A method, system, device and medium for externally parsing private confidentiality agreements

Abstract

The present invention relates to the field of data security. The present invention proposes a method, system, device and medium for externally parsing a private confidentiality protocol. The method includes: obtaining a data packet to be parsed, a checksum, five-tuple information and a TCP / UDP payload extracted from the data packet by a probe; when the probe asynchronously calls an external parsing module through a preset API interface, the checksum, five-tuple information and TCP / UDP payload are passed to the external parsing module; in the external parsing module, the checksum is matched to a private confidentiality protocol rule, and the five-tuple information and the TCP / UDP payload are processed based on the private confidentiality protocol rule to generate a parsing result; and the parsing result is asynchronously returned to the probe. The implementation of the present invention is flexible, safe and highly confidential, improves the parsing efficiency and security of the private confidentiality protocol, realizes asynchronous interaction between the probe and the parsing module, and improves the flexibility of the system.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a method, system, device and medium for externally parsing a private confidentiality protocol. Background Art

[0002] When conducting network intelligent analysis in the market, network probes are used to conduct efficient data analysis of the original traffic, and the analysis results are saved in the database, and then presented to customers through the WEB client report server to meet customer needs for real-time monitoring, fault complaints, fault analysis, reporting and communication and other functions.

[0003] However, there are significant challenges in application protocol parsing, especially when dealing with private and confidential application protocols provided by customers. The traditional process requires customers to define their application protocols in detail, and then technical experts will deeply interpret the contents of these protocols and perform tedious coding implementation work accordingly. This process is not only time-consuming and labor-intensive, but also highly dependent on the technical staff's professional understanding of the protocol and their ability to convert this understanding into code.

[0004] In the scenario where the customer adopts a private confidentiality agreement, the existing solution is particularly inadequate and will lead to the leakage of customer privacy. However, if the customer handles it, the data packets are captured by the network probe and these raw data packets are directly passed to the customer's program. The subsequent data packet analysis and processing, database storage and final presentation of the results through the WEB client report server are all left to the customer to complete, resulting in a significant extension of the project cycle and a sharp increase in development costs, which also makes it impossible to realize this part of the potential economic benefits. Summary of the invention

[0005] Based on the above purpose, the present invention proposes a method for externally parsing a private confidentiality agreement, comprising:

[0006] Get the data packet to be parsed, and the probe extracts the checksum, five-tuple information and TCP / UDP payload from the data packet;

[0007] When the probe asynchronously calls the external parsing module through a preset API interface, the checksum, the five-tuple information and the TCP / UDP payload are passed to the external parsing module;

[0008] In the external parsing module, the private confidentiality protocol rules are matched by the check character, and the five-tuple information and the TCP / UDP payload are processed based on the private confidentiality protocol rules to generate a parsing result;

[0009] The parsing result is asynchronously returned to the probe.

[0010] In some embodiments, the step of obtaining the data packet to be parsed includes:

[0011] Acquire message data, assign a checksum to the message data, and assemble to obtain a data structure;

[0012] Performing logic verification and integrity check on the fields in the data structure;

[0013] The data structure that has passed the logic verification and integrity check is used as the data packet to be parsed.

[0014] In some embodiments, the step of the probe asynchronously calling the external parsing module through a preset API interface includes:

[0015] The probe defines a callback function and stores the callback function in a dictionary;

[0016] Obtain a reference to the callback function and associate the reference to a preset API interface;

[0017] The probe sends a call request through a preset API interface, combines the call request and the reference of the callback function into a request event object, and puts the request event object into a request event queue;

[0018] In response to the request event object being retrieved, a reference to the corresponding callback function is passed as a parameter to the external parsing module.

[0019] In some embodiments, the step of asynchronously returning the parsing result to the probe includes:

[0020] The external parsing module constructs a parsing event object with the reference of the callback function and the parsing result;

[0021] Put the parsing event object into the parsing event queue;

[0022] The probe obtains the event object from the parsing event queue and identifies the parsing result.

