unidentified fields cannot be parsed through the target standardized network protocol, each unidentified field and its field data can be parsed using the data parsing methods of at least one associated field that has an associated relationship with each unidentified field.

[0051] Each data parsing method of each associated field is used to parse at least one target general data parsing strategy and at least one target custom data parsing strategy of the corresponding associated field.

[0052] At this time, the preset parsing task generation method can be used to perform adaptive parallel parsing task generation for all target common data parsing strategies and all target custom data parsing strategies, and generate multiple target data parsing strategies in real time.

[0053] Exemplarily, the preset parsing task generation method is a random matching method or an exhaustive method, etc.

[0054] Step 130: Make a decision on the parsing results of each of the multiple target data parsing strategies, and determine the parsing processing result of the target protocol data packet based on the decision result.

[0055] Specifically, by using multiple target data parsing strategies to parse the unrecognized fields and the field data of the unrecognized fields respectively, multiple parsing results are obtained, and the multiple parsing results are summarized and sorted to facilitate result judgment on the multiple parsing results, thereby obtaining the parsing processing result of the target protocol data packet.

[0056] Exemplarily, multiple parsing results can be judged in advance based on the parsing success conditions set for different types of data packets. If multiple parsing results meet the parsing success conditions corresponding to the target protocol data packet, the switching result is judged to be successful. At this time, the parsing processing result of the target protocol data packet can be obtained based on the target data parsing strategy corresponding to the unidentified field when the judgment is successful, and the data parsing strategy corresponding to the identified field in the target protocol data packet; for example, the meaning of each field after the target protocol data packet is parsed, each standard protocol field and each non-standard protocol field can be used to standardize the data parsing methods adapted to the respective network protocols and their respective data parsing results.

[0057] It should be noted that if multiple parsing results do not meet the parsing success conditions corresponding to the target protocol data packet, the switching result judgment fails. At this time, the unidentified fields can be parsed manually and / or by performing association analysis on the unidentified fields; until the parsing processing results of the target protocol data packet are obtained.

[0058] The data packet parsing method provided by the embodiment of the present invention first determines the unidentified fields in the target protocol data packet that are not correctly identified by the corresponding target standardized network protocol and the field data of the unidentified fields; and further determines multiple target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated fields of the unidentified fields. Since each target data parsing strategy is used to parse the unidentified fields and field data, the result judgment is made on the parsing results of each of the multiple target data parsing strategies, and the parsing processing result of the target protocol data packet can be determined based on the judgment result. In this way, under the basic condition of meeting the standard protocol identification and parsing, it supports the flow parsing work of the non-standard protocol modified based on the standard protocol. For the data packet transmitted in the artificially modified protocol, it can not only parse the standard protocol field contained therein, but also parse the non-standard protocol field contained therein, instead of directly treating it as an error data packet or an abnormal data packet, thereby improving the success rate and accuracy of parsing the data packet.

[0059] Based on the above Figure 1 In the data packet parsing method shown, in an exemplary embodiment, the specific implementation process of step 110 can be implemented through the following steps.

[0060] First, the target protocol data packet is parsed layer by layer based on the target standardized network protocol, and the initial field and initial field data parsed out of each layer are matched with the preset protocol requirements corresponding to the target standardized network protocol; then, it is determined that the initial field corresponding to the initial field when the matching fails and at least one subsequent field of the initial field are both unrecognized fields, and the initial field data corresponding to the initial field corresponding to the matching failure and at least one subsequent field are both used as field data.

[0061] Specifically, refer to Figure 2 The schematic diagram of the architecture of the data packet parsing and processing system shown in FIG. Figure 2As shown, the electronic device can send the target protocol data packet to the basic traffic parsing module of the data packet parsing and processing system. The basic traffic parsing module can determine the target standardized network protocol template (or target general network protocol template) that matches the protocol type of the target protocol data packet from the pre-built network protocol parsing library, and then parse the target protocol data packet layer by layer based on the target standardized network protocol contained in the target standardized network protocol template and using the logical processing method of a finite state machine or a protocol tree.

