Report generation method and device for firewall equipment and processing equipment

Abstract

The invention provides a report generation method and device for firewall equipment and processing equipment, which are used for more efficiently and accurately realizing the generation of a summary report by specifically combining a multi-way tree structure on the basis of providing a set of automatic report generation architecture for the firewall equipment. And a series of optimization settings are further provided in the aspect of details, so that the requirement for automatically drawing the summary report in high quality under the actual condition can be met, and the development of related work of firewall equipment can be promoted very friendly.

Description

Technical Field

[0001] The present application relates to the field of firewall management, and in particular to a report generation method, apparatus and processing equipment for firewall equipment. Background Art

[0002] In business operations, it is usually necessary to present the relevant work status in the form of summary reports. A typical example is that Internet companies present their annual performance summary reports to platform users and the public. Through this type of summary report, the relevant work status can be presented concisely and intuitively both internally and externally.

[0003] The inventors of the present application have discovered that traditional summary reports are generally drawn manually. Some technologies may involve automatic drawing solutions, but they are also at a relatively simple level. They only implement a relatively simple summary report drawing process that replicates the logic of manually drawn reports, and cannot meet the actual needs of high-quality automatically drawn summary reports. Summary of the invention

[0004] The present application provides a report generation method, apparatus and processing equipment for firewall devices, which are used to provide a set of automatic report generation architecture for firewall devices, specifically combining a multi-branch tree structure to more efficiently and accurately realize the generation of summary reports, and also provide a further series of optimization settings in details, so as to meet the needs of high-quality automatic drawing of summary reports in actual situations, and can very friendly promote the development of firewall device related work.

[0005] In a first aspect, the present application provides a report generation method for a firewall device, the method comprising:

[0006] Determine corresponding report template data for a report generation task for a target firewall device, wherein the report generation task is used to generate a summary report for the target firewall device in the network architecture within a preset time range;

[0007] Parse the report template data into a multi-tree structure, where the root node, master node, sub node and leaf node are located from the top to the bottom. The root node is used to implement the report cover, the master and sub nodes are used to implement the report attribute parameters, and the leaf node is used to implement the report data presentation form.

[0008] Obtain the working data of the target firewall device within a preset time range;

[0009] Based on the working data, the attribute parameters corresponding to each node in the tree structure of the multi-branch tree are configured to obtain the target data;

[0010] Taking the target data as input, call the report generation function to generate the corresponding summary report.

[0011] In a second aspect, the present application provides a report generation device for a firewall device, the device comprising:

[0012] A determination unit, configured to determine corresponding report template data for a report generation task for a target firewall device, wherein the report generation task is configured to generate a summary report for the target firewall device in the network architecture within a preset time range;

[0013] A parsing unit, used for parsing the report template data into a tree structure of a multi-branch tree, wherein in the tree structure of the multi-branch tree, the node positions of the root node, the master node, the sub node and the leaf node are in a relationship from the top layer to the bottom layer, the root node is used to realize the report cover, the master node and the sub node are used to realize the report attribute parameters, and the leaf node is used to realize the report data presentation form;

[0014] An acquisition unit, used to acquire working data of a target firewall device within a preset time range;

[0015] A configuration unit, configured to configure attribute parameters corresponding to each node in the tree structure of the multi-branch tree based on the working data to obtain target data;

[0016] The generation unit is used to take the target data as input, call the report generation function, and generate the corresponding summary report.

[0017] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0019] From the above content, it can be concluded that the present application has the following beneficial effects:

[0020] In response to the management needs of firewall devices, this application not only provides a set of automated report generation architecture for firewall devices, but also specifically combines a multi-branch tree structure to more efficiently and accurately generate summary reports, and also provides a further series of optimization settings in details. This can meet the needs of high-quality automated summary report drawing in actual situations, and can very friendly promote the development of firewall device related work. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a report generation method for a firewall device in this application;

[0023] Figure 2 This is a schematic diagram of an example of the tree structure parsing logic of this application;

[0024] Figure 3 This is a schematic diagram of an example of a specific example of the tree structure of this application;

[0025] Figure 4 This is another example schematic diagram of a specific example of the tree structure of this application;

[0026] Figure 5 A logical schematic diagram of the overall scheme of this application;

[0027] Figure 6 It is another logical schematic diagram of the overall scheme of this application;

[0028] Figure 7 It is another logical schematic diagram of the overall scheme of this application;

[0029] Figure 8 It is another logical schematic diagram of the overall scheme of this application;

[0030] Fig. 9 This is a structural diagram of a report generation device for a firewall device in the present application;

[0031] Fig.10 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0033] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0034] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0035] Before introducing the report generation method for firewall devices provided by the present application, the background content involved in the present application is first introduced.

