Protocol analysis processing method and system, computer equipment, readable storage medium and program product

Abstract

The invention relates to a protocol analysis processing method and system, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: under the condition that a protocol application receives a to-be-analyzed data packet, sending the to-be-analyzed data packet in the protocol application to a started protocol plug-in through a data communication channel; the protocol plug-in is started as an independent service process; analyzing the received to-be-analyzed data packet by adopting a protocol plug-in to generate an analysis result; and returning an analysis result in the protocol plug-in to the protocol application through the data communication channel. By adopting the method, the compatibility of the protocol plug-in can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a protocol parsing method, system, computer device, computer-readable storage medium, and computer program product. Background Art

[0002] Industrial control network security products (such as industrial firewalls, industrial monitoring and auditing, etc.) often require fine-grained parsing and processing of numerous industrial network protocols, usually using protocol plug-ins.

[0003] Traditional protocol plug-ins use dynamic libraries. By defining standardized interfaces, the product dynamically loads third-party plug-in libraries, and then calls the plug-in library functions through standardized interfaces to implement protocol parsing. The disadvantage of this method is that the program is highly coupled and has high compatibility requirements for third-party plug-ins, including development languages, interface function methods, etc., which must be consistent with the caller. For different products and different suppliers, third-party plug-ins may require customized development, which increases the workload of protocol plug-in maintenance, resulting in lower compatibility of protocol plug-ins. Summary of the invention

[0004] Based on this, it is necessary to provide a protocol parsing processing method, system, computer device, computer-readable storage medium and computer program product that can improve the compatibility of protocol plug-ins in response to the above technical problems.

[0005] In a first aspect, the present application provides a protocol parsing processing method, comprising:

[0006] When the protocol application receives a data packet to be parsed, the protocol application sends the data packet to be parsed to the started protocol plug-in through a data communication channel; the protocol plug-in is started as an independent service process;

[0007] The protocol plug-in is used to parse the received data packet to be parsed and generate a parsing result;

[0008] The parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

[0009] In one embodiment, before sending the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel, the method further includes:

[0010] Registering the registration information corresponding to the protocol plug-in into the protocol application; the registration information at least includes the resolvable protocol information of the protocol plug-in;

[0011] The step of sending the data packet to be parsed in the protocol application to the protocol plug-in through the data communication channel includes:

[0012] According to the registration information, the data packet to be parsed in the protocol application is sent to the protocol plug-in through a data communication channel.

[0013] In one of the embodiments, the protocol plug-in includes at least one candidate protocol plug-in;

[0014] The step of sending the data packet to be parsed in the protocol application to the protocol plug-in through a data communication channel according to the registration information includes:

[0015] Determine the protocol type of the data packet to be parsed;

[0016] Determining a target protocol plug-in from the candidate protocol plug-ins according to the registration information and the protocol type;

[0017] The data packet to be parsed in the protocol application is sent to the target protocol plug-in through a data communication channel.

[0018] In one embodiment, before sending the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel, the method further includes:

[0019] Determine the deployment method of the protocol plug-in; the deployment method includes local deployment and cloud deployment;

[0020] According to the deployment mode, a corresponding data communication channel is established between the protocol application and the protocol plug-in.

[0021] In one of the embodiments, before returning the parsing result in the protocol plug-in to the protocol application through the data communication channel, the method further includes:

[0022] According to the format requirements of the protocol application, the parsing result is encapsulated into a data format corresponding to the format requirements through the protocol plug-in to obtain an encapsulated parsing result;

[0023] The returning the parsing result in the protocol plug-in to the protocol application through the data communication channel includes:

[0024] The encapsulation parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

[0025] In one of the embodiments, before returning the parsing result in the protocol plug-in to the protocol application through the data communication channel, the method further includes:

[0026] The parsing result is encrypted by the protocol plug-in to obtain an encrypted parsing result;

[0027] The returning the parsing result in the protocol plug-in to the protocol application through the data communication channel includes:

[0028] The encrypted parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

[0029] In a second aspect, the present application also provides a protocol parsing processing system, the system comprising a protocol application and a protocol plug-in;

[0030] The protocol application is used to send the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel when receiving the data packet to be parsed; the protocol plug-in is started as an independent service process;

[0031] The protocol plug-in is used to parse the received data packet to be parsed and generate a parsing result;

[0032] The protocol plug-in is used to return the parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0033] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0034] When the protocol application receives a data packet to be parsed, the protocol application sends the data packet to be parsed to the started protocol plug-in through a data communication channel; the protocol plug-in is started as an independent service process;