[0062] When the target protocol data packet is successfully parsed, it can be determined that the fields contained in the target protocol data packet are all standard protocol fields and are all successfully identified. At this time, the target protocol data packet and the data parsing processing methods adapted to each of the identified standard protocol fields can be sent to the parsing result output module to complete this data parsing; conversely, when the target protocol data packet cannot be successfully parsed, that is, the initial field data of at least one initial field contained in the target protocol data packet does not match the preset protocol requirements corresponding to the target standardized network protocol, the target protocol data packet and the target standardized network protocol template containing the target standardized network protocol can be sent to the unidentified field and data processing module.

[0063] The unidentified field and data processing module locks the target standardized network protocol template used to parse the target protocol data packet, and based on the identified fields parsed and identified from the target protocol data packet, marks and sorts out each initial field that does not match the preset protocol requirements as an unidentified field, and extracts the initial field data of each initial field as the field data of the corresponding unidentified field, and then sends all the unidentified fields and their respective field data as additional information to the adaptive parallel parsing task generation module.

[0064] Exemplarily, when the target protocol data packet is a UDP data packet, the parsed UDP source port number, destination port number, and UDP length are all correct and are all recognized fields, but the UDP checksum is wrong. At this time, the currently used UDP protocol template can be marked, and the UDP checksum and the data payload subsequent to the UDP checksum can be treated as unrecognized fields, and the field data of the UDP checksum and the data payload can be extracted.

[0065] Based on the above Figure 1 In the data packet parsing method shown, in an exemplary embodiment, the specific implementation process of step 120 can be implemented through the following steps.

[0066] First, multiple order adjustment methods for at least two unrecognized fields are determined; further, multiple target data parsing strategies are determined based on the multiple order adjustment methods, the number of target general data parsing strategies and the number of target custom data parsing strategies.

[0067] For details, please refer to Figure 2 The schematic diagram of the architecture of the data packet parsing and processing system shown in FIG. Figure 2 As shown, the adaptive parallel parsing task generation module first analyzes the received additional information, and when it is determined that there are at least two unidentified fields in the target protocol data packet that are not correctly identified by the target standardized network protocol, the field order of the at least two unidentified fields can be adjusted by exhaustive method, thereby obtaining various order adjustment methods of the at least two unidentified fields. For example, when the target protocol data packet is a UDP data packet and the unidentified fields are two unidentified fields, namely, a UDP check field and a data payload field, two order adjustment methods of the UDP check field and the data payload field can be obtained by exhaustive method.

[0068] At this time, multiple target data analysis strategies can be generated by random matching or exhaustive enumeration based on multiple order adjustment methods, the number of target general data analysis strategies, and the number of target custom data analysis strategies, and then the number of target data analysis strategies is further sent to the parallel task scheduling basic unit, and the above-mentioned additional information is sent to the task execution module accordingly; if there are two order adjustment methods, and there are a total of four data analysis strategies for the target general data analysis strategy and the target custom data analysis strategy, each order adjustment method corresponds to four data analysis strategies, so that eight target data analysis strategies can be obtained.

[0069] Based on the above Figure 1 In the data packet parsing processing method shown, in an exemplary embodiment, the process of determining the universal data parsing strategy for each target and the custom data parsing strategy for each target can be implemented through the following steps.

[0070] First, find the associated fields that have an associated relationship with the unidentified fields from the pre-built network protocol parsing library; then, based on the found associated fields, find the general data parsing strategies for each target and the custom data parsing strategies for each target from the network protocol parsing library

[0071] Among them, the network protocol parsing library includes the standardized fields involved in different types of standardized protocol data packets and the general data parsing strategies corresponding to the standardized fields, the non-standardized fields involved in different types of non-standardized protocol data packets and the custom data parsing strategies corresponding to the non-standardized fields, as well as the field statistical classification completed according to the association relationship in each standardized field and each non-standardized field.

