A real-time flow retention method, program product, electronic device and storage medium

Abstract

Embodiments of the present application provide a real-time traffic retention method, a program product, an electronic device and a storage medium, and relate to the technical field of network security. The method comprises detecting each data packet in a network session based on a retention rule to determine whether the retention rule is hit; if the data packet does not hit the retention rule but is configured to need to be cached, caching the current data packet through a pre-set cache memory pool; when any subsequent data packet hits the retention rule, recording the position of the data packet in the network session in a pre-set retention private area, writing the previously cached data packet into a pcap file, and retaining all subsequent data packets. The method sets a retention rule to achieve the purpose of retaining effective data without burdening the device, thereby solving the problem of heavy device burden caused by full-flow retention.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a real-time traffic retention method, a program product, an electronic device and a storage medium. BACKGROUND

[0002] In the field of network security, it is often necessary to retain certain specific traffic for analysis and future blocking to ensure that the network is not attacked. The existing method is usually full traffic retention. However, in a network with large traffic, if full traffic retention is performed, the performance and capacity requirements of the retention device are very high, which can cause a large device burden. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a real-time traffic retention method, a program product, an electronic device and a storage medium, which sets retention rules to achieve the purpose of retaining effective data without burdening the device, and solves the problem of a large device burden caused by full traffic retention.

[0004] The embodiments of the present application provide a real-time traffic retention method, which comprises:

[0005] Detecting each data packet in a network session based on a retention rule to determine whether the retention rule is hit;

[0006] If the data packet does not hit the retention rule but is configured to need to be cached, the current data packet is cached through a pre-set cache memory pool.

[0007] When any subsequent data packet hits the retention rule, the position of the data packet in the network session is recorded in a pre-set retention private area, the previously cached data packet is written into a pcap file, and all subsequent data packets are retained.

[0008] In the above implementation process, when traffic monitoring, the retention rule is set, and the network session that hits the retention rule is saved, achieving the purpose of retaining effective data without burdening the device. The cache memory pool is used to cache the data packets that need to be cached, avoiding frequent memory allocation and release, improving processing efficiency, and solving the problem of a large device burden caused by full traffic retention.

[0009] Further, if the data packet does not hit the retention rule but is configured to need to be cached, the current data packet is cached through a pre-set cache memory pool, comprising:

[0010] If the data packet does not hit the alarm rule, it is determined whether the network session needs to be cached.

[0011] If necessary, it is judged whether the payload length of the data packet is greater than the cache unit block size of the cache memory pool;

[0012] If it is not greater than the cache unit block size, the storage mode of the data packet is set to the cache unit block;

[0013] If it is greater than the cache unit block size, temporary memory is applied to the data packet in a dynamic allocation manner;

[0014] The data packet is stored in the cache linked list of the reserved private area.

[0015] In the above implementation process, different cache modes are adopted for data packets of different sizes, which improves processing efficiency and avoids frequent memory application or release operation frequency, and the operation is flexible, avoiding packet loss.

[0016] Further, the data packet is stored in the cache linked list of the reserved private area, comprising:

[0017] It is judged whether the number of data packets cached in the current session is over limit;

[0018] If it is not over limit, a node is taken out from the cache memory pool for caching the current data packet, and the node is stored in the cache linked list of the reserved private area;

[0019] If it is over limit, the current data packet is stored in the most initial node to overwrite the most initial node.

[0020] In the above implementation process, the cache linked list is used for data packet storage, which can be stored in the cache linked list according to the number of data packets, and if it is over limit, the old node is overwritten.

[0021] Further, the method further comprises:

[0022] If the data packet hits at least one alarm rule, the evidence identification of the network session is set.

[0023] In the above implementation process, the alarm rule is used as a specific reservation rule, and the session that hits the alarm rule is saved, avoiding full-flow reservation.