[0035] The protocol plug-in is used to parse the received data packet to be parsed and generate a parsing result;

[0036] The parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0038] When the protocol application receives a data packet to be parsed, the protocol application sends the data packet to be parsed to the started protocol plug-in through a data communication channel; the protocol plug-in is started as an independent service process;

[0039] The protocol plug-in is used to parse the received data packet to be parsed and generate a parsing result;

[0040] The parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

[0041] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0042] When the protocol application receives a data packet to be parsed, the protocol application sends the data packet to be parsed to the started protocol plug-in through a data communication channel; the protocol plug-in is started as an independent service process;

[0043] The protocol plug-in is used to parse the received data packet to be parsed and generate a parsing result;

[0044] The parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

[0045] The above-mentioned protocol parsing processing method, system, computer device, computer-readable storage medium and computer program product, first, when the protocol application receives a data packet to be parsed, the data packet to be parsed in the protocol application is sent to the started protocol plug-in through a data communication channel, wherein the protocol plug-in is started as an independent service process, and when the protocol application receives a data packet to be parsed, the data packet is sent to the started protocol plug-in through a data communication channel, and the protocol plug-in is started as an independent service process, which significantly reduces the coupling between the protocol plug-in and the protocol application, so that the plug-in no longer depends on the development language or operating environment of the application, thereby improving the compatibility and scalability of the system. At the same time, the protocol plug-in runs as an independent process and supports a distributed deployment mode, which can be adapted to both local and cloud; then, adopt The protocol plug-in parses and processes the received data packets to be parsed, generates parsing results, and implements the protocol parsing logic by using an independent plug-in, which can flexibly adapt to multiple protocol types and reduce the complexity of the system's protocol extension. At the same time, the parsing task is performed by an independent plug-in, and a specific protocol plug-in can be loaded according to actual needs, thereby improving the efficiency of protocol parsing and optimizing system performance; finally, the parsing results in the protocol plug-in are returned to the protocol application through the data communication channel, and the parsing results generated by the protocol plug-in are returned to the protocol application through the data communication channel. The data communication channel can provide encryption and integrity verification functions to ensure the security and reliability of data during transmission. Through the design of a universal communication interface, the protocol plug-in and the protocol application can seamlessly interoperate in a multi-platform and multi-network environment, enhancing the adaptability and flexibility of the system. In the above method, by designing the protocol plug-in as an independent service process and decoupling it from the protocol application, the problem of high coupling and poor compatibility between the plug-in and the application in the traditional dynamic library mode is solved. At the same time, the secure transmission and efficient interaction of data are realized through a standardized data communication channel. In addition, the parsing task is completed by an independent plug-in, which not only improves the parsing efficiency, but also ensures the stability of the main program of the protocol application, and improves the compatibility, scalability and security of the system as a whole. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A schematic diagram of a flow chart of a protocol parsing processing method in one embodiment;

[0048] Figure 2A schematic diagram of a flow chart of a protocol parsing method in another embodiment;

[0049] Figure 3 A schematic diagram of communication interaction between a protocol plug-in and a protocol application in one embodiment;

[0050] Figure 4 A schematic diagram of a flow chart of a protocol parsing processing method in one embodiment;

[0051] Figure 5 A structural block diagram of a protocol analysis processing system in one embodiment;

[0052] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] In one embodiment, Figure 1 As shown, a protocol parsing processing method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be, but is not limited to, various personal computers, laptops, smart phones, and tablet computers. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. In this embodiment, the method includes the following steps:

[0055] Step S101, when the protocol application receives a data packet to be parsed, the data packet to be parsed in the protocol application is sent to the started protocol plug-in through a data communication channel.

[0056] The protocol plug-in is started as an independent service process. A protocol plug-in is a service module that can independently parse specific protocol data. It is designed to run as an independent service process, independent of the process where the protocol application is located, and supports receiving data packets through data communication channels and returning parsing results.

[0057] The data communication channel is a communication mechanism used for data transmission between protocol applications and protocol plug-ins, supporting local communication methods (such as named pipes, shared memory) or remote communication methods (such as TCP Socket, WebSocket).

