Flow processing method, device, equipment, medium and product

Abstract

The invention discloses a flow processing method, device and equipment, a medium and a product. The method comprises the following steps: in response to a flow acquisition request for a first target machine, determining a target acquisition machine and a task identification number corresponding to a target virtual subnet according to the target virtual subnet to which the first target machine belongs; according to the target address and the operating system type of the first target machine, a flow collection task is generated in combination with the task identification number, and according to the flow collection task, based on a first collection network card and a second collection network card of the target collection machine, the target collection machine is controlled to carry out flow collection on the first target machine; and obtaining file identification information fed back by the target acquisition machine, and determining a target traffic file according to the file identification information so as to respond to the traffic acquisition request. According to the technical scheme, the double network cards of the traffic acquisition machine can be used for performing traffic acquisition on the target machines of different operating system types, so that the traffic processing efficiency is improved, and the robustness of the acquisition system is improved.

Description

Technical Field

[0001] The present invention relates to the field of network application technology, and in particular to a traffic processing method, device, equipment, medium and product. Background Art

[0002] With the continuous development and popularization of network applications, network security and performance issues are becoming increasingly prominent. In order to effectively monitor and analyze network traffic, it is necessary to collect, filter, store and analyze massive network data packets. For example, in attack and defense drill business scenarios, it is necessary to remotely capture the traffic of multiple target machines in the drill scenario. Capturing the traffic of the target host plays a key role in data retention and the next step of threat event analysis.

[0003] Therefore, facing the complex multi-intranet environment in the virtual network, how the business platform can use the dual network cards of the traffic collection machine to collect traffic from target machines of different operating system types, improve the efficiency of traffic processing, and enhance the robustness of the collection system is an urgent problem to be solved. Summary of the invention

[0004] The present invention provides a flow processing method, device, equipment, medium and product, so as to utilize the dual network cards of a flow collector to collect flow from target machines of different operating system types, thereby improving the efficiency of flow processing and enhancing the robustness of the collection system.

[0005] According to one aspect of the present invention, there is provided a traffic processing method, comprising:

[0006] In response to a traffic collection request for a first target machine, determining a target collection machine and a task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs;

[0007] Generate a flow collection task according to the target address and operating system type of the first target machine in combination with the task identification number, and control the target collection machine to collect flow from the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the flow collection task;

[0008] Obtain the file identification information fed back by the target collector, and determine the target flow file according to the file identification information to respond to the flow collection request.

[0009] According to another aspect of the present invention, there is provided a flow processing device, comprising:

[0010] A determination module, configured to respond to a traffic collection request for a first target machine and determine a target collection machine and a task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs;

[0011] The collection module is used to generate a flow collection task according to the target address and the operating system type of the first target machine in combination with the task identification number, and control the target collection machine to collect flow from the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the flow collection task;

[0012] The response module is used to obtain the file identification information fed back by the target collection machine, and determine the target flow file according to the file identification information to respond to the flow collection request.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the traffic processing method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the traffic processing method described in any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the traffic processing method of any embodiment of the present invention is implemented.

[0019] The technical solution of the embodiment of the present invention responds to a traffic collection request for a first target machine, determines a target collection machine and a task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs; generates a traffic collection task according to the target address and operating system type of the first target machine in combination with the task identification number, and controls the target collection machine to perform traffic collection on the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the traffic collection task; obtains file identification information fed back by the target collection machine, and determines the target traffic file according to the file identification information to respond to the traffic collection request. By utilizing the dual network cards of the traffic collection machine to perform traffic collection on target machines of different operating system types, the efficiency of traffic processing can be improved and the robustness of the collection system can be enhanced.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a traffic processing method provided by Embodiment 1 of the present invention;

[0023] Figure 2A It is a schematic diagram of the flow of flow collection provided by the second embodiment of the present invention;

[0024] Figure 2B It is a flow chart of traffic playback provided by Embodiment 2 of the present invention;

[0025] Figure 3 is a structural block diagram of a flow processing device provided in Embodiment 3 of the present invention;