[0036] The report generation method, device and computer-readable storage medium for firewall devices provided in the present application can be applied to processing devices, and are used to provide a set of automated report generation architecture for firewall devices, specifically combining a multi-branch tree structure to more efficiently and accurately generate summary reports, and also provide a further series of optimization settings in details, so as to meet the needs of high-quality automated drawing of summary reports in actual situations, and can very friendly promote the development of firewall device-related work.

[0037] The report generation method for firewall devices mentioned in the present application can be executed by a report generation device for firewall devices, or a server, a physical host, or a user equipment (UE) or other different types of processing devices integrated with the report generation device for firewall devices. The report generation device for firewall devices can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer, or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0038] It can be understood that the processing device that executes the report generation method for firewall devices of the present application or is equipped with the corresponding application service of the report generation method for firewall devices of the present application usually only needs corresponding data processing capabilities in specific applications. It can be either a corresponding device node in the internal network architecture of the enterprise or a device outside the internal network architecture of the enterprise. This is relatively flexible. The specific device type and device deployment form can be adaptively adjusted according to actual needs, and the present application does not make specific limitations.

[0039] If the display processing of the generated summary report is further involved, the processing device needs to be further adjusted. For example, it needs to be configured with a corresponding display screen (such as a touch screen). For example, it can also be connected to an external display screen device or linked to other devices with display screens to display content.

[0040] Next, the report generation method for firewall devices provided by the present application is introduced.

[0041] First, see Figure 1 , Figure 1 A flow chart of a report generation method for a firewall device provided in the present application is shown. The report generation method for a firewall device provided in the present application may specifically include the following steps S101 to S105:

[0042] Step S101, determining corresponding report template data for a report generation task for a target firewall device, wherein the report generation task is used to generate a summary report of the target firewall device in the network architecture within a preset time range;

[0043] It can be understood that the present application initiates the corresponding solution processing in the form of a task. In this regard, the present application may involve a report generation task for the target firewall device (or firewall product) to trigger the processing of the solution of the present application to generate a summary report on the working status of the target firewall device within a preset time period, thereby providing data support for the management of the firewall device, thereby further promoting the network security work of the firewall device and ensuring the information security of the enterprise.

[0044] Among them, the target firewall device is the firewall device currently being targeted, which itself can be a device node in the enterprise's internal network architecture that is specifically responsible for the network security responsibility of the firewall, or it can be a device node in the enterprise's internal network architecture that is responsible for the original work / functional responsibilities while also being equipped with additional firewall corresponding application services. This is all possible.

[0045] The acquisition and processing of report generation tasks can be done by manual configuration, by receiving tasks sent (including forwarding) from other devices, or by autonomously initiating tasks according to preset task initiation strategies / rules. All of these are possible.

[0046] Among them, the time span pointed to by the task, that is, the preset time range, can be either the default one or directly specified, such as a whole year, half a year, one month, one week, or a specific day range, specific hour range, etc. that can be adjusted specifically, which can be flexibly adjusted according to the actual situation.

[0047] When the report generation task for the target firewall device is determined, the corresponding report template data can be determined. In layman's terms, the report template data is the data used to describe the template of the summary report to be generated for this task. It can also be directly understood as a report template (custom template), which means that this application pre-configures different report templates for different application requirements, so that the pre-built report generation logic and report content framework can be directly applied.

[0048] In the specific process of obtaining report template data, it can be directly indicated by the task information, for example, through the report template identifier carried in the task information (different report template identifiers correspond to different report template data), or the user can manually select the target report template data to be selected from the different report template data displayed through the corresponding visual interface, or the device can select the adapted target report template data autonomously according to the pre-configured report template data selection strategy / rules and the application requirements of the current task (specifically, it can include the indication content in the task information and other application conditions collected in addition to the task information). This obviously also involves the quantification and ranking of the adaptability, so as to finally select the target report template data with the best adaptability.

[0049] Step S102, parsing the report template data into a tree structure of a multi-branch tree, wherein in the tree structure of the multi-branch tree, the node positions of the root node, the master node, the sub node and the leaf node are in a relationship from the top layer to the bottom layer, the root node is used to implement the report cover, the master node and the sub node are used to implement the report attribute parameters, and the leaf node is used to implement the report data presentation form;

[0050] It can be understood that in the process of generating a corresponding summary report based on the report template data combined with the relevant working data of the target firewall device, the present application specifically involves the application of a multi-branch tree structure. While using the multi-branch tree to concisely and efficiently represent the report-related template design, it is also conducive to efficient and accurate subsequent function call processing, and ultimately achieves the goal of generating a summary report efficiently and accurately.

[0051] In the tree structure of the multi-branch tree involved in the present application, there are usually four types of nodes, namely, root node (root node), master node (main node), sub node (slave node) and leaf node (leaf node). The node positions of the root node, master node, sub node and leaf node are from top to bottom. In some tree structure branches, there may be no intermediate master node and / or sub node.

