Method and system for parsing tcp compressed stream based on imap4 protocol

Abstract

The application provides a TCP compression stream analysis method and system based on an IMAP4 protocol, and the method comprises the following steps: performing stream identification on a received TCP stream based on a preset target standard port to obtain a target TCP stream; performing data caching and ordering and reorganization on the target TCP stream to obtain a reorganized TCP stream; performing compressed TCP stream processing on the reorganized TCP stream to obtain a compressed TCP stream; when there is a decompression object in the target direction of the compressed TCP stream, storing the content of the compressed TCP stream into the decompression object in the target direction; decompressing the decompression object by using a preset function to obtain plaintext TCP stream data; cutting and IP packet encapsulating the plaintext TCP stream data according to a standard delimiter to obtain cut and encapsulated data; and analyzing the cut and encapsulated data according to a preset format and delimiter to obtain data analysis results. The application can realize fast and efficient data analysis.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to a TCP compressed stream parsing method and system based on the IMAP4 protocol. Background Technology

[0002] IMAP4 (Internet Message Access Protocol 4) is the fourth version of the interactive data message access protocol. It allows clients to access and read data on the server, whether online or offline, and also enables interactive operations on the server.

[0003] In the field of network data analysis and parsing, IMAP4 electronic compression cannot quickly parse data. Even if all IP packets in the TCP stream are cached, it is necessary to wait for the FIN packet of the TCP stream or wait for the stream timeout, which will greatly extend the data parsing time. For massive amounts of network data, this will greatly reduce the data filtering efficiency and make it impossible to achieve large-scale application.

[0004] It is evident that the IMAP4 protocol data analysis method in related technologies suffers from low parsing efficiency due to data compression. Summary of the Invention

[0005] This invention provides a TCP compressed stream parsing method and system based on the IMAP4 protocol, which solves the problem of low parsing efficiency caused by data compression in the existing IMAP4 protocol data analysis methods, and achieves fast and efficient data parsing.

[0006] This invention provides a TCP compressed stream parsing method based on the IMAP4 protocol, comprising the following steps.

[0007] The received TCP stream is stream identified based on a preset target standard port to obtain a target TCP stream; the target TCP stream is then buffered and reorganized to obtain a reassembled TCP stream; if the reassembled TCP stream carries a compression flag, it is compressed to obtain a compressed TCP stream; the target direction of the compressed TCP stream is determined, and if a decompression object exists in the target direction, the content of the compressed TCP stream is stored in the decompression object in the target direction, wherein the target direction includes uplink and downlink; the decompression object is decompressed using a preset function to obtain plaintext TCP stream data; the plaintext TCP stream data is segmented and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol to obtain segmented encapsulated data; the segmented encapsulated data is parsed according to a preset format and the delimiter to obtain a data parsing result.

[0008] According to the present invention, a TCP compressed stream parsing method based on the IMAP4 protocol is provided. The method for stream identification of the received TCP stream based on a preset target standard port to obtain the target TCP stream includes: performing IMAP4 stream identification and filtering on the received TCP stream to obtain the target data packet, wherein the source port or destination port of the target data packet is a preset target standard port; and establishing a TCP stream node for the target TCP stream based on the source IP address, destination IP address, source port, destination port and protocol type of the target data packet.

[0009] According to the present invention, a TCP compressed stream parsing method based on the IMAP4 protocol is provided. The step of performing data caching and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream includes: obtaining the current data packet received by the target TCP stream; when the linked list of the target TCP stream is empty, attaching the current data packet to the linked list of the TCP stream to obtain a reassembled TCP stream; when the linked list of the target TCP stream is not empty, traversing all nodes of the TCP stream in reverse order to determine the sequence number and acknowledgment number of the currently traversed node; when the sequence number of the current data packet is greater than the sequence number of the currently traversed node, designating the currently traversed node as a node to be inserted; when the sequence number of the current data packet is greater than the acknowledgment number of the node to be inserted, removing duplicate bytes between the current data packet and the node to be inserted, and updating the sequence number and acknowledgment number of the current data packet to obtain an updated data packet; and inserting the updated data packet into the node to be inserted to obtain a reassembled TCP stream.

[0010] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, after determining the target direction of the compressed TCP stream, the method further includes: when there is no decompression object for the compressed TCP stream in the target direction, creating a new decompression object with the same direction as the target direction, and storing the content of the compressed TCP stream into the new decompression object.

[0011] According to the TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, the step of segmenting and encapsulating the plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain segmented encapsulated data includes: when the plaintext TCP stream data contains a standard delimiter, segmenting the plaintext TCP stream data according to the standard delimiter to obtain a single data packet, wherein the single data packet includes the data in the plaintext TCP stream data from the first byte to the first standard delimiter; and encapsulating the source IP address, destination IP address, source port, and destination port in the single data packet to obtain segmented encapsulated data.

[0012] According to a TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, before parsing the segmented and encapsulated data according to a preset format and the delimiter to obtain the data parsing result, the method further includes: determining the target direction of the segmented and encapsulated data; when the target direction is an uplink direction, parsing the segmented and encapsulated data; if a first command exists in the segmented and encapsulated data, setting the segmented and encapsulated data to a ready-to-receive state; if the first command does not exist in the segmented and encapsulated data, discarding the segmented and encapsulated data; when the segmented and encapsulated data is in a ready-to-receive state, parsing the segmented and encapsulated data; if a second command exists in the segmented and encapsulated data, setting the segmented and encapsulated data to a formal reception state; if the second command does not exist in the segmented and encapsulated data, discarding the segmented and encapsulated data.