[0026] Figure 4 It is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", "target", "candidate", "alternative", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0029] It should be noted that in the relevant technology, there are two main technical solutions for remote traffic collection in network packet capture mode: (1) The remote traffic collection solution based on ssh+sshpass+tcpdump+wireshark. This solution can only collect Linux host traffic, and a connection needs to be established when connecting to the remote host for the first time (user inputs yes / no). Although special scripts can be used to assist in completing the connection establishment or configuring ssh to avoid identity authentication, the sshpass transmission password faces considerable security risks. (2) The remote traffic collection solution based on wireshark / tshark+winpcap+rpcapd is suitable for Windows platform collection machines and cannot be directly applied to Linux environments. Wireshark relies on the libpcap protocol for remote traffic collection, and the libpcap protocol on the Linux platform does not have a remote collection feature configured by default. Therefore, the wireshark / tshark downloaded and installed directly does not support the remote collection protocol and cannot be configured with a remote collection port.

[0030] The above technical solutions have the following problems: (1) The existing remote collection solution based on the network packet capture mode cannot simultaneously realize traffic collection for target machines with multiple operating systems such as Windows and Linux. Moreover, in some business scenarios, the business network and the underlying virtual machine network cannot be directly connected. The traffic collection machine needs to interact with the business network and the underlying virtual machine intranet network at the same time. In addition, the virtual intranet network may be repeated, resulting in repeated traffic collection target IPs, which brings difficulties to accurate traffic collection, traffic packet return and platform interaction. (2) The existing traffic playback tool tcpreplay provides a simple traffic playback interface and related playback options, but usually only performs playback operations for a single host. Each host needs to perform a separate playback operation, which makes it difficult to quickly realize batch and random modification of IP addresses and MAC addresses. In some scenarios, a single traffic playback task needs to simultaneously play back multiple traffic to multiple target machines, and the pcap package needs to be edited and verified before playback. When multiple traffic playback tasks are running simultaneously, the traffic playback method for a single host is inefficient and consumes a lot of resources, making it difficult to achieve efficient and targeted playback of multiple traffic for multiple target machines.

[0031] The present invention is aimed at the complex multi-intranet environment in the virtual network. The flow collection machine adopts a dual network card solution. Remote flow collection and business interaction are carried out simultaneously using different network cards. In order to solve the problem of repeated target addresses caused by multiple virtual intranets, a multi-set flow collection machine solution is adopted to bind the collection task identification number and the flow collection machine to ensure that the flow collection machine only collects target devices in a specific virtual network. At the same time, in order to avoid a large number of flow packets being transmitted back due to excessive collection flow, occupying business bandwidth and affecting business stability, the collected flow is analyzed and filtering conditions are set to filter the flow when it is collected. The specific implementation method will be introduced in detail in the subsequent embodiments.

[0032] Embodiment 1

[0033] Figure 1 1 is a flow chart of a traffic processing method provided by the first embodiment of the present invention; this embodiment can be applied to the case where the service platform controls the target acquisition machine to interact with the target machine to collect the traffic of the target machine. The method can be executed by a traffic processing device, which can be implemented in the form of hardware and / or software. The traffic processing device can be configured in an electronic device, such as a service platform, such as Figure 1 As shown, the traffic processing method includes:

[0034] S101 . In response to a traffic collection request for a first target machine, a target collection machine and a task identification number corresponding to the target virtual subnet to which the first target machine belongs are determined.

[0035] Among them, the first target machine refers to the target machine for target traffic collection, and the target machine can specifically be an independent computer host or a virtual machine. The target machine runs in a virtual network environment. Specifically, there are multiple virtual subnets in the entire virtual network. Each target machine runs under the corresponding target virtual subnet. Each target virtual subnet is configured with an exclusive traffic collection machine, namely the target collection machine, and is also configured with a task identification number. The task identification numbers of different target virtual subnets are different. The task identification number refers to the collection task identification number corresponding to the target collection machine one by one, and can specifically be an ID (Identity document, unique code) number. The target collection machine can be configured with dual network cards, which are used for interaction with the business platform and the target machine respectively, so as to realize remote traffic collection and business interaction using different network cards at the same time.

