Message filtering method, computer program product and electronic equipment

Abstract

The invention provides a message filtering method, a computer program product, electronic equipment and a storage medium, and the method comprises the steps: obtaining an access control strategy; matching and classifying parameters in the access control strategy to obtain a first condition category and a second condition category; obtaining an initial message according to the access control strategy ID; filtering the initial message according to the first condition category to obtain a cached message; and performing secondary filtering on the cached message according to the second condition category to obtain a target message. By implementing the message filtering method and the message filtering device, the matching condition of message filtering can be expanded, so that the message filtering is more accurate, operation and maintenance personnel are not needed, the tracing of the message is facilitated, the accuracy of the intercepted message can be improved to the maximum extent, the capturing of miscellaneous packets is reduced, the cost is reduced, and the use of manpower and material resources is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a message filtering method, a computer program product, an electronic device, and a storage medium. Background Art

[0002] The firewall provides a wealth of access control functions. Users can configure reasonable access control policies based on the network topology environment. When the firewall receives a message, it detects the source and destination areas, source VLAN, source and destination addresses, services, geographic locations, time ranges, etc. of the message, which can effectively detect abnormal traffic in the network. Usually, operation and maintenance personnel need to find the cause through message filtering (network packet capture).

[0003] However, the conditions relied on by the existing message filtering are limited. For example, intercepting messages by address, port, protocol, time, etc. cannot completely match the matching conditions supported by the firewall access control policy, that is, it cannot capture packets according to the firewall access control policy. In this case, the operation and maintenance personnel are usually required to manually input the packet capture filtering conditions for packet capture analysis. This method relies heavily on the operation and maintenance experience of the operation and maintenance personnel, and the intercepted messages contain a large number of miscellaneous packets, which greatly hinders the tracing of the messages, is inefficient, and has extremely high costs. Summary of the invention

[0004] The purpose of the present application is to provide a message filtering method, a computer program product, an electronic device and a storage medium, which can expand the matching conditions of message filtering, make the message filtering more accurate, do not need to rely on operation and maintenance personnel, facilitate the tracing of messages, and can maximize the accuracy of intercepted messages, reduce the capture of miscellaneous packets, reduce costs, and reduce the use of manpower and material resources.

[0005] In a first aspect, an embodiment of the present application provides a message filtering method, the method comprising:

[0006] Get access control policy;

[0007] Matching and classifying the parameters in the access control policy to obtain a first condition category and a second condition category;

[0008] Obtaining an initial message according to the access control policy ID;

[0009] Filtering the initial message according to the first condition category to obtain a cached message;

[0010] The cached message is filtered twice according to the second condition category to obtain the target message.

[0011] In the above implementation process, the multi-dimensional access control policies are matched and classified, and then two filterings with different precisions are performed according to the classified access control policies. This can expand the matching conditions for message filtering, making message filtering more accurate. It does not need to rely on operation and maintenance personnel, and is convenient for tracing the source of messages. It can maximize the accuracy of intercepted messages, reduce the capture of miscellaneous packets, reduce costs, and reduce the use of manpower and material resources.

[0012] Furthermore, before the step of filtering the initial message according to the first condition category to obtain a cached message, the step further includes:

[0013] Determining whether the initial message contains parameters in the access control policy;

[0014] If yes, filter the initial message to obtain the cached message;

[0015] If not, it is determined that the initial message cannot generate the target message.

[0016] In the above implementation process, when the initial message contains the parameters in the access control policy, the message is filtered, which can reduce the capture of miscellaneous packets, reduce the difficulty of screening the initial message, and improve the filtering efficiency.

[0017] Further, the step of filtering the initial message according to the first condition category to obtain a cached message includes:

[0018] Constructing a filtering condition according to the first condition category;

[0019] The initial message is filtered according to the filtering condition to obtain the cached message.

[0020] In the above implementation process, by constructing the filtering condition according to the first condition category, the initial message can be screened more carefully, and the initial message that does not meet the requirements can be removed through the combination of parameters, thereby reducing the filtering error of the initial message.

[0021] Further, the step of performing secondary filtering on the cached message according to the second condition category to obtain the target message includes:

[0022] Initializing parameters in the second condition category;

[0023] Determine that the parameters in the initialized second condition category are filtering conditions;

[0024] The cached message is filtered twice according to the filtering condition to obtain the target message.

