Mirror data acquisition and transmission method and system, medium and computer equipment

Abstract

The invention discloses a mirroring data acquisition and transmission method and system, a medium and computer equipment, and the method comprises the steps that a mirroring data acquisition device acquires a first data frame when the first data frame passes through a deployment point of the mirroring data acquisition device, and transmits the acquired first data frame to an SDN in a one-way manner; the SDN determines a target default routing system from a plurality of default routing systems based on the first data frame information, repackages according to the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system; and the target default routing system de-encapsulates the second data frame based on a corresponding preset default route to obtain a data packet, and forwards the data packet to target equipment or a network, so that the target equipment or the network executes a corresponding task based on the data packet. According to the invention, the security and stability of an original network are protected, and flexible acquisition and transmission of data resources are realized.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission, and in particular to a method and system, medium, and computer equipment for acquiring and transmitting mirror data. Background Art

[0002] With the rapid development of information technology, the amount of data transmission has shown an explosive growth trend, and network applications have become more and more diversified. In this context, network monitoring, performance optimization, security auditing and other aspects have become particularly important. As a copy of data transmitted on a non-primary path, the acquisition and analysis of mirror data have shown indispensable importance in many key areas. Mirror data is the cornerstone of a deep understanding of network behavior and is essential for troubleshooting network failures, monitoring bandwidth usage, and evaluating network performance. In the field of network security, the capture and analysis of mirror data is a key means of detecting and defending against network attacks and intrusions. Through in-depth analysis of network traffic using mirror data, potential security threats can be discovered in a timely manner and corresponding measures can be taken. In addition, for sensitive industries such as finance and healthcare, mirror data can also help ensure the compliance of data transmission and meet strict regulatory requirements.

[0003] Currently, the acquisition and transmission of mirrored data mainly rely on professional network analysis tools, such as Wireshark and tcpdump. However, after capturing data packets, Wireshark needs to send the data to a local or remote interface for display and analysis. This process will cause delays in a high-traffic network environment. When data packets are sent to the local area, they are often temporarily stored locally, which greatly increases the risk of data leakage. In addition, this tool mainly focuses on the analysis and display of data packets, and lacks sufficient flexibility for data transmission and management in complex network environments. Tcpdump is based on command line operations, and has a high threshold for use for non-technical users. In addition, this tool mainly focuses on the capture and filtering of data packets, but has limitations in the flexibility of data transmission and control of the receiver. In addition, the above two tools are also prone to affect the security and stability of the data source network. Summary of the invention

[0004] In view of this, the present application provides a method and system for acquiring and transmitting mirror data, a storage medium, and a computer device. Through the mirror data acquisition device, the one-way transmission of the first data frame of the mirror is guaranteed, reverse attacks or data tampering are prevented, and security is improved; through SDN, real-time transmission of data resources can be achieved, and the timeliness and efficiency of data resource transmission can be improved; through the default routing system, the original data details can be ensured to be complete and unchanged, thereby ensuring the integrity of data resources. In addition, the embodiment of the present application does not need to store the first data frame of the mirror locally, further ensuring data security; SDN dynamically determines the target default routing system from multiple default routing systems through the first data frame information, which can improve the flexibility of data transmission and management. In addition, the whole process has a high degree of automation and is easy to operate, which is conducive to improving the user experience of non-technical users. The whole process not only protects the security and stability of the original network, but also realizes the flexible acquisition and transmission of data resources, thereby promoting the effective use and monitoring of data resources.

[0005] According to one aspect of the present application, a method for acquiring and transmitting mirrored data is provided, comprising: When the first data frame passes through the deployment point of the mirror data acquisition device, the mirror data acquisition device acquires the first data frame, and unidirectionally transmits the acquired first data frame to the SDN; The SDN determines a target default routing system from multiple default routing systems based on the first data frame information, re-encapsulates the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system; The target default routing system decapsulates the second data frame to obtain a data packet based on the corresponding preset default route, and forwards the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0006] According to another aspect of the present application, a system for acquiring and transmitting mirrored data is provided, comprising: A mirror data acquisition device, used to acquire the first data frame when the first data frame passes through a deployment point of the mirror data acquisition device, and unidirectionally transmit the acquired first data frame to the SDN; The SDN is used to determine a target default routing system from multiple default routing systems based on the first data frame information, re-encapsulate the second data frame according to the target default routing system, and forward the second data frame to the target default routing system; The target default routing system is used to decapsulate the second data frame to obtain a data packet based on the corresponding preset default route, and forward the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0007] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned method for acquiring and transmitting mirror data is implemented.

[0008] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned method for acquiring and transmitting mirror data when executing the program.

