IMAP4 protocol-based TCP (Transmission Control Protocol) compressed stream analysis method and system

Abstract

The invention provides a TCP compressed stream analysis method and system based on an IMAP4 protocol, and the method comprises the steps: carrying out the flow recognition of a received TCP stream based on a preset target standard port, and obtaining a target TCP stream; performing data caching and sorting recombination on the target TCP stream to obtain a recombined TCP stream; performing TCP stream compression processing on the recombined TCP stream to obtain a compressed TCP stream; when the compressed TCP stream has the decompression object in the target direction, storing the content of the compressed TCP stream into the decompression object in the target direction; decompressing the decompressed object through a preset function to obtain plaintext TCP stream data; carrying out cutting and IP message packaging on the plaintext TCP stream data according to a standard separator to obtain cut packaging data; and analyzing the cut packaged data according to a preset format and a separator to obtain a data analysis result. According to the invention, rapid and efficient data analysis can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a TCP compression stream parsing method and system based on IMAP4 protocol. Background Art

[0002] IMAP4 (Internet Message Access Protocol 4) is the fourth version of the interactive data message access protocol. It supports protocol clients to access and read messages on the server online or offline, and can also interactively operate messages on the server.

[0003] In the field of network data analysis and parsing, after electronic compression using the IMAP4 method, data parsing cannot be achieved quickly. Even if all IP packets in the TCP stream are cached, it is necessary to wait for the FIN packet of the TCP stream or wait for the timeout of the stream, which will greatly extend the data parsing time. For massive network data, the data filtering efficiency will be greatly reduced, and large-scale application cannot be achieved.

[0004] It can be seen that the data analysis method of the IMAP4 protocol in the related art has the problem of low parsing efficiency caused by data compression. Summary of the invention

[0005] The present invention provides a TCP compressed stream parsing method and system based on IMAP4 protocol, which are used to solve the defect of low parsing efficiency caused by data compression in the IMAP4 protocol data analysis mode in the prior art, and realize fast and efficient data parsing.

[0006] The invention provides a TCP compression stream parsing method based on IMAP4 protocol, comprising the following steps.

[0007] The received TCP stream is identified based on a preset target standard port to obtain a target TCP stream; data is cached and sorted and reassembled on the target TCP stream to obtain a reassembled TCP stream; when a compression identifier is carried in the reassembled TCP stream, the reassembled TCP stream is compressed and processed to obtain a compressed TCP stream; the target direction of the compressed TCP stream is determined, and when a decompression object exists in the compressed TCP stream in the target direction, the content of the compressed TCP stream is stored in the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; the decompression object is decompressed by a preset function to obtain plaintext TCP stream data; the plaintext TCP stream data is cut and encapsulated in an IP message according to a standard delimiter of the IMAP4 protocol to obtain cut encapsulated data; the cut encapsulated data is parsed according to a preset format and the delimiter to obtain a data parsing result.

[0008] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, the received TCP stream is subjected to stream identification based on a preset target standard port to obtain a target TCP stream, comprising: performing IMAP4 stream identification and filtering on the received TCP stream to obtain a target data packet, wherein the source port or destination port of the target data packet is a preset target standard port; and establishing a TCP stream node of the target TCP stream based on the source IP address, destination IP address, source port, destination port and protocol type of the target data packet.

[0009] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, the target TCP stream is cached and sorted and reorganized to obtain a reorganized TCP stream, including: obtaining a current data packet received by the target TCP stream; when the linked list of the target TCP stream is empty, mounting the current data packet to the linked list of the TCP stream to obtain a reorganized TCP stream; when the linked list of the target TCP stream is not empty, reversely traversing all nodes of the TCP stream to determine the sequence number and confirmation number of the currently traversed node; when the sequence number of the current data packet is greater than the sequence number of the currently traversed node, using the currently traversed node as a node to be inserted; when the sequence number of the current data packet is greater than the confirmation number of the node to be inserted, removing repeated bytes between the current data packet and the node to be inserted, and updating the sequence number and confirmation number of the current data packet to obtain an updated data packet; inserting the updated data packet into the node to be inserted to obtain a reorganized TCP stream.

[0010] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, after determining the target direction of the compressed TCP stream, the method also includes: when there is no decompression object in the target direction of the compressed TCP stream, creating a new decompression object with the same direction as the target direction, and storing the content of the compressed TCP stream in the new decompression object.

[0011] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, the plaintext TCP stream data is cut and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the cut and encapsulated data, including: when there is a standard delimiter in the plaintext TCP stream data, the plaintext TCP stream data is cut according to the standard delimiter to obtain a single data packet, wherein the single data packet includes the data from the first byte to the first standard delimiter in the plaintext TCP stream data; the source IP address, destination IP address, source port and destination port in the single data packet are encapsulated to obtain the cut and encapsulated data.

[0012] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, before parsing the cut encapsulated data according to the preset format and the delimiter to obtain the data parsing result, the method also includes: determining the target direction of the cut encapsulated data; when the target direction is the uplink direction, parsing the cut encapsulated data, and when there is a first command in the cut encapsulated data, setting the cut encapsulated data to a ready-to-receive state; when the first command does not exist in the cut encapsulated data, discarding the cut encapsulated data; when the cut encapsulated data is in the ready-to-receive state, parsing the cut encapsulated data, and when there is a second command in the cut encapsulated data, setting the cut encapsulated data to a formally received state; when the second command does not exist in the cut encapsulated data, discarding the cut encapsulated data.