[0072] Specifically, the network protocol parsing library can be mainly composed of a general parsing sub-library, a custom parsing sub-library and an association relationship sub-library. The general parsing sub-library is composed of multiple general network protocol templates (or multiple standardized network protocol templates). The general network protocol (or standardized network protocol) contained in each general network protocol template complies with international, national, association and industry standards or specific rules, and each general network protocol template is used to identify the protocol type of the corresponding field in a corresponding standardized protocol data packet and finally complete the layer-by-layer parsing of the corresponding standardized protocol data packet to obtain the standardized fields involved in the corresponding standardized protocol data packet and the general data parsing strategy corresponding to the standardized fields.

[0073] The custom parsing sub-library can also be called an expert parsing library, which is mainly composed of multiple custom network protocol templates (or multiple non-standardized network protocol templates). The custom network protocol (or non-standardized network protocol) contained in each custom network protocol template mainly includes knowledge-based or expert experience-based data parsing methods, and each custom network protocol template is used to adopt the industry's commonly used protocol construction methods and methods to try to parse non-standardized protocol data packets modified based on standardized protocols, so as to obtain a custom data parsing strategy corresponding to the non-standardized fields involved in a non-standardized protocol data packet and the non-standardized fields, thereby further improving the parsing success rate.

[0074] The association sub-library completes the statistics and classification of each field in the general network protocol and the custom network protocol by sorting out the standardized fields involved in each general network protocol template or each general data parsing strategy in the general parsing sub-library, and the fields with similar meanings in the non-standardized fields involved in each custom network protocol template or custom data parsing strategy in the custom parsing sub-library, that is, completing the field statistics and classification of each standardized field and each non-standardized field according to the association relationship, providing a basis for the subsequent adaptive generation of the target data parsing strategy for the target protocol data packet.

[0075] In this way, the associated fields having an associated relationship with the unidentified fields can be first searched from the network protocol parsing library, and then the general data parsing strategies and custom data parsing strategies of each target of the associated fields can be further searched from the network protocol parsing library.

[0076] Based on the above Figure 1 In an exemplary embodiment of the data packet parsing method shown, for the determined multiple target data parsing strategies, the parsing results of the unidentified fields and their field data can be first obtained, and the multiple parsing results can be achieved through the following steps.

[0077] First, multiple target data analysis strategies are prioritized; further, the execution order of each target data analysis strategy is determined based on the number of target data analysis strategies, the number of current computing resources and the priority ranking results; then, the corresponding target data analysis strategies are started in parallel based on the execution orders to obtain the analysis results of each of the multiple target data analysis strategies.

[0078] For details, please refer to Figure 2 The schematic diagram of the architecture of the data packet parsing and processing system shown in FIG. Figure 2 As shown, the parallel task scheduling basic unit allocates each strategy execution task based on the number of strategies of the target data parsing strategy, the number of resources of the current computing power resources, and the priority sorting results. Each strategy execution task contains the corresponding target data parsing strategy and its execution order, and starts the parsing work of the strategy execution task in parallel and waits for all tasks to be executed. For example, when the number of strategies is 20 and the number of resources is 10, the first 10 target data parsing strategies with the highest priority can be executed in parallel first, and then the remaining 10 target data parsing strategies can be executed in parallel.

[0079] For each strategy execution task, each strategy execution task can be sent to the corresponding task execution module, each task execution module parses the additional information according to the assigned target data parsing strategy, and feeds the obtained parsing result back to the parsing result judge. The number of task execution modules is the same as the number of target data parsing strategies and corresponds one to one.

[0080] Based on the above Figure 1 In the data packet parsing and processing method shown, in an exemplary embodiment, in step 130, the parsing results of each of the multiple target data parsing strategies are judged, and the parsing and processing results of the target protocol data packet are determined based on the judgment results. The specific implementation process is achieved through the following steps.

[0081] When there is a unique solution among multiple parsing results, the parsing processing result of the target protocol data packet is determined based on the target data parsing strategy corresponding to the unique solution and the target common data parsing strategy corresponding to the identified fields in the target protocol data packet; or, when there are multiple solutions among multiple parsing results or multiple parsing results have no solutions, related data analysis is performed on the multiple parsing results, and the parsing processing result of the target protocol data packet is determined based on the related data analysis results.