[0024] Further, when any data packet hits the reservation rule in the subsequent process, the position of the data packet in the network session is recorded in the pre-set reservation private area, and the previously cached data packet is written into a pcap file, comprising:

[0025] It is judged whether the evidence identification of the data packet is set;

[0026] If set, the pcap file is opened, and the cached data packets in the cache linked list and the current data packet are saved into the pcap file.

[0027] In the above implementation process, the forensic identification is set to indicate that the alarm rule is hit, and the data packet to be set is saved.

[0028] Further, the method further comprises:

[0029] The subsequent data packets are continuously processed, and before the data packets are saved, it is determined whether the pcap file exceeds the file granularity for retention, and if the limit is exceeded, the pcap file is closed in advance.

[0030] In the above implementation process, if the limit is exceeded, the pcap file is closed in advance, the retention of the traffic is stopped, and the pcap file for retention can be prevented from occupying too much disk space.

[0031] Further, the method further comprises:

[0032] When the session ends, a security log of the network session is generated, and the security log includes whether the alarm rule is hit, the alarm rule information, whether the pcap file for retention exists, the pcap file name for retention, the pcap file size, and the position of the data packet that hits the alarm rule.

[0033] In the above implementation process, the security log is generated, and the feature points in each session that need to be retained are recorded for accurate positioning.

[0034] Embodiments of the present application also provide a real-time traffic retention device, and the device comprises:

[0035] An attack detection module is configured to detect each data packet in a network session based on a retention rule to determine whether the retention rule is hit;

[0036] A cache module is configured to cache the current data packet in a pre-set cache memory pool if the data packet does not hit the retention rule but is configured to be cached;

[0037] A retention module is configured to record the position of the data packet in the network session in a pre-set retention private area when any subsequent data packet hits the retention rule, write the previously cached data packet into a pcap file, and retain all the subsequent data packets.

[0038] In the implementation process, in the flow monitoring, a retention rule is set, and a network session that hits the retention rule is saved, so that effective data can be retained and the device is not burdened; the data packets that need to be cached are cached by using the cache memory pool, so that the frequent application and release of memory are avoided, the processing efficiency is improved, and the problem of large device burden caused by full flow retention is solved.

[0039] The embodiment of the application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to execute the real-time flow retention method.

[0040] The embodiment of the application further provides an electronic device, which comprises a memory and a processor, the memory is used to store a computer program, and the processor executes the computer program to enable the electronic device to execute the real-time flow retention method.

[0041] The embodiment of the application further provides a readable storage medium, which stores computer program instructions, and the computer program instructions are read and executed by a processor to execute the real-time flow retention method. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments of the application. It should be understood that the following drawings only show some embodiments of the application, and therefore should not be regarded as a limitation to the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0043] Figure 1 A flow chart of a real-time flow retention method provided by the embodiment of the application;

[0044] Figure 2 A specific flow chart of caching data packets provided by the embodiment of the application;

[0045] Figure 3 A specific flow chart of storing data packets to a cache linked list provided by the embodiment of the application;

[0046] Figure 4 A flow chart of retaining data packets provided by the embodiment of the application;

[0047] Figure 5 A specific flow chart of flow retention provided by the embodiment of the application;

[0048] Figure 6 A structure block diagram of a real-time flow retention device provided by the embodiment of the application.

[0049] Icon:

[0050] 100 - attack detection module; 200 - cache module; 300 - retention module. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

[0052] It should be noted that similar reference numerals and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", and the like are only used to distinguish description, and cannot be understood as indicating or implying relative importance.

[0053] Embodiment 1

[0054] Please refer to Figure 1 , Figure 1 A flowchart of a real-time traffic retention method provided by the embodiments of the present application. The present application solves the problem of high device burden and high capacity requirement caused by directly retaining all traffic without screening by setting retention rules and screening traffic when collecting traffic. The security log used in the present application is intended to record the pcap file name of the current session retention and identify the packet position that needs to be focused on in the traffic, such as abnormal data segments in network attacks. The cache memory pool, retention unit block size, and retention file granularity configuration logic used in the present application are intended to flexibly cope with different types of devices and provide appropriate retention configuration for different capacity environments.