[0013] The present invention also provides a TCP compressed stream parsing system based on the IMAP4 protocol, comprising the following modules: a TCP stream reassembly module, used for performing stream identification on a received TCP stream based on a preset target standard port to obtain a target TCP stream; the TCP stream reassembly module is further used for performing data caching and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream; a TCP compressed stream decompression module is used for performing compressed TCP stream processing on the reassembled TCP stream when a compression identifier is carried in the reassembled TCP stream to obtain a compressed TCP stream; the TCP compressed stream decompression module is further used for determining a target direction of the compressed TCP stream, and in the compressed TCP When there is a decompression object in the target direction of the flow, the content of the compressed TCP flow is stored in the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; the TCP compressed flow decompression module is further used to decompress the decompression object through a preset function to obtain plaintext TCP flow data; the TCP flow plaintext data cutting module is used to cut and encapsulate the plaintext TCP flow data into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the cut encapsulated data; the IMAP4 data parsing module is used to parse the cut encapsulated data according to the preset format and the delimiter to obtain the data parsing result.

[0014] The present invention also provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the TCP compressed stream parsing method based on the IMAP4 protocol as described above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for parsing a TCP compressed stream based on the IMAP4 protocol as described above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned TCP compression stream parsing methods based on the IMAP4 protocol.

[0017] The invention provides a TCP compressed stream parsing method and system based on the IMAP4 protocol. The received TCP stream is identified through a preset target standard port, ensuring that only the target TCP stream is processed, reducing the interference of irrelevant data; data caching and sorting and reorganizing the target TCP stream to obtain a structured reorganized TCP stream, providing an accurate data basis for subsequent processing; when it is identified that the reorganized TCP stream carries a compression mark, the TCP stream is compressed to generate a compressed TCP stream; the bandwidth occupation of data transmission is reduced and the network transmission efficiency is improved; the target direction (uplink or downlink) of the compressed TCP stream is determined, and whether to store the content of the compressed TCP stream in the decompression object is determined according to whether there is a decompression object in the target direction, thereby improving the pertinence and flexibility of the data; the decompression object is decompressed through a preset function to obtain plaintext TCP stream data. Then, the plaintext TCP stream data is cut and IP message encapsulated according to the standard delimiter of the IMAP4 protocol, and the cut encapsulated data is parsed according to the preset format and delimiter to obtain the data parsing result; the integrity and accuracy of the data are ensured, and the efficiency and accuracy of data parsing are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a framework diagram of the TCP compression stream parsing system based on the IMAP4 protocol provided by the present invention.

[0020] Figure 2 It is a flow chart of the TCP compression stream parsing method based on the IMAP4 protocol provided by the present invention.

[0021] Figure 3 It is a schematic diagram of the working process of the TCP stream reassembly module provided by the present invention.

[0022] Figure 4 It is a schematic diagram of the working process of the TCP compression stream decompression module provided by the present invention.

[0023] Figure 5It is a workflow diagram of the TCP stream plaintext data cutting module provided by the present invention.

[0024] Figure 6 It is a schematic diagram of the workflow of the IMAP4 data parsing module provided by the present invention.

[0025] Figure 7 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] Electronic transmission relies on a variety of protocols, the most common of which are SMTP (Simple Mail Transfer Protocol), POP3 (Post Office Protocol) and IMAP (Internet Message Access Protocol). SMTP is used for sending, while POP3 and IMAP are used for receiving. The SMTP protocol ensures transmission from the sender's server to the receiver's server, while POP3 and IMAP protocols help users download or synchronize from the server.

[0028] IMAP4 (Internet Message Access Protocol 4) is the fourth version of the interactive data message access protocol. It supports the protocol client to access and read the server online or away, and can also interactively operate the server. IMAP4 makes up for many defects of the POP3 protocol, such as supporting whether the client and the server need to compress the data during data transmission, which is of great significance for large-capacity acquisition and can greatly improve the speed and efficiency of acquisition.

[0029] Faced with such a network environment, in the field of network data analysis and parsing, after electronic compression using the IMAP4 method, the MIME block header information cannot be quickly and effectively found in the BODYSTRUCTURE in the TCP compression stream, and data parsing cannot be quickly achieved. Even if all IP packets in the TCP stream are cached, it is necessary to wait for the FIN packet of the TCP stream or wait for the timeout of the stream, which will greatly extend the data parsing time. For massive network data, the data filtering efficiency will be greatly reduced, and large-scale application cannot be achieved.

[0030] In order to solve the problem of low parsing efficiency caused by data compression during IMAP4 acquisition, the present invention proposes a TCP compressed stream parsing method and system based on the IMAP4 protocol, which can effectively solve the problem that the TCP stream cannot be quickly and efficiently parsed after being compressed when analyzing data using the IMAP4 protocol, thereby achieving fast and efficient data parsing.

[0031] refer to Figure 1 , Figure 1 It is a framework diagram of the TCP compression stream parsing system based on the IMAP4 protocol provided by the present invention.

[0032] In order to solve the above technical problems, the present invention proposes a TCP compression stream parsing method and system based on the IMAP4 protocol, and its framework diagram is as follows: Figure 1 As shown, the system includes four modules: a TCP stream reassembly module (100), a TCP compressed stream decompression module (200), a TCP stream plaintext data cutting module (300), and an IMAP4 data parsing module (400). When the IMAP4 protocol is obtained, the data content cannot be parsed normally due to the compression of the TCP stream, and a new data packet is encapsulated after segmented decompression of the TCP stream and cutting of the TCP data delimiter, so as to achieve the purpose of fast and efficient content analysis.

[0033] Optionally, the TCP compressed stream parsing method based on the IMAP4 protocol in the embodiment of the present application can be executed by a server, or by a terminal device, or by both a server and a terminal device. Taking the example of the TCP compressed stream parsing method based on the IMAP4 protocol in this embodiment being executed by a server.

[0034] Figure 2 FIG. 1 is a flow chart of a TCP compression stream parsing method based on the IMAP4 protocol provided by the present invention. Figure 2 As shown, the method includes the following steps.

