Network traffic processing method, electronic device, storage medium and computer program product

Abstract

The invention provides a network traffic processing method, electronic equipment, a storage medium and a computer program product, and the method comprises the steps: obtaining network traffic; the network flow is shunted based on the TCP session information of the network flow, so that the network flow is put into at least two processing queues; and sending the network flow to an auditing system server based on a network channel corresponding to the processing queue, so that the auditing system server processes the network flow based on two or more processor cores, each processor core processes the network flow transmitted by one network channel, and the auditing system server sends the network flow to the auditing system server. Each processing queue corresponds to one network channel. According to the invention, the forwarding efficiency of network traffic can be improved.

Description

Technical Field

[0001] The present application relates to the field of network traffic processing, and in particular, to a network traffic processing method, electronic device, storage medium and computer program product. Background Art

[0002] Currently, the traffic proxy forwards the original traffic to the audit system through a public channel. Since there is only one channel, that is, one TCP session, the audit system can only use one processor core for processing, and the other cores are all idle. In this way, the multi-processor core advantage of the audit system is not fully utilized, resulting in poor performance. According to the flow control characteristics of the TCP session itself, the slow processing of the receiving end will cause the sending end to slow down accordingly, which in turn leads to low efficiency of the traffic proxy forwarding the original traffic. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a network traffic processing method, an electronic device, a storage medium and a computer program product to improve the forwarding efficiency of network traffic.

[0004] In a first aspect, the present invention provides a network traffic processing method, the method being applied to a traffic proxy client, the method comprising:

[0005] Get network traffic;

[0006] Diverting the network traffic based on TCP session information of the network traffic to place the network traffic into a processing queue, wherein the processing queues include at least two;

[0007] The network traffic is sent to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted via a network channel, and each processing queue corresponds to a network channel.

[0008] After acquiring network traffic, the method of the first aspect of the present application can divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted by a network channel, and each processing queue corresponds to a network channel. Compared with the prior art, the present application diverts the network traffic to multiple network channels, and then can utilize the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in a network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0009] In an optional implementation manner, obtaining network traffic includes:

[0010] Create a packet capture thread;

[0011] The network traffic flowing through the network card of the traffic proxy client is captured based on the packet capture thread.

[0012] This optional implementation creates a packet capture thread, thereby being able to capture the network traffic flowing through the network card of the traffic proxy client based on the packet capture thread.

[0013] In an optional implementation, creating a packet capture thread includes:

[0014] Determine the number of network cards of the traffic proxy client;

[0015] The packet capture thread is determined based on the number of network cards of the traffic proxy client, wherein each network card corresponds to one packet capture thread.

[0016] This optional implementation manner determines the number of network cards of the traffic proxy client, and thus can determine the packet capture thread based on the number of network cards of the traffic proxy client, wherein each network card corresponds to one packet capture thread.

[0017] In an optional implementation, the network traffic is diverted based on the TCP session information of the network traffic to place the network traffic into a processing queue, including:

[0018] Determine a queue index based on the TCP session information of the network traffic;

[0019] The network traffic is placed into the processing queue based on the queue index.

[0020] This optional implementation can determine the queue index based on the TCP session information of the network traffic, and further can put the network traffic into the processing queue based on the queue index.

[0021] In an optional implementation, determining the queue index based on the TCP session information of the network traffic includes:

[0022] Extracting a five-tuple of the network traffic based on TCP session information of the network traffic;

[0023] A queue index is determined based on the five-tuple of the network traffic.

[0024] This optional implementation can extract the quintuple of the network traffic based on the TCP session information of the network traffic, and further can determine the queue index based on the quintuple of the network traffic.

[0025] In an optional implementation manner, determining a queue index based on the quintuple of the network traffic includes:

[0026] Calculating a hash value of the network traffic based on the quintuple of the network traffic;

[0027] A queue index is determined based on a hash value of the network traffic.

[0028] This optional implementation can calculate the hash value of the network traffic based on the quintuple of the network traffic, and further can determine the queue index based on the hash value of the network traffic.

[0029] In an optional embodiment, the method further comprises:

[0030] The network traffic is parsed to obtain TCP session information of the network traffic.