[0025] In the above implementation process, the parameters in the initialized second condition category are used as filtering conditions, which can simplify the secondary filtering process, so that the filtering conditions can be more accurately matched to the cached messages, which is convenient for subsequent tracing of the messages.

[0026] Further, the step of performing secondary filtering on the cached message according to the filtering condition to obtain the target message includes:

[0027] Reading the first filter condition among the filter conditions;

[0028] Perform secondary filtering on the cached message according to the first filtering condition to obtain part of the target message;

[0029] Performing secondary filtering on the cached message according to the remaining filtering conditions in the filtering conditions in turn to obtain a plurality of partial target messages;

[0030] The target message is generated according to the multiple partial target messages.

[0031] In the above implementation process, the cached messages are filtered twice in sequence according to multiple filtering conditions, which can improve the accuracy of the secondary filtering, reduce the number of traversals of the cached messages, and improve the efficiency of the secondary filtering.

[0032] Furthermore, the step of performing secondary filtering on the cached message according to the first filtering condition to obtain part of the target message includes:

[0033] Obtaining node information corresponding to the configuration information of the first filtering condition;

[0034] Extract the message containing the feature corresponding to the node information from the cache message to obtain the partial target message.

[0035] In the above implementation process, the corresponding message is extracted according to the node information, which can improve the accuracy of some target messages, reduce data redundancy, and make the message contain more effective information.

[0036] Furthermore, the step of performing secondary filtering on the cached message according to the first filtering condition to obtain part of the target message further includes:

[0037] Determining whether the first filtering condition includes a security engine;

[0038] If so, extract the keyword in the policy information corresponding to the first filtering condition, perform keyword filtering on the partial target message according to the keyword, and obtain the partial target message after keyword filtering.

[0039] In the above implementation process, when the filtering conditions include a security engine, further filtering some target messages according to keywords can further improve the accuracy of the messages, enhance the network's defense capabilities, and reduce security risks.

[0040] In a second aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0041] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0042] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0043] In a fifth aspect, an embodiment of the present application further provides a message filtering device, the device comprising:

[0044] An acquisition module is used to obtain access control policies;

[0045] A matching and classification module, used for matching and classifying the parameters in the access control policy to obtain a first condition category and a second condition category;

[0046] A message acquisition module, used to obtain an initial message according to the access control policy ID;

[0047] A filtering module, configured to filter the initial message according to the first condition category to obtain a cached message;

[0048] A secondary filtering module is used to perform secondary filtering on the cached message according to the second condition category to obtain a target message.

[0049] In the above implementation process, the multi-dimensional access control policies are matched and classified, and then two filterings with different precisions are performed according to the classified access control policies. This can expand the matching conditions for message filtering, making message filtering more accurate. It does not need to rely on operation and maintenance personnel, and is convenient for tracing the source of messages. It can maximize the accuracy of intercepted messages, reduce the capture of miscellaneous packets, reduce costs, and reduce the use of manpower and material resources.

[0050] Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by implementing the above-mentioned technology of the present disclosure.

[0051] And it can be implemented according to the contents of the specification. The following is a detailed description of the preferred embodiments of the present application with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the range values. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 A flowchart of a message filtering method provided in an embodiment of the present application;

[0054] Figure 2 A schematic diagram of the structure of the message filtering device provided in the embodiment of the present application;

[0055] Figure 3 A schematic diagram of the structural composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0057] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0058] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application, but are not used to limit the scope of the present application.

[0059] Embodiment 1

[0060] Figure 1 is a flow chart of the message filtering method provided in the embodiment of the present application, such as Figure 1 As shown, the method includes:

[0061] S1, obtain access control policy;

[0062] S2, matching and classifying the parameters in the access control policy to obtain a first condition category and a second condition category;

[0063] S3, obtaining the initial message according to the access control policy ID;

[0064] S4, filtering the initial message according to the first condition category to obtain a cached message;

[0065] S5, performing secondary filtering on the cached message according to the second condition category to obtain the target message.

[0066] In the above implementation process, the multi-dimensional access control policies are matched and classified, and then two filterings with different precisions are performed according to the classified access control policies. This can expand the matching conditions for message filtering, making message filtering more accurate. It does not need to rely on operation and maintenance personnel, and is convenient for tracing the source of messages. It can maximize the accuracy of intercepted messages, reduce the capture of miscellaneous packets, reduce costs, and reduce the use of manpower and material resources.

