Data processing method and device, equipment and storage medium

Abstract

The invention provides a data processing method and device, electronic equipment and a readable storage medium, and the method comprises the steps: splitting and combining obtained source network filter information of a source platform, and obtaining first general configuration information comprising at least one general rule used for representing network behaviors; generating a universal network rule tree according to the first universal configuration information and the universal rule; traversing and searching the universal network rule tree to obtain second universal configuration information; and converting the second general configuration information into target network filter information matched with the filter rule of the target platform. By extracting common characteristics of network behaviors under different platforms, when rule conversion is carried out between different platforms, source network filter information is converted into a general rule, then the general rule is converted into target network filter information matched with a filter rule of a target platform, and the rule conversion efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and specifically relates to a data processing method, device, electronic equipment and readable storage medium. Background Art

[0002] Network filters play an important role in network security, network maintenance, and the construction of large-scale system software.

[0003] In related technologies, when the computer system environment changes, professionals (software production / operation and maintenance personnel) are required to migrate the network filtering information of the source platform to the target platform to ensure network security and normal operation of the software system on the target platform. Professionals need to master relevant knowledge to perform manual conversion or use simple scripts to achieve the migration of the network filtering information of the source platform.

[0004] Since it is difficult to master network filtering information itself, and only simple conversion can be performed through scripts, the applicability is poor, and the rule conversion is complex and inefficient. Summary of the invention

[0005] The present invention aims to provide a data processing method, device, electronic device and readable storage medium, which at least solve the problem that the conversion method of network filter rules in the prior art has poor applicability, complex conversion and low efficiency.

[0006] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0007] In a first aspect, an embodiment of the present application provides a method for data processing, including:

[0008] The obtained source network filter information of the source platform is split and combined to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior;

[0009] Generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to represent the topological relationship between the first general configuration information and the topological relationship between the general rules;

[0010] By traversing and searching the universal network rule tree, second universal configuration information consisting of universal rules corresponding to nodes in the universal network rule tree is obtained;

[0011] The second general configuration information is converted into target network filter information matching the filter rule of the target platform.

[0012] In a second aspect, the present application also provides a method and apparatus for data processing, including:

[0013] A processing module, configured to split and combine the acquired source network filter information of the source platform to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior;

[0014] A first generating module, configured to generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to characterize the topological relationship between the first general configuration information and the topological relationship between the general rules;

[0015] A first traversal search module, configured to obtain second general configuration information consisting of general rules corresponding to nodes in the general network rule tree by traversing and searching the general network rule tree;

[0016] The second generating module is configured to convert the second general configuration information into target network filter information matching the filter rule of the target platform.

[0017] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a processor; and one or more programs, wherein the one or more programs are stored in a memory and are configured to be executed by the one or more processors, wherein the one or more programs include instructions for performing the following operations:

[0018] The obtained source network filter information of the source platform is split and combined to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior;

[0019] Generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to represent the topological relationship between the first general configuration information and the topological relationship between the general rules;

[0020] By traversing and searching the universal network rule tree, second universal configuration information consisting of universal rules corresponding to nodes in the universal network rule tree is obtained;

[0021] The second general configuration information is converted into target network filter information matching the filter rule of the target platform.

[0022] In a fourth aspect, an embodiment of the present application further provides a readable storage medium, which, when instructions in the readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method described in the first aspect.

[0023] In summary, the embodiment of the present application first splits and combines the source network filter information in a preset manner to obtain the first general configuration information containing at least one general rule for characterizing network behavior, and then generates a general network rule tree based on the first general configuration information and the general rule, and finally obtains the second general configuration information by traversing and searching the general network rule tree, and converts the second general configuration information into target network filter information that matches the filter rules of the target platform. The embodiment of the present application extracts the common characteristics of network behavior under different platforms, so that when converting rules between different platforms, the source network filter information is converted into general rules, and then the general rules are converted into target network filter information that matches the filter rules of the target platform, so as to realize the conversion between network filter configuration rules under different platforms, which not only improves the applicability of rule conversion, but also reduces the complexity of rule conversion and improves the efficiency of rule conversion. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of the steps of a data processing method provided by an embodiment of the present application;

[0025] Figure 2 It is a schematic diagram of the general rule definition provided in the embodiment of the present application;

[0026] Figure 3 is a schematic diagram of a general conversion module of an operating system provided in an embodiment of the present application;

[0027] Figure 4 is a schematic diagram of a general network rule tree provided in an embodiment of the present application;

[0028] Figure 5 is a schematic diagram of a target rule provided in an embodiment of the present application;

[0029] Figure 6 It is a schematic diagram of the conversion between target rules and target filters provided in an embodiment of the present application;

[0030] Figure 7 is a flowchart of another data processing method provided by an embodiment of the present application;

[0031] Figure 8 It is a system workflow diagram provided by an embodiment of the present application;

[0032] Fig. 9 is a workflow diagram of the front-end conversion module provided in an embodiment of the present application;

[0033] Fig.10 is a workflow diagram of a general network rule module provided in an embodiment of the present application;

[0034] Fig.11is a workflow diagram of the back-end conversion module provided in an embodiment of the present application;

[0035] Fig.12 is a block diagram of a data processing device provided in an embodiment of the present application;

[0036] Fig.13 is a block diagram of an electronic device provided in an embodiment of the present application;

[0037] Fig.14 It is a block diagram of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The data processing method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0039] Network filters (also known as network filter subsystems, etc.) are essential components of every modern operating system and are the cornerstone of technologies such as firewalls, proxy servers, and network security. Network filters usually play an important role in network security, network maintenance, and the construction of large-scale system software. In addition, many systems, such as virtual machines, containers, distributed, and cloud computing systems, require correct network filtering configuration rules to work properly. Among them, there are many types of network filters, and their types are usually related to the type of computer operating system. For example, the network filters used in the Linux operating system include iptables, nftables, etc., and the network filters used in the Windows operating system include Windows Filter Platform (WFP, Windows Filter Platform), etc.

[0040] Network filters usually include three parts: rules, matching points, and priorities. Among them, rules include conditions and actions. Conditions are descriptions of network behaviors, and actions are operations that need to be performed when the description of network behaviors meets the conditions. For example, the rule is "If the Internet Protocol (IP) address is equal to 192.168.100.100, then discard the data." Then, in this rule, "IP address equals 192.168.100.100" is the condition, and "discard the data" is the action. Matching point refers to the location. Specifically, the matching point refers to the specific location where the rule performs the matching operation in the network protocol stack. Priority indicates the order in which the matching operation is executed, usually referring to the order in which the rules execute the matching operation if the rules are at the same matching point. For two or more rules at the same matching point, the higher the priority of the rule, the higher the matching operation of the rule will be executed first.

[0041] Since network filters are very important to the computer system environment, when the computer system environment changes, it is usually necessary to migrate the source network filter information configured on the source platform to the target platform, and ensure the network security and normal operation of the software system on the target platform. For example, the source platform can be a Linux platform, and the target platform can be a Windows platform. When the computer system environment is converted from a Linux platform to a Windows platform, the network filter information used by the network filter used by the Linux platform needs to be reconfigured according to the network filter supported by the Windows platform.

[0042] The related art proposes two solutions. One solution is that professionals migrate the source network filtering information configured on the source platform to the target platform. Since the configuration of the network filter involves a lot of network knowledge, it is difficult to master this network knowledge. In addition, since the implementation schemes of the network filter and the network protocol stack are highly coupled, the driver of the network protocol stack is often directly related to the operating system kernel. The network filter subsystems used by different operating systems are different, especially the configurations of matching points and priorities are different, which further increases the learning cost. Professionals save multiple configuration files by themselves and migrate the source network filtering information to the target platform for reconfiguration. Not only is the learning cost high, but also the realization of this function usually requires professionals to repeat learning and a lot of trial and error, and the conversion is complex and inefficient. Another solution is to convert the source network filtering information configured on the source platform through scripts and syntax. This process usually requires code implementation, which is relatively complicated, and can only be converted simply through scripts to achieve conversion between fixed rules or fixed targets, and the applicability is poor.

[0043] The embodiment of the present application first splits and combines the source network filter information in a preset manner to obtain first general configuration information containing at least one general rule for characterizing network behavior, and then generates a general network rule tree based on the first general configuration information and the general rule. Finally, the second general configuration information is obtained by traversing and searching the general network rule tree, and the second general configuration information is converted into target network filter information that matches the filter rules of the target platform. The embodiment of the present application extracts the common characteristics of network behavior under different platforms, so that when converting rules between different platforms, the source network filter information is converted into general rules, and then the general rules are converted into target network filter information that matches the filter rules of the target platform, so as to realize the conversion between network filter configuration rules under different platforms, which not only improves the applicability of rule conversion, but also reduces the complexity of rule conversion and improves the efficiency of rule conversion.

[0044] Based on the above implementation scenario, refer to Figure 1, which shows a step flow chart of a data processing method provided by an embodiment of the present application, the method comprising:

[0045] Step 101 : split and combine the acquired source network filter information of the source platform to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior.

[0046] In the embodiment of the present application, the source platform may be an operating system in a computer system. For example, the source platform may be a Linux platform or a Windows platform, or of course, other platforms, which are not specifically limited in the embodiment of the present application.

[0047] Further, in the embodiment of the present application, the source network filter information may be the rule configuration information of the source platform using the filter to work. For example, the source network filter information may be "discarding data packets that use the Transmission Control Protocol (TCP) protocol to access the address 172.16.33.199:80".