[0036] Optionally, the service platform may generate a traffic collection request for the first target machine in response to a traffic collection instruction for the first target machine issued by the user, and may also periodically trigger the traffic collection request for the first target machine based on a preset collection period.

[0037] Optionally, in response to a traffic collection request for the first target machine, the traffic collection request can be parsed to determine the first target machine, and further combined with the correspondence between the preset target machine and the candidate virtual subnet to determine the target virtual subnet corresponding to the first target machine, and determine the target collection machine corresponding to the target virtual subnet and the task identification number corresponding to the target collection machine.

[0038] S102. Generate a traffic collection task according to the target address and operating system type of the first target machine in combination with the task identification number, and control the target collection machine to collect traffic from the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the traffic collection task.

[0039] Among them, the target address may specifically refer to the IP (Internet Protocol) address of the first target machine. The operating system type may be different series of Windows or Linux operating systems, for example, it may be a variety of operating systems including win7, win10, win2012 server, kali2.0, ubuntu16.04 and centos7. The traffic collection task refers to the collection task generated by the business platform and sent to the target collection machine. The traffic collection task may include the target address of the first target machine, the operating system type and the task identification number. The first collection network card of the target collection machine is used for business communication between the target collection machine and the business platform. The second collection network card of the target collection machine is used for the target collection machine to perform remote traffic collection on the first target machine.

[0040] Optionally, according to the traffic collection task, traffic collection is performed on the first target machine based on the first collection network card and the second collection network card of the target collection machine, including: interacting with the target collection machine through the first collection network card of the target collection machine to send the traffic collection task to the target collection machine; controlling the target collection machine to perform traffic collection on the first target machine based on the second collection network card.

[0041] Optionally, if the number of first target machines is at least two, the target acquisition machine can be controlled to collect the traffic of each first target machine in parallel, and the obtained traffic packets can be partitioned in the file system based on the file service storage, so that the corresponding file identification number and name and other information can be fed back to the business platform later.

[0042] Optionally, based on preset filtering conditions, the filtering address (such as IP address) of the specified filtered target machine can be determined, and the first target machine other than the filtering address can be determined as the first target machine for which traffic collection is required, and traffic collection is performed on this part of the first target machines.

[0043] For example, based on the following collection command, collection and filtering of the first target machine with a specified IP address can be implemented. That is, the filter rule is specified after -f, and the traffic of a specific IP (i.e., "126.125.124.11", "126.125.124.12" and 126.125.124.13) can be specified not to be collected:

[0044] tshark -i rpcap: / / $2:2002 / \\\Device\\NPF_{7B1142CA-4430-B0C8-

[0045] EB5DB063545E}-w$3-b filesize:5000-b duration:30

[0046] -f'not host 126.125.124.11and not host 126.125.124.12and not host

[0047] 126.125.124.13'

[0048] It should be noted that during the flow collection process, excessive flow will lead to rapid growth and return of flow packets, which will affect the overall system performance. Therefore, by specifying filtering conditions to filter specific flows, the number of captured flow packets can be greatly reduced.

[0049] Optionally, the target acquisition machine is controlled to perform traffic collection on the first target machine based on the second acquisition network card, including: using a preset network protocol analysis tool to collect traffic on the first target machine whose operating system type is Windows through the winpcap remote packet capture protocol; using a preset network protocol analysis tool to collect traffic on the first target machine whose operating system type is Linux through the rpcapd remote packet capture protocol.

[0050] Among them, the preset network protocol analysis tool can be tshark, which is used to capture and analyze data packets in computer networks. Winpcap and rpcapd are remote packet capture protocols applied to Windows and Linux respectively. Specifically, winpcap is a software tool on the Windows platform. After installation, it can be set to automatically start at boot time. It listens to port 2002 on the target machine by default; rpcadp is a collection agent tool applied to Linux target machines, and the command line can be used directly. Tshark needs to cooperate with the remote packet capture protocol to capture the traffic on the target machine. Specifically, tshark collects traffic based on the libpcap protocol.