[0013] This invention also provides a TCP compressed stream parsing system based on the IMAP4 protocol, comprising the following modules: a TCP stream reassembly module, used to perform stream identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; the TCP stream reassembly module is further used to perform data buffering and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream; a TCP compressed stream decompression module, used to perform TCP stream compression processing on the reassembled TCP stream when a compression identifier is carried in the reassembled TCP stream to obtain a compressed TCP stream; the TCP compressed stream decompression module is further used to determine the target direction of the compressed TCP stream, and to perform TCP stream compression processing on the compressed TCP stream. When a decompression object exists in the target direction, the content of the compressed TCP stream is stored in the decompression object in the target direction, wherein the target direction includes: uplink and downlink; the TCP compressed stream decompression module is further used to decompress the decompression object using a preset function to obtain plaintext TCP stream data; the TCP stream plaintext data segmentation module is used to segment and encapsulate the plaintext TCP stream data into IP packets according to the standard delimiter of the IMAP4 protocol to obtain segmented encapsulated data; the IMAP4 data parsing module is used to parse the segmented encapsulated data according to a preset format and the delimiter to obtain data parsing results.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the TCP compressed stream parsing method based on the IMAP4 protocol as described above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the TCP compressed stream parsing method based on the IMAP4 protocol as described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the TCP compressed stream parsing method based on the IMAP4 protocol as described above.

[0017] The TCP compressed stream parsing method and system based on the IMAP4 protocol provided by this invention identifies the received TCP stream through a preset target standard port, ensuring that only the target TCP stream is processed, reducing interference from irrelevant data; it performs data caching and sorting and reassembly on the target TCP stream to obtain a structured reassembled TCP stream, providing an accurate data foundation for subsequent processing; when a compression identifier is detected in the reassembled TCP stream, the TCP stream is compressed to generate a compressed TCP stream, reducing bandwidth consumption for data transmission and improving network transmission efficiency; it determines the target direction (uplink or downlink) of the compressed TCP stream and decides whether to store the content of the compressed TCP stream in the decompression object based on whether a decompression object exists in the target direction, improving data targeting and flexibility; it decompresses the decompression object through a preset function to obtain plaintext TCP stream data. Then, it segments and encapsulates the plaintext TCP stream data according to the standard delimiters of the IMAP4 protocol, and parses the segmented and encapsulated data according to a preset format and delimiters to obtain the data parsing result; it ensures the integrity and accuracy of the data, while improving the efficiency and accuracy of data parsing. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a framework diagram of the TCP compressed stream parsing system based on the IMAP4 protocol provided by the present invention.

[0020] Figure 2 This is a flowchart illustrating the TCP compressed stream parsing method based on the IMAP4 protocol provided by this invention.

[0021] Figure 3 This is a schematic diagram of the workflow of the TCP stream reassembly module provided by the present invention.

[0022] Figure 4 This is a schematic diagram of the workflow of the TCP compressed stream decompression module provided by the present invention.

[0023] Figure 5This is a flowchart of the TCP stream plaintext data segmentation module provided by the present invention.

[0024] Figure 6 This is a schematic diagram of the workflow of the IMAP4 data parsing module provided by the present invention.

[0025] Figure 7 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] Electronic communication relies on various protocols, the most common being SMTP (Simple Mail Transfer Protocol), POP3 (Post Office Protocol), and IMAP (Internet Message Access Protocol). SMTP is used for sending, while POP3 and IMAP are used for receiving. The SMTP protocol ensures transmission from the sender's server to the receiver's server, while POP3 and IMAP protocols help users download or synchronize from the server.

[0028] IMAP4 (Internet Message Access Protocol 4) is the fourth version of the interactive data message access protocol. It allows clients to access and read data on the server online or offline, and also allows them to interactively operate the data on the server. IMAP4 makes up for many of the shortcomings of the POP3 protocol. For example, it supports whether the client and server need to compress the data during data transmission. This is of great significance for large-capacity data acquisition and can greatly improve the speed and efficiency of data acquisition.

[0029] Faced with such a network environment, in the field of network data analysis and parsing, after electronic compression using IMAP4, the MIME block header information cannot be extracted quickly and effectively from the BODYSTRUCTURE in the TCP compressed stream, making it impossible to quickly parse the data. Even if all IP packets in the TCP stream are cached, it is necessary to wait for the FIN packet of the TCP stream or wait for the stream timeout, which will greatly prolong the data parsing time. For massive amounts of network data, this will greatly reduce the data filtering efficiency and make it impossible to achieve large-scale application.

[0030] To address the issue of low parsing efficiency caused by data compression during IMAP4 acquisition, this invention proposes a TCP compressed stream parsing method and system based on the IMAP4 protocol. This method effectively solves the problem of slow and efficient data parsing when the TCP stream is compressed during IMAP4 data analysis, thereby achieving fast and efficient data parsing.

[0031] refer to Figure 1 , Figure 1 This is a framework diagram of the TCP compressed stream parsing system based on the IMAP4 protocol provided by the present invention.

[0032] To address the aforementioned technical problems, this invention proposes a TCP compressed stream parsing method and system based on the IMAP4 protocol, the framework of which is shown in the figure below. Figure 1 As shown, this system includes four modules: a TCP stream reassembly module (100), a TCP compressed stream decompression module (200), a TCP stream plaintext data segmentation module (300), and an IMAP4 data parsing module (400). It can quickly and efficiently analyze data content that cannot be parsed properly when acquiring IMAP4 protocol data due to TCP stream compression. This is achieved by segmenting and decompressing the TCP stream and segmenting it with TCP data delimiters to encapsulate new data packets.

[0033] Optionally, the TCP compressed stream parsing method based on the IMAP4 protocol in this embodiment can be executed by a server, by a terminal device, or by both a server and a terminal device. Taking the execution of the TCP compressed stream parsing method based on the IMAP4 protocol in this embodiment by a server as an example.

[0034] Figure 2 This is a flowchart illustrating the TCP compressed stream parsing method based on the IMAP4 protocol provided by this invention, as shown below. Figure 2 As shown, the method includes the following steps.

[0035] Step 1: Perform flow identification on the received TCP stream based on the preset target standard port to obtain the target TCP stream.