[0048] Furthermore, in an embodiment of the present application, the source network filter information can be obtained through the capture filter in the Wireshark tool. Specifically, first open the Wireshark tool, select the network interface that needs to capture packets, select Capture Filter in the menu bar, and then enter the filter rule TCP in the pop-up dialog box. Finally, click the Start button to start obtaining the source network filter information. After each source network filter information is obtained, it can be saved in a configuration file. Each line in the configuration file represents a source network filter information, and finally a configuration file containing all source network filter information is obtained.

[0049] Since the locations and priorities of filter execution rules of different network platforms are different, when converting the source network filter information of the source platform into the target filter information of the target platform, the source network filter information needs to be converted into a common rule, thereby improving the applicability of the network filter rule conversion.

[0050] In the implementation of this application, a general rule may refer to a general network rule that does not include the network filter implementation and configuration details. Since general rules are universal, even complex filter rules can be converted into general rules. General rules generally include conditions, operations, actions, etc. More specifically, they have the following attributes: condition type, condition data, operations, and actions.

[0051] In an embodiment of the present application, the general rules can be stored in the intermediate configuration file in the form of a dictionary, and the preset attribute names of the general rules and the attribute values ​​corresponding to the preset attribute names can be stored in the form of strings. For example, a general rule can be described as: {{"condition type": "value corresponding to the condition type"}, {"condition data": "value corresponding to the condition data"}, {"operation": "value corresponding to the operation"}, {"action": "value corresponding to the action"}}.

[0052] The condition type can refer to the condition type that needs to be matched, such as L4 protocol number, IP address, port number, transport layer protocol, etc., and the condition type must describe an independent single network behavior and must not describe a composite behavior. For example, the condition type cannot contain a composite behavior such as IP address & port number.

[0053] Conditional data may refer to conditional data that needs to be matched, for example, 192.168.11.100, 8080, etc. And the conditional data must be meaningful, independent, and single data, and multiple types of matching data cannot appear. For example, 192.168.11.100:8080.

[0054] The operation can refer to the matching method, and the operation must be a single logical behavior with meaning, such as equal, not equal, greater than, less than, etc.

[0055] An action can refer to an operation after a successful match, and the action must be a single meaningful behavior, such as redirect, discard, release, forward, mark, etc.

[0056] In an embodiment of the present application, the preset method can be a predefined method, and the source network filter information is semantically parsed according to the preset method to obtain one or more attribute information. For example, the source network filter information is "If the Internet Protocol Version 4 (IPV4) address of a data packet is equal to 10.10.88.100, then discard the packet", and the information is semantically parsed to obtain two attribute information "IPV4 address equal to 10.10.88.100" and "discard". After obtaining these two attribute information, according to the parsing order of the attribute information, these two attribute information are combined to obtain a general rule, that is, a general rule with a "condition type" value of "IPV4 address", a "condition data" value of "10.10.88.100", a "operation" value of "equal to" and an "action" value of "discard". In an embodiment of the present application, the general rule can be stored in the intermediate configuration file in the form of a dictionary, and the preset attribute name of the general rule and the attribute value corresponding to the preset attribute name can be stored in the form of a string. For example: {{"Condition Type":"IPV4 Address","Condition Data":"10.10.88.100","Operation":"Equals","Action":"Drop"}}.

[0057] For example, see Figure 2, the original rule is "discard the data packets that use TCP protocol to access address 172.16.33.199:80". By performing text semantic analysis in the order of network protocol, access address, port number, and action, four attribute information can be obtained, namely "use TCP protocol", "access address 172.16.33.199", "port number 80", and "discard". After obtaining the four attribute information of "use TCP protocol", "access address 172.16.33.199", "port number 80", and "discard", these four attribute information are combined in the order of splitting the attribute information to obtain the general configuration information including three general rules. Among them, the "Condition Type" value of General Rule 1 is "L4 Protocol Number", the "Condition Data" value is "06", the "Operation" value is "Equal", and the "Action" value is "Jump General Rule 2"; the "Condition Type" value of General Rule 2 is "IPV4 Target Address", the "Condition Data" value is "172.16.33.199", the "Operation" value is "Equal", and the "Action" value is "Jump General Rule 3"; the "Condition Type" value of General Rule 3 is "Target Port Number", the "Condition Data" value is "80", the "Operation" value is "Equal", and the "Action" value is "Discard". In an embodiment of the present application, if the general rules need to be stored in an intermediate configuration file, they can be stored in the form of a dictionary, and the preset attribute names of the general rules and the attribute values ​​corresponding to the preset attribute names can be stored in the form of strings. For example: {{"Condition Type":"L4 Protocol Number","Condition Data":"06","Operation":"Equals","Action":"Jump"},{"Condition Type":"IPV4 Destination Address","Condition Data":"172.16.33.199","Operation":"Equals","Action":"Jump"},{"Condition Type":"Destination Port Number","Condition Data":"80","Operation":"Equals","Action":"Drop"}}.

[0058] For example, see Figure 3, the source network filter information in Windows Filter Platform (WFP) is "Condition domain is FWPM_CONDITION_PROTOCOL, condition match type is FWP_MATCH_EQUAL, condition value type is FWP_UINT32, condition value is TCP, filter execution is FWP_ACTION_DROP, filter execution layer is FWPM_LAYER_ALE_CONNECT_V4, filter priority is FWP_EMPTY, and the number of filter conditions is 1". The WPF conversion library performs semantic analysis in the order of transport layer protocol, connection status, and action, and can obtain three attribute information, namely "transport layer protocol number TCP", "connection status NEW", and "discard". After obtaining the three attribute information of "transport layer protocol number TCP", "connection status NEW", and "discard", these three attribute information are combined according to the parsing order of text information to obtain general configuration information including two general rules. Among them, the value of "Condition Type" of General Rule 1 is "Transport Layer Protocol Number", the value of "Condition Data" is "TCP", the value of "Operation" is "Equal", and the value of "Action" is "Jump to General Rule 2"; the value of "Condition Type" of General Rule 2 is "Connection Status", the value of "Condition Data" is "NEW", the value of "Operation" is "Equal", and the value of "Action" is "Discard". The storage format of general rules is the same as described above, and no further details are given here.

[0059] In the embodiment of the present application, since the general rules are stored in the intermediate configuration file, when the general rules need to be called, the intermediate configuration file can be called through the ls instruction to obtain the general rules.

[0060] Since network filters generally filter network packets, and network packets, as carriers of network protocols, have behaviors that are widely applicable, complex filter configurations can be converted into general network rules.

[0061] Therefore, the embodiment of the present application splits and combines the source network filter information in a preset manner to obtain the first general configuration information containing at least one general rule for characterizing network behavior. For different network filter platforms, the conversion between the network filter and the general rule can be realized, so that the rule conversion between any platforms can be realized based on the general rule, which greatly improves the applicability of the network filter rule conversion and also improves the work efficiency of the maintenance personnel.

[0062] Step 102: Generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to represent the topological relationship between the first general configuration information and the topological relationship between the general rules.

[0063] In the embodiment of the present application, the general network rule tree can be a model that is completely described by network behavior and represents a complete network filter information. The general network rule tree is composed of general rules according to the way data is transmitted on the network protocol stack. According to different general rule characteristics, the general network rule tree usually includes a root node, a layer, a sublayer, and a rule chain.

[0064] Among them, the root node is a node that must be included in each universal network rule tree, representing the starting point of data passing through the rule tree. The position of the root node in the universal network rule tree is related to the direction of data transmission. For example, in the receiving direction, the root node is located at the lowest layer (i.e., the physical layer) in the universal network rule tree, and in the sending direction, the root node is located at the highest layer (i.e., the application layer) in the universal network rule tree.

[0065] Each general network rule tree contains at least one layer, where a layer is a collection of general rules whose condition types belong to the same model layer. Taking the general network rule tree as the Open System Interconnection Reference Model (OSI) as an example, the collection of general rules belonging to the same OSI layer is a layer.

[0066] Each layer in the general network rule tree can be divided into one or more sublayers. A sublayer is a collection of general rules belonging to the same protocol in the same layer, and each sublayer in the layer is a parallel structure with no priority. For example, the network layer includes IPV4 and IPV6 sublayers, and there is no priority difference between IPV4 and IPV6 sublayers.

[0067] Figure 4 Schematic diagram of a general network rule tree provided in an embodiment of the present application. Figure 4 , the general network rule tree includes classifications corresponding to the network layer and classifications corresponding to the transport layer, wherein the classifications corresponding to the network layer include subclassifications corresponding to the IPV4 sublayer and subclassifications corresponding to the IPV6 sublayer, and the classifications corresponding to the transport layer include subclassifications corresponding to the TCP sublayer and subclassifications corresponding to the UDP sublayer. Each node in the general network rule tree corresponds to a general rule, and contains attribute information of the general rule corresponding to the node. For example, node 1 corresponds to general rule 1, and node 1 contains attribute information of general rule 1, node 4 corresponds to general rule 4, and node 4 contains attribute information of general rule 4, etc. Each branch in the general network rule tree contains a number of nodes, and the branches where these nodes are located correspond to a first general configuration information. In other words, each branch in the general network rule tree represents a first general configuration information. For example, the branches where nodes 9, 5, and 6 are located correspond to a first general configuration information.