[0031] This optional implementation can obtain the TCP session information of the network traffic by parsing the network traffic.

[0032] In a second aspect, the present invention provides a network traffic processing device, which is applied to a traffic proxy client, and includes:

[0033] Acquisition module, used to obtain network traffic;

[0034] A traffic diversion processing module, used for diverting the network traffic based on the TCP session information of the network traffic, so as to put the network traffic into a processing queue, wherein the processing queues include at least two;

[0035] A data forwarding module is used to send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted via a network channel, and each processing queue corresponds to a network channel.

[0036] After acquiring the network traffic, the device of the second aspect of the present application can divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted by a network channel, and each processing queue corresponds to a network channel. Compared with the prior art, the present application diverts the network traffic to multiple network channels, and then can utilize the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in a network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0037] In a third aspect, the present invention provides an electronic device, comprising:

[0038] Processor; and

[0039] A memory configured to store machine-readable instructions, which, when executed by the processor, execute the method described in any one of the aforementioned embodiments.

[0040] The electronic device of the third aspect of the present application can, by executing the network traffic processing method, after acquiring the network traffic, divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted by a network channel, and each processing queue corresponds to a network channel. Compared with the prior art, the present application can divert the network traffic to multiple network channels, and then can utilize the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in a network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0041] In a fourth aspect, the present invention provides a storage medium storing a computer program, wherein the computer program is executed by a processor as described in any one of the aforementioned embodiments.

[0042] The storage medium of the fourth aspect of the present application can, by executing the network traffic processing method, after obtaining the network traffic, divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted by a network channel, and each processing queue corresponds to a network channel. Compared with the prior art, the present application can divert the network traffic to multiple network channels, and then can use the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in a network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0043] In a fifth aspect, the present invention provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method described in any one of the claims in the aforementioned implementation methods.

[0044] The computer program product of the fifth aspect of the present application can, by executing the network traffic processing method, after obtaining the network traffic, divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted by a network channel, and each processing queue corresponds to a network channel. Compared with the prior art, the present application can divert the network traffic to multiple network channels, and then can use the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in a network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 It is a flowchart of a network traffic processing method disclosed in an embodiment of the present application;

[0047] Figure 2 It is a schematic diagram of a framework of network traffic processing disclosed in an embodiment of the present application;

[0048] Figure 3 It is a structural schematic diagram of a network traffic processing device disclosed in an embodiment of the present application;

[0049] Figure 4 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0051] Embodiment 1

[0052] See also Figure 1 , Figure 1 1 is a flow chart of a network traffic processing method disclosed in an embodiment of the present application, wherein the method is applied to a traffic proxy client. Figure 1 As shown, the method of the embodiment of the present application includes the following steps:

[0053] 101. Obtain network traffic;

[0054] 102. Divert the network traffic based on the TCP session information of the network traffic to place the network traffic into a processing queue, wherein the processing queues include at least two;

[0055] 103. Send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic incoming through one network channel, and each processing queue corresponds to one network channel.

[0056] After acquiring network traffic, the method of an embodiment of the present application can divert network traffic based on the TCP session information of the network traffic to place the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes network traffic incoming through a network channel, and each processing queue corresponds to a network channel.

[0057] Compared with the prior art, the present application diverts network traffic to multiple network channels, and then utilizes the multi-processor cores of the audit system server to process network traffic in parallel, wherein each processor core processes the network traffic in one network channel, thereby avoiding the slow sending of network traffic by the data source due to the audit system server's failure to process network traffic in a timely manner, thereby improving the network traffic forwarding efficiency.

[0058] For the embodiments of the present application, in some scenarios, if the audit system server cannot quickly process network traffic, the speed at which the network traffic sender sends network traffic will be reduced, wherein the speed at which the network traffic sender sends network traffic is adapted to the speed at which the audit system server processes network power. Furthermore, if the speed at which the network traffic sender sends traffic is reduced, the amount of network traffic forwarded per unit time by the traffic proxy client located between the sender and the audit system server is reduced, that is, the processing efficiency of the traffic proxy client for network traffic is reduced. Based on this, the embodiments of the present application can enable the audit system server to process network traffic in parallel based on multiple processor cores by diverting network traffic, thereby improving the processing speed of network traffic, thereby improving the traffic forwarding efficiency of the traffic proxy client.