[0009] By means of the above technical scheme, the present application provides a method and system for acquiring and transmitting mirrored data, a storage medium, and a computer device. When a first data frame passes through a mirrored data acquisition device, the mirrored data acquisition device can mirror the first data frame, and then the mirrored first data frame is sent to the SDN through the unidirectional transmission channel of the mirrored data acquisition device. Further, the SDN selects the most suitable default routing system from a plurality of pre-configured default routing systems as the target default routing system according to the first data frame information in the first data frame. The SDN can also re-encapsulate the first data frame according to the relevant information in the target default routing system, and after encapsulation, a second data frame can be obtained, and the second data frame is sent to the target default routing system. After receiving the second data frame, the target default routing system decapsulates the second data frame to restore the original data packet, and then forwards the original data packet to the target device or network according to the preset default route corresponding to the target default routing system. Under the premise of not affecting the original network traffic, the embodiment of the present application uses the mirrored data acquisition device, SDN and the default routing system to ensure that the data packet on the original transmission link can be acquired and transmitted to the target device or network. The embodiment of the present application uses a mirror data acquisition device to ensure the one-way transmission of the first data frame of the mirror, prevent reverse attacks or data tampering, and improve security; through SDN, real-time transmission of data resources can be achieved, improving the timeliness and efficiency of data resource transmission; through the default routing system, the original data details can be ensured to be complete and unchanged, thereby ensuring the integrity of data resources. In addition, the embodiment of the present application does not need to store the first data frame of the mirror locally, further ensuring data security; SDN dynamically determines the target default routing system from multiple default routing systems through the first data frame information, which can improve the flexibility of data transmission and management. In addition, the whole process has a high degree of automation and is easy to operate, which is conducive to improving the user experience of non-technical users. The whole process not only protects the security and stability of the original network, but also realizes the flexible acquisition and transmission of data resources, thereby promoting the effective use and monitoring of data resources.

[0010] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1A schematic diagram of a process of acquiring and transmitting mirrored data provided by an embodiment of the present application is shown; Figure 2 A schematic diagram showing a flow chart of another method for acquiring and transmitting mirrored data provided in an embodiment of the present application is shown; Figure 3 A schematic diagram showing a connection relationship of a data diode provided in an embodiment of the present application; Figure 4 A schematic diagram showing a flow chart of another method for acquiring and transmitting mirrored data provided in an embodiment of the present application is shown; Figure 5 A schematic diagram of the structure of a preset forwarding mode determination model provided in an embodiment of the present application is shown; Figure 6 A schematic diagram of a default routing system provided in an embodiment of the present application is shown; Figure 7 A schematic diagram of the structure of a system for acquiring and transmitting mirrored data provided by an embodiment of the present application is shown; Figure 8 A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0012] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0013] In this embodiment, a method for acquiring and transmitting mirrored data is provided. Figure 1 As shown, the method includes: Step 101 : When a first data frame passes through a deployment point of the mirrored data acquisition device, the mirrored data acquisition device acquires the first data frame, and unidirectionally transmits the acquired first data frame to the SDN.

[0014] An embodiment of the present application provides a method for acquiring and transmitting mirror data, which is implemented by a mirror data acquisition device, an SDN (Software Defined Networking) and a default routing system. Specifically, the mirror data acquisition device can be deployed in advance in the original transmission link of the data to be monitored. When the first data frame passes through the mirror data acquisition device, the mirror data acquisition device can mirror the first data frame, while the original first data frame passing through the mirror data acquisition device continues to be transmitted normally without affecting the original network traffic. Then, the mirrored first data frame is sent to the SDN through the unidirectional transmission channel of the mirror data acquisition device. Here, the unidirectional transmission can ensure that the acquired first data frame can only flow from the mirror data acquisition device to the SDN, prevent reverse attacks or data tampering, and improve security.

[0015] Step 102: The SDN determines a target default routing system from multiple default routing systems based on the first data frame information, re-encapsulates the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system.

[0016] After the SDN receives the first data frame, the SDN further selects the most appropriate default routing system from the preconfigured multiple default routing systems as the target default routing system based on the first data frame information in the first data frame. Specifically, the SDN can know the target device or network corresponding to the mirrored first data frame based on the first data frame information, and then select the target default routing system whose final target address is the target device or network. Afterwards, the SDN can also re-encapsulate the first data frame according to the relevant information in the target default routing system, and after encapsulation, the second data frame can be obtained, and the second data frame is sent to the target default routing system. Here, re-encapsulation can include modifying the header information of the first data frame, etc., so that the target address of the second data frame points to the target default routing system.

[0017] Step 103, the target default routing system decapsulates the second data frame to obtain a data packet based on the corresponding preset default route, and forwards the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0018] After receiving the second data frame, the target default routing system decapsulates the second data frame to restore the original data packet, and then forwards the original data packet to the target device or network according to the preset default route corresponding to the target default routing system, so that when the target device or network receives the original data packet, it can perform corresponding tasks according to the data packet. The tasks here can be security monitoring tasks (intrusion detection system (IDS) analysis of traffic characteristics), network diagnosis tasks (packet capture tools restore communication sessions), etc. For example, the target device can be a data monitoring terminal or a data analysis terminal, and after receiving the data packet, it can perform data monitoring tasks or data analysis tasks; the network can be the network where the device that ultimately performs the task is located.

