A message analysis method, device, equipment and medium

Abstract

The application relates to the technical field of message analysis, and discloses a message analysis method, device, equipment and medium, the method comprising the following steps: obtaining a hardware identification result of a to-be-analyzed message, wherein the hardware identification result represents a basic type of the to-be-analyzed message; based on the hardware identification result, a first matching template matched with the to-be-analyzed message is obtained; based on the first matching template, target domain segment data of the to-be-analyzed message is extracted and spliced; a spliced result is compared with protocol templates in a protocol template library, and based on a comparison result, a message type of the to-be-analyzed message is determined. The application can improve the identification capacity and flexibility of message hardware analysis.

Description

Technical Field

[0001] This invention relates to the field of message parsing technology, specifically to a message parsing method, apparatus, device, and medium. Background Technology

[0002] Message protocol parsing involves identifying and distinguishing the various network protocols encapsulated in a message to ensure data transmission.

[0003] In related technologies, message protocol parsing mainly employs two methods: soft parsing and hard parsing. Soft parsing suffers from higher latency, while hard parsing can only recognize a limited number of message protocols and has weak scalability.

[0004] Therefore, a highly scalable message parsing method is needed. Summary of the Invention

[0005] In view of this, the present invention provides a message parsing method that can improve the recognition capacity and flexibility of hard message parsing.

[0006] In a first aspect, the present invention provides a message parsing method, the method comprising: obtaining a hardware identification result of a message to be parsed, wherein the hardware identification result represents the basic type of the message to be parsed; obtaining a first matching template that matches the message to be parsed based on the hardware identification result; extracting and splicing target domain segment data of the message to be parsed based on the first matching template; comparing the splicing result with a protocol template in a protocol template library, and determining the message type of the message to be parsed based on the comparison result.

[0007] In this embodiment, by obtaining a matching template that matches the message to be parsed and extracting message segments, the target segment data in the message to be parsed can be quickly identified and extracted, improving the efficiency of message parsing. By comparing the splicing result with the protocol template to determine the message type of the message to be parsed, the flexibility and scalability of the method can be improved.

[0008] In one optional implementation, obtaining the hardware identification result of the message to be parsed includes: receiving the message to be parsed and obtaining the target field of the message to be parsed; and determining the basic type of the message to be parsed based on the target field.

[0009] In this embodiment, by obtaining the target field of the message to be parsed, the basic type of the message to be parsed can be determined, which can improve the efficiency of message parsing.

[0010] In one optional implementation, obtaining a first matching template that matches the message to be parsed based on the hardware identification result includes: determining a first feature set of the message to be parsed based on the hardware identification result, wherein the first feature set includes the message header information of the message to be parsed; comparing the matching templates in the first feature set and the matching template set, and determining the first matching template based on the comparison result.

[0011] In this embodiment, a first matching template is obtained by acquiring a first feature set of the message to be parsed. This allows for rapid processing of the message. By comparing the template with the matching template in the matching template set, the message can be standardized.

[0012] In an optional implementation, the method further includes: obtaining a set of message types for the message to be parsed, wherein the set of message types includes at least one message type; generating and configuring a matching template based on the set of message types, wherein the matching template corresponds to at least one message type in the set of message types; and constructing a set of matching templates containing the matching templates.

[0013] In this embodiment, constructing a matching template set based on the set of message types of the message to be parsed can improve the efficiency of message parsing. Furthermore, the matching template set can cover multiple message types, improving the adaptability and flexibility of the method.

[0014] In one optional implementation, extracting and assembling the target segment data of the reception parsing message based on the first matching template includes: determining the position and length of the target segment based on the first matching template; and extracting and assembling the target segment data in the reception parsing message according to the position and length of the target segment.

[0015] In this embodiment, the location and length of the target segment are determined based on the first matching template to extract the corresponding data. This provides information for subsequent message parsing and improves the efficiency of the method.

[0016] In one optional implementation, if the splicing result fails to match the protocol template in the protocol template library, the message type of the message to be parsed is the basic type of the message to be parsed.