[0059] In an embodiment of the present application, diverting network traffic means placing data packets consistent with the TCP session in the same queue and sending them to the audit system server through the same data channel, so that the audit system server uses one processing core to process data incoming through the same data channel.

[0060] It should be noted that, in general, if the network traffic is not diverted, it is difficult for the audit system server to use a multi-processor core to process the network traffic, wherein the process communication restrictions of the multi-processor core and the inconsistency of the data packets make it difficult for the audit system server to use a multi-processor core to process the network traffic. For example, the network traffic includes data packets A, B, and C, and data packets A and C belong to the first TCP session, while data packet B belongs to the second TCP session. At this time, if the audit system server uses the A processor core and the B processor core to process the network traffic, the A processor core will receive data packets A and B, and the B processor core will receive data packet C. At this time, when the A processor core processes the first TCP session, it is necessary to obtain data packet C from the B processor core based on the process communication mechanism. The process communication mechanism has a slow communication efficiency, which still leads to the low efficiency of the audit system server in processing network traffic. In comparison, the embodiment of the present application can send data packets A and C to the A processor core in the audit system server through the same data channel by diverting the network traffic, avoiding the need for the A processor core to obtain data packet C from the B processor core, thereby ensuring that the audit system server can quickly process network traffic through multiple processor cores.

[0061] In the embodiment of the present application, the processing queue may refer to a heap space, where the heap space is a memory area.

[0062] In the embodiment of the present application, the number of processing queues may be two, three, four, etc. The number of processing queues may also be determined according to the data size of the network traffic, or may be set according to the requirements of traffic proxy efficiency.

[0063] In the embodiment of the present application, the audit system server is the audit system server, which is the core component of the audit system. The audit system server processes network traffic by performing protocol analysis on the network traffic to obtain the analysis result; performing lexical and grammatical analysis based on the analysis result to obtain the analysis result, and then performing alarm processing based on the analysis result to obtain the alarm log, and finally saving the alarm log, generating statistical reports based on the alarm log, and generating page display based on the alarm log.

[0064] In an embodiment of the present application, multiple network channels of the traffic proxy client can share the data forwarding pressure of a single network channel, thereby improving the forwarding efficiency of network traffic.

[0065] In the embodiment of the present application, each processing queue corresponds to a network channel, which means that the network channel corresponds to the processing queue one by one, for example, network channel A corresponds to processing queue A, and network channel B corresponds to processing queue B.

[0066] In an embodiment of the present application, the audit system server may include two processing cores, three processing cores, four processing cores, etc.

[0067] In the embodiment of the present application, as an optional implementation, step: obtaining network traffic includes the following sub-steps:

[0068] Create a packet capture thread;

[0069] Capture the network traffic flowing through the network card of the traffic proxy client based on the packet capture thread.

[0070] This optional implementation creates a packet capture thread, thereby being able to capture the network traffic flowing through the network card of the traffic proxy client based on the packet capture thread.

[0071] With respect to the above optional implementation manner, the network card of the traffic proxy client may be used to receive network traffic.

[0072] In the embodiment of the present application, as an optional implementation, step: creating a packet capture thread includes:

[0073] Determine the number of network cards on the traffic proxy client;

[0074] The packet capture thread is determined based on the number of network cards of the traffic proxy client, wherein each network card corresponds to a packet capture thread.

[0075] This optional implementation manner determines the number of network cards of the traffic proxy client, and thus can determine the packet capture threads based on the number of network cards of the traffic proxy client, wherein each network card corresponds to a packet capture thread.

[0076] For the above optional implementation manner, as an example, if the number of network cards of the traffic proxy client is 5, the number of packet capture threads is also 5.

[0077] In the embodiment of the present application, as an optional implementation, the step of: diverting the network traffic based on the TCP session information of the network traffic to put the network traffic into the processing queue includes the following steps:

[0078] Determine the queue index based on TCP session information of network traffic;

[0079] Put network traffic into a processing queue based on the queue index.