[0019] By applying the technical solution of this embodiment, when the first data frame passes through the mirror data acquisition device, the mirror data acquisition device can mirror the first data frame, and then the mirrored first data frame is sent to the SDN through the unidirectional transmission channel of the mirror data acquisition device. Further, the SDN selects the most suitable default routing system from the preconfigured multiple default routing systems as the target default routing system based on the first data frame information in the first data frame. The SDN can also re-encapsulate the first data frame according to the relevant information in the target default routing system, and after encapsulation, the second data frame can be obtained, and the second data frame is sent to the target default routing system. After receiving the second data frame, the target default routing system decapsulates the second data frame to restore the original data packet, and then forwards the original data packet to the target device or network according to the preset default route corresponding to the target default routing system. Under the premise of not affecting the original network traffic, the embodiment of the present application uses the mirror data acquisition device, SDN and the default routing system to ensure that the data packet on the original transmission link can be acquired and transmitted to the target device or network. The embodiment of the present application uses a mirror data acquisition device to ensure the one-way transmission of the first data frame of the mirror, prevent reverse attacks or data tampering, and improve security; through SDN, real-time transmission of data resources can be achieved, improving the timeliness and efficiency of data resource transmission; through the default routing system, the original data details can be ensured to be complete and unchanged, thereby ensuring the integrity of data resources. In addition, the embodiment of the present application does not need to store the first data frame of the mirror locally, further ensuring data security; SDN dynamically determines the target default routing system from multiple default routing systems through the first data frame information, which can improve the flexibility of data transmission and management. In addition, the whole process has a high degree of automation and is easy to operate, which is conducive to improving the user experience of non-technical users. The whole process not only protects the security and stability of the original network, but also realizes the flexible acquisition and transmission of data resources, thereby promoting the effective use and monitoring of data resources.

[0020] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another method for obtaining and transmitting mirror data is provided, such as Figure 2 As shown, the method includes: Step 201 : When a first data frame passes through a deployment point of the mirrored data acquisition device, the mirrored data acquisition device acquires the first data frame, and unidirectionally transmits the acquired first data frame to the SDN.

[0021] In this embodiment, the mirror data acquisition device may be a data diode. The data entry end of the data diode is connected to the original transmission link of the first data frame, and the data exit end of the data diode is connected to the SDN. Figure 3 As shown, a connection relationship of a data diode in an embodiment of the present application is shown.

[0022] Step 202: the SDN determines the MAC address of the data receiver of the first data frame according to the first data frame information, and determines a first routing device having the same MAC address as the data receiver from a plurality of routing devices with defined MAC addresses included in the SDN.

[0023] In this embodiment, the SDN may include multiple routing devices (such as routers, Ethernet switches that also serve as routing functions, virtual routing devices, etc.). These routing devices are routing devices with defined mac addresses. The mac addresses of these routing devices can be obtained in advance based on statistics. For example, the data that needs to be monitored and acquired can be counted in advance, and then the data recipients corresponding to these data are determined. The mac addresses of these data recipients can be used to define the mac addresses of routing devices in the SDN. In addition, a corresponding default routing system can be configured in advance for each routing device with a defined mac address. Each default routing system contains pre-set data forwarding paths and rules. Each default routing system can correspond to a final target device or network.

[0024] After receiving the first data frame, the SDN can search for a matching routing device in its internally maintained MAC address and routing device mapping table according to the destination MAC address in the first data frame information (i.e., the MAC address of the data receiver). This mapping table is established by the SDN during the initialization or configuration process, and it records the routing device information corresponding to each MAC address.

[0025] Step 203, when there is a first routing device with the same MAC address as the data recipient among the multiple routing devices with defined MAC addresses, the default routing system corresponding to the first routing device is used as the target default routing system, and the first data frame is re-encapsulated according to the address of the target default routing system to obtain a second data frame, and the second data frame is forwarded to the target default routing system through the first routing device.

[0026] In this embodiment, if a first routing device matching the destination mac address is found, the SDN can determine the default routing system to which the first routing device belongs as the target default routing system. After determining the target default routing system, the SDN re-encapsulates the first data frame according to the address of the target default routing system to generate a second data frame. The re-encapsulation process may include operations such as modifying existing header information to indicate the forwarding destination of the re-encapsulated second data frame to the first routing device. After completing the re-encapsulation, the SDN forwards the second data frame to the target default routing system through the previously determined first routing device.

[0027] Step 204: when there is no first routing device with the same MAC address as the data receiver among the multiple routing devices with defined MAC addresses, determine a second routing device in an idle state from the multiple routing devices with defined MAC addresses included in the SDN; when there is a second routing device in an idle state among the multiple routing devices with defined MAC addresses, change the defined MAC address corresponding to the second routing device to the MAC address of the data receiver, and configure the default routing system corresponding to the first data frame according to the second routing device and the MAC address and IP address corresponding to the target device or network, use the newly configured default routing system as the target default routing system corresponding to the second routing device, and according to the address of the target default routing system The first data frame is re-encapsulated to obtain a second data frame, and the second data frame is forwarded to the corresponding target default routing system through the second routing device; when there is no second routing device in an idle state among the multiple routing devices with defined MAC addresses, a third routing device is created based on the MAC address of the data recipient, and the default routing system corresponding to the first data frame is configured according to the third routing device and the MAC address and IP address corresponding to the target device or network, the newly configured default routing system is used as the target default routing system corresponding to the third routing device, and the first data frame is re-encapsulated according to the address of the target default routing system to obtain a second data frame, and the second data frame is forwarded to the corresponding target default routing system through the third routing device.

