Network data analysis method and device, equipment and medium

Abstract

The invention relates to a network data analysis method and device, equipment and a medium, and relates to the technical field of data processing. The network data analysis method provided by the invention comprises the following steps: dividing a plurality of to-be-analyzed data packets obtained from an original target file into a plurality of groups of data packets according to a preset condition, and respectively writing each group of data packets into a corresponding to-be-analyzed target file; sequentially reading the to-be-analyzed data packets from the to-be-analyzed target file, analyzing a target field from the read to-be-analyzed data packets, and storing the analyzed target field into the target file; and in response to that all the to-be-parsed data packets in the to-be-parsed target file are parsed, notifying the service front end that the target file is parsed, so as to display the parsed target file on the basis of an interface of the service front end. Through the scheme of the invention, the analysis and presentation speed of the network data is improved, so that a user can see the analyzed data without waiting for the completion of the analysis of the total data.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a network data parsing method, device, equipment and medium. Background Art

[0002] As the Internet becomes increasingly developed, enterprises pay special attention to network performance security. Many network performance analysis tools have emerged. Sometimes enterprises not only need to view various analyzed indicators on the network performance analysis tool platform, but also need to trace the source to view and analyze the original PCAP data packets.

[0003] However, in the process of viewing and analyzing the original PCAP data packet, it is usually necessary to load the entire PCAP data packet and wait for the full PCAP data packet to be parsed before it can be displayed to the user. The loading and parsing speed of the entire PCAP data packet is very slow, which affects the customer experience. Summary of the invention

[0004] In view of this, the present invention proposes a network data parsing method, device, equipment and medium, which solves the problems in the related art of slow loading and parsing speed, untimely presentation of network data and impact on customer experience during the process of viewing and analyzing the original PCAP data packet.

[0005] In one aspect, an embodiment of the present invention provides a network data parsing method, the network data parsing method comprising performing the following steps at a service backend: Divide the data packets to be parsed obtained from the original target file into multiple groups of data packets according to preset conditions, and write each group of data packets into the corresponding target file to be parsed; Read the data packets to be parsed from the target file to be parsed in sequence, parse the target fields from the read data packets to be parsed, and store the parsed target fields in the target file; In response to the completion of parsing of all the data packets to be parsed in the target file to be parsed, the service front end is notified that the parsing of the target file is completed, so that all the target fields in the parsed target file are displayed based on the interface of the service front end.

[0006] In some implementations, the network data parsing method further includes: According to the filtering conditions received from the service front end based on the interface, several data packets to be parsed are obtained from the original target file.

[0007] In some implementations, the filtering conditions include: transmission time of the data packet, source address information and destination address information of the data packet, source port information and destination port information of the data packet.

[0008] In some implementations, parsing a target field from the read data packet to be parsed, and storing the parsed target field into a target file includes: A plurality of target fields are parsed from the data packet to be parsed, and the parsed target fields are stored in a target file in the form of rows.

[0009] In some implementations, the network data parsing method further includes executing the following steps at the service front end: In response to receiving a notification from the service backend that parsing of the target file is complete, all the target fields that have been parsed are read from the target file, and the target fields are displayed based on the interface.

[0010] In some implementations, reading all parsed target fields from the target file includes: Call the API interface to read all the parsed target fields from the target file based on the called API interface, and convert the read target fields into target fields in a specified format for display.

[0011] In some implementations, the network data parsing method further includes executing the following steps at the service front end: A user filtering request is received based on an interface, and filtering conditions are sent to a service backend based on the user filtering request, so that the service backend obtains a number of data packets to be parsed from an original target file based on the filtering conditions.

[0012] On the other hand, an embodiment of the present invention further provides a network data parsing device, comprising: A filtering module is configured to divide a number of to-be-parsed data packets obtained from an original target file into a plurality of groups of data packets according to preset conditions, and write each group of data packets into a corresponding to-be-parsed target file; The parsing module is configured to sequentially read the data packets to be parsed from the target file to be parsed, parse the target fields from the read data packets to be parsed, and store the parsed target fields into the target file; The notification module is configured to notify the service front-end interface of the completion of target file parsing in response to the completion of parsing of all data packets to be parsed in the target file to be parsed, so as to display all target fields in the parsed target file based on the interface of the service front-end.

