Data message detection method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses a data message detection method and device, equipment and a storage medium, and the method comprises the steps: positioning a data load in a detection message, and obtaining a target number of bytes from a current detection point of the data load as a comparison index; matching the comparison index with a target comparison table constructed according to the previous target number of bytes of each feature code; if the comparison index hits the target comparison table, obtaining a comparison field matched with the hit target feature code from the current check point, and matching the comparison field with the target feature code; if the comparison field is successfully matched with the target feature code, abnormal prompting is carried out on the detection message; and if the comparison index does not hit the target comparison table or the comparison field is not matched with the target feature code, after a new current detection point is determined, returning to execute the operation of acquiring the target number of bytes as the comparison index from the current detection point of the data load until the detection of all the data loads is completed, so that the accuracy of the detection result is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data message detection method, device, equipment and storage medium. Background Art

[0002] At present, with the rise and popularity of short videos and live broadcasts, the amount of data from network users has increased dramatically, and the attack traffic they face has become increasingly complex. Therefore, in order to conduct in-depth retrieval of the content of data packets and more accurate feature matching, more types and quantities of feature codes are required.

[0003] In the prior art, data traffic is usually connected to a diversion device, and the diversion device is used as the front-end system for accessing traffic, and a certain number of feature codes are issued according to the requirements of the back-end system. Then, since the position of the abnormal feature in the detection message is uncertain, it is usually necessary to search byte by byte whether there is the same feature code in the detection message. Alternatively, N identical feature codes can be issued to the feature code storage space, and Figure 1 As shown, the starting position of the feature code is offset by 0 to N bytes in sequence, so as to match the feature code located at any position of the detection message, where N is the number of bytes contained in the detection message, and the capacity of the feature code storage space is fixed.

[0004] However, the method of searching byte by byte whether the same signature exists in the detection message requires searching each byte in the detection message, which results in a large number of searches and low matching efficiency. Secondly, the method of offsetting the starting position of the signature by 0 to N bytes in sequence reduces the number of searches while increasing the occupation of the signature storage space, which greatly limits the types of signatures sent to the signature storage space. Summary of the invention

[0005] The present invention provides a data message detection method, device, equipment and storage medium, which can realize abnormality detection of data messages according to more types of feature codes, thereby improving the accuracy of abnormality detection of data messages.

[0006] In a first aspect, an embodiment of the present invention provides a data packet detection method, including:

[0007] Locate the data payload in the detection message, and obtain a target number of bytes from the current detection point of the data payload as a comparison index, wherein the current detection point is initialized to the starting position of the data payload;

[0008] Matching the comparison index with a pre-established target comparison table, where the target comparison table is constructed based on the first target number of bytes of each feature code used to detect the data message;

[0009] If the comparison index hits the target comparison table, the target feature code corresponding to the hit result is obtained, and the comparison field adapted to the target feature code is obtained from the current detection point to match the target feature code;

[0010] If the comparison field matches the target signature successfully, an abnormal prompt will be given for the detected message;

[0011] If the comparison index does not hit the target comparison table, or the comparison field does not match the target feature code, after determining the new current detection point, return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

[0012] Optionally, before matching the comparison index with a pre-established target comparison table, it also includes: obtaining at least one feature code for detecting the data message; starting from the starting byte of each feature code, obtaining a target number of bytes in each feature code as feature indexes corresponding to each feature code; calculating the decimal values ​​corresponding to each feature index, and using each decimal value as a row number, organizing each feature code according to its row number to generate a target comparison table.

[0013] Optionally, the comparison index is matched with a pre-established target comparison table, including: calculating a comparison decimal value corresponding to the comparison index, and detecting whether the target comparison table stores at least one feature code under the target row number corresponding to the comparison decimal value; if so, determining that the comparison index hits the target comparison table, otherwise, determining that the comparison index does not hit the target comparison table.