[0035] Step 1: Perform flow identification on the received TCP flow based on the preset target standard port to obtain the target TCP flow.

[0036] Among them, the Transmission Control Protocol (TCP) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol; TCP is designed to adapt to the layered protocol hierarchy that supports multiple network applications. Pairs of application processes in an interconnected computer communication network can rely on TCP to provide reliable communication services to transmit byte streams. TCP supports bidirectional data flows, and applications can also send data in only one direction. Between hosts, TCP uses port numbers to identify application services and can transmit data streams in multiple channels.

[0037] In the embodiment of the present invention, the TCP flow reassembly module is used to determine whether the TCP communication port is port 143 to perform flow identification. The IMAP4 protocol uses the standard 143 communication port for communication. The module sorts and reassembles data packets based on the TCP header sequence. The module uses the actual intercepted load position as a parameter, combines the offset of the actual intercepted position of the TCP load relative to the starting position, calculates the offset relative to the starting position of the load and the final load length, and calculates the data length to be read based on the final load length stored in the data frame, reads the data to be stored after the current frame from the file, and writes the intercepted data of this frame.

[0038] According to a TCP compression stream parsing method based on the IMAP4 protocol provided by the present invention, a received TCP stream is identified based on a preset target standard port to obtain a target TCP stream, including: Performing IMAP4 stream identification and filtering on the received TCP stream to obtain a target data packet, wherein the source port or destination port of the target data packet is a preset target standard port; A TCP flow node of a target TCP flow is established based on the source IP address, destination IP address, source port, destination port, and protocol type of the target data packet.

[0039] refer to Figure 3 , Figure 3 It is a schematic diagram of the working process of the TCP stream reassembly module provided by the present invention.

[0040] The TCP stream reassembly module 100 is responsible for TCP stream identification, data caching, sorting, and reassembly, which specifically includes the following steps.

[0041] Step 101, IP layer protocol analysis.

[0042] Perform protocol analysis on the IP layer, analyze the IP version, IP packet length, identifier, fragmentation flag, fragmentation offset, TTL, transport layer protocol type, source IP, destination IP and other information and save them in the IP packet memory object; Among them, the Internet Protocol (IP) is the core of the entire TCP / IP protocol family and the foundation of the Internet. IP is located in the network layer of the TCP / IP model (equivalent to the network layer of the OSI model), and it can provide information of various protocols to the transport layer; here, IP packets are data packets.

[0043] Step 102, TCP header parsing.

[0044] Parse the source port, destination port, checksum, sequence number, acknowledgment number, flags, checksum, etc., continue to process the data packets whose source port or destination port is the standard port 143, discard the rest of the data packets, perform IMAP4 flow identification and filtering, and establish a TCP flow node based on the five-tuple of source IP, destination IP, source port, destination port, and protocol type.

[0045] Through the embodiment of the present invention, by checking the port number and protocol identifier of the data packet, the IMAP4 traffic can be accurately identified, and according to the preset target standard port, specific IMAP4 data packets can be filtered out to reduce redundant traffic in the network and improve network transmission efficiency.

[0046] Continue to refer Figure 2 ,Step 2, cache and sort the target TCP stream and reorganize it to obtain the reorganized TCP stream.

[0047] In an embodiment of the present invention, a cache mechanism is established to store the received target TCP stream. The cache can be a memory-based data structure, such as a hash table, a linked list, or a queue, for storing TCP segments and related information (such as sequence numbers, acknowledgment numbers, data lengths, etc.).

[0048] The sequence number in the target TCP stream is used to identify the position of the data in the TCP stream. According to the sequence number, the received target TCP stream can be sorted. After sorting, the data parts in the TCP segments can be spliced ​​together according to the sequence number to form a complete TCP stream. In the sorting process, out-of-order or duplicate TCP segments will be encountered. The out-of-order segments need to be temporarily stored until the previous segment arrives; the duplicate segments can be discarded, and then the reassembled TCP stream is obtained.

[0049] According to a TCP compression stream parsing method based on the IMAP4 protocol provided by the present invention, data caching and sorting and reorganizing the target TCP stream are performed to obtain a reorganized TCP stream, including: Get the current data packet received by the target TCP stream; When the linked list of the target TCP stream is empty, the current data packet is mounted to the linked list of the TCP stream to obtain the reassembled TCP stream; When the linked list of the target TCP stream is not empty, reversely traverse all nodes of the TCP stream to determine the sequence number and confirmation number of the currently traversed node; When the sequence number of the current data packet is greater than the sequence number of the currently traversed node, the currently traversed node is used as the node to be inserted; When the sequence number of the current data packet is greater than the confirmation number of the node to be inserted, the duplicate bytes between the current data packet and the node to be inserted are removed, and the sequence number and confirmation number of the current data packet are updated to obtain an updated data packet; Insert the update data packet into the node to be inserted to obtain the reassembled TCP stream.

[0050] In network communications, a TCP stream is composed of multiple TCP packets. These packets may arrive out of order due to network conditions (such as delay, packet loss, etc.). The process of reassembling a TCP stream is to reorder the TCP packets that arrive out of order according to their sequence numbers to restore the original, ordered TCP data stream.

[0051] In the embodiment of the present invention, if the linked list (sequential queue for storing data packets) of the target TCP stream is empty, it means that this is the first data packet received by the TCP stream. The current data packet is directly mounted to the linked list of the TCP stream to form an initial reassembled TCP stream. If the linked list is not empty, it means that the TCP stream has previously received and stored data packets, and the next step is to perform data packet reordering and deduplication processing.