[0082] For details, please refer to Figure 2 The schematic diagram of the architecture of the data packet parsing and processing system shown in FIG. Figure 2As shown, the parsing result judge is used to summarize and organize the parsing results of parallel tasks and determine whether they contain a unique solution. If multiple parsing results have only a unique solution, the target data parsing strategy corresponding to the unique solution is determined as the correct data parsing method for the additional information. At this time, the parsing report generation module can generate a parsing report and output the parsing processing results. The parsing processing results include the meaning of all fields of the target protocol data packet, the target universal data parsing strategy adapted to the identified fields (or standardized protocol fields), the target data parsing strategy adapted to the unidentified fields (or non-standard protocol fields), the target universal data parsing strategy corresponding to the identified fields, and the parsing results of all the above data parsing strategies.

[0083] On the contrary, if there is no unique solution among the above-mentioned multiple analysis results, it means that all the target data analysis strategies executed in parallel have failed. At this time, the above-mentioned additional information can be sent to the cache part in the analysis data storage unit, and all the analysis results are sent to the associated data analysis module; if there are multiple solutions among the above-mentioned multiple analysis results, it means that there are multiple analysis possibilities for the target data analysis strategies executed in parallel and a unique result cannot be determined, which requires the auxiliary analysis of associated data. Therefore, the above-mentioned additional information is also sent to the cache part in the analysis data storage unit, and all the analysis results are sent to the associated data analysis module.

[0084] Based on the above Figure 1 The data packet parsing and processing method shown, in an exemplary embodiment, performs correlation data analysis on multiple parsing results, and determines the parsing and processing result of the target protocol data packet based on the correlation data analysis result. The specific implementation process is achieved through the following steps.

[0085] First, based on a preset association principle, multiple associated protocol data packets of a target protocol data packet are obtained, and the preset association principle includes at least one of a same-flow association principle, a same-session association principle, an adjacent sequence number association principle, a same-source address association principle, and a same-destination address association principle; then, in the case where the parsing results of each associated protocol data packet contain a set of successful parsing strategies, if there is a unique intersection in each set of successful parsing strategies, the parsing processing result is determined based on the successful parsing strategy corresponding to the unique intersection and the target common data parsing strategy; or, if there is no intersection in each set of successful parsing strategies or there are multiple intersections, the manual parsing result of the target protocol data packet is determined as the parsing processing result.

[0086] For details, please refer to Figure 2 The schematic diagram of the architecture of the data packet parsing and processing system shown in FIG. Figure 2As shown, the associated data analysis module mainly targets multiple parsing results that cannot be determined by the current parallel parsing. According to the preset association principle, it searches for multiple historical protocol data packets that have an association relationship with the target protocol data packet from the cached multiple historical protocol data packets that have completed the parsing process and use them as associated protocol data packets. It then further performs associated data analysis on the multiple associated protocol data packets, and compares whether there are overlapping parsing success strategies in the parsing results of each associated protocol data packet. If there is a unique result, the data parsing method of the associated protocol data packet corresponding to the unique result is found and used as the correct data parsing method for additional information. At this time, the parsing report generation module can generate a parsing report and output the parsing processing results. At the same time, the data parsing method of the associated protocol data packet found is fed back to the custom parsing sub-library in the network protocol parsing library to facilitate subsequent parsing of similar protocol data packets.

[0087] Exemplarily, when the target protocol data packet is a UDP data packet, the associated data analysis module finds two associated protocol data packets with the same source IP address / same destination IP address as the UDP data packet from the cached multiple historical protocol data packets, the parsing result of the first associated protocol data packet includes 2 successful parsing results, and the parsing result of the second associated protocol data packet includes 3 successful parsing results, and the data parsing strategies corresponding to the above two successful parsing results and the above three successful parsing results respectively have a unique intersection, which indicates that the data parsing method corresponding to the unique intersection can simultaneously parse and process the above two associated protocol data packets. At this time, the data parsing method corresponding to the unique intersection can be determined as the correct data parsing method for the above additional information.