[0014] Optionally, before matching the comparison index with a pre-established target comparison table, it also includes: obtaining at least one feature code for detecting the data message; starting from the starting byte of each feature code, obtaining a target number of bytes in each feature code as feature indexes corresponding to each feature code; calculating feature hash values ​​corresponding to each feature index, and generating a target comparison table based on each feature hash value.

[0015] Optionally, the comparison index is matched with a pre-established target comparison table, including: calculating a comparison hash value corresponding to the comparison index, and querying whether a feature hash value equal to the comparison hash value is stored in the target comparison table; if so, determining that the comparison index hits the target comparison table, otherwise, determining that the comparison index does not hit the target comparison table.

[0016] Optionally, determining the new current detection point specifically includes: taking the current detection point of the data payload as a starting point and incrementing by a target number of bytes to obtain a new current detection point.

[0017] Optionally, obtaining at least one feature code for detecting a data message specifically includes: obtaining at least one basic feature code that matches the data message; obtaining a target basic feature code for feature code extension in each basic feature code; locating an extension area in the target basic feature code, and calculating a basic field value corresponding to all fields in the extension area; calculating at least one extension field value that matches the basic field value according to a preset extension method, and respectively determining a target extension field corresponding to each extension field value; using at least one target extension field to replace all fields in the extension area of ​​the target basic feature code, respectively, to obtain at least one extended feature code; and using the basic feature code and the extended feature code together as a feature code for detecting a data message.

[0018] In a second aspect, an embodiment of the present invention further provides a data message detection device, including:

[0019] A comparison index acquisition module is used to locate the data payload in the detection message and obtain a target number of bytes from the current detection point of the data payload as a comparison index, wherein the current detection point is initialized to the starting position of the data payload;

[0020] An index matching module, used to match the comparison index with a pre-established target comparison table, where the target comparison table is constructed based on the first target number of bytes of each feature code used to detect the data message;

[0021] The feature code matching module is used to obtain the target feature code corresponding to the hit result if the comparison index hits the target comparison table, and obtain the comparison field adapted to the target feature code from the current detection point to match the target feature code;

[0022] The abnormality prompt module is used to prompt the detected message for abnormality if the comparison field matches the target feature code successfully;

[0023] The loop matching module is used to determine the new current detection point if the comparison index does not hit the target comparison table, or the comparison field does not match the target feature code, and then return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

[0024] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0025] at least one processor; and

[0026] a memory communicatively connected to at least one processor; wherein,

[0027] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor can execute the data message detection method provided by any embodiment of the present invention.

[0028] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the data packet detection method provided by any embodiment of the present invention when executed.

[0029] The technical solution of the embodiment of the present invention, by determining the starting position of the target feature code in the data payload and then matching the complete target feature code with the comparison field in the data payload, avoids the situation in which the feature code storage space is insufficient to store more types of feature codes due to the need to send multiple repeated feature codes to the feature code storage space due to the uncertain position of the abnormal feature in the detection message. It can realize anomaly detection of data messages based on more types of feature codes, thereby improving the accuracy of anomaly detection of data messages.

[0030] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] Figure 1 It is a schematic diagram of a feature code matching method in the prior art;

[0033] Figure 2 is a flow chart of a data packet detection method provided according to Embodiment 1 of the present invention;

[0034] Figure 3 is a flow chart of another data packet detection method provided according to Embodiment 2 of the present invention;

[0035] Figure 4 is a flow chart of another data packet detection method provided according to Embodiment 3 of the present invention;

[0036] Figure 5 is a structural schematic diagram of a data packet detection device provided according to Embodiment 4 of the present invention;

[0037] Figure 6 It is a schematic diagram of the structure of an electronic device provided by Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0038] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0039] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0040] Embodiment 1

[0041] Figure 2 It is a flow chart of a data packet detection method provided according to Example 1 of the present invention. This embodiment is applicable to the situation where data packets are detected through feature codes. The method can be executed by a data packet detection device. The data packet detection device can be implemented in the form of hardware and / or software. The data packet detection device can be configured in an electronic device such as a computer.