[0013] On the other hand, an embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory, the memory storing a computer program that can be run on the processor, characterized in that when the processor executes the program, the steps of the method of any of the above embodiments are performed.

[0014] On the other hand, an embodiment of the present invention further provides a computer storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method of any of the above embodiments are executed.

[0015] The present invention has at least the following beneficial effects: The present invention provides a network data parsing method, display method, device, equipment and medium, which greatly reduces the workload required for each parsing and improves the parsing speed by splitting an original target file into multiple target files to be parsed and parsing with the target files to be parsed as the parsing target. The data packets to be parsed are read from the target files to be parsed, the target fields are parsed, and the parsed target fields are stored in the target files, and all the parsed target fields are displayed with the target files as the display targets, thereby improving the presentation speed of the network data, so that the user can see the parsed network data without waiting for the full amount of data to be parsed, thereby improving the user experience, and the network data can be displayed without the aid of third-party tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flowchart of a network data parsing method provided by an embodiment of the present invention; Figure 2 A flowchart of a network data parsing method provided by an embodiment of the present invention; Figure 3 A schematic diagram of a network data display interface provided by an embodiment of the present invention; Figure 4 A schematic diagram of a filter request input interface provided by an embodiment of the present invention; Figure 5 A flowchart of a network data parsing method provided by an embodiment of the present invention; Figure 6 A schematic diagram of the structure of a network data parsing device provided by an embodiment of the present invention; Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention; Figure 8 A schematic diagram of the structure of a computer storage medium provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention are further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0019] It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are for distinguishing two non-identical entities with the same name or non-identical parameters. It can be seen that "first" and "second" are only for the convenience of expression and should not be understood as limitations on the embodiments of the present invention. The subsequent embodiments will not explain this one by one.

[0020] As the Internet becomes increasingly developed, enterprises pay special attention to network performance security. Many network performance analysis tools have emerged. Sometimes enterprises not only need to view various analyzed indicators on the network performance analysis tool platform, but also need to trace the source to view and analyze the original PCAP data packets.

[0021] In the related art, when viewing and analyzing the original PCAP data packet, it is usually necessary to load the full PCAP data packet and wait for the full PCAP data packet to be parsed before it can be displayed to the user. The whole process is very slow, which affects the customer experience.

[0022] In addition, when viewing and analyzing PCAP data packets, third-party tools such as Wireshark are required. Third-party tools need to be installed on the client, and different operating systems support different versions, which greatly increases the burden on the client.

[0023] In view of this, in order to solve at least one of the above technical problems, the embodiment of the present invention proposes a network data parsing method, display method, device, equipment and medium, which greatly reduces the workload required for each parsing and improves the parsing speed by splitting the original target file into multiple target files to be parsed and parsing with the target files to be parsed as the parsing target. By reading the data packet to be parsed from the target file to be parsed, parsing the target field, and storing the parsed target field in the target file, and displaying all the parsed target fields with the target file as the display target, the data presentation speed is greatly improved, so that the user can see the parsed data without waiting for the full data parsing to be completed, which improves the user experience, and the data display can be completed without the help of third-party tools.

[0024] The present invention is described in detail below in conjunction with embodiments and drawings.

[0025] A first aspect of an embodiment of the present invention provides a network data parsing method, such as Figure 1 As shown, the network data parsing method provided by the embodiment of the present invention includes executing steps S10 to S12 at the service backend.

[0026] S10, dividing a plurality of to-be-parsed data packets obtained from the original target file into a plurality of groups of data packets according to preset conditions, and writing each group of data packets into a corresponding to the to-be-parsed target file.

[0027] The original target file may be a network data file, for example, a PCAP (Packet Capture) file. A PCAP file may contain several data packets (i.e., data packets to be parsed), each of which includes header information and data content.

[0028] The preset condition may be a preset quantity or a preset capacity, etc., which is not specifically limited here.

[0029] By presetting conditions, the entire original target file can be split into multiple target files to be parsed. The number of data packets in the target files to be parsed is much less than the number of data packets in the original target file, thereby improving the parsing speed of the target files to be parsed.