[0028] In this embodiment, since there may be statistical omissions when defining the mac address of the routing device in advance, or some new data recipients are temporarily added, resulting in the currently defined mac address not being able to fully cover all situations, there may be a situation where the currently defined mac address does not contain the mac address of the data recipient corresponding to the first data frame. At this time, the SDN can check the routing device status information maintained internally to determine whether there is a second routing device in an idle state. Here, the idle state generally means that the routing device is not currently processing any data forwarding tasks, or its processing capacity has not yet reached saturation, which can be specifically judged by indicators such as traffic monitoring, CPU / memory utilization, etc.

[0029] If the SDN finds that there is a second routing device in an idle state after inspection, the SDN can change the defined mac address corresponding to the second routing device to the mac address of the data recipient of the first data frame. After the modification, the routing device will be responsible for processing all data frames sent to the mac address of the data recipient corresponding to the first data frame. Next, the SDN configures the default routing system corresponding to the first data frame according to the mac address and IP address of the target device or network, as well as the information of the second routing device, so that the configured default routing system can successfully forward the data resources from the second routing device to the target device or network. After configuring the new default routing system, the SDN re-encapsulates the first data frame according to the address of the newly configured default routing system, generates a second data frame, and forwards the second data frame to the corresponding target default routing system (that is, the new default routing system configured for the second routing device) through the second routing device.

[0030] If the SDN finds that there is no idle second routing device after checking, the SDN can create a new third routing device based on the mac address of the data recipient of the first data frame. This new device can be a physical device or a virtual device, depending on the implementation and configuration of the SDN. Subsequently, the SDN configures the default routing system corresponding to the first data frame based on the mac address and IP address of the target device or network, as well as the information of the third routing device. After configuring the new default routing system, the SDN re-encapsulates the first data frame according to the address of the newly configured default routing system, generates a second data frame, and forwards the second data frame to the corresponding target default routing system (that is, the new default routing system configured for the third routing device) through the third routing device.

[0031] When the defined mac address does not contain the mac address of the data receiver of the first data frame, the embodiment of the present application automatically determines a new routing device and a default routing system corresponding to the new routing device, which can adapt well to the dynamic network environment, does not require manual intervention, and has good automation performance; when determining a new routing device, it gives priority to reusing idle devices, which can improve the utilization rate of the created routing devices; when there are no idle devices, it supports the creation of new routing devices, further improving the scalability of SDN. The embodiment of the present application realizes the dynamic allocation and intelligent management of routing resources through the centralized control capability of SDN, and solves the problems of resource waste and lack of flexibility caused by fixed routing configuration in traditional networks.

[0032] Step 205: the target default routing system decapsulates the second data frame to obtain a data packet based on the corresponding preset default route, and forwards the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0033] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another method for obtaining and transmitting mirror data is provided, such as Figure 4 As shown, the method includes: Step 301 : When a first data frame passes through a deployment point of the mirrored data acquisition device, the mirrored data acquisition device acquires the first data frame, and unidirectionally transmits the acquired first data frame to the SDN.

[0034] Step 302: the SDN parses the received first data frame, determines header information corresponding to the first data frame, and inputs the header information into a preset forwarding mode determination model.

[0035] Step 303, the preset forwarding mode determination model extracts the target features corresponding to the header information through the feature extraction layer, and outputs the probability value corresponding to each preset forwarding mode based on the target features through the result output layer, and uses the preset forwarding mode with the largest probability value as the target forwarding mode for the SDN to forward the second data frame to the target default routing system, wherein the preset forwarding mode includes a routing forwarding mode and a flow table forwarding mode.

[0036] In this embodiment, in the SDN architecture, the control plane of the network is separated from the data forwarding plane. This separation makes the control and management of the network more flexible and programmable. However, in the face of complex network environments and changing traffic requirements, how to efficiently select data forwarding paths has become a challenge. The embodiment of the present application can quickly determine the forwarding method suitable for each first data frame by setting a preset forwarding method determination model in the SDN. The preset forwarding method determination model can be built based on machine learning, and is used to predict the best forwarding method based on the header information of the data frame, and can specifically include a feature extraction layer and a result output layer.