[0042] like Figure 2 As shown, a data packet detection method disclosed in this embodiment includes:

[0043] S110: Locate the data payload in the detection message, and obtain a target number of bytes from the current detection point of the data payload as a comparison index.

[0044] In this embodiment, the detection message may be a data message including a header, a data payload, and a tail. The current detection point is initialized to the starting position of the data payload. The target number may be any integer not less than 1 and not greater than the number of bytes contained in the data payload.

[0045] Exemplarily, assuming that the current detection point is the starting position of the data payload, a target number of bytes may be obtained from the starting position of the data payload as a comparison index.

[0046] S120: Match the comparison index with a pre-established target comparison table, where the target comparison table is constructed according to the first target number of bytes of each feature code used to detect the data message.

[0047] In this embodiment, the feature code can be used to detect whether there is an abnormality in the data message.

[0048] In this step, specifically, the first target number of bytes of each feature code may be obtained according to the target comparison table, and the first target number of bytes of each feature code may be used as a feature index to match the comparison index.

[0049] S130: If the comparison index hits the target comparison table, a target feature code corresponding to the hit result is obtained, and a comparison field adapted to the target feature code is obtained from the current detection point to match the target feature code.

[0050] In this step, specifically, if the comparison index matches any feature index, the target feature code corresponding to the hit result is obtained, and according to the number of bytes contained in the target feature code, the comparison field adapted to the target feature code is obtained from the current detection point, wherein the number of bytes in the comparison field is equal to the number of bytes in the target feature code.

[0051] S140: If the comparison field matches the target feature code successfully, an abnormal prompt is given for the detected message.

[0052] In this step, specifically, if the comparison field matches the target feature code successfully, an abnormal prompt can be given to the detection message according to the abnormal situation pointed to by the target feature code. If the comparison field does not match the target feature code, after determining the new current detection point, return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

[0053] S150: If the comparison index does not hit the target comparison table, after determining a new current detection point, return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

[0054] In this step, specifically, if the comparison index does not match any feature index, then after offsetting the current detection point to obtain a new current detection point, return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

[0055] The technical solution of this embodiment is to locate the data payload in the detection message, and obtain the target number of bytes from the current detection point of the data payload as the comparison index, wherein the current detection point is initialized to the starting position of the data payload; match the comparison index with a pre-established target comparison table, the target comparison table is constructed according to the first target number of bytes of each feature code used to detect the data message; if the comparison index hits the target comparison table, obtain the target feature code corresponding to the hit result, and obtain the comparison field adapted to the target feature code from the current detection point to match the target feature code; if the comparison field matches the target feature code successfully, the detection The message prompts an exception; if the comparison index does not hit the target comparison table, or the comparison field does not match the target feature code, then after determining the new current detection point, return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed. This technical means solves the problem that due to the uncertain position of the abnormal feature in the detection message, multiple repeated feature codes need to be sent to the feature code storage space, resulting in insufficient feature code storage space to store more types of feature codes. It can realize anomaly detection of data messages based on more types of feature codes, thereby improving the accuracy of anomaly detection of data messages.

[0056] Embodiment 2

[0057] Figure 3 It is a flowchart of another data packet detection method provided according to the second embodiment of the present invention. This embodiment is a further optimization and expansion based on the above embodiments, and can be combined with various optional technical solutions in the above implementation methods.

[0058] like Figure 3 As shown, a data packet detection method disclosed in this embodiment includes:

[0059] S210: Locate the data payload in the detection message, and obtain a target number of bytes from the current detection point of the data payload as a comparison index.

[0060] The current detection point is initialized to the starting position of the data payload.

[0061] Optionally, after locating the data payload in the detection message, the data payload may be stored in a cache memory, so that the message header offset does not need to be calculated first when searching for the starting position of the payload, thereby improving the efficiency of obtaining the comparison index.