[0088] Furthermore, by comparing the parsing results of each associated protocol data packet, it is determined that there is no intersection in the successful parsing strategies contained in each of them, or there are at least two successful parsing strategies in the intersection, then it is determined that the associated data analysis module cannot parse the target protocol data packet through associated data analysis. At this time, the target protocol data packet can be parsed by manual parsing to obtain the parsing processing result of the target protocol data packet and the parsing report generation module outputs its parsing report.

[0089] For example, refer to Figure 3 The second flow chart of the data packet parsing method shown in FIG. Figure 3As shown, firstly, the input data packet (that is, the target protocol data packet in the aforementioned embodiment) is judged. When it is determined that it can be parsed, it can be determined to be a data packet in a standard protocol format, and it can be parsed according to the traditional parsing method and then the parsing result is output; on the contrary, when it is determined that it cannot be parsed, it can be determined to be a data packet in a custom protocol format or a non-standardized protocol data packet modified based on a certain standardized protocol. At this time, the current general network protocol template of the target protocol data packet (that is, the target general network protocol template in the aforementioned embodiment) can be determined, and the identifiable part in the target protocol data packet (such as each standard protocol field and its field data) can be completed based on the target general network protocol template, and the unidentified fields and the field data of the unidentified fields are extracted from the target protocol data packet and used as additional information; further, multiple parallel parsing tasks (such as multiple policy execution tasks in the aforementioned embodiment) for parsing additional information are generated according to the preset association principle, and each parallel parsing task is executed and the respective parsing results are summarized and sorted until the parsing result of the target protocol data packet is obtained. The specific process involved can refer to the aforementioned embodiment. It will not be repeated here.

[0090] The data packet parsing and processing device provided by the present invention is described below. The data packet parsing and processing device described below and the data packet parsing and processing method described above can be referenced to each other.

[0091] Reference Figure 4 , is a schematic diagram of the structure of the data packet parsing and processing device provided by the present invention, such as Figure 4 As shown, the data packet parsing and processing device 400 includes: a field data identification unit 410, a parsing strategy determination unit 420 and a parsing strategy processing unit 430.

[0092] The field data identification unit 410 is used to determine the unidentified fields in the target protocol data packet that are not correctly identified by the corresponding target standardized network protocol and the field data of the unidentified fields.

[0093] The parsing strategy determination unit 420 is used to determine multiple target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated fields of the unrecognized fields; each target data parsing strategy is used to parse the unrecognized fields and field data.

[0094] The parsing strategy processing unit 430 is used to make a decision on the parsing results of each of the multiple target data parsing strategies, and determine the parsing processing result of the target protocol data packet based on the decision result.

[0095] Optionally, the parsing strategy determination unit 420 is specifically used to determine multiple order adjustment methods for at least two unidentified fields; based on the multiple order adjustment methods, the number of target general data parsing strategies and the number of target custom data parsing strategies, determine multiple target data parsing strategies.

[0096] Optionally, the parsing strategy determination unit 420 is specifically used to search for associated fields that have an associated relationship with unidentified fields from a pre-built network protocol parsing library; based on the found associated fields, search for general data parsing strategies for each target and custom data parsing strategies for each target from the network protocol parsing library; wherein the network protocol parsing library includes standardized fields involved in different types of standardized protocol data packets and general data parsing strategies corresponding to the standardized fields, non-standardized fields involved in different types of non-standardized protocol data packets and custom data parsing strategies corresponding to the non-standardized fields, as well as field statistical classifications completed in each standardized field and each non-standardized field according to the associated relationship.

[0097] Optionally, the parsing strategy processing unit 430 is specifically used to prioritize multiple target data parsing strategies; determine the execution order of each target data parsing strategy based on the number of target data parsing strategies, the number of resources of current computing resources and the priority sorting results; start the corresponding target data parsing strategies in parallel based on each execution order to obtain the parsing results of each of the multiple target data parsing strategies.