[0037] Specifically, after the SDN receives the first data frame, the first data frame may be parsed to extract the header information of the first data frame. The data frame header usually contains important information such as the source address, the destination address, and the protocol type, which are crucial for the subsequent determination of the forwarding path. After the SDN extracts the header information of the first data frame, the header information is input into the preset forwarding mode determination model. The preset forwarding mode determination model first extracts features related to the target forwarding mode from the header information through its feature extraction layer. These features may include specific patterns of the source address and the destination address, protocol type, packet size, traffic type (video, text, etc.), etc. The extracted target features are then input into the result output layer, and the result output layer calculates the probability value corresponding to each preset forwarding mode based on the target features extracted by the feature extraction layer. Here, the preset forwarding mode may include two types: routing forwarding mode and flow table forwarding mode. Among them, the routing forwarding mode refers to a mode of forwarding data frames according to the default routing system; the flow table forwarding mode refers to a mode of forwarding data frames according to the flow table (a matching-action rule table) inside the SDN. Different forwarding methods have different advantages in different situations. By presetting the forwarding method to determine the model, the optimal forwarding method can be selected according to the real-time situation.

[0038] After the result output layer calculates the probability value of each forwarding method, SDN will select the forwarding method with the largest probability value as the target forwarding method. This means that the model believes that this forwarding method is most likely to meet the current network conditions and traffic requirements. Once the target forwarding method is determined, SDN can apply this target forwarding method to the forwarding decision of the second data frame. In this way, SDN can manage network traffic in a dynamic and intelligent way.

[0039] The embodiment of the present application introduces a machine learning model so that the SDN can intelligently select a forwarding mode according to the header information of the first data frame. This method not only improves the efficiency of network forwarding, but also enhances the flexibility and adaptability of the network.

[0040] In addition, the preset forwarding mode determination model may also include a feature acquisition layer, such as Figure 5 As shown, the feature acquisition layer is triggered by the feature extraction layer. When the feature extraction layer receives the header information, the feature acquisition layer starts to acquire context features. Here, the context features may include features such as current link utilization, historical flow table hit rate, and controller load status. After the feature extraction layer completes extracting features from the header information, the result output layer can splice the features of the feature extraction layer and the feature acquisition layer, and then calculate the probability value corresponding to each preset forwarding method based on the splicing result.

[0041] Step 304: the SDN determines a target default routing system from multiple default routing systems based on the first data frame information, re-encapsulates the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system.

[0042] Step 305, the target default routing system decapsulates the second data frame to obtain a data packet based on the corresponding preset default route, and forwards the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0043] In an embodiment of the present application, optionally, when the target forwarding mode is a flow table forwarding mode, step 304 includes: the network device in the SDN searches for a target flow table corresponding to the header information from a flow table pre-issued by the SDN controller based on the header information of the first data frame, modifies the address in the header information according to the matching item in the target flow table, and re-encapsulates the second data frame, and forwards the second data frame to the target default routing system corresponding to the forwarding strategy according to the forwarding strategy indicated by the target flow table matching item.

[0044] In this embodiment, the SDN may include network devices, an SDN controller, and a flow table pre-issued by the SDN controller. The flow table is a key component in the SDN, which defines how to process data flows passing through the network device. When the first data frame enters a network device (such as a switch or a router) pre-set in the SDN, the network device may process the first data frame. Specifically, the network device first parses the header information of the first data frame. The data frame header information contains various metadata, such as source address, destination address, protocol type, etc. Subsequently, the network device searches for a target flow table that matches the header information in the flow table pre-issued by the SDN controller based on the header information of the first data frame. Here, the target flow table refers to those flow table entries whose matching items match the data frame header information. Once the target flow table is found, the network device may modify the address in the data frame header information according to the matching items in the target flow table to obtain a second data frame. This re-encapsulation process is to ensure that the data frame can be correctly forwarded according to the new routing policy.

[0045] The target flow table not only contains items for matching data frames, but also contains policies indicating how to forward the matched data streams. Then, the network device determines the target default routing system of the second data frame according to the forwarding policy indicated by the target flow table matching item, and forwards the second data frame to the specified target default routing system according to the forwarding policy. The embodiment of the present application utilizes the centralized control and dynamic routing selection capabilities of SDN, and realizes flexible forwarding of data frames through flow table matching and header information modification, which not only improves the flexibility and programmability of the network, but also enhances the performance and security of the network.

[0046] In addition, when the target forwarding mode is a routing forwarding mode, step 304 includes: the SDN determines the mac address of the data recipient of the first data frame according to the first data frame information, determines a first routing device with the same mac address as the data recipient from a plurality of routing devices with defined mac addresses contained in the SDN, uses the default routing system corresponding to the first routing device as the target default routing system, re-encapsulates the first data frame according to the address of the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system through the first routing device.