[0017] In this embodiment, if the comparison fails, the original message type is preserved, which can prevent incorrect handling of messages and improve the stability of the method.

[0018] In an optional implementation, the method further includes constructing a protocol template library: based on the application task of the message to be parsed, obtaining a set of message protocol types, wherein the set of message protocol types includes several message protocol types that support the application task; constructing a protocol template library corresponding to the set of message protocol types, wherein the protocol templates contained in the protocol template library correspond to the message protocol types in the set of message protocol types.

[0019] In this embodiment, by constructing a protocol template library, the efficiency and accuracy of message parsing can be improved.

[0020] Secondly, the present invention provides a message parsing apparatus, comprising: a hardware identification module for acquiring a hardware identification result of a message to be parsed, wherein the hardware identification result characterizes the basic type of the message to be parsed; a matching module for acquiring a first matching template that matches the message to be parsed based on the hardware identification result; a processing module for extracting and splicing target domain segment data of the message to be parsed based on the first matching template; and a determining module for comparing the splicing result with a protocol template in a protocol template library, and determining the message type of the message to be parsed based on the comparison result.

[0021] Thirdly, the present invention provides a computer device, including: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the message parsing method of the first aspect or any corresponding embodiment described above.

[0022] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the message parsing method of the first aspect or any corresponding embodiment described above. Attached Figure Description

[0023] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating a message parsing method according to an embodiment of the present invention;

[0025] Figure 2 This is a flowchart illustrating another message parsing method according to an embodiment of the present invention;

[0026] Figure 3 This is a flowchart illustrating another message parsing method according to an embodiment of the present invention;

[0027] Figure 4 This is a structural block diagram of a message parsing apparatus according to an embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] This invention provides a message parsing method that, by generating and configuring protocol templates, can flexibly support extended parsing of custom message formats, thereby improving the flexibility of hardware recognition and meeting the offloading requirements for parsing new message formats. The recognition capacity can be expanded by increasing the number of templates in the protocol template library. Hardware-based message parsing, compared to software parsing using software instructions, reduces latency and improves message parsing efficiency.

[0031] According to an embodiment of the present invention, a message parsing method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0032] This embodiment provides a message parsing method. Figure 1 This is a flowchart of a message parsing method according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0033] Step S101: Obtain the hardware identification result of the message to be parsed, wherein the hardware identification result represents the basic type of the message to be parsed.

[0034] Upon receiving a message, it needs to be parsed to extract the data contained within. Hardware can parse the message simultaneously with data transmission, thereby improving the speed of message parsing. The hardware identification device can be a network processor.

[0035] The message to be parsed can be captured through the network interface card and then sent to the hardware identification device for hardware identification. If the message is successfully identified by the hardware, the hardware identification device can directly output the identification result and perform corresponding operations based on the data transmitted in the message. If the message is not identified by the hardware, it indicates that the hardware identification device does not support the identification of this message; in this case, only the structure of the message needs to be output.

[0036] In a practical application, if the protocol of the message to be parsed is IP (Internet Protocol), and the hardware identification device cannot recognize the protocol / next header field in the IP protocol header, then the hardware identification device will only output the source address and destination address of the message to be parsed.

[0037] Step S102: Based on the hardware identification result, obtain the first matching template that matches the message to be parsed.

[0038] Before obtaining the first matching template, the message type and structure to be parsed can be determined based on the application task of the message parsing method. Then, based on the message type and structure, the fields that uniquely identify the message type are identified. According to the message structure, one or more matching templates are written, each corresponding to a specific message type.

[0039] The pre-written matching templates can be integrated into a library to facilitate finding the first matching template that matches the message to be parsed.

[0040] In some alternative implementations, after the matching template is written, it can be tested using sample message data, and the matching template can be adjusted based on the test results.

[0041] In the process of obtaining the first matching template, it is necessary to first analyze the hardware identification results, obtain the feature information of the hardware identification results, compare them with each matching template, and use the matching template that matches successfully as the first matching template. The feature information may include port number, specific values ​​of message protocol fields, message sequence number, etc.