[0067] In S1, the access control policy of the firewall is obtained. The access control policy includes parameters such as source address, destination address, source area, destination area, source port, destination port, application, address location, network operator, time, security engine, etc.

[0068] In S2, these parameters are divided into two categories, namely the first condition category and the second condition category. The first condition category includes: address, port, protocol, and the second condition category includes: interface, broadband operator, geographic location, time range, and security engine. Among them, the first condition category can be regarded as a conventional fixed classification method. These conditions have been supported and applied in the tcpdump tool and are the first filtering conditions to be considered during the packet capture process. The second condition category is a matching condition that combines the firewall system and industry conventions or standards. For example, the interface, security engine, and time range need to be combined with the firewall system, and the broadband operator and geographic location need to be combined with industry conventions or standards.

[0069] Furthermore, before the step of filtering the initial message according to the first condition category to obtain the cached message, the method further includes:

[0070] Determine whether the initial message contains the parameters in the access control policy;

[0071] If yes, filter the initial message to obtain the cached message;

[0072] If not, it is determined that the initial message cannot generate the target message.

[0073] In the above implementation process, when the initial message contains the parameters in the access control policy, the message is filtered, which can reduce the capture of miscellaneous packets, reduce the difficulty of screening the initial message, and improve the filtering efficiency.

[0074] Filtering the initial message according to the first condition category can be regarded as the initial screening of the initial message. When the system starts to receive / send messages, the filtering conditions are constructed according to the first condition category. Optionally, the embodiment of the present application uses the tcpdump tool to conditionally filter and intercept messages, and cache the intercepted messages in the system.

[0075] Furthermore, S4 includes:

[0076] Construct a filtering condition according to the first condition category;

[0077] The initial message is filtered according to the filtering condition to obtain the cached message.

[0078] In the above implementation process, by constructing the filtering condition according to the first condition category, the initial message can be screened more carefully, and the initial message that does not meet the requirements can be removed through the combination of parameters, thereby reducing the filtering error of the initial message.

[0079] The filter conditions are constructed as follows:

[0080] For example, if the address, port, and protocol are in an "and" relationship, you can construct a filtering condition such as host***and port**and tcp; for example, if the address, port, and protocol are in an "or" relationship, you can construct a filtering condition such as host***or host***, port**or port**, tcp or udp.

[0081] Furthermore, S5 includes:

[0082] Initialize the parameters in the second conditional category;

[0083] Determine that the parameters in the initialized second condition category are filtering conditions;

[0084] The cached messages are filtered twice according to the filtering conditions to obtain the target messages.

[0085] In the above implementation process, the parameters in the initialized second condition category are used as filtering conditions, which can simplify the secondary filtering process, so that the filtering conditions can be more accurately matched to the cached messages, which is convenient for subsequent tracing of the messages.

[0086] The parameters in the second condition category are read in sequence, and the parameter variables i=0, i+1=1 are initialized, and the initialized parameters are used as filtering conditions for secondary filtering.

[0087] Further, the step of performing secondary filtering on the cached message according to the filtering condition to obtain the target message includes:

[0088] Read the first filter condition in the filter conditions;

[0089] Perform secondary filtering on the cached messages according to the first filtering condition to obtain some target messages;

[0090] Perform secondary filtering on the cached message according to the remaining filtering conditions in the filtering condition in turn to obtain multiple partial target messages;

[0091] A target message is generated from a plurality of partial target messages.

[0092] In the above implementation process, the cached messages are filtered twice in sequence according to multiple filtering conditions, which can improve the accuracy of the secondary filtering, reduce the number of traversals of the cached messages, and improve the efficiency of the secondary filtering.

[0093] Start reading the first filter condition in the second condition category, filter it, and retain the filtering result (the obtained partial target message), continue i+1 to start reading the second filter condition in the second condition category, filter it again and retain the filtering result, and so on, read all the filter conditions in the second condition category until all the filter conditions complete the filtering process, and finally generate the target message based on the retained multiple partial target messages.

