Traffic detection method and device, equipment and storage medium

Abstract

The invention discloses a flow detection method and device, equipment and a storage medium. According to the scheme, VPP flow is forwarded to Suricata by using LibDAQ, an additional virtual interface is not introduced, process management is very convenient, usability and flexibility are higher, a message does not pass through a protocol stack, and performance loss is very low; in addition, as the LibDAQ supports multi-queue packet capture, the multi-core processing advantage of the VPP can be fully utilized, and the performance is very high; moreover, the LibDAQ has defined a set of complete data structure for ensuring reliable transmission of messages, supports batch message transmission, perfectly adapts to the vector message processing logic of the VPP, and has very small development workload.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a flow detection method, device, equipment and storage medium. Background Art

[0002] With the continuous development of Internet infrastructure, enterprise networks are facing more and more complex security threats. In modern network security protection, traffic detection and analysis is a crucial part.

[0003] At present, in order to improve the level of network security protection, many network environments have begun to use the Vector Packet Processing (VPP) platform in combination with the network intrusion detection and prevention system Suricata, using VPP as an efficient forwarding platform for data packets and Suricata as a deep detection engine for traffic. Based on this, when performing traffic detection in the prior art, it is usually necessary to create a TAP interface after running VPP, and the TAP interface will correspondingly create a virtual interface on the host, so that Suricata can receive data packets from this virtual interface for subsequent traffic detection.

[0004] However, the above flow detection method has the problem of poor usability and flexibility. Summary of the invention

[0005] The present application aims to at least solve the technical problems existing in the prior art. To this end, the first aspect of the present application proposes a flow detection method, which includes:

[0006] Obtaining the abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory;

[0007] Initialize and configure the abstract data packet collection library module to be loaded based on the preset configuration file to obtain the initialized abstract data packet collection library module;

[0008] Call the preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module;

[0009] Perform traffic detection on the data packet to obtain the detection result.

[0010] In a possible implementation, obtaining an abstract data packet collection library module to be loaded includes:

[0011] Read configuration files or command line parameters of network intrusion detection and prevention systems;

[0012] Based on the configuration file or command line parameters, obtain the module name corresponding to the abstract data packet collection library module to be loaded;

[0013] Based on the module name, the abstract data packet collection library module to be loaded corresponding to the module name is searched in the network intrusion detection and defense system library path.

[0014] In a possible implementation, calling a preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module includes:

[0015] Based on the number of working threads in the preset configuration file, create a packet receiving thread corresponding to the number of working threads;

[0016] For each packet receiving thread, the preset message receiving function is called to collect data packets in batches from the initialized abstract data packet collection library module.

[0017] In a possible implementation, calling a preset message receiving function to collect data packets in batches from an initialized abstract data packet collection library module includes:

[0018] Initialize the abstract data packet collection library module structure and add related functions; the related functions include module loading function, instance creation function and message receiving function;

[0019] Record the API base address in the module loading function, create a module context structure in the instance creation function, map the preset queue to the current memory space, and save the preset queue address pointer to the module context structure; wherein the preset queue address pointer includes a read pointer;

[0020] Read the data packet from the preset queue based on the read pointer through the receive message function, fill the data packet into the preset array, and update the read pointer;

[0021] After all data packets in the preset queue are read or the maximum number of received packets set in the preset configuration file is reached, the preset array is returned to obtain the data packets.

[0022] In a possible implementation, the related functions further include a destroy instance function, a destroy message function, and a module uninstall function, and the method further includes:

[0023] After completing the flow detection process for the data packet, the destroy message function is called to release and recycle the resources of the preset array;

[0024] After the module context structure created in the create instance function is used, the destroy instance function is called to release the preset shared memory and clear the context information;

[0025] After the abstract packet collection library module is used, call the module uninstall function to clear the API base address.

[0026] In one possible implementation, the method includes:

[0027] Create a data packet processing plug-in and add initialization code and worker thread node processing code corresponding to each worker thread to the plug-in;

[0028] Perform plug-in initialization processing based on the initialization code and obtain the pre-configured preset queue size and preset memory size;

[0029] According to the preset queue size and the preset memory size, a preset queue is created for each working thread based on the shared memory; wherein the preset queue is a first-in-first-out queue.