[0042] Step S103: Based on the first matching template, extract and assemble the target domain segment data of the reception parsing message.

[0043] Specifically, target segment data can be extracted from the corresponding position in the header of the message to be parsed based on the first matching template, where the number of target segments is unlimited. If the number of target segments is 1, the data of the target segment can be extracted directly. If the number of target segments is not 1, after determining the position of each target segment, the data of each target segment is extracted, and the extracted data of each target segment is concatenated in the extraction order.

[0044] Step S104: Compare the splicing result with the protocol template in the protocol template library, and determine the message type of the message to be parsed based on the comparison result.

[0045] The method of obtaining the protocol template library is unrestricted. Protocol templates can be obtained from relevant platforms to build the protocol template library, or staff can write and configure protocol templates to obtain the protocol template library.

[0046] After the splicing result is successfully compared with any protocol template in the protocol template library, the message type of the message to be parsed can be updated according to the protocol template.

[0047] In some optional implementations, after determining the message type of the message to be parsed, the offset value of the message to be parsed can be obtained according to the protocol template corresponding to the message. Where the message to be parsed does not contain variable-length fields, the offset value can be determined based on the length of the fields in the message. In a practical application, if the IP header length of the message to be parsed is 20 bytes, then the offset value of the TCP (Transmission Control Protocol) payload is the sum of the IP header length and the TCP header length.

[0048] If the concatenation result fails to match the protocol templates in the protocol template library, then the message type of the message to be parsed is the same as the hardware identification result, and no update is required.

[0049] The message parsing method provided in this embodiment can quickly identify and extract target segment data from the message to be parsed by obtaining a matching template that matches the message to be parsed, thereby improving the efficiency of message parsing. By comparing the splicing result with the protocol template, the message type of the message to be parsed can be determined, which can improve the flexibility and scalability of the method.

[0050] This embodiment provides a message parsing method. Figure 2 This is a flowchart of a message parsing method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0051] Step S201: Obtain the hardware identification result of the message to be parsed, wherein the hardware identification result represents the basic type of the message to be parsed.

[0052] Specifically, step S201 includes:

[0053] Step S2011: Receive the message to be parsed and obtain the target field of the message to be parsed.

[0054] Filtering rules can be set on the hardware identification device to obtain the target fields of the message to be parsed. These target fields are used to identify the type of the message to be parsed and may include Ethernet type, IP protocol number, TCP / UDP (User Datagram Protocol) port number, etc.

[0055] Step S2012: Determine the basic type of the message to be parsed based on the target field.

[0056] The basic type of the message to be parsed can be determined by the content of the target field. In a practical application, the target field includes the protocol field of the message to be parsed; when the protocol field is 6, it indicates that the message to be parsed is TCP.

[0057] Step S202: Based on the hardware identification result, obtain the first matching template that matches the message to be parsed.

[0058] Specifically, step S202 includes:

[0059] Step S2021: Based on the hardware identification results, determine the first feature set of the message to be parsed, wherein the first feature set includes the message header information of the message to be parsed.

[0060] The first feature set includes not only the header information of the message to be parsed, but also its sequence number, trailer information, etc. Based on the hardware recognition results, the composition structure, sequence number, and other feature information of the message to be parsed can be obtained to construct the first feature set. This feature information can be directly extracted from the message to be parsed.

[0061] Step S2022: Compare the matching templates in the first feature set and the matching template set, and determine the first matching template based on the comparison results.

[0062] The matching template defines the message characteristics of different types of messages. The first set of features of the message to be parsed is compared with the message characteristics defined by different matching templates. If the first set of features is the same as the message characteristics defined by the matching template, it means that the message to be parsed matches the matching template, and the matching template is used as the first matching template.

[0063] If the first feature set is not completely identical to the message features defined in the matching template, it indicates that the message to be parsed has failed to match the matching template.

[0064] In some optional implementations, the above step S2022 includes the following steps:

[0065] Step a1: Obtain the message type set of the message to be parsed, wherein the message type set includes at least one message type.

