Data stream processing method and device, computer equipment and storage medium

Abstract

The invention relates to the field of network technologies and security technologies, in particular to a data stream processing method and device, computer equipment and a storage medium. The method comprises the following steps: carrying out data flow attribute identification on a to-be-processed data flow accessed to a shunt; if the attribute identification result is that the to-be-processed data stream is an encrypted data stream, acquiring data stream information corresponding to the to-be-processed data stream; and sending the data stream information to a back-end system having a subscription relationship with the to-be-processed data. According to the method and the device, each back-end system can acquire the data stream information corresponding to the to-be-processed data stream, and each back-end system does not need to perform a data stream information acquisition process for the to-be-processed data stream, so that the difficulty of acquiring the data stream information by the back-end systems is reduced, and the quantity of resources required in a data stream processing process is reduced.

Description

Technical Field

[0001] The present application relates to the fields of network technology and security technology, and in particular to a data stream processing method, device, computer equipment and storage medium. Background Art

[0002] The data streams of interfaces between multiple network devices (such as gateways, switches, routers, etc.) can be connected to the splitter through mirroring, splitting, etc. The splitter can aggregate and split these data streams and output them to multiple application systems (such as monitoring systems, business analysis systems, etc.) for subsequent processing. The splitter can aggregate and split data streams according to the different requirements of application systems for data streams.

[0003] However, in the prior art, network traffic is introduced into the splitter through splitting or mirroring at the interface of key network equipment, and then the splitter makes multiple copies for distribution to the back-end analysis system for processing (such as network security detection, malware detection system, etc.). There are problems such as the inability to copy and process only the encrypted traffic category of concern (such as the malware detection system does not need to detect mainstream video application traffic) and the repeated processing of handshake message information extraction and flow feature statistics for the same encrypted original traffic in multiple back-end systems, which leads to waste of resources. Summary of the invention

[0004] Based on this, it is necessary to provide a data stream processing method, apparatus, computer equipment and storage medium that can prevent repeated processing of data stream messages in response to the above technical problems.

[0005] In a first aspect, the present application provides a data stream processing method. The method comprises:

[0006] Identify data flow attributes of the data flow to be processed that is connected to the splitter;

[0007] If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed;

[0008] The data stream information is sent to a back-end system that has a subscription relationship with the data to be processed.

[0009] In one embodiment, the data flow information includes target handshake information and target feature information; obtaining the data flow information corresponding to the data flow to be processed includes:

[0010] Extracting target handshake information from the data stream to be processed to obtain target handshake information in the data stream information;

[0011] During the process of the data to be processed being connected to the splitter, characteristic information is collected to obtain target characteristic information in the data flow information.

[0012] In one of the embodiments, the target characteristic information includes at least one of: number of packets, rate, flow duration, average packet size, average packet interval, number of packets in a specific packet length interval, and average packet size / rate in a specific time period interval.

[0013] In one of the embodiments, the target handshake information includes at least one of a server name indication SNI, a resource directory indicator RDI, and authentication information Certification.

[0014] In one embodiment, the step of identifying data flow attributes of a to-be-processed data flow accessing the splitter includes:

[0015] Determining whether the traffic protocol of the data flow to be processed is an encryption protocol;

[0016] If so, it is determined that the attribute identification result is that the data stream to be processed is an encrypted data stream; if not, it is determined that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

[0017] In one embodiment, the method further comprises:

[0018] Verifying whether the target handshake information matches the traffic replication rule;

[0019] If there is a match, the duplicate data stream of the data stream to be processed is sent to the backend system.

[0020] In a second aspect, the present application also provides a data stream processing device. The device comprises:

[0021] An identification module, used for identifying data flow attributes of the data flow to be processed that is connected to the splitter;

[0022] An acquisition module, configured to acquire data stream information corresponding to the data stream to be processed if the attribute identification result indicates that the data stream to be processed is an encrypted data stream;

[0023] The sending module is used to send the data stream information to a back-end system that has a subscription relationship with the data to be processed.

[0024] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0025] Identify data flow attributes of the data flow to be processed that is connected to the splitter;

[0026] If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed;

[0027] The data stream information is sent to a back-end system that has a subscription relationship with the data to be processed.

[0028] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0029] Identify data flow attributes of the data flow to be processed that is connected to the splitter;

[0030] If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed;

[0031] The data stream information is sent to a back-end system that has a subscription relationship with the data to be processed.