[0055] In the device for monitoring the network environment, the present application reserves space as a cache data packet memory pool and configures the cache packet number and the retention file granularity. Based on the network session, the present application detects the packet data that exists risks to network security and collects the traffic data packets that need to be focused on in real time. The present application generates corresponding security logs to record the features that may pose a threat to network security in the network session and the retention data packet name for analysis. The present application also records the pcap file name of the session retention and identifies the packet position that needs to be focused on in the traffic, such as abnormal data segments in network attacks.

[0056] The present application uses cache memory pool, retention unit block, and retention file granularity configuration to flexibly cope with different types and capacities of devices and provide appropriate retention configuration for them.

[0057] The method specifically includes the following steps:

[0058] Step S100: detecting each data packet in the network session based on the retention rules to determine whether the retention rules are hit;

[0059] For example, the retention rule can be an alarm rule, and if the data packet hits at least one alarm rule, the forensic identification of the network session is set.

[0060] For example, according to specific requirements, the data packet in each network session is detected by an alarm rule, and when a hit is detected, the forensic identification of the data packet is set, and the retention pcap file name is set with the current hit time, and saved in the session; if the same session hits multiple alarm rules, it is necessary to determine whether the forensic identification in the session has been set, and if it has been set, the retention pcap file name is not set repeatedly.

[0061] During traffic monitoring, the session that hits the alarm rule is saved in real time, and the delay of the network monitoring device is small. By setting the retention rule, the device space occupied by the traffic that does not exist risk caused by full traffic retention is avoided.

[0062] Each data packet in the session is detected by an alarm, and each data packet feature exists in the loaded alarm rule, such as the request parameter in the http request, the specific field in the data packet payload, etc. If it is determined that the data packet hits a certain alarm rule or certain alarm rules, the forensic identification of the session is set, that is, the traffic retention of the session is required, and if it does not hit, the forensic identification is not set.

[0063] Step S200: if the data packet does not hit the retention rule, but is configured to require caching, the current data packet is cached through the pre-set cache memory pool;

[0064] The data packet is cached, and the cache here does not mean that the data is saved in the cache in the memory, but means that the message before the session hits the feature is saved, that is, the actual retention after the feature is hit, and the cache before the hit is only cached. When the session protocol is configured to require caching, but the currently detected packet does not hit the feature of the alarm rule, the packet is cached first to ensure the integrity of the session retention.

[0065] Cache memory pool: the data packet cached by the traffic retention is all data packets, so the size of the unit block cached each time can be fixed, and a memory pool is directly allocated at the initialization time. When the packet is cached at runtime, there is no need to frequently allocate / free (allocate memory / free memory), and the cache unit block in the memory pool is directly taken and returned, improving the efficiency.

[0066] Cache unit block: the size of each memory block in the cache memory pool for caching message data is fixed, and the size of each memory block is the size of the cache unit block, which is measured in bytes. The value can refer to the mtu (maximum transmission unit) in the network.

[0067] If the session protocol is configured to require caching, but the current detected packet does not hit the retention rule, the packet is cached first to ensure the integrity of the network session retention.

[0068] Step S300: When any subsequent packet hits the retention rule, the position of the packet in the network session is recorded in the pre-set retention private area, the previously cached packet is written into the pcap file, and all subsequent packets are retained.

[0069] When a packet in the session hits the feature in the alarm rule, the position of the current packet in the session is recorded in the retention private area; the cached packet in this session is written into the pcap file, and all packets after the session are retained.