[0030] In a possible implementation, the method further includes:

[0031] For each worker thread, batches of data packets are received based on the worker thread node processing code;

[0032] Based on the write pointer in the preset queue address pointer, the data packet is written into the preset queue corresponding to the currently working working thread, and the write pointer is updated.

[0033] The second aspect of the present application provides a flow detection device, which includes:

[0034] An acquisition module is used to acquire the abstract data packet collection library module to be loaded, and dynamically load the abstract data packet collection library module to be loaded into the current process memory;

[0035] An initialization module, used for initializing and configuring the abstract data packet collection library module to be loaded based on a preset configuration file to obtain an initialized abstract data packet collection library module;

[0036] The receiving module is used to call the preset receiving message function to collect data packets in batches from the initialized abstract data packet collection library module;

[0037] The processing module is used to perform flow detection processing on the data packet to obtain the detection result.

[0038] In a possible implementation manner, the acquisition module is specifically used to:

[0039] Read configuration files or command line parameters of network intrusion detection and prevention systems;

[0040] Based on the configuration file or command line parameters, obtain the module name corresponding to the abstract data packet collection library module to be loaded;

[0041] Based on the module name, the abstract data packet collection library module to be loaded corresponding to the module name is searched in the network intrusion detection and defense system library path.

[0042] In a possible implementation manner, the above-mentioned collection module is specifically used for:

[0043] Based on the number of working threads in the preset configuration file, create a packet receiving thread corresponding to the number of working threads;

[0044] For each packet receiving thread, the preset message receiving function is called to collect data packets in batches from the initialized abstract data packet collection library module.

[0045] In a possible implementation manner, the collection module is further used for:

[0046] Initialize the abstract data packet collection library module structure and add related functions; the related functions include module loading function, instance creation function and message receiving function;

[0047] Record the API base address in the module loading function, create a module context structure in the instance creation function, map the preset queue to the current memory space, and save the preset queue address pointer to the module context structure; wherein the preset queue address pointer includes a read pointer;

[0048] Read the data packet from the preset queue based on the read pointer through the receive message function, fill the data packet into the preset array, and update the read pointer;

[0049] After all data packets in the preset queue are read or the maximum number of received packets set in the preset configuration file is reached, the preset array is returned to obtain the data packets.

[0050] In a possible implementation manner, the related functions further include a destroy instance function, a destroy message function and a module uninstall function, and the above-mentioned flow detection device is further used for:

[0051] After completing the flow detection process for the data packet, the destroy message function is called to release and recycle the resources of the preset array;

[0052] After the module context structure created in the create instance function is used, the destroy instance function is called to release the preset shared memory and clear the context information;

[0053] After the abstract packet collection library module is used, call the module uninstall function to clear the API base address.

[0054] In a possible implementation manner, the flow detection device is further used for:

[0055] Create a data packet processing plug-in and add initialization code and worker thread node processing code corresponding to each worker thread to the plug-in;

[0056] Perform plug-in initialization processing based on the initialization code and obtain the pre-configured preset queue size and preset memory size;

[0057] According to the preset queue size and the preset memory size, a preset queue is created for each working thread based on the shared memory; wherein the preset queue is a first-in-first-out queue.

[0058] In a possible implementation manner, the flow detection device is further used for:

[0059] For each worker thread, batches of data packets are received based on the worker thread node processing code;

[0060] Based on the write pointer in the preset queue address pointer, the data packet is written into the preset queue corresponding to the currently working working thread, and the write pointer is updated.

[0061] The third aspect of the present application proposes an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the flow detection method as described in the first aspect.

[0062] The fourth aspect of the present application proposes a computer-readable storage medium, which stores at least one instruction, at least one program, a code set or an instruction set. The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the traffic detection method as described in the first aspect.