[0036] Transmission Control Protocol (TCP) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. TCP is designed to adapt to layered protocol hierarchies that support multiple network applications. In interconnected computer networks, pairs of application processes can rely on TCP to provide reliable communication services for transmitting byte streams. TCP supports bidirectional data streaming, but applications can also send data unidirectionally. Between hosts, TCP uses port numbers to identify application services and can multiplex data streams.

[0037] In this embodiment of the invention, a TCP stream reassembly module is used to determine whether the TCP communication port is port 143 for stream identification. The IMAP4 protocol uses the standard port 143 for communication. This module sorts and reassembles data packets based on the TCP header sequence. The module takes the actual intercepted payload position as a parameter, combines it with the offset of the actual intercepted TCP payload position relative to the starting position, calculates the offset relative to the starting position of the payload and the final payload length, and simultaneously calculates the length of data to be read based on the final payload length stored in the data frame. Data that should be stored after the current frame is read from the file and written into the intercepted data of this frame.

[0038] According to the present invention, a TCP compressed stream parsing method based on the IMAP4 protocol is provided, which performs stream identification on the received TCP stream based on a preset target standard port to obtain the target TCP stream, including:

[0039] The received TCP stream is identified and filtered using IMAP4 to obtain the target data packet, where the source port or destination port of the target data packet is a preset target standard port.

[0040] A TCP stream node for the target TCP stream is established based on the source IP address, destination IP address, source port, destination port, and protocol type of the target data packet.

[0041] refer to Figure 3 , Figure 3 This is a schematic diagram of the workflow of the TCP stream reassembly module provided by the present invention.

[0042] The TCP stream reassembly module 100 is responsible for TCP stream identification, data caching, sorting, and reassembly, specifically including the following steps.

[0043] Step 101, IP layer protocol parsing.

[0044] Protocol parsing is performed at the IP layer, parsing information such as IP version, IP packet length, identifier, fragmentation flag, fragmentation offset, TTL, transport layer protocol type, source IP, and destination IP, and storing it in the IP packet memory object;

[0045] Among them, the Internet Protocol (IP) is the core of the entire TCP / IP protocol suite and the foundation of the Internet. IP is located at the network layer of the TCP / IP model (equivalent to the network layer of the OSI model), and it can provide information on various protocols to the transport layer; here, IP packets are data packets.

[0046] Step 102, TCP header parsing.

[0047] The system parses the source port, destination port, checksum, sequence number, acknowledgment number, flags, and other information. It continues to process data packets whose source or destination port is the 143 standard port, while discarding other data packets. It performs IMAP4 flow identification and filtering, and establishes TCP flow nodes based on the five-tuple of source IP, destination IP, source port, destination port, and protocol type.

[0048] Through the embodiments of the present invention, IMAP4 traffic can be accurately identified by checking the port number and protocol identifier of the data packets. Based on the preset target standard port, specific IMAP4 data packets can be filtered out to reduce redundant traffic in the network and improve network transmission efficiency.

[0049] Continue to refer to Figure 2 Step 2: Buffer and sort the target TCP stream to obtain the reassembled TCP stream.

[0050] In this embodiment of the invention, a caching mechanism is established to store the received target TCP stream. The cache can be a memory-based data structure, such as a hash table, linked list, or queue, used to store TCP segments and their related information (such as sequence number, acknowledgment number, data length, etc.).

[0051] Sequence numbers in the target TCP stream are used to identify the position of data within the TCP stream. Based on these sequence numbers, the received target TCP stream can be sorted. After sorting, the data portions of the TCP segments can be concatenated according to their sequence numbers to form a complete TCP stream. During the sorting process, out-of-order or duplicate TCP segments may be encountered. Out-of-order segments need to be temporarily stored until the preceding segments arrive; duplicate segments can be discarded, resulting in a reassembled TCP stream.

[0052] According to the present invention, a TCP compressed stream parsing method based on the IMAP4 protocol is provided, which performs data buffering and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream, including:

[0053] Get the current data packets received by the target TCP stream;

[0054] When the target TCP stream's linked list is empty, the current data packet is attached to the TCP stream's linked list to obtain a reassembled TCP stream;

[0055] If the linked list of the target TCP stream is not empty, traverse all nodes of the TCP stream in reverse order to determine the sequence number and acknowledgment number of the currently traversed node.

[0056] If the sequence number of the current data packet is greater than the sequence number of the currently traversed node, the currently traversed node will be used as the node to be inserted.

[0057] If the sequence number of the current data packet is greater than the acknowledgment number of the node to be inserted, remove the duplicate bytes between the current data packet and the node to be inserted, and update the sequence number and acknowledgment number of the current data packet to obtain the updated data packet;

[0058] The updated data packet is inserted into the node to be inserted, resulting in a reassembled TCP stream.

[0059] In network communication, a TCP stream consists of multiple TCP packets. These packets may arrive out of order due to network conditions such as latency and packet loss. The process of reassembling a TCP stream involves reordering the out-of-order TCP packets according to their sequence numbers to restore the original, ordered TCP data stream.

[0060] In this embodiment of the invention, if the target TCP stream's linked list (a sequential queue for storing data packets) is empty, it indicates that this is the first data packet received by the TCP stream. The current data packet is directly added to the TCP stream's linked list, forming the initial reassembled TCP stream. If the linked list is not empty, it indicates that the TCP stream has already received and stored data packets, and the process proceeds to the next step, where data packet reordering and deduplication are performed.

[0061] Traverse the linked list backwards from the end, where each node represents a received and stored data packet. Reverse traversal makes it easier to find the correct insertion position for the current data packet, ensuring the correct packet order. During traversal, record the sequence number (Seq) and acknowledgment number (Ack) of the currently traversed node. The sequence number (Seq) identifies the packet's position in the TCP stream. The acknowledgment number (Ack) identifies the sequence number of the next data packet the receiver expects to receive.

