Network traffic load data decoding method and device, electronic equipment and storage medium

Abstract

The invention provides a network traffic load data decoding method and device, electronic equipment and a storage medium, and relates to the technical field of network traffic data processing. The method comprises the following steps: acquiring load data of network traffic; and determining first to-be-decoded data belonging to each coding type in the load data based on the coding characteristics of the plurality of coding types, and decoding the first to-be-decoded data according to the coding type to which the first to-be-decoded data belongs. According to the invention, format analysis does not need to be carried out on the load data, the coding type of the load data is directly determined based on the coding characteristics, and decoding processing is carried out according to the corresponding coding type, so that the problems of poor expansibility and high maintenance cost caused by format analysis can be solved, and the network security can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic data processing, and particularly to a method, apparatus, electronic device and storage medium for decoding network traffic load data. Background Art

[0002] In the transmission of HTTP data, in order to enhance data privacy, the load data is often encrypted or encoded. In the prior art, for the decoding process of data, it is necessary to first parse the data format, read the encoding type from the parsed data, and then decode the data.

[0003] However, this solution needs to support the parsing of all data formats. Every time a new data format is added, code for parsing the new data format needs to be added. Therefore, the scalability of this solution is very poor and the maintenance cost is relatively high. Summary of the Invention

[0004] Embodiments of the present invention provide a method, apparatus, electronic device and storage medium for decoding network traffic load data, so as to solve the technical problems of poor scalability and high maintenance cost in the prior art.

[0005] In a first aspect, an embodiment of the present invention provides a method for decoding network traffic load data, the method including: obtaining load data of network traffic; determining first data to be decoded belonging to each of the encoding types in the load data based on encoding features of multiple encoding types, and decoding the first data to be decoded according to the encoding type to which it belongs.

[0006] In some embodiments, the determining first data to be decoded belonging to each of the encoding types in the load data based on encoding features of multiple encoding types, and decoding the first data to be decoded according to the encoding type to which it belongs includes: for each of the encoding types, matching the encoding feature of the encoding type with the load data to determine first position information of the first data to be decoded belonging to the encoding type in the load data; and based on the first position information, decoding the first data to be decoded belonging to the encoding type according to the encoding type.

[0007] In some embodiments, the matching of the encoding features of the encoding type with the payload data to determine the first position information of the first data to be decoded belonging to the encoding type in the payload data includes: determining the number of matching characters corresponding to the encoding type; scanning the characters in the payload data, and sequentially matching the scanned characters with the encoding features according to the number of matching characters to determine the target characters that match the encoding features successfully; and determining the first position information based on the second position information of the target characters in the payload data.

[0008] As a possible implementation manner, the determining the first position information based on the second position information of the target characters in the payload data includes: performing pre-decoding processing on the target characters according to the encoding type based on the second position information; determining the readability of each group of data obtained after the pre-decoding processing; determining the third position information of the target characters corresponding to the data with readability less than the threshold in the payload data; and determining the second position information after removing the third position information as the first position information.

[0009] In some embodiments, the determining the first data to be decoded belonging to each encoding type in the payload data based on the encoding features of multiple encoding types includes: determining the number of matching characters corresponding to each encoding type; sequentially scanning the characters in the payload data in ascending order of the number of matching characters, and matching the scanned characters with the encoding features of the encoding type corresponding to the number of matching characters; if the scanned characters match the encoding features of the first encoding type successfully, record the encoding type to which the scanned characters belong, and continue the scanning and matching of the subsequent characters until all the characters in the payload data have been matched; and determining the characters belonging to each encoding type in the payload data as the first data to be decoded belonging to the corresponding encoding type.

[0010] In some embodiments, after decoding the first data to be decoded according to the encoding type to which it belongs, it further includes: determining the second data to be decoded belonging to each encoding type in the decoded data based on the encoding features of the multiple encoding types, and decoding the second data to be decoded according to the encoding type to which it belongs.