[0094] Further, the step of performing secondary filtering on the cached message according to the first filtering condition to obtain part of the target message includes:

[0095] Get the node information corresponding to the configuration information of the first filtering condition;

[0096] Extract the message containing the feature corresponding to the node information from the cache message to obtain part of the target message.

[0097] In the above implementation process, the corresponding message is extracted according to the node information, which can improve the accuracy of some target messages, reduce data redundancy, and make the message contain more effective information.

[0098] The secondary filtering process can be divided into filtering based on filtering conditions such as filtering area, time range, etc., or filtering based on filtering conditions such as broadband operator, address location, etc., depending on the filtering conditions. Therefore, it is necessary to determine which filtering condition is being used based on the configuration information of the filtering condition.

[0099] The filtering method based on filtering conditions such as filtering area and time range requires combining the firewall area and time configuration to find specific node information (interface, time node), and then filter the messages, cache the messages with relevant characteristics, and obtain some target messages.

[0100] The filtering method based on filtering conditions such as broadband operators and address locations requires the use of industry conventions or standards to filter messages and cache messages with relevant characteristics.

[0101] Further, the step of performing secondary filtering on the cached message according to the first filtering condition to obtain part of the target message also includes:

[0102] Determine whether the first filter condition includes the security engine;

[0103] If so, extract the keyword in the policy information corresponding to the first filtering condition, perform keyword filtering on part of the target messages according to the keyword, and obtain the keyword-filtered part of the target messages.

[0104] In the above implementation process, when the filtering conditions include a security engine, further filtering some target messages according to keywords can further improve the accuracy of the messages, enhance the network's defense capabilities, and reduce security risks.

[0105] If the filtering conditions involve security engines, such as virus defense detection security engine, intrusion defense detection security engine, content filtering (http, ftp, mail protocol, etc.) security engine, it is also necessary to combine the configuration of the security engine on the firewall and filter the messages according to keywords.

[0106] The keywords in this application refer to the keywords referenced in the security engine, including but not limited to http web page content keywords, ftp command keywords, url keywords, email sender and recipient keywords, email attachment keywords, email subject keywords, as well as virus file features, application identifiers, ips attack features, waf attack features, etc.

[0107] For example, assume that the firewall system is configured with a zone object, a time object, and 2,000 access control policies. The matching conditions and referenced security engines of each access control policy are different, and the source and destination addresses of some access control policies have been converted. When the system receives a network packet capture instruction based on the firewall access control policy id 8001 8002 9002, the process is as follows:

[0108]

[0109] Among them, the physical interface bound to area_eth1 is eth1, and the physical interface bound to area_eth2 is eth2. The time range defined by T1 is every Monday and every Wednesday, and the time range defined by T2 is 10:00-12:00 every day. The conditions based on policy ids 8001, 8002, and 9002 are classified as follows:

[0110]

[0111] According to the ID of the access control policy, when the system receives / sends a message, the tcpdump tool is used to filter and intercept the message. The filtering conditions are spliced ​​according to condition category 1:

[0112]

[0113]

[0114] Cache the intercepted messages in the system for further analysis:

[0115]

[0116]

[0117] The message filtering method of the embodiment of the present application is simple and effective, and can be completed by giving a command to the firewall. For example, the firewall is instructed to capture the message with policy id = 8001. The firewall can analyze the policy, classify the filtering conditions, filter the message, and generate the message by itself, without more manual operations, making the message acquisition process more convenient. It provides a basis for the subsequent analysis of the message interaction process and the location of network problems.

[0118] After policy analysis, message interception, and message analysis, the method of the present application generates messages that fully match the policy. The firewall can analyze the policy, classify the filtering conditions, filter the messages, and generate the messages by itself, without the need for more manual operations, making the message acquisition process more convenient. After the policy is modified, the filtering conditions can also be dynamically adjusted by the system.

[0119] In addition, the second condition category of this application supports expansion. As the firewall function becomes more and more perfect, more filtering conditions can be classified into the second condition category. It will complement the firewall system, adapt to a richer network environment, and support a richer network protocol. In the case of a large number of policies and complex configurations, it is more flexible and accurate. It is conducive to the operation and maintenance personnel to quickly locate network problems and accurately analyze network traffic.

[0120] Embodiment 2

[0121] An embodiment of the present application provides a computer program product. When the computer program product is run on a computer, the computer executes any method of the first embodiment.