[0052] As an example, see Figure 2 The schematic diagram of an example of the tree structure parsing logic of the present application is shown, and the report structure corresponding to the determined report template data is as follows Figure 2 The tree structure shown is parsed. For example, if the report structure is: (1-1)(2-1)(2-2)(3-1)(4-1), it can be parsed as Figure 3 An example schematic diagram of a specific example of the tree structure of the present application is shown.

[0053] For the tree structure of a multi-branch tree, the details are:

[0054]

[0055]

[0056] Corresponding to the report generation requirements of this application, for the above four nodes, this application can be specifically designed as follows:

[0057] The root node is used to implement the report cover, the master and sub nodes are used to implement the report attribute parameters, and the leaf node is used to implement the report data presentation.

[0058] In this way, for each node in the tree structure of the multi-branch tree, it is necessary to configure the relevant working data of the current target firewall device as the specific parameters (date data) of the node's attribute parameters (attr parameters, which can be understood as a data item and need to be filled with specific data content) for the subsequent report generation function to call and generate the corresponding summary report.

[0059] Specifically, as an exemplary embodiment here, the type of the root node may specifically include a background image, a main title, a subtitle, the number of devices targeted by the report, and a preset time range;

[0060] The types of master and sub nodes may specifically include first title, first subtitle, first description, and first comment;

[0061] The type of the leaf node may specifically include a second title, a second subtitle, a second description, a second comment, an icon type, a display unit, a reversed horizontal and vertical coordinates, the number of multi-line chart members, and the name of the chart to be merged.

[0062] It can be understood that the first and second prefixes are used to distinguish the contents of the master / sub nodes and the leaf nodes.

[0063] Specifically, the attr parameters are predefined, and the corresponding data data is generated according to the given template, so they are implemented separately here, unless there are some special attr parameters that need to rely on data calculation, then the callback function will be called to add some custom parameters.

[0064] For a more vivid explanation, you can also use the following set of examples (specifically reflected by the table configuration involved in the work process) to better understand the predefined content of the attr parameter.

[0065] 1. If it is a root node, generate a report cover (i.e., report cover), and the attr parameters (i.e., the application type of the required filling work parameters in the report generation process) are as shown in Table 1:

[0066] Table 1-root node instance

[0067]

[0068]

[0069] If it is a master node / sub node, it mainly implements the attr parameters of the report. The parameter contents are as shown in Table 2:

[0070] Table 2-Master node / sub node instance

[0071] serial number key value Note 1 title String title 2 sub_title String Subheading 3 description String describe 4 report_notes Object Notes / Special Instructions

[0072] If it is a leaf node, it mainly implements the attr parameter of the data representation. The parameter content is as shown in Table 3:

[0073] Table 3-Leaf node instance

[0074]

[0075] The above mainly provides specific implementation solutions based on the corresponding data types of the reports generated by each node. In terms of the specific report content, this application also provides other specific implementation solutions.

[0076] Specifically, as an exemplary embodiment here, the data items corresponding to the master node may include equipment, data statistics, network quality and network security.

[0077] 1) For the master node corresponding to the device, the data items of the sub nodes below the node include 1.1) device health status;

[0078] 1.1) The reports corresponding to the device health status include 1.1.1) CPU utilization statistics report, 1.1.2) memory utilization statistics report, 1.1.3) online user statistics report and 1.1.4) user session statistics report;

[0079] 2) For the master node corresponding to the data statistics, the data items of the sub nodes below the node include 2.1) user online behavior statistics, 2.2) user email audit statistics report, 2.3) user website visit statistics report, 2.4) user IM audit statistics report, 2.5) search keyword ranking report, 2.6) user search keyword statistics report, 2.7) malicious website visit ranking, 2.8) user malicious website audit statistics report, 2.9) user community audit statistics report, 2.10) URL category statistics ranking, 2.11) URL visit statistics ranking and 2.12) user other application audit statistics report;

[0080] 2.1) The report contents corresponding to the statistics of the number of online behaviors of users include 2.1.1) the classification report of online behaviors of users and 2.1.2) the ranking report of online behaviors of users. 2.2) The report contents corresponding to the statistics of email audit of users include 2.2.1) the statistics report of emails sent by users and 2.2.2) the statistics report of emails received by users. 2.3) The report contents corresponding to the statistics of website visits of users include 2.3.1) the statistics report of website visits of users. 2.4) The report contents corresponding to the statistics of the number of IM audit of users include 2.4.1) the statistics report of IM audit of users. 2.5) The report contents corresponding to the ranking of search keywords include 2.5.1) the ranking report of search keywords. 2.6) The report contents corresponding to the statistics of the number of search keywords of users include 2.6.1) the statistics report of the number of search keywords of users. 2.7) The corresponding report content of malicious website visit ranking includes 2.7.1) malicious website visit ranking report, 2.8) User malicious website audit frequency statistics include 2.8.1) User malicious website audit frequency statistics report, 2.9) User community audit frequency statistics corresponding report content includes 2.9.1) User community website report and 2.9.2) User community visit frequency ranking report, 2.10) URL category statistics ranking corresponding report content includes 2.10.1) URL category statistics ranking report, 2.11) URL access statistics ranking corresponding report content includes 2.111.) URL access statistics ranking report, 2.12) User other application audit statistics corresponding report content includes 2.12.1) User other application audit frequency statistics report;

