Alarm method and device based on data detection, computer equipment and storage medium

Abstract

The invention provides an alarm method and device based on data detection, computer equipment and a storage medium, and belongs to the technical field of networks. In the application, an alarm rule is created for an alarm model, the alarm rule is split into a plurality of sub-rules with causal association, a data packet is compared with the sub-rules according to a comparison time sequence, and when all the sub-rules in the alarm rule are met, an alarm is output. And if a plurality of alarm models exist, creating a plurality of alarm rules, traversing all sub-rules in the plurality of alarm rules, and when all sub-rules in a certain alarm rule are met, outputting an alarm. According to the method, manual analysis is avoided, and the alarm efficiency and accuracy are improved; compared with the prior art, only the comparison results meeting the sub-rules are stored, and once any sub-rule is not met, the comparison is not continued, so that the space overhead and the resource occupation during the operation period are greatly reduced.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to an alarm method, device, computer equipment and storage medium based on data detection. Background Art

[0002] In the field of network traffic analysis, data detection to generate alarms is an important technology. Detecting data based on alarm rules can provide timely feedback on abnormal situations in network traffic analysis. As business needs grow and change, alarm rules have become very complex. The traditional method of detecting data based on single-packet feature rules to generate alarms can no longer meet actual application needs. Alarms can only be generated when the features of multiple data packets meet the conditions at the same time.

[0003] At present, for the detection and alarm of complex alarm rules, the complex alarm rules are usually broken down into single-packet feature rules one by one, and the single-packet feature rules are used to detect the data, and the results of these detections are stored. Then, the correlation between these results is manually analyzed. When the data packet meets all the corresponding alarm rules, an alarm is output.

[0004] However, in the above technical solution, when detecting data based on complex alarm rules, manual correlation analysis of the detection results is used. The manual efficiency is not as good as the efficiency of the machine, which will greatly delay the timing of the alarm. Moreover, manual correlation analysis requires relevant professional experience and has a low accuracy rate. Summary of the invention

[0005] The embodiments of the present application provide an alarm method, device, computer equipment and storage medium based on data detection, which improves efficiency and greatly reduces space overhead and resource occupation during operation. The technical solution is as follows:

[0006] On the one hand, a data detection-based alarm method is provided, the method comprising:

[0007] Based on the alarm model, an alarm rule is created, and based on the alarm rule, multiple sub-rules and a comparison sequence of the alarm rule are obtained, wherein the alarm rule is used to indicate the conditions that the alarm feature must meet, and the comparison sequence is used to indicate the comparison order of the multiple sub-rules in the alarm rule;

[0008] Identify a metadata field in a data packet, parse the metadata field of the data packet, and obtain metadata in the data packet, wherein the metadata includes characteristic data of the data packet;

[0009] Filtering feature data corresponding to the alarm feature from the metadata of the data packet;

[0010] The filtered feature data is compared according to the comparison sequence among all sub-rules in the alarm rule;

[0011] If the selected characteristic data satisfies all sub-rules in the alarm rule based on the comparison, an alarm is output.

[0012] On the other hand, there is provided an alarm device based on data detection, the device comprising:

[0013] Create a module to create alarm rules based on the alarm model;

[0014] An acquisition module, used for acquiring, based on the alarm rule, a plurality of sub-rules and a comparison sequence of the alarm rule, wherein the alarm rule is used to indicate a condition that an alarm feature needs to satisfy, and the comparison sequence is used to indicate a comparison order of the plurality of sub-rules in the alarm rule;

[0015] A metadata acquisition module, used to identify the metadata field in the data packet, parse the metadata field of the data packet, and obtain the metadata in the data packet, wherein the metadata includes characteristic data of the data packet;

[0016] A screening module, used to screen out characteristic data corresponding to the alarm characteristic from the metadata of the data packet;

[0017] A comparison module is used to compare the filtered feature data according to the comparison sequence between all sub-rules in the alarm rule;

[0018] The alarm module is used to output an alarm if the filtered feature data meets all sub-rules in the alarm rule based on the comparison.

[0019] In a possible implementation, the creation module is used to parse the alarm model, obtain alarm features and correlation data between the alarm features, and create alarm rules based on the alarm features and the correlation data between the alarm features.

[0020] In a possible implementation, the acquisition module is used to split the alarm rule based on the association relationship data between the alarm features to obtain multiple sub-rules and comparison sequence of the alarm rule.

[0021] In a possible implementation, the comparison module is used to compare any filtered feature data with a first sub-rule among the multiple sub-rules, wherein the first sub-rule is the first sub-rule among the sub-rules corresponding to the feature data;

[0022] If the feature data satisfies the first sub-rule, the feature data is compared with a second sub-rule located after the first sub-rule in the comparison sequence, wherein the second sub-rule is the second sub-rule in the sub-rules corresponding to the feature data;

[0023] If the characteristic data does not satisfy the first sub-rule, the characteristic data will not be further processed. Similarly, if the characteristic data satisfies all sub-rules corresponding to the characteristic data, the data packet satisfies the alarm rule.

[0024] In a possible implementation, the comparison result of the data packet against the multiple sub-rules is recorded in an array form.

[0025] In a possible implementation, the creation module is also used to create multiple alarm rules based on multiple alarm models or multiple alarm model instances of the same alarm model, each alarm rule includes multiple sub-rules, and the alarm rule is used to indicate the conditions that the alarm feature must meet.

[0026] In a possible implementation, the device further includes:

[0027] A deduplication module is used to deduplicate sub-rules in multiple alarm rules to obtain multiple different sub-rules;

[0028] The comparison module is further used to detect the data packet based on the multiple different sub-rules to obtain the comparison results of the multiple alarm rules;

[0029] The alarm module is further configured to output an alarm based on the comparison result of the multiple alarm rules.