[0063] The embodiments of the present application have the following beneficial effects:

[0064] The flow detection method provided by the embodiment of the present application includes: obtaining an abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory, initializing and configuring the abstract data packet collection library module to be loaded based on a preset configuration file, obtaining the initialized abstract data packet collection library module, calling a preset message receiving function, batch collecting data packets from the initialized abstract data packet collection library module, performing flow detection processing on the data packets, and obtaining the detection result. This solution uses LibDAQ to forward VPP traffic to Suricata, does not introduce additional virtual interfaces, is very convenient for process management, has higher ease of use and flexibility, and the message does not pass through the protocol stack, and the performance loss is very low; in addition, since LibDAQ supports multi-queue packet capture, it can fully utilize the multi-core processing advantages of VPP, and the performance is very high; and LibDAQ has defined a complete set of data structures to ensure the reliable transmission of messages, and supports batch message transmission, perfectly adapts to the vector message processing logic of VPP, and the development workload is very small. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 A block diagram of a computer device provided in an embodiment of the present application;

[0066] Figure 2 A flow chart of the steps of a flow detection method provided in an embodiment of the present application;

[0067] Figure 3 A flowchart of the steps for creating a queue provided in an embodiment of the present application;

[0068] Figure 4 A flowchart of the steps of receiving a data packet provided in an embodiment of the present application;

[0069] Figure 5 A flowchart of the steps of obtaining an abstract data packet collection library module to be loaded provided in an embodiment of the present application;

[0070] Figure 6 A flowchart of the steps of receiving a data packet provided in an embodiment of the present application;

[0071] Figure 7 Another flowchart of steps for receiving a data packet provided in an embodiment of the present application;

[0072] Figure 8 A structural block diagram of a flow detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0074] At present, in order to improve the level of network security protection, many network environments have begun to combine the Vector Packet Processing (VPP) platform with the network intrusion detection and defense system Suricata, using VPP as an efficient forwarding platform for data packets and Suricata as a deep detection engine for traffic. When performing traffic detection, it is usually necessary to create a TAP interface after running VPP, and the TAP interface will correspondingly create a virtual interface on the host, so that Suricata can receive data packets from this virtual interface for subsequent traffic detection. However, the above method Suricata is heavily dependent on VPP, that is, VPP must be run before Suricata can be run. It is not easy to use and difficult to manage, and the performance of using af-packet to capture packets is not very high. If af-xdp is used to capture packets, the kernel version requirements are relatively strict (must be above 5.10), and it cannot support lower version kernels. af-packet is a high-performance network packet capture technology that can directly access network packets at the data link layer and send them to the packet capture program for further processing. AF-XDP is a high-performance packet processing technology that implements zero-copy packet processing in the Linux kernel.

[0075] Among them, VPP is an open source high-performance packet processing framework that provides efficient packet processing functions in user space. By using vector processing and multi-threading technology, VPP can support millions of packet processing per second; achieve zero-copy data transmission and reduce latency; support plug-in extension functions to adapt to various network requirements. It is widely used in high-speed packet forwarding, load balancing, network address translation and other scenarios in enterprises and data centers.

[0076] Suricata is an open source network intrusion detection and defense system that can perform in-depth analysis of network traffic and supports detection of multiple protocols including HTTP. It supports multi-threaded processing, enabling it to handle large-scale traffic more efficiently. It has deep packet inspection, traffic logging, malicious activity identification and other functions. It is suitable for scenarios that require traffic monitoring, threat detection and real-time defense.

[0077] Based on this, the present application proposes a traffic detection method, which includes: obtaining an abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory, initializing and configuring the abstract data packet collection library module to be loaded based on a preset configuration file, obtaining the initialized abstract data packet collection library module, calling a preset message receiving function, batch collecting data packets from the initialized abstract data packet collection library module, performing traffic detection processing on the data packets, and obtaining the detection result. This solution uses LibDAQ to forward VPP traffic to Suricata, which does not introduce additional virtual interfaces, is very convenient for process management, has higher ease of use and flexibility, and the message does not pass through the protocol stack, and the performance loss is very low; in addition, because LibDAQ supports multi-queue packet capture, it can fully utilize the multi-core processing advantages of VPP and has very high performance; and LibDAQ has defined a complete set of data structures to ensure the reliable transmission of messages, and supports batch message transmission, perfectly adapting to the vector message processing logic of VPP, and the development workload is very small.