[0058] Among them, the protocol application refers to an application that can interact with the protocol plug-in. Its main functions include receiving data packets to be parsed, sending data packets to the protocol plug-in through the data communication channel, and receiving the parsing results returned by the protocol plug-in. The protocol application can be deployed on the terminal device or server, responsible for the scheduling and result processing of the protocol parsing task. For example, in industrial control systems, protocol applications run on monitoring terminals or control devices to receive data packets from field devices; in network security products (such as firewalls, intrusion detection systems), protocol applications need to analyze network traffic and identify data behaviors in specific protocols; in IoT gateway devices, data packets from different sensors or devices need to be parsed and uploaded to the cloud platform, and so on.

[0059] Exemplarily, first, the protocol plug-in is designed as an independent process, runs as an independent service in the system, and exchanges data with the protocol application through inter-process communication (IPC). When started, the protocol plug-in is started through the service management mechanism of the operating system (such as systemd, Windows Service Manager) or through containerization technology (such as Docker), and listens to one or more ports or pipes to receive data packets. When the protocol application receives the data packet to be parsed, the basic information of the data packet is first encapsulated into a predetermined format (such as JSON or binary stream), and then transmitted to the protocol plug-in through the established data communication channel. If the protocol plug-in is deployed in a local environment, the data communication channel adopts a named pipe or shared memory to achieve efficient and low-latency data transmission; if the protocol plug-in is deployed in a cloud environment, TCP Socket or other remote communication mechanisms are used to ensure that data can be transmitted in scenarios across physical entities. The protocol plug-in listens for incoming data packets on the service port, receives and processes these data packets through a preset parsing interface, and completes the receiving process.

[0060] Step S102: using the protocol plug-in, parse the received data packet to be parsed and generate a parsing result.

[0061] Exemplarily, the protocol application sends the data packet to be parsed to the protocol plug-in through the data communication channel, and the protocol plug-in first selects the corresponding parsing method according to the protocol type of the data packet. For example, if an HTTP data packet is received, the protocol plug-in will use the HTTP parser to extract information such as the request header, request body, response header, etc.; if it is a Modbus protocol data packet, the plug-in will parse the data register, status information, etc. The protocol plug-in uses an efficient parsing algorithm to parse the data packet field by field, and generates a structured parsing result according to the requirements of the protocol. The parsing result can be in a standardized format (such as JSON, XML, binary format, etc.) for further processing or storage by the protocol application. In this way, the protocol plug-in provides flexible and efficient data parsing capabilities that can support the processing of multi-protocol data.

[0062] Step S103: Return the parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0063] The parsing result is the structured information generated by the protocol plug-in after parsing the data packet. It usually contains the key fields, data values ​​and other related metadata in the protocol. The parsing result is the core data that the protocol application further processes after receiving the data packet to be parsed. The parsing result can be encapsulated in a standardized format (such as JSON, XML, or a custom format) according to the needs of the protocol application to ensure that the protocol application can easily understand and process it.

[0064] Exemplarily, the protocol plug-in transmits the parsed data through the communication channel. After receiving the parsing results, the protocol application may perform further operations based on the parsed content, such as storing data, generating reports, triggering alarms, or executing other business logic. The protocol plug-in can use a local data channel (such as a named pipe or shared memory) or a remote data channel (such as TCP / IP or WebSocket) to transmit the parsing results, depending on the deployment location (local or cloud) between the protocol plug-in and the protocol application. In this way, the data exchange between the protocol application and the protocol plug-in becomes more flexible and efficient. The protocol plug-in runs as an independent process, which not only improves the performance of the parsing, but also ensures the security and reliability of data transmission.

[0065] In the above-mentioned protocol parsing processing method, first, when the protocol application receives a data packet to be parsed, the data packet to be parsed in the protocol application is sent to the started protocol plug-in through the data communication channel, wherein the protocol plug-in is started as an independent service process, and when the protocol application receives a data packet to be parsed, the data packet is sent to the started protocol plug-in through the data communication channel, and the protocol plug-in is started as an independent service process, which significantly reduces the coupling between the protocol plug-in and the protocol application, so that the plug-in no longer depends on the development language or operating environment of the application, thereby improving the compatibility and scalability of the system. At the same time, the protocol plug-in runs as an independent process and supports distributed deployment mode, which can be adapted to both local and cloud; then, the protocol plug-in is used to process the received data packet to be parsed. The data packet is parsed and processed to generate parsing results. By using independent plug-ins to implement protocol parsing logic, it can flexibly adapt to multiple protocol types and reduce the complexity of the system's protocol extension. At the same time, the parsing task is performed by an independent plug-in, and a specific protocol plug-in can be loaded according to actual needs, thereby improving the efficiency of protocol parsing and optimizing system performance; finally, through the data communication channel, the parsing results in the protocol plug-in are returned to the protocol application, and the parsing results generated by the protocol plug-in are returned to the protocol application through the data communication channel. The data communication channel can provide encryption and integrity verification functions to ensure the security and reliability of data during transmission. Through the design of a universal communication interface, the protocol plug-in and the protocol application can seamlessly interoperate in a multi-platform and multi-network environment, enhancing the adaptability and flexibility of the system. In the above method, by designing the protocol plug-in as an independent service process and decoupling it from the protocol application, the problem of high coupling and poor compatibility between the plug-in and the application in the traditional dynamic library mode is solved. At the same time, the secure transmission and efficient interaction of data are realized through a standardized data communication channel. In addition, the parsing task is completed by an independent plug-in, which not only improves the parsing efficiency, but also ensures the stability of the main program of the protocol application, and improves the compatibility, scalability and security of the system as a whole.