[0030] S11, reading the data packets to be parsed from the target file to be parsed in sequence, parsing the target fields from the read data packets to be parsed, and storing the parsed target fields in the target file.

[0031] The target field can be configured based on demand, and there are generally multiple target fields in a data packet to be parsed.

[0032] In a specific implementation, multiple target fields may be parsed from the read data packet to be parsed, and the multiple target fields may be concatenated together and stored in a target file.

[0033] S12: In response to the completion of parsing of all the data packets to be parsed in the target file to be parsed, the service front end is notified that the parsing of the target file is completed.

[0034] After the service front end receives the pass, it displays all the target fields in the parsed target file based on the service front end interface.

[0035] After all the data packets to be parsed in a target file to be parsed are parsed, the service front end can be notified that the target file parsing is complete, and the parsed target fields can be displayed.

[0036] The solution of the present invention, by splitting the original target file into multiple target files to be parsed, and parsing with the target files to be parsed as the parsing target, greatly reduces the workload required for each parsing and improves the parsing speed. By reading the data packet to be parsed from the target file to be parsed, parsing the target field, and storing the parsed target field in the target file, and displaying all the parsed target fields with the target file as the display target, the presentation speed of network data is improved, especially the display speed of the first interface data to be displayed on the display interface is particularly improved, so that the user can see the parsed data without waiting for the full data parsing to be completed, which improves the user experience, and the network data can be displayed without the help of third-party tools.

[0037] In some embodiments of the present invention, the method further includes: obtaining a number of data packets to be parsed from the original target file. The obtaining step may further include: obtaining a number of data packets to be parsed from the original target file according to the filtering conditions received from the service front end based on the interface.

[0038] The filtering conditions are used to filter out qualified data packets from the original target file, reduce the number of data packets that need to be parsed, and further improve the data packet parsing speed.

[0039] In a specific implementation, a filtering program can be designed. The filtering program can find the corresponding original target file according to the storage path of the original target file for reading, and then retrieve the read original target file according to the filtering conditions to filter out several data packets to be parsed that meet the filtering conditions.

[0040] In some embodiments of the present invention, the filtering conditions may include: transmission time of the data packet, source address information and destination address information of the data packet, source port information and destination port information of the data packet.

[0041] Specifically, the transmission time of the data packet may include the data packet transmission start time and the data packet transmission end time. The filtering conditions may include: the data packet transmission start time, the data packet transmission end time, the source address information and the destination address information of the data packet, the source port information and the destination port information of the data packet.

[0042] The transmission time of the data packet can be used to limit the time period that the user needs to query, and other filtering conditions can be used to quickly locate the data information to be analyzed.

[0043] The filtering conditions can be passed to the service backend through the API interface. After receiving the filtering conditions, the service backend can filter the massive amount of original PCAP using the filtering conditions to retrieve the data packets that match the filtering conditions, thereby filtering out some unnecessary information, reducing the number of data packets that need to be parsed, and further improving the data packet parsing speed.

[0044] In a specific implementation, the filtered data packets can be stored in a target file to be parsed according to preset conditions.

[0045] For example, if the number of filtered data packets reaches a certain number (for example, 1000), the data packets of the certain data (including the packet header and the packet body) are written into a PCAP format file, and the PCAP format file is named filter1.pcap, and the cache is cleared to continue subsequent filtering to obtain filter2.pcap, filter3.pcap..., until all the data is filtered and several PCAP format files are obtained.

[0046] In some embodiments of the present invention, parsing a target field from a read data packet to be parsed and storing the parsed target field into a target file may include: parsing a plurality of target fields from the read data packet to be parsed and storing the parsed target fields into the target file in the form of rows.

[0047] The filtered target files to be parsed are parsed in turn, that is, each data packet to be parsed is read from each target file to be parsed in turn, several target fields are parsed from the read data packets to be parsed, and the parsed target fields are stored in the target file in the form of rows.

[0048] In some examples, a parsing program W may be designed to parse the data packets to be parsed in each target file to be parsed.