[0081] 3) The data items of the master node corresponding to the network quality and the sub-nodes below the node include 3.1) interface traffic statistics, 3.2) application traffic ranking and 3.3) user traffic ranking;

[0082] The report contents corresponding to 3.1) interface traffic statistics include 3.1.1) device interface uplink traffic statistics report, 3.1.2) device interface downlink traffic statistics report and 3.1.3) device interface bidirectional traffic statistics report; the report contents corresponding to 3.2) application traffic ranking include 3.2.1) application software uplink traffic report, 3.2.2) application software downlink traffic report and 3.2.3) application software bidirectional traffic report; the report contents corresponding to 3.3) user traffic ranking include 3.3.1) user uplink traffic statistics report, 3.3.2) user downlink traffic statistics report and 3.3.3) user bidirectional traffic statistics report;

[0083] 4) The data items of the master node corresponding to network security and the sub-nodes under the node include 4.1) ips network security analysis, 4.2) av virus protection security analysis, 4.3) ddos ​​network attack security analysis, 4.4) industrial control whitelist event analysis report, 4.5) industrial control whitelist event analysis report, 4.6) industrial control protocol audit analysis report;

[0084] 4.1) The corresponding reports for ips network security analysis include 4.1.1) ips network security analysis report, 4.1.2) threat distribution report, 4.1.3) attack trend report, 4.1.4) attack source ranking report, 4.1.5) attacked ranking report, 4.1.6) log level distribution report, 4.1.7) attack event ranking report, 4.1.8) protocol ranking report and 4.1.9) business system distribution report. The corresponding reports for 4.2) av virus protection security analysis include 4.2. 1) av virus protection security analysis report, 4.3) ddos ​​network attack security analysis corresponding report content includes 4.3.1) ddos ​​network attack security analysis report, 4.4) industrial control whitelist event analysis corresponding report content includes 4.4.1) industrial control whitelist event analysis report, 4.5) industrial control whitelist event analysis corresponding report content includes 4.5.1) industrial control whitelist event analysis report, 4.6) industrial control protocol audit analysis corresponding report content includes 4.6.1) industrial control protocol audit analysis report.

[0085] Specifically, the above content can be more vividly understood in combination with the following Table 4:

[0086] Table 4 Example of report details

[0087]

[0088]

[0089] It can be understood that the above two embodiments mainly provide specific examples from the perspective of specific data triggers and types involved in different aspects. Starting from the specific operation level, a practical implementation plan is provided, which is highly adaptable to the summary report generation goal of firewall equipment and has better application value.

[0090] Step S103, obtaining the working data of the target firewall device within a preset time range;

[0091] It can be understood that, based on the processed tree structure, as mentioned above, data filling work for the attribute parameters (attr parameters) of each node is also involved, so the working data of the target firewall device within a preset time range can be obtained.

[0092] Among them, the working data can be recorded locally on the target firewall device, or on other devices that record the working status of the target firewall device. Even corresponding to the application of the present application scheme, it is also possible to keep records of the working status of the relevant firewall device when the relevant firewall device is working, so as to use the data required for subsequent summary report generation. All of these are possible.

[0093] As an exemplary embodiment here, obtaining the working data of the target firewall device within a preset time range may specifically include:

[0094] The working data of the target firewall device within a preset time range is obtained from a log database that records data required for periodic log collection, wherein the working data is specifically in the form of working logs.

[0095] It is easy to see that in the embodiment here, the present application involves the application of a log database (logdb), and obtains different work data corresponding to the present application scheme by collecting logs therefrom, so that the target work data required for the current task can be easily obtained therefrom later.

[0096] At the same time, this application also has further configuration for the type of the work data.

[0097] Specifically, as an exemplary embodiment here, the types of working data involved in this application may specifically include sample type, rank type, rank_stat type and rank_top type, and are processed into two forms of data, two-dimensional data and multi-dimensional data, in the subsequent processing process, and the multi-dimensional data (can only) be presented in tabular form.

[0098] As an example, one could have the following:

[0099]

[0100] Table 5 - Related configuration examples

[0101]

[0102] It can be understood that the embodiment here also starts from the specific operation level and provides a practical implementation supporting solution. It is highly adaptable to the summary report generation goal of the firewall device and has better application value.