[0052] Traverse all nodes in reverse from the end of the linked list, each node represents a received and stored data packet. By traversing in reverse, it is easier to find the position where the current data packet should be inserted to ensure the correct order of the data packets. During the traversal process, record the sequence number (Seq) and acknowledgment number (Ack) of the current traversal node. The sequence number (Seq) is used to identify the position of the data packet in the TCP stream. The acknowledgment number (Ack) is used to identify the sequence number of the next data packet that the receiver expects to receive.

[0053] Compare the sequence number of the current data packet with the sequence number of the currently traversed node. If the sequence number of the current data packet is greater than the sequence number of the currently traversed node, mark the node as a node to be inserted. Compare the sequence number of the current data packet with the confirmation number of the node to be inserted. If the sequence number of the current data packet is greater than the confirmation number of the node to be inserted, it means that there is duplicate data between the current data packet and the node to be inserted. Remove the duplicate bytes and update the sequence number and confirmation number of the current data packet to obtain the updated data packet.

[0054] Insert the updated data packet into the position of the node to be inserted, and obtain the reassembled TCP stream.

[0055] Continue to refer Figure 3 , step 103, determine the uplink and downlink.

[0056] The data packet with source port 143 is judged as a downlink data packet, otherwise it is an uplink data packet.

[0057] Step 104: sequence and ack are calculated and saved.

[0058] Save the sequence number of the data packet and calculate the acknowledgment number based on the packet length.

[0059] Step 105, determine whether the TCP stream is empty.

[0060] To determine whether the TCP stream is empty, it is necessary to determine whether the first and last nodes of the linked list have the same address. If they are the same, the linked list is empty.

[0061] Step 106, mount the linked list node to save the data packet.

[0062] When the linked list is empty, it proves that the current data packet is the first IP packet of the TCP flow and is directly mounted in the TCP flow linked list.

[0063] Step 107, traverse the TCP flow linked list.

[0064] When the TCP flow node is not empty, reversely traverse all the nodes of the TCP flow, take out the sequence number (Sequence Number) and acknowledgment number (Acknowledgment Number) of each node, and compare them with the sequence number and acknowledgment number saved in the current IP packet.

[0065] Step 108, determine whether the insertion node is found.

[0066] Traverse the linked list in reverse order, compare the sequence number and confirmation number of the current IP packet with the sequence number and confirmation number stored in the current IP packet and the sequence number and confirmation number of each node. When the sequence number and confirmation number of the current IP packet are greater than the sequence number and confirmation number of the currently traversed node, the current node is the node position to be inserted, otherwise continue to traverse the remaining flow nodes.

[0067] Step 109, determine whether the Sequence is repeated.

[0068] Compare the value of the sequence number Sequence of the current IP packet with the confirmation number Ack of the node to be inserted. If they are greater, it is determined that the Sequence is repeated.

[0069] Step 110, remove duplicate bytes and save the data packet.

[0070] If the current IP packet has a duplicate Sequence with the flow node to be inserted, remove the duplicate bytes in the current IP packet, insert the non-duplicate bytes into the current TCP flow node, and update the sequence number and confirmation number of the current IP packet.

[0071] Step 111, mount the IP packet to the current location.

[0072] After finding the node to be inserted, the current IP message is inserted into the flow node to be inserted. At this point, TCP flow identification, sorting, and deduplication are completed.

[0073] The embodiment of the present invention realizes the sequence reorganization and deduplication processing of the data packets received by the target TCP stream, ensures the correct sequence of the data packets in the TCP stream, and avoids the transmission of duplicate data, thereby improving the reliability and efficiency of TCP transmission.

[0074] Continue to refer Figure 2 , Step 3, when the reassembled TCP stream carries a compression identifier, the reassembled TCP stream is subjected to compressed TCP stream processing to obtain a compressed TCP stream.

[0075] In the embodiment of the present invention, the TCP compressed stream decompression module is used for identifying and decompressing the upstream and downstream compressed data.

[0076] The TCP compressed stream decompression module is used to determine whether the data packet has the "compress deflate" compression flag. After determining that it is a TCP compressed stream, the compression flag of the stream is set. When processing subsequent TCP data packets, non-compressed TCP streams and compressed TCP streams are processed according to whether there is a compression flag. According to the upstream and downstream directions of the data, GZIP decompression objects for the upstream and downstream directions are established respectively, and storage space for decompressed data is applied in the decompression object. The data is stored in the corresponding decompression object, and the GZIP decompression interface inflate function in the ZLIB library is called to implement decompression. After decompression is successful, the decompressed data is stored in the decompression cache space for subsequent TCP stream plaintext data cutting module to cut and encapsulate.

[0077] Step 4, determine the target direction of the compressed TCP stream, and when there is a decompression object in the target direction of the compressed TCP stream, store the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction.

[0078] In the TCP / IP protocol stack, the data transmission direction is clearly distinguished. The upstream direction usually refers to the direction from the client to the server, while the downstream direction refers to the direction from the server to the client. Different application scenarios have different requirements for the data transmission direction.

[0079] For example, in real-time communication applications, uplink data (such as user input or requests) may need to be compressed to reduce latency, while in other applications, downlink data (such as server responses or content distribution) may need to be compressed to save bandwidth.

[0080] In network communications, the target direction is usually determined based on the establishment of a TCP connection and the sending and receiving of data packets. For example, when a client initiates a connection request to a server, the connection is considered to be in the upstream direction; and when the server sends a response data to the client, the connection is considered to be in the downstream direction.

[0081] Select an appropriate compression algorithm based on application requirements and network conditions. Common compression algorithms include lossless compression (such as DEFLATE, GZIP, etc.), which encapsulates the compressed data into a format suitable for network transmission and adds necessary metadata (such as compression algorithm identifier, data length, etc.) so that the receiving end can correctly decompress it.

[0082] After determining the target direction, it is necessary to check whether there is a decompression object that can process compressed data in the direction. When it is confirmed that there is a decompression object in the target direction, the content of the compressed TCP stream is transferred to the decompression object.