[0049] For example, the first target file filter1.pcap to be parsed is parsed by the parsing program W, and the Frame Number, timestamp, source IP, source port, destination IP, destination port, protocol type, packet size, and Sequence Number information in each data packet in the target file filter1.pcap to be parsed are read, and these fields are concatenated together, separated by commas, and then each record is stored in the text file A in the form of a line. The final data format is as follows: 1, 2024-12-0813:39:00.291996888, 192.168.1.100, 37182, 172.10.50.102, 8080, TCP, 128, [ACK] Seq=4272866516 Ack=1324090249 Win=52896 Len=0.

[0050] When the parsing of the first target file to be parsed, filter1.pcap, is completed, there will be multiple lines (for example, 1000 lines) of data in file A. The parsing program W will send a notification to the client front end, indicating that the analysis of the first file has been completed. After receiving the information, the client front end calls the API reading interface to read the data of file A, reading 1000 data each time. After reading, the data is parsed according to the specified format and assembled into JSON format and returned to the client front end for presentation. Next, the parsing program W continues to parse the second target file to be parsed, filter2.pcap, until the parsing of the last target file to be parsed is completed.

[0051] The network data parsing method provided by the embodiment of the present invention can also be applied to a service front end, such as Figure 2 As shown, the network data parsing method can execute step S21 at the service front end.

[0052] S21. In response to receiving a notification from the service backend that parsing of the target file is complete, all the target fields that have been parsed are read from the target file, and the target fields are displayed based on the interface.

[0053] After the service front end receives the notification from the service back end that the parsing of the target file is complete, it reads all the parsed target fields from the target file and displays the read target fields based on the interface.

[0054] The solution of the present invention displays all parsed target fields with the target file as the display target, thereby improving the presentation speed of the parsed data, especially the presentation speed of the first interface data that needs to be displayed on the display interface. The user can see the parsed data without waiting for the full data to be parsed, thereby improving the user experience.

[0055] In some embodiments of the present invention, reading all target fields after parsing from a target file may include: calling an API interface to read all target fields after parsing from the target file based on the called API interface, and converting the read target fields into target fields in a specified format for display.

[0056] Specifically, every time a target file to be parsed is parsed and a corresponding target file is obtained, the content in the target file can be read through the API interface, and the read content can be converted into a specified format, such as JSON format, and returned to the display interface. The display interface can assemble the target fields of each row according to the attribute information and display them in the form of a table. As a result, the display interface can present part of the data first without waiting for all PCAP parsing to be completed. The presentation speed of the parsed data is improved, and the user experience is improved.

[0057] Figure 3 A schematic diagram of a network data display interface provided by an embodiment of the present invention. In some examples, the assembled target field can be displayed in Figure 3 The display interface shown.

[0058] like Figure 3 The display interface shown shows a data packet record in each row, and the display interface includes 7 columns in total, namely: frame number, time, source address, destination address, protocol type, packet length, and information overview in the packet, and each column represents the content that needs to be displayed for a data packet record. In the solution of the present invention, the display interface can present partial data first without waiting for all PCAP parsing to be completed.

[0059] Assuming that a target file to be parsed stores 1000 data packets, the target file stores 1000 data records corresponding to the 1000 data packets. Each time the display interface is displayed, it can display the 1000 data records stored in a target file. The display interface first displays the first 1000 data records, and the page can be turned back through the scroll bar. When the user turns back through the scroll bar and turns to the 1001st record, the data in the second target file (1001~2000 data) is loaded. Therefore, the parsing program parses 1000 data packets very quickly, which is much faster than the speed of the interface calling the API and then presenting it. Therefore, at this time, the parsing program W may have parsed the 10th file to be parsed, so that the user can see the data without waiting for all the data packets to be parsed, thereby achieving an accelerated effect of data display.

[0060] In some embodiments of the present invention, Figure 2 As shown, the network data parsing method can also perform step S20 at the service front end.

[0061] S20: receiving a user filtering request based on the interface, and sending filtering conditions to a service backend based on the user filtering request.

[0062] By sending the filtering conditions to the service backend, the service backend can obtain a number of data packets to be parsed from the original target file based on the filtering conditions.

[0063] This interface can be a filter request input interface, such as Figure 4 As shown, the filter request input interface may include time (ie, start time to end time), source IP, source port, target IP, and target port. The user inputs the filter request based on the filter request input interface.

