Protocol decoding method and device

Abstract

The invention discloses a protocol decoding method and device, relates to the technical field of computers, and mainly aims to quickly realize protocol decoding on a specified network system. According to the main technical scheme, the method comprises the following steps: presetting a protocol description file corresponding to at least one communication protocol, wherein the protocol description file is used for describing the corresponding communication protocol; determining a target communication protocol and a target programming language adopted by the target system in response to determining to perform protocol decoding on the traffic data of the target system; selecting a first protocol description file corresponding to the target communication protocol from preset protocol description files; based on the target programming language, converting the first protocol description file into a second protocol description file which can be identified by protocol decoding; and based on the second protocol description file, performing protocol decoding on the traffic data of the target system.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular, to a protocol decoding method and apparatus. Background Art

[0002] Protocol decoding technology is a commonly used protocol restoration technology, which can restore the content data in network traffic data for security control operations such as data auditing.

[0003] Currently, when it is necessary to perform protocol decoding on the traffic data generated by any specified network system, it is necessary to write corresponding protocol decoding logic for the specified network system to perform protocol decoding on the traffic data of the specified network system through the protocol decoding logic. However, a specified network system usually has its own communication protocol and programming language. In this way, before writing the protocol decoding logic, developers need to spend a lot of time familiarizing themselves with the protocol framework, protocol format, and programming language before they can write the protocol decoding logic applicable to protocol decoding of the specified network system, resulting in difficulty in quickly implementing protocol decoding of the specified network system. Summary of the Invention

[0004] In view of this, this application proposes a protocol decoding method and apparatus, with the main purpose of quickly implementing protocol decoding of a specified network system.

[0005] To achieve the above objective, this application mainly provides the following technical solutions:

[0006] In a first aspect, this application provides a protocol decoding method, which presets protocol description files corresponding to at least one communication protocol, and the protocol description files are used to describe the corresponding communication protocols. The protocol decoding method includes:

[0007] In response to determining to perform protocol decoding on the traffic data of a target system, determine the target communication protocol and target programming language adopted by the target system;

[0008] Select a first protocol description file corresponding to the target communication protocol from the preset protocol description files;

[0009] Based on the target programming language, convert the first protocol description file into a second protocol description file recognizable by protocol decoding;

[0010] Based on the second protocol description file, perform protocol decoding on the traffic data of the target system.

[0011] In some embodiments of the present application, the preset protocol description file describes the corresponding communication protocol in a specified programming language. Then, based on the target programming language, converting the first protocol description file into a second protocol description file recognizable by protocol decoding includes: obtaining the language conversion logic required to convert the specified programming language into the target programming language; based on the language conversion logic, converting the first protocol description file into a second protocol description file using the target programming language.

[0012] In some embodiments of the present application, the protocol decoding method further includes: determining the communication protocol that requires the preset protocol description file; for each determined communication protocol: obtaining the protocol data use cases corresponding to the communication protocol; analyzing the protocol data use cases based on the protocol format of the communication protocol to obtain the protocol parameters related to the communication protocol; setting the decoding data corresponding to each protocol parameter, where the decoding data is used to protocol decode the parameter value of the corresponding protocol parameter from the traffic data; associating the protocol parameter with the corresponding decoding data to form a corresponding parameter structure; describing the parameter structure in a specified programming language to form the protocol description file corresponding to the communication protocol.

[0013] In some embodiments of the present application, obtaining the protocol data use cases corresponding to the communication protocol includes: controlling the preset sample system to perform target communication with the preset interaction end using the communication protocol; collecting the traffic data related to the target communication generated by the preset sample system; performing binary format conversion on the collected traffic data to obtain the protocol data use cases corresponding to the communication protocol.

[0014] In some embodiments of the present application, after setting the decoding data corresponding to each protocol parameter, the protocol decoding method further includes: for each protocol parameter, detecting whether the correct parameter value corresponding to the protocol parameter can be protocol decoded from the preset test traffic data based on the corresponding decoding data. If it can, then perform the step of associating the protocol parameter with the corresponding decoding data to form a corresponding parameter structure. Otherwise, issue an alarm for prompting that the decoding data corresponding to the protocol parameter is abnormal.