[0011] In a second aspect, an embodiment of the present invention provides a network traffic payload data decoding device, including: an acquisition module, configured to acquire the payload data of network traffic; a decoding module, configured to determine the first data to be decoded belonging to each encoding type in the payload data based on the encoding features of multiple encoding types, and decode the first data to be decoded according to the encoding type to which it belongs.

[0012] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor and a memory storing a computer program, where when the processor executes the program, the above-mentioned network traffic load data decoding method is implemented.

[0013] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned network traffic load data decoding method is implemented.

[0014] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program, and when the computer program is executed by a processor, the above-mentioned network traffic load data decoding method is implemented.

[0015] The network traffic load data decoding method, device, electronic device and storage medium provided by the embodiments of the present invention obtain the load data of network traffic; based on the coding features of multiple coding types, determine the first data to be decoded belonging to each coding type in the load data, and perform decoding processing on the first data to be decoded according to the coding type to which it belongs. The present invention does not need to perform format parsing on the load data, directly determines the coding type of the load data based on the coding features, and performs decoding processing according to the corresponding coding type, which can not only solve the problems of poor scalability and high maintenance cost caused by format parsing, but also improve network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention, and those of ordinary skill in the art can also obtain other drawings based on these drawings without creative efforts.

[0017] Figure 1 It is one of the flow diagrams of a network traffic load data decoding method provided by an embodiment of the present invention; Figure 2 It is another flow diagram of a network traffic load data decoding method provided by an embodiment of the present invention; Figure 3 It is yet another flow diagram of a network traffic load data decoding method provided by an embodiment of the present invention; Figure 4 It is still another flow diagram of a network traffic load data decoding method provided by an embodiment of the present invention; Figure 5 It is the structural diagram of a network traffic load data decoding device provided by an embodiment of the present invention; Figure 6Schematic structural diagram of the electronic device provided by the embodiment of the present invention. Detailed implementation manners

[0018] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings in the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without creative efforts shall fall within the protection scope of the present invention.

[0019] It should be noted that in the transmission of HTTP data, in order to enhance the privacy of data, the payload data is often encrypted or encoded. In the prior art, for the decoding process of data, it is necessary to first perform format parsing on the data, read the encoding type from the parsed data, and then perform decoding processing on the data. For example, in the process of HTTP data transmission, the payload data is Base64 encoded. There are respective HTTP headers and HTTP bodies in the HTTP data, and there are multiple formats for the HTTP body, such as XML format, URL format, etc. For the decoding of data in different formats, it is necessary to first find the characteristics of each format in the data. For example, for XML format data, first find <xml>, then find the content therein and read the encoding type, and finally decode the content based on the encoding type.

[0020] However, this solution needs to support the parsing and processing of all data formats. For each new data format added, code for parsing the new data format needs to be added. Therefore, the extensibility of this solution is very poor and the maintenance cost is relatively high. For advanced persistent threats, this technical solution can be easily bypassed by cyber attackers, resulting in the network security protection device being rendered useless. Cyber attackers only need to place the attack characteristics in a new data format to bypass this technical solution.

[0021] To solve the above problems, an embodiment of the present invention provides a method, device, electronic device, and storage medium for decoding network traffic load data.

[0022] Figure 1 It is one of the schematic flowcharts of a method for decoding network traffic load data provided by an embodiment of the present invention. As Figure 1 shown, the method may include the following steps.

[0023] Step 101, obtain the load data of network traffic.

[0024] Among them, the load data of network traffic refers to the actual data transmitted in network traffic, excluding protocol headers and control information. For example, it can be HTTP load data, that is, in HTTP requests and responses, the data part except for the HTTP header. The load data can be various types of data such as text, images, audio, and video.