[0062] S220: Obtain at least one feature code for detecting the data message, and starting from the start byte of each feature code, obtain a target number of bytes in each feature code as feature indexes corresponding to each feature code.

[0063] In this step, specifically, at least one basic feature code that matches the data message, and / or an extended feature code corresponding to the basic feature code can be used as a feature code for detecting the data message, and starting from the starting byte of each feature code, the first target number of bytes in each feature code are obtained as feature indexes corresponding to each feature code.

[0064] Optionally, obtaining at least one feature code for detecting a data message specifically includes: obtaining at least one basic feature code that matches the data message; obtaining a target basic feature code for feature code extension in each basic feature code; locating an extension area in the target basic feature code, and calculating a basic field value corresponding to all fields in the extension area; calculating at least one extension field value that matches the basic field value according to a preset extension method, and respectively determining a target extension field corresponding to each extension field value; using at least one target extension field to replace all fields in the extension area of ​​the target basic feature code, respectively, to obtain at least one extended feature code; and using the basic feature code and the extended feature code together as a feature code for detecting a data message.

[0065] Among them, the byte lengths of each basic feature code are the same or different. There can be multiple preset extension methods, such as incrementing the basic field value according to a set fixed value. The basic feature code, the target extension field and the extended feature code have the same base system, such as binary. The base field value and the extended field value have the same base system, such as decimal.

[0066] Exemplarily, assuming that the target basic feature code is aaa001bbb, the extended area in aaa001bbb can be located as 001, and the basic field value corresponding to 001 can be calculated as 1. Then, the basic field value can be added by 1 according to the set extension number to obtain 99 extended field values ​​from 2 to 100. After that, each extended field value can be converted into a binary target extended field, and each target extended field can be used to replace all the fields in the extended area of ​​the target basic feature code to obtain 99 extended feature codes. Finally, the basic feature code and the extended feature code can be used together as feature codes for detecting data packets to improve the efficiency of obtaining different types of feature codes.

[0067] S230, calculating the decimal value corresponding to each feature index, and taking each decimal value as a row number, organizing each feature code according to its row number to generate a target comparison table.

[0068] In this step, specifically, the maximum decimal value corresponding to the target number of bytes can be calculated, and the maximum decimal value can be used as the number of rows to generate a comparison table to be filled. Then, each feature code can be added to the comparison table to be filled according to the decimal value corresponding to each feature index, thereby obtaining a target comparison table.

[0069] Optionally, the target comparison table may be stored in a cache memory to increase the speed of acquiring the feature code, thereby improving the efficiency of abnormality detection of data packets.

[0070] S240, calculate the comparison decimal value corresponding to the comparison index, and detect whether the target comparison table stores at least one feature code under the target row number corresponding to the comparison decimal value. If so, execute S250, if not, return to execute S210 after executing S270, until the detection of all data payloads is completed.

[0071] In this embodiment, the target row number may be equal to the comparison decimal value corresponding to the comparison index.

[0072] S250: Obtain a target feature code corresponding to the hit result, and obtain a comparison field adapted to the target feature code from the current detection point to match the target feature code.

[0073] S260: If the comparison field matches the target feature code successfully, an abnormal prompt is given for the detection message.

[0074] Specifically, after matching the comparison field with the target feature code, it also includes: if the comparison field does not match the target feature code, after determining the new current detection point, return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

[0075] S270: Determine a new current detection point.

[0076] In this step, specifically, the current detection point of the data payload can be used as the starting point to increment the target number of bytes to obtain a new current detection point. The target number can be determined according to user needs. For example, assuming that the current detection point is the starting position of the data payload, the next position of the starting position of the data payload can be used as the new current monitoring point.