[0047] In the embodiment of the present application, optionally, before the step of “obtaining the first data frame” in step 301, the method further includes: if the mac address of the data recipient of the first data frame obtained by the mirrored data acquisition device is known, then creating a fourth routing device based on the known mac address, and configuring a default routing system corresponding to the first data frame according to the fourth routing device and the mac address and IP address corresponding to the target device or network, and using the configured default routing system as the target default routing system corresponding to the fourth routing device; accordingly, after the step of “obtaining the first data frame” in step 301, the method further includes: the mirrored data acquisition device unidirectionally transmits the acquired first data frame to the fourth routing device; the fourth routing device re-encapsulates the first data frame according to the address of the target default routing system to obtain a second data frame, and sends the second data frame to the corresponding target default routing system; the target default routing system decapsulates the second data frame based on the corresponding preset default route to obtain a data packet, and forwards the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0048] In this embodiment, if the mac address of the data recipient of the first data frame obtained by the mirror data acquisition device on the deployed link is known and fixed, then a routing device can be directly constructed in advance based on the known and fixed mac address, which can be referred to as the fourth routing device. Subsequently, according to the mac address and IP address of the target device or network, and the information of the fourth routing device, the default routing system corresponding to the first data frame is configured, and the newly configured default routing system can be used as the target default routing system corresponding to the fourth routing device. In this way, after the mirror data acquisition device obtains the first data frame, the data frame can be forwarded directly through the fourth routing device without setting up an SDN for it, which further reduces the complexity of forwarding the data frame and reduces the deployment cost.

[0049] Furthermore, after the mirror data acquisition device acquires the first data frame, the first data frame can be unidirectionally transmitted to the fourth routing device. After receiving the first data frame, the fourth routing device re-encapsulates the first data frame according to the address of the target default routing system, generates a second data frame, and forwards the second data frame to the corresponding target default routing system (that is, the new default routing system configured for the fourth routing device). After receiving the second data frame, the target default routing system decapsulates the second data frame to restore the original data packet, and then forwards the original data packet to the target device or network according to the preset default route corresponding to the target default routing system. In this way, when the target device or network receives the original data packet, it can perform corresponding tasks according to the data packet.

[0050] It should be noted that the mirror data acquisition device deployed on different links can choose whether to configure SDN for it according to whether the mac address of the data recipient of the first data frame acquired by the mirror data acquisition device is known or unknown. When the mac address of the data recipient of the first data frame is unknown, by configuring SDN for it, the SDN can further determine the target default routing system from multiple default routing systems, thereby accurately determining the transmission direction of the first data frame; and when the mac address of the data recipient of the first data frame is known, the SDN is omitted and directly transmitted by the pre-configured fourth routing device, which can save deployment costs and reduce the complexity of data frame forwarding. The embodiment of the present application determines the data frame transmission method according to actual conditions, which greatly improves the flexibility of mirror data transmission.

[0051] In the embodiment of the present application, optionally, each of the default routing systems includes at least one default router, and each default router is configured with a preset default route; when the target default routing system includes multiple default routers, step 305 includes: the first default router in the target default routing system decapsulates the second data frame to obtain a data packet, and forwards the data packet to an adjacent default router based on the corresponding preset default route; each of the remaining default routers in the target default routing system forwards the data packet in sequence according to their respective corresponding preset default routes, so as to forward the data packet to the target device or network.

[0052] In this embodiment, there may be one or more default routers in each default routing system. Each default router is configured with a preset default route, which is used to guide the transmission path of data packets in the network. The schematic diagram of the default routing system can be as follows: Figure 6 When the target default routing system contains multiple default routers, the processing flow of the data packet (here specifically the data packet obtained after the second data frame is decapsulated) is as follows: a. Processing of the first default router in the target default routing system: After receiving the second data frame, it is decapsulated and restored to the original data packet. After decapsulation, the data packet is forwarded to the adjacent default router according to its pre-configured default route. The "adjacent" here refers to the next-hop router that matches the destination address of the data packet in the routing table.

[0053] b. Processing of other default routers in the target default routing system: Each subsequent default router that receives a data packet determines the next-hop transmission path based on its own configured preset default route and forwards the data packet to the next adjacent default router until the data packet reaches the destination device or network.

[0054] The target default routing system of the embodiment of the present application can ensure the integrity of the data packet (the original data packet details are complete and unchanged) through the collaborative work of multiple default routers and preset default routes, thereby achieving efficient and reliable transmission of data packets in the network.

[0055] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a system for acquiring and transmitting mirror data, such as Figure 7 As shown, the system includes: A mirror data acquisition device, used to acquire the first data frame when the first data frame passes through a deployment point of the mirror data acquisition device, and unidirectionally transmit the acquired first data frame to the SDN; The SDN is used to determine a target default routing system from multiple default routing systems based on the first data frame information, re-encapsulate the second data frame according to the target default routing system, and forward the second data frame to the target default routing system; The target default routing system is used to decapsulate the second data frame to obtain a data packet based on the corresponding preset default route, and forward the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0056] Optionally, the mirror data acquisition device is a data diode, a data input end of the data diode is connected to an original transmission link of the first data frame, and a data output end of the data diode is connected to the SDN. Optionally, the SDN is used to: The MAC address of the data receiver of the first data frame is determined according to the first data frame information, a first routing device having the same MAC address as the data receiver is determined from the multiple routing devices with defined MAC addresses included in the SDN, a default routing system corresponding to the first routing device is used as the target default routing system, and the first data frame is re-encapsulated according to the address of the target default routing system to obtain a second data frame, and the second data frame is forwarded to the target default routing system through the first routing device.