[0025] In some embodiments, the data packet can be copied to the memory through the network card, and a flow is created according to the five-tuple of ipsrc (source IP address), ipdst (destination IP address), portsrc (source port number), portdst (destination port number), and protocal (protocol type). Packets with the same five-tuple are hung on the same flow; the protocol of each data packet is identified to obtain the protocol tree and top-level protocol of the data packet; the IP and TCP of the flow are reorganized, and then according to different protocols, the corresponding load data is obtained.

[0026] Step 102, based on the encoding characteristics of multiple encoding types, determine the first data to be decoded belonging to each encoding type in the load data, and decode the first data to be decoded according to the encoding type to which it belongs.

[0027] Among them, the encoding features of each encoding type refer to the features of the characters after being encoded by the encoding method of each encoding type, and these encoding features can be preset. For example, the encoding features of the Base64 encoding type can be that all characters belong to the valid range of characters corresponding to the base64 encoding, and the encoding features of the hexadecimal encoding type can be that the encoded characters conform to patterns such as 0xaa, \aa, etc.

[0028] In some embodiments, multiple encoding types may include encoding types such as Base64, URL, Unicode, hexadecimal, octal, binary, etc. The encoding features of each encoding type can be obtained by analyzing a large amount of encoding data in advance. For example, they can be obtained by means of a neural network model for feature extraction, or can be obtained by summarizing a large amount of encoding data, or can also be determined by other analysis methods.

[0029] In some embodiments, the characters included in the payload data can be compared with the encoding features of multiple encoding types to determine which encoding type each character in the payload data belongs to, and then the data can be decoded according to the corresponding encoding type.

[0030] As a possible implementation, since the minimum unit for encoding by each encoding type is different. For example, the base64 encoding type encodes 3 bytes into 4 ASCII characters, that is, its minimum unit is 4 characters. Therefore, when matching the encoding features with the characters in the payload data, the number of characters compared for different encoding types is different. For example, since the minimum unit of base64 encoded data is 4 characters, when comparing the payload data with the encoding features of the base64 encoding type, 4 consecutive characters in the payload data can be compared with the encoding features of the base64 encoding type. Therefore, the number of matching characters can be preset for each encoding type, that is, the number of characters for each match of the encoding features of each type when matching the payload data with the encoding features.

[0031] Specifically, based on the encoding features of multiple encoding types, the implementation process of determining the first data to be decoded belonging to each encoding type in the payload data may include: determining the number of matching characters corresponding to each encoding type; scanning the characters in the payload data in ascending order of the number of matching characters, and matching the scanned characters with the encoding features of the encoding type corresponding to the number of matching characters; if the scanned characters match the encoding features of the first encoding type successfully, record the encoding type to which the scanned characters belong, and continue the scanning and matching of subsequent characters until all characters in the payload data have been matched; determine the characters in the payload data belonging to each encoding type as the first data to be decoded belonging to the corresponding encoding type.

[0032] As an example, scanning can start from the first character in the payload data. After scanning a character, it is determined whether there is an encoding type with a matching character count of 1. If there is an encoding type with a matching character count of 1, the scanned character is matched with the corresponding encoding feature. If the match is successful, the encoding type matched by the character is recorded, and scanning continues from the second character. If the match fails, the second character is scanned, and it is further determined whether there is an encoding type with a matching character count of 2 for feature matching. If there is no encoding type with a matching character count of 1, the second character is scanned, and it is determined whether there is an encoding type with a matching character count of 2. If there is an encoding type with a matching character count of 2, the two scanned characters are matched with the corresponding encoding feature, the encoding feature to which the two characters belong is recorded, and scanning continues from the third character. If there is no encoding type with a matching character count of 2, the third character is scanned, and it is determined whether there is an encoding type with a matching character count of 3, and so on. Until all characters in the payload data are successfully matched, the characters corresponding to each encoding type are obtained, and the characters corresponding to each encoding type are determined as the first data to be decoded for the corresponding encoding type.

[0033] As another example, after each successful match between a scanned character and an encoding feature, the position information of the scanned character in the payload data can be recorded. Finally, after all characters are successfully matched, the position information of the first data to be decoded for each encoding type is obtained, and then the first data to be decoded is decoded based on the position information according to the corresponding encoding type.