[0066] In this process, the message types that need to be identified can be determined based on the actual application, and a message type set containing all message types that need to be identified can be constructed.

[0067] Step a2: Generate and configure a matching template based on the message type set, wherein the matching template corresponds to at least one message type in the message type set.

[0068] The process involves retrieving the message structure for each message type from the message type set and generating corresponding message templates based on these structures. The message structure can be obtained from the message type's manual. In a practical application, generating TCP message templates is necessary. The TCP protocol manual provides the TCP message structure, including source and destination ports, which can then be used to generate the appropriate templates. After generating and configuring the matching templates, message samples can be used to test the matching templates.

[0069] Step a3: Construct a set of matching templates containing the matching templates.

[0070] Constructing a matching template set based on the set of message types to be parsed can improve the efficiency of message parsing. Furthermore, the matching template set can cover multiple message types, increasing the adaptability and flexibility of the method.

[0071] Step S203: Based on the first matching template, extract and assemble the target domain segment data of the reception parsing message.

[0072] Please see details Figure 1 Step S103 of the illustrated embodiment will not be described again here.

[0073] Step S204: Compare the splicing result with the protocol template in the protocol template library, and determine the message type of the message to be parsed based on the comparison result.

[0074] Please see details Figure 1 Step S104 of the illustrated embodiment will not be described again here.

[0075] The message parsing method provided in this embodiment improves parsing efficiency by obtaining the target fields of the message to be parsed to determine its basic type. A first matching template is obtained by acquiring the first feature set of the message to be parsed, allowing for rapid processing of the message. Standardization of the message can be achieved by comparing it with matching templates in the matching template set.

[0076] This embodiment provides a message parsing method. Figure 3 This is a flowchart of a message parsing method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0077] Step S301: Obtain the hardware identification result of the message to be parsed, wherein the hardware identification result represents the basic type of the message to be parsed.

[0078] Please see details Figure 1 Step S101 of the illustrated embodiment will not be described again here.

[0079] Step S302: Based on the hardware recognition result, obtain the first matching template that matches the message to be parsed.

[0080] Please see details Figure 1 Step S102 of the illustrated embodiment will not be described again here.

[0081] Step S303: Based on the first matching template, extract and assemble the target domain segment data of the reception parsing message.

[0082] Specifically, step S303 includes:

[0083] Step S3031: Based on the first matching template, determine the position and length of the target domain segment.

[0084] The selection and number of target segments are unrestricted. Segments containing information can be selected as target segments based on the actual situation. The corresponding positions and lengths in the message to be parsed are determined based on the positions and lengths of each target segment in the first matching template.

[0085] Step S3032: Extract and assemble the data of the target segment in the reception parsing message according to the location and length of the target segment.

[0086] If the number of target segments is 1, the data of the target segment can be directly extracted according to its position and length in the message to be parsed. If the number of target segments is not 1, the position of each target segment is determined, the data of each target segment is extracted, and the extracted data of each target segment is concatenated in the extraction order.

[0087] Step S304: Compare the splicing result with the protocol template in the protocol template library, and determine the message type of the message to be parsed based on the comparison result.

[0088] Please see details Figure 1 Step S104 of the illustrated embodiment will not be described again here.

[0089] In some optional implementations, if the splicing result fails to match the protocol template in the protocol template library, the message type of the message to be parsed is the basic type of the message to be parsed.

[0090] Preserving the original message type when the comparison fails can prevent incorrect message handling and improve the stability of the method.

[0091] In some optional implementations, step S304 may be preceded by:

[0092] Step b1: Based on the application task of the message to be parsed, obtain the message protocol type set, which includes several message protocol types that support the application task.

[0093] Specifically, based on the application task of the message to be parsed, the message protocol type that needs to be identified is determined, and a message protocol type set containing the message protocol types is constructed.

[0094] In a practical application, if the application task to be parsed is an online game, then it is necessary to identify protocols such as UDP, and the message protocol type set needs to include the UDP protocol.

[0095] Step b2: Construct a protocol template library corresponding to the message protocol type set, wherein the protocol templates contained in the protocol template library correspond to the message protocol types in the message protocol type set.