[0015] In some embodiments of the present application, after describing the parameter structure in a specified programming language to form the protocol description file corresponding to the communication protocol, the protocol decoding method further includes: based on

[0016] the specified programming language, detecting whether there are syntax errors in the protocol description file; if not, determining that the protocol description file corresponding to the communication protocol is available; if there are, issuing a prompt that there are syntax errors in the protocol description file, and / or, locating the position where the syntax error is located in the protocol description file for modification and use.

[0017] In some embodiments of the present application, protocol decoding of the traffic data of the target system based on the second protocol description file includes: selecting a target parameter structure from the parameter structure of the second protocol description file; importing the target parameter structure into a hard decoding logic matching the target system to form a decoding logic for protocol decoding of the traffic data of the target system; and performing protocol decoding on the traffic data of the target system based on the decoding logic.

[0018] In some embodiments of the present application, protocol decoding of the traffic data of the target system based on the second protocol description file includes: selecting a target parameter structure from the parameter structure of the second protocol description file; compiling the target parameter structure using a runtime module matching the target system to form a decoding logic for protocol decoding of the traffic data of the target system; and performing protocol decoding on the traffic data of the target system based on the decoding logic.

[0019] In some embodiments of the present application, selecting a target parameter structure from the parameter structure of the second protocol description file includes: determining target protocol parameters corresponding to the target communication protocol, where parameter values corresponding to the target protocol parameters are data for which traffic control is required; and selecting a parameter structure related to the target protocol parameters from the parameter structure of the second protocol description file as the target parameter structure.

[0020] Alternatively, display all parameter structures of the second protocol description file for selection; if there is a selected parameter structure, select the selected parameter structure as the target parameter structure.

[0021] Alternatively, select all parameter structures of the second protocol description file as target parameter structures.

[0022] In some embodiments of the present application, the specified programming language is the yaml programming language.

[0023] In some embodiments of the present application, the protocol decoding method further includes: determining whether the user needs to perform protocol decoding on the traffic data of the target system according to a preset protocol description file; if so, performing the step of selecting a first protocol description file corresponding to the target communication protocol from the preset protocol description file; if not, prompting the target communication protocol and target programming language adopted by the target system for the user to write a decoding logic for protocol decoding of the traffic data of the target system based on the target communication protocol and the target programming language.

[0024] In a second aspect, the present application provides a protocol decoding device that pre-sets protocol description files corresponding to at least one communication protocol, and the protocol description files are used to describe the corresponding communication protocols. The protocol decoding device includes:

[0025] A determination module, configured to determine a target communication protocol and a target programming language adopted by the target system in response to determining to perform protocol decoding on traffic data of the target system;

[0026] A selection module, configured to select a first protocol description file corresponding to the target communication protocol from the pre-set protocol description files;

[0027] A conversion module, configured to convert the first protocol description file into a second protocol description file recognizable by protocol decoding based on the target programming language;

[0028] A decoding module, configured to perform protocol decoding on the traffic data of the target system based on the second protocol description file.

[0029] In a third aspect, the present application provides a computer-readable storage medium, where the storage medium includes a stored program, and when the program runs, it controls the device where the storage medium is located to execute the protocol decoding method in the first aspect.

[0030] In a fourth aspect, the present application provides an electronic device, which includes: a memory for storing a program; a processor coupled to the memory for running the program to execute the protocol decoding method in the first aspect.

[0031] The protocol decoding method and device provided by the present application pre-set protocol description files corresponding to one or more communication protocols in advance. When it is determined to perform protocol decoding on the traffic data of the target system, a first protocol description file corresponding to the target communication protocol adopted by the target system is selected from the pre-set protocol description files, and based on the target programming language adopted by the target system, the first protocol description file is converted into a second protocol description file recognizable