[0057] Optionally, when there is no first routing device having the same MAC address as the data receiver among the multiple routing devices with defined MAC addresses, the SDN is further used to: Determine a second routing device in an idle state from a plurality of routing devices with defined mac addresses included in the SDN; When there is a second routing device in an idle state among the multiple routing devices with defined MAC addresses, the defined MAC address corresponding to the second routing device is changed to the MAC address of the data receiver, and according to the second routing device and the MAC address and IP address corresponding to the target device or network, the default routing system corresponding to the first data frame is configured, the newly configured default routing system is used as the target default routing system corresponding to the second routing device, and the first data frame is re-encapsulated according to the address of the target default routing system to obtain a second data frame, and the second data frame is forwarded to the corresponding target default routing system through the second routing device; When there is no idle second routing device among the multiple routing devices with defined MAC addresses, a third routing device is created based on the MAC address of the data recipient, and a default routing system corresponding to the first data frame is configured according to the third routing device and the MAC address and IP address corresponding to the target device or network, and the newly configured default routing system is used as the target default routing system corresponding to the third routing device, and the first data frame is re-encapsulated according to the address of the target default routing system to obtain a second data frame, and the second data frame is forwarded to the corresponding target default routing system through the third routing device.

[0058] Optionally, the SDN is used to: The network device in the SDN searches for a target flow table corresponding to the header information of the first data frame from a flow table pre-issued by the SDN controller based on the header information of the first data frame, modifies the address in the header information according to a matching item in the target flow table, and re-encapsulates the second data frame, and forwards the second data frame to a target default routing system corresponding to the forwarding strategy according to a forwarding strategy indicated by a matching item in the target flow table.

[0059] Optionally, the SDN is further used for: Before determining a target default routing system from a plurality of default routing systems based on the first data frame information, parsing the received first data frame to determine header information corresponding to the first data frame, and inputting the header information into a preset forwarding mode determination model; The preset forwarding mode determination model extracts the target features corresponding to the header information through the feature extraction layer, and outputs the probability value corresponding to each preset forwarding mode based on the target features through the result output layer, and uses the preset forwarding mode with the largest probability value as the target forwarding mode for the SDN to forward the second data frame to the target default routing system, wherein the preset forwarding mode includes a routing forwarding mode and a flow table forwarding mode.

[0060] Optionally, the system further comprises a routing device configuration device; the routing device configuration device is used to: Before acquiring the first data frame, if the MAC address of the data recipient of the first data frame acquired by the mirrored data acquisition device is known, a fourth routing device is created based on the known MAC address, and a default routing system corresponding to the first data frame is configured according to the fourth routing device and the MAC address and IP address corresponding to the target device or network, and the configured default routing system is used as the target default routing system corresponding to the fourth routing device; Correspondingly, the mirror data acquisition device is further used to, after acquiring the first data frame, unidirectionally transmit the acquired first data frame to the fourth routing device; The fourth routing device is used to re-encapsulate the first data frame according to the address of the target default routing system to obtain a second data frame, and send the second data frame to the corresponding target default routing system; The target default routing system is used to decapsulate the second data frame to obtain a data packet based on the corresponding preset default route, and forward the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

[0061] Optionally, each of the default routing systems includes at least one default router, and each default router is configured with a preset default route; When the target default routing system includes multiple default routers, the first default router in the target default routing system is used to decapsulate the second data frame to obtain a data packet, and forward the data packet to an adjacent default router based on the corresponding preset default route; each of the remaining default routers in the target default routing system is used to forward the data packet in sequence according to the respective corresponding preset default routes, so as to forward the data packet to the target device or network.

[0062] It should be noted that for other corresponding descriptions of the functional units involved in the system for acquiring and transmitting mirrored data provided in the embodiment of the present application, reference can be made to Figures 1 to 6 The corresponding description in the method will not be repeated here.

[0063] The present application also provides a computer device, which may be a personal computer, a server, a network device, etc. Figure 8As shown, the computer device includes a bus, a processor, a memory and a communication interface, and may also include an input and output interface and a display device. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store location information. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in each method embodiment are implemented.

[0064] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0065] In one embodiment, a computer-readable storage medium is provided. The computer-readable storage medium may be non-volatile or volatile, and stores a computer program thereon. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0066] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0067] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0068] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0069] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0070] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for acquiring and transmitting mirror data, characterized in that: include: When the first data frame passes through the deployment point of the mirror data acquisition device, the mirror data acquisition device acquires the first data frame, and unidirectionally transmits the acquired first data frame to the SDN; The SDN determines a target default routing system from multiple default routing systems based on the first data frame information, re-encapsulates the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system; The target default routing system decapsulates the second data frame to obtain a data packet based on the corresponding preset default route, and forwards the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

2. The method according to claim 1, characterized in that The mirror data acquisition device is a data diode, a data input end of the data diode is connected to the original transmission link of the first data frame, and a data output end of the data diode is connected to the SDN.