[0096] Based on the protocol types in the message protocol type set, obtain the corresponding message structure for each protocol type, and then create the corresponding protocol template based on the message structure. The protocol template contains the necessary fields for that protocol type. Construct a protocol template library containing all the protocol templates.

[0097] In some optional implementations, the message protocol type set includes a first custom message protocol. Based on the structure of the first custom message protocol, a corresponding protocol template can be created. The protocol template library contains protocol templates for the first custom message protocol, enabling the parsing of messages to be parsed under the first custom message protocol, thereby expanding the capacity for identifying message types and improving the flexibility of the method.

[0098] By building a protocol template library, the efficiency and accuracy of message parsing can be improved.

[0099] The message parsing method provided in this embodiment determines the location and length of the target segment based on a first matching template to extract the corresponding data. This can provide information for subsequent message parsing and improve the efficiency of the method.

[0100] This embodiment also provides a message parsing apparatus for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0101] This embodiment provides a message parsing device, such as... Figure 4 As shown, it includes:

[0102] The hardware identification module 401 is used to obtain the hardware identification result of the message to be parsed, wherein the hardware identification result represents the basic type of the message to be parsed;

[0103] Matching module 402 is used to obtain a first matching template that matches the message to be parsed based on the hardware recognition result;

[0104] Processing module 403 is used to extract and assemble the target domain segment data of the reception parsing message based on the first matching template;

[0105] The determination module 404 is used to compare the splicing result with the protocol templates in the protocol template library, and based on the comparison result, determine the message type of the message to be parsed.

[0106] In some alternative implementations, the hardware identification module 401 includes:

[0107] The target field acquisition unit is used to receive the message to be parsed and acquire the target field of the message to be parsed.

[0108] The basic type determination unit is used to determine the basic type of the message to be parsed based on the target field.

[0109] In some alternative implementations, the matching module 402 includes:

[0110] The feature determination unit is used to determine a first feature set of the message to be parsed based on the hardware recognition results, wherein the first feature set includes the message header information of the message to be parsed.

[0111] The matching template determination unit is used to compare the matching templates in the first feature set and the matching template set, and determine the first matching template based on the comparison result.

[0112] In some optional implementations, the message parsing apparatus further includes:

[0113] Match template set building module 405 is used to build a match template set.

[0114] The matching template set construction module 405 includes:

[0115] The message type set acquisition unit is used to acquire the message type set of the message to be parsed, wherein the message type set includes at least one message type.

[0116] The matching template acquisition unit is used to generate and configure a matching template based on a set of message types, wherein the matching template corresponds to at least one message type in the set of message types.

[0117] Template collection building unit, used to build a matching template collection containing matching templates.

[0118] In some alternative implementations, the processing module 403 includes:

[0119] The target segment determination unit is used to determine the position and length of the target segment based on the first matching template.

[0120] The target segment data acquisition unit is used to extract and assemble the data of the target segment in the receiving parsed message according to the location and length of the target segment.

[0121] In some optional implementations, if the splicing result fails to match the protocol template in the protocol template library, the message type of the message to be parsed is the basic type of the message to be parsed.

[0122] In some optional implementations, the message parsing apparatus further includes:

[0123] Protocol template library construction module 406 is used to build protocol template libraries.

[0124] The protocol template library construction module 406 includes:

[0125] The message protocol type set acquisition unit is used to acquire a message protocol type set based on the application task of the message to be parsed, wherein the message protocol type set includes several message protocol types that support the application task.

[0126] The protocol template library construction unit is used to construct a protocol template library corresponding to the message protocol type set, wherein the protocol templates contained in the protocol template library correspond to the message protocol types in the message protocol type set.

[0127] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0128] In this embodiment, the message parsing device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0129] This invention also provides a computer device having the above-described features. Figure 4 The message parsing device shown.

[0130] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 5As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 5 Take a processor 10 as an example.