[0062] Compare the sequence number of the current data packet with the sequence number of the currently traversed node. If the sequence number of the current data packet is greater than the sequence number of the currently traversed node, mark that node as the node to be inserted. Compare the sequence number of the current data packet with the acknowledgment number of the node to be inserted. If the sequence number of the current data packet is greater than the acknowledgment number of the node to be inserted, it means that there is duplicate data between the current data packet and the node to be inserted. Remove duplicate bytes and update the sequence number and acknowledgment number of the current data packet to obtain the updated data packet.

[0063] The updated data packet is inserted into the position of the node to be inserted, resulting in the reassembled TCP stream.

[0064] Continue to refer to Figure 3 Step 103: Determine the uplink and downlink.

[0065] Data packets with a source port of 143 are identified as downlink packets; otherwise, they are identified as uplink packets.

[0066] Step 104: Calculate and save the sequence and ack.

[0067] Save the sequence number of the data packet and calculate the acknowledgment number based on the packet length.

[0068] Step 105: Determine if the TCP stream is empty.

[0069] To determine if a TCP stream is empty, you need to check if the addresses of the first and last nodes of the linked list are the same. If they are the same, the linked list is empty.

[0070] Step 106: Mount the linked list node to store the data packet.

[0071] If the linked list is empty, it means that the current data packet is the first IP packet of the TCP stream and is directly attached to the TCP stream linked list.

[0072] Step 107: Traverse the TCP stream list.

[0073] When the TCP stream node is not empty, iterate through all nodes of the TCP stream in reverse, extract the sequence number and acknowledgment number of each node, and compare them with the sequence number and acknowledgment number stored in the current IP packet.

[0074] Step 108: Determine if the insertion node has been found.

[0075] Traverse the linked list in reverse order, comparing the sequence number and acknowledgment number of the current IP packet with the sequence number and acknowledgment number of each node. If the sequence number and acknowledgment number of the current IP packet are greater than the sequence number and acknowledgment number of the currently traversed node, the current node is the position to be inserted; otherwise, continue traversing the remaining stream nodes.

[0076] Step 109: Determine if there are duplicate Sequences.

[0077] Compare the value of the current IP packet's sequence number (Sequence) with the acknowledgment number (Ack) of the node to be inserted. If the value is greater, it is determined that the Sequence is duplicated.

[0078] Step 110: Remove duplicate bytes and save the data packet.

[0079] If the sequence number of the current IP packet is duplicated with that of the stream node to be inserted, remove the duplicate bytes from the current IP packet, insert the non-duplicate bytes into the current TCP stream node, and update the sequence number and acknowledgment number of the current IP packet.

[0080] Step 111: Mount the IP packet to the current location.

[0081] After finding the node to be inserted, the current IP packet is inserted into the node to be inserted. At this point, TCP flow identification, sorting, and deduplication are completed.

[0082] This invention enables the reordering and deduplication of data packets received in a target TCP stream. This ensures the correct order of data packets within the TCP stream and avoids the transmission of duplicate data, thereby improving the reliability and efficiency of TCP transmission.

[0083] Continue to refer to Figure 2 Step 3: When the reassembled TCP stream carries a compression flag, the reassembled TCP stream is compressed to obtain a compressed TCP stream.

[0084] In this embodiment of the invention, the TCP compressed stream decompression module is used for the identification and decompression of uplink and downlink compressed data.

[0085] The TCP compressed stream decompression module determines whether a data packet has the "compress deflate" compression flag. If it's identified as a TCP compressed stream, the compression flag is set. Subsequent TCP packet processing then determines whether to process the data as an uncompressed or compressed TCP stream based on the presence of this flag. GZIP decompression objects are created for both upstream and downstream directions, and space is allocated within each object to store the decompressed data. Data is stored in the corresponding decompression object, and the `inflate` function from the ZLIB library's GZIP decompression interface is called to perform decompression. Upon successful decompression, the decompressed data is stored in the decompression buffer space for subsequent TCP stream plaintext data segmentation and encapsulation by the module.

[0086] Step 4: Determine the target direction of the compressed TCP stream. If a decompression object exists in the target direction of the compressed TCP stream, store the contents of the compressed TCP stream into the decompression object in the target direction. The target direction includes the uplink and downlink directions.

[0087] In the TCP / IP protocol stack, the direction of data transmission is clearly distinguished: uplink typically refers to data from the client to the server, while downlink refers to data from the server to the client. Different application scenarios have different requirements for the direction of data transmission.

[0088] For example, in real-time communication applications, upstream data (such as user input or requests) may need to be compressed to reduce latency, while in other applications, downstream data (such as server responses or content distribution) may need to be compressed to save bandwidth.

[0089] In network communication, the determination of the destination direction is usually based on the establishment of a TCP connection and the sending and receiving of data packets. For example, when a client initiates a connection request to a server, the connection is considered to be in the uplink direction; while when the server sends response data to the client, the connection is considered to be in the downlink direction.

[0090] Choose the appropriate compression algorithm based on application requirements and network conditions. Common compression algorithms include lossless compression (such as DEFLATE, GZIP, etc.), which encapsulates the compressed data into a format suitable for network transmission and adds necessary metadata (such as compression algorithm identifier, data length, etc.) so that the receiving end can decompress it correctly.

[0091] After determining the target direction, it is necessary to check whether a decompression object capable of processing compressed data exists in that direction. Once a decompression object is confirmed to exist in the target direction, the contents of the compressed TCP stream are transmitted to that decompression object.

[0092] According to the TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, after determining the target direction of the compressed TCP stream, the method further includes:

[0093] If no decompression object exists in the target direction of the compressed TCP stream, a new decompression object is created in the same direction as the target direction, and the contents of the compressed TCP stream are stored in the new decompression object.

[0094] When no decompression object exists in the target direction, compressed data may be lost or cannot be processed correctly. By creating a new decompression object, you can ensure that the data is received and decompressed, thus avoiding data loss.