[0103] Step S104, based on the working data, configuring the attribute parameters corresponding to each node in the tree structure of the multi-branch tree to obtain the target data;

[0104] In this way, based on the obtained working data, specific node attribute filling operations can be performed to complete the configuration of attribute parameters corresponding to each node in the tree structure of the multi-branch tree (which may further involve data conversion processing, which is also possible in some cases). At this time, the tree structure can be recorded as target data (specifically in json format, i.e. json data) for the convenience of explanation or distinction. At this time, the specific summary report generation process can be promoted through the subsequent report generation function.

[0105] Step S105, taking the target data as input, calling the report generation function to generate a corresponding summary report.

[0106] It can be understood that the present application has pre-designed a function for generating a corresponding summary report based on the tree structure filled with data, namely, a report generation function. In this regard, when the target data has been obtained in advance, the report generation function can be called to perform parsing, rendering and other processing, and finally generate the summary report required for the current task.

[0107] The summary report is easy to understand and can be read and displayed. It presents the working status of the target firewall device within a preset time range in a highly concise and intuitive manner.

[0108] Specifically, we can also use the following set of examples to gain a more vivid understanding.

[0109] Input: Check the specific report template, and convert it into a structured string of 7 input strings: (1-1)(2-1)(2-2)(3-1)(4-1-1)(4-1-2)(4-1-3).

[0110] The intermediate algorithm process is:

[0111] Initialize a root node, take the root as the parent node, and for (1-1), find a node with a child node data of 1. If not found, create master-1. Then take master-1 as the parent node, find a node with a child node data of 1. If not found, create sub-1.

[0112] The output is: Figure 4 Another example schematic diagram of a specific example of the tree structure of the present application is shown.

[0113] The corresponding algorithm core pseudo code is:

[0114]

[0115]

[0116]

[0117] In the report generation link based on function calls, for the tree structure generated earlier, start pre-order traversal (non-recursive), get a node, check the node depth is 1 or 2, that is, add the corresponding attr attribute. The possibility of adding custom attributes is not ruled out, so a custom callback interface is provided. If it is a leaf node (depth 3), add the corresponding attr attribute and call the function to generate the report. At this time, according to the report generation tree and the collected data, corresponding processing is performed to form a text in json format, and then continue to export it as an index.html file for rendering.

[0118] As an example, based on the periodic acquisition of recorded log information, the currently required report data is collected, and then combined with the user-configured report template to form a fixed-format json string to replace the "--abt==OriginalData##spl++" string in index.html. At this time, an html format report can be generated with the name index.html (the file name can be flexibly adjusted according to actual needs). If a pdf type table is generated, wkhtmltopdf needs to be called to convert the graphic and text table to generate a pdf file.

[0119] It can be seen from here that as an exemplary embodiment, the summary report specifically generated by the present application can be a report in HTML format on the one hand, and a report in PDF format on the other hand, and the PDF format report is converted from the previously generated HTML format report.

[0120] Among them, wkhtmltopdf is an HTML to PDF tool / component that can be used in this application. As an existing tool, it has better practicality. Of course, this application can also be further optimized and improved on the basis of relevant existing file conversion tools, and even self-configured novel self-developed tools can be used, which can be configured according to actual conditions.

[0121] Of course, in actual applications, it may also involve the setting of summary reports in other file formats, and even the setting of customized / self-developed summary report formats, so as to further improve the personalization / customization characteristics, while also facilitating more efficient and convenient use within the enterprise for some special application needs, and in some cases it can also further improve data security.

[0122] At the same time, corresponding to more specific practical applications or configuration work, the above content can also be combined with Figures 5 to 8 A more vivid understanding can be obtained by referring to the logical schematic diagram of the overall solution of the present application.

[0123] Among them, for Figure 7 As shown in the content, the cfg_db connection points to the Sqlite3 database file path " / disk / report / .cfg_local.db". The cfg_db database stores various report templates, parameters, and data generated by management templates. Each column in this database is a member variable in this task as a parameter.

[0124] The Sqlite3 database file path " / tmp / .cfg_business_system.db" pointed to by the bs_db connection## can be understood as storing business_system related data.

[0125] After obtaining the summary report required for the current task, it is understandable that further data application links may be involved.

[0126] In this data application link, local storage, off-site storage, output of report generation prompts, report display, further data processing, etc. can be carried out. Obviously, the specific data application processing can be flexibly set by pre-configured and real-time configured data application processing strategies / rules, and this application does not make specific limitations.

[0127] Finally, for the above solution content, in general, in response to the management needs of firewall devices, this application not only provides a set of automated report generation architecture for firewall devices, but also specifically combines a multi-branch tree structure to more efficiently and accurately realize the generation of summary reports, and also provides a further series of optimization settings in details. This can meet the needs of high-quality automated drawing of summary reports in actual situations, and can very friendly promote the development of firewall device related work.