[0023] In some embodiments, the step of matching the private confidentiality agreement rule through the check character in the external parsing module includes:

[0024] Extracting a check field from the check character, and matching according to the check field being an updated version of the private confidentiality agreement rule;

[0025] In response to the updated version of the private confidentiality agreement rule being identical to the check field, selecting the corresponding private confidentiality agreement rule;

[0026] In response to the updated version of the private confidentiality agreement rule being different from the verification field, a non-updated label is marked for the corresponding private confidentiality agreement rule.

[0027] In some embodiments, the five-tuple information includes a source IP address, a source port, a destination IP address, a destination port, and a protocol type.

[0028] In some embodiments, the method further comprises:

[0029] The probe performs business logic analysis and statistics according to the analysis results, stores the analysis results in a database, and displays the business logic analysis and statistical results through an interface.

[0030] The present invention proposes a system for externally parsing a private confidentiality protocol, comprising:

[0031] An extraction unit configured to obtain a data packet to be parsed, a checksum, five-tuple information, and a TCP / UDP payload extracted by the probe from the data packet;

[0032] A calling unit, configured to pass the checksum, five-tuple information and TCP / UDP payload to the external parsing module when the probe asynchronously calls the external parsing module through a preset API interface;

[0033] A parsing unit, configured to match the private confidentiality protocol rule through the check character in the external parsing module, process the quintuple information and the TCP / UDP payload based on the private confidentiality protocol rule, and generate a parsing result;

[0034] The returning unit is configured to asynchronously return the parsing result to the probe.

[0035] The present invention provides a computer device, comprising:

[0036] At least one processor; and a memory storing a computer program executable on the processor, wherein the processor executes the steps of the method for externally parsing a private confidentiality agreement when executing the program.

[0037] The present invention proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for externally parsing a private confidentiality agreement are executed.

[0038] The present invention has at least the following beneficial technical effects:

[0039] The present invention proposes a method, system, device and medium for externally parsing a private confidentiality protocol. The method comprises: obtaining a data packet to be parsed, and extracting a checksum, five-tuple information and TCP / UDP payload from the data packet by a probe; when the probe asynchronously calls an external parsing module through a preset API interface, the checksum, five-tuple information and TCP / UDP payload are passed to the external parsing module; in the external parsing module, the checksum is matched to a private confidentiality protocol rule, and the five-tuple information and TCP / UDP payload are processed based on the private confidentiality protocol rule to generate a parsing result; and the parsing result is asynchronously returned to the probe.

[0040] The present invention uses network probes to implement data flow maintenance, statistics, statistical aggregation, KPI information or application data storage in the database, which are difficult to implement. After the customer implements the agreed API, the external parsing module dynamic link library and header file are provided to the probe, which is dynamically linked and executed at runtime. The probe does not need to know the specific content of the customer's private confidentiality agreement, but can still implement the business logic analysis, statistics and interface presentation required by the customer. The implementation method is flexible, safe and highly confidential, which improves the parsing efficiency and security of the private confidentiality agreement, realizes asynchronous interaction between the probe and the parsing module, improves the scalability and flexibility of the system, and ensures the integrity and authenticity of the private agreement through verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A flow chart of a method for externally parsing a private confidentiality agreement provided by the present invention;

[0043] Figure 2 A system module diagram for externally parsing a private confidentiality protocol provided by the present invention;

[0044] Figure 3 A schematic diagram of the structure of an embodiment of a computer device provided by the present invention;

[0045] Figure 4 A schematic diagram of the structure of an embodiment of a computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0046] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention are further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0047] It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are for distinguishing two non-identical entities with the same name or non-identical parameters. It can be seen that "first" and "second" are only for the convenience of expression and should not be understood as limitations on the embodiments of the present invention. The subsequent embodiments will not explain this one by one.