[0034] According to the network traffic payload data decoding method provided by the embodiments of the present invention, the payload data of network traffic is obtained; based on the encoding features of multiple encoding types, the first data to be decoded belonging to each encoding type in the payload data is determined, and the first data to be decoded is decoded according to the encoding type to which it belongs. The present invention does not need to perform format parsing on the payload data, directly determines the encoding type of the payload data based on the encoding features, and performs decoding processing according to the corresponding encoding type, which can not only solve the problems of poor scalability and high maintenance cost caused by format parsing, but also improve security.

[0035] Figure 2 This is the second flowchart of the network traffic payload data decoding method provided by the embodiments of the present invention. As Figure 2 shown, based on the above embodiments, Figure 1 the implementation process of step 102 in

[0036] Step 201, for each encoding type, match the encoding feature of the encoding type with the payload data to determine the first position information of the first data to be decoded belonging to the encoding type in the payload data.

[0037] That is to say, the coding features of each coding type can be respectively matched with the payload data. The matching processes corresponding to multiple coding types can be executed in parallel or serially. If there are 5 coding types, the payload data can be copied into 5 copies, and 5 threads can be set respectively. Each thread is responsible for the matching process between the coding features of one coding type and the payload data, and finally the first data to be decoded belonging to each coding type is obtained.

[0038] In some embodiments, for each coding type, the characters in the payload data are scanned in sequence, and the scanned characters are matched with the coding features of this coding type. If the scanned characters match the coding features successfully, the position information of the scanned characters in the payload data is recorded, and the subsequent character matching process continues until all characters have been matched. All the recorded position information is determined as the first position information of the first data to be decoded belonging to this coding type in the payload data. That is to say, since the characters that match successfully all belong to the first data to be decoded of this coding type, the recorded position information of the characters is the position information of the first data to be decoded of this coding type.

[0039] It should be noted that the first data to be decoded belonging to this coding type can be all the data belonging to this coding type in the payload data, or the data matched each time during the feature matching process. That is to say, in the actual execution process, the feature matching process and the decoding process can be parallel or serial. It can be that after all data have been matched, the decoding process is carried out, or it can be that after each time the data to be decoded of this coding type is matched, the decoding process is carried out.

[0040] As a possible implementation, matching the coding features of the coding type with the payload data and determining the first position information of the first data to be decoded belonging to the coding type in the payload data may include the following steps.

[0041] Step S1, determine the number of matching characters corresponding to the coding type.

[0042] Step S2, scan the characters in the payload data, and sequentially match the scanned characters with the coding features according to the number of matching characters to determine the target characters that match the coding features successfully.

[0043] Among them, the target characters refer to the characters that match the coding features successfully, which can be all the characters in the payload data that match the coding features successfully, or the characters that match successfully each time. Here, it can be determined according to the actual execution logic requirements.

[0044] In some embodiments, if the number of matching characters corresponding to the encoding type is N, scanning can start from the first character in the payload data. After scanning every N characters, these N characters are matched with the encoding feature to obtain the matching result of these N characters and the encoding feature. Then, continue to scan the subsequent N characters for feature matching until all characters in the payload data are successfully matched with the encoding feature. All characters that successfully match the encoding feature are determined as target characters.

[0045] In some other embodiments, if the number of matching characters corresponding to the encoding type is N, scanning can start from the first character in the payload data. After scanning every N characters, these N characters are matched with the encoding feature. If these N characters successfully match the encoding feature, these N characters are determined as target characters. Then, continue to scan the subsequent N characters for feature matching. At the same time, step S3 can be executed in parallel to determine the position information, and after obtaining the position information, step 202 is executed to perform parallel decoding on the data.

[0046] Step S3: Determine the first position information based on the second position information of the target character in the payload data.