[0122] Embodiment 3

[0123] In order to execute the method corresponding to the above embodiment 1 to achieve the corresponding functions and technical effects, a message filtering device is provided below, such as Figure 2 As shown, the device comprises:

[0124] Acquisition module 1, used to obtain access control policy;

[0125] A matching and classification module 2, used for matching and classifying the parameters in the access control policy to obtain a first condition category and a second condition category;

[0126] The message acquisition module 3 is used to obtain the initial message according to the access control policy ID;

[0127] A filtering module 4, configured to filter the initial message according to the first condition category to obtain a cached message;

[0128] The secondary filtering module 5 is used to perform secondary filtering on the cached message according to the second condition category to obtain the target message.

[0129] In the above implementation process, the multi-dimensional access control policies are matched and classified, and then two filterings with different precisions are performed according to the classified access control policies. This can expand the matching conditions for message filtering, making message filtering more accurate. It does not need to rely on operation and maintenance personnel, and is convenient for tracing the source of messages. It can maximize the accuracy of intercepted messages, reduce the capture of miscellaneous packets, reduce costs, and reduce the use of manpower and material resources.

[0130] Furthermore, the device also includes a judgment module, which is used to:

[0131] Determine whether the initial message contains the parameters in the access control policy;

[0132] If yes, filter the initial message to obtain the cached message;

[0133] If not, it is determined that the initial message cannot generate the target message.

[0134] In the above implementation process, when the initial message contains the parameters in the access control policy, the message is filtered, which can reduce the capture of miscellaneous packets, reduce the difficulty of screening the initial message, and improve the filtering efficiency.

[0135] Furthermore, the filtering module 4 is also used for:

[0136] Construct a filtering condition according to the first condition category;

[0137] The initial message is filtered according to the filtering condition to obtain the cached message.

[0138] In the above implementation process, by constructing the filtering condition according to the first condition category, the initial message can be screened more carefully, and the initial message that does not meet the requirements can be removed through the combination of parameters, thereby reducing the filtering error of the initial message.

[0139] Furthermore, the secondary filtering module 5 is also used for:

[0140] Initialize the parameters in the second conditional category;

[0141] Determine that the parameters in the initialized second condition category are filtering conditions;

[0142] The cached messages are filtered twice according to the filtering conditions to obtain the target messages.

[0143] In the above implementation process, the parameters in the initialized second condition category are used as filtering conditions, which can simplify the secondary filtering process, so that the filtering conditions can be more accurately matched to the cached messages, which is convenient for subsequent tracing of the messages.

[0144] Furthermore, the secondary filtering module 5 is also used for:

[0145] Read the first filter condition in the filter conditions;

[0146] Perform secondary filtering on the cached messages according to the first filtering condition to obtain some target messages;

[0147] Perform secondary filtering on the cached message according to the remaining filtering conditions in the filtering condition in turn to obtain multiple partial target messages;

[0148] A target message is generated from a plurality of partial target messages.

[0149] In the above implementation process, the cached messages are filtered twice in sequence according to multiple filtering conditions, which can improve the accuracy of the secondary filtering, reduce the number of traversals of the cached messages, and improve the efficiency of the secondary filtering.

[0150] Furthermore, the secondary filtering module 5 is also used for:

[0151] Get the node information corresponding to the configuration information of the first filtering condition;

[0152] Extract the message containing the feature corresponding to the node information from the cache message to obtain part of the target message.

[0153] In the above implementation process, the corresponding message is extracted according to the node information, which can improve the accuracy of some target messages, reduce data redundancy, and make the message contain more effective information.

[0154] Furthermore, the secondary filtering module 5 is also used for:

[0155] Determine whether the first filter condition includes the security engine;

[0156] If so, extract the keyword in the policy information corresponding to the first filtering condition, perform keyword filtering on part of the target messages according to the keyword, and obtain the keyword-filtered part of the target messages.

[0157] In the above implementation process, when the filtering conditions include a security engine, further filtering some target messages according to keywords can further improve the accuracy of the messages, enhance the network's defense capabilities, and reduce security risks.

[0158] The above-mentioned message filtering device can implement the method of the above-mentioned embodiment 1. The options in the above-mentioned embodiment 1 are also applicable to this embodiment and will not be described in detail here.