[0083] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, after determining the target direction of the compressed TCP stream, the method further includes: When there is no decompression object in the target direction of the compressed TCP stream, a new decompression object with the same direction as the target direction is created, and the content of the compressed TCP stream is stored in the new decompression object.

[0084] When there is no decompression object in the target direction, the compressed data may be lost or not processed correctly. By creating a new decompression object, you can ensure that the data is received and decompressed, thus avoiding data loss.

[0085] In the embodiment of the present invention, a new decompression object is instantiated according to a preset configuration or strategy. The new decompression object needs to be properly configured and initialized to ensure that it can correctly process the data in the compressed TCP stream. For example, the decompression algorithm is set, the network interface is configured, and the interaction mode with other system components is defined.

[0086] After the decompression object is created and initialized, the content of the compressed TCP stream will be transferred to the newly created decompression object.

[0087] According to the embodiment of the present invention, by creating a new decompression object to process the data, the integrity of the data stream can be ensured, and the data can be prevented from being interrupted or lost during the transmission process.

[0088] Step 5, decompress the decompression object through a preset function to obtain plaintext TCP stream data.

[0089] refer to Figure 4 , Figure 4 It is a schematic diagram of the working process of the TCP compression stream decompression module provided by the present invention.

[0090] Step 201, determine whether there is a compression mark.

[0091] Determine whether there is a negotiated "compress deflate" compression flag. If the negotiation succeeds, it is determined to be a TCP compressed stream. If the negotiation fails or there is no compression flag, it is determined to be a non-compressed stream.

[0092] In the HTTP protocol, deflate is a commonly used content encoding type, which is used to compress transmitted data to reduce the transmission volume and improve transmission efficiency.

[0093] Step 202, determine whether the decompression object exists.

[0094] According to the upstream and downstream directions of the IP data packet, determine whether there is a decompression object in this direction, that is, whether the decompression object pointer is empty.

[0095] Step 203: Create a new decompression object for the same-direction stream.

[0096] If the decompression object does not exist, apply for the decompression object and assign an initial value, and store the TCP compressed data of the data packet in the decompression object.

[0097] Step 204, sending the TCP payload to the decompression object.

[0098] If the decompression object exists, the content of the current IP packet is stored in the decompression object in the same direction of upstream and downstream.

[0099] Step 205, calling the ZLIB library interface for decompression.

[0100] Call the inflate function in the ZLIB library to decompress all data contents in the decompressed object.

[0101] Here, ZLIB library is an open source data compression library used to compress and decompress data. inflate is a function in ZLIB library that is used to decompress ZLIB compressed data. The inflate function uses the DEFLATE algorithm to achieve decompression by reading compressed blocks in the input data stream and decoding them into raw data blocks. It accepts compressed data as input and decompresses it into raw data.

[0102] Step 206, determining whether the decompression is successful.

[0103] Determine whether the decompression is successful based on the return value of the inflate function. If it fails, the current data packet will be discarded.

[0104] Step 207, decompress the content and store it in the plain text area.

[0105] The successfully decompressed data is stored in the cache requested by the decompression object. If the cache is empty, the currently decompressed data is stored in the first address. If there is historical data in the cache, the currently successfully decompressed data is stored at the end of the cache after calculating the offset for subsequent TCP stream plaintext data cutting module to cut and use.

[0106] Through the embodiments of the present invention, by compressing the TCP stream, the amount of data that needs to be transmitted can be significantly reduced. By determining the target direction and storing the decompressed object, it is ensured that the compressed TCP stream can be correctly transmitted to the target direction and can be correctly decompressed and restored when needed.

[0107] Continue to refer Figure 2 , Step 6, cut the plaintext TCP stream data and encapsulate it into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the cut and encapsulated data.

[0108] In the embodiment of the present invention, the TCP stream plaintext data cutting module is used to cut the TCP stream and encapsulate it into IP packets according to the delimiter of the IMAP4 protocol.

[0109] The TCP stream plaintext data cutting module cuts the data using the \r\n separator for the cached decompressed TCP stream data in the decompression object, and determines whether there is a \r\n cutting symbol. If there is no separator, the data is cached and the next round of cutting is performed after the next batch of decompressed data in the same direction is successfully decompressed. If there is a \r\n separator, the data is cut according to the separator, from the first byte to the first \r\n, and cut into a single data packet. The source IP and destination IP, source port and destination port information in the data packet are saved, and a new IP data packet is encapsulated based on this information. After the encapsulation is successful, the data is sent to the IMAP4 data parsing module (400) for data parsing.

[0110] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, plain text TCP stream data is cut and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the cut encapsulated data, including: When a standard delimiter exists in the plaintext TCP stream data, the plaintext TCP stream data is cut according to the standard delimiter to obtain a single data packet, wherein the single data packet includes data from the first byte to the first standard delimiter in the plaintext TCP stream data; The source IP address, destination IP address, source port and destination port in a single data packet are encapsulated to obtain the cut and encapsulated data.

[0111] refer to Figure 5 , Figure 5 It is a workflow diagram of the TCP stream plaintext data cutting module provided by the present invention.

[0112] Step 301, TCP decompresses the object plaintext data.

[0113] Get all the plaintext data from the decompressed object and enter this module for cutting processing.

[0114] Step 302, determine whether there is a separator.

[0115] Determine whether the current plaintext data contains the separator \r\n, which is the standard separator of the IMAP4 protocol.

[0116] Step 303, split the data according to the delimiter.

[0117] According to the IMAP4 protocol data separator \r\n, the data is split, and it is determined whether there is a \r\n split symbol. The data is not cached and the next batch of data in the same direction is decompressed. If there is a \r\n separator, the data is split according to the separator, and the data from the first byte to the first \r\n is a single data packet.