[0077] The technical solution of this embodiment is to calculate the decimal value corresponding to each feature index, and use each decimal value as the row number, organize each feature code according to its row number to generate a target comparison table; calculate the comparison decimal value corresponding to the comparison index, and detect whether the target comparison table stores at least one feature code under the target row number corresponding to the comparison decimal value. If so, obtain the target feature code corresponding to the hit result, and obtain the comparison field adapted to the target feature code from the current detection point to match the target feature code; if the comparison field matches the target feature code successfully, an abnormal prompt is given to the detection message; if not, determine After the new current detection point is reached, it returns to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed. The starting position of the target feature code in the data payload can be quickly determined by detecting whether there is a target row number equal to the comparison decimal in the target comparison table, thereby avoiding the situation where multiple repeated feature codes need to be sent to the feature code storage space due to the uncertain position of the abnormal feature in the detection message, reducing the occupancy of the feature code storage space, and realizing anomaly detection of data messages based on more types of feature codes, thereby improving the accuracy of anomaly detection of data messages.

[0078] Embodiment 3

[0079] Figure 4 It is a flowchart of another data packet detection method provided according to Example 3 of the present invention. This embodiment is a further optimization and expansion based on the above embodiments, and can be combined with various optional technical solutions in the above implementation methods.

[0080] like Figure 4 As shown, a data packet detection method disclosed in this embodiment includes:

[0081] S310: Locate the data payload in the detection message, and obtain a target number of bytes from the current detection point of the data payload as a comparison index.

[0082] The current detection point is initialized to the starting position of the data payload.

[0083] S320: Obtain at least one feature code for detecting the data message, and starting from the start byte of each feature code, obtain a target number of bytes in each feature code as feature indexes corresponding to each feature code.

[0084] S330, calculating the feature hash value corresponding to each feature index, and generating a target comparison table based on each feature hash value.

[0085] S340, calculate the comparison hash value corresponding to the comparison index, and query whether the target comparison table stores a feature hash value equal to the comparison hash value. If so, execute S350. If not, return to execute S310 after executing S370 until the detection of all data payloads is completed.

[0086] S350: Obtain a target feature code corresponding to the hit result, and obtain a comparison field adapted to the target feature code from the current detection point to match the target feature code.

[0087] S360: If the comparison field matches the target feature code successfully, an abnormal prompt is given for the detection message.

[0088] S370: Determine a new current detection point.

[0089] The technical solution of this embodiment calculates the feature hash value corresponding to each feature index, and generates a target comparison table according to each feature hash value; calculates the comparison hash value corresponding to the comparison index, and queries whether the target comparison table stores a feature hash value equal to the comparison hash value. If so, obtains the target feature code corresponding to the hit result, and obtains the comparison field adapted to the target feature code from the current detection point to match the target feature code; if the comparison field matches the target feature code successfully, an abnormal prompt is given for the detection message; if not, after determining the new current detection point, returns The operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload is executed until the detection of the entire data payload is completed. The starting position of the target feature code in the data payload can be determined by querying whether the target comparison table stores a feature hash value equal to the comparison hash value. This avoids the situation where feature matching needs to be performed based on multiple repeated feature codes due to the uncertain position of the abnormal feature in the detection message, saves feature code storage space, and can realize anomaly detection of data messages based on more types of feature codes, thereby improving the accuracy of anomaly detection of data messages.

[0090] Embodiment 4

[0091] Figure 5 It is a structural diagram of a data packet detection device provided according to Example 4 of the present invention. This embodiment can be applied to the situation where data packets are detected according to feature codes. The data packet detection device can be implemented in the form of hardware and / or software and can be configured in an electronic device such as a computer.