[0030] In a possible implementation, the comparison module is used to traverse the above-mentioned multiple different sub-rules, compare the characteristic data of the data packet with the traversed sub-rules, and obtain the comparison results of the characteristic data for each sub-rule; from the comparison results of the characteristic data for each sub-rule, the comparison results of the sub-rules included are respectively filtered out for each alarm rule;

[0031] The alarm module is used to output an alarm if it is determined that the characteristic data satisfies all sub-rules in any alarm rule based on the screened comparison results.

[0032] In a possible implementation, the comparison module is used to traverse the multiple different sub-rules, compare the feature data of the data packet with the currently traversed sub-rule, and if the comparison result of the feature data for the sub-rule is not satisfied and the sub-rule is not the last sub-rule of any alarm rule, then stop executing at least one third sub-rule among the multiple sub-rules, and the at least one third sub-rule belongs to the alarm rule and does not belong to an alarm rule other than the alarm rule among the multiple alarm rules; if the comparison result of the feature data for the sub-rule is satisfied, continue traversing to obtain the comparison result of the feature data for each sub-rule, and filter out the comparison results of the sub-rules contained in each alarm rule from the comparison result of the feature data for each sub-rule;

[0033] The alarm module is used to output an alarm if it is determined that the characteristic data satisfies all sub-rules in any alarm rule based on the screened comparison results.

[0034] On the other hand, a computer device is provided, which includes a processor and a memory, wherein the memory is used to store at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the operations performed by the data detection-based alarm method in the optional implementation of the present application.

[0035] On the other hand, a computer-readable storage medium is provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor to implement the operations performed by the alarm method based on data detection in the optional implementation of the present application.

[0036] On the other hand, a computer program product or a computer program is provided, which includes a computer program code, which is stored in a computer-readable storage medium, and a processor of a computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device performs the operations performed by the data detection-based alarm method provided in the above-mentioned various optional implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1It is a schematic diagram of an implementation environment of an alarm method based on data detection provided according to an embodiment of the present application;

[0039] Figure 2 is a flow chart of an alarm method based on data detection provided according to an embodiment of the present application;

[0040] Figure 3 is a flowchart of a sub-rule matching process provided according to an embodiment of the present application;

[0041] Figure 4 is a flowchart of a method for outputting an alarm based on multiple alarm rules provided according to an embodiment of the present application;

[0042] Figure 5 is a flowchart of a multi-alarm rule matching process provided according to an embodiment of the present application;

[0043] Figure 6 is a block diagram of an alarm device based on data detection provided according to an embodiment of the present application;

[0044] Figure 7 is a structural block diagram of a computer device provided according to an embodiment of the present application;

[0045] Figure 8 It is a structural block diagram of a server provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0047] In this application, the terms "first", "second", etc. are used to distinguish identical or similar items with basically the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there any limitation on quantity and execution order.

[0048] In the present application, the term "at least one" means one or more, and the term "plurality" means two or more.

[0049] The term "and / or" in this application describes the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0050] It should be noted that the data involved in this application (including but not limited to data used for analysis, data stored, data displayed, etc.) are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the alarm model, alarm rules and data packets involved in this application are all obtained with full authorization.

[0051] The alarm method based on data detection provided in the embodiment of the present application can be executed by a computer device. In some embodiments, the computer device is a terminal or a server. Figure 1 Schematic diagram of an implementation environment of an alarm method based on data detection provided according to an embodiment of the present application. Figure 1 , the implementation environment includes a terminal 101 and a server 102.

[0052] The terminal 101 and the server 102 can be directly or indirectly connected via wired or wireless communication, which is not limited in this application.

[0053] In some embodiments, the terminal 101 is a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, etc., but is not limited thereto. An application supporting the data detection-based alarm method may be run on the terminal to configure the alarm model or other information so that the server 102 can perform corresponding detection and alarm. For example, the above-mentioned application is a detection application, a social application, and a multimedia application.

[0054] In some embodiments, the server 102 is a server corresponding to the above-mentioned application, and performs detection and alarm based on the configuration of the terminal. The above-mentioned server 102 is an independent physical server, and can also be a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), big data and artificial intelligence platforms. In some embodiments, the server 102 undertakes the main computing work in the alarm method, and the terminal 101 undertakes the secondary computing work in the alarm method; or, the server 102 undertakes the secondary computing work in the alarm method, and the terminal 101 undertakes the main computing work in the alarm method; or, the server 102 and the terminal 101 adopt a distributed computing architecture for collaborative computing.

[0055] Those skilled in the art will appreciate that the number of the above terminals may be more or less. For example, the above terminal may be only one, or the above terminals may be dozens or hundreds, or more. The embodiment of the present application does not limit the number of terminals and device types.

[0056] In some embodiments, the wireless network or wired network described above uses standard communication technology and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to any combination of LAN (Local Area Network), MAN (Metropolitan Area Network), WAN (Wide Area Network), mobile, wired or wireless network, dedicated network or virtual private network. In some embodiments, technologies and / or formats including HTML (Hyper Text Mark-up Language), XML (Extensible Markup Language) and the like are used to represent data exchanged through the network. In addition, conventional encryption technologies such as SSL (Secure Socket Layer), TLS (Transport Layer Security), VPN (Virtual Private Network), IPsec (Internet Protocol Security) and the like can be used to encrypt all or some links. In other embodiments, customized or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0057] Figure 2 This is a flow chart of an alarm method based on data detection provided in an embodiment of the present application, taking the execution subject as a server as an example, such as Figure 2 As shown, the method includes the following steps.