[0068] In an embodiment of the present application, for example, the source network filter information is "discard data packets that use the TCP protocol to access the address 172.16.33.199:80". After obtaining the first general configuration information consisting of three general rules, based on the priority of the general rules defined by the source platform, it is determined that general rule 1 has a higher priority than general rule 2, and general rule 2 has a higher priority than general rule 3. The higher the priority of a general rule, the sooner the general rule is executed. Based on this, the execution order among the three general rules in the first general configuration information can be determined, that is, general rule 1 is executed first, then general rule 2, and finally general rule 3. Based on the execution order among the three general rules, the nodes corresponding to the three general rules can be connected, that is, node 1 is connected to node 2, and node 2 is connected to node 3, forming a branch corresponding to the first general configuration information in the general network rule tree.

[0069] For another example, the source network filter information is "if the IPV4 address of a data packet is equal to 10.10.88.100, then discard the packet". After obtaining the first general configuration information consisting of a general rule, since there is only one general rule, the node corresponding to the general rule constitutes a branch in the general network rule tree.

[0070] By performing the above analysis on all first general configuration information, multiple branches in the general network rule tree can be obtained. Figure 4 As shown, after obtaining multiple branches of the general network rule tree, the node corresponding to the general rule executed first in each first general configuration information is determined based on the priority of the general rule executed first in each first general configuration information defined by the source platform, that is, the priority of the first general configuration information. For example, the first general configuration information 1 includes general rule 1, the first general configuration information 2 includes general rules 9, general rules 5, and general rules 6, and the first general configuration information 3 includes general rules 3, general rules 4, and general rules 5. Based on the priorities of general rules 1, general rules 9, and general rules 3 defined by the source platform, it is determined that the priority of general rule 1 is higher than that of general rule 9, and the priority of general rule 9 is higher than that of general rule 3. The higher the priority of a general rule, the earlier the general rule is executed, and the earlier the node corresponding to the general rule is executed. That is to say, based on the priorities of general rules 1, general rules 9, and general rules 3, the execution order of the general rules can be determined, and thus the execution order of the nodes corresponding to the general rules can be determined, that is, node 1 is executed first, then node 9, and finally node 3. Node 1, node 9, and node 3 are connected according to the execution order of the nodes to obtain a general network rule tree composed of branches corresponding to the three first general configuration information.

[0071] In the embodiment of the present application, based on the first general configuration information and the general rules, a general network rule tree is generated that can characterize the topological relationship between the general configuration information, that is, the topological relationship between the general rules. By utilizing the common characteristics of network behaviors under different platforms, the conversion between network filter configuration rules under different platforms is realized, which not only improves the applicability of network filter rule conversion, but also the general network rule tree can be used to quickly debug and analyze network faults, and also improves the work efficiency of maintenance personnel.

[0072] Step 103: Obtain second general configuration information consisting of general rules corresponding to nodes in the general network rule tree by traversing and searching the general network rule tree.

[0073] In the embodiment of the present application, the second general configuration information is the rule configuration information of the target platform using the filter operation, wherein the target platform is usually different from the source platform.

[0074] Furthermore, the content of the second general configuration information is also different from that of the source network filter information. The second general configuration information contains at least one general rule. General rules have one or more of the following attributes: position, priority, and general rule set. Among them, the position (i.e., the matching position) is determined by the layer and sublayer where the general rule is located on the general network rule tree, which can represent the network layer where the general rule is executed. The priority adopts a relative priority, and each sublayer has an independent relative priority, the highest of which is 0, which can represent the order in which the general rules are executed in the second general configuration information of the network layer. The general rule set includes at least one general rule, which can represent the general rules that need to be executed in the general rule set.

[0075] For example, see Figure 5 , starting from the root node, traverse the nodes in the classification corresponding to the network layer, first traverse to node 1, node 1 is not connected to other nodes, then a second general configuration information consisting of general rule 1 corresponding to node 1 can be generated; then traverse from node 1 to node 9, node 9 is connected to node 5, then execute the jump operation, continue to traverse node 5, node 5 is connected to node 6, then execute the jump operation, traverse node 6, node 6 is not connected to any node, then a second general configuration information consisting of general rule 1 corresponding to node 9, general rule 5 corresponding to node 5, and general rule 6 corresponding to node 6 can be generated; then traverse from node 9 to node 3, node 3 is connected to node 4, then execute the jump operation, continue to traverse node 4, node 4 is connected to node 7, then execute the jump operation, traverse node 7, node 7 is not connected to any node, then a second general configuration information consisting of general rule 3 corresponding to node 3, general rule 4 corresponding to node 4, and general rule 7 corresponding to node 7 can be generated.

[0076] like Figure 5As shown, the second general configuration information includes three attributes: position, priority, and general rule set. Among them, the priority indicates the priority of the second general configuration information in all the second general configuration information in the classification corresponding to the layer to which it belongs, and the general rule set includes the general rules contained in the second general configuration information. The value of "position" is network layer-IPV4, the value of "priority" is 2, and the elements in the "general rule set" are general rule 3 corresponding to node 3, general rule 4 corresponding to node 4, and general rule 7 corresponding to node 7; the priority is 2, which means that the second general configuration information is executed in the classification corresponding to the layer in the order of 3. Continue to traverse the nodes in the classification corresponding to the transport layer until traversing to node 2, and node 2 is not connected to other nodes, then a second general configuration information composed of general rule 2 corresponding to node 2 can be generated, and the traversal ends. Among them, the second general configuration information includes three attributes: position, priority, and general rule set. The position is transport layer-TCP, which indicates that the priority is 1, which indicates that the second general configuration information is executed in the classification corresponding to the layer in the order of 2. The element in the general rule set is general rule 2 corresponding to node 2, indicating that the second general configuration information only includes general rule 2. It should be noted that the execution order of the second general configuration information with a priority of 0 is 1, that is, it is executed first.

[0077] Step 104: Convert the second general configuration information into target network filter information that matches the filter rule of the target platform.

[0078] In an embodiment of the present application, the second general configuration information includes a general rule corresponding to at least one node. After obtaining the second general configuration information by traversing and searching the general network rule tree, the second general configuration information is converted into target network filter information that matches the target platform according to the filter rules defined by the target platform, and can be adapted to the target platform.

[0079] In an embodiment of the present application, the second general configuration information is converted into target network filter information that matches the filter rules of the target platform. Specifically, based on the execution order of the general rules in the second general configuration information, it is converted into target network filter information that matches the filter rules of the target platform through a general conversion module library, and the conversion is performed according to the execution order and rules of the target platform to make it adaptable to the target platform.

[0080] See also Figure 6The second general configuration information includes general rule 1, general rule 2, and general rule 3, wherein the "condition type" value of general rule 1 is "target IP address", the "condition data" value is "10.16.10.192", the "operation" value is "equal to", and the "action" value is "jump rule 2"; the "condition type" value of general rule 2 is "transport layer protocol number", the "condition data" value is "UDP", the "operation" value is "equal to", and the "action" value is "jump rule 3"; the "condition type" value of general rule 3 is "connection status", the "condition data" value is "NEW", the "operation" value is "equal to", and the "action" value is "discard".

[0081] The second general configuration information is used as the input of the iptables conversion library. Based on the execution order defined by the iptables conversion library, for example, the general rules related to the protocol number are executed first, then the general rules related to the IP address, and then other general rules are executed. It can be obtained that general rule 2 is executed first, then general rule 1, and finally general rule 3 is executed, and the general rules are converted into target network filter rules adapted to the Linux platform. General rule 2 corresponds to 2-pudp, where 2 represents general rule 2, -p represents the protocol type, and udp represents the specific matching protocol; general rule 1 corresponds to 1-d 10.16.10.192, where 1 represents general rule 1, -d represents the IP address, and 10.16.10.192 represents the specific matching IP address; general rule 3 corresponds to 3-m conntrack-ctstate, where 3 represents general rule 3, -m represents the matching connection state, and conntrack-ctstateNEW represents the specific matching connection state. -jDROP indicates that the action of general rule 3 is to drop. Finally, the target network filter information is obtained. That is, rule 2: -p udp, rule 1: -d 10.16.10.192, rule 3: -m conntrack-ctstateNEW, and the action of rule 3 is -j DROP.

[0082] In summary, the embodiment of the present application first splits and combines the source network filter information in a preset manner to obtain the first general configuration information containing at least one general rule for characterizing network behavior, and then generates a general network rule tree based on the first general configuration information and the general rule, and finally obtains the second general configuration information by traversing and searching the general network rule tree, and converts the second general configuration information into target network filter information that matches the filter rules of the target platform. The embodiment of the present application extracts the common characteristics of network behavior under different platforms, so that when converting rules between different platforms, the source network filter information is converted into general rules, and then the general rules are converted into target network filter information that matches the filter rules of the target platform, so as to realize the conversion between network filter configuration rules under different platforms, which not only improves the applicability of rule conversion, but also reduces the complexity of rule conversion and improves the efficiency of rule conversion.

[0083] refer to Figure 7 , which shows a flowchart of the steps of another data processing method provided by an embodiment of the present application, including:

[0084] Step 201 : split and combine the acquired source network filter information of the source platform to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior.

[0085] This step may specifically refer to the above step 101, which will not be described in detail here.

[0086] In the embodiment of the present application, the source network filter information may also be referred to as an original rule, and may be converted into one or more general rules.

[0087] Optionally, step 201 may specifically include:

[0088] Sub-step 2011, performing text semantic analysis on the source network filter information in the execution order to obtain one or more attribute information.

[0089] In an embodiment of the present application, the execution order is related to the source platform, and can be the order in which the source network filter information defined by the source platform is executed. For example, the source network filter information is "discard data packets that use the TCP protocol to access the address 172.16.33.199:80". By performing text semantic parsing in the order of network protocol, access address, port number, and action, four attribute information can be obtained, "use TCP protocol", "access address 172.16.33.199", "port number 80", and "discard". According to the execution order, the source network filter information is parsed to obtain one or more attribute information, so that a general rule can be generated based on this one or more attribute information. The way in which the embodiment of the present application generates general rules is not limited to this.