[0070] Different processing methods are performed according to the size of the specific packet: if the packet is smaller than the size of the retention unit block, the unit block in the memory pool is used, and needs to be returned after use; if the packet is larger than the normal size, the dynamic allocation method is used, and needs to be released after use. As shown in the specific flowchart for caching packets, step S200 specifically includes the following steps: Figure 2

[0071] Step S210: If the packet does not hit the alarm rule, it is determined whether the network session requires caching;

[0072] Step S220: If it requires, it is determined whether the payload length of the packet is greater than the cache unit block size of the cache memory pool;

[0073] Step S230: If it is not greater than the cache unit block size, the storage mode of the packet is set to the cache unit block;

[0074] Step S240: If it is greater than the cache unit block size, temporary memory is applied to the packet in a dynamic allocation manner;

[0075] Dynamic application: for example, in the C language development process, malloc, calloc and other functions can be used to allocate memory according to the actual size. The additional dynamic allocation retention mode is provided for different packet lengths, which is flexible in operation and avoids packet loss.

[0076] In the present application, the memory pool is applied when running initialization. Compared with dynamic application at runtime, the memory pool has the following advantages: saving memory application and release time; avoiding memory fragmentation.

[0077] Using the cache memory pool, in the retention process, frequent memory application and release are avoided, the use frequency of dynamic memory is reduced, and the processing efficiency is improved. ​

[0078] Step S250: store the data packet into the cache linked list of the retention private area.

[0079] As shown in the specific flowchart of storing the data packet into the cache linked list, step S250 specifically includes the following steps: Figure 3

[0080] Step S251: determine whether the number of data packets cached in the current session exceeds the limit;

[0081] Step S252: if not, take a node from the cache memory pool for caching the current data packet, and store the node into the cache linked list of the retention private area;

[0082] After taking a node from the memory pool for caching the current data packet, the node is stored into the cache linked list of the retention private area.

[0083] Step S253: if the limit is exceeded, store the current data packet into the most initial node to overwrite the most initial node.

[0084] As shown in the flowchart of retaining the data packet, step S300 specifically includes the following steps: Figure 4

[0085] Step S301: determine whether the forensic identification of the data packet is set;

[0086] Step S302: if set, open the pcap file, and save the data packets cached in the cache linked list and the current data packet into the pcap file.

[0087] The method further includes: continuously processing subsequent data packets, and before saving the data packets, determining whether the pcap file exceeds the retention file granularity, and if the limit is exceeded, closing the pcap file in advance.

[0088] The retention file granularity refers to the upper limit of the size of each pcap file retained.

[0089] Since it is necessary to prevent the retention pcap message file from occupying too much disk space, it is necessary to limit the size of the pcap message file retained by each session. Specifically, before opening the file for data packet retention, it is necessary to determine whether the size of the current pcap file exceeds the limit, and if the limit is exceeded, the file is closed in advance to stop the retention of traffic.

[0090] Similarly, during retention, different processing methods are used according to the size of the specific data packet: if the data packet is smaller than the size of the retention unit block, the unit block in the memory pool is used, and after use, it needs to be returned; if the data packet exceeds the normal size, the dynamic allocation method is used, and after use, it needs to be released.​​

[0091] At the end of the session, a security log of the network session is generated, the security log including whether an alarm rule is hit, the alarm rule information, whether a retained pcap file exists, a retained pcap file name, a pcap file size, and a position of a packet hitting the alarm rule.

[0092] A security log is generated, and a feature point of interest in each session that needs to be retained is recorded, so as to accurately locate.

[0093] When the session ends, a private area applied in the session needs to be cleaned up, and if no alarm rule is hit and no retention is performed, a cache packet link table needs to be cleaned up.

[0094] The retained pcap file needs to save a time of retention of each packet, and therefore, when a cache packet and a retained packet are performed, a storage time at the time is stored into a packet header.

[0095] For example, the application can be applied to alarm evidence collection of attack detection of a network security device in a data security field, such as Figure 5 As shown in a specific flowchart of traffic retention. Specifically, the following steps are included:

[0096] Step S11: system initialization: loading configuration, the configuration including a cache memory pool size that can be opened based on a current device condition, a retention file granularity (namely, a retention pcap packet file size upper limit), and packets that need to be cached (different dimensions can be selected according to a requirement, such as based on an application protocol); creating a memory pool, and initializing a unit memory block therein; loading alarm rules that need to be detected;

[0097] For example, when the system starts, an attack detection module loads alarm rules in an attack detection library; a traffic retention module reads configuration, including but not limited to a memory pool size, a cache unit block size, a cache condition (such as an application protocol dimension, and a cache protocol list is configured), and a retention file granularity; assuming that a data security device is 16g, a memory pool size allocated to the traffic retention module for use is 2g, the traffic retention module creates a 2g memory pool, and initializes a unit block therein.