[0118] Step 304, encapsulate the cut IP data packet.

[0119] Encapsulate the source IP and destination IP, source port and destination port stored in the decompressed object into a new IP data packet. After successful encapsulation, the data is sent to the IMAP4 data parsing module (400) for parsing. Step 305, sending the plaintext data packet to the function for parsing.

[0120] The successfully encapsulated data is sent to the IMAP4 data parsing module for parsing.

[0121] In an embodiment of the present invention, the standard delimiter used in the plaintext TCP stream data is determined. This is usually one or more specific characters or strings used to identify the boundaries of the data packet; scan from the first byte of the plaintext TCP stream data to find the position of the first standard delimiter; after finding the first standard delimiter, cut out the data before it (from the first byte to the last byte before the delimiter) to form a single data packet. Repeat the above process to scan and cut the remaining data until the entire plaintext TCP stream data is processed.

[0122] Each single packet cut out is parsed to extract the network layer information (such as IP address and port number). The source IP address and destination IP address are extracted from the IP header of the packet. The source port and destination port are extracted from the transport layer header (such as TCP header) of the packet. The extracted source IP address, destination IP address, source port and destination port information are encapsulated. The encapsulation format can be designed according to specific needs, which can be a simple text format, binary format or other format. The information extracted and encapsulated from each packet is generated to generate the cut encapsulated data. This data can be stored in memory, written to a file, or sent over the network.

[0123] Through the embodiment of the present invention, the plaintext TCP stream data can be cut into single data packets according to the standard delimiter, and the network information therein can be extracted and encapsulated to obtain the cut and encapsulated data.

[0124] Continue to refer Figure 2 , Step 7, parse the cut and packaged data according to the preset format and delimiter to obtain the data parsing result.

[0125] In the embodiment of the present invention, the IMAP4 data parsing module is used to parse the content of the encapsulated IP message after cutting.

[0126] The IMAP4 data parsing module is used to determine whether there are FETCH and BODY instructions in the data packet, and determine whether the packet is upstream or downstream. When it is determined to be upstream data, the data packet is parsed to find out whether there is a BODY command. If BODY.PEEK[], BODY.PEEK[HEADER, BODYSTRUCTURE, etc. appear, it is determined to enter the ready to receive state. When processing downstream data, it is determined whether the downstream packet of the TCP stream has a FETCH command. If so, the TCP stream enters the formal receiving state; when processing the next downstream data, all downstream data packets are cached until an upstream data packet appears, indicating that the IMAP4 data reception is completed. All saved downstream data payload parts are reorganized and the content is parsed according to the format and delimiter.

[0127] In the embodiment of the present invention, each field in the encapsulated data is parsed one by one according to the delimiter, for example, operations such as extracting text strings, parsing numbers, converting data types, etc. The parsed fields and data are organized according to a preset format (such as an object, an array, or a dictionary) to generate a data parsing result.

[0128] Through the above steps of the embodiment of the present invention, the received TCP stream is identified through the preset target standard port, ensuring that only the target TCP stream is processed, reducing the interference of irrelevant data; the target TCP stream is cached and sorted and reorganized to obtain a structured reorganized TCP stream, providing an accurate data basis for subsequent processing; when it is identified that the reorganized TCP stream carries a compression identifier, the TCP stream is compressed to generate a compressed TCP stream; the bandwidth occupied by data transmission is reduced and the network transmission efficiency is improved; the target direction (uplink or downlink) of the compressed TCP stream is determined, and whether to store the content of the compressed TCP stream in the decompression object is determined according to whether there is a decompression object in the target direction, thereby improving the pertinence and flexibility of the data; the decompression object is decompressed through a preset function to obtain plaintext TCP stream data. Then, the plaintext TCP stream data is cut and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol, and the cut encapsulated data is parsed according to the preset format and delimiter to obtain the data parsing result; the integrity and accuracy of the data are ensured, while the efficiency and accuracy of data parsing are improved.

[0129] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, before parsing the cut encapsulated data according to a preset format and delimiter to obtain a data parsing result, the method further includes: Determine the target direction of the package data after cutting; When the target direction is the uplink direction, the cut encapsulated data is parsed, and when the cut encapsulated data contains the first command, the cut encapsulated data is set to be ready to receive; when the cut encapsulated data does not contain the first command, the cut encapsulated data is discarded; When the cut encapsulated data is in the ready-to-receive state, the cut encapsulated data is parsed, and when there is a second command in the cut encapsulated data, the cut encapsulated data is set to the formal receiving state; when there is no second command in the cut encapsulated data, the cut encapsulated data is discarded.

[0130] Here, the first command is the above-mentioned BODY command, and the second command is the above-mentioned FETCH command.

[0131] refer to Figure 6 , Figure 6 It is a schematic diagram of the workflow of the IMAP4 data parsing module provided by the present invention.

[0132] Step 401, determine whether it is an uplink packet.

[0133] Determine whether the data packet is uplink data. If it is uplink data, find the flag bit in the uplink data packet; Step 402, discard the data packet.

[0134] In the initial state of IMAP4, if the downlink data is received first without the flow flag, the data is discarded; Step 403, determine whether there is a BODY command.

[0135] If it is an uplink data packet, determine whether there are commands such as BODY.PEEK[], BODY.PEEK[HEADER, BODYSTRUCTURE, etc. in the data packet; Step 404: The TCP stream enters a ready-to-receive state.

[0136] If the BODY instruction exists, the TCP stream enters the ready-to-receive state. If not, the state bit is wrong and the data packet is discarded. Step 405, determine whether there is a FETCH command.

[0137] After the TCP stream enters the ready-to-receive state, determine whether the current data packet has a FETCH command. If not, discard the data packet; if so, set the TCP stream to enter the receiving state; Step 406, receiving data.