[0051] Optionally, before tshark collects traffic based on libpcap protocol, you need to re-optimize and compile and install libpcap protocol that supports remote collection features on the collection machine, and then recompile and install wireshark so that it can configure the remote collection interface. At the same time, configure and start winpcap and rpcapd services on Windows and Linux target machines respectively. Among them, wireshark is tshark with a graphical interface, and tshark is the command line version of wireshark.

[0052] It should be noted that before optimization, remote traffic collection was not possible on the Linux platform and the configuration of remote collection ports was not supported. After optimization, the remote collection port can be configured based on tshark on the target collection machine.

[0053] Optionally, after controlling the target collector to collect traffic from the first target machine, it also includes: controlling the target collector to store the collected candidate traffic files in slices; controlling the target collector to determine the target traffic file to be returned from the candidate traffic file based on the timed return strategy, and determining the file name and file identification number of the target traffic file; controlling the target collector to generate file identification information based on the file name, file identification number and the target address of the first target machine and feed back the file identification information to the business platform.

[0054] Among them, the timed return strategy refers to the strategy of the target collector to cyclically return the file identification of the target traffic file to the business platform based on the preset return cycle. The file identification information includes the file name and file identification number of the target traffic file. The candidate traffic file refers to the traffic file that the target collector will collect, and the target traffic file can be the file in the candidate traffic file that meets the timed return strategy. The essence of the candidate traffic file and the target traffic file are both PCAP traffic packets, specifically block files for segmented storage. The file identification number refers to the ID number of the target traffic file.

[0055] Optionally, the target collector may store the collected candidate traffic files in segments based on the collection duration or file size.

[0056] Optionally, each first target machine can record the number of traffic packets that have been returned in real time, and then sort and retrieve all candidate traffic files by creation time, removing the candidate traffic files that have been returned before and the latest candidate traffic files that have not been saved. What remains are the target traffic files that need to be returned.

[0057] S103: Obtain file identification information fed back by the target collection machine, and determine the target flow file according to the file identification information to respond to the flow collection request.

[0058] The file identification information may include the file name and file identification number of the target traffic file, and may also include the target address of the collected first target machine.

[0059] It should be noted that after the target collector determines the target traffic file to be returned, it can upload the target traffic file to the file service and obtain the file identification number returned by the file service. The target collector can then return information such as the file identification number, file name, and target address of the target machine to the business platform. The business platform can use the file identification number to display, retrieve, and download the target traffic file or perform playback analysis on the target traffic file, i.e., traffic playback.

[0060] Optionally, the business platform can also interact with the target playback machine and the second target machine, respond to the user's playback request, or periodically perform traffic playback operations. Specifically, in response to the traffic playback request for the second target machine, determine the address list of the second target machine, the target playback file identification number, the number of task executions and the execution duration, and generate a traffic playback task in combination with the playback task identification number; according to the traffic playback task, based on the first playback network card and the second playback network card of the target playback machine, control the target playback machine to perform traffic playback on the second target machine; control the target playback machine to monitor the traffic during the traffic playback process, and feedback to the business platform after detecting that the playback is over.

[0061] The target playback machine is configured with a first playback network card and a second playback network card. The first playback network card is used to enable the target playback machine to interact with the service platform, and the second playback network card is used to enable the target playback machine to interact with the second target machine. The second target playback machine refers to the target machine designated for traffic playback. The number of target playback file identification numbers can be at least one. The number of executions and the execution duration are the number of executions and the duration of a traffic playback task. For example, if the number of executions is 2, the traffic corresponding to the second target machine is played back twice.

[0062] Optionally, the business platform may generate a target playback file list and an address list according to the second target machine and the target playback file identification number specified by the user to be played back, so as to generate a traffic playback task in combination with the number of task executions and execution duration.

[0063] Optionally, if the number of the second target machines is at least two, multiple target playback files may be played back in parallel on the second target machines.

[0064] It should be noted that Traffic Replay is a network analysis and testing technology used to resend previously captured network traffic to the network to test and verify the behavior and performance of network devices, applications, and security systems. Through traffic replay, specific network scenarios can be reproduced in a laboratory environment for troubleshooting, performance testing, and security analysis. The target replay file identification number refers to, for example, an ID number that can uniquely identify the target replay file.