[0066] In an exemplary embodiment, before the above step S101 sends the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel, it also includes: registering the registration information corresponding to the protocol plug-in in the protocol application; the registration information at least includes the resolvable protocol information of the protocol plug-in.

[0067] Furthermore, the above step S101 sends the data packet to be parsed in the protocol application to the protocol plug-in through the data communication channel, and also includes: sending the data packet to be parsed in the protocol application to the protocol plug-in through the data communication channel according to the registration information.

[0068] Exemplarily, when the protocol application is started, the registration information of the protocol plug-in is loaded into the memory by reading the configuration file or querying the registry. The registration information contains key data such as the protocol type and version that the protocol plug-in can parse, and the functions supported by the plug-in. When the protocol application receives a data packet to be parsed, it first checks the protocol type of the data packet and searches for a protocol plug-in that can process the data packet of this type in the registered plug-in information. If a matching plug-in is found, the protocol application transmits the data packet to the corresponding protocol plug-in through the data communication channel. The protocol plug-in executes the corresponding parsing logic according to the type of data packet received, completes the parsing process of the data, and generates a parsing result.

[0069] In this embodiment, by registering the protocol plug-in in the protocol application, the interaction between the protocol application and the protocol plug-in is efficiently decoupled, and the protocol application only needs to care about the registration information of the plug-in and the supported protocol types, without directly understanding the internal implementation logic of the plug-in. The plug-in registration mechanism ensures that the protocol application can flexibly select the appropriate plug-in for protocol parsing, and can dynamically adjust the use of the plug-in according to demand, thereby enhancing the flexibility, scalability and maintainability of the system. In addition, the use of the data communication channel ensures the efficiency and security of the data transmission process between the protocol plug-in and the protocol application, further improving the processing capacity of the parsing task.

[0070] In an exemplary embodiment, the protocol plug-in includes at least one candidate protocol plug-in; the above-mentioned sending the data packet to be parsed in the protocol application to the protocol plug-in through the data communication channel according to the registration information also includes: determining the protocol type of the data packet to be parsed; determining the target protocol plug-in from the candidate protocol plug-ins according to the registration information and the protocol type; and sending the data packet to be parsed in the protocol application to the target protocol plug-in through the data communication channel.

[0071] Exemplarily, when a protocol application receives a data packet to be parsed, it first determines the protocol type of the data packet to be parsed by analyzing the header information or other protocol identification fields of the data packet. The protocol type is usually identified by the protocol application according to the data packet format, protocol identifier or preset rules. For example, the protocol application receives a network data packet, and the protocol application can identify whether it is HTTP protocol, Modbus protocol or other protocols by checking the identifier or protocol header field of the data packet (such as the GET method in the HTTP request, or the function code in the Modbus data packet). After identifying the protocol type, the protocol application searches for the previously loaded registration information, which includes the protocol types and functions supported by all candidate protocol plug-ins. When the protocol application identifies the protocol type, it automatically selects the most suitable plug-in from multiple candidate protocol plug-ins to parse the data packet according to the protocol type listed in the registration information. Through the data communication channel, the protocol application sends the data packet to be parsed to the target protocol plug-in selected from the candidate protocol plug-ins. After receiving the data packet, the target protocol plug-in processes the data according to a specific protocol parsing logic to generate a parsing result. The protocol plug-in performs corresponding operations according to different protocol types and data contents, including data verification, field extraction, protocol feature matching, etc. For example, for HTTP requests, the protocol plug-in will extract information such as request method, request header, and request body; and for Modbus data packets, the plug-in will parse function codes, register data, etc. The results returned by the protocol plug-in after parsing will be passed back to the protocol application through the data communication channel for subsequent processing or decision-making.