[0032] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0033] Identify data flow attributes of the data flow to be processed that is connected to the splitter;

[0034] If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed;

[0035] The data stream information is sent to a back-end system that has a subscription relationship with the data to be processed.

[0036] The above-mentioned data stream processing method, device, computer equipment and storage medium perform data stream attribute identification according to the data stream to be processed, and when the attribute identification result is that the data stream to be processed is an encrypted data stream, obtain the data stream information corresponding to the data stream to be processed, and then send the data stream information to the back-end system that has a subscription relationship with the data to be processed. According to the above content, it can be seen that in the process of processing the data stream, the present application does not adopt the method of sending the data stream to multiple back-end systems in the prior art and extracting the data stream information in multiple back-end systems respectively; instead, after determining that the data to be processed is an encrypted data stream, the data stream information corresponding to the data stream to be processed is obtained, and then the obtained data stream information is sent to the back-end system that has a subscription relationship with the data to be processed; so as to realize the step of obtaining the data stream information only once, each back-end system can obtain the data stream information corresponding to the data stream to be processed, and there is no need for each back-end system to perform the data stream information acquisition process for the data stream to be processed, which reduces the difficulty of the back-end system to obtain the data stream information, and reduces the amount of resources required in the data stream processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 An application environment diagram of a data stream processing method provided in an embodiment of the present application;

[0038] Figure 2 A flowchart of a first data stream processing method provided in an embodiment of the present application;

[0039] Figure 3 A flowchart of a second data stream processing method provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of a flow chart of a third data stream processing method provided in an embodiment of the present application;

[0041] Figure 5 A flowchart of a fourth data stream processing method provided in an embodiment of the present application;

[0042] Figure 6 A schematic diagram of a method for processing data streams executed by a splitter provided in an embodiment of the present application;

[0043] Figure 7 A structural block diagram of a data stream processing device provided in an embodiment of the present application;

[0044] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] The data stream processing method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. According to the data stream to be processed, the data stream attribute is identified. When the attribute identification result is that the data stream to be processed is an encrypted data stream, the data stream information corresponding to the data stream to be processed is obtained, and then the data stream information is sent to the back-end system that has a subscription relationship with the data to be processed. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0047] In one embodiment, Figure 2 As shown, a data stream processing method is provided, which is applied to Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0048] S201, identifying data flow attributes of a data flow to be processed that is connected to a splitter.

[0049] It should be noted that data stream data may include but is not limited to encrypted data streams and unencrypted data; therefore, when identifying the data stream attributes of the data stream to be processed that is connected to the splitter, it can be determined whether the data stream to be processed is encrypted, and then, based on the encryption status of the data stream to be processed, the data stream attributes of the data stream to be processed can be determined.

[0050] Furthermore, whether the data flow to be processed is encrypted can be determined by determining whether the traffic protocol of the data flow to be processed is an encrypted traffic protocol.

[0051] In one embodiment of the present application, when it is necessary to identify the data flow attributes of the data flow to be processed that is connected to the splitter, the traffic protocol of the data flow to be processed can be obtained. When the traffic protocol of the data flow to be processed is an encrypted traffic protocol, the attribute identification result is determined to be that the data flow to be processed is an encrypted data flow; when the traffic protocol of the data flow to be processed is a non-encrypted traffic protocol, the attribute identification result is determined to be that the data flow to be processed is a non-encrypted data flow.

[0052] S202: If the attribute identification result is that the data stream to be processed is an encrypted data stream, data stream information corresponding to the data stream to be processed is obtained.

[0053] It should be noted that, when it is determined that the data to be processed is an encrypted data stream, a process of obtaining data stream information corresponding to the data stream to be processed is triggered, wherein the data stream information includes target handshake information and target feature information.

[0054] In one embodiment of the present application, if the attribute identification result is that the data stream to be processed is an encrypted data stream, target handshake information is extracted from the data stream to be processed, and statistics on target feature information are started at the same time.

[0055] S203, sending the data stream information to a backend system that has a subscription relationship with the data to be processed.

[0056] It should be noted that before sending the data flow information to the back-end system that has a subscription relationship with the data to be processed, the subscription relationship between at least one back-end system and the data flow to be processed can be verified; then, based on the subscription relationship, the data flow information can be sent to the back-end system that has a subscription relationship with the data to be processed.