[0065] Optionally, according to the traffic playback task, based on the first playback network card and the second playback network card of the target playback machine, the target playback machine is controlled to perform traffic playback on the second target machine, including: based on the first playback network card of the target playback machine, the traffic playback task is sent to the target playback machine to control the target playback machine to determine the target playback file according to the target playback file identification number; the target playback file is edited and verified, and after the verification is completed, according to the timed loop playback strategy and the target playback file, the second playback network card of the target playback machine interacts with the second target machine to perform traffic playback.

[0066] The target playback file may be a PCAP packet, i.e., a traffic packet. The timed loop playback strategy may be based on a timeout mechanism and a loop to implement a task-oriented timed loop playback strategy. The timeout mechanism refers to a countdown task, and the task automatically ends after the countdown ends.

[0067] Optionally, the target playback machine may download the corresponding PCAP package from the file service according to the target playback file identification number to obtain the target playback file.

[0068] Optionally, after determining the target playback file, you can first modify the destination IP, source MAC address (Media Access Control Address) and destination MAC address of the PCAP packet corresponding to the target playback file, and then recalculate the checksum of the PCAP packet corresponding to the target playback file based on the content of the modified PCAP packet corresponding to the target playback file and store the PCAP packet corresponding to the target playback file to complete the editing and verification of the target playback file.

[0069] Optionally, after editing and verification, a merge operation can be performed on the target playback file of each second target machine. Specifically, the Mergecap tool can be used to merge pcap packages to merge multiple pcap packages of a second target machine into one pcap package. Finally, a group of pcap packages corresponding to each target machine are saved.

[0070] Optionally, after verification is completed, traffic playback can be performed by interacting with the second target machine based on the tcpreplay traffic playback tool and the second playback network card of the target playback machine according to the timed loop playback strategy and the target playback file.

[0071] Optionally, during the traffic playback process, the target collector can monitor the status of the traffic playback process and notify the business platform if there is any abnormality.

[0072] The technical solution of the embodiment of the present invention responds to a traffic collection request for a first target machine, determines a target collection machine and a task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs; generates a traffic collection task according to the target address and operating system type of the first target machine in combination with the task identification number, and controls the target collection machine to perform traffic collection on the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the traffic collection task; obtains file identification information fed back by the target collection machine, and determines the target traffic file according to the file identification information to respond to the traffic collection request. By utilizing the dual network cards of the traffic collection machine to perform traffic collection on target machines of different operating system types, the efficiency of traffic processing can be improved and the robustness of the collection system can be enhanced.

[0073] Embodiment 2

[0074] Figure 2A It is a schematic diagram of the flow of flow collection provided by the second embodiment of the present invention; Figure 2B It is a flow chart of traffic playback provided in the second embodiment of the present invention; based on the above embodiment, this embodiment provides an interaction between a business platform, a collector and a target machine to realize a preferred solution for traffic collection and playback of the target machine.

[0075] Specifically, Figure 2AAs shown, traffic collection may include the following process: the business platform starts collecting traffic in response to a traffic collection request for the first target machine, sends the traffic collection task to the first collection network card (denoted as eth0) of the target collection machine, and the target collection machine performs remote filtering and collection on the first target machine (including Windows host and Linux host) through the second collection network card (denoted as eth1). After the target collection machine obtains the candidate traffic file, it can perform shard storage, and based on the timed feedback strategy, obtain the file identification information of the target traffic file from the file service through the first collection network card (denoted as eth0), and feed the file identification information back to the business platform through the first collection network card (denoted as eth0). Among them, the file service is used for PCAP file storage.

[0076] For example, see Figure 2B Traffic playback may include the following process: the business platform starts playback in response to the traffic playback request for the second target machine, sends the traffic playback task to the first playback network card (represented as eth0) of the target playback machine, and the target playback machine sends the playback file identification number to the file service through the first playback network card (represented as eth0) to download the file to obtain the target playback file. Further, the target playback machine can perform Pcap package editing and verification according to the target playback file, and perform batch merging. Finally, the second target machine (including Windows host and Linux host) is played in a timed loop through the second playback network card (represented as eth1), that is, traffic playback. During the traffic playback process, traffic playback monitoring can be performed, and feedback is given to the business platform through the first playback network card (represented as eth0) when an abnormality is detected. Among them, the file service is used for PCAP file storage.