[0072] In this embodiment, through the registration information of the protocol plug-in, the protocol application realizes the function of dynamically selecting the target plug-in from multiple candidate protocol plug-ins according to the data packet protocol type, thereby effectively improving the parsing efficiency and system flexibility. It can automatically adapt to different protocol types without manual intervention by the user, making the protocol parsing process more intelligent and automated. At the same time, the modular design of the protocol plug-in ensures that it can be easily expanded and updated. It only needs to add new plug-ins to the registration information or update existing plug-ins without modifying the core logic of the protocol application, which enhances maintainability and scalability.

[0073] In an exemplary embodiment, before the above step S101 sends the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel, it also includes: determining the deployment method of the protocol plug-in; the deployment method includes local deployment and cloud deployment; according to the deployment method, establishing a corresponding data communication channel between the protocol application and the protocol plug-in.

[0074] Exemplarily, after receiving the data packet to be parsed, the protocol application first needs to determine the deployment mode of the protocol plug-in. The deployment mode can be local deployment or cloud deployment, which depends on the system architecture design and actual needs. If the protocol plug-in is deployed locally, the data communication channel usually chooses the local data channel form (such as named pipes, shared memory or UNIX domain sockets, etc.), which provides low latency and efficient data transmission. If the protocol plug-in is deployed in the cloud or a remote server, the protocol application will communicate with the remote plug-in through a remote data communication channel (such as TCP / IP Socket, WebSocket or HTTPAPI). Once the protocol application determines the deployment mode of the protocol plug-in, it will establish an appropriate data communication channel between the protocol application and the protocol plug-in according to the deployment mode. For example, if the protocol plug-in is deployed locally, the protocol application will establish a data channel through a local network interface (such as shared memory, named pipes) to directly transmit the data packet to be parsed to the locally running protocol plug-in; if the protocol plug-in is deployed in the cloud, the protocol application sends a data packet to the protocol plug-in in the cloud by establishing a secure TCP connection or using a Web API (such as a RESTful API). In the process of establishing a communication channel, the protocol application also needs to ensure the security and reliability of communication. For local deployment, protocol applications may need to ensure access to named pipes or shared memory to avoid interference from other programs; for cloud deployment, communication channels need to support encrypted transmission (such as TLS / SSL) to ensure data confidentiality, and use authentication mechanisms to ensure that only authorized protocol applications can access protocol plug-ins. Through these measures, data transmission between protocol applications and protocol plug-ins can be effectively guaranteed in different deployment modes.

[0075] For example, if the protocol plug-in is deployed locally, the protocol application will establish a data communication channel in the following way: using the named pipe provided by the operating system (such as in Windows), the protocol application transmits the data to the protocol plug-in through the pipe, and the plug-in returns the result after parsing. If the protocol plug-in is deployed in the cloud, the protocol application may use the HTTP protocol to interact with the cloud plug-in: the protocol application encapsulates the data packet to be parsed into JSON format through the HTTP client and sends it to the API endpoint of the cloud protocol plug-in. After the protocol plug-in parses the data, it returns the parsed result in JSON format.

[0076] In this embodiment, through the mechanism of dynamically selecting the communication channel, the protocol application can flexibly select the appropriate communication channel according to the deployment location and environment of the protocol plug-in, realize efficient and secure protocol parsing task processing, and ensure that the protocol plug-in can smoothly exchange data with the protocol application regardless of whether it is deployed locally or in the cloud. At the same time, this design improves flexibility, supports the expansion, replacement or migration of the protocol plug-in according to needs, and enhances maintainability and scalability.

[0077] In an exemplary embodiment, before returning the parsing result in the protocol plug-in to the protocol application through the data communication channel in the above step S103, it also includes: according to the format requirements of the protocol application, encapsulating the parsing result into a data format corresponding to the format requirements through the protocol plug-in to obtain an encapsulated parsing result.