[0047] Among them, the second position information of the target character in the payload data can be the start position and end position of the target character in the payload data. If the target character includes multiple segments of characters, the second position information of the target character in the payload data can include the start position and end position of each segment of characters.

[0048] It can be understood that the characters that successfully match the encoding feature are the characters obtained after encoding according to this encoding type, and the characters that successfully match the encoding feature are the first data to be decoded belonging to this encoding type. Therefore, the second position information of the target character in the payload data can be determined as the first position information.

[0049] Step 202: Perform decoding processing on the first data to be decoded belonging to the encoding type according to the encoding type based on the first position information.

[0050] It should be noted that during the actual execution process, when a character that successfully matches is obtained each time, the position information of the character can be recorded first, and then the scanning and matching of subsequent characters can continue. After all characters in the payload data are matched, all the recorded position information is determined as the first position information, and then based on the first position information, the first data to be decoded is decoded according to the encoding type. It is also possible to determine the position information of the character that successfully matches in the payload data each time after obtaining a character that successfully matches, determine this position information as the first position information of the corresponding first data to be decoded, write the obtained first position information into the decoding queue, and a corresponding thread takes out the first position information from the decoding queue and performs decoding processing according to the corresponding encoding type.

[0051] According to the network traffic load data decoding method of the embodiments of the present invention, for each coding type, the coding characteristics of the coding type are matched with the load data to determine the first position information of the first data to be decoded belonging to the coding type in the load data; based on the first position information, the first data to be decoded belonging to the coding type is decoded according to the coding type. The present invention can directly perform decoding processing through the method of coding characteristic matching without parsing the data format, which can not only solve the problems of poor scalability and high maintenance cost caused by format parsing, but also solve the problem of network attack behavior that an attacker's attack data placed in a new data format cannot be detected, thus improving network security.

[0052] In order to further improve the accuracy of coding type recognition, the present invention proposes another embodiment.

[0053] Figure 3 It is the third flow chart of the network traffic load data decoding method provided by the embodiments of the present invention. As Figure 3 shown, based on the above embodiments, the implementation process of determining the first position information based on the second position information of the target character in the load data may include the following steps.

[0054] Step 301, based on the second position information, pre-decode the target character according to the coding type.

[0055] It should be noted that, after each character with successful feature matching is obtained, the successfully matched character can be pre-decoded to determine whether the successfully matched character belongs to the coding type, or after all characters in the load data are matched, all the matched characters can be pre-decoded, or pre-decoding can be performed at a preset interval.

[0056] Step 302, determine the readability of each group of data obtained after pre-decoding.

[0057] Among them, each group of data obtained after pre-decoding can be the data of each minimum unit after decoding, or the data that is an integer multiple of the minimum unit. For example, if the coding type is base64, every 4 characters are decoded to obtain 3 bytes, then every 3 bytes can be used as a group of data after pre-decoding, or every 3n characters can be used as a group of data after pre-decoding, where n is an integer greater than 1.

[0058] In some embodiments, the readability of each group of data can be the proportion of the number of readable characters in each group of data. For example, if a group of data contains 10 characters and 8 characters are readable, then the readability of this group of data is 80%.

[0059] As a possible implementation manner, the process of determining the readability of each group of data obtained after pre-decoding processing may include: presetting a readable character set, where the readable character set contains all readable characters; for each group of data obtained after pre-decoding processing, comparing each character in the group of data with the readable character set. If a certain character belongs to the readable character set, then the character is readable; if a certain character does not belong to the readable character set, then the character is unreadable; based on the comparison results of each character in the group of data, determine the readability of the group of data.

[0060] As another possible implementation manner, each group of data obtained after pre-decoding processing may be input into a preset readability prediction model to obtain the readability prediction result of each group of data output by the readability prediction model; wherein, the readability prediction model is trained based on decoded data samples and their corresponding readability label values, and the readability prediction model has learned the mapping relationship between the decoded data and the readability. The readability prediction model may be a neural network model or a machine learning model.