[0095] In this embodiment of the invention, a new decompression object is instantiated according to a preset configuration or strategy. The new decompression object needs to be properly configured and initialized to ensure it can correctly process data in the compressed TCP stream. For example, this includes setting the decompression algorithm, configuring the network interface, and defining the interaction methods with other system components.

[0096] After the decompression object is created and initialized, the contents of the compressed TCP stream will be transferred to the newly created decompression object.

[0097] By creating new decompression objects to process these data through the embodiments of the present invention, the integrity of the data stream can be ensured, and data interruption or loss during transmission can be avoided.

[0098] Step 5: Decompress the object using a preset function to obtain plaintext TCP stream data.

[0099] refer to Figure 4 , Figure 4This is a schematic diagram of the workflow of the TCP compressed stream decompression module provided by the present invention.

[0100] Step 201: Determine if there is a compression indicator.

[0101] Determine if there is a negotiated "compress deflate" compression flag. If the negotiation is successful, it is determined to be a TCP compressed stream; if the negotiation fails or there is no compression flag, it is determined to be an uncompressed stream.

[0102] In the HTTP protocol, deflate is a commonly used content-encoding type used to compress transmitted data to reduce the amount of data transmitted and improve transmission efficiency.

[0103] Step 202: Determine if the object to be decompressed exists.

[0104] Based on the uplink and downlink direction of the IP data packets, determine whether there is a decompression object in that direction, i.e., whether the decompression object pointer is null.

[0105] Step 203: Create a new decompression object with the same direction of flow.

[0106] If the decompression object does not exist, request a decompression object and assign it an initial value, then store the TCP compressed data of the data packet into the decompression object.

[0107] Step 204: Send the TCP payload to the decompression object.

[0108] If the decompression object exists, store the contents of the current IP packet into the decompression object in the same direction as the uplink and downlink.

[0109] Step 205: Call the ZLIB library interface to decompress.

[0110] The `inflate` function from the ZLIB library is called to decompress all data content in the decompressed object.

[0111] Here, the ZLIB library is an open-source data compression library used for compressing and decompressing data. `inflate` is a function in the ZLIB library used to decompress ZLIB-compressed data. The `inflate` function uses the DEFLATE algorithm, reading compressed blocks from the input data stream and decoding them back into the original data blocks to achieve decompression. It accepts compressed data as input and decompresses it back into the original data.

[0112] Step 206: Determine if decompression was successful.

[0113] The success of decompression is determined by the return value of the inflate function; if it fails, the current data packet is discarded.

[0114] Step 207: Decompress the contents and store them in the plaintext area.

[0115] After successful decompression, the data is stored in the cache requested by the decompression object. If the cache is empty, the current decompressed data is stored in the starting address. If there is historical data in the cache, the offset is calculated and the current successfully decompressed data is stored at the end of the cache for subsequent TCP stream plaintext data segmentation module to use for segmentation.

[0116] Through the embodiments of the present invention, by compressing the TCP stream, the amount of data that needs to be transmitted can be significantly reduced. By determining the target direction and storing the decompressed object, it is ensured that the compressed TCP stream can be correctly transmitted to the target direction and can be correctly decompressed and restored when needed.

[0117] Continue to refer to Figure 2 Step 6: Cut the plaintext TCP stream data and encapsulate it into IP packets according to the standard delimiter of the IMAP4 protocol to obtain the cut and encapsulated data.

[0118] In this embodiment of the invention, the TCP stream plaintext data segmentation module is used to segment the TCP stream and encapsulate IP packets according to the delimiters of the IMAP4 protocol.

[0119] The TCP stream plaintext data segmentation module segments the cached decompressed TCP stream data in the decompression object using the \r\n delimiter. It checks for the presence of the \r\n delimiter; if no delimiter is present, the data is cached, awaiting the next batch of data decompressed in the same direction before proceeding to the next segmentation. If the \r\n delimiter is present, the data is segmented according to the delimiter, from the first byte to the first \r\n, into single data packets. The source and destination IP addresses and port information within each packet are saved. Based on this information, new IP data packets are encapsulated. After successful encapsulation, the data is sent to the IMAP4 data parsing module (400) for parsing.

[0120] According to the present invention, a TCP compressed stream parsing method based on the IMAP4 protocol is provided, which segments and encapsulates plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain segmented and encapsulated data, including:

[0121] When a standard delimiter exists in the plaintext TCP stream data, the plaintext TCP stream data is segmented according to the standard delimiter to obtain a single data packet. The single data packet includes the data in the plaintext TCP stream data from the first byte to the first standard delimiter.

[0122] The source IP address, destination IP address, source port, and destination port in a single data packet are encapsulated to obtain the segmented encapsulated data.

[0123] refer to Figure 5 , Figure 5 This is a flowchart of the TCP stream plaintext data segmentation module provided by the present invention.

[0124] Step 301: Decompress plaintext data of the TCP object.

[0125] All plaintext data is extracted from the decompressed object and processed in this module.

[0126] Step 302: Determine if there is a separator.

[0127] Determine if the current plaintext data contains the separator \r\n, which is the standard separator for the IMAP4 protocol.

[0128] Step 303: Cut the data according to the delimiter.

[0129] Data is segmented according to the IMAP4 protocol data delimiter \r\n. The system checks for the presence of the \r\n delimiter; if not, the data is cached and awaits the next batch of data decompressed in the same direction. If the \r\n delimiter exists, the data is segmented according to the delimiter, with each data packet ending at the first \r\n byte.

[0130] Step 304: Encapsulate the segmented IP data packets.

[0131] The source IP, destination IP, source port, and destination port saved in the decompressed object are encapsulated into a new IP data packet. After successful encapsulation, the data is sent to the IMAP4 data parsing module (400) for parsing.

[0132] Step 305: Send plaintext data packets to the function for parsing.

[0133] After successful encapsulation, the data is sent to the IMAP4 data parsing module for parsing.