[0078] Furthermore, the above step S103 returns the parsing result in the protocol plug-in to the protocol application through the data communication channel, and also includes: returning the encapsulation parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0079] Exemplarily, after parsing the data packet, the protocol plug-in may generate the original parsing result in a general format (such as an internal data structure or a raw byte stream). However, the protocol application may have specific format requirements, such as requiring the parsing result to be transmitted in JSON, XML or other standardized formats. In order to meet the needs of the protocol application, the protocol plug-in will encapsulate the parsing result according to the predefined format requirements. Therefore, the protocol plug-in will convert and format the parsing result according to the format requirements of the protocol application. For example, if the protocol application requires the result to be returned in JSON format, the protocol plug-in will convert the parsed data field (such as HTTP header, Modbus register value, etc.) into a structure that conforms to the JSON format. The plug-in encapsulates the parsing result into a format that conforms to the protocol application requirements through a data format conversion function or library, and prepares it to be returned through a communication channel. The data in the encapsulation process may be compressed, encrypted or other preprocessing steps to ensure efficiency, security and reliability during the transmission process. For example, the protocol plug-in may compress the returned JSON data to reduce the bandwidth requirements for data transmission, or encrypt the data to prevent it from being stolen midway. Through the data communication channel, the protocol plug-in transmits the encapsulated parsing result to the protocol application. At this point, the protocol application receives and parses the encapsulated results through the interface and continues to perform subsequent processing operations (such as storing data, generating reports, triggering alarms, etc.). Encapsulation enables the protocol plug-in to flexibly adjust the output format of the parsing results according to the needs of the protocol application, improving the compatibility and scalability of the system.

[0080] In this embodiment, by encapsulating the parsing results into a data format corresponding to the format requirements, the protocol plug-in not only completes the protocol parsing task, but also can dynamically adapt the format according to the requirements of the protocol application, ensuring the consistency and interoperability between the data format and the protocol application, thereby enhancing flexibility, scalability and maintainability.

[0081] In an exemplary embodiment, before returning the parsing result in the protocol plug-in to the protocol application through the data communication channel in the above step S103, it also includes: encrypting the parsing result through the protocol plug-in to obtain an encrypted parsing result.

[0082] Furthermore, the above step S103 returns the parsing result in the protocol plug-in to the protocol application through the data communication channel, and also includes: returning the encrypted parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0083] For example, after the protocol plug-in completes the protocol parsing, the generated parsing results may contain sensitive information (such as user data, financial data, control instructions, etc.), which need to be protected during transmission to prevent the data from being stolen or tampered with. To this end, the protocol plug-in will encrypt the parsing results to ensure the confidentiality and integrity of the data. Encryption processing usually uses symmetric encryption (such as AES algorithm) or asymmetric encryption (such as RSA algorithm) to ensure that only authorized protocol applications can decrypt and process the parsing results.

[0084] The protocol plug-in will first encrypt the generated parsing results according to the predetermined encryption algorithm: According to the security requirements of the protocol application, the protocol plug-in selects an appropriate encryption algorithm (for example, using the AES symmetric encryption algorithm for data encryption). The protocol plug-in uses a secure key management mechanism to generate the keys required for encryption. Keys can be pre-shared, session-based, or dynamically exchanged through a secure channel (such as TLS). The protocol plug-in encrypts the parsing results using the selected encryption algorithm and key. The encrypted data cannot be interpreted by unauthorized personnel or systems, and only the protocol application holding the key can correctly decrypt it.

[0085] After completing the encryption process, the protocol plug-in generates an encryption parsing result. The encrypted data is returned to the protocol application through the data communication channel, ensuring that even if the data is intercepted during transmission, the attacker cannot decipher its content.

[0086] Furthermore, after receiving the encrypted data, the protocol application will use the same key or key pair to decrypt it and obtain the original parsing result.

[0087] For example, if symmetric encryption (such as AES) is used between the protocol application and the protocol plug-in, the protocol application needs to obtain or share the key through a secure channel in advance. Before data transmission, the protocol plug-in will encrypt the data, and after receiving the data, the protocol application will use the same key to decrypt the data to obtain the parsing result.

[0088] In addition, the design of using encrypted data transmission also enhances the secure communication between protocol applications and protocol plug-ins, especially in distributed or cross-network environments (such as protocol plug-ins deployed in the cloud). Encryption ensures the confidentiality, integrity and authentication of data, and effectively prevents security issues such as man-in-the-middle attacks and data tampering.

[0089] In this embodiment, through data encryption transmission, the interaction between the protocol application and the protocol plug-in is more secure, ensuring that the data is not illegally accessed or tampered with during the transmission process, thereby improving security and credibility. Encryption processing enables strict compliance with security standards and compliance requirements when processing sensitive data to prevent data leakage and security threats.