[0058] 201. Based on the alarm model, create an alarm rule, and based on the alarm rule, obtain multiple sub-rules and comparison timing of the alarm rule, where the alarm rule is used to indicate conditions that the alarm feature must meet.

[0059] In the embodiment of the present application, the alarm model is an algorithm model used to indicate the alarm scenarios that the network may face. For example, for a network attack scenario, the alarm model can indicate to alarm for a scenario where a large number of links are initiated within 1 second. The alarm rule that can be created by the alarm model is that the number of access requests to the same port within 1 second is greater than the target value.

[0060] In some embodiments, the step of creating an alarm rule based on the alarm model includes: parsing the alarm model to obtain alarm features and association relationship data between the alarm features, and creating an alarm rule based on the alarm features and the association relationship data between the alarm features. Among them, a feature refers to a certain attribute of a data packet, such as data packet length, data packet timestamp, source IP address of the data packet, destination IP address, protocol type, port number, etc. The alarm feature refers to the feature involved in the alarm model, and the association relationship data between the alarm features is used to represent the association relationship between the alarm features. The association relationship between the alarm features refers to whether the alarm features appear in the same rule. For example, if a rule is that the length of two adjacent data packets is greater than 1000 bytes and the time difference between the current data packet and the first data packet is greater than 10 seconds, then there is an association relationship between the data packet length and the data packet timestamp.

[0061] In some embodiments, based on the alarm rule, the step of obtaining multiple sub-rules and comparison sequence of the alarm rule includes: splitting the alarm rule based on the correlation relationship data between the alarm features to obtain multiple sub-rules and comparison sequence of the alarm rule, and the comparison sequence is used to indicate the comparison order of the multiple sub-rules in the alarm rule.

[0062] In some embodiments, the comparison timing is determined based on the causal relationship between the sub-rules. The alarm rule includes a set of single-packet feature rules, each of which is treated as a sub-rule when split, and the multiple sub-rules are analyzed in combination with the association relationship data between the alarm features to obtain sub-rules with causal relationships, and based on the causal relationship between the sub-rules, the comparison timing of the sub-rule as the cause is sorted before the comparison timing of the sub-rule as the result, so as to obtain the comparison order of the multiple sub-rules.

[0063] For example, a user provides an abnormal traffic alarm model, and the specific content is that if the length of a data packet exceeds 1000 bytes for 10 consecutive seconds, an alarm is output to the user. According to the steps of creating alarm rules, the alarm model is first parsed, and the alarm features of the alarm model are obtained as data packet length and data packet timestamp. The correlation data between the alarm features are multiple consecutive adjacent data packet lengths and data packet timestamps. Based on the data packet length and the correlation between multiple consecutive adjacent data packet lengths and data packet timestamps, the alarm rule is created as follows:

[0064] r1: The packet size exceeds 1000 bytes;

[0065] r2: The lengths of multiple consecutive data packets exceed 1000 bytes and the time difference between the current data packet and the first data packet is greater than 10 seconds.

[0066] Moreover, the comparison sequence of r1 and r2 is to compare r1 first, and then compare r2 when r1 satisfies the condition. That is, only when the length of a data packet exceeds 1000 bytes, will it be detected whether the length of the next adjacent data packet exceeds 1000 bytes and whether the time difference between the current data packet and the first data packet is greater than 10 seconds.

[0067] 202. Identify a metadata field in a data packet, parse the metadata field of the data packet, and obtain metadata in the data packet, where the metadata includes characteristic data of the data packet.

[0068] In the embodiment of the present application, the metadata field is a field in the data packet used to carry metadata. The metadata in the data packet includes characteristic data such as source IP address, destination IP address, protocol type, port number, and data packet timestamp.

[0069] In some embodiments, the step of identifying the metadata field in the data packet includes: when receiving the data packet, determining the metadata field based on a preset transmission protocol, and based on the determined metadata field, locating the specific position of the metadata field in the data packet to identify the metadata field in the data packet.

[0070] 203. Filter out feature data corresponding to the alarm feature from the metadata of the data packet.

[0071] For example, if the above alarm features include data packet length and data packet timestamp, then the feature data other than the data packet length and data packet timestamp are filtered out from the extracted metadata, and only the data packet length and data packet timestamp of the data packet are retained.

[0072] 204. Compare the filtered feature data according to the comparison sequence among all sub-rules in the alarm rule.

[0073] For any characteristic data screened out, the first sub-rule in all sub-rules corresponding to the characteristic data is called the first sub-rule, and the second sub-rule in all sub-rules corresponding to the characteristic data is called the second sub-rule. Accordingly, the comparison step of the above step 204 includes: comparing the characteristic data with the first sub-rule in the multiple sub-rules; if the characteristic data satisfies the first sub-rule, comparing the characteristic data with the second sub-rule located after the first sub-rule in the comparison sequence; if the characteristic data does not satisfy the first sub-rule, not further processing the characteristic data; and so on. If the characteristic data satisfies all sub-rules corresponding to the characteristic data, it means that the data packet satisfies the alarm rule.

[0074] In some embodiments, the characteristic data selected from the data packet is represented in array form to indicate whether the sub-rule in the alarm rule satisfies the characteristic data selected from the data packet. The index of the sub-rule is represented by the position index of the array, that is, the position of the sub-rule in the array reflects the position of the sub-rule in the comparison sequence. Figure 3 , Figure 3 It is a flowchart of a sub-rule matching process provided according to an embodiment of the present application. In the initial state, all sub-rules are in an unsatisfied state. During the data packet comparison process, if the characteristic data screened out in the data packet satisfies certain sub-rules, a mark is placed on the corresponding position of the sub-rule in the array, indicating that the sub-rule has been satisfied and is in a partially satisfied state. When all sub-rules at all positions are marked, they are in a fully satisfied state, indicating that the alarm rule is satisfied.