[0138] Set the TCP stream state to the formal start receiving state; Step 407, determine whether it is a downlink packet.

[0139] After the TCP stream enters the formal receiving state, it determines whether the current data packet has a TCP payload and whether the data direction is downlink data; Step 408, receiving the downlink data mounting linked list.

[0140] If it is downlink data, the data packet is the content, the data packet is saved and hung in the content list; if it is uplink data, it is determined that the IMAP4 content has been received; Step 409, determining whether data reception is completed.

[0141] The TCP stream receives a stream timeout message or receives an uplink data packet of the stream, and determines that the reception is complete; Step 410, sending the analysis result.

[0142] After receiving the content, IMAP4 parses it according to the format and separator.

[0143] Through the embodiment of the present invention, the data packaged after cutting can be correctly processed, and corresponding state setting and data reception can be performed according to the commands contained therein, so that the content can be parsed according to the format and separator after reception.

[0144] The above embodiments of the present invention relate to the field of network data analysis and parsing, and solve the problem that the data cannot be filtered quickly and efficiently after the TCP stream is compressed when analyzing data using the IMAP4 protocol. Figure 1 The system comprises a TCP stream reassembly module (100), a TCP compressed stream decompression module (200), a TCP stream plaintext data cutting module (300), and an IMAP4 data parsing module (400); the interactive relationship is as follows: the TCP stream reassembly module (100) is responsible for TCP stream identification and data caching, sorting, and reassembly; the TCP compressed stream decompression module (200) is responsible for identification and decompression of upstream and downstream compressed data; the TCP stream plaintext data cutting module (300) cuts the TCP stream and encapsulates the IP message according to the delimiter of the IMAP4 protocol; the IMAP4 data parsing module (400) is responsible for parsing the content of the IP message encapsulated after cutting; the present invention has low coupling, high scalability, flexibility, and high efficiency. The present invention aims at the problem that the IMAP4 protocol TCP data stream in network data cannot be normally filtered after being compressed, and proposes a fast and efficient solution for TCP stream decompression and data analysis. The analysis efficiency is improved by segmented decompression of the TCP stream and encapsulation of new data packets after TCP data delimiter cutting, so as to achieve the purpose of fast and efficient content analysis. The method of segmented decompression of the TCP stream can also be applied to data analysis of other application protocols.

[0145] The TCP compressed stream parsing system based on the IMAP4 protocol provided by the present invention is described below. The TCP compressed stream parsing system based on the IMAP4 protocol described below and the TCP compressed stream parsing method based on the IMAP4 protocol described above can be referred to each other.

[0146] refer to Figure 1 , Figure 1 It is a framework diagram of the TCP compression stream parsing system based on the IMAP4 protocol provided by the present invention.

[0147] The TCP stream reassembly module 100 is used to perform stream identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; The TCP stream reassembly module 100 is also used to cache and sort the target TCP stream to obtain a reassembled TCP stream; The TCP compressed stream decompression module 200 is used to perform compressed TCP stream processing on the reassembled TCP stream when a compression mark is carried in the reassembled TCP stream to obtain a compressed TCP stream; The TCP compressed stream decompression module 200 is further used to determine the target direction of the compressed TCP stream, and when there is a decompression object in the target direction of the compressed TCP stream, store the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; The TCP compressed stream decompression module 200 is also used to decompress the decompression object through a preset function to obtain plaintext TCP stream data; The TCP stream plaintext data cutting module 300 is used to cut and encapsulate the plaintext TCP stream data into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the encapsulated data after cutting; The IMAP4 data parsing module 400 is used to parse the cut and encapsulated data according to a preset format and separator to obtain a data parsing result.

[0148] Specifically, the above-mentioned TCP compressed stream parsing system based on the IMAP4 protocol provided by the present invention can implement all the method steps implemented by the above-mentioned TCP compressed stream parsing method embodiment based on the IMAP4 protocol, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0149] Figure 7 is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as Figure 7 As shown, the electronic device may include: a processor (processor) 710 , a communication interface (Communications Interface) 720 , a memory (memory) 730 and a communication bus 740 , wherein the processor 710 , the communication interface 720 , and the memory 730 communicate with each other through the communication bus 740 . The processor 710 can call the logic instructions in the memory 730 to execute the TCP compressed stream parsing method based on the IMAP4 protocol, which includes: performing stream identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; performing data caching and sorting reorganization on the target TCP stream to obtain a reorganized TCP stream; when the reorganized TCP stream carries a compression identifier, performing compressed TCP stream processing on the reorganized TCP stream to obtain a compressed TCP stream; determining the target direction of the compressed TCP stream, and when there is a decompression object in the target direction of the compressed TCP stream, storing the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; decompressing the decompression object through a preset function to obtain plaintext TCP stream data; cutting and IP packet encapsulating the plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain cut encapsulated data; parsing the cut encapsulated data according to the preset format and delimiter to obtain a data parsing result.

[0150] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0151] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the TCP compressed stream parsing method based on the IMAP4 protocol provided by the above methods, which includes: performing stream identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; performing data caching and sorting and reorganizing on the target TCP stream to obtain a reorganized TCP stream; when a compression identifier is carried in the reorganized TCP stream, performing compressed TCP stream processing on the reorganized TCP stream to obtain a compressed TCP stream; determining a target direction of the compressed TCP stream, and when a decompression object exists in the target direction of the compressed TCP stream, storing the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; decompressing the decompression object through a preset function to obtain plaintext TCP stream data; cutting and IP packet encapsulating the plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain cut encapsulated data; parsing the cut encapsulated data according to the preset format and delimiter to obtain a data parsing result.