[0048] This invention proposes a method for externally parsing a private confidentiality agreement. Figure 1 ,include:

[0049] S1: Get the data packet to be parsed, and the probe extracts the checksum, five-tuple information and TCP / UDP payload from the data packet;

[0050] S2: When the probe asynchronously calls the external parsing module through a preset API interface, the checksum, the five-tuple information and the TCP / UDP payload are passed to the external parsing module;

[0051] S3: In the external parsing module, the private confidentiality protocol rule is matched through the check character, and the quintuple information and the TCP / UDP payload are processed based on the private confidentiality protocol rule to generate a parsing result;

[0052] S4: Asynchronously returning the parsing result to the probe.

[0053] The external parsing module in the present invention provides a parsing API in the form of a dynamic link library for the probe to call to parse the private protocol.

[0054] When the probe receives a data packet, the probe calls the API of the external parsing module and transmits the 5-tuple and TCP / UDP payload content of the data packet to the external parsing module. After that, the external parsing module parses the TCP / UDP payload content of the data packet according to the private confidentiality protocol rules, and then obtains the desired content, and returns the parsing result to the probe when the parsing is completed. After receiving the parsing result of the external parsing module, the probe performs business logic analysis and statistics, stores the result in a specified database, and presents it in an interface.

[0055] In the present invention, the probe processes data packets on multiple CPU cores and in independent threads concurrently, so the API implementation of the external parsing module needs to be thread-safe.

[0056] In the present invention, the client does not need to deeply understand the details of the protocol or perform complex coding work, because the method of the present invention can automatically parse the private confidentiality agreement externally, which greatly reduces the development burden of the client. It reduces the client's dependence on professional development teams and resources, thereby reducing the overall development cost. Since the parsing process is automatically completed by the method of the present invention, the client does not need to spend a lot of time on protocol interpretation and coding implementation, thereby significantly shortening the project development cycle. Since the parsing process is performed externally, the client's private confidentiality agreement and data will not be exposed to unnecessary third parties, thereby protecting the client's privacy and data security.

[0057] The present invention adopts efficient parsing algorithms and processes, which can quickly and accurately parse private confidentiality protocols, improving the performance and reliability of the overall system. Through the standardized parsing process, human errors are reduced, the accuracy of data processing is improved, and the parsing of multiple private confidentiality protocols is supported. It can easily respond to changes in customer needs and improve the flexibility and scalability of the system. The external parsing method enables the system to easily integrate new parsing modules or update existing modules to adapt to new protocols or protocol changes that may appear in the future.

[0058] In some embodiments, see Figure 1 , the step of obtaining the data packet to be parsed includes:

[0059] Acquire message data, assign a checksum to the message data, and assemble to obtain a data structure;

[0060] Performing logic verification and integrity check on the fields in the data structure;

[0061] The data structure that has passed the logic verification and integrity check is used as the data packet to be parsed.

[0062] The logic verification and integrity check of the present invention can ensure that the data in the field conforms to the expected format, type and range, thereby avoiding the generation of invalid data. Through strict verification, errors in the data can be discovered and corrected in a timely manner, thereby improving the quality of the data. Prevent malicious users from attacking the system by entering illegal data. For fields containing sensitive information, verification can ensure that they are not illegally accessed or tampered with, thereby protecting the security of the system.

[0063] By discovering and correcting errors during the verification phase, the cost of error handling in subsequent data processing can be reduced. For fields that need to be queried frequently, logical verification and integrity verification can ensure the accuracy and consistency of data, thereby optimizing query efficiency and ensuring that fields in the data structure maintain consistency and integrity in multiple links or systems. Verification can ensure that data complies with business rules, thereby supporting the normal operation and decision-making of the business.