[0092] like Figure 5 As shown, the data packet detection device disclosed in this embodiment includes: a comparison index acquisition module 51, an index matching module 52, a feature code matching module 53, an abnormality prompt module 54 and a cyclic matching module 55, wherein:

[0093] A comparison index acquisition module 51 is used to locate the data payload in the detection message and obtain a target number of bytes from the current detection point of the data payload as a comparison index, wherein the current detection point is initialized to the starting position of the data payload;

[0094] An index matching module 52, used to match the comparison index with a pre-established target comparison table, where the target comparison table is constructed based on the first target number of bytes of each feature code used to detect the data message;

[0095] The feature code matching module 53 is used to obtain the target feature code corresponding to the hit result if the comparison index hits the target comparison table, and obtain the comparison field adapted to the target feature code from the current detection point to match the target feature code;

[0096] The abnormality prompt module 54 is used to provide an abnormality prompt for the detected message if the comparison field matches the target feature code successfully;

[0097] The loop matching module 55 is used to return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload if the comparison index does not hit the target comparison table, or the comparison field does not match the target feature code, after determining the new current detection point, until the detection of the entire data payload is completed.

[0098] The technical solution in this embodiment solves the problem that the position of the abnormal feature in the detection message is uncertain, and multiple repeated feature codes need to be sent to the feature code storage space, resulting in insufficient feature code storage space to store more types of feature codes, through the mutual cooperation of the comparison index acquisition module, the index matching module, the feature code matching module, the exception prompt module and the loop matching module. It can realize anomaly detection of data messages based on more types of feature codes, thereby improving the accuracy of anomaly detection of data messages.

[0099] Optionally, the device also includes a first target comparison table generation module, which is used to: obtain at least one feature code for detecting a data message; starting from the starting byte of each feature code, obtain a target number of bytes in each feature code as feature indexes corresponding to each feature code; calculate the decimal values ​​corresponding to each feature index, and use each decimal value as a row number to organize each feature code according to its row number to generate a target comparison table.

[0100] Optionally, the index matching module 52 is specifically used to: calculate a comparison decimal value corresponding to the comparison index, and detect whether the target comparison table stores at least one feature code under the target row number corresponding to the comparison decimal value; if so, determine that the comparison index hits the target comparison table, otherwise, determine that the comparison index does not hit the target comparison table.

[0101] Optionally, the device also includes a second target comparison table generating module, which is used to: obtain at least one feature code for detecting data packets; starting from the starting byte of each feature code, obtain a target number of bytes in each feature code as feature indexes corresponding to each feature code; calculate feature hash values ​​corresponding to each feature index, and generate a target comparison table based on each feature hash value.

[0102] Optionally, the index matching module 52 is also specifically used to: calculate the comparison hash value corresponding to the comparison index, and query whether a feature hash value equal to the comparison hash value is stored in the target comparison table; if so, determine that the comparison index hits the target comparison table, otherwise, determine that the comparison index does not hit the target comparison table.

[0103] Optionally, the circular matching module 55 is specifically configured to: take the current detection point of the data payload as a starting point and increment the target number of bytes to obtain a new current detection point.

[0104] Optionally, obtaining at least one feature code for detecting a data message specifically includes: obtaining at least one basic feature code that matches the data message; obtaining a target basic feature code for feature code extension in each basic feature code; locating an extension area in the target basic feature code, and calculating a basic field value corresponding to all fields in the extension area; calculating at least one extension field value that matches the basic field value according to a preset extension method, and respectively determining a target extension field corresponding to each extension field value; using at least one target extension field to replace all fields in the extension area of ​​the target basic feature code, respectively, to obtain at least one extended feature code; and using the basic feature code and the extended feature code together as a feature code for detecting a data message.

[0105] The data packet detection device provided in the embodiment of the present invention can execute the data packet detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For the contents not described in detail in this embodiment, reference can be made to the description in any method embodiment of the present application.

[0106] Embodiment 5

[0107] Figure 6 FIG. 1 is a schematic diagram showing the structure of an electronic device 10 that can be used to implement an embodiment of the present invention. Figure 6As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0108] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0109] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a data packet detection method.

[0110] In some embodiments, the data packet detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data packet detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the data packet detection method in any other appropriate manner (e.g., by means of firmware).