[0057] In one embodiment of the present application, for each back-end system, if there is a subscription relationship between a certain back-end system and the data stream to be processed, and the subscription relationship indicates that it is necessary to obtain data flow information of the data stream to be processed, the data flow information is sent to the back-end system that has a subscription relationship with the data to be processed.

[0058] Further explanation: It is also necessary to verify whether the target handshake information matches the traffic replication rule; if it matches, the replicated data stream of the data stream to be processed is sent to the backend system.

[0059] Among them, at least one kind of handshake information is recorded in the traffic replication rule. If the handshake information of a certain data flow is the same as the handshake information recorded in the traffic replication rule, it is determined that the data flow needs to be replicated, and the replicated data flow after the traffic replication is sent to the back-end system that has a subscription relationship with the data flow.

[0060] The above-mentioned data stream processing method identifies the data stream attributes according to the data stream to be processed, and when the attribute identification result is that the data stream to be processed is an encrypted data stream, obtains the data stream information corresponding to the data stream to be processed, and then sends the data stream information to the back-end system that has a subscription relationship with the data to be processed. According to the above content, it can be seen that in the process of processing the data stream, the present application does not adopt the method of sending the data stream to multiple back-end systems in the prior art and extracting the data stream information in multiple back-end systems respectively; instead, after determining that the data to be processed is an encrypted data stream, the data stream information corresponding to the data stream to be processed is obtained, and then the obtained data stream information is sent to the back-end system that has a subscription relationship with the data to be processed; so as to realize the step of obtaining the data stream information only once, each back-end system can obtain the data stream information corresponding to the data stream to be processed, and there is no need for each back-end system to carry out the data stream information acquisition process for the data stream to be processed, which reduces the difficulty of the back-end system to obtain the data stream information, and reduces the amount of resources required in the data stream processing process.

[0061] In one embodiment, the back-end system subscribes to encrypted traffic through the northbound interface of the diverter based on the original traffic filtered by the handshake information, handshake message information, flow feature statistics and other data. Specifically: (1) Copy the original traffic: Taking the subscription of the original traffic excluding the mainstream video application as an example, subscribe to the original traffic whose SNI is not equal to list1. List1 content is the SNI set of mainstream video applications; handshake information includes but is not limited to: SNI, RDI, Certification; (2) Flow feature statistics include but are not limited to: number of packets, rate, flow duration, average packet size, average packet interval, packet number statistics in a certain packet length interval, average packet size / rate statistics in a certain time interval, etc.

[0062] In one embodiment, if Figure 3 As shown, the data flow information includes target handshake information and target feature information. Therefore, when it is necessary to obtain the data flow information corresponding to the data flow to be processed, the following contents may be included:

[0063] S301, extracting target handshake information from a data stream to be processed, and obtaining target handshake information in the data stream information.

[0064] The target handshake information includes at least one of a server name indication SNI, a resource directory indicator RDI and authentication information Certification.

[0065] S302, collecting characteristic information during the process of the data to be processed accessing the splitter, and obtaining target characteristic information in the data flow information.

[0066] The target characteristic information includes: at least one of the number of packets, rate, flow duration, average packet size, average packet interval, number of packets in a specific packet length interval, and average packet size / rate in a specific time period interval.

[0067] In one embodiment of the present application, when the attribute identification result is that the data stream to be processed is an encrypted data stream, the target handshake information of the data stream to be processed is extracted to obtain the target handshake information in the data stream information, and the collected target handshake information is sent to the XDR generation module; and at the same time, feature information is collected during the process of the data to be processed accessing the splitter until the end of the stream, to obtain the target feature information in the data stream information, and the collected target feature information is sent to the XDR generation module; the XDR generation module sends each type of corresponding XDR data of the data stream information to a back-end system that has a subscription relationship with the data to be processed.

[0068] The above-mentioned data stream processing method can obtain target handshake information and target characteristic information by extracting target handshake information from the data stream to be processed and collecting characteristic information during the process of the data to be processed accessing the splitter, so as to realize the step of obtaining data stream information only once, so that each back-end system can obtain the data stream information corresponding to the data stream to be processed, and there is no need for each back-end system to perform the data stream information acquisition process for the data stream to be processed, which reduces the difficulty of the back-end system to obtain data stream information and reduces the amount of resources required in the data stream processing process.