[0152] On the other hand, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is implemented to execute the TCP compressed stream parsing method based on the IMAP4 protocol provided by the above methods, the method comprising: performing stream identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; performing data caching and sorting and reorganizing on the target TCP stream to obtain a reorganized TCP stream; when a compression identifier is carried in the reorganized TCP stream, performing compressed TCP stream processing on the reorganized TCP stream to obtain a compressed TCP stream; determining a target direction of the compressed TCP stream, and when a decompression object exists in the target direction of the compressed TCP stream, storing the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; decompressing the decompression object by a preset function to obtain plaintext TCP stream data; cutting and IP packet encapsulating the plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain cut encapsulated data; parsing the cut encapsulated data according to the preset format and delimiter to obtain a data parsing result.

[0153] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A TCP compressed stream parsing method based on IMAP4 protocol, characterized in that: include: Perform flow identification on the received TCP flow based on the preset target standard port to obtain the target TCP flow; Buffering and sorting the target TCP stream to obtain a reorganized TCP stream; When the reassembled TCP stream carries a compression identifier, performing a compressed TCP stream process on the reassembled TCP stream to obtain a compressed TCP stream; Determine the target direction of the compressed TCP stream, and when there is a decompression object in the target direction of the compressed TCP stream, store the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; Decompress the decompression object by using a preset function to obtain plaintext TCP stream data; The plaintext TCP stream data is cut and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol to obtain cut and encapsulated data; The cut and packaged data is parsed according to a preset format and the separator to obtain a data parsing result.

2. The method for analyzing TCP compressed stream based on IMAP4 protocol according to claim 1, characterized in that: The step of performing flow identification on the received TCP flow based on the preset target standard port to obtain the target TCP flow includes: Performing IMAP4 stream identification and filtering on the received TCP stream to obtain a target data packet, wherein the source port or destination port of the target data packet is a preset target standard port; A TCP flow node of a target TCP flow is established based on the source IP address, destination IP address, source port, destination port and protocol type of the target data packet.

3. The method for analyzing TCP compressed stream based on IMAP4 protocol according to claim 2, characterized in that: The step of caching and sorting the target TCP stream to obtain a reorganized TCP stream includes: Obtain the current data packet received by the target TCP stream; When the linked list of the target TCP stream is empty, mounting the current data packet to the linked list of the TCP stream to obtain a reassembled TCP stream; When the linked list of the target TCP stream is not empty, reversely traverse all nodes of the TCP stream to determine the sequence number and confirmation number of the currently traversed node; When the sequence number of the current data packet is greater than the sequence number of the current traversal node, the current traversal node is used as a node to be inserted; When the sequence number of the current data packet is greater than the confirmation number of the node to be inserted, removing duplicate bytes between the current data packet and the node to be inserted, and updating the sequence number and confirmation number of the current data packet to obtain an updated data packet; The update data packet is inserted into the node to be inserted to obtain a reassembled TCP stream.

4. The method for analyzing TCP compressed stream based on IMAP4 protocol according to claim 1, characterized in that: After determining the target direction of the compressed TCP stream, the method further comprises: When there is no decompression object in the target direction of the compressed TCP stream, a new decompression object having the same direction as the target direction is created, and the content of the compressed TCP stream is stored in the new decompression object.

5. The method for analyzing TCP compressed stream based on IMAP4 protocol according to claim 1, characterized in that: The step of cutting the plaintext TCP stream data and encapsulating the plaintext TCP stream data into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the cut encapsulated data includes: When a standard delimiter exists in the plaintext TCP stream data, the plaintext TCP stream data is cut according to the standard delimiter to obtain a single data packet, wherein the single data packet includes data from the first byte to the first standard delimiter in the plaintext TCP stream data; The source IP address, the destination IP address, the source port and the destination port in the single data packet are encapsulated to obtain the cut and encapsulated data.

6. The method for analyzing TCP compressed stream based on IMAP4 protocol according to claim 1, characterized in that: Before parsing the cut and packaged data according to the preset format and the delimiter to obtain the data parsing result, the method further includes: Determining a target direction of the packaged data after cutting; When the target direction is the uplink direction, the cut encapsulated data is parsed, and when the cut encapsulated data contains a first command, the cut encapsulated data is set to be ready to receive; when the cut encapsulated data contains no first command, the cut encapsulated data is discarded; When the cut encapsulated data is in a ready-to-receive state, the cut encapsulated data is parsed, and when a second command exists in the cut encapsulated data, the cut encapsulated data is set to a formal receiving state; when the second command does not exist in the cut encapsulated data, the cut encapsulated data is discarded.

7. A TCP compressed stream parsing system based on IMAP4 protocol, characterized in that: include: A TCP stream reassembly module is used to perform stream identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; The TCP stream reassembly module is further used to cache and sort the target TCP stream to obtain a reassembled TCP stream; A TCP compressed stream decompression module, used for, when the reassembled TCP stream carries a compression identifier, performing compressed TCP stream processing on the reassembled TCP stream to obtain a compressed TCP stream; The TCP compressed stream decompression module is further used to determine the target direction of the compressed TCP stream, and when the compressed TCP stream has a decompression object in the target direction, store the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: an upstream direction and a downstream direction; The TCP compressed stream decompression module is further used to decompress the decompression object through a preset function to obtain plaintext TCP stream data; A TCP stream plaintext data cutting module, used to cut and encapsulate the plaintext TCP stream data into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the encapsulated data after cutting; The IMAP4 data parsing module is used to parse the cut and encapsulated data according to a preset format and the separator to obtain a data parsing result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the TCP compressed stream parsing method based on the IMAP4 protocol is implemented as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for parsing a TCP compressed stream based on the IMAP4 protocol as claimed in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for parsing a TCP compressed stream based on the IMAP4 protocol as claimed in any one of claims 1 to 6 is implemented.

Images