[0128] The above is an introduction to the report generation method for firewall devices provided by the present application. In order to facilitate better implementation of the report generation method for firewall devices provided by the present application, the present application also provides a report generation device for firewall devices from the perspective of functional modules.

[0129] See also Fig. 9 , Fig. 9 This is a structural diagram of a report generation device for a firewall device in the present application. In the present application, the report generation device 900 for a firewall device may specifically include the following structure:

[0130] The determining unit 901 is used to determine corresponding report template data for a report generation task for a target firewall device, wherein the report generation task is used to generate a summary report of the target firewall device in the network architecture within a preset time range;

[0131] The parsing unit 902 is used to parse the report template data into a tree structure of a multi-branch tree, wherein in the tree structure of the multi-branch tree, the node positions of the root node, the master node, the sub node and the leaf node are in a relationship from the top layer to the bottom layer, the root node is used to implement the report cover, the master node and the sub node are used to implement the report attribute parameters, and the leaf node is used to implement the report data presentation form;

[0132] An acquisition unit 903 is used to acquire working data of a target firewall device within a preset time range;

[0133] The configuration unit 904 is used to configure the attribute parameters corresponding to each node in the tree structure of the multi-branch tree based on the working data to obtain the target data;

[0134] The generating unit 905 is used to take the target data as input, call the report generating function, and generate a corresponding summary report.

[0135] In an exemplary embodiment, the types of the root node include a background image, a main title, a subtitle, the number of devices targeted by the report, and a preset time range;

[0136] The types of master and sub nodes include first title, first subtitle, first description, and first comment;

[0137] The types of leaf nodes include the second title, second subtitle, second description, second comment, icon type, display unit, reversed horizontal and vertical axes, number of multi-line chart members, and the name of the chart to be merged.

[0138] In another exemplary embodiment, the acquiring unit 903 is specifically configured to:

[0139] The working data of the target firewall device within a preset time range is obtained from a log database that records data required for periodic log collection, wherein the working data is specifically in the form of working logs.

[0140] In another exemplary embodiment, the types of working data specifically include sample type, rank type, rank_stat type and rank_top type, and are processed into two-dimensional data and multi-dimensional data in subsequent processing, and the multi-dimensional data is presented in a tabular form.

[0141] In another exemplary embodiment, the data items corresponding to the master node include equipment, data statistics, network quality and network security.

[0142] 1) For the master node corresponding to the device, the data items of the sub nodes below the node include the health status of the device;

[0143] The reports corresponding to the device health status include CPU utilization statistics report, memory utilization statistics report, online user statistics report and user session statistics report;

[0144] 2) For the master node corresponding to the data statistics, the data items of the sub-nodes below the node include user online behavior statistics, user email audit statistics report, user website visit statistics report, user IM audit statistics report, search keyword ranking report, user search keyword number statistics report, malicious website visit ranking, user malicious website audit statistics report, user community audit statistics report, URL category statistics ranking, URL visit statistics ranking and user other application audit statistics report;

[0145] The report contents corresponding to the statistics of the number of online behaviors of users include the report of the classification of online behaviors of users and the report of the ranking of online behaviors of users; the report contents corresponding to the statistics of the audit of emails of users include the report of the statistics of the sent emails of users and the report of the statistics of the received emails of users; the report contents corresponding to the statistics of the website visits of users include the report of the statistics of the website visits of users; the report contents corresponding to the statistics of the number of im audits of users include the report of the statistics of the number of im audits of users; the report contents corresponding to the ranking of search keywords include the report of the ranking of search keywords; the report contents corresponding to the statistics of the number of search keywords of users include the report of the statistics of the number of search keywords of users; the report contents corresponding to the ranking of malicious website visits include the report of the ranking of malicious website visits; the statistics of the number of audits of malicious websites of users include the report of the statistics of the number of audits of malicious websites of users; the report contents corresponding to the statistics of the number of community audits of users include the report of the website of users and the report of the ranking of the number of community visits of users; the report contents corresponding to the ranking of URL statistics include the report of the ranking of URL statistics; the report contents corresponding to the ranking of URL visits include the report of the ranking of URL visits; the report contents corresponding to the statistics of the audit of other applications of users include the report of the statistics of the audit of other applications of users;

[0146] 3) The data items of the sub-nodes under the master node corresponding to the network quality include interface traffic statistics, application traffic rankings, and user traffic rankings;

[0147] The report contents corresponding to the interface traffic statistics include the device interface upstream traffic statistics report, the device interface downstream traffic statistics report and the device interface bidirectional traffic statistics report; the report contents corresponding to the application traffic ranking include the application software upstream traffic report, the application software downstream traffic report and the application software bidirectional traffic report; the report contents corresponding to the user traffic ranking include the user upstream traffic statistics report, the user downstream traffic statistics report and the user bidirectional traffic statistics report;