[0069] In one embodiment, if Figure 4 As shown, when it is necessary to identify the data flow attributes of the data flow to be processed by the access splitter, the following contents may be included:

[0070] S401, determining whether the traffic protocol of the data flow to be processed is an encryption protocol.

[0071] It should be noted that when it is necessary to determine whether the traffic protocol of the data flow to be processed is an encryption protocol, you can detect whether the traffic protocol is an encryption protocol. Specifically: if it is determined that the traffic protocol is a known encryption protocol such as HTTPS, SSL / TLS, VPN, SSH, etc., then it is determined that the traffic protocol of the data flow to be processed is an encryption protocol.

[0072] In one embodiment of the present application, at least one encryption protocol whitelist may be pre-set, and after determining the flow protocol of the data flow to be processed, verify whether the flow protocol belongs to the encryption protocol whitelist, and if so, determine that the flow protocol of the data flow to be processed is an encryption protocol. The encryption protocol whitelist records at least one encryption protocol.

[0073] S402: If yes, determine that the attribute identification result is that the data stream to be processed is an encrypted data stream; if no, determine that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

[0074] In one embodiment of the present application, if it is determined that the attribute identification result is that the data stream to be processed is an encrypted data stream, the subsequent steps of obtaining data stream information corresponding to the data stream to be processed are executed; if it is determined that the attribute identification result is that the data stream to be processed is an unencrypted data stream, data stream processing is performed on the data stream to be processed through the unencrypted traffic processing module.

[0075] The above-mentioned data flow processing method, by determining whether the traffic protocol of the data flow to be processed is an encryption protocol, realizes different processing methods for the data flow to be processed according to the data flow attribute identification result, reduces the difficulty of the back-end system to obtain data flow information, and reduces the amount of resources required in the data flow processing process.

[0076] In one embodiment, if Figure 5 As shown, when the data stream information needs to be sent to a backend system that has a subscription relationship with the data to be processed, the following contents may be included:

[0077] S501, determining whether the traffic protocol of the data flow to be processed is an encryption protocol.

[0078] S502: If yes, determine that the attribute identification result is that the data stream to be processed is an encrypted data stream; if no, determine that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

[0079] S503: If the attribute identification result is that the data stream to be processed is an encrypted data stream, extract the target handshake information from the data stream to be processed to obtain the target handshake information in the data stream information.

[0080] S504, verify whether the target handshake information matches the traffic replication rule.

[0081] S505: If there is a match, the duplicate data stream of the data stream to be processed is sent to the backend system.

[0082] S506, collecting characteristic information during the process of the data to be processed accessing the splitter, and obtaining target characteristic information in the data flow information.

[0083] S507, sending the data stream information to a backend system that has a subscription relationship with the data to be processed.

[0084] Specifically, Figure 6As shown, when the encrypted traffic data flow enters the splitter, the splitter identifies that the data flow is an encrypted protocol such as HTTPS, QUIC, etc., and extracts the service provider-related information (including but not limited to SNI, RDN, and Certification, etc.) from the data flow handshake message, and compares it with the rule configuration, and decides whether to copy it to the back-end system according to the rule matching situation; at the same time, the splitter starts the flow feature statistics process in the memory, and the flow feature statistics may include but not limited to the number of packets, rate, flow duration, average packet size, average packet interval, the number of packets in a certain packet length interval, and the average packet size / rate statistics in a certain time interval. When the splitter identifies that the flow ends, it forms various types of xDRs including flow five-tuples, flow start and end time, handshake message information, various flow feature values, etc. according to the subscription content of the back-end system, and outputs them to the corresponding back-end system.

[0085] The above-mentioned data stream processing method identifies the data stream attributes according to the data stream to be processed, and when the attribute identification result is that the data stream to be processed is an encrypted data stream, obtains the data stream information corresponding to the data stream to be processed, and then sends the data stream information to the back-end system that has a subscription relationship with the data to be processed. According to the above content, it can be seen that in the process of processing the data stream, the present application does not adopt the method of sending the data stream to multiple back-end systems in the prior art and extracting the data stream information in multiple back-end systems respectively; instead, after determining that the data to be processed is an encrypted data stream, the data stream information corresponding to the data stream to be processed is obtained, and then the obtained data stream information is sent to the back-end system that has a subscription relationship with the data to be processed; so as to realize the step of obtaining the data stream information only once, each back-end system can obtain the data stream information corresponding to the data stream to be processed, and there is no need for each back-end system to carry out the data stream information acquisition process for the data stream to be processed, which reduces the difficulty of the back-end system to obtain the data stream information, and reduces the amount of resources required in the data stream processing process.