[0134] In this embodiment of the invention, a standard delimiter used in the plaintext TCP stream data is determined. This is typically one or more specific characters or strings used to identify the boundaries of data packets. The system scans starting from the first byte of the plaintext TCP stream data to find the position of the first standard delimiter. Upon finding the first standard delimiter, the data preceding it (from the first byte to the last byte before the delimiter) is segmented to form a single data packet. This process is repeated to scan and segment the remaining data until the entire plaintext TCP stream data has been processed.

[0135] Each segmented data packet is parsed to extract network layer information (such as IP address and port number). The source and destination IP addresses are extracted from the IP header. The source and destination ports are extracted from the transport layer header (such as the TCP header). The extracted source and destination IP addresses, source and destination ports, etc., are then encapsulated. The encapsulation format can be designed according to specific requirements, and can be simple text, binary, or other formats. The extracted and encapsulated information for each data packet is used to generate segmented and encapsulated data. This data can be stored in memory, written to a file, or sent over the network.

[0136] Through the embodiments of the present invention, plaintext TCP stream data can be segmented into single data packets according to standard delimiters, and network information can be extracted and encapsulated to obtain segmented and encapsulated data.

[0137] Continue to refer to Figure 2 Step 7: Parse the segmented and encapsulated data according to the preset format and delimiters to obtain the data parsing results.

[0138] In this embodiment of the invention, the IMAP4 data parsing module is used to parse the content of the segmented and encapsulated IP packets.

[0139] The IMAP4 data parsing module is used to determine whether data packets contain FETCH and BODY commands, and to determine the uplink or downlink of the packet. When it determines the data is uplink, it parses the data packet, searching for the BODY command. If BODY.PEEK[], BODY.PEEK[HEADER], BODYSTRUCTURE, etc., are found, it enters the ready-to-receive state. During downlink data processing, it checks whether the downlink packets in the TCP stream contain FETCH commands. If so, the TCP stream enters the formal reception state. During the next downlink data processing, it buffers all downlink data packets until an uplink data packet appears, indicating that the IMAP4 data reception is complete. It then reassembles all the saved downlink data payload portions and parses the content according to the format and delimiters.

[0140] In this embodiment of the invention, each field in the encapsulated data is parsed one by one according to the delimiter, such as extracting text strings, parsing numbers, and converting data types. The parsed fields and data are then organized according to a preset format (such as an object, array, or dictionary) to generate the data parsing result.

[0141] Through the steps described in this embodiment of the invention, the received TCP stream is identified through a preset target standard port, ensuring that only the target TCP stream is processed, reducing interference from irrelevant data; the target TCP stream is cached and reorganized to obtain a structured reorganized TCP stream, providing an accurate data foundation for subsequent processing; when a compression flag is detected in the reorganized TCP stream, the TCP stream is compressed to generate a compressed TCP stream; this reduces bandwidth consumption for data transmission and improves network transmission efficiency; the target direction (uplink or downlink) of the compressed TCP stream is determined, and whether to store the content of the compressed TCP stream in the decompression object is decided based on whether a decompression object exists in the target direction, improving the targeting and flexibility of the data; the decompression object is decompressed using a preset function to obtain plaintext TCP stream data. Then, the plaintext TCP stream data is segmented and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol, and the segmented and encapsulated data is parsed according to a preset format and delimiter to obtain the data parsing result; this ensures the integrity and accuracy of the data, while improving the efficiency and accuracy of data parsing.

[0142] According to the TCP compressed stream parsing method based on the IMAP4 protocol provided by the present invention, before parsing the segmented and encapsulated data according to a preset format and delimiter to obtain the data parsing result, the above method further includes:

[0143] Determine the target orientation for the data to be packaged after cutting;

[0144] When the target direction is uplink, the segmented and encapsulated data is parsed. If the first command is present in the segmented and encapsulated data, the segmented and encapsulated data is set to a ready-to-receive state. If the first command is not present in the segmented and encapsulated data, the segmented and encapsulated data is discarded.

[0145] When the segmented encapsulated data is in a ready-to-receive state, the segmented encapsulated data is parsed. If a second command is present in the segmented encapsulated data, the segmented encapsulated data is set to a formal reception state; if no second command is present in the segmented encapsulated data, the segmented encapsulated data is discarded.

[0146] Here, the first command is the BODY command mentioned above, and the second command is the FETCH command mentioned above.

[0147] refer to Figure 6 , Figure 6 This is a schematic diagram of the workflow of the IMAP4 data parsing module provided by the present invention.

[0148] Step 401: Determine if it is an uplink packet.

[0149] Determine if the data packet is uplink data; if it is uplink data, look up the flag bit in the uplink data packet.

[0150] Step 402: Discard the data packet.

[0151] In the initial state of IMAP4, if downlink data is received first but the flag is not set to indicate a stream, the data is discarded.

[0152] Step 403: Determine if the BODY command is present.

[0153] If it is an uplink data packet, check whether the data packet contains commands such as BODY.PEEK[], BODY.PEEK[HEADER, BODYSTRUCTURE, etc.;

[0154] Step 404: The TCP stream enters the ready-to-receive state.

[0155] If the BODY instruction is present, the TCP stream enters the ready-to-receive state; if it is not present, the status bit is incorrect, and the data packet is discarded.

[0156] Step 405: Determine if there is a FETCH command.

[0157] After the TCP stream enters the ready-to-receive state, it checks whether the current data packet contains a FETCH command. If not, the packet is discarded; if it does, the TCP stream is set to enter the receive state.

[0158] Step 406: Receive data.

[0159] Set the TCP stream state to the "Start Receiving" state;

[0160] Step 407: Determine if it is a downlink packet.

[0161] After the TCP stream enters the formal start-up-receive state, it determines whether the current data packet has TCP payload and whether the data direction is downlink data.

[0162] Step 408: Receive downlink data and mount the linked list.