[0061] Step 303, determine the third position information of the target character corresponding to the data with readability less than the threshold in the payload data.

[0062] Step 304, determine the second position information after removing the third position information as the first position information.

[0063] It can be understood that if the readability of the data is poor, it can be considered that the data decoding process does not decode according to its encoding type, that is, the decoding type judgment of the target character is incorrect.

[0064] In some embodiments, a threshold may be preset in advance, and the readability of each group of data after pre-decoding processing is compared with the threshold. If the readability of a certain group of data is less than the threshold, it is determined that the target characters corresponding to the group of data do not belong to this encoding type. Therefore, the position information of these characters can be removed from the position information to improve the accuracy of encoding type recognition, and thus the accuracy of payload data decoding can be improved.

[0065] According to the network traffic payload data decoding method provided by the embodiments of the present invention, based on the second position information, pre-decode the target characters according to the encoding type; determine the readability of each group of data obtained after pre-decoding processing; determine the third position information of the target characters corresponding to the data with readability less than the threshold in the payload data; determine the second position information after removing the third position information as the first position information. The present invention can verify the encoding feature matching result through pre-decoding, improve the accuracy of encoding type recognition, and further improve the accuracy of decoding processing.

[0066] Figure 4 FIG. 4 is a schematic flow chart of the network traffic load data decoding method provided by an embodiment of the present invention. As Figure 4 shown, the method may include the following steps.

[0067] Step 401, obtain the load data of network traffic.

[0068] Step 402, based on the encoding features of multiple encoding types, determine the first data to be decoded belonging to each encoding type in the load data, and perform decoding processing on the first data to be decoded according to its belonging encoding type.

[0069] Step 403, based on the encoding features of multiple encoding types, determine the second data to be decoded belonging to each encoding type in the decoded data, and perform decoding processing on the second data to be decoded according to its belonging encoding type.

[0070] In an actual application scenario, a network attacker may encode the data multiple times. To identify such an attack behavior, the data to be decoded in the data obtained after decoding processing can be continuously decoded until there is no data to be decoded.

[0071] That is to say, after step 402 is executed, the data obtained after decoding processing can be used as new load data, and continue to determine the second data to be decoded belonging to each encoding type in the decoded data based on the encoding features of multiple encoding types, and perform decoding processing on the second data to be decoded according to its belonging encoding type until there is no data to be decoded in the data obtained after decoding processing.

[0072] It should be noted that the implementation process of step 402 is the same as the implementation process of determining the first data to be decoded belonging to each encoding type in the load data based on the encoding features of multiple encoding types and performing decoding processing on the first data to be decoded according to its belonging encoding type introduced in the above embodiment, and will not be elaborated here.

[0073] According to the network traffic load data decoding method of the embodiment of the present invention, it can support cyclic decoding or cyclic alternating decoding, and improves the ability to cope with advanced persistent threats.

[0074] For the sake of easy understanding, the technical effects of the network traffic load data decoding method of the embodiment of the present invention will be described by way of examples.

[0075] For example: For vulnerability A, in the HTTP URL parameter, the attack feature: cat / etc / passwd is Base64 encoded; for vulnerability B, in the HTTP Body, the XML data format is adopted, and in the data segment, the attack feature: cat / etc / passwd is Base64 encoded; for vulnerability C, in the HTTP Body, the MutiPart data format is adopted, and in the data segment, the attack feature: cat / etc / passwd is Base64 encoded. The core feature of the above three vulnerabilities is: cat / etc / passwd. For existing protection technologies, for vulnerability A, it must first support URL parameter decoding, then perform Base64 decoding on the data, and finally match the core feature; for vulnerability B, it must first support parsing XML data, then find the data segment therein, and perform base64 decoding, and then match the core feature; for vulnerability C, it must first support parsing MutiPart data, then find the data segment therein, and perform base64 decoding, and then match the core feature.