[0111] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0112] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0113] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0114] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0115] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0116] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0117] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0118] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data message detection method, characterized in that: The method comprises: Locate the data payload in the detection message, and obtain a target number of bytes from the current detection point of the data payload as a comparison index, wherein the current detection point is initialized to the starting position of the data payload; Matching the comparison index with a pre-established target comparison table, where the target comparison table is constructed based on the first target number of bytes of each feature code used to detect the data message; If the comparison index hits the target comparison table, the target feature code corresponding to the hit result is obtained, and the comparison field adapted to the target feature code is obtained from the current detection point to match the target feature code; If the comparison field matches the target signature successfully, an abnormal prompt will be given for the detected message; If the comparison index does not hit the target comparison table, or the comparison field does not match the target feature code, after determining the new current detection point, return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

2. The method according to claim 1, characterized in that Before matching the alignment index with the pre-built target alignment table, it also includes: Obtaining at least one feature code for detecting a data message; Starting from the starting byte of each feature code, a target number of bytes are obtained in each feature code as feature indexes corresponding to each feature code; The decimal value corresponding to each feature index is calculated, and each decimal value is used as a row number. Each feature code is organized according to its row number to generate the target comparison table.

3. The method according to claim 2, characterized in that Match the alignment index to a pre-built target alignment table, including: Calculate a comparison decimal value corresponding to the comparison index, and detect whether the target comparison table stores at least one feature code under the target row number corresponding to the comparison decimal value; If so, it is determined that the comparison index hits the target comparison table, otherwise, it is determined that the comparison index does not hit the target comparison table.

4. The method according to claim 1, characterized in that: Before matching the alignment index with the pre-built target alignment table, it also includes: Obtaining at least one feature code for detecting a data message; Starting from the starting byte of each feature code, a target number of bytes are obtained in each feature code as feature indexes corresponding to each feature code; The feature hash value corresponding to each feature index is calculated, and the target comparison table is generated according to each feature hash value.

5. The method according to claim 4, characterized in that Match the alignment index to a pre-built target alignment table, including: Calculate the comparison hash value corresponding to the comparison index, and query whether the target comparison table stores a feature hash value equal to the comparison hash value; If so, it is determined that the comparison index hits the target comparison table, otherwise, it is determined that the comparison index does not hit the target comparison table.

6. The method according to claim 1, characterized in that Determining the new current detection point specifically includes: Taking the current detection point of the data payload as the starting point, increment the target number of bytes to obtain a new current detection point.

7. The method according to claim 2, characterized in that Acquiring at least one feature code for detecting a data message, specifically comprising: Obtaining at least one basic feature code matching the data message; Obtaining a target basic feature code for feature code expansion from each basic feature code; Locating an extended area in the target basic feature code, and calculating basic field values ​​corresponding to all fields in the extended area; According to a preset extension method, at least one extension field value matching the basic field value is calculated, and a target extension field corresponding to each extension field value is determined respectively; Using at least one target extended field to replace all fields in the extended area of ​​the target basic feature code respectively, to obtain at least one extended feature code; The basic feature code and the extended feature code are used together as feature codes for detecting data packets.

8. A data message detection device, characterized in that: The device comprises: A comparison index acquisition module is used to locate the data payload in the detection message and obtain a target number of bytes from the current detection point of the data payload as a comparison index, wherein the current detection point is initialized to the starting position of the data payload; An index matching module, used to match the comparison index with a pre-established target comparison table, where the target comparison table is constructed based on the first target number of bytes of each feature code used to detect the data message; The feature code matching module is used to obtain the target feature code corresponding to the hit result if the comparison index hits the target comparison table, and obtain the comparison field adapted to the target feature code from the current detection point to match the target feature code; The abnormality prompt module is used to prompt the detected message for abnormality if the comparison field matches the target feature code successfully; The loop matching module is used to determine the new current detection point if the comparison index does not hit the target comparison table, or the comparison field does not match the target feature code, and then return to execute the operation of obtaining the target number of bytes as the comparison index from the current detection point of the data payload until the detection of the entire data payload is completed.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data packet detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data packet detection method according to any one of claims 1 to 7 when executed.

Images