[0090] Sub-step 2012, according to the preset attributes in the general rule, fill each of the attribute information in the preset attributes of the general rule to obtain the general rule; the preset attributes of the general rule include: one or more of rule type, condition type, condition data, operation, and action.

[0091] In the embodiment of the present application, the preset attributes of the general rule may include: one or more of rule type, condition type, condition data, operation, and action. The description of condition type, condition data, operation, and action can refer to the above step 102, which will not be repeated here.

[0092] Further, the rule type includes a starting rule and an intermediate rule. Among them, the starting rule is defined according to the location of the matching point in the original rule in the network protocol stack of the platform and the specific content of the rule. The starting rule can be the lowest rule in the data flow direction of the network layer where the condition type is located in the general set of the same original rule, and the absolute priority of the original rule is recorded. The intermediate rule can be a rule outside the original rule in the general rule set belonging to the same original rule, which is an extension of the starting action and is related to each other through the jump action. For example, the original rule is "If a data packet IPV4 address is equal to 10.10.88.100, then discard the packet", and the text semantics of the rule is parsed to obtain two attribute information, namely "IPV4 address is equal to 10.10.88.100" and "discard". The general rule has preset attributes, namely, four attributes of condition type, condition data, operation and action. After obtaining the attribute information through text semantics parsing, the content of the attribute information replaces the attribute content corresponding to the general rule. The obtained general rule has the condition type of IPV4 address, the condition data of 10.10.88.100, the operation of equals, and the action of discard. Since there is only one general rule, this general rule is the starting rule.

[0093] For another example, the original rule is "discard the data packets that use the TCP protocol to access the address 172.16.33.199:80". After the text semantic analysis of the rule, four attribute information is obtained, namely "use TCP protocol", "access address 172.16.33.199", "port number 80" and "discard". The general rule has preset attributes, namely, the condition type, condition data, operation and action. After the attribute information is obtained through text semantic analysis, the content of the attribute information is replaced with the attribute content corresponding to the general rule to obtain three general rules. Among them, the general rule 1 has the condition type of L4 protocol number, the condition data is 06, the operation is equal to, and the action is jump; the general rule 2 has the condition type of IPV4 target address, the condition data is 172.16.33.199, the operation is equal to, and the action is jump; the general rule 3 has the condition type of target port number, the condition data is 80, the operation is equal to, and the action is discard. Among the three general rules, based on the priority of the general rules defined by the source platform, it is determined that the priority of general rule 1 is higher than the priority of general rule 2, and the priority of general rule 2 is higher than the priority of general rule 3. The higher the priority of a general rule, the earlier the general rule is executed. Based on this, the execution order among the three general rules in the first general configuration information can be determined, that is, general rule 1 is executed first, then general rule 2, and finally general rule 3.

[0094] The start rule is the first general rule executed among the three general rules, and the remaining general rules are intermediate rules. That is, general rule 1 is the start rule, and general rule 2 and general rule 3 are intermediate rules. That is, the general rule with condition type L4 protocol number, condition data 06, operation equal to, and action jump is the start rule. In contrast, the general rule with condition type IPV4 target address, condition data 172.16.33.199, operation equal to, and action jump, and the general rule with condition type target port number, condition data 80, operation equal to, and action discard are all intermediate rules.

[0095] Sub-step 2013: numbering each of the general rules according to the execution order, and connecting the obtained general rules according to the numbers to form the first general configuration information.

[0096] For example, see Figure 2, the original rule is "discard the data packets that use TCP protocol to access address 172.16.33.199:80". The text semantic analysis of the rule obtains four attribute information, namely: "use TCP protocol", "access address 172.16.33.199", "port number 80" and "discard". The general rule has preset attributes, namely, condition type, condition data, operation and action. After obtaining the attribute information through text semantic analysis, the content of the attribute information replaces the attribute content corresponding to the general rule. That is, the general rule with "condition type" as "L4 protocol number", "condition data" as "06", "operation" as "equal" and "action" as "jump" is obtained, the general rule with "condition type" as "IPV4 target address", "condition data" as "172.16.33.199", "operation" as "equal" and "action" as "jump" is obtained, and the general rule with "condition type" as "target port number", "condition data" as "80", "operation" as "equal" and "action" as "discard" is obtained. Finally, according to the execution order of the general rules, that is, the order of "using TCP protocol", "access address 172.16.33.199", "port number 80" and "discard", each general rule is numbered, that is, the general rule with condition type of L4 protocol number, condition data of 06, operation equal to, action of jumping general rule 2 is general rule 1, the condition type is IPV4 target address, condition data is 172.16.33.199, operation equal to, action of jumping general rule 3 is general rule 2, the condition type is target port number, condition data is 80, operation equal to, action of discarding is general rule 3. Finally, the numbered general rules are connected according to the execution order of the general rules to obtain the first general configuration information. The first general configuration information includes: general rule 1, general rule 2 and general rule 3, wherein the condition type of general rule 1 is L4 protocol number, the condition data is 06, the operation is equal, and the action is jump, the condition type of general rule 2 is IPV4 target address, the condition data is 172.16.33.199, the operation is equal, and the action is jump, and the condition type of general rule 3 is target port number, the condition data is 80, the operation is equal, and the action is discard. It should be noted that when numbering general rules, duplicate numbers cannot appear.

[0097] The embodiment of the present application splits and combines the source network filter information in a preset manner to obtain general configuration information containing at least one general rule. For different network filter platforms, the conversion between the network filter and the general rule can be realized, so that the rule conversion between any platforms can be realized based on the general rule, which greatly improves the applicability of the network filter rule conversion and also improves the work efficiency of the maintenance personnel.

[0098] Step 202: Generate a general network rule tree according to the first general configuration information and the general rules, wherein the general network rule tree is used to represent the topological relationship between the first general configuration information and the topological relationship between the general rules.

[0099] This step may be specifically referred to as the above step 102, which will not be described in detail here.

[0100] Optionally, step 202 may specifically include:

[0101] Sub-step 2021, classifying the general rules into categories corresponding to the network model layer to which the general rules belong.

[0102] See also Figure 4 , Figure 4 There are nodes 1, 3, and 8, which correspond to different general rules. Among them, nodes 1 and 3 belong to the classification corresponding to the network layer in the network model layer, and node 8 belongs to the classification corresponding to the transmission layer in the network model layer, and node 8 is classified into the classification corresponding to the transmission layer in the network model layer.

[0103] Before step 221, the network model hierarchy contained in all the collected general rules may be traversed to initialize the general network rule tree so that the general network rule tree does not contain general rules before the general rules are divided.

[0104] Sub-step 2022, taking the general rules in the classification as nodes in the general network rule tree, and for each of the classifications, sorting and connecting the nodes in the classifications according to the first priority of the general rules in the classifications and the second priority of the first general configuration information to which the general rules in the classifications belong, to obtain a first topological structure corresponding to each of the classifications.

[0105] See also Figure 4 The first priority refers to the priority between the general rules in the first general configuration information, and the second priority refers to the priority between the first general configuration information. The first priority and the second priority are determined based on the priority of the configuration rules executed by the source network platform.

[0106] Based on the first priority, it can be determined that the priority of general rule 9 is higher than that of general rule 5, and the priority of general rule 5 is higher than that of general rule 6. Since the higher the priority, the earlier the general rule is executed, general rule 9 is executed first, then general rule 5, and finally general rule 6. General rule 9 corresponds to node 9, general rule 5 corresponds to node 5, and general rule 6 corresponds to node 6. Therefore, node 9 is executed first, then node 5, and finally node 6. Node 9, node 5, and node 6 are connected according to the execution order of the nodes.

[0107] Based on the second priority, the priority between the first general configuration information can be determined, that is, the priority of the general rules that are first executed by different first general configuration information. Based on the second priority, it can be determined that the priority of general rule 9 is higher than that of general rule 3. Since the higher the priority, the earlier the general rule is executed, general rule 9 is executed first, and then general rule 3. General rule 9 corresponds to node 9, and general rule 3 corresponds to node 3. Therefore, node 9 is executed first and then node 3. Node 9 and node 3 are connected according to the execution order of the nodes. After all the nodes are connected, the first topological structure corresponding to each classification is obtained.

[0108] In the embodiment of the present application, the general rules correspond to the nodes in the general network rule tree, and the correspondence is one-to-one. For each of the categories (layers), the nodes in the categories are sorted and connected according to the first priority of the general rules in the categories and the second priority of the first general configuration information to which the general rules in the categories belong, so as to obtain a first topological structure corresponding to each of the categories, so that the general rules can be formed into a unified tree structure according to the execution order, that is, the general network rule tree.

[0109] Optionally, the method further includes:

[0110] Step A1: classify the general rules into subcategories corresponding to the general rules.

[0111] See also Figure 4 , Figure 4 There are nodes 1, 5, and 8, which correspond to different general rules. Among them, nodes 1 and 5 belong to the sub-classification corresponding to the IPV4 sub-layer in the network layer of the network model layer, and node 8 belongs to the sub-classification corresponding to the TCP sub-layer in the transport layer of the network model layer.

[0112] Step A2: For each of the sub-categories, the nodes in the sub-categories are sorted and connected according to the first priority of the general rules in the sub-categories and the second priority of the first general configuration information to which the general rules in the category belong, so as to obtain a second topological structure corresponding to each of the sub-categories.