[0086] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0087] Based on the same inventive concept, the embodiment of the present application also provides a data stream processing device for implementing the data stream processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more data stream processing device embodiments provided below can refer to the limitations on the data stream processing method above, and will not be repeated here.

[0088] In one embodiment, Figure 7 As shown, a data stream processing device is provided, comprising: an identification module 10, an acquisition module 20 and a sending module 30, wherein:

[0089] The identification module 10 is used to identify the data flow attributes of the to-be-processed data flow connected to the splitter.

[0090] The acquisition module 20 is configured to acquire data stream information corresponding to the data stream to be processed if the attribute identification result shows that the data stream to be processed is an encrypted data stream.

[0091] The sending module 30 is used to send the data stream information to a backend system that has a subscription relationship with the data to be processed.

[0092] In one embodiment, target handshake information is extracted from the data stream to be processed to obtain target handshake information in the data stream information;

[0093] When the data to be processed is connected to the splitter, characteristic information is collected to obtain target characteristic information in the data flow information.

[0094] In one embodiment, the target characteristic information includes at least one of: number of packets, rate, flow duration, average packet size, average packet interval, number of packets in a specific packet length interval, and average packet size / rate in a specific time period interval.

[0095] In one embodiment, the target handshake information includes: at least one of a server name indication SNI, a resource directory indicator RDI, and authentication information Certification.

[0096] In one embodiment, determining whether the traffic protocol of the data flow to be processed is an encryption protocol;

[0097] If so, it is determined that the attribute identification result is that the data stream to be processed is an encrypted data stream; if not, it is determined that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

[0098] In one embodiment, verifying whether the target handshake information matches the traffic replication rule;

[0099] If there is a match, the duplicate data stream of the data stream to be processed is sent to the backend system.

[0100] The above-mentioned data stream processing device identifies the data stream attributes according to the data stream to be processed, and when the attribute identification result is that the data stream to be processed is an encrypted data stream, obtains the data stream information corresponding to the data stream to be processed, and then sends the data stream information to the back-end system that has a subscription relationship with the data to be processed. According to the above content, it can be seen that in the process of processing the data stream, the present application does not adopt the method of sending the data stream to multiple back-end systems in the prior art and extracting the data stream information in multiple back-end systems respectively; instead, after determining that the data to be processed is an encrypted data stream, the data stream information corresponding to the data stream to be processed is obtained, and then the obtained data stream information is sent to the back-end system that has a subscription relationship with the data to be processed; so as to realize the step of obtaining the data stream information only once, each back-end system can obtain the data stream information corresponding to the data stream to be processed, and each back-end system does not need to perform the data stream information acquisition process for the data stream to be processed, which reduces the difficulty of the back-end system to obtain the data stream information, and reduces the amount of resources required in the data stream processing process.

[0101] Each module in the above data stream processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0102] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a data stream processing method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0103] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0104] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0105] Identify data flow attributes of the data flow to be processed that is connected to the splitter;

[0106] If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed;

[0107] The data stream information is sent to the back-end system that has a subscription relationship with the data to be processed.

[0108] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0109] Extracting target handshake information from the data stream to be processed, and obtaining target handshake information in the data stream information;

[0110] When the data to be processed is connected to the splitter, characteristic information is collected to obtain target characteristic information in the data flow information.

[0111] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0112] The target characteristic information includes: at least one of the number of packets, rate, flow duration, average packet size, average packet interval, number of packets in a specific packet length interval, and average packet size / rate in a specific time interval.

[0113] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0114] The target handshake information includes at least one of a server name indication SNI, a resource directory indicator RDI, and authentication information Certification.

[0115] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0116] Determine whether the traffic protocol of the data flow to be processed is an encryption protocol;

[0117] If so, it is determined that the attribute identification result is that the data stream to be processed is an encrypted data stream; if not, it is determined that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

[0118] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0119] Verify that the target handshake information matches the traffic replication rule;

[0120] If there is a match, the duplicate data stream of the data stream to be processed is sent to the backend system.