[0077] The present invention adopts a network packet capture mode, which can realize remote traffic collection and multi-traffic batch directional playback of target hosts of various operating system types in a virtual network, solving the problem that existing network packet capture solutions cannot be directly applied to virtual network environments and cannot simultaneously perform remote traffic collection and efficient batch playback for Linux and Windows target machines.

[0078] Embodiment 3

[0079] Figure 3 : is a structural block diagram of a flow processing device provided in the third embodiment of the present invention; this embodiment can be applied to the situation where the business platform controls the target acquisition machine to interact with the target machine to realize the collection of the flow of the target machine. The flow processing device provided in the embodiment of the present invention can execute the flow processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method; the flow processing device can be implemented in the form of hardware and / or software, and configured in an electronic device with flow processing function, such as in a business platform, such as Figure 3As shown, the flow processing device specifically includes:

[0080] The determination module 301 is used to respond to the traffic collection request for the first target machine and determine the target collection machine and task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs;

[0081] The collection module 302 is used to generate a traffic collection task according to the target address and the operating system type of the first target machine in combination with the task identification number, and control the target collection machine to collect traffic from the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the traffic collection task;

[0082] The response module 303 is used to obtain the file identification information fed back by the target collector, and determine the target flow file according to the file identification information to respond to the flow collection request.

[0083] The technical solution of the embodiment of the present invention responds to a traffic collection request for a first target machine, determines a target collection machine and a task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs; generates a traffic collection task according to the target address and operating system type of the first target machine in combination with the task identification number, and controls the target collection machine to perform traffic collection on the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the traffic collection task; obtains file identification information fed back by the target collection machine, and determines the target traffic file according to the file identification information to respond to the traffic collection request. By utilizing the dual network cards of the traffic collection machine to perform traffic collection on target machines of different operating system types, the efficiency of traffic processing can be improved and the robustness of the collection system can be enhanced.

[0084] Furthermore, the acquisition module 302 may include:

[0085] An interaction unit, used for interacting with a target collection machine through a first collection network card of the target collection machine to send a flow collection task to the target collection machine;

[0086] The collection unit is used to control the target collection machine to collect traffic from the first target machine based on the second collection network card.

[0087] Furthermore, the acquisition unit is specifically used for:

[0088] Using the preset network protocol analysis tool and the winpcap remote packet capture protocol, the traffic of the first target machine with the operating system type of Windows is collected;

[0089] The preset network protocol analysis tool is used to collect traffic from the first target machine whose operating system type is Linux through the rpcapd remote packet capture protocol.

[0090] Furthermore, the above device is also used for:

[0091] Control the target collection machine to store the collected candidate flow files in segments;

[0092] Control the target collector to determine the target flow file to be returned from the candidate flow files based on the timed return strategy, and determine the file name and file identification number of the target flow file;

[0093] The target acquisition machine is controlled to generate file identification information according to the file name, the file identification number and the target address of the first target machine and feed the file identification information back to the business platform.

[0094] Furthermore, the above device also includes:

[0095] A playback generation module, for responding to a traffic playback request to a second target machine, determining an address list of the second target machine, a target playback file identification number, a task execution count and an execution duration, so as to generate a traffic playback task in combination with the playback task identification number;

[0096] A traffic playback module, used to control the target playback machine to perform traffic playback on the second target machine based on the first playback network card and the second playback network card of the target playback machine according to the traffic playback task;

[0097] The feedback module is used to control the target playback machine to monitor the traffic during the traffic playback process, and to feedback to the business platform after detecting the end of the playback.