[0113] In order to perform a finer-grained division, the general rules are divided into subcategories corresponding to the general rules. For each subcategories, the nodes in the subcategories are sorted and connected according to the first priority of the general rules in the subcategories and the second priority of the general configuration information to which the general rules in the categories belong, to obtain the second topological structure corresponding to each subcategories. The second topological structures corresponding to each subcategories are combined to obtain the first topological structure. For example, see Figure 4 , in the subclassification corresponding to the sublayer IPV4, according to the first priority of the general rule, the priority of the node corresponding to the general rule can be determined. The priority of node 3 is higher than the priority of node 4, and the priority of node 4 is higher than the priority of node 7. The higher the priority, the earlier the node is executed. The execution order of nodes 3, 4 and 7 can be determined, that is, node 3 is executed first, then node 4, and finally node 7, so that nodes 3, 4 and 7 are connected based on the execution order. According to the second priority of the first general configuration information to which the general rule belongs, the priority of the node corresponding to the general rule executed first in the first general configuration information can be determined, and the priority of node 1 is higher than the priority of node 9, and the priority of node 9 is higher than the priority of node 3. The higher the priority, the earlier the node is executed. It can be determined that node 1 is executed first, then node 9, and finally node 3, so that nodes 1, node 9 and node 3 are connected based on the execution order to obtain the second topological structure of the sublayer IPV4.

[0114] Step A3: Combine the second topological structures corresponding to each of the sub-categories to obtain the first topological structure.

[0115] After the sub-classification second topology structures respectively corresponding to the sub-layer IPv4 and the sub-layer TCP are obtained, the sub-classification second topology structures respectively corresponding to the sub-layer IPv4 and the sub-layer TCP are combined to obtain the first topology structure.

[0116] Sub-step 2023, according to the structure of the network model layer, the first topological structure is sorted and connected to obtain the universal network rule tree.

[0117] For example, see Figure 4, the network model layer includes the network layer and the transport layer, and the node 3 in the classification corresponding to the network layer is connected with the node 8 in the classification corresponding to the transport layer to obtain a general network rule tree. It should be noted that this embodiment is only described by taking the network model layer including the network layer and the transport layer as an example, and the network model layer may also include other layers.

[0118] In summary, for sub-steps 2031 to 2033, see Figure 4 , node 1, node 9, node 5, node 3, node 4, and node 7 are classified into the classification corresponding to the network layer, among which node 1, node 9, and node 3 are classified into the subclassification corresponding to the IPV4 sublayer and belong to the set of rule chains, and node 4, node 5, and node 7 are classified into the subclassification corresponding to the IPV4 sublayer and belong to the set of intermediate rule bases. Node 8, node 2, node 10, and node 6 are classified into the subclassification corresponding to the TCP sublayer and belong to the set of rule chains, and node 10 and node 6 are classified into the subclassification corresponding to the TCP sublayer and belong to the set of intermediate rule bases. According to the priority of the general rule corresponding to the node, the priority of the node is generated, that is, the priority of node 9 is higher than that of node 5, and the priority of node 5 is higher than that of node 6. According to the priority of the general configuration information to which the general rule corresponding to the node belongs, the priority of the node in the rule chain is generated, that is, the priority of node 1 is higher than that of node 9. And the topological structure of the network layer is connected to generate a general network rule tree.

[0119] In the embodiment of the present application, based on the first general configuration information and the general rules, a general network rule tree is generated that can characterize the topological relationship between the first general configuration information, that is, the topological relationship between the general rules. By utilizing the common characteristics of network behavior under different platforms, the conversion between network filter configuration rules under different operating systems is realized, which not only improves the applicability of network filter rule conversion, but also the general network rule tree can be used to quickly debug and analyze network faults, and also improves the work efficiency of maintenance personnel.

[0120] Optionally, after sub-step 2023, the following steps may also be included:

[0121] Step B1, traversing from the leaf nodes of the general network rule tree.

[0122] For example, see Figure 4, start traversing from the leaf node 6, node 2, node 10, etc. of the general network rule tree. It should be noted that the purpose of the traversal here is to optimize the general network rule tree. If there are two branches in the general network rule tree, one of which includes node 1 and the other includes node 1 and node 3, then there are two identical nodes. If you start traversing from the root node, when you traverse to node 1, if you find a duplicate node 1, you will merge the two duplicate nodes 1 into one node, that is, delete one of the nodes 1. At this time, it is wrong, so you need to start traversing from the leaf node.

[0123] Step B2: If there are multiple repeated nodes in the traversal to the general network rule tree, the multiple repeated nodes are merged into one node.

[0124] Further, for steps B1 to B3, see Figure 5 , Figure 5 Each layer in includes a rule chain and an intermediate rule base, wherein the nodes in the rule chain include the first executed node in each branch of the general network rule tree, the first executed node is the starting node, and the nodes in the intermediate rule base are the remaining nodes in each branch of the general network rule tree except the starting node, and the remaining nodes except the starting node are intermediate nodes. For example, node 1, node 9, node 3, node 8 and node 2 are all starting nodes and belong to the nodes on the rule chain. Node 5, node 6, node 4, node 7 and node 10 are all intermediate nodes and belong to the intermediate rule base.

[0125] Figure 5 There are 5 branches, including the branch where node 1 is located, the branch where nodes 9, 5 and 6 are located, the branch where nodes 3, 4 and 7 are located, the branch where nodes 8 and 10 are located, and the branch where node 2 is located.

[0126] Traverse from all leaf nodes in the general network rule tree, that is, traverse from node 2, node 10, node 7, node 6, and node 1. On the branch corresponding to each node, if there are repeated intermediate nodes, merge the repeated multiple intermediate nodes into one intermediate node, which can be to retain only one intermediate node among multiple intermediate nodes, connect the previous intermediate node to which other intermediate nodes belong to the retained intermediate node, and delete other intermediate nodes. The repeated multiple intermediate nodes can be nodes with the same condition type, condition data, operation, and action. After traversing the intermediate nodes on each branch, traverse the starting nodes on different branches, that is, traverse node 1, node 9, node 3, node 8, and node 2. If there are repeated starting nodes, merge the repeated multiple starting nodes into one starting node, which can be to retain only one starting node among multiple starting nodes and delete other starting nodes. The repeated multiple starting nodes can be nodes with the same priority, condition type, condition data, operation, and action. If two nodes, one node belongs to the intermediate node and the other node belongs to the starting node, then the two nodes are not repeated nodes. Judging whether there are multiple repeated nodes can also be understood as judging redundant rules.

[0127] It should be noted that Figure 5 The displayed universal network rule tree does not have any repeated nodes, so the universal network rule tree may also be an optimized universal network rule tree.

[0128] In the embodiment of the present application, by traversing the nodes of the general network rule tree and merging multiple repeated nodes into one node, the structure of the general network rule tree can be simplified and the efficiency of network filter rule conversion can be improved.

[0129] Step 203: Obtain second general configuration information consisting of general rules corresponding to nodes in the general network rule tree by traversing and searching the general network rule tree.

[0130] This step may be specifically referred to as the above step 103, which will not be described in detail here.

[0131] Optionally, step 203 may specifically include:

[0132] Step 2031, traverse the nodes in the general network rule tree starting from the root node.

[0133] For example, see Figure 5 , start traversing from the root node of the general network rule tree and first traverse node 1.

[0134] Step 2032: Determine whether to continue traversing the next node or extract the target node based on the connection information of the currently traversed target node. If the target node is extracted, the general rule corresponding to the target node is recorded as the second general configuration information.

[0135] For example, see Figure 5 , traverse the nodes in the general network rule tree from the root node. If traversing to node 3, since node 3 is connected to other nodes, it is necessary to continue traversing the next node of node 3, that is, node 4. If traversing to node 2, since node 2 has no connection information, it is necessary to extract node 2 and record the general rule 2 corresponding to node 2 in the second general configuration information 1 to generate a second general configuration information.

[0136] Optionally, step 2032 may specifically include sub-steps 20321-20324:

[0137] Sub-step 20321: If the target node is the starting node and the target node is connected to an intermediate node, after performing a matching operation on the target node, traverse the intermediate nodes connected to the target node to obtain the intermediate nodes connected to the starting node.

[0138] In the examples of this application, see Figure 5 The starting node is the first node executed in each branch of the general network rule tree, and the intermediate nodes are the remaining nodes in each branch of the general network rule tree except the starting node. For example, node 1, node 9, node 3, node 8 and node 2 are all starting nodes. Node 5, node 6, node 4, node 7 and node 10 are all intermediate nodes.

[0139] For example, see Figure 5 If the currently traversed node is node 9, since node 9 is the node corresponding to the first general rule executed in the first general configuration information, node 9 is the starting node. Since node 9 is connected to the intermediate node 5, it is necessary to execute the operation of node 9 and continue to traverse node 5.

[0140] If the condition type of the target node and the condition data of the target node meet the operation condition of the target node, it is determined that the matching operation is completed, and the intermediate nodes connected to the target node are traversed.

[0141] In the embodiment of the present application, each node corresponds to a general rule, so the node also includes attribute information of the general rule. For example, node 9 includes one or more of the attribute information corresponding to the condition type, condition data, operation, and action attribute.

[0142] Sub-step 20322: If the target node is an intermediate node, and the target node is connected to another intermediate node, then after matching the target node, traverse to the other intermediate node connected to the target node to obtain the other intermediate node connected to the intermediate node.

[0143] For example, see Figure 5 , if the currently traversed node is node 5, and node 5 is an intermediate node, since node 5 is connected to intermediate node 6, the matching operation of node 5 is executed. After the matching operation of node 5 is executed, node 6 is continued to be traversed.