[0121] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0122] Identify data flow attributes of the data flow to be processed that is connected to the splitter;

[0123] If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed;

[0124] The data stream information is sent to the back-end system that has a subscription relationship with the data to be processed.

[0125] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0126] Extracting target handshake information from the data stream to be processed, and obtaining target handshake information in the data stream information;

[0127] When the data to be processed is connected to the splitter, characteristic information is collected to obtain target characteristic information in the data flow information.

[0128] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0129] The target characteristic information includes: at least one of the number of packets, rate, flow duration, average packet size, average packet interval, number of packets in a specific packet length interval, and average packet size / rate in a specific time interval.

[0130] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0131] The target handshake information includes at least one of a server name indication SNI, a resource directory indicator RDI, and authentication information Certification.

[0132] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0133] Determine whether the traffic protocol of the data flow to be processed is an encryption protocol;

[0134] If so, it is determined that the attribute identification result is that the data stream to be processed is an encrypted data stream; if not, it is determined that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

[0135] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0136] Verify that the target handshake information matches the traffic replication rule;

[0137] If there is a match, the duplicate data stream of the data stream to be processed is sent to the backend system.

[0138] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0139] Identify data flow attributes of the data flow to be processed that is connected to the splitter;

[0140] If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed;

[0141] The data stream information is sent to the back-end system that has a subscription relationship with the data to be processed.

[0142] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0143] Extracting target handshake information from the data stream to be processed, and obtaining target handshake information in the data stream information;

[0144] When the data to be processed is connected to the splitter, characteristic information is collected to obtain target characteristic information in the data flow information.

[0145] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0146] The target characteristic information includes: at least one of the number of packets, rate, flow duration, average packet size, average packet interval, number of packets in a specific packet length interval, and average packet size / rate in a specific time interval.

[0147] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0148] The target handshake information includes at least one of a server name indication SNI, a resource directory indicator RDI, and authentication information Certification.

[0149] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0150] Determine whether the traffic protocol of the data flow to be processed is an encryption protocol;

[0151] If so, it is determined that the attribute identification result is that the data stream to be processed is an encrypted data stream; if not, it is determined that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

[0152] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0153] Verify that the target handshake information matches the traffic replication rule;

[0154] If there is a match, the duplicate data stream of the data stream to be processed is sent to the backend system.

[0155] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0156] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0157] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0158] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data stream processing method, characterized in that: The method comprises: Identify data flow attributes of the data flow to be processed that is connected to the splitter; If the attribute identification result is that the data stream to be processed is an encrypted data stream, then obtaining data stream information corresponding to the data stream to be processed; The data stream information is sent to a back-end system that has a subscription relationship with the data to be processed.

2. The method according to claim 1, characterized in that The data stream information includes target handshake information and target feature information; Obtaining data flow information corresponding to the data flow to be processed, including: Extracting target handshake information from the data stream to be processed to obtain target handshake information in the data stream information; During the process of the data to be processed being connected to the splitter, characteristic information is collected to obtain target characteristic information in the data flow information.

3. The method according to claim 2, characterized in that The target characteristic information includes: at least one of the number of packets, rate, flow duration, average packet size, average packet interval, number of packets in a specific packet length interval, and average packet size / rate in a specific time period interval.

4. The method according to claim 2, characterized in that: The target handshake information includes: at least one of a server name indication SNI, a resource directory indicator RDI and authentication information Certification.

5. The method according to any one of claims 1 to 4, characterized in that The step of identifying data flow attributes of the data flow to be processed by the access splitter includes: Determining whether the traffic protocol of the data flow to be processed is an encryption protocol; If so, it is determined that the attribute identification result is that the data stream to be processed is an encrypted data stream; if not, it is determined that the attribute identification result is that the data stream to be processed is a non-encrypted data stream.

6. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Verifying whether the target handshake information matches the traffic replication rule; If there is a match, the duplicate data stream of the data stream to be processed is sent to the backend system.

7. A data stream processing device, characterized in that: The device comprises: An identification module, used for identifying data flow attributes of the data flow to be processed that is connected to the splitter; An acquisition module, configured to acquire data stream information corresponding to the data stream to be processed if the attribute identification result indicates that the data stream to be processed is an encrypted data stream; The sending module is used to send the data stream information to a back-end system that has a subscription relationship with the data to be processed.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images