[0080] This optional implementation can determine the queue index based on the TCP session information of the network traffic, and further can put the network traffic into the processing queue based on the queue index.

[0081] With respect to the above optional implementation manner, the TCP session information of the network traffic may include information such as the source address and the source port.

[0082] In an embodiment of the present application, as an optional implementation, step: determining the queue index based on the TCP session information of the network traffic includes the following steps:

[0083] Extract the five-tuple of network traffic based on TCP session information of network traffic;

[0084] The queue index is determined based on the five-tuple of network traffic.

[0085] This optional implementation can extract the quintuple of network traffic based on the TCP session information of the network traffic, and further can determine the queue index based on the quintuple of network traffic.

[0086] In the embodiment of the present application, as an optional implementation, step: determining the queue index based on the quintuple of network traffic includes the following steps:

[0087] Calculate the hash value of the network traffic based on the five-tuple of the network traffic;

[0088] The queue index is determined based on the hash value of the network traffic.

[0089] This optional implementation can calculate the hash value of the network traffic based on the quintuple of the network traffic, and further can determine the queue index based on the hash value of the network traffic.

[0090] In the embodiment of the present application, as an optional implementation, the method of the embodiment of the present application further includes the following steps:

[0091] Parse network traffic to obtain TCP session information of network traffic.

[0092] This optional implementation can obtain TCP session information of network traffic by parsing the network traffic.

[0093] For the embodiments of this application, as an example, please refer to Figure 2 , Figure 2 Schematic diagram of a network traffic processing framework disclosed in the embodiment of the present application. Figure 2As shown in the figure, the traffic proxy tool client creates a packet capture thread for each network card to capture traffic. Furthermore, the packet capture thread divides the captured traffic and puts it into the corresponding queue. Each queue corresponds to a separate channel, through which data is sent to the audit system server. Furthermore, the audit system allocates a processor core to each channel according to its own TCP session to process the data sent by the traffic proxy, so that the original traffic is distributed to multiple processor cores for processing.

[0094] In the above example, the traffic proxy tool client creates a packet capture thread for each network card to capture traffic. For example, to capture the traffic of network card 1 and network card 2, thread 1 and thread 2 are created to capture the traffic on the network card in real time without blocking.

[0095] In the above example, the packet capture thread will divert the captured traffic and put it into the corresponding queue. For example, if packet 1 is captured, its five-tuple is hashed to obtain hash value 1, and the subscript value 1 of the queue to be placed is obtained through the hash value, and the packet data is placed in queue 1. Similarly, if packet 2 is captured, its five-tuple is hashed to obtain hash value 2, and the subscript value 1 of the queue to be placed is obtained through the hash value, and the packet data is placed in queue 1; if packet 3 is captured, its five-tuple is hashed to obtain hash value 3, and the subscript value 3 of the queue to be placed is obtained through the hash value, and the packet data is placed in queue 3. At the same time, the data in each queue is continuously sent to the audit system server through their respective channels, such as the data in queue 1 is sent through channel 1, and the data in queue 3 is sent through channel 3.

[0096] In the above example, the audit system server receives the data sent by the traffic proxy and allocates processor cores for processing according to the TCP session of the channel itself. For example, the data of channel 1 is processed on core 2, and the data of channel 3 is processed on core 1. In this way, the original traffic is distributed to multiple processor cores for parallel processing, which improves performance.

[0097] Embodiment 2

[0098] See also Figure 3 , Figure 3 1 is a schematic diagram of the structure of a network traffic processing device disclosed in an embodiment of the present application, wherein the device is applied to a traffic proxy client. Figure 3 As shown, the device of the embodiment of the present application includes the following functional modules:

[0099] 201. An acquisition module, used for acquiring network traffic;

[0100] 202. A traffic diversion processing module, configured to divert network traffic based on TCP session information of the network traffic, so as to place the network traffic into a processing queue, wherein there are at least two processing queues;

[0101] 203. A data forwarding module is used to send network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic incoming from one network channel, and each processing queue corresponds to one network channel.