3. The method according to claim 1, characterized in that The SDN determines a target default routing system from a plurality of default routing systems based on the first data frame information, re-encapsulates the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system, including: The SDN determines the MAC address of the data recipient of the first data frame according to the first data frame information, determines a first routing device having the same MAC address as the data recipient from a plurality of routing devices with defined MAC addresses included in the SDN, uses a default routing system corresponding to the first routing device as the target default routing system, re-encapsulates the first data frame according to the address of the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system through the first routing device.

4. The method according to claim 3, characterized in that: When there is no first routing device having the same MAC address as the data receiver among the plurality of routing devices having defined MAC addresses, the method further includes: Determine a second routing device in an idle state from a plurality of routing devices with defined mac addresses included in the SDN; When there is a second routing device in an idle state among the multiple routing devices with defined MAC addresses, the defined MAC address corresponding to the second routing device is changed to the MAC address of the data receiver, and according to the second routing device and the MAC address and IP address corresponding to the target device or network, the default routing system corresponding to the first data frame is configured, the newly configured default routing system is used as the target default routing system corresponding to the second routing device, and the first data frame is re-encapsulated according to the address of the target default routing system to obtain a second data frame, and the second data frame is forwarded to the corresponding target default routing system through the second routing device; When there is no idle second routing device among the multiple routing devices with defined MAC addresses, a third routing device is created based on the MAC address of the data recipient, and a default routing system corresponding to the first data frame is configured according to the third routing device and the MAC address and IP address corresponding to the target device or network, and the newly configured default routing system is used as the target default routing system corresponding to the third routing device, and the first data frame is re-encapsulated according to the address of the target default routing system to obtain a second data frame, and the second data frame is forwarded to the corresponding target default routing system through the third routing device.

5. The method according to claim 1, characterized in that The SDN determines a target default routing system from a plurality of default routing systems based on the first data frame information, re-encapsulates the target default routing system to obtain a second data frame, and forwards the second data frame to the target default routing system, including: The network device in the SDN searches for a target flow table corresponding to the header information of the first data frame from a flow table pre-issued by the SDN controller based on the header information of the first data frame, modifies the address in the header information according to a matching item in the target flow table, and re-encapsulates the second data frame, and forwards the second data frame to a target default routing system corresponding to the forwarding strategy according to a forwarding strategy indicated by a matching item in the target flow table.

6. The method according to claim 1, characterized in that Before the SDN determines a target default routing system from a plurality of default routing systems based on the first data frame information, the method further includes: The SDN parses the received first data frame, determines header information corresponding to the first data frame, and inputs the header information into a preset forwarding mode determination model; The preset forwarding mode determination model extracts the target features corresponding to the header information through the feature extraction layer, and outputs the probability value corresponding to each preset forwarding mode based on the target features through the result output layer, and uses the preset forwarding mode with the largest probability value as the target forwarding mode for the SDN to forward the second data frame to the target default routing system, wherein the preset forwarding mode includes a routing forwarding mode and a flow table forwarding mode.

7. The method according to claim 1, characterized in that Before acquiring the first data frame, the method further includes: If the MAC address of the data recipient of the first data frame acquired by the mirrored data acquisition device is known, a fourth routing device is created based on the known MAC address, and a default routing system corresponding to the first data frame is configured according to the fourth routing device and the MAC address and IP address corresponding to the target device or network, and the configured default routing system is used as the target default routing system corresponding to the fourth routing device; Correspondingly, after acquiring the first data frame, the method further includes: The mirror data acquisition device unidirectionally transmits the acquired first data frame to the fourth routing device; The fourth routing device re-encapsulates the first data frame according to the address of the target default routing system to obtain a second data frame, and sends the second data frame to the corresponding target default routing system; The target default routing system decapsulates the second data frame to obtain a data packet based on the corresponding preset default route, and forwards the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

8. The method according to any one of claims 1 to 7, characterized in that Each of the default routing systems includes at least one default router, and each default router is configured with a preset default route; When the target default routing system includes multiple default routers, the target default routing system decapsulates the second data frame to obtain a data packet based on the corresponding preset default route, and forwards the data packet to the target device or network, including: The first default router in the target default routing system decapsulates the second data frame to obtain a data packet, and forwards the data packet to an adjacent default router based on a corresponding preset default route; Each of the remaining default routers in the target default routing system forwards the data packet in sequence according to the corresponding preset default route, so as to forward the data packet to the target device or network.

9. A system for acquiring and transmitting image data, characterized in that: include: A mirror data acquisition device, used to acquire the first data frame when the first data frame passes through a deployment point of the mirror data acquisition device, and unidirectionally transmit the acquired first data frame to the SDN; The SDN is used to determine a target default routing system from multiple default routing systems based on the first data frame information, re-encapsulate the second data frame according to the target default routing system, and forward the second data frame to the target default routing system; The target default routing system is used to decapsulate the second data frame to obtain a data packet based on the corresponding preset default route, and forward the data packet to the target device or network, so that the target device or network performs a corresponding task based on the data packet.

10. A medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

11. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

Images