[0078] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "multiple" means two or more. In addition, the use of "based on" or "according to" means openness and inclusiveness, because the process, steps, calculations or other actions "based on" or "according to" one or more of the conditions or values ​​may be based on additional conditions or values ​​beyond the described values ​​in practice.

[0079] The traffic detection method provided in the present application can be applied to a computer device (electronic device), which can be a server or a terminal, wherein the server can be a single server or a server cluster composed of multiple servers. The embodiments of the present application do not specifically limit this. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices.

[0080] Take the computer device as a server as an example. Figure 1 A block diagram of a server is shown, such as Figure 1As shown, the server may include a processor and a memory connected via a system bus. The processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. When the computer program is executed by the processor, a flow detection method is implemented.

[0081] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. Optionally, the server may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0082] It should be noted that the execution subject of the embodiments of the present application may be a computer device or a flow detection device. The following method embodiments are described using a computer device as the execution subject.

[0083] Figure 2 A flow chart of the steps of a flow detection method provided in an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0084] Step 202: Obtain the abstract data packet collection library module to be loaded, and dynamically load the abstract data packet collection library module to be loaded into the current process memory.

[0085] When performing flow detection, data packets may be received first. In some optional embodiments, for example, Figure 3 As shown, Figure 3 A flowchart of steps for creating a queue provided in an embodiment of the present application includes:

[0086] Step 302: Create a data packet processing plug-in, and add initialization code and worker thread node processing code corresponding to each worker thread to the plug-in.

[0087] Step 304: Perform plug-in initialization processing based on the initialization code, and obtain a pre-configured preset queue size and preset memory size.

[0088] Step 306: Create a preset queue for each working thread based on the shared memory according to the preset queue size and the preset memory size.

[0089] Among them, you can first create a new packet processing plug-in, that is, a VPP plug-in, and you need to add initialization code and worker thread node processing code corresponding to each worker thread to the plug-in. Then, you can add a configuration reading process to the packet processing plug-in initialization process, that is, read the pre-configured preset queue size and preset memory size from the configuration file. The packet processing plug-in will be loaded when VPP is started, and the initialization process will be executed when the packet processing plug-in is loaded.

[0090] Therefore, a preset queue can be created for each worker thread based on the shared memory according to the preset queue size and the preset memory size. The preset queue is a first-in-first-out queue. In addition, the read pointer and the write pointer positions need to be initialized to point to the beginning of the queue. At this time, the queue is empty.

[0091] In some optional embodiments, after the preset queue is created, the data packet can be received, such as Figure 4 As shown, Figure 4 A flowchart of a step of receiving a data packet provided in an embodiment of the present application includes:

[0092] Step 402: For each worker thread, batches of data packets are received based on the worker thread node processing code.

[0093] Step 404: Based on the write pointer in the preset queue address pointer, write the data packet into the preset queue corresponding to the currently working working thread, and update the write pointer.

[0094] Among them, for each working thread, in the current node processing flow of the working thread, data packets can be continuously received in batches. There may be multiple data packets received each time. The number of received data packets is calculated, and based on the write pointer in the preset queue address pointer, the data packets are written to the preset queue corresponding to the current working thread, and then the write pointer position is updated, that is, the write position = current write position + number of data packets.

[0095] Then, the next batch of data packets may continue to be received, and the above steps 402 and 404 may be repeated.

[0096] After creating the VPP plug-in, you can also pre-develop an abstract packet collection library module, namely the LibDAQ module, in VPP to forward VPP traffic to Suricata, that is, collect data packets from the VPP plug-in through the abstract packet collection library module and forward them to Suricata for traffic detection and processing. Among them, the modular development idea of ​​the abstract packet collection library module is consistent with the VPP plug-in idea, which is very easy to integrate.