[0102] After acquiring network traffic, the device of the embodiment of the present application can divert network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic incoming from one network channel, and each processing queue corresponds to one network channel. Compared with the prior art, the present application diverts the network traffic to multiple network channels, and then can utilize the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in one network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0103] It should be noted that for other detailed descriptions of the device in the embodiment of the present application, please refer to the relevant description of the embodiment of the present application, and the embodiment of the present application will not go into details.

[0104] Embodiment 3

[0105] See also Figure 4 , Figure 4 is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application, such as Figure 4 As shown, the electronic device of the embodiment of the present application includes:

[0106] Processor 301; and

[0107] The memory 302 is configured to store machine-readable instructions, and when the instructions are executed by the processor 301, the method of any one of the aforementioned embodiments is executed.

[0108] The electronic device of the embodiment of the present application can, by executing the network traffic processing method, after acquiring the network traffic, divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic incoming from one network channel, and each processing queue corresponds to one network channel. Compared with the prior art, the present application can divert the network traffic to multiple network channels, and then can utilize the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in one network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0109] Embodiment 4

[0110] An embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor as in any of the methods described in the foregoing implementations.

[0111] The storage medium of the embodiment of the present application can, by executing the network traffic processing method, after acquiring the network traffic, divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic incoming from one network channel, and each processing queue corresponds to one network channel. Compared with the prior art, the present application can divert the network traffic to multiple network channels, and then can utilize the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in one network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0112] Embodiment 5

[0113] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, any method claimed in any of the above-mentioned embodiments is implemented.

[0114] The computer program product of the embodiment of the present application can, by executing the network traffic processing method, after obtaining the network traffic, divert the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue, wherein there are at least two processing queues, and then can send the network traffic to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic incoming from one network channel, and each processing queue corresponds to one network channel. Compared with the prior art, the present application can divert the network traffic to multiple network channels, and then can utilize the multi-processor cores of the audit system server to process the network traffic in parallel, wherein each processor core processes the network traffic in one network channel, thereby avoiding the slow sending of network traffic by the data source due to the untimely processing of network traffic by the audit system server, thereby improving the network traffic forwarding efficiency.

[0115] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0116] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0118] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0119] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0120] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A network traffic processing method, characterized in that: The method is applied to a traffic proxy client, and the method includes: Get network traffic; Diverting the network traffic based on TCP session information of the network traffic to place the network traffic into a processing queue, wherein the processing queues include at least two; The network traffic is sent to the audit system server based on the network channel corresponding to the processing queue, so that the audit system server processes the network traffic based on two or more processor cores, wherein each processor core processes the network traffic transmitted via a network channel, and each processing queue corresponds to a network channel.

2. The method according to claim 1, characterized in that Obtaining network traffic includes: Create a packet capture thread; The network traffic flowing through the network card of the traffic proxy client is captured based on the packet capture thread.

3. The method according to claim 2, characterized in that Creating a packet capture thread includes: Determine the number of network cards of the traffic proxy client; The packet capture thread is determined based on the number of network cards of the traffic proxy client, wherein each network card corresponds to one packet capture thread.

4. The method according to claim 1, characterized in that Diverting the network traffic based on the TCP session information of the network traffic to put the network traffic into a processing queue includes: Determine a queue index based on the TCP session information of the network traffic; The network traffic is placed into the processing queue based on the queue index.

5. The method according to claim 4, characterized in that Determining a queue index based on the TCP session information of the network traffic includes: Extracting a five-tuple of the network traffic based on TCP session information of the network traffic; A queue index is determined based on the five-tuple of the network traffic.

6. The method according to claim 5, characterized in that Determining a queue index based on the five-tuple of the network traffic includes: Calculating a hash value of the network traffic based on the quintuple of the network traffic; A queue index is determined based on a hash value of the network traffic.

7. The method according to claim 1, characterized in that The method further comprises: The network traffic is parsed to obtain TCP session information of the network traffic.

8. An electronic device, characterized in that: include: processor; as well as A memory configured to store machine-readable instructions, wherein when the instructions are executed by the processor, the method according to any one of claims 1 to 7 is performed.

9. A storage medium, characterized in that: The storage medium stores a computer program, and the computer program is executed by a processor to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images