[0144] Sub-step 20323: If the target node is the intermediate node and the intermediate node is not connected to other nodes, the traversal result from the last traversal from the starting node to the target node is extracted and recorded as the second general configuration information corresponding to the intermediate node to obtain the second general configuration information.

[0145] For example, see Figure 5 , if the currently traversed node is node 6, and node 6 is an intermediate node, since node 6 is not connected to any intermediate node, node 9, node 5 and node 6 are extracted, and the general rule corresponding to each node is recorded as a second general configuration information.

[0146] Sub-step 20324: If the node is a starting node and the starting node is not connected to the intermediate node, extract the node and record it as the second general configuration information corresponding to the starting node to obtain the second general configuration information.

[0147] For example, see Figure 5 If the currently traversed node is node 1, and node 1 is the starting node, since node 1 is not connected to any intermediate node, node 1 is extracted, and general rule 1 corresponding to node 1 is recorded as a second general configuration information.

[0148] Sub-step 2033: After traversing all nodes, output all the recorded second general configuration information.

[0149] For example, see Figure 5 , starting from the root node, traverse the nodes in the general network rule tree until node 2 is traversed, and then all the recorded second general configuration information is output. Figure 5 Only two second general configuration information are shown, it should be understood that Figure 5The general network rule tree shown obtains more than two second general configuration information. Among them, the second general configuration information 1 and the second general configuration information 2 both include three attributes, position, priority, and general rule set. Among them, the position indicates the location where the second general configuration information is executed, the priority indicates the order in which the second general configuration information is executed in the layer to which it belongs, and the general rule set includes the general rules corresponding to the nodes contained in the second general configuration information. For example, the position of the second general configuration information 1 is the transport layer-TCP, the priority is 1, and the general rule set is 2, which means "after the TCP sublayer in the transport layer executes the second general configuration information with a priority of 0, the second general configuration information 1 starts to be executed, and the general rule to be executed is the general rule 2 corresponding to node 2". The position of the second general configuration information 2 is the network layer-IPV4, the priority is 2, and the general rule set is 3, 4, 7, which means "after the IPV4 sublayer in the network layer executes the second general configuration information with a priority of 0 and a priority of 1, the second general configuration information 2 starts to be executed, and the general rules to be executed are the general rule 3 corresponding to node 3, the general rule 4 corresponding to node 4, and the general rule 7 corresponding to node 7".

[0150] Step 204, traverse the second general configuration information, and determine the action type corresponding to the general rule contained in the second general configuration information; the second general configuration information includes at least one general rule.

[0151] In the embodiment of the present application, the action type of the general rule includes jump and non-jump. Among them, jump can be that after the current general rule is executed, other general rules need to be executed, and non-jump can be that after the current general rule is executed, the second general configuration information to which the general rule belongs is executed. The second general configuration information is traversed, and the action type of the general rule in the second general configuration information is determined, that is, "jump" or "non-jump", and based on this, the target network filter information is determined.

[0152] Step 205: If the action type is jump, a jump operation is performed, and after the jump action is performed, an association relationship between the general rule and the jump to the next general rule is established.

[0153] In an embodiment of the present application, the association relationship may be a logical relationship, and the logical relationship may be an "and" relationship. "And" means that after the execution of general rule 1 is completed, no matter what the execution result is, it will jump to the general rule connected to general rule 1. If the action type of the traversed general rule is "jump", the jump operation is executed, and the jump action is converted to an "and" relationship. It should be noted that the "and" relationship is only a defined relationship, representing the execution order of the general rules. In other words, the general rules can be connected with "&", which represents the execution order of the general rules.

[0154] For example, see Figure 6 The second general configuration information includes general rule 1, general rule 2, and general rule 3, wherein the condition type of general rule 1 is the target IP address, the condition data is 10.16.10.192, the operation type is equal, and the action type is jump rule 2; the condition type of general rule 2 is the transport layer protocol number, the condition data is the user datagram protocol (UDP), the operation type is equal, and the action type is jump rule 3; the condition type of general rule 3 is the connection state, the condition data is NEW, the operation type is equal, and the action type is discard. When traversing to general rule 1, since the action type of general rule 1 is jump, the jump operation is executed to jump to general rule 2, and general rule 1 and general rule 2 are connected with the logical relationship of "and". After jumping to general rule 2, since the action type of general rule 2 is jump, the jump operation is executed to jump to general rule 3, and rule 2 and general rule 3 are connected with the logical relationship of "&", and the action type of general rule 3 is continued to be determined.

[0155] Step 207: If the action type is non-jump, then according to the conversion rule preset for the target platform, multiple general rules having the association relationship are generated as target network filter information.

[0156] For example, see Figure 6 After general rule 2 and general rule 3 are connected with the logical relationship of "and", since the action type of general rule 3 is non-jump, multiple general rules with the logical relationship of "and" are generated, namely general rule 1&general rule 2&general rule 3, that is, general rule 1, general rule 2, and general rule 3 are connected with "&".

[0157] In the embodiment of the present application, the conversion rule is related to the platform, and different platforms have different preset conversion rules. For example, if the target platform is a Linux platform and the filtering subsystem used is an iptables conversion library, the preset conversion rules of the platform may be general rule 2, general rule 1, and general rule 3. The target network filter information is generated according to general rule 2, general rule 1, and general rule 3.

[0158] In summary, the embodiment of the present application first splits and combines the source network filter information in a preset manner to obtain the first general configuration information containing at least one general rule for characterizing network behavior, and then generates a general network rule tree based on the first general configuration information and the general rule, and finally obtains the second general configuration information by traversing and searching the general network rule tree, and converts the second general configuration information into target network filter information that matches the filter rules of the target platform. The embodiment of the present application extracts the common characteristics of network behavior under different platforms, so that when converting rules between different platforms, the source network filter information is converted into general rules, and then the general rules are converted into target network filter information that matches the filter rules of the target platform, so as to realize the conversion between network filter configuration rules under different platforms, which not only improves the applicability of rule conversion, but also reduces the complexity of rule conversion and improves the efficiency of rule conversion.

[0159] Figure 8-Figure 11 It is a system workflow diagram provided by the embodiment of the present application and a workflow diagram of each module in the system. Figure 8 , Figure 8 This is the system workflow diagram provided by the embodiment of the present application. The overall workflow of the system is as follows: the source network filter configuration rule is used as the input of the front-end conversion module, and the first general configuration information is generated by the front-end conversion module, and then the first general configuration information is input into the general network rule module, and the general network rule module generates a general network rule tree by arranging the logical relationship, and finally the general network rule tree is used as the input of the back-end conversion module, and the general network rule tree is converted into the target network filter rule by the back-end conversion module. This system can be used for different network filter platforms, and only needs to implement the conversion method between the filter and the first general configuration information, and the general network rule tree can be used to realize the conversion of any rule configuration between any platforms, which greatly improves the work efficiency of maintenance personnel. At the same time, the general network rule tree can be used to quickly debug and analyze network failures, providing great convenience.

[0160] Fig. 9 is a flowchart of the front-end conversion module provided in the embodiment of the present application. Fig. 9 The main function of the front-end conversion module is to provide a method for converting a specific filter rule into the first general configuration information. The source network filter configuration rule is used as input and converted into the first general configuration information through the general conversion module library. Among them, the general conversion module library includes several specific network filters, and the network filter is related to the platform. For example, when the platform is a Windows platform, the network filter conversion module is a WFP conversion library, and when the platform is a Linux platform, the network filter conversion module is an iptables conversion library.

[0161] The workflow of the front-end conversion module is as follows:

[0162] 1. After the input module receives the input source network filter configuration rule, it searches for a specific network filter in the universal conversion module library, and converts the source network filter configuration rule into a first universal configuration information including at least one universal rule through the specific network filter. Among them, the universal conversion module library includes a network filter 0 conversion module, a network filter 1 conversion module, and a network filter 2 conversion module. It should be noted that the universal conversion module library can include more network filter conversion modules. The following description takes the specific network filter as the network filter 1 conversion module as an example.

[0163] 2. The network filter 1 conversion module traverses all source network filter configuration rules and converts them into the first general configuration information. Specifically, first, the network filter 1 conversion module traverses the source network filter configuration rules and collects all source rules. Then, all source rules are traversed and each source rule is converted into several general rules. Among them, each general rule must contain only one condition type and condition data, and all general rules are numbered uniformly without duplicate numbers. Finally, each general rule is split into a starting rule and an intermediate rule. Among them, each general rule must have one rule that belongs to the starting rule, and the priority in the source rule is recorded in the starting rule. After all the source rules are converted into general rules, the matching point information of the original rule is not reflected in the general rule set.

[0164] 3. Input all the collected general rules into the front-end analysis module to obtain the initial rule set and the intermediate rule set. Specifically, all the general rules are divided into rule sets according to the OSI network layer in which they are located, and all the rule sets of each layer are sorted into the initial rule set and the intermediate rule set.

[0165] Fig.10 is a workflow diagram of the general network rule module provided in the embodiment of the present application. Fig.10 The general network rule module is used to convert the first general configuration information generated by the front-end conversion module into a general network rule tree.

[0166] The workflow of the general network rule module is as follows:

[0167] 1. Traverse the network model hierarchy contained in the first general configuration information generated by the front-end conversion module and initialize the general network rule tree.