[0097] Among them, LibDAQ is an abstract packet collection library designed for the open source intrusion detection system Snort, which provides an interface for interacting with the underlying data collection equipment. It is compatible with a variety of data collection technologies to adapt to different systems and hardware; it uses zero copy and multi-threading to help users achieve higher data processing throughput; it supports use on multiple operating systems to simplify user configuration and deployment; it helps users obtain data packets more efficiently and achieve high-performance intrusion detection functions, which is suitable for enterprise network security environments. LibDAQ provides the abstraction of multiple packet capture modes and unifies the packet capture interface. After Suricata integrates LibDAQ, it can not only receive traffic from VPP, but also directly support many other packet capture methods that Suricata does not natively support.

[0098] Thus, when performing traffic detection, the abstract data packet collection library module to be loaded can be obtained, and the abstract data packet collection library module to be loaded can be dynamically loaded into the current process memory. Figure 5 As shown, Figure 5 A flowchart of the steps of obtaining an abstract data packet collection library module to be loaded provided in an embodiment of the present application includes:

[0099] Step 502: Read the configuration file or command line parameters of the network intrusion detection and prevention system.

[0100] Step 504: Based on the configuration file or command line parameters, obtain the module name corresponding to the abstract data packet collection library module to be loaded.

[0101] Step 506: Based on the module name, search the network intrusion detection and defense system library path for the abstract data packet collection library module to be loaded that corresponds to the module name.

[0102] Among them, the configuration file or command line parameters of the network intrusion detection and prevention system, namely Suricata, can be read first to obtain the abstract data packet collection library module to be loaded. In some optional embodiments, the VPP LibDAQ module will be compiled into a dynamic library file, namely daq_vpp.so, for Suricata to load and use.

[0103] Thus, the module name corresponding to the abstract data packet collection library module to be loaded can be obtained based on the configuration file or command line parameters. For example, the module name that can be used in the embodiment of the present application is daq_vpp. In addition, the obtained abstract data packet collection library module to be loaded can also be dynamically loaded into the current process memory.

[0104] Next, based on the module name, the abstract data packet acquisition library module daq_vpp.so to be loaded corresponding to the module name can be searched in the network intrusion detection and defense system library path, that is, the LibDAQ module to be loaded.

[0105] Step 204: Initialize and configure the abstract data packet collection library module to be loaded based on the preset configuration file to obtain an initialized abstract data packet collection library module.

[0106] Among them, after obtaining the abstract data packet collection library module to be loaded, the preset configuration file can be read, and the abstract data packet collection library module to be loaded can be initialized and configured based on the preset configuration file, such as initializing the number of working threads, the maximum number of received packets, the maximum length of data packets, timeout period and other parameters to obtain the initialized abstract data packet collection library module.

[0107] Step 206: Call the preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module.

[0108] Among them, in some optional embodiments, such as Figure 6 As shown, Figure 6 A flowchart of the steps of receiving a data packet provided in an embodiment of the present application includes:

[0109] Step 602: Based on the number of working threads in the preset configuration file, create a packet receiving thread corresponding to the number of working threads.

[0110] Step 604: For each packet receiving thread, call a preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module.

[0111] Among them, based on the number of working threads in the preset configuration file, packet receiving threads corresponding to the number of working threads can be created, and then for each packet receiving thread, a preset receiving message function can be called to batch collect data packets from the initialized abstract data packet collection library module. Figure 7 As shown, Figure 7 Another step flow chart of receiving a data packet provided in an embodiment of the present application includes:

[0112] Step 702: Initialize the abstract data packet collection library module structure and add related functions.

[0113] Step 704: record the API base address in the module loading function, create a module context structure in the instance creation function, map the preset queue to the current memory space, and save the preset queue address pointer to the module context structure.

[0114] Step 706: Read the data packet from the preset queue based on the read pointer through the receive message function, fill the data packet into the preset array, and update the read pointer.

[0115] Step 708: After all data packets in the preset queue are read or the maximum number of received packets set in the preset configuration file is reached, the preset array is returned to obtain the data packets.

[0116] Among them, when forwarding data packets through the LibDAQ module, the abstract data packet acquisition library module structure, namely DAQ_ModuleAPI_t, can be initialized first, and related functions can be added. The related functions can include module loading function, instance creation function and message receiving function.