[0075] For example, there is an alarm rule R that contains a group of sub-rules r1, r2 and r3, where the comparison sequence of the group of sub-rules is r1-r2-r3, where the condition for r2 to be satisfied is that the data packet has a certain data feature and r1 has been satisfied, and the condition for r3 to be satisfied is that the data packet has a certain data feature and both r1 and r2 have been satisfied. When the data feature satisfies r2, but r1 has not been satisfied before, then r2 cannot be satisfied either.

[0076] The above process is only described by taking the example of maintaining an array for a data packet. In some embodiments, an array can also be maintained based on multiple data packets, that is, each position in the array is used to indicate whether the multiple data packets all meet the corresponding sub-rules.

[0077] In some embodiments, for any sub-rule, if the data feature of a data packet does not satisfy the sub-rule, the data feature of the data packet is discarded to avoid caching too many detection results, thus avoiding a waste of storage space. In some embodiments, for any sub-rule, if the data feature of a data packet does not satisfy the sub-rule, the data feature of the data packet is cached, and if the cache duration reaches a preset duration, the data feature of the data packet is discarded, and the preset duration is determined based on the relationship between the sub-rules in the alarm rule. By caching for a period of time and then discarding, the comparison of the overall alarm rule can be ensured without wasting storage space. For example, if a sub-rule is a rule that needs to be satisfied by N consecutive data packets, the preset duration is set to the maximum receiving time of N data packets, where the maximum receiving time refers to the time difference between the first and Nth data packets received among the N data packets, and N is a positive integer greater than 2.

[0078] 205. If it is determined based on the comparison that the filtered feature data satisfies all sub-rules in the alarm rule, an alarm is output.

[0079] The purpose of outputting the alarm is to notify the network administrator to take timely measures for defense and repair. Outputting the alarm includes sending an alarm message to the target terminal, and the alarm message is used to indicate the alarm rules currently met. In some embodiments, the alarm message is also used to indicate the current risks and the corresponding defense or repair measures to achieve the purpose of the alarm.

[0080] The method provided in the embodiment of the present application creates an alarm rule for the alarm model, and splits the alarm rule into multiple sub-rules with causal associations. During the comparison process, each time a sub-rule is satisfied, the next sub-rule is compared. In this process, the traditional manual analysis method is converted into system automatic association by comparing the timing. When all sub-rules in the alarm rule are satisfied, an alarm is output to avoid manual analysis, which improves efficiency and greatly advances the timing of the alarm. At the same time, the accuracy of the alarm can also be improved. Furthermore, only the comparison results that meet the sub-rules are stored, and once any sub-rule is not satisfied, the comparison will not be continued, which greatly reduces space overhead and resource usage during operation.

[0081] Above Figure 2 The embodiment shown is implemented based on a single alarm rule. For an alarm method configured with multiple alarm rules, the embodiment of the present application provides the following Figure 4 The method shown, Figure 4 This is a flowchart of a method for outputting alarms based on multiple alarm rules provided according to an embodiment of the present application. Taking the execution subject as a server as an example, the method includes the following steps.

[0082] 401. Based on multiple alarm models or multiple alarm model instances of the same alarm model, multiple alarm rules are created, each alarm rule includes multiple sub-rules, and the alarm rule is used to indicate conditions that the alarm feature must meet.

[0083] Among them, the sub-rules contained in different alarm rules may be repeated.

[0084] Multiple alarm model instances of the same alarm model refer to the parameters of the sub-rules in each alarm model instance being different. For example, alarm model instance 1 is that if the length of a data packet exceeds 1000 bytes for 10 consecutive seconds, an alarm is output to the user, and alarm model instance 2 is that if the length of a data packet exceeds 1500 bytes for 10 consecutive seconds, an alarm is output to the user. The different data packet lengths of 1000 bytes and 1500 bytes in the above two alarm model instances are the values ​​of different features of the same alarm model.

[0085] In some embodiments, the step of creating multiple alarm rules includes: parsing multiple alarm models in parallel to obtain multiple alarm features and correlation data between the multiple alarm features, and creating multiple alarm rules based on the multiple alarm features and the correlation data between the multiple alarm features, that is, executing the above step 201 in parallel to create multiple alarm rules.

[0086] 402. De-duplicate sub-rules in multiple alarm rules to obtain multiple different sub-rules.

[0087] In some embodiments, the step of deduplicating sub-rules in multiple alarm rules includes: traversing all sub-rules in the multiple alarm rules, if it is detected that the current sub-rule is the same as any sub-rule before the current sub-rule, discarding the current sub-rule and continuing to detect the next sub-rule, if it is detected that the current sub-rule is different from any sub-rule before the current sub-rule, retaining the current sub-rule, and so on, to obtain multiple different sub-rules.

[0088] 403. Identify the metadata field in the data packet, parse the metadata field of the data packet, and obtain the metadata in the data packet, where the metadata includes characteristic data of the data packet.

[0089] 404. Filter out feature data corresponding to multiple alarm features from the metadata of the data packet.

[0090] The above steps 403 and 404 are similar to steps 202 and 203 and are not described in detail.

[0091] 405 , traverse the above multiple different sub-rules, compare the filtered feature data with the traversed sub-rules, and obtain comparison results of the feature data for each sub-rule.