[0168] 2. Fill in the general network rule tree. First, according to the hierarchical structure input by the front-end conversion module, traverse each level one by one from the root node. Secondly, organize all the general rules in each layer according to the specific protocol type to which they belong to form several sub-layers, and traverse all sub-layers to generate a rule chain for the general rules in the sub-layers. Finally, traverse all the general rules in the rule chain and rearrange the positions of the general rules in the rule chain according to priority. The general rule with the highest priority is at the head of the rule chain, that is, the starting position. The priority of the rule at the final starting position is the priority of the rule chain.

[0169] 3. Traverse the rule chains and intermediate rule bases of the general network rule tree and remove redundant rules. First, start from the highest layer relative to the root node and traverse all the intermediate rules in each layer, collect all the redundant rules, keep only one redundant rule, and point all the jump targets of the superior rules to which other redundant rules belong to the retained rule, and delete other redundant rules. Then, traverse all the rule chains in the layer, collect all the redundant rules, keep only one, and delete the other redundant rules.

[0170] Fig.11 is a flowchart of the back-end conversion module provided in the embodiment of the present application. Fig.11 , the back-end conversion module is used to convert the general network rule tree into the target network filter rule. The general network rule tree is used as input and converted into the target network filter rule through the general conversion module library. Among them, the general conversion module library includes several specific network filters, and the network filter is related to the platform. For example, when the platform is a Windows platform, the network filter conversion module is a WFP conversion library, and when the platform is a Linux platform, the network filter conversion module is an iptables conversion library.

[0171] The workflow of the backend conversion module is as follows:

[0172] 1. Traverse the general network rule tree generated by the general network rule module and generate the second general configuration information. Assume that the default state of the general network rule tree is passed, that is, if all general rules are not hit, it will be released. Enter the general network rule tree from the root node, traverse all layers and sub-layers in order, and traverse all rule chains in the sub-layers in order from high to low priority. Traverse each rule in the rule chain, and assume that its conditions are matched successfully and execute the action. If the action is a jump, continue to assume that the jump target rule is matched successfully, and execute the action of the jump target rule. If the action is a non-jump, collect all the rules that have been matched during the period and record them as a second general configuration information. The position of the starting rule in the rule chain is the relative priority. Continue to traverse the next rule on the rule chain until all the rules in the rule chain have been traversed.

[0173] 2. Input all the second general configuration information into the network filter conversion module to convert it into the target network filter rules and generate the configuration file of the target filter. Traverse all the general rules in the second general configuration information, and the network filter conversion module corresponding to the target platform converts the general rules into the target network filter rules based on the execution order defined by the target platform. If the target platform is a Linux platform, the network filter conversion module can be an iptables conversion library, which converts the general rules into the target network filter rules based on the execution order defined by the Linux platform. For example, see Figure 6 , based on the execution order defined by the iptables conversion library, for example, first execute the general rules related to the protocol number, then execute the general rules related to the IP address, and then execute other general rules. It can be obtained that general rule 2 is executed first, then general rule 1, and finally general rule 3 is executed, and the general rules are converted into target network filter rules adapted to the Linux platform. That is, rule 2: -p udp, rule 1: -d 10.16.10.192, rule 3: -m conntrack–ctstate NEW, and the action of rule 3 is -j DROP. For the actions of the network behavior described in each general rule, all jump actions are converted into the logical relationship 'and' in the target network filter rules, and non-jump rules are converted into specific operations of the target network filter.

[0174] In summary, the embodiment of the present application first splits and combines the source network filter information in a preset manner to obtain the first general configuration information containing at least one general rule for characterizing network behavior, and then generates a general network rule tree based on the first general configuration information and the general rule, and finally obtains the second general configuration information by traversing and searching the general network rule tree, and converts the second general configuration information into target network filter information that matches the filter rules of the target platform. The embodiment of the present application extracts the common characteristics of network behavior under different platforms, so that when converting rules between different platforms, the source network filter information is converted into general rules, and then the general rules are converted into target network filter information that matches the filter rules of the target platform, so as to realize the conversion between network filter configuration rules under different platforms, which not only improves the applicability of rule conversion, but also reduces the complexity of rule conversion and improves the efficiency of rule conversion.

[0175] refer to Fig.12 , which shows a data processing device provided by an embodiment of the present application, the device comprising:

[0176] The processing module 301 is used to split and combine the acquired source network filter information of the source platform to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior;

[0177] A first generating module 302 is used to generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to represent the topological relationship between the first general configuration information and the topological relationship between the general rules;

[0178] A first traversal search module 303, configured to obtain second general configuration information consisting of general rules corresponding to nodes in the general network rule tree by traversing and searching the general network rule tree;

[0179] The second generating module 304 is configured to convert the second general configuration information into target network filter information that matches the filter rule of the target platform.

[0180] Optionally, the processing module includes:

[0181] A splitting submodule is used to perform text semantic analysis on the source network filter information in an execution order to obtain one or more attribute information;

[0182] A filling submodule is used to fill each of the attribute information in the preset attributes of the general rule according to the preset attributes in the general rule to obtain the general rule; the preset attributes of the general rule include: one or more of rule type, condition type, condition data, operation, and action;

[0183] The numbering submodule is used to number each of the general rules according to the execution order, and connect the obtained general rules into the first general configuration information according to the numbers.

[0184] Optionally, the first generating module includes:

[0185] A first division submodule is used to divide the general rules into categories corresponding to the network model layer to which the general rules belong;

[0186] a sorting submodule, configured to respectively use the general rules in the classification as nodes in the general network rule tree, and for each of the classifications, sort and connect the nodes in the classifications according to the first priority corresponding to the general rules in the classification and the second priority corresponding to the first general configuration information to which the general rules in each of the classifications belong, so as to obtain a first topological structure corresponding to each of the classifications;

[0187] The first connection submodule is used to sort and connect the first topological structure according to the structure of the network model layer to obtain the universal network rule tree.

[0188] Optionally, the device further comprises:

[0189] A division module, used for dividing the general rules into subcategories corresponding to the general rules;

[0190] a connection module, configured to, for each of the sub-categories, sort and connect the nodes in the sub-categories according to the first priority corresponding to the general rule in the sub-categories and the second priority corresponding to the first general configuration information to which the general rule in each of the categories belongs, to obtain a second topological structure corresponding to each of the sub-categories;

[0191] A combining module is used to combine the second topological structures corresponding to each of the sub-categories to obtain the first topological structure.

[0192] Optionally, the device further comprises:

[0193] A second traversal search module, used to start traversal from the leaf nodes of the universal network rule tree;

[0194] The merging module is used to merge the repeated multiple nodes into one node if there are repeated multiple nodes in the traversal to the universal network rule tree.

[0195] Optionally, the first traversal search module includes:

[0196] A first traversal search submodule, used for traversing the universal network rule tree starting from a root node;

[0197] a determination submodule, used to determine whether to continue traversing the next node or extract the target node according to the connection information of the target node currently traversed, and if the target node is extracted, the general rule corresponding to the target node is recorded as the second general configuration information;

[0198] The first output submodule is used to output the second general configuration information after traversing all nodes.

[0199] Optionally, the determining submodule includes:

[0200] A first matching operation unit is configured to, if the target node is a starting node and the target node is connected to an intermediate node, traverse the intermediate nodes connected to the target node after performing a matching operation on the target node to obtain the intermediate nodes connected to the starting node;

[0201] A second matching operation unit is used for, if the target node is an intermediate node and the target node is connected to another intermediate node, after performing a matching operation on the target node, traversing the other intermediate node connected to the target node to obtain another intermediate node connected to the intermediate node;

[0202] A first output unit is configured to extract a traversal result from the start node to the target node from the last traversal if the target node is the intermediate node and the intermediate node is not connected to other nodes, and record the traversal result as the second general configuration information corresponding to the intermediate node to obtain the second general configuration information;

[0203] The second output unit is used to extract the starting node and record it as the second general configuration information corresponding to the starting node if the target node is the starting node and the starting node is not connected to the intermediate node, so as to obtain the second general configuration information.

[0204] Optionally, the first matching operation unit includes:

[0205] The judgment execution subunit is used to determine that the matching operation is completed if the condition type of the target node and the condition data of the target node meet the operation condition of the target node, and traverse the intermediate nodes connected to the target node to continue matching the intermediate nodes connected to the target node.

[0206] Optionally, the second generating module includes:

[0207] A second traversal search submodule, used to traverse the second general configuration information and determine the action type of the general rule in the second general configuration information; the second general configuration information includes at least one general rule;

[0208] A first judgment execution submodule is used for executing a jump operation if the action type is a jump, and after executing the jump action, establishing an association relationship between the general rule and the next general rule after the jump;

[0209] The second judgment execution submodule is used for generating target network filter information from a plurality of general rules having the association relationship according to a conversion rule preset for a target platform if the action type is non-jump.

[0210] In summary, the embodiment of the present application first splits and combines the source network filter information in a preset manner to obtain the first general configuration information containing at least one general rule for characterizing network behavior, and then generates a general network rule tree based on the first general configuration information and the general rule, and finally obtains the second general configuration information by traversing and searching the general network rule tree, and converts the second general configuration information into target network filter information that matches the filter rules of the target platform. The embodiment of the present application extracts the common characteristics of network behavior under different platforms, so that when converting rules between different platforms, the source network filter information is converted into general rules, and then the general rules are converted into target network filter information that matches the filter rules of the target platform, so as to realize the conversion between network filter configuration rules under different platforms, which not only improves the applicability of rule conversion, but also reduces the complexity of rule conversion and improves the efficiency of rule conversion.