[0117] Next, you can record the API base address in the module loading function, create a module context structure in the instance creation function, map the preset queue based on shared memory to the current memory space of the current LibDAQ module using process, and save the preset queue address pointer to the module context structure.

[0118] The preset queue address pointer also includes a read pointer, so that the data packet can be read from the preset queue based on the read pointer through the receive message function, the data packet can be filled into the preset array, and the read pointer can be updated. Specifically, in the receive message function, the data packet in the preset queue can be continuously read according to the read pointer, and the read pointer can be updated. In addition, the read data packet content can also be filled into the preset array structure, that is, the DAQ_Msg_t structure, and the length of DAQ_Msg_t can be set.

[0119] After all data packets in the preset queue are read or the maximum number of received packets set in the preset configuration file is reached, the receive message function will return the filled preset array and array size to the data caller so that the data caller can obtain the data packet.

[0120] In some optional embodiments, the related functions also include a destroy instance function, a destroy message function and a module uninstall function. After the flow detection processing of the data packet is completed, that is, after the data caller processes the preset array DAQ_Msg_t, the destroy message function can be called to release and recycle the resources of the preset array.

[0121] After the module context structure created in the create instance function is used up, that is, when the created instance is no longer used, the destroy instance function can be called to release the preset shared memory and clear the context information.

[0122] After the abstract data packet collection library module is used, that is, when the abstract data packet collection library module is no longer used, the module uninstallation function can be called to clear the API base address.

[0123] Step 208: Perform flow detection on the data packet to obtain a detection result.

[0124] Among them, after obtaining the data packet collected by the abstract data packet collection library module, the data packet can be processed for traffic detection to obtain the detection result, that is, continue to execute Suricata's decoding, application protocol parsing, and threat detection process normally. The specific implementation process can refer to the existing technology and will not be repeated here.

[0125] The present application provides a flow detection method, which includes: obtaining an abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory, initializing and configuring the abstract data packet collection library module to be loaded based on a preset configuration file, obtaining the initialized abstract data packet collection library module, calling a preset message receiving function, batch collecting data packets from the initialized abstract data packet collection library module, performing flow detection processing on the data packets, and obtaining a detection result. This solution uses LibDAQ to forward VPP traffic to Suricata, does not introduce additional virtual interfaces, is very convenient for process management, has higher ease of use and flexibility, and the message does not pass through the protocol stack, and the performance loss is very low; in addition, since LibDAQ supports multi-queue packet capture, it can fully utilize the multi-core processing advantages of VPP, and the performance is very high; and LibDAQ has defined a complete set of data structures to ensure reliable transmission of messages, and supports batch message transmission, perfectly adapts to the vector message processing logic of VPP, and the development workload is very small.

[0126] Figure 8 A structural block diagram of a flow detection device provided in an embodiment of the present application.

[0127] like Figure 8 As shown, the flow detection device 800 includes:

[0128] The acquisition module 802 is used to acquire the abstract data packet collection library module to be loaded, and dynamically load the abstract data packet collection library module to be loaded into the current process memory.

[0129] The initialization module 804 is used to initialize the abstract data packet collection library module to be loaded based on a preset configuration file to obtain an initialized abstract data packet collection library module.

[0130] The receiving module 806 is used to call a preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module.

[0131] The processing module 808 is used to perform flow detection processing on the data packet to obtain a detection result.

[0132] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be described in detail here. Each module in the above flow detection device can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations of each of the above modules.

[0133] In one embodiment of the present application, a computer device is provided, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0134] Obtaining the abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory;

[0135] Initialize and configure the abstract data packet collection library module to be loaded based on the preset configuration file to obtain the initialized abstract data packet collection library module;

[0136] Call the preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module;

[0137] Perform traffic detection on the data packet to obtain the detection result.

[0138] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:

[0139] Read configuration files or command line parameters of network intrusion detection and prevention systems;

[0140] Based on the configuration file or command line parameters, obtain the module name corresponding to the abstract data packet collection library module to be loaded;

[0141] Based on the module name, the abstract data packet collection library module to be loaded corresponding to the module name is searched in the network intrusion detection and defense system library path.