[0090] In another exemplary embodiment, Figure 2 As shown, the present application provides a protocol parsing processing method, the method comprising:

[0091] Step S201, determining a deployment mode of the protocol plug-in, and establishing a corresponding data communication channel between the protocol application and the protocol plug-in according to the deployment mode.

[0092] Among them, deployment methods include local deployment and cloud deployment.

[0093] Step S202, registering the registration information corresponding to the protocol plug-in into the protocol application.

[0094] The registration information at least includes the parseable protocol information of the protocol plug-in.

[0095] The protocol plug-in includes at least one candidate protocol plug-in.

[0096] Step S203: when the protocol application receives the data packet to be parsed, the protocol type of the data packet to be parsed is determined, and a target protocol plug-in is determined from the candidate protocol plug-ins according to the registration information and the protocol type.

[0097] Step S204: sending the data packet to be parsed in the protocol application to the target protocol plug-in through the data communication channel.

[0098] Among them, the protocol plug-in is started as an independent service process.

[0099] Step S205: using the protocol plug-in, parse the received data packet to be parsed and generate a parsing result.

[0100] Step S206: According to the format requirement of the protocol application, the protocol plug-in is used to encapsulate the parsing result into a data format corresponding to the format requirement to obtain an encapsulated parsing result.

[0101] Step S207: encrypt the encapsulation parsing result through the protocol plug-in to obtain an encrypted encapsulation parsing result.

[0102] Step S208: Return the encrypted encapsulation parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0103] For example, Figure 3 As shown in FIG. 1 , in a specific example, a schematic diagram of the communication interaction between the protocol plug-in and the protocol application is shown, and the communication method includes a local data channel (such as a named pipe) or a remote data channel (such as a socket).

[0104] In this embodiment, by designing the protocol plug-in as an independent service process and decoupling it from the protocol application, the problem of high coupling and poor compatibility between the plug-in and the application in the traditional dynamic library mode is solved. At the same time, the secure transmission and efficient interaction of data are achieved through standardized data communication channels. In addition, the parsing task is completed by an independent plug-in, which not only improves the parsing efficiency, but also ensures the stability of the main program of the protocol application, and improves the compatibility, scalability and security of the system as a whole.

[0105] In an exemplary embodiment, Figure 4 As shown, the present application provides a protocol parsing processing method, the process of which includes:

[0106] 1. Agreement registration

[0107] The protocol plug-in registers with the protocol application. The registration description includes information such as the protocol name and protocol characteristics that can be parsed, so as to inform the protocol application of the protocols that can be parsed.

[0108] 2. Packet forwarding

[0109] After the protocol plug-in completes registration, the protocol application forwards the data packet to be parsed and processed to the corresponding protocol plug-in for processing based on the registered protocol plug-in feature information.

[0110] 3. Protocol analysis and processing

[0111] The protocol plug-in parses the data packet and encapsulates the parsed result into a structure in a format such as JSON.

[0112] 4. Parsing data returned

[0113] The protocol plug-in returns the parsing results to the protocol application through the local data channel or the remote data channel, realizing flexible parsing and processing of the protocol.

[0114] In this embodiment, the protocol plug-in can be run and dynamically expanded on demand. The interface mode of the protocol plug-in adopts a data communication interface, which avoids the functional coupling relationship between the protocol plug-in and the application system through a local or remote communication interface, and enhances the compatibility of the protocol plug-in. The protocol parsing data adopts a template defined in json format. The protocol plug-in is compatible with products developed in any language (C / C++, Java, Python, etc.); the protocol plug-in supports distributed dynamic deployment, dynamic upgrade, and on-demand creation, which improves system resource utilization and stability.

[0115] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0116] Based on the same inventive concept, the embodiment of the present application also provides a protocol parsing processing system for implementing the protocol parsing processing method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more protocol parsing processing system embodiments provided below can refer to the limitations on the protocol parsing processing method above, and will not be repeated here.

[0117] In an exemplary embodiment, Figure 5 As shown, a protocol parsing processing system is provided, including: a protocol application 501 and a protocol plug-in 502, wherein:

[0118] The protocol application 501 is used to send the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel when receiving the data packet to be parsed; the protocol plug-in is started as an independent service process;

[0119] The protocol plug-in 502 is used to parse the received data packet to be parsed and generate a parsing result;

[0120] The protocol plug-in 502 is also used to return the parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0121] In one of the embodiments, the protocol plug-in 502 is further used to register registration information corresponding to the protocol plug-in into the protocol application; the registration information at least includes the resolvable protocol information of the protocol plug-in.