[0064] In some embodiments, see Figure 1 The step of the probe asynchronously calling the external parsing module through a preset API interface includes:

[0065] The probe defines a callback function and stores the callback function in a dictionary;

[0066] Obtain a reference to the callback function and associate the reference to a preset API interface;

[0067] The probe sends a call request through a preset API interface, combines the call request and the reference of the callback function into a request event object, and puts the request event object into a request event queue;

[0068] In response to the request event object being retrieved, a reference to the corresponding callback function is passed as a parameter to the external parsing module.

[0069] By placing request event objects into a queue, the system can process these requests on demand and dynamically without having to execute them immediately when the request is sent. This increases the flexibility of the system in processing requests. The callback function allows specific operations to be performed after the request is completed, which supports the asynchronous programming model. The system can wait for the response of the API interface while processing other tasks, and execute the callback function when the response arrives. As the business develops, it is necessary to add new API interfaces or modify existing interfaces. By objectifying request events and placing them in a queue, it is easier to expand and maintain the system because new request processing logic can be easily added to the queue.

[0070] In high-concurrency situations, the system can limit the number of requests processed simultaneously to avoid resource exhaustion. Request queues can be used as part of load balancing to ensure that requests are evenly distributed to different processing units, thereby improving the overall performance of the system. By encapsulating request processing logic in callback functions and objectifying request events, the code can be made more modular. This helps reduce code complexity and improves readability.

[0071] In some embodiments, see Figure 1 , the step of asynchronously returning the parsing result to the probe includes:

[0072] The external parsing module constructs a parsing event object with the reference of the callback function and the parsing result;

[0073] Put the parsing event object into the parsing event queue;

[0074] The probe obtains the event object from the parsing event queue and identifies the parsing result.

[0075] By placing parsing event objects into a queue, the system can process these events asynchronously without waiting for each parsing task to complete. This allows the system to process multiple parsing tasks at the same time, improving overall processing efficiency. The parsing event queue can be used as a tool for resource management. The system can dynamically allocate resources such as CPU, memory, etc. according to the number of events in the queue to optimize resource usage and avoid resource waste. The parsing event queue allows the system to keep event objects in the queue for retries when errors are encountered during the parsing process. This enhances the fault tolerance of the system and ensures that data is not lost due to temporary errors.

[0076] Although parsing events are processed asynchronously, the system can ensure that important parsing tasks are processed first through queue priority settings, thereby providing users with more timely feedback. Through queue scheduling and management, the system can use resources more effectively. At the same time, the parsing event queue can record the processing status, processing time and other information of each parsing event, providing data support for system monitoring and performance analysis. Through visualization tools, administrators can monitor the status of the parsing event queue in real time, such as queue length, processing speed, etc., so as to discover and solve problems in a timely manner.

[0077] In some embodiments, see Figure 1 The step of matching the private confidentiality agreement rule by the verification symbol in the external parsing module includes:

[0078] Extracting a check field from the check character, and matching according to the check field being an updated version of the private confidentiality agreement rule;

[0079] In response to the updated version of the private confidentiality agreement rule being identical to the check field, selecting the corresponding private confidentiality agreement rule;

[0080] In response to the updated version of the private confidentiality agreement rule being different from the verification field, a non-updated label is marked for the corresponding private confidentiality agreement rule.

[0081] By verifying the fields, the updated version of the private confidentiality agreement rules can be accurately matched with the previous version to ensure the accuracy and consistency of the rules, and effectively avoid misoperations when updating the agreement rules, such as incorrectly replacing key content or omitting necessary update items.

[0082] With the help of the check field, the update of private confidentiality agreement rules can be automated, reducing manual intervention and improving update efficiency. When it is found that the private confidentiality agreement rules need to be updated, they can be quickly matched according to the check field and the update process can be completed quickly to ensure the security and compliance of the system or application.