[0092] In the embodiment of the present application, there is no limitation on the comparison sequence of the above-mentioned multiple different sub-rules, and each filtered out feature data needs to be compared with the above-mentioned multiple different sub-rules. Accordingly, the comparison step of step 405 includes: for any filtered out feature data, the feature data is compared with the above-mentioned multiple different sub-rules one by one, and all sub-rules satisfied by the feature data are marked to obtain the comparison results of the feature data for each sub-rule.

[0093] 406. From the comparison results of the feature data for each sub-rule, filter out the comparison results of the sub-rules included in each alarm rule.

[0094] In some embodiments, the above step 406 includes: for any alarm rule, traversing the comparison results of the above feature data for each sub-rule; if the alarm rule includes the current sub-rule, associating the comparison results of the feature data for the current sub-rule with the alarm rule; if the alarm rule does not include the current sub-rule, continuing to screen the next sub-rule of the current sub-rule, and so on, to obtain the comparison results of all sub-rules in each alarm rule.

[0095] 407. If it is determined based on the filtered comparison results that the characteristic data satisfies all sub-rules in any alarm rule, an alarm is output.

[0096] In some embodiments, the above step 407 can be implemented through the following process: for any alarm rule, the comparison results of all sub-rules in the alarm rule are traversed. If the comparison results of all the traversed sub-rules are satisfied, the alarm rule is satisfied and an alarm is output; if any one of the comparison results of all the traversed sub-rules does not satisfy the sub-rule, the alarm rule is not satisfied and no alarm is output.

[0097] In some embodiments, the above step 407 is also implemented through the following process: for any alarm rule, the comparison results of each sub-rule are traversed according to the comparison sequence of the alarm rule. If the comparison results of all the traversed sub-rules satisfy the sub-rules, the alarm rule is satisfied and an alarm is output; if any of the comparison results of all the traversed sub-rules does not satisfy the sub-rules, the traversal is stopped to reduce space overhead and resource usage.

[0098] In some embodiments, the above 405 to step 407 are also implemented by the following process: traverse the above multiple different sub-rules, compare the filtered feature data with the currently traversed sub-rule, if the comparison result of the feature data for the sub-rule is not satisfied and the sub-rule is not the last sub-rule of any alarm rule, then stop executing at least one third sub-rule among the multiple sub-rules, the at least one third sub-rule belongs to the alarm rule, and does not belong to the alarm rule other than the alarm rule among the multiple alarm rules. If the comparison result of the feature data for the sub-rule is satisfied, continue to traverse to obtain the comparison result of the feature data for each sub-rule, and filter out the comparison results of the sub-rules contained in each alarm rule from the comparison result of the feature data for each sub-rule. If it is determined based on the filtered comparison result that the feature data satisfies all the sub-rules in any alarm rule, an alarm is output.

[0099] In order to facilitate the understanding of the above technical solution, an example is given below. Figure 5 Let me introduce you. Figure 5 It is a flowchart of a multi-alarm rule matching process provided according to an embodiment of the present application.

[0100] like Figure 5 As shown, the alarm rule R1 includes: r1, r2, r3 and r5;

[0101] Alarm rule R2 includes r2, r3 and r4;

[0102] By removing duplicates, we obtain sub-rules r1, r2, r3, r4 and r5.

[0103] When comparing based on the above sub-rules r1, r2, r3, r4 and r5, if the comparison result of r1 is not satisfied, it can be determined that r5 does not belong to the alarm rule R2 and there is no need to continue execution. Then, the comparison of sub-rule r5 is stopped and the comparison of sub-rules r2, r3 and r4 is continued.

[0104] There is a causal relationship between the sub-rules in any alarm rule. The previous sub-rule is the cause of the next sub-rule, and the next sub-rule is the result of the previous sub-rule. If the feature data does not satisfy a sub-rule, then the feature data must not satisfy the next sub-rule of the sub-rule in the comparison sequence. If the subsequent comparison steps are stopped at this time, the consumption of computing resources can be avoided, and the storage of too many comparison results can be avoided to improve the utilization of storage space. If the unsatisfied sub-rule is the last sub-rule in the comparison sequence, there is no need to execute processing such as stopping the comparison, and the alarm can be directly output.

[0105] The method provided in the embodiment of the present application combines the sub-rules in these alarm rules together for comparison when there are multiple alarm rules, that is, when there are multiple alarm models or multiple alarm model instances of the same alarm model. Multiple alarm rules can be detected through one comparison process, thus avoiding separate detection of each alarm rule, greatly improving detection efficiency.

[0106] Figure 6 is a block diagram of an alarm device based on data detection provided according to an embodiment of the present application. The device is used to execute the above-mentioned alarm method based on data detection, see Figure 6 , the device comprises:

[0107] A creation module 601 is used to create an alarm rule based on the alarm model;

[0108] An acquisition module 602 is used to acquire multiple sub-rules and a comparison sequence of the alarm rule based on the alarm rule, wherein the alarm rule is used to indicate a condition that an alarm feature needs to satisfy, and the comparison sequence is used to indicate a comparison order of multiple sub-rules in the alarm rule;

[0109] The metadata acquisition module 603 is used to identify the metadata field in the data packet, parse the metadata field of the data packet, and obtain the metadata in the data packet, wherein the metadata includes characteristic data of the data packet;

[0110] A screening module 604, configured to screen out characteristic data corresponding to the alarm characteristic from the metadata of the data packet;

[0111] Comparison module 605, used to compare the filtered feature data according to the comparison sequence between all sub-rules in the alarm rule;

[0112] The alarm module 606 is used to output an alarm if it is determined based on the comparison that the filtered feature data meets all sub-rules in the alarm rule.

[0113] In a possible implementation, the creation module is used to parse the alarm model, obtain alarm features and correlation data between the alarm features, and create alarm rules based on the alarm features and the correlation data between the alarm features.