[0076] However, the network traffic load data decoding method of the embodiments of the present invention can automatically perform Base64 decoding on the above data, can support the protection against the above three vulnerabilities A, B, and C, and also supports any other data format. Even regardless of the location of the core feature in HTTP, the protection effect can be achieved without re-development.

[0077] Another example is that vulnerability D performs a single Base64 encoding on the core feature; vulnerability E performs a single HEX encoding on the core feature; vulnerability F first performs a single Base64 encoding on the core feature and then performs HEX encoding; vulnerability G first performs two Base64 encodings on the core feature. For existing protection technologies, only single decoding is supported, so they only have a protective effect on vulnerabilities D and E. However, the network traffic load data decoding method of the embodiments of the present application, due to supporting cyclic decoding or cyclic alternate decoding, can support the protection against the above four vulnerabilities D, E, F, and G. For other unknown vulnerabilities, regardless of the number of encodings and the types of mixed encodings, the protection of unknown network security can be achieved without re-development, truly achieving effective response to sustainable threats from a technical level.

[0078] Next, the network traffic load data decoding device provided by the embodiments of the present invention will be described. The network traffic load data decoding device described below can be correspondingly referred to the network traffic load data decoding method described above.

[0079] Figure 5 It is a schematic structural diagram of the network traffic load data decoding device provided by the embodiments of the present invention. As Figure 5 As shown, the device may include an acquisition module 510 and a decoding module 520. The acquisition module 510 is used to acquire the load data of network traffic; the decoding module 520 is used to determine the first data to be decoded belonging to each coding type in the load data based on the coding features of multiple coding types, and perform decoding processing on the first data to be decoded according to the coding type to which it belongs.

[0080] In some embodiments, the decoding module 520 is specifically configured to: for each coding type, match the coding feature of the coding type with the load data to determine the first position information of the first data to be decoded belonging to the coding type in the load data; based on the first position information, perform decoding processing on the first data to be decoded belonging to the coding type according to the coding type.

[0081] In some embodiments, the decoding module 520 is further configured to: determine the number of matching characters corresponding to the coding type; scan the characters in the load data, and sequentially match the scanned characters with the coding feature according to the number of matching characters to determine the target characters that match the coding feature; based on the second position information of the target characters in the load data, determine the first position information.

[0082] In some embodiments, the decoding module 520 is further configured to: based on the second position information, perform pre-decoding processing on the target characters according to the coding type; determine the readability of each group of data obtained after the pre-decoding processing; determine the third position information of the target characters corresponding to the data with readability less than the threshold in the load data; and determine the second position information after removing the third position information as the first position information.

[0083] In some embodiments, the decoding module 520 is further configured to: determine the number of matching characters corresponding to each coding type; sequentially scan the characters in the load data in ascending order of the number of matching characters, and match the scanned characters with the coding features of the coding types corresponding to the number of matching characters; if the scanned characters match the coding features of the first coding type successfully, record the coding type to which the scanned characters belong, and continue scanning and matching the subsequent characters until all the characters in the load data have been matched; and determine the characters in the load data belonging to each coding type as the first data to be decoded belonging to the corresponding coding type.

[0084] In some embodiments, the decoding module 520 is further configured to: After decoding the first data to be decoded according to its encoding type, based on the encoding features of the multiple encoding types, determine the second data to be decoded belonging to each of the encoding types in the decoded data, and decode the second data to be decoded according to its encoding type.

[0085] The network traffic load data decoding device provided by the embodiments of the present invention obtains the load data of network traffic; based on the encoding features of multiple encoding types, determines the first data to be decoded belonging to each encoding type in the load data, and decodes the first data to be decoded according to its encoding type. The present invention does not need to perform format parsing on the load data, directly determines the encoding type of the load data based on the encoding features, and performs decoding processing according to the corresponding encoding type, which can not only solve the problems of poor scalability and high maintenance cost caused by format parsing, but also improve security.

[0086] Figure 6 An example of the physical structure diagram of an electronic device is shown as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640. Among them, the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the computer program in the memory 630 to execute the steps of the network traffic load data decoding method provided by the above embodiments.