[0122] In one of the embodiments, the protocol application 501 is further used to send the data packet to be parsed in the protocol application to the protocol plug-in through the data communication channel according to the registration information.

[0123] In one of the embodiments, the protocol plug-in includes at least one candidate protocol plug-in; the above-mentioned protocol application 501 is also used to determine the protocol type of the data packet to be parsed; determine the target protocol plug-in from the candidate protocol plug-ins based on the registration information and the protocol type; and send the data packet to be parsed in the protocol application to the target protocol plug-in through a data communication channel.

[0124] In one of the embodiments, the above-mentioned protocol application 501 is also used to determine the deployment method of the protocol plug-in; the deployment method includes local deployment and cloud deployment; according to the deployment method, a corresponding data communication channel is established between the protocol application and the protocol plug-in.

[0125] In one of the embodiments, the protocol plug-in 502 is further used to encapsulate the parsing result into a data format corresponding to the format requirement according to the format requirement of the protocol application through the protocol plug-in to obtain the encapsulated parsing result.

[0126] In one of the embodiments, the protocol plug-in 502 is further used to return the encapsulation parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0127] In one of the embodiments, the protocol plug-in 502 is also used to encrypt the parsing result through the protocol plug-in to obtain an encrypted parsing result.

[0128] In one of the embodiments, the protocol plug-in 502 is further used to return the encryption parsing result in the protocol plug-in to the protocol application through the data communication channel.

[0129] Each module / unit in the above-mentioned protocol analysis and processing system can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules / units can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0130] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, a protocol parsing processing method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0131] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0133] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0134] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0136] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0137] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0138] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A protocol analysis processing method, characterized in that: The method comprises: When the protocol application receives a data packet to be parsed, the protocol application sends the data packet to be parsed to the started protocol plug-in through a data communication channel; the protocol plug-in is started as an independent service process; The protocol plug-in is used to parse the received data packet to be parsed and generate a parsing result; The parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

2. The method according to claim 1, characterized in that Before sending the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel, the method further includes: Registering the registration information corresponding to the protocol plug-in into the protocol application; the registration information at least includes the resolvable protocol information of the protocol plug-in; The step of sending the data packet to be parsed in the protocol application to the protocol plug-in through the data communication channel includes: According to the registration information, the data packet to be parsed in the protocol application is sent to the protocol plug-in through a data communication channel.

3. The method according to claim 2, characterized in that The protocol plug-in includes at least one candidate protocol plug-in; The step of sending the data packet to be parsed in the protocol application to the protocol plug-in through a data communication channel according to the registration information includes: Determine the protocol type of the data packet to be parsed; Determining a target protocol plug-in from the candidate protocol plug-ins according to the registration information and the protocol type; The data packet to be parsed in the protocol application is sent to the target protocol plug-in through a data communication channel.

4. The method according to claim 1, characterized in that: Before sending the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel, the method further includes: Determine the deployment method of the protocol plug-in; the deployment method includes local deployment and cloud deployment; According to the deployment mode, a corresponding data communication channel is established between the protocol application and the protocol plug-in.

5. The method according to claim 1, characterized in that Before returning the parsing result in the protocol plug-in to the protocol application through the data communication channel, the method further includes: According to the format requirements of the protocol application, the parsing result is encapsulated into a data format corresponding to the format requirements through the protocol plug-in to obtain an encapsulated parsing result; The returning the parsing result in the protocol plug-in to the protocol application through the data communication channel includes: The encapsulation parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

6. The method according to any one of claims 1 to 5, characterized in that: Before returning the parsing result in the protocol plug-in to the protocol application through the data communication channel, the method further includes: The parsing result is encrypted by the protocol plug-in to obtain an encrypted parsing result; The returning the parsing result in the protocol plug-in to the protocol application through the data communication channel includes: The encrypted parsing result in the protocol plug-in is returned to the protocol application through the data communication channel.

7. A protocol analysis processing system, characterized in that: The system includes a protocol application and a protocol plug-in; The protocol application is used to send the data packet to be parsed in the protocol application to the started protocol plug-in through the data communication channel when receiving the data packet to be parsed; the protocol plug-in is started as an independent service process; The protocol plug-in is used to parse the received data packet to be parsed and generate a parsing result; The protocol plug-in is used to return the parsing result in the protocol plug-in to the protocol application through the data communication channel.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images