[0142] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:

[0143] Based on the number of working threads in the preset configuration file, create a packet receiving thread corresponding to the number of working threads;

[0144] For each packet receiving thread, the preset message receiving function is called to collect data packets in batches from the initialized abstract data packet collection library module.

[0145] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:

[0146] Initialize the abstract data packet collection library module structure and add related functions; the related functions include module loading function, instance creation function and message receiving function;

[0147] Record the API base address in the module loading function, create a module context structure in the instance creation function, map the preset queue to the current memory space, and save the preset queue address pointer to the module context structure; wherein the preset queue address pointer includes a read pointer;

[0148] Read the data packet from the preset queue based on the read pointer through the receive message function, fill the data packet into the preset array, and update the read pointer;

[0149] After all data packets in the preset queue are read or the maximum number of received packets set in the preset configuration file is reached, the preset array is returned to obtain the data packets.

[0150] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:

[0151] After completing the flow detection process for the data packet, the destroy message function is called to release and recycle the resources of the preset array;

[0152] After the module context structure created in the create instance function is used, the destroy instance function is called to release the preset shared memory and clear the context information;

[0153] After the abstract packet collection library module is used, call the module uninstall function to clear the API base address.

[0154] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:

[0155] Create a data packet processing plug-in and add initialization code and worker thread node processing code corresponding to each worker thread to the plug-in;

[0156] Perform plug-in initialization processing based on the initialization code and obtain the pre-configured preset queue size and preset memory size;

[0157] According to the preset queue size and the preset memory size, a preset queue is created for each working thread based on the shared memory; wherein the preset queue is a first-in-first-out queue.

[0158] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:

[0159] For each worker thread, batches of data packets are received based on the worker thread node processing code;

[0160] Based on the write pointer in the preset queue address pointer, the data packet is written into the preset queue corresponding to the currently working working thread, and the write pointer is updated.

[0161] The computer device provided in the embodiment of the present application has similar implementation principles and technical effects to those of the above-mentioned method embodiment, and will not be described in detail here.

[0162] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0163] Obtaining the abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory;

[0164] Initialize and configure the abstract data packet collection library module to be loaded based on the preset configuration file to obtain the initialized abstract data packet collection library module;

[0165] Call the preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module;

[0166] Perform traffic detection on the data packet to obtain the detection result.

[0167] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:

[0168] Read configuration files or command line parameters of network intrusion detection and prevention systems;

[0169] Based on the configuration file or command line parameters, obtain the module name corresponding to the abstract data packet collection library module to be loaded;

[0170] Based on the module name, the abstract data packet collection library module to be loaded corresponding to the module name is searched in the network intrusion detection and defense system library path.

[0171] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:

[0172] Based on the number of working threads in the preset configuration file, create a packet receiving thread corresponding to the number of working threads;

[0173] For each packet receiving thread, the preset message receiving function is called to collect data packets in batches from the initialized abstract data packet collection library module.

[0174] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:

[0175] Initialize the abstract data packet collection library module structure and add related functions; the related functions include module loading function, instance creation function and message receiving function;

[0176] Record the API base address in the module loading function, create a module context structure in the instance creation function, map the preset queue to the current memory space, and save the preset queue address pointer to the module context structure; wherein the preset queue address pointer includes a read pointer;

[0177] Read the data packet from the preset queue based on the read pointer through the receive message function, fill the data packet into the preset array, and update the read pointer;

[0178] After all data packets in the preset queue are read or the maximum number of received packets set in the preset configuration file is reached, the preset array is returned to obtain the data packets.

[0179] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:

[0180] After completing the flow detection process for the data packet, the destroy message function is called to release and recycle the resources of the preset array;

[0181] After the module context structure created in the create instance function is used, the destroy instance function is called to release the preset shared memory and clear the context information;

[0182] After the abstract packet collection library module is used, call the module uninstall function to clear the API base address.