[0083] By matching the checksum field, the compatibility of private confidentiality agreement rules between different platforms or systems can be ensured, avoiding rule conflicts or invalidation caused by platform differences. With the continuous development of technology, private confidentiality agreement rules need to be constantly adjusted and updated. By matching the checksum field, it can be ensured that the rules can adapt to technological changes and maintain their effectiveness and security. The checksum field can be used as a means of verifying the integrity of private confidentiality agreement rules to prevent the rules from being tampered with during transmission or storage. By matching the checksum field, users can enhance their trust in private confidentiality agreement rules and ensure that data and information are fully protected during transmission and storage.

[0084] In some embodiments, see Figure 1 The five-tuple information includes source IP address, source port, destination IP address, destination port and protocol type.

[0085] In network communications, each data packet contains unique five-tuple information. This uniqueness ensures that the data packet will not be confused or mistransmitted during transmission, thereby ensuring the reliability of data transmission.

[0086] In some embodiments, the method further comprises:

[0087] The probe performs business logic analysis and statistics according to the analysis results, stores the analysis results in a database, and displays the business logic analysis and statistical results through an interface.

[0088] The probe uses the analysis results as input and performs analysis using the preset business logic analysis model or algorithm. During the analysis process, the probe screens, cleans, converts, and other operations on the data to ensure the accuracy and consistency of the data. Based on the business logic analysis model, the probe can obtain corresponding analysis results, such as trend prediction and anomaly detection. The probe performs data statistics based on the results of the business logic analysis. The statistical content includes statistical quantities such as the mean, standard deviation, maximum, and minimum values ​​of the data, as well as the distribution, trend, and other characteristics of the data. Through data statistics, the probe can more intuitively display the characteristics and laws of the data.

[0089] The probe displays business logic analysis and statistical results to users through a graphical user interface (GUI) or application program interface (API). The interface displays content in the form of charts, tables, reports, etc., so that users can intuitively understand data and analysis results.

[0090] Through the business logic analysis and statistics of the probe, you can fully explore and utilize the value of data, better understand the rules and trends behind the data, and provide strong support for decision-making. According to the results of business logic analysis, you can find bottlenecks and problems in the business process and improve work efficiency and quality. By displaying business logic analysis and statistical results through the interface, you can easily share data and analysis results, promote data sharing and communication, and improve the application value of data.

[0091] This invention proposes a system for externally parsing private confidentiality protocols, see Figure 2 ,include:

[0092] The extraction unit 100 is configured to obtain the data packet to be parsed, the checksum, the five-tuple information and the TCP / UDP payload extracted by the probe from the data packet;

[0093] The calling unit 200 is configured to pass the check character, the five-tuple information and the TCP / UDP payload to the external parsing module when the probe asynchronously calls the external parsing module through a preset API interface;

[0094] The parsing unit 300 is configured to match the private confidentiality protocol rule through the check character in the external parsing module, process the quintuple information and the TCP / UDP payload based on the private confidentiality protocol rule, and generate a parsing result;

[0095] The returning unit 400 is configured to asynchronously return the parsing result to the probe.

[0096] The present invention uses network probes to implement data flow maintenance, statistics, statistical aggregation, KPI information or application data stored in databases, which are difficult to implement. After the customer implements the agreed API, the external parsing module dynamic link library and header file are provided to the probe, which is dynamically linked and executed at runtime. The network probe does not need to know the specific content of the customer's private confidentiality agreement, but can still implement the business logic analysis, statistics and interface presentation required by the customer. The implementation method is flexible, safe and highly confidential, which improves the parsing efficiency and security of the private confidentiality agreement, realizes asynchronous interaction between the probe and the parsing module, improves the scalability and flexibility of the system, and ensures the integrity and authenticity of the private agreement through verification.

[0097] In some embodiments, the API in the external parsing module of the present invention is clearly defined.

[0098] int moduleXxxInit(void), external parsing module initialization function, called once when the probe starts.

[0099] void moduleXxxClean(void), external parsing module end cleanup function, called once when the probe stops.