[0114] In a possible implementation, the acquisition module is used to split the alarm rule based on the association relationship data between the alarm features to obtain multiple sub-rules and comparison sequence of the alarm rule.

[0115] In a possible implementation, the comparison module is used to compare any filtered feature data with a first sub-rule among the multiple sub-rules, wherein the first sub-rule is the first sub-rule among the sub-rules corresponding to the feature data;

[0116] If the feature data satisfies the first sub-rule, the feature data is compared with a second sub-rule located after the first sub-rule in the comparison sequence, wherein the second sub-rule is the second sub-rule in the sub-rules corresponding to the feature data;

[0117] If the characteristic data does not satisfy the first sub-rule, the characteristic data will not be further processed. Similarly, if the characteristic data satisfies all sub-rules corresponding to the characteristic data, the data packet satisfies the alarm rule.

[0118] In a possible implementation, the comparison result of the data packet against the multiple sub-rules is recorded in an array form.

[0119] In a possible implementation, the creation module is also used to create multiple alarm rules based on multiple alarm models or multiple alarm model instances of the same alarm model, each alarm rule includes multiple sub-rules, and the alarm rule is used to indicate the conditions that the alarm feature must meet.

[0120] In a possible implementation, the device further includes:

[0121] A deduplication module is used to deduplicate sub-rules in multiple alarm rules to obtain multiple different sub-rules;

[0122] The comparison module is further used to detect the data packet based on the multiple different sub-rules to obtain the comparison results of the multiple alarm rules;

[0123] The alarm module is further configured to output an alarm based on the comparison result of the multiple alarm rules.

[0124] In a possible implementation, the comparison module is used to traverse the above-mentioned multiple different sub-rules, compare the characteristic data of the data packet with the traversed sub-rules, and obtain the comparison results of the characteristic data for each sub-rule; from the comparison results of the characteristic data for each sub-rule, the comparison results of the sub-rules included are respectively filtered out for each alarm rule;

[0125] The alarm module is used to output an alarm if it is determined that the characteristic data satisfies all sub-rules in any alarm rule based on the screened comparison results.

[0126] In a possible implementation, the comparison module is used to traverse the multiple different sub-rules, compare the feature data of the data packet with the currently traversed sub-rule, and if the comparison result of the feature data for the sub-rule is not satisfied and the sub-rule is not the last sub-rule of any alarm rule, then stop executing at least one third sub-rule among the multiple sub-rules, and the at least one third sub-rule belongs to the alarm rule and does not belong to an alarm rule other than the alarm rule among the multiple alarm rules; if the comparison result of the feature data for the sub-rule is satisfied, continue traversing to obtain the comparison result of the feature data for each sub-rule, and filter out the comparison results of the sub-rules contained in each alarm rule from the comparison result of the feature data for each sub-rule;

[0127] The alarm module is used to output an alarm if it is determined that the characteristic data satisfies all sub-rules in any alarm rule based on the screened comparison results.

[0128] In an embodiment of the present application, an alarm rule is created for the alarm model, and the alarm rule is split into multiple causally related sub-rules. The data packet is compared with the sub-rules according to the comparison sequence. When all sub-rules in the alarm rule are satisfied, an alarm is output; if there are multiple alarm models, multiple alarm rules are created, and all sub-rules in multiple alarm rules are traversed. When all sub-rules in a certain alarm rule are satisfied, an alarm is output. The above method avoids manual analysis and improves the efficiency and accuracy of alarms; only the comparison results that meet the sub-rules are stored, and once any sub-rule is not satisfied, the comparison will not be continued, which greatly reduces the space overhead and resource usage during operation.

[0129] It should be noted that: the alarm device based on data detection provided in the above embodiment only uses the division of the above functional modules as an example when performing an alarm based on data detection. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0130] In the embodiments of the present application, the computer device can be configured as a terminal or a server. When the computer device is configured as a terminal, the terminal can be used as the execution subject to implement the technical solution provided in the embodiments of the present application. When the computer device is configured as a server, the server can be used as the execution subject to implement the technical solution provided in the embodiments of the present application. The technical solution provided in the present application can also be implemented through interaction between the terminal and the server. The embodiments of the present application are not limited to this.

[0131] Figure 7 1 is a block diagram of a computer device 700 provided according to an embodiment of the present application. The computer device 700 may be a portable mobile terminal, such as a smart phone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer or a desktop computer. The computer device 700 may also be referred to as a user device, a portable terminal, a laptop terminal, a desktop terminal or other names.

[0132] Typically, the computer device 700 includes a processor 701 and a memory 702 .

[0133] The processor 701 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 701 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 701 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 701 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 701 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0134] The memory 702 may include one or more computer-readable storage media, which may be non-transitory. The memory 702 may also include a high-speed random access memory and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 702 is used to store at least one computer program, which is used to be executed by the processor 701 to implement the alarm method based on data detection provided in the method embodiment of the present application.

[0135] In some embodiments, the computer device 700 may further optionally include: a peripheral device interface 703 and at least one peripheral device. The processor 701, the memory 702 and the peripheral device interface 703 may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral device interface 703 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 704, a display screen 705, a camera assembly 706, an audio circuit 707 and a power supply 708.

[0136] The peripheral device interface 703 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 701 and the memory 702. In some embodiments, the processor 701, the memory 702, and the peripheral device interface 703 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 701, the memory 702, and the peripheral device interface 703 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

[0137] The radio frequency circuit 704 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 704 communicates with the communication network and other communication devices through electromagnetic signals. The radio frequency circuit 704 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. In some embodiments, the radio frequency circuit 704 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. The radio frequency circuit 704 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 704 may also include circuits related to NFC (Near Field Communication), which is not limited in this application.