[0098] Optionally, the parsing strategy processing unit 430 is specifically used to determine the parsing processing result of the target protocol data packet based on the target data parsing strategy corresponding to the unique solution and the target common data parsing strategy corresponding to the identified fields in the target protocol data packet when there is a unique solution among multiple parsing results; and to perform associated data analysis on the multiple parsing results, and determine the parsing processing result of the target protocol data packet based on the associated data analysis result when there are multiple solutions among the multiple parsing results or there are no solutions for the multiple parsing results.

[0099] Optionally, the parsing strategy processing unit 430 is specifically used to obtain multiple associated protocol data packets of the target protocol data packet based on preset association principles, the preset association principles including at least one of the same-flow association principle, the same-session association principle, the adjacent sequence number association principle, the same-source address association principle and the same-destination address association principle; when the parsing results of each associated protocol data packet contain a set of successful parsing strategies, if there is a unique intersection in each set of successful parsing strategies, the parsing processing result is determined based on the successful parsing strategy corresponding to the unique intersection and the target common data parsing strategy; if there is no intersection in each set of successful parsing strategies or there are multiple intersections, the manual parsing result of the target protocol data packet is determined as the parsing processing result.

[0100] Optionally, the field data identification unit 410 is specifically used to parse the target protocol data packet layer by layer based on the target standardized network protocol, and match the initial fields and initial field data parsed out of each layer with the preset protocol requirements corresponding to the target standardized network protocol; determine that the initial field corresponding to the initial field when the match fails and at least one subsequent field of the initial field are both unrecognized fields, and use the initial field data corresponding to the initial field corresponding to the match failure and at least one subsequent field as field data.

[0101] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the data packet parsing processing method, which includes: determining the unidentified fields and field data of the unidentified fields that are not correctly identified by the corresponding target standardized network protocol in the target protocol data packet; determining multiple target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated fields of the unidentified fields; each target data parsing strategy is used to parse the unidentified fields and field data; making a result judgment on the parsing results of each of the multiple target data parsing strategies, and determining the parsing processing result of the target protocol data packet based on the judgment result.

[0102] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0103] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data packet parsing and processing methods provided by the above methods, and the method includes: determining unidentified fields and field data of unidentified fields in the target protocol data packet that are not correctly identified by the corresponding target standardized network protocol; determining multiple target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated fields of the unidentified fields; each target data parsing strategy is used to parse the unidentified fields and field data; making result judgments on the parsing results of each of the multiple target data parsing strategies, and determining the parsing processing results of the target protocol data packet based on the judgment results.

[0104] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the data packet parsing and processing methods provided by the above-mentioned methods, the method comprising: determining unidentified fields in a target protocol data packet that are not correctly identified by the corresponding target standardized network protocol and field data of the unidentified fields; determining multiple target data parsing strategies based on the target general data parsing strategy and the target custom data parsing strategy of the associated fields of the unidentified fields; each target data parsing strategy is used to parse the unidentified fields and field data; making result judgments on the parsing results of each of the multiple target data parsing strategies, and determining the parsing processing result of the target protocol data packet based on the judgment results.

[0105] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0106] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data packet analysis and processing method, characterized in that: include: Determining unidentified fields in a target protocol data packet that are not correctly identified by a corresponding target standardized network protocol and field data of the unidentified fields; Determine a plurality of target data parsing strategies based on a target general data parsing strategy and a target custom data parsing strategy of an associated field of the unidentified field; Each of the target data parsing strategies is used to parse the unrecognized field and the field data; A result judgment is performed on the analysis results of each of the multiple target data analysis strategies, and a parsing processing result of the target protocol data packet is determined based on the judgment result.

2. The data packet analysis and processing method according to claim 1, characterized in that: The target general data parsing strategy and the target custom data parsing strategy based on the associated fields of the unrecognized fields determine a plurality of target data parsing strategies, including: determining a plurality of order adjustment methods for at least two of the unrecognized fields; Based on the multiple order adjustment methods, the number of the target general data analysis strategies and the number of the target custom data analysis strategies, the multiple target data analysis strategies are determined.