[0100] int moduleXxxFlowInit(XxxPktInfo *pktInfo, void** flowModuleDataPtr), external parsing module data flow initialization function, called once each time the probe processes a new data flow (5-tuple), the first parameter pktInfo is the input parameter, the 5-tuple information is passed in, the second parameter is the output parameter, the address of the private data structure memory of the newly applied moduleXxx will be stored. Generally in this function, moduleXxx first performs some initialization operations, then applies for a private data structure memory, saves the information related to this data flow in this memory, so that it can be used in the subsequent data packet parsing, and then saves the address of this memory to the address given by the second parameter.

[0101] XXX_ERR_CODEmoduleXxxFlowParse(XxxPktInfo *pktInfo, unsigned char *payload, int payloadLen, void *flowModuleDataPtr, XxxRetData **retData), external parsing module data flow parsing function, parses payload content, the first four parameters are input parameters, incoming data packet 5-tuple information, 4-layer payload pointer, payload length, the last parameter is the output parameter, save the parsing result information, when the probe parses the 4-layer header of a data packet, call this API once. After moduleXxx completes parsing, apply for memory to save the parsing result in this block of memory and save the memory address to the address specified by the output parameter.

[0102] void moduleXxxFreeRetData(XxxRetData *pRetData), parsing result memory release function, called after the probe has finished using the parsing result data, to release the memory occupied by the parsing result data.

[0103] void moduleXxxFlowClose (XxxPktInfo *pktInfo, void**flowModuleDataPtr), external parsing module data flow end function, called once when the probe detects that TCP transmission ends or UDP transmission times out and there is no data flow. Both parameters are input parameters, passing in 5-tuple information and the private data structure pointer (flowModuleDataPtr) of moduleXxx related to this data flow. In this function, clean up the content related to the data flow and release the memory requested during initialization and parsing.

[0104] Based on the same inventive concept, according to another aspect of the present invention, Figure 3 As shown, an embodiment of the present invention further provides a computer device 30, which includes a processor 310 and a memory 320. The memory 320 stores a computer program 321 that can be run on the processor. When the processor 310 executes the program, the steps of the above method are performed.

[0105] Based on the same inventive concept, according to another aspect of the present invention, Figure 4 As shown, an embodiment of the present invention further provides a computer-readable storage medium 40, which stores a computer program 410 for executing the above method when executed by a processor.

[0106] The embodiment of the present invention may also include a corresponding computer device. The computer device includes a memory, at least one processor, and a computer program stored in the memory and executable on the processor, and the processor executes any one of the above methods when executing the program.

[0107] The memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules in the embodiments of the present application. The processor executes various functional applications and data processing of the device by running the non-volatile software programs, instructions and modules stored in the memory, that is, implementing the above method.

[0108] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In an embodiment, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the local module via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0109] Finally, it should be noted that a person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium of the program can be a disk, an optical disk, a read-only storage memory (ROM) or a random access memory (RAM), etc. The above-mentioned computer program embodiments can achieve the same or similar effects as the corresponding above-mentioned arbitrary method embodiments.

[0110] It will also be appreciated by those skilled in the art that various exemplary logic blocks, modules, circuits and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software or a combination of the two. In order to clearly illustrate this interchangeability of hardware and software, a general description has been given to the functions of various schematic components, blocks, modules, circuits and steps. Whether this function is implemented as software or hardware depends on specific applications and the design constraints imposed on the entire system. Those skilled in the art can implement the function in various ways for each specific application, but this implementation decision should not be interpreted as causing a departure from the disclosed scope of the embodiments of the present invention.

[0111] The above are exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications may be made without departing from the scope disclosed in the embodiments of the present invention. The functions, steps and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. The serial numbers of the embodiments disclosed in the above embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in individual form, they may also be understood as multiple unless explicitly limited to the singular.

[0112] It should be understood that, as used herein, the singular forms "a", "an" are intended to include the plural forms as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and / or" refers to any and all combinations including one or more of the associated listed items.