[0148] 4) The data items of the sub-nodes under the master node corresponding to network security include ips network security analysis, av virus protection security analysis, ddos ​​network attack security analysis, industrial control whitelist event analysis report, industrial control whitelist event analysis report, and industrial control protocol audit analysis report;

[0149] The report contents corresponding to ips network security analysis include ips network security analysis report, threat distribution report, attack trend report, attack source ranking report, attacked ranking report, log level distribution report, attack event ranking report, protocol ranking report and business system distribution report; the report contents corresponding to av virus protection security analysis include av virus protection security analysis report; the report contents corresponding to ddos ​​network attack security analysis include ddos ​​network attack security analysis report; the report contents corresponding to industrial control whitelist event analysis include industrial control whitelist event analysis report; the report contents corresponding to industrial control whitelist event analysis include industrial control whitelist event analysis report; the report contents corresponding to industrial control protocol audit analysis include industrial control protocol audit analysis report.

[0150] In yet another exemplary embodiment, the summary report is specifically a report in HTML format.

[0151] In yet another exemplary embodiment, the summary report is specifically a report in PDF format, and the report in PDF format is converted from a previously generated report in HTML format.

[0152] This application also provides a processing device from the perspective of hardware structure, see Fig.10 , Fig.10 1001, a memory 1002, and an input / output device 1003. The processor 1001 is used to execute the computer program stored in the memory 1002 to implement the following Figure 1 The steps of the report generation method for the firewall device in the corresponding embodiment; or, the processor 1001 is used to execute the computer program stored in the memory 1002 to implement the following Fig. 9 Corresponding to the functions of each unit in the embodiment, the memory 1002 is used to store the processor 1001 executing the above Figure 1 The computer program required by the report generation method for the firewall device in the corresponding embodiment.

[0153] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 1002, and executed by the processor 1001 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0154] The processing device may include, but is not limited to, the processor 1001, the memory 1002, and the input / output device 1003. Those skilled in the art will appreciate that the illustration is merely an example of the processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 1001, the memory 1002, the input / output device 1003, etc. are connected via a bus.

[0155] The processor 1001 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0156] The memory 1002 can be used to store computer programs and / or modules. The processor 1001 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 1002 and calling the data stored in the memory 1002. The memory 1002 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0157] When the processor 1001 is used to execute the computer program stored in the memory 1002, the following functions can be implemented:

[0158] Determine corresponding report template data for a report generation task for a target firewall device, wherein the report generation task is used to generate a summary report for the target firewall device in the network architecture within a preset time range;

[0159] Parse the report template data into a multi-tree structure, where the root node, master node, sub node and leaf node are located from the top to the bottom. The root node is used to implement the report cover, the master and sub nodes are used to implement the report attribute parameters, and the leaf node is used to implement the report data presentation form.

[0160] Obtain the working data of the target firewall device within a preset time range;

[0161] Based on the working data, the attribute parameters corresponding to each node in the tree structure of the multi-branch tree are configured to obtain the target data;

[0162] Taking the target data as input, call the report generation function to generate the corresponding summary report.

[0163] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the report generating device, processing device and corresponding units of the firewall device described above can refer to the following. Figure 1 The description of the report generation method for the firewall device in the corresponding embodiment will not be repeated here.

[0164] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0165] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the report generation method for the firewall device in the corresponding embodiment, the specific operation can refer to the following Figure 1 The description of the report generation method for the firewall device in the corresponding embodiment will not be repeated here.

[0166] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0167] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the report generation method for the firewall device in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1The beneficial effects that can be achieved by the report generation method for the firewall device in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0168] The report generation method, device, processing device and computer-readable storage medium for firewall devices provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application. At the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A report generation method for a firewall device, characterized in that: The method comprises: Determine corresponding report template data for a report generation task of a target firewall device, wherein the report generation task is used to generate a summary report of the target firewall device in the network architecture within a preset time range; Parsing the report template data into a tree structure of a multi-branch tree, wherein in the tree structure of the multi-branch tree, the node positions of the root node, the master node, the sub node and the leaf node are in a relationship from the top layer to the bottom layer, the root node is used to implement the report cover, the master node and the sub node are used to implement the report attribute parameters, and the leaf node is used to implement the report data presentation form; Acquire the working data of the target firewall device within the preset time range; Based on the working data, the attribute parameters corresponding to each node in the tree structure of the multi-branch tree are configured to obtain target data; Taking the target data as input, a report generation function is called to generate the corresponding summary report.

2. The method according to claim 1, characterized in that The types of the root node include background image, main title, subtitle, number of devices targeted by the report and the preset time range; The types of the master and sub nodes include a first title, a first subtitle, a first description, and a first comment; The types of the leaf node include a second title, a second subtitle, a second description, a second comment, an icon type, a display unit, a reversed horizontal and vertical coordinates, the number of multi-line chart members, and a chart name of the chart to be merged.