3. The data packet analysis and processing method according to claim 2, characterized in that: The method further comprises: Searching for an associated field that has an associated relationship with the unrecognized field from a pre-built network protocol parsing library; Based on the found associated fields, searching for the universal data parsing strategies for each target and the custom data parsing strategies for each target from the network protocol parsing library; Among them, the network protocol parsing library includes standardized fields involved in different types of standardized protocol data packets and general data parsing strategies corresponding to the standardized fields, non-standardized fields involved in different types of non-standardized protocol data packets and custom data parsing strategies corresponding to the non-standardized fields, as well as field statistical classifications completed according to the association relationships in each of the standardized fields and each of the non-standardized fields.

4. The data packet analysis and processing method according to any one of claims 1 to 3, characterized in that: The method further comprises: Prioritizing the multiple target data parsing strategies; Determine the execution order of each of the target data parsing strategies based on the strategy quantity of the target data parsing strategies, the resource quantity of the current computing resources, and the priority sorting result; Based on the execution orders, the corresponding target data analysis strategies are started in parallel to obtain the analysis results of the multiple target data analysis strategies.

5. The data packet analysis and processing method according to claim 4, characterized in that: The step of judging the parsing results of each of the plurality of target data parsing strategies and determining the parsing result of the target protocol data packet based on the judgement result includes: In the case where there is a unique solution among the multiple parsing results, the parsing processing result of the target protocol data packet is determined based on the target data parsing strategy corresponding to the unique solution and the target general data parsing strategy corresponding to the identified fields in the target protocol data packet; In the case that there are multiple solutions in the multiple analysis results or the multiple analysis results have no solution, correlation data analysis is performed on the multiple analysis results, and the analysis processing result of the target protocol data packet is determined according to the correlation data analysis result.

6. The data packet analysis and processing method according to claim 5, characterized in that: The performing of correlation data analysis on the plurality of the analysis results, and determining the analysis processing result of the target protocol data packet according to the correlation data analysis result, includes: Based on a preset association principle, obtaining multiple associated protocol data packets of the target protocol data packet, the preset association principle comprising at least one of a same-flow association principle, a same-session association principle, an adjacent sequence number association principle, a same-source address association principle, and a same-destination address association principle; When the parsing results of each of the associated protocol packets contain a parsing success strategy set, If there is a unique intersection in each of the sets of successful parsing strategies, then determining the parsing result based on the successful parsing strategy corresponding to the unique intersection and the target general data parsing strategy; If there is no intersection or multiple intersections in the analysis success strategy sets, the manual analysis result of the target protocol data packet is determined as the analysis processing result.

7. The data packet analysis and processing method according to any one of claims 1 to 3, characterized in that: The step of determining an unidentified field in a target protocol data packet that is not correctly identified by a corresponding target standardized network protocol and field data of the unidentified field includes: Parsing the target protocol data packet layer by layer based on the target standardized network protocol, and matching the initial field and initial field data parsed at each layer with the preset protocol requirements corresponding to the target standardized network protocol; Determine that the initial field corresponding to when the match fails and at least one subsequent field of the initial field are both the unrecognized fields, and use the initial field data corresponding to the initial field corresponding to when the match fails and the at least one subsequent field as the field data.

8. A data packet analysis and processing device, characterized in that: include: A field data identification unit, used to determine an unidentified field in a target protocol data packet that is not correctly identified by a corresponding target standardized network protocol and field data of the unidentified field; A parsing strategy determining unit, configured to determine a plurality of target data parsing strategies based on a target general data parsing strategy and a target custom data parsing strategy of an associated field of the unrecognized field; Each of the target data parsing strategies is used to parse the unrecognized field and the field data; The parsing strategy processing unit is used to make a decision on the parsing results of each of the plurality of target data parsing strategies, and determine the parsing processing result of the target protocol data packet based on the decision result.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the data packet parsing and processing method as claimed in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data packet parsing and processing method as claimed in any one of claims 1 to 7 is implemented.

Images