[0098] Furthermore, the traffic playback module is specifically used for:

[0099] Based on the first playback network card of the target playback machine, the traffic playback task is sent to the target playback machine to control the target playback machine to determine the target playback file according to the target playback file identification number;

[0100] The target playback file is edited and verified, and after the verification is completed, according to the timed loop play strategy and the target playback file, the second playback network card of the target playback machine interacts with the second target machine to perform traffic playback.

[0101] Embodiment 4

[0102] Figure 4 It is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0103] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0104] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0105] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as a traffic processing method.

[0106] In some embodiments, the traffic processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the traffic processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the traffic processing method in any other appropriate manner (e.g., by means of firmware).

[0107] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0108] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0109] In the context of the present invention, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0110] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0111] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0112] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0113] In one embodiment, the embodiment of the present invention further includes a computer program product, the computer program product includes a computer program, and the computer program implements the traffic processing method of any embodiment of the present invention when executed by a processor.

[0114] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0115] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0116] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A traffic processing method, characterized in that: include: In response to a traffic collection request for a first target machine, determining a target collection machine and a task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs; Generate a flow collection task according to the target address and operating system type of the first target machine in combination with the task identification number, and control the target collection machine to collect flow from the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the flow collection task; Obtain the file identification information fed back by the target collector, and determine the target flow file according to the file identification information to respond to the flow collection request.

2. The method according to claim 1, characterized in that According to the traffic collection task, based on the first collection network card and the second collection network card of the target collection machine, traffic collection is performed on the first target machine, including: Interacting with the target collector through the first collection network card of the target collector to send the traffic collection task to the target collector; The target acquisition machine is controlled to collect traffic from the first target machine based on the second acquisition network card.

3. The method according to claim 2, characterized in that Controlling the target collection machine to collect traffic from the first target machine based on the second collection network card includes: Using the preset network protocol analysis tool and the winpcap remote packet capture protocol, the traffic of the first target machine whose operating system type is windows is collected; The preset network protocol analysis tool is used to collect traffic from the first target machine whose operating system type is Linux through the rpcapd remote packet capture protocol.

4. The method according to claim 1, characterized in that After controlling the target collection machine to collect traffic from the first target machine, the method further includes: Control the target collection machine to store the collected candidate flow files in segments; Control the target collector to determine the target flow file to be returned from the candidate flow files based on the timed return strategy, and determine the file name and file identification number of the target flow file; The target acquisition machine is controlled to generate file identification information according to the file name, the file identification number and the target address of the first target machine and feed the file identification information back to the business platform.

5. The method according to claim 1, characterized in that Also includes: In response to a traffic playback request for a second target machine, determine an address list of the second target machine, a target playback file identification number, a task execution count, and an execution duration, so as to generate a traffic playback task in combination with the playback task identification number; According to the traffic playback task, based on the first playback network card and the second playback network card of the target playback machine, the target playback machine is controlled to perform traffic playback on the second target machine; The target playback machine is controlled to monitor traffic during traffic playback and provide feedback to the business platform after detecting that playback is complete.

6. The method according to claim 5, characterized in that According to the traffic playback task, based on the first playback network card and the second playback network card of the target playback machine, the target playback machine is controlled to perform traffic playback on the second target machine, including: Based on the first playback network card of the target playback machine, the traffic playback task is sent to the target playback machine to control the target playback machine to determine the target playback file according to the target playback file identification number; The target playback file is edited and verified, and after the verification is completed, according to the timed loop play strategy and the target playback file, the second playback network card of the target playback machine interacts with the second target machine to perform traffic playback.

7. A flow processing device, characterized in that: include: A determination module, configured to respond to a traffic collection request for a first target machine and determine a target collection machine and a task identification number corresponding to the target virtual subnet according to the target virtual subnet to which the first target machine belongs; The collection module is used to generate a flow collection task according to the target address and the operating system type of the first target machine in combination with the task identification number, and control the target collection machine to collect flow from the first target machine based on the first collection network card and the second collection network card of the target collection machine according to the flow collection task; The response module is used to obtain the file identification information fed back by the target collection machine, and determine the target flow file according to the file identification information to respond to the flow collection request.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the traffic processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the traffic processing method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the traffic processing method according to any one of claims 1 to 6.

Images