[0131] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0132] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0133] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0134] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0135] The computer device also includes an input device 30 and an output device 40. The processor 10, memory 20, input device 30, and output device 40 can be connected via a bus or other means. Figure 5 Taking the example of a connection between China and Israel via a bus.

[0136] Input device 30 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 40 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The aforementioned display devices include, but are not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some alternative embodiments, the display device may be a touchscreen.

[0137] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0138] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0139] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A message parsing method, characterized in that, The method includes: The hardware identification result of the hardware identification device performing hardware identification on the message to be parsed is obtained, wherein the hardware identification result represents the basic type of the message to be parsed; if the hardware identification device does not support the identification of the message to be parsed, the hardware identification result includes the composition structure of the message to be parsed. Based on the hardware identification result, a first matching template that matches the message to be parsed is obtained; Based on the first matching template, extract and concatenate the target domain segment data of the message to be parsed; Compare the splicing result with the protocol templates in the protocol template library, and determine the message type of the message to be parsed based on the comparison result; After the splicing result is successfully compared with any protocol template in the protocol template library, the message type of the message to be parsed is updated according to the protocol template. If the concatenation result fails to match the protocol template in the protocol template library, the message type of the message to be parsed is the basic type of the message to be parsed. The process of constructing the protocol template library includes: obtaining a set of message protocol types based on the application task of the message to be parsed, wherein the set of message protocol types includes several message protocol types that support the application task and custom message protocols; and constructing a protocol template library corresponding to the set of message protocol types, wherein the protocol templates contained in the protocol template library correspond to the message protocol types in the set of message protocol types.

2. The method according to claim 1, characterized in that, The hardware identification results for obtaining the message to be parsed include: Receive the message to be parsed and obtain the target field of the message to be parsed; Based on the target field, the basic type of the message to be parsed is determined.

3. The method according to claim 1, characterized in that, The step of obtaining a first matching template that matches the message to be parsed based on the hardware identification result includes: Based on the hardware identification results, a first feature set of the message to be parsed is determined, wherein the first feature set includes the message header information of the message to be parsed; The matching templates in the first feature set and the matching template set are compared, and the first matching template is determined based on the comparison results.

4. The method according to claim 3, characterized in that, The method further includes: Obtain a set of message types for the message to be parsed, wherein the set of message types includes at least one message type; Based on the message type set, a matching template is generated and configured, wherein the matching template corresponds to at least one message type in the message type set; Construct a matching template set that includes the matching template.

5. The method according to claim 1, characterized in that, The step of extracting and concatenating the target segment data of the message to be parsed based on the first matching template includes: Based on the first matching template, determine the position and length of the target domain segment; Based on the location and length of the target field segment, extract and concatenate the data of the target field segment in the message to be parsed.

6. A message parsing device, characterized in that, The device includes: The hardware identification module is used to obtain the hardware identification result of the hardware identification device performing hardware identification on the message to be parsed, wherein the hardware identification result represents the basic type of the message to be parsed; if the hardware identification device does not support the identification of the message to be parsed, the hardware identification result includes the composition structure of the message to be parsed. The matching module is used to obtain a first matching template that matches the message to be parsed based on the hardware recognition result; The processing module is used to extract and concatenate the target domain segment data of the message to be parsed based on the first matching template; The determination module is used to compare the splicing result with the protocol templates in the protocol template library, and based on the comparison result, determine the message type of the message to be parsed; After the splicing result is successfully compared with any protocol template in the protocol template library, the message type of the message to be parsed is updated according to the protocol template. If the concatenation result fails to match the protocol template in the protocol template library, the message type of the message to be parsed is the basic type of the message to be parsed. Constructing the protocol template library includes: obtaining a set of message protocol types based on the application task of the message to be parsed; the set of message protocol types includes several message protocol types supporting the application task and custom message protocols; and constructing a protocol template library corresponding to the set of message protocol types, wherein the protocol templates contained in the protocol template library correspond to the message protocol types in the set of message protocol types.

7. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the message parsing method according to any one of claims 1 to 5 by executing the computer instructions.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the message parsing method according to any one of claims 1 to 5.

Images