[0087] In addition, when the logical instructions in the above-mentioned memory 630 can be implemented in the form of software function units and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The foregoing storage medium includes: various media such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk, or an optical disc that can store program codes.

[0088] On the other hand, an embodiment of the present invention further provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the steps of the network traffic load data decoding method provided in each of the above embodiments.

[0089] On the other hand, an embodiment of the present invention further provides a processor-readable storage medium, which stores a computer program. The computer program is used to cause the processor to execute the network traffic load data decoding method provided in each of the above embodiments.

[0090] The processor-readable storage medium can be any available medium or data storage device accessible by the processor, including but not limited to magnetic memories (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical memories (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor memories (such as ROM, EPROM, EEPROM, non-volatile memories (NANDFLASH), solid state drives (SSD)).

[0091] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative labor.

[0092] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disks, optical disks, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.< / xml>

Claims

1. A method for decoding network traffic load data, characterized in that: include: Get network traffic load data; Based on the encoding features of multiple encoding types, first data to be decoded belonging to each encoding type in the payload data is determined, and the first data to be decoded is decoded according to the encoding type to which it belongs.

2. The method according to claim 1, characterized in that The step of determining first data to be decoded in the payload data belonging to each encoding type based on encoding features of the plurality of encoding types, and performing decoding processing on the first data to be decoded according to the encoding type to which the first data belongs, includes: For each of the encoding types, matching the encoding feature of the encoding type with the payload data, and determining first position information of the first to-be-decoded data belonging to the encoding type in the payload data; Based on the first position information, first to-be-decoded data belonging to the encoding type is decoded according to the encoding type.

3. The method according to claim 2, characterized in that The matching of the encoding feature of the encoding type with the payload data to determine first position information of first to-be-decoded data belonging to the encoding type in the payload data includes: Determine the number of matching characters corresponding to the encoding type; Scanning characters in the payload data, matching the scanned characters with the coding features in sequence according to the number of matching characters, and determining target characters that successfully match the coding features; The first position information is determined based on the second position information of the target character in the payload data.

4. The method according to claim 3, characterized in that: The determining the first position information based on the second position information of the target character in the payload data comprises: Based on the second position information, and according to the encoding type, pre-decoding the target character; Determine the readability of each set of data obtained after pre-decoding processing; Determine third position information of a target character corresponding to data whose readability is less than a threshold value in the payload data; The second location information after removing the third location information is determined as the first location information.

5. The method according to claim 1, characterized in that The determining, based on the encoding features of the plurality of encoding types, first data to be decoded in the payload data belonging to each encoding type comprises: Determine the number of matching characters corresponding to each encoding type; Scan the characters in the payload data in order from the smallest to the largest number of matching characters, and match the scanned characters with the encoding features of the encoding type corresponding to the number of matching characters; If the scanned character successfully matches the coding feature of the first coding type, the coding type to which the scanned character belongs is recorded, and the scanning and matching of subsequent characters are continued until all characters in the payload data have been matched; The characters in the payload data belonging to each encoding type are determined as first data to be decoded belonging to the corresponding encoding type.

6. The method according to any one of claims 1 to 5, characterized in that After the first to-be-decoded data is decoded according to the encoding type to which it belongs, the method further includes: Based on the encoding features of the multiple encoding types, second data to be decoded belonging to each encoding type in the decoded data is determined, and the second data to be decoded is decoded according to the encoding type to which it belongs.

7. A network traffic load data decoding device, characterized in that: include: An acquisition module is used to obtain load data of network traffic; A decoding module is used to determine the first data to be decoded belonging to each encoding type in the payload data based on encoding features of multiple encoding types, and decode the first data to be decoded according to the encoding type to which it belongs.

8. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the network traffic load data decoding method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network traffic load data decoding method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the network traffic load data decoding method according to any one of claims 1 to 6 is implemented.

Images