[0098] Step S12: session start: when a new network session enters the device, a network protocol to which the session belongs is recorded, and initialization of a retention private area is performed, and a cache packet link table is created;

[0099] For example, the data security device starts processing accessed network traffic. The traffic is distinguished by a session, and is taken in a single packet as a unit, first enters an attack detection module, and then enters a traffic retention module, and each module initializes a private area required by itself in the session.

[0100] Step S13: detection: monitoring real-time traffic, and detecting the alarm rule characteristics of the data packets in each session according to specific needs, and setting the evidence identification in the session when the alarm rule is hit;

[0101] The attack detection module detects each data packet in the session to determine whether the loaded alarm rule is hit.

[0102] After the attack detection module hits an alarm for a session, the retention flag in the session is set, and the retention pcap file name is set with the current hit time, and saved in the session; if the same session hits multiple rules, it is necessary to determine whether the retention flag in the session has been set, if it has been set, the retention pcap file name is not set again.

[0103] Step S14: cache: determining whether the current network session needs to be cached, when the session protocol is configured to need to be cached, but the currently detected packet does not hit the alarm, the packet is cached first to ensure the integrity of the session retention;

[0104] Step S15: traffic session retention: when a packet in the session hits the feature in the alarm rule, the position of the current packet in the session is recorded in the private area of the session; the cached packet in the session is written into the pcap file, and all packets after the session are retained;

[0105] When the cache is cached into the cache linked list, it is necessary to determine whether the number of cached data packets exceeds the limit; if not, a node is taken out from the cache linked list for caching the current data packet; if it exceeds the limit, the current data packet is stored in the most initial node to overwrite the most initial node.

[0106] After the data packet in the session reaches the traffic retention module, it is determined whether the retention flag is set to need to be retained.

[0107] If it is not set, it is determined whether the session needs to be cached (such as the application protocol being configured in the cache protocol list), if it needs to be cached, it is determined whether the data packet payload length is not greater than the configured cache unit block size, and the unit block in the memory pool is used and returned; the data packet exceeding the cache unit block size is dynamically allocated, and the memory is released after use. The data packet is stored in the cache linked list in the private area of the session.

[0108] If it is set, the pcap file is opened, and the cached data packet in the cache linked list in the session and the current data packet are saved into the pcap file.

[0109] The data packet is continuously processed; before the retention data packet, it is determined whether the pcap file size exceeds the retention file granularity, and if it exceeds the limit, the file is closed in advance.

[0110] Step S16: Session End: Clean up the private area requested in the session and generate the security log for this session.

[0111] Close the file when the session closes or times out.

[0112] Send the security log for this session. The log contains fields such as whether the alarm rule was hit, alarm rule hit information, and the filename of the pcap file.

[0113] For example, by analyzing security logs and the corresponding retained pcap filenames, measures such as blocking such traffic can be taken to improve network security.

[0114] Example 2

[0115] This application provides a real-time traffic retention device, applied to the real-time traffic retention method in Embodiment 1, such as... Figure 6 The diagram shown is a structural block diagram of a real-time traffic retention device, which includes, but is not limited to:

[0116] The attack detection module 100 is used to detect each data packet in a network session based on retention rules to determine whether a retention rule is hit.

[0117] The caching module 200 is used to cache the current data packet through a pre-set cache memory pool if the data packet does not hit the retention rule but is configured to be cached.

[0118] The retention module 300 is used to record the position of the data packet in the network session in a pre-set retention private area when any subsequent data packet hits the retention rule, write the previously cached data packets into a pcap file, and retain all subsequent data packets.