[0159] The rest of the contents of the embodiments of the present application can refer to the contents of the above-mentioned embodiment 1, and will not be repeated in this embodiment.

[0160] Embodiment 4

[0161] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the message filtering method of the first embodiment.

[0162] Optionally, the above-mentioned electronic device may be a server.

[0163] See also Figure 3 , Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 31, a communication interface 32, a memory 33 and at least one communication bus 34. The communication bus 34 is used to realize direct connection and communication between these components. The communication interface 32 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 31 may be an integrated circuit chip with signal processing capabilities.

[0164] The processor 31 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 31 can also be any conventional processor, etc.

[0165] The memory 33 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 33 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 31, the device can execute the above-mentioned Figure 1 The method embodiment involves various steps.

[0166] Optionally, the electronic device may further include a storage controller and an input / output unit. The memory 33, the storage controller, the processor 31, the peripheral interface, and the input / output unit are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components may be electrically connected to each other via a communication bus 34. The processor 31 is used to execute executable modules stored in the memory 33, such as software function modules or computer programs included in the device.

[0167] The input and output unit is used to provide users with the task creation and to create an optional time period or preset execution time for the task to enable interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0168] Understandably, Figure 3 The structure shown is for illustration only. The electronic device may also include Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown. Figure 3 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0169] In addition, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which implements the message filtering method of embodiment 1 when executed by a processor.

[0170] The embodiment of the present application also provides a computer program product, which, when running on a computer, enables the computer to execute the method described in the method embodiment.

[0171] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented with a dedicated hardware-based device that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0172] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0173] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0174] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0175] The above is only a specific implementation of the present application, but the protection range of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical range disclosed in the present application, which should be included in the protection range of the present application. Therefore, the protection range of the present application should be based on the protection range of the claims.

[0176] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A message filtering method, characterized in that: The method comprises: Get access control policy; Matching and classifying the parameters in the access control policy to obtain a first condition category and a second condition category; Obtaining an initial message according to the access control policy ID; Filtering the initial message according to the first condition category to obtain a cached message; The cached message is filtered twice according to the second condition category to obtain the target message.

2. The message filtering method according to claim 1, characterized in that: Before the step of filtering the initial message according to the first condition category to obtain a cached message, the step further includes: Determining whether the initial message contains parameters in the access control policy; If yes, filter the initial message to obtain the cached message; If not, it is determined that the initial message cannot generate the target message.

3. The message filtering method according to claim 1, characterized in that: The step of filtering the initial message according to the first condition category to obtain a cached message includes: Constructing a filtering condition according to the first condition category; The initial message is filtered according to the filtering condition to obtain the cached message.

4. The message filtering method according to claim 1, characterized in that: The step of performing secondary filtering on the cached message according to the second condition category to obtain the target message includes: Initializing parameters in the second condition category; Determine that the parameters in the initialized second condition category are filtering conditions; The cached message is filtered twice according to the filtering condition to obtain the target message.

5. The message filtering method according to claim 4, characterized in that: The step of performing secondary filtering on the cached message according to the filtering condition to obtain the target message comprises: Reading the first filter condition among the filter conditions; Perform secondary filtering on the cached message according to the first filtering condition to obtain part of the target message; Performing secondary filtering on the cached message according to the remaining filtering conditions in the filtering conditions in turn to obtain a plurality of partial target messages; The target message is generated according to the multiple partial target messages.

6. The message filtering method according to claim 5, characterized in that: The step of performing secondary filtering on the cached message according to the first filtering condition to obtain part of the target message comprises: Obtaining node information corresponding to the configuration information of the first filtering condition; Extract the message containing the feature corresponding to the node information from the cache message to obtain the partial target message.

7. The message filtering method according to claim 6, characterized in that: The step of performing secondary filtering on the cached message according to the first filtering condition to obtain part of the target message further includes: Determining whether the first filtering condition includes a security engine; If so, extract the keyword in the policy information corresponding to the first filtering condition, perform keyword filtering on the partial target message according to the keyword, and obtain the partial target message after keyword filtering.

8. A computer program product, characterized in that When the computer program product is executed on a computer, the computer is enabled to perform the method according to any one of claims 1 to 7.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the message filtering method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the message filtering method according to any one of claims 1 to 7.

Images