[0163] If it is downlink data, the data packet is the content, the data packet is saved and added to the content list; if it is uplink data, it is determined that the IMAP4 content has been received.

[0164] Step 409: Determine whether data reception is complete.

[0165] When a TCP stream receives a stream timeout message or receives an upstream data packet for that stream, it determines that the reception is complete.

[0166] Step 410: Send the analysis results.

[0167] After receiving the data, IMAP4 parses the content according to the format and delimiters.

[0168] Through the embodiments of the present invention, the data after being cut and packaged can be processed correctly, and the corresponding status settings and data reception can be performed according to the commands contained therein, so that the content can be parsed according to the format and delimiters after the reception is completed.

[0169] The above embodiments of the present invention relate to the field of network data analysis and parsing, solving the problem that data cannot be filtered quickly and efficiently after TCP stream compression when analyzing data using the IMAP4 protocol. (Reference) Figure 1 This system includes a TCP stream reassembly module (100), a TCP compressed stream decompression module (200), a TCP stream plaintext data segmentation module (300), and an IMAP4 data parsing module (400). Their interaction is as follows: the TCP stream reassembly module (100) is responsible for TCP stream identification, data caching, sorting, and reassembly; the TCP compressed stream decompression module (200) is responsible for identifying and decompressing uplink and downlink compressed data; the TCP stream plaintext data segmentation module (300) segments the TCP stream and encapsulates IP packets according to the IMAP4 protocol delimiters; and the IMAP4 data parsing module (400) is responsible for parsing the content of the segmented and encapsulated IP packets. This invention features low coupling, high scalability, flexibility, and high efficiency. This invention addresses the problem that IMAP4 protocol TCP data streams cannot be properly filtered after compression in network data. It proposes a fast and efficient solution for TCP stream decompression and data analysis. By segmenting and decompressing the TCP stream and encapsulating new data packets after cutting with TCP data delimiters, the analysis efficiency is improved, achieving the goal of fast and efficient content parsing. The TCP stream segmentation and decompression method can also be applied to the data parsing of other application protocols.

[0170] The TCP compressed stream parsing system based on the IMAP4 protocol provided by this invention is described below. The TCP compressed stream parsing system based on the IMAP4 protocol described below can be referred to in correspondence with the TCP compressed stream parsing method based on the IMAP4 protocol described above.

[0171] refer to Figure 1 , Figure 1 This is a framework diagram of the TCP compressed stream parsing system based on the IMAP4 protocol provided by the present invention.

[0172] The TCP stream reassembly module 100 is used to perform flow identification on the received TCP stream based on a preset target standard port to obtain the target TCP stream;

[0173] The TCP stream reassembly module 100 is also used to perform data caching and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream.

[0174] The TCP compression stream decompression module 200 is used to compress the reassembled TCP stream when the reassembled TCP stream carries a compression flag, so as to obtain a compressed TCP stream.

[0175] The TCP compression stream decompression module 200 is also used to determine the target direction of the compressed TCP stream. When there is a decompression object in the target direction of the compressed TCP stream, the content of the compressed TCP stream is stored in the decompression object in the target direction. The target direction includes the uplink direction and the downlink direction.

[0176] The TCP compression stream decompression module 200 is also used to decompress the decompressed object through a preset function to obtain plaintext TCP stream data;

[0177] The TCP stream plaintext data segmentation module 300 is used to segment plaintext TCP stream data and encapsulate IP packets according to the standard delimiter of the IMAP4 protocol to obtain segmented and encapsulated data.

[0178] The IMAP4 data parsing module 400 is used to parse the segmented and encapsulated data according to a preset format and delimiter to obtain the data parsing results.

[0179] Specifically, the TCP compressed stream parsing system based on the IMAP4 protocol provided by the present invention can implement all the method steps implemented in the above-described TCP compressed stream parsing method embodiment based on the IMAP4 protocol, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0180] Figure 7 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as... Figure 7As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communications bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other through the communications bus 740. The processor 710 can call logic instructions in the memory 730 to execute a TCP compressed stream parsing method based on the IMAP4 protocol. This method includes: stream identification of the received TCP stream based on a preset target standard port to obtain a target TCP stream; data buffering and sorting / reassembly of the target TCP stream to obtain a reassembled TCP stream; when the reassembled TCP stream carries a compression identifier, performing compression TCP stream processing on the reassembled TCP stream to obtain a compressed TCP stream; determining the target direction of the compressed TCP stream, and when a decompression object exists in the target direction, storing the content of the compressed TCP stream into the decompression object in the target direction, where the target direction includes: uplink and downlink; decompressing the decompression object using a preset function to obtain plaintext TCP stream data; segmenting and encapsulating the plaintext TCP stream data into IP packets according to the standard delimiter of the IMAP4 protocol to obtain segmented encapsulated data; and parsing the segmented encapsulated data according to a preset format and delimiter to obtain the data parsing result.

[0181] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0182] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the TCP compressed stream parsing method based on the IMAP4 protocol provided by the above methods. The method includes: performing flow identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; performing data buffering and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream; when the reassembled TCP stream carries a compression identifier, performing compression TCP stream processing on the reassembled TCP stream to obtain a compressed TCP stream; determining the target direction of the compressed TCP stream, and when there is a decompression object in the target direction of the compressed TCP stream, storing the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: uplink and downlink; decompressing the decompression object through a preset function to obtain plaintext TCP stream data; segmenting and encapsulating the plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain segmented encapsulated data; and parsing the segmented encapsulated data according to a preset format and delimiter to obtain a data parsing result.