[0119] The specific implementation process of each module has been described in detail in Example 1, and will not be repeated here.

[0120] This application also provides a computer program product, which includes a computer program that is executed by a processor using the real-time traffic retention method in embodiment 1.

[0121] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor runs the computer program to enable the electronic device to perform the real-time traffic retention method in Embodiment 1.

[0122] The application further provides a readable storage medium, which stores computer program instructions. When the computer program instructions are read and executed by a processor, the real-time traffic retention method in the embodiment 1 is executed.

[0123] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are only schematic, for example, the flow charts and block diagrams in the drawings show the possible implementation architectures, functions and operations of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flow charts or block diagrams can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that, in some alternative implementation manners, the functions noted in the blocks can also occur in different order from that noted in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flow charts, and the combination of blocks in the block diagrams and / or flow charts, can be implemented by a dedicated hardware-based system for implementing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0124] In addition, the functional modules in the various embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0125] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0126] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0127] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0128] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one from another entity or action without necessarily requiring or implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1. A method for real-time flow retention, the method comprising: The method comprises: detecting each data packet in a network session based on a retention rule to determine whether the retention rule is hit; if the data packet does not hit the retention rule but is configured to require caching, caching the data packet through a pre-set cache memory pool; when any subsequent data packet hits the retention rule, recording the position of the data packet in the network session in a pre-set retention private area, writing the previously cached data packet into a pcap file, and retaining all subsequent data packets.

2. The real-time flow retention method of claim 1, wherein, The method of caching the data packet through a pre-set cache memory pool if the data packet does not hit the retention rule but is configured to require caching comprises: if the data packet does not hit the alarm rule, determining whether the network session requires caching; if yes, determining whether the payload length of the data packet is greater than the cache unit block size of the cache memory pool; if no, setting the storage mode of the data packet to the cache unit block; if yes, applying temporary memory to the data packet in a dynamic allocation manner; storing the data packet into a cache linked list of the retention private area.

3. The real-time flow retention method of claim 2, wherein, The method of storing the data packet into a cache linked list of the retention private area comprises: determining whether the number of data packets cached in the current session exceeds the limit; if no, taking a node from the cache memory pool for caching the current data packet, and storing the node into the cache linked list of the retention private area; if yes, storing the current data packet into the most initial node to overwrite the most initial node.

4. The real-time flow retention method of claim 1, wherein, The method further comprises: if the data packet hits at least one alarm rule, setting a forensic identification of the network session.

5. The real-time flow retention method of claim 1, wherein, The method of recording the position of the data packet in the network session in a pre-set retention private area when any subsequent data packet hits the retention rule, writing the previously cached data packet into a pcap file, comprises: determining whether the forensic identification of the data packet is set; if yes, opening the pcap file, and saving the cached data packet in the cache linked list and the current data packet into the pcap file.

6. The real-time flow retention method of claim 5, wherein, The method further comprises: continuously processing subsequent data packets, and determining whether the pcap file exceeds the retention file granularity before saving the data packets, and if yes, closing the pcap file in advance.

7. The real-time flow retention method of claim 1, wherein, The method further comprises: generating a security log of the network session when the session ends, wherein the security log comprises whether the alarm rule is hit, alarm rule information, whether the retention pcap file exists, the retention pcap file name, the pcap file size, and the position of the data packet hitting the alarm rule.

8. A computer program product, characterised in that, The computer program product comprises a computer program, which, when executed by a processor, implements the real-time traffic retention method of any one of claims 1-7.

9. An electronic device, comprising: The electronic device comprises a memory for storing a computer program and a processor for running the computer program to make the electronic device execute the real-time traffic retention method in any one of claims 1 to 7.

10. A readable storage medium, characterized by, The readable storage medium stores computer program instructions, and the computer program instructions are read and run by a processor to execute the real-time traffic retention method in any one of claims 1 to 7.

Images