[0064] The embodiments of the present invention are described in detail below with reference to specific examples.

[0065] Example 1: Reference Figure 5 , a network data parsing method includes steps S50~S54.

[0066] S50: The service front end receives the filtering conditions based on the filtering request input interface, and sends them to the service back end through the API interface.

[0067] S51, the service backend filters the original target file based on the filtering condition through the filtering program, and puts the data packets in the original target file that meet the filtering condition into the cache queue.

[0068] S52, reading the data packets that meet the filtering conditions from the cache queue in sequence, and storing them into the to-be-parsed file in PCAP format according to preset data.

[0069] Specifically, the 1st to 1000th data packets may be stored in a first PCAP format file to be parsed (hereinafter referred to as PCAP file), the 1001st to 2000th data packets may be stored in a second PCAP file, ..., and the last 1000 data packets may be stored in an Nth PCAP file.

[0070] S53, parse each PCAP file in turn through a parsing program, and store the parsed target fields in the target file in the form of rows.

[0071] S54. The service front end reads the target fields in the target file based on the API interface, and displays them after assembling them.

[0072] Example 2: Taking 1 million data packets as an example to compare the efficiency of the related technical solutions and the solution of the present invention, assuming that the size of one data packet is 128 bytes, it takes 0.1 seconds to open 1000 data packets, and the file to be parsed in the solution of the present invention stores 1000 data packets to be parsed.

[0073] Related technical solution: First, download 1 million PCAP data packets to the local computer in the form of files, and then use third-party software to open 100 PCAP data packets for presentation. The whole process is as follows: filter 1 million data packets, the total size is 1000000*128 / 1024 / 1024 = about 122MB, and the time to open 1 million data packets is: 1000000 / 1000*0.1=100 seconds, plus the time to download the file, then the time consumption will be greater than 100 seconds.

[0074] The solution of the present invention: only 1000 data packets need to be parsed, the total size is 1000*128=125KB, the opening time of 1000 data packets is 0.1 seconds, and the API call time is generally less than 1 second. Therefore, the total time consumption of this solution for the initial display of the display interface is within 2 seconds.

[0075] Through the solution of the present invention, the display speed of the display interface displaying the network data packets of the first interface when the display interface displays a batch of network data packets is greatly improved.

[0076] Based on the same inventive concept, according to another aspect of the present invention, an embodiment of the present invention further provides a network data parsing device, such as Figure 6 As shown, the network data parsing device 60 may include: The filtering module 61 is configured to divide a plurality of to-be-parsed data packets obtained from the original target file into a plurality of groups of data packets according to preset conditions, and write each group of data packets into a corresponding to the to-be-parsed target file; The parsing module 62 is configured to sequentially read the data packets to be parsed from the target file to be parsed, parse the target fields from the read data packets to be parsed, and store the parsed target fields into the target file; The notification module 63 is configured to notify the service front-end interface of the completion of the target file parsing in response to the completion of the parsing of all the data packets to be parsed in the target file to be parsed, so as to display all the target fields in the parsed target file based on the interface of the service front-end.

[0077] Based on the same inventive concept, according to another aspect of the present invention, Figure 7 As shown, an embodiment of the present invention further provides an electronic device 700, which includes a processor 710 and a memory 720. The memory 720 stores a computer program 721 that can be run on the processor. When the processor 710 executes the program, the steps of the above method are performed.

[0078] Among them, the memory, as a non-volatile storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as the program instructions / modules corresponding to the compression method in the embodiment of the present application. The processor executes various functional applications and data processing of the device by running the non-volatile software programs, instructions and modules stored in the memory, that is, realizing the compression method of the above method embodiment.

[0079] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the local module via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0080] Based on the same inventive concept, according to another aspect of the present invention, Figure 8 As shown, an embodiment of the present invention further provides a computer storage medium 800, which stores a computer program 810 for executing the above method when executed by a processor.

[0081] Finally, it should be noted that a person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium of the program can be a disk, an optical disk, a read-only storage memory (ROM) or a random access memory (RAM), etc. The above-mentioned computer program embodiments can achieve the same or similar effects as the corresponding above-mentioned any method embodiments.