[0138] The display screen 705 is used to display the UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 705 is a touch display screen, the display screen 705 also has the ability to collect touch signals on the surface or above the surface of the display screen 705. The touch signal can be input to the processor 701 as a control signal for processing. At this time, the display screen 705 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 705 can be one, set on the front panel of the computer device 700; in other embodiments, the display screen 705 can be at least two, respectively set on different surfaces of the computer device 700 or in a folding design; in other embodiments, the display screen 705 can be a flexible display screen, set on the curved surface or folding surface of the computer device 700. Even, the display screen 705 can also be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 705 can be made of materials such as LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode, organic light-emitting diode).

[0139] The camera assembly 706 is used to capture images or videos. In some embodiments, the camera assembly 706 includes a front camera and a rear camera. Typically, the front camera is disposed on the front panel of the terminal, and the rear camera is disposed on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 706 may also include a flash. The flash may be a monochrome temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0140] The audio circuit 707 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals and input them into the processor 701 for processing, or input them into the radio frequency circuit 704 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there can be multiple microphones, which are respectively arranged at different parts of the computer device 700. The microphone can also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 701 or the radio frequency circuit 704 into sound waves. The speaker can be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio circuit 707 may also include a headphone jack.

[0141] The power supply 708 is used to power various components in the computer device 700. The power supply 708 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 708 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged through a wired line, and a wireless rechargeable battery is a battery that is charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0142] In some embodiments, the computer device 700 further includes one or more sensors 709 , including but not limited to: an acceleration sensor 710 , a gyroscope sensor 711 , a pressure sensor 712 , an optical sensor 713 , and a proximity sensor 714 .

[0143] The acceleration sensor 710 can detect the magnitude of acceleration on the three coordinate axes of the coordinate system established by the computer device 700. For example, the acceleration sensor 710 can be used to detect the components of gravity acceleration on the three coordinate axes. The processor 701 can control the display screen 705 to display the user interface in a horizontal view or a vertical view according to the gravity acceleration signal collected by the acceleration sensor 710. The acceleration sensor 710 can also be used to collect game or user motion data.

[0144] The gyro sensor 711 can detect the body direction and rotation angle of the computer device 700, and the gyro sensor 711 can cooperate with the acceleration sensor 710 to collect the user's 3D actions on the computer device 700. The processor 701 can implement the following functions based on the data collected by the gyro sensor 711: motion sensing (such as changing the UI according to the user's tilt operation), image stabilization during shooting, game control, and inertial navigation.

[0145] The pressure sensor 712 can be set on the side frame of the computer device 700 and / or the lower layer of the display screen 705. When the pressure sensor 712 is set on the side frame of the computer device 700, it can detect the user's grip signal of the computer device 700, and the processor 701 performs left and right hand recognition or shortcut operation according to the grip signal collected by the pressure sensor 712. When the pressure sensor 712 is set on the lower layer of the display screen 705, the processor 701 controls the operability controls on the UI interface according to the user's pressure operation on the display screen 705. The operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

[0146] The optical sensor 713 is used to collect the ambient light intensity. In one embodiment, the processor 701 can control the display brightness of the display screen 705 according to the ambient light intensity collected by the optical sensor 713. Specifically, when the ambient light intensity is high, the display brightness of the display screen 705 is increased; when the ambient light intensity is low, the display brightness of the display screen 705 is reduced. In another embodiment, the processor 701 can also dynamically adjust the shooting parameters of the camera assembly 706 according to the ambient light intensity collected by the optical sensor 713.

[0147] The proximity sensor 714, also called a distance sensor, is usually disposed on the front panel of the computer device 700. The proximity sensor 714 is used to collect the distance between the user and the front of the computer device 700. In one embodiment, when the proximity sensor 714 detects that the distance between the user and the front of the computer device 700 is gradually decreasing, the processor 701 controls the display screen 705 to switch from the screen-on state to the screen-off state; when the proximity sensor 714 detects that the distance between the user and the front of the computer device 700 is gradually increasing, the processor 701 controls the display screen 705 to switch from the screen-off state to the screen-on state.

[0148] Taking the computing device as a server as an example, Figure 8 This is a schematic diagram of the structure of a server provided in an embodiment of the present application. The server 800 may have relatively large differences due to different configurations or performances, and may include one or more CPUs (Central Processing Units, processors) 801 and one or more memories 802, wherein the one or more memories 802 store at least one computer program, and the at least one computer program is loaded and executed by the one or more processors 801 to implement the above-mentioned alarm method based on data detection. Of course, the server 800 may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The server 800 may also include other components for implementing device functions, which will not be repeated here.

[0149] Those skilled in the art will understand that Figure 7 The structure shown in the figure does not constitute a limitation on the computer device 700, and the computer device 700 may include more or less components than shown in the figure, or combine some components, or adopt a different arrangement of components.

[0150] The embodiment of the present application also provides a computer-readable storage medium, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor of a computer device to implement the operation performed by the computer device in the method of the above embodiment. For example, the computer-readable storage medium can be a ROM (Read-Only Memory), a RAM (Random Access Memory), a CD-ROM (Compact Disc Read-Only Memory), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0151] In some embodiments, the computer program involved in the embodiments of the present application may be deployed and executed on a computer device, or on multiple computer devices located at one location, or on multiple computer devices distributed at multiple locations and interconnected by a communication network. Multiple computer devices distributed at multiple locations and interconnected by a communication network may constitute a blockchain system.