[0211] Fig.13 1 is a block diagram of an electronic device 1300 provided in an embodiment of the present application. For example, the electronic device 1300 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0212] Reference Fig.13 , the electronic device 1300 may include one or more of the following components: a processing component 1302 , a memory 1304 , a power component 1306 , a multimedia component 1308 , an audio component 1310 , an input / output (I / O) interface 1312 , a sensor component 1314 , and a communication component 1316 .

[0213] The processing component 1302 generally controls the overall operation of the electronic device 1300, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 1302 may include one or more processors 1320 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 1302 may include one or more modules to facilitate the interaction between the processing component 1302 and other components. For example, the processing component 1302 may include a multimedia module to facilitate the interaction between the multimedia component 1308 and the processing component 1302.

[0214] The memory 1304 is used to store various types of data to support the operation of the electronic device 1300. Examples of such data include instructions for any application or method operating on the electronic device 1300, contact data, phone book data, messages, pictures, multimedia, etc. The memory 1304 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0215] The power supply component 1306 provides power to the various components of the electronic device 1300. The power supply component 1306 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 1300.

[0216] The multimedia component 1308 includes a screen that provides an output interface between the electronic device 1300 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 1308 includes a front camera and / or a rear camera. When the electronic device 1300 is in an operating mode, such as a shooting mode or a multimedia mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0217] The audio component 1310 is used to output and / or input audio signals. For example, the audio component 1310 includes a microphone (MIC), and when the electronic device 1300 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is used to receive an external audio signal. The received audio signal can be further stored in the memory 1304 or sent via the communication component 1316. In some embodiments, the audio component 1310 also includes a speaker for outputting audio signals.

[0218] I / O interface 1312 provides an interface between processing component 1302 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0219] The sensor assembly 1314 includes one or more sensors for providing various aspects of status assessment for the electronic device 1300. For example, the sensor assembly 1314 can detect the open / closed state of the electronic device 1300, the relative positioning of components, such as the display and keypad of the electronic device 1300, and the sensor assembly 1314 can also detect the position change of the electronic device 1300 or a component of the electronic device 1300, the presence or absence of user contact with the electronic device 1300, the orientation or acceleration / deceleration of the electronic device 1300, and the temperature change of the electronic device 1300. The sensor assembly 1314 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 1314 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1314 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0220] The communication component 1316 is used to facilitate wired or wireless communication between the electronic device 1300 and other devices. The electronic device 1300 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 1316 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1316 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0221] In an exemplary embodiment, the electronic device 1300 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to implement a task optimization method provided in an embodiment of the present application.

[0222] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 1304 including instructions, and the instructions can be executed by a processor 1320 of the electronic device 1300 to perform the above method. For example, the non-transitory storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0223] Fig.14 1 is a block diagram of another electronic device 1400 provided in an embodiment of the present application. For example, the electronic device 1400 may be provided as a server. Fig.14 The electronic device 1400 includes a processing component 1422, which further includes one or more processors, and a memory resource represented by a memory 1432 for storing instructions that can be executed by the processing component 1422, such as an application. The application stored in the memory 1432 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1422 is configured to execute instructions to perform a task optimization method provided in an embodiment of the present application.

[0224] The electronic device 1400 may also include a power supply component 1426 configured to perform power management of the electronic device 1400, a wired or wireless network interface 1450 configured to connect the electronic device 1400 to a network, and an input output (I / O) interface 1458. The electronic device 1400 may operate based on an operating system stored in the memory 1432.

[0225] An embodiment of the present application also provides a computer program product, including a computer program, and a task optimization method implemented when the computer program is executed by a processor.

[0226] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for data processing, characterized in that: include: Splitting and combining the acquired source network filter information of the source platform to obtain first general configuration information; The first general configuration information includes at least one general rule for characterizing network behavior; Generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to represent the topological relationship between the first general configuration information and the topological relationship between the general rules; By traversing and searching the universal network rule tree, second universal configuration information consisting of universal rules corresponding to nodes in the universal network rule tree is obtained; The second general configuration information is converted into target network filter information matching the filter rule of the target platform.

2. The method according to claim 1, characterized in that: The step of splitting and combining the acquired source network filter information of the source platform to obtain the first general configuration information includes: Performing text semantic parsing on the source network filter information in an execution order to obtain one or more attribute information; According to the preset attributes in the general rule, each item of the attribute information is filled in the preset attributes of the general rule to obtain the general rule; the preset attributes of the general rule include: one or more of rule type, condition type, condition data, operation, and action; According to the execution order, each of the general rules is numbered respectively, and the obtained general rules are connected according to the numbers to form the first general configuration information.

3. The method according to claim 1, characterized in that The generating a general network rule tree according to the first general configuration information and the general rule includes: Classifying the general rules into categories corresponding to the network model layer to which the general rules belong; The general rules in the classification are respectively used as nodes in the general network rule tree, and for each of the classifications, the nodes in the classifications are sorted and connected according to the first priority corresponding to the general rules in the classification and the second priority corresponding to the first general configuration information to which the general rules in each of the classifications belong, so as to obtain a first topological structure corresponding to each of the classifications; According to the structure of the network model layer, the first topological structure is sorted and connected to obtain the universal network rule tree.

4. The method according to claim 3, characterized in that The method further comprises: Dividing the general rules into subcategories corresponding to the general rules; For each of the subcategories, the nodes in the subcategories are sorted and connected according to the first priority corresponding to the general rule in the subcategories and the second priority corresponding to the first general configuration information to which the general rule in each of the categories belongs, so as to obtain a second topological structure corresponding to each of the subcategories; The second topological structure corresponding to each of the sub-categories is combined to obtain the first topological structure.

5. The method according to claim 3, characterized in that: After the first topological structures are sorted and connected according to the structure of the network model layer to obtain the universal network rule tree, the method further includes: Traversing from the leaf nodes of the universal network rule tree; If there are multiple repeated nodes in the traversal to the universal network rule tree, the multiple repeated nodes are merged into one node.

6. The method according to claim 1, characterized in that The step of obtaining second general configuration information composed of general rules corresponding to nodes in the general network rule tree by traversing and searching the general network rule tree includes: Traverse the general network rule tree starting from the root node; According to the connection information of the target node currently traversed, determine whether to continue traversing the next node or extract the target node, and if the target node is extracted, record the general rule corresponding to the target node as the second general configuration information; After traversing all nodes, the second general configuration information is output.

7. The method according to claim 6, characterized in that The general rule includes a start rule and an intermediate rule, wherein the start rule corresponds to a corresponding start node in the general network rule tree, and the intermediate rule corresponds to an intermediate node in the general network rule tree except the start node; The step of determining to continue traversing the next node or extracting the target node according to the connection information of the target node currently traversed includes: If the target node is the starting node, and the target node is connected to an intermediate node, then after performing a matching operation on the target node, traverse the intermediate nodes connected to the target node to obtain the intermediate nodes connected to the starting node; If the target node is an intermediate node, and the target node is connected to another intermediate node, then after performing a matching operation on the target node, traverse the other intermediate node connected to the target node to obtain another intermediate node connected to the intermediate node; If the target node is the intermediate node, and the intermediate node is not connected to other nodes, extract the traversal result from the start node to the target node from the previous traversal, and record it as the second general configuration information corresponding to the intermediate node, so as to obtain the second general configuration information; If the target node is the start node and the start node is not connected to the intermediate node, the start node is extracted and recorded as the second general configuration information corresponding to the start node to obtain the second general configuration information.

8. The method according to claim 7, characterized in that The preset attributes of the general rule corresponding to the target node include one or more of condition type, condition data, operation, and action; After performing the matching operation on the target node, traversing the intermediate nodes connected to the target node includes: If the condition type of the target node and the condition data of the target node meet the operation condition of the target node, it is determined that the matching operation is completed, and the intermediate nodes connected to the target node are traversed to continue matching the intermediate nodes connected to the target node.

9. The method according to claim 1, characterized in that: The converting the second general configuration information into target network filter information matching the filter rule of the target platform includes: Traversing the second general configuration information, and determining the action type corresponding to the general rule contained in the second general configuration information; the second general configuration information includes at least one of the general rules; If the action type is jump, a jump operation is performed, and after the jump action is performed, an association relationship between the general rule and the next general rule after the jump is established; If the action type is non-jump, then according to the conversion rules preset for the target platform, the multiple general rules with the association relationship are subjected to legality judgment to generate the target network filter information.

10. A data processing device, characterized in that: The device comprises: A processing module, configured to split and combine the acquired source network filter information of the source platform to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior; A first generating module, configured to generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to characterize the topological relationship between the first general configuration information and the topological relationship between the general rules; A first traversal search module, configured to obtain second general configuration information consisting of general rules corresponding to nodes in the general network rule tree by traversing and searching the general network rule tree; The second generating module is configured to convert the second general configuration information into target network filter information matching the filter rule of the target platform.

11. An electronic device, characterized in that: The invention comprises a processor; and one or more programs, wherein the one or more programs are stored in a memory and are configured to be executed by the one or more processors, wherein the one or more programs include instructions for performing the following operations: The obtained source network filter information of the source platform is split and combined to obtain first general configuration information; the first general configuration information includes at least one general rule for characterizing network behavior; Generate a general network rule tree according to the first general configuration information and the general rules; the general network rule tree is used to represent the topological relationship between the first general configuration information and the topological relationship between the general rules; By traversing and searching the universal network rule tree, second universal configuration information consisting of universal rules corresponding to nodes in the universal network rule tree is obtained; The second general configuration information is converted into target network filter information matching the filter rule of the target platform.

12. A readable storage medium, characterized in that: When the instructions in the readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method as described in any one of method claims 1-9.

Images