[0082] It will also be appreciated by those skilled in the art that various exemplary logic blocks, modules, circuits and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software or a combination of the two. In order to clearly illustrate this interchangeability of hardware and software, a general description has been given to the functions of various schematic components, blocks, modules, circuits and steps. Whether this function is implemented as software or hardware depends on specific applications and the design constraints imposed on the entire system. Those skilled in the art can implement the function in various ways for each specific application, but this implementation decision should not be interpreted as causing a departure from the disclosed scope of the embodiments of the present invention.

[0083] The above are exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications may be made without departing from the scope of the embodiments disclosed in the present invention as defined in the claims. The functions, steps and / or actions of the method claims according to the disclosed embodiments described herein do not need to be performed in any particular order. The serial numbers of the embodiments disclosed in the above embodiments of the present invention are for description only and do not represent the advantages and disadvantages of the embodiments. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in individual form, they may also be understood as multiple unless explicitly limited to the singular.

[0084] It should be understood that, as used herein, the singular forms "a", "an" are intended to include the plural forms as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and / or" refers to any and all possible combinations including one or more of the associated listed items.

[0085] A person skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the disclosure of the embodiments of the present invention (including the claims) is limited to these examples; under the concept of the embodiments of the present invention, the technical features in the above embodiments or different embodiments can also be combined, and there are many other changes in different aspects of the above embodiments of the present invention, which are not provided in detail for the sake of simplicity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the embodiments of the present invention.

Claims

1. A network data analysis method, characterized in that: The method comprises executing the following steps at the service backend: Divide the data packets to be parsed obtained from the original target file into multiple groups of data packets according to preset conditions, and write each group of data packets into the corresponding target file to be parsed; Reading the data packets to be parsed from the target file to be parsed in sequence, parsing the target fields from the read data packets to be parsed, and storing the parsed target fields in the target file; In response to all the data packets to be parsed in the target file to be parsed being parsed, the service front end is notified that the parsing of the target file is completed, so as to display all the target fields in the parsed target file based on the interface of the service front end.

2. The method according to claim 1, characterized in that Also includes: According to the received filtering conditions sent by the service front end based on the interface, a number of data packets to be parsed are obtained from the original target file.

3. The method according to claim 2, characterized in that The filtering conditions include: transmission time of the data packet, source address information and destination address information of the data packet, source port information and destination port information of the data packet.

4. The method according to any one of claims 1 to 3, characterized in that: Parsing the target field from the data packet to be parsed and storing the parsed target field in the target file includes: A plurality of target fields are parsed from the data packet to be parsed, and the parsed target fields are stored in a target file in the form of rows.

5. The method according to claim 1, characterized in that It also includes the following steps on the service front end: In response to receiving a notification from the service backend that parsing of the target file is complete, all the target fields that have been parsed are read from the target file, and the target fields are displayed based on the interface.

6. The method according to claim 5, characterized in that All target fields that have been parsed and read from the target file include: The API interface is called to read all the parsed target fields from the target file based on the called API interface, and the read target fields are converted into target fields in a specified format for display.

7. The method according to claim 5, characterized in that The method further comprises: A user filtering request is received based on an interface, and filtering conditions are sent to a service backend based on the user filtering request, so that the service backend obtains a number of data packets to be parsed from an original target file based on the filtering conditions.

8. A network data analysis device, characterized in that: include: A filtering module is configured to divide a number of to-be-parsed data packets obtained from an original target file into a plurality of groups of data packets according to preset conditions, and write each group of data packets into a corresponding to the to-be-parsed target file; A parsing module is configured to sequentially read the data packets to be parsed from the target file to be parsed, parse the target fields from the read data packets to be parsed, and store the parsed target fields into the target file; The notification module is configured to notify the service front-end interface that the parsing of the target file is completed in response to the completion of parsing of all the data packets to be parsed in the target file to be parsed, so as to display all the target fields parsed in the target file based on the interface of the service front-end.

9. An electronic device, comprising: at least one processor; as well as A memory storing a computer program executable on the processor, wherein the processor executes the steps of the method according to any one of claims 1 to 7 when executing the program.

10. A computer storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are performed.

Images