[0183] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:

[0184] Create a data packet processing plug-in and add initialization code and worker thread node processing code corresponding to each worker thread to the plug-in;

[0185] Perform plug-in initialization processing based on the initialization code and obtain the pre-configured preset queue size and preset memory size;

[0186] According to the preset queue size and the preset memory size, a preset queue is created for each working thread based on the shared memory; wherein the preset queue is a first-in-first-out queue.

[0187] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:

[0188] For each worker thread, batches of data packets are received based on the worker thread node processing code;

[0189] Based on the write pointer in the preset queue address pointer, the data packet is written into the preset queue corresponding to the currently working working thread, and the write pointer is updated.

[0190] The computer-readable storage medium provided in this embodiment has similar implementation principles and technical effects to those of the above method embodiments, and will not be described in detail here.

[0191] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0192] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0193] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A flow detection method, characterized in that: The method comprises: Obtaining an abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory; Initializing and configuring the abstract data packet collection library module to be loaded based on a preset configuration file to obtain an initialized abstract data packet collection library module; Calling a preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module; Perform flow detection processing on the data packet to obtain a detection result.

2. The method according to claim 1, characterized in that The step of obtaining the abstract data packet collection library module to be loaded includes: Read configuration files or command line parameters of network intrusion detection and prevention systems; Based on the configuration file or command line parameters, obtain the module name corresponding to the abstract data packet collection library module to be loaded; Based on the module name, the abstract data packet collection library module to be loaded corresponding to the module name is searched in the network intrusion detection and defense system library path.

3. The method according to claim 1 or 2, characterized in that: The calling of the preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module includes: Based on the number of working threads in the preset configuration file, create a packet receiving thread corresponding to the number of working threads; For each packet receiving thread, the preset message receiving function is called to collect data packets in batches from the initialized abstract data packet collection library module.

4. The method according to claim 3, characterized in that The calling of the preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module includes: Initialize the abstract data packet collection library module structure and add related functions; wherein the related functions include module loading function, instance creation function and message receiving function; Recording the API base address in the module loading function, creating a module context structure in the create instance function, mapping the preset queue to the current memory space, and saving the preset queue address pointer to the module context structure; wherein the preset queue address pointer includes a read pointer; Reading a data packet from the preset queue based on the read pointer through the receive message function, filling the data packet into a preset array, and updating the read pointer; After all the data packets in the preset queue are read or the maximum number of received packets set in the preset configuration file is reached, the preset array is returned to obtain the data packets.

5. The method according to claim 4, characterized in that The related functions also include a destroy instance function, a destroy message function and a module uninstall function, and the method also includes: After completing the flow detection process for the data packet, calling the destruction message function to release and recycle the resources of the preset array; After the module context structure created in the create instance function is used up, the destroy instance function is called to release the preset shared memory and clear the context information; After the use of the abstract data packet collection library module is completed, the module uninstallation function is called to clear the API base address.

6. The method according to claim 4 or 5, characterized in that: The method comprises: Create a data packet processing plug-in, and add initialization code and worker thread node processing code corresponding to each worker thread to the plug-in; Performing plug-in initialization processing based on the initialization code, and obtaining a pre-configured preset queue size and a preset memory size; According to the preset queue size and the preset memory size, the preset queue is created for each working thread based on the shared memory; wherein the preset queue is a first-in-first-out queue.

7. The method according to claim 6, characterized in that The method further comprises: For each of the working threads, receiving data packets in batches based on the working thread node processing code; Based on the write pointer in the preset queue address pointer, the data packet is written into the preset queue corresponding to the currently working working thread, and the write pointer is updated.

8. A flow detection device, characterized in that: The device comprises: An acquisition module, used for acquiring an abstract data packet collection library module to be loaded, and dynamically loading the abstract data packet collection library module to be loaded into the current process memory; An initialization module, used to initialize and configure the abstract data packet collection library module to be loaded based on a preset configuration file to obtain an initialized abstract data packet collection library module; A receiving module, used for calling a preset message receiving function to collect data packets in batches from the initialized abstract data packet collection library module; The processing module is used to perform flow detection processing on the data packet to obtain a detection result.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the flow detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the flow detection method as described in any one of claims 1-7.

Images