3. The method according to claim 1, characterized in that The obtaining of the working data of the target firewall device within the preset time range includes: The working data of the target firewall device within the preset time range is obtained from a log database that records data required for periodic log collection, wherein the working data is specifically in the form of a working log.

4. The method according to claim 3, characterized in that The types of the working data specifically include sample type, rank type, rank_stat type and rank_top type, and are processed into two-dimensional data and multi-dimensional data in the subsequent processing process, and the multi-dimensional data is presented in a tabular form.

5. The method according to claim 1, characterized in that The data items corresponding to the master node include equipment, data statistics, network quality and network security. 1) For the master node corresponding to the device, the data items of the sub nodes below the node include the health status of the device; The report contents corresponding to the device health status include CPU utilization statistics report, memory utilization statistics report, online user statistics report and user session statistics report; 2) For the master node corresponding to the data statistics, the data items of the sub nodes below the node include user online behavior statistics, user email audit statistics report, user website visit statistics report, user IM audit statistics report, search keyword ranking report, user search keyword number statistics report, malicious website visit ranking, user malicious website audit statistics report, user community audit statistics report, URL category statistics ranking, URL visit statistics ranking and user other application audit statistics report; The report content corresponding to the statistics of the number of times of user online behavior includes a user online behavior classification report and a user online behavior ranking report, the report content corresponding to the user email audit statistics includes a user sending email statistics report and a user receiving email statistics report, the report content corresponding to the user website visit statistics includes a user website visit statistics report, the report content corresponding to the user IM audit number statistics includes a user IM audit number statistics report, the report content corresponding to the search keyword ranking includes a search keyword ranking report, the report content corresponding to the user search keyword number statistics includes a user search keyword number statistics report, the report content corresponding to the malicious website visit ranking includes a malicious website visit ranking report, the user malicious website audit number statistics includes a user malicious website audit number statistics report, the report content corresponding to the user community audit number statistics includes a user community website report and a user community visit number ranking report, the report content corresponding to the URL category statistics ranking includes a URL category statistics ranking report, the report content corresponding to the URL access statistics ranking includes a URL access statistics ranking report, and the report content corresponding to the user other application audit statistics here includes a user other application audit number statistics report; 3) The data items of the sub nodes under the master node corresponding to the network quality include interface traffic statistics, application traffic ranking and user traffic ranking; The report contents corresponding to the interface traffic statistics include the device interface uplink traffic statistics report, the device interface downlink traffic statistics report and the device interface bidirectional traffic statistics report; the report contents corresponding to the application traffic ranking include the application software uplink traffic report, the application software downlink traffic report and the application software bidirectional traffic report; the report contents corresponding to the user traffic ranking include the user uplink traffic statistics report, the user downlink traffic statistics report and the user bidirectional traffic statistics report; 4) The data items of the sub nodes below the master node corresponding to network security include ips network security analysis, av virus protection security analysis, ddos ​​network attack security analysis, industrial control whitelist event analysis report, industrial control whitelist event analysis report, and industrial control protocol audit analysis report; The report contents corresponding to the ips network security analysis include ips network security analysis report, threat distribution report, attack trend report, attack source ranking report, attacked ranking report, log level distribution report, attack event ranking report, protocol ranking report and business system distribution report; the report contents corresponding to the av virus protection security analysis include av virus protection security analysis report; the report contents corresponding to the ddos ​​network attack security analysis include ddos ​​network attack security analysis report; the report contents corresponding to the industrial control whitelist event analysis include industrial control whitelist event analysis report; the report contents corresponding to the industrial control whitelist event analysis include industrial control whitelist event analysis report; the report contents corresponding to the industrial control protocol audit analysis include industrial control protocol audit analysis report.

6. The method according to claim 1, characterized in that The summary report is specifically a report in HTML format.

7. The method according to claim 1, characterized in that The summary report is specifically a report in PDF format, and the report in PDF format is converted from a previously generated report in HTML format.

8. A report generation device for a firewall device, characterized in that: The device comprises: A determination unit, configured to determine corresponding report template data for a report generation task for a target firewall device, wherein the report generation task is configured to generate a summary report of the target firewall device in the network architecture within a preset time range; A parsing unit, used for parsing the report template data into a tree structure of a multi-branch tree, wherein in the tree structure of the multi-branch tree, the node positions of the root node, the master node, the sub node and the leaf node are in a relationship from the top layer to the bottom layer, the root node is used to implement the report cover, the master node and the sub node are used to implement the report attribute parameters, and the leaf node is used to implement the report data expression form; An acquisition unit, configured to acquire the working data of the target firewall device within the preset time range; A configuration unit, configured to configure attribute parameters corresponding to each node in the tree structure of the multi-branch tree based on the working data to obtain target data; The generating unit is used to take the target data as input, call the report generating function, and generate the corresponding summary report.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images