[0183] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the TCP compressed stream parsing method based on the IMAP4 protocol provided by the above methods. The method includes: performing flow identification on the received TCP stream based on a preset target standard port to obtain a target TCP stream; performing data buffering and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream; when the reassembled TCP stream carries a compression identifier, performing compression TCP stream processing on the reassembled TCP stream to obtain a compressed TCP stream; determining the target direction of the compressed TCP stream, and when a decompression object exists in the target direction of the compressed TCP stream, storing the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: uplink and downlink; decompressing the decompression object using a preset function to obtain plaintext TCP stream data; segmenting and encapsulating the plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain segmented encapsulated data; and parsing the segmented encapsulated data according to a preset format and delimiter to obtain a data parsing result.

[0184] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0185] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0186] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A TCP compressed stream parsing method based on the IMAP4 protocol, characterized in that, include: The received TCP stream is identified based on a preset target standard port to obtain the target TCP stream; The target TCP stream is buffered, sorted, and reassembled to obtain a reassembled TCP stream; When the reassembled TCP stream carries a compression flag, the reassembled TCP stream is processed into a compressed TCP stream to obtain a compressed TCP stream. The target direction of the compressed TCP stream is determined. When a decompression object exists in the target direction of the compressed TCP stream, the content of the compressed TCP stream is stored in the decompression object in the target direction. The target direction includes: uplink and downlink. The decompressed object is decompressed using a preset function to obtain plaintext TCP stream data; The plaintext TCP stream data is segmented and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol to obtain segmented and encapsulated data. The segmented and encapsulated data is parsed according to the preset format and the delimiter to obtain the data parsing result.

2. The TCP compressed stream parsing method based on the IMAP4 protocol according to claim 1, characterized in that, The process of stream identification based on a preset target standard port to obtain the target TCP stream includes: The received TCP stream is subjected to IMAP4 stream identification and filtering to obtain the target data packet, wherein the source port or destination port of the target data packet is a preset target standard port; A TCP stream node for the target TCP stream is established based on the source IP address, destination IP address, source port, destination port, and protocol type of the target data packet.

3. The TCP compressed stream parsing method based on the IMAP4 protocol according to claim 2, characterized in that, The step of caching and reordering the target TCP stream to obtain a reassembled TCP stream includes: Obtain the current data packet received by the target TCP stream; When the target TCP stream's linked list is empty, the current data packet is attached to the linked list of the TCP stream to obtain a reassembled TCP stream; When the linked list of the target TCP stream is not empty, traverse all nodes of the TCP stream in reverse order to determine the sequence number and acknowledgment number of the currently traversed node; When the sequence number of the current data packet is greater than the sequence number of the currently traversed node, the currently traversed node is taken as the node to be inserted; When the sequence number of the current data packet is greater than the acknowledgment number of the node to be inserted, remove duplicate bytes between the current data packet and the node to be inserted, and update the sequence number and acknowledgment number of the current data packet to obtain an updated data packet; The updated data packet is inserted into the node to be inserted, resulting in a reassembled TCP stream.

4. The TCP compressed stream parsing method based on the IMAP4 protocol according to claim 1, characterized in that, After determining the target direction of the compressed TCP stream, the method further includes: When there is no decompression object for the compressed TCP stream in the target direction, a new decompression object is created in the same direction as the target direction, and the contents of the compressed TCP stream are stored in the new decompression object.

5. The TCP compressed stream parsing method based on the IMAP4 protocol according to claim 1, characterized in that, The plaintext TCP stream data is segmented and encapsulated into IP packets according to the standard delimiter of the IMAP4 protocol to obtain segmented and encapsulated data, including: When a standard delimiter exists in the plaintext TCP stream data, the plaintext TCP stream data is segmented according to the standard delimiter to obtain a single data packet, wherein the single data packet includes the data in the plaintext TCP stream data from the first byte to the first standard delimiter; The source IP address, destination IP address, source port, and destination port in the single data packet are encapsulated to obtain segmented encapsulated data.

6. The TCP compressed stream parsing method based on the IMAP4 protocol according to claim 1, characterized in that, Before parsing the segmented and encapsulated data according to the preset format and the delimiter to obtain the data parsing result, the method further includes: Determine the target orientation of the cut and packaged data; When the target direction is the uplink direction, the segmented and encapsulated data is parsed. If the segmented and encapsulated data contains a first command, the segmented and encapsulated data is set to a ready-to-receive state. If the segmented and encapsulated data does not contain the first command, the segmented and encapsulated data is discarded. When the segmented and encapsulated data is in a ready-to-receive state, the segmented and encapsulated data is parsed. If a second command is present in the segmented and encapsulated data, the segmented and encapsulated data is set to a formal reception state. If the second command is not present in the segmented and encapsulated data, the segmented and encapsulated data is discarded.

7. A TCP compressed stream parsing system based on the IMAP4 protocol, characterized in that, include: The TCP stream reassembly module is used to perform flow identification on the received TCP stream based on a preset target standard port to obtain the target TCP stream; The TCP stream reassembly module is also used to perform data caching and sorting reassembly on the target TCP stream to obtain a reassembled TCP stream; The TCP compression stream decompression module is used to perform compression TCP stream processing on the reassembled TCP stream when the reassembled TCP stream carries a compression flag, so as to obtain a compressed TCP stream. The TCP compression stream decompression module is further configured to determine the target direction of the compressed TCP stream, and when there is a decompression object in the target direction of the compressed TCP stream, store the content of the compressed TCP stream into the decompression object in the target direction, wherein the target direction includes: uplink direction and downlink direction; The TCP compressed stream decompression module is also used to decompress the decompressed object through a preset function to obtain plaintext TCP stream data; The TCP stream plaintext data segmentation module is used to segment and encapsulate the plaintext TCP stream data according to the standard delimiter of the IMAP4 protocol to obtain segmented and encapsulated data. The IMAP4 data parsing module is used to parse the segmented and encapsulated data according to a preset format and the delimiter to obtain the data parsing result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the TCP compressed stream parsing method based on the IMAP4 protocol as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the TCP compressed stream parsing method based on the IMAP4 protocol as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the TCP compressed stream parsing method based on the IMAP4 protocol as described in any one of claims 1 to 6.

Images