[0152] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer program code, and the computer program code is stored in a computer-readable storage medium. The processor of the terminal reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the terminal executes the alarm method based on data detection provided in the above various optional implementations.

[0153] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0154] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An alarm method based on data detection, characterized in that: The method comprises: Based on the alarm model, an alarm rule is created, and based on the alarm rule, multiple sub-rules and a comparison sequence of the alarm rule are obtained, wherein the alarm rule is used to indicate the conditions that the alarm feature must meet, and the comparison sequence is used to indicate the comparison order of the multiple sub-rules in the alarm rule; Identify a metadata field in a data packet, parse the metadata field of the data packet, and obtain metadata in the data packet, wherein the metadata includes characteristic data of the data packet; Filtering feature data corresponding to the alarm feature from the metadata of the data packet; The filtered feature data is compared according to the comparison sequence among all sub-rules in the alarm rule; If the filtered feature data satisfies all sub-rules in the alarm rule based on the comparison, an alarm is output.

2. The method according to claim 1, characterized in that The creation of alarm rules based on the alarm model includes: The alarm model is analyzed to obtain alarm features and correlation data between the alarm features, and alarm rules are created based on the alarm features and correlation data between the alarm features.

3. The method according to claim 1, characterized in that The acquiring, based on the alarm rule, a plurality of sub-rules of the alarm rule and a comparison sequence comprises: Based on the association relationship data between the alarm features, the alarm rule is split to obtain multiple sub-rules and comparison time sequences of the alarm rule.

4. The method according to claim 1, characterized in that The comparing of the filtered feature data according to the comparison sequence among all sub-rules in the alarm rule includes: For any of the filtered feature data, the feature data is compared with a first sub-rule among the multiple sub-rules, wherein the first sub-rule is the first sub-rule among the sub-rules corresponding to the feature data; If the feature data satisfies the first sub-rule, the feature data is compared with a second sub-rule located after the first sub-rule in the comparison sequence, wherein the second sub-rule is the second sub-rule in the sub-rules corresponding to the feature data; If the characteristic data does not satisfy the first sub-rule, the characteristic data will not be further processed. Similarly, if the characteristic data satisfies all sub-rules corresponding to the characteristic data, the data packet satisfies the alarm rule.

5. The method according to claim 1, characterized in that The comparison result of the data packet against the multiple sub-rules is recorded in array form.

6. The method according to claim 1, characterized in that The method further comprises: Based on multiple alarm models or multiple alarm model instances of the same alarm model, multiple alarm rules are created. Each alarm rule contains multiple sub-rules. The alarm rule is used to indicate the conditions that the alarm feature must meet. De-duplicate the sub-rules in multiple alarm rules to obtain multiple different sub-rules; The data packet is detected based on the multiple different sub-rules to obtain comparison results of the multiple alarm rules, and an alarm is output based on the comparison results of the multiple alarm rules.

7. The method according to claim 6, characterized in that The detecting the data packet based on the multiple different sub-rules to obtain the comparison results of the multiple alarm rules, and outputting an alarm based on the comparison results of the multiple alarm rules includes: Traversing the above-mentioned multiple different sub-rules, comparing the characteristic data of the data packet with the traversed sub-rules, and obtaining a comparison result of the characteristic data for each sub-rule; From the comparison results of the feature data for each sub-rule, the comparison results of the sub-rules included in each alarm rule are filtered out respectively; If, based on the filtered comparison results, it is determined that the characteristic data satisfies all sub-rules in any alarm rule, an alarm is output.

8. The method according to claim 6, characterized in that The detecting the data packet based on the multiple different sub-rules to obtain the comparison results of the multiple alarm rules, and outputting an alarm based on the comparison results of the multiple alarm rules includes: Traversing the multiple different sub-rules, comparing the characteristic data of the data packet with the currently traversed sub-rule, if the comparison result of the characteristic data for the sub-rule is not satisfied and the sub-rule is not the last sub-rule of any alarm rule, then stopping the execution of at least one third sub-rule among the multiple sub-rules, the at least one third sub-rule belongs to the alarm rule and does not belong to an alarm rule other than the alarm rule among the multiple alarm rules; If the comparison result of the feature data against the sub-rule is satisfied, continue traversing to obtain the comparison result of the feature data against each sub-rule, and filter out the comparison results of the sub-rules included in each alarm rule from the comparison result of the feature data against each sub-rule; If, based on the filtered comparison results, it is determined that the characteristic data satisfies all sub-rules in any alarm rule, an alarm is output.

9. An alarm device based on data detection, characterized in that: The device comprises: Create a module to create alarm rules based on the alarm model; An acquisition module, used for acquiring, based on the alarm rule, a plurality of sub-rules and a comparison sequence of the alarm rule, wherein the alarm rule is used to indicate a condition that an alarm feature needs to satisfy, and the comparison sequence is used to indicate a comparison order of the plurality of sub-rules in the alarm rule; A metadata acquisition module, used to identify the metadata field in the data packet, parse the metadata field of the data packet, and obtain the metadata in the data packet, wherein the metadata includes characteristic data of the data packet; A screening module, used to screen out characteristic data corresponding to the alarm characteristic from the metadata of the data packet; A comparison module is used to compare the filtered feature data according to the comparison sequence between all sub-rules in the alarm rule; The alarm module is used to output an alarm if the filtered feature data meets all sub-rules in the alarm rule based on the comparison.

10. A computer device, characterized in that: The computer device includes a processor and a memory, the memory is used to store at least one computer program, and the at least one computer program is loaded by the processor to execute the data detection-based alarm method described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store at least one computer program, and the at least one computer program is used to execute the data detection-based alarm method described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data detection-based alarm method according to any one of claims 1 to 8 is implemented.

Images