[0113] A person skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the disclosure of the embodiments of the present invention is limited to these examples; under the idea of ​​the embodiments of the present invention, the technical features in the above embodiments or different embodiments can also be combined, and there are many other changes in different aspects of the above embodiments of the present invention, which are not provided in detail for the sake of simplicity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the embodiments of the present invention.

Claims

1. A method for externally parsing a private confidentiality agreement, characterized in that: include: Obtain the data packet to be parsed, and the probe extracts the checksum, five-tuple information and TCP / UDP payload from the data packet; When the probe asynchronously calls the external parsing module through a preset API interface, the checksum, the five-tuple information and the TCP / UDP payload are passed to the external parsing module; In the external parsing module, the private confidentiality protocol rules are matched by the check character, and the five-tuple information and the TCP / UDP payload are processed based on the private confidentiality protocol rules to generate a parsing result; The parsing result is asynchronously returned to the probe.

2. A method for externally parsing a private confidentiality agreement according to claim 1, characterized in that: The step of obtaining the data packet to be parsed comprises: Acquire message data, assign a checksum to the message data, and assemble to obtain a data structure; Performing logic verification and integrity check on the fields in the data structure; The data structure that has passed the logic verification and integrity check is used as the data packet to be parsed.

3. A method for externally parsing a private confidentiality agreement according to claim 1, characterized in that: The step of the probe asynchronously calling the external parsing module through a preset API interface includes: The probe defines a callback function and stores the callback function in a dictionary; Obtain a reference to the callback function and associate the reference to a preset API interface; The probe sends a call request through a preset API interface, combines the call request and the reference of the callback function into a request event object, and puts the request event object into a request event queue; In response to the request event object being retrieved, a reference to the corresponding callback function is passed as a parameter to the external parsing module.

4. A method for externally parsing a private confidentiality agreement according to claim 3, characterized in that: The step of asynchronously returning the parsing result to the probe comprises: The external parsing module constructs a parsing event object with the reference of the callback function and the parsing result; Put the parsing event object into the parsing event queue; The probe obtains the event object from the parsing event queue and identifies the parsing result.

5. A method for externally parsing a private confidentiality agreement according to claim 1, characterized in that: The step of matching the private confidentiality agreement rule through the verification symbol in the external parsing module includes: Extracting a check field from the check character, and matching according to the check field being an updated version of the private confidentiality agreement rule; In response to the updated version of the private confidentiality agreement rule being identical to the check field, selecting the corresponding private confidentiality agreement rule; In response to the updated version of the private confidentiality agreement rule being different from the verification field, a non-updated label is marked for the corresponding private confidentiality agreement rule.

6. A method for externally parsing a private confidentiality protocol according to claim 1, characterized in that: The five-tuple information includes source IP address, source port, destination IP address, destination port and protocol type.

7. A method for externally parsing a private confidentiality agreement according to claim 1, characterized in that: The method also includes: The probe performs business logic analysis and statistics according to the analysis results, stores the analysis results in a database, and displays the business logic analysis and statistical results through an interface.

8. A system for externally parsing a private confidentiality agreement, characterized in that: include: An extraction unit is configured to obtain a data packet to be parsed, and the probe extracts a checksum, five-tuple information and a TCP / UDP payload from the data packet; A calling unit, configured to pass the checksum, five-tuple information and TCP / UDP payload to the external parsing module when the probe asynchronously calls the external parsing module through a preset API interface; A parsing unit, configured to match the private confidentiality protocol rule through the check character in the external parsing module, process the quintuple information and the TCP / UDP payload based on the private confidentiality protocol rule, and generate a parsing result; The returning unit is configured to asynchronously return the parsing result to the probe.

9. A computer device comprising: at least one processor; and a memory storing a computer program executable on the processor, wherein the processor executes the steps of a method for externally parsing a private confidentiality agreement as described in any one of claims 1 to 7 when executing the program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of a method for externally parsing a private confidentiality agreement as described in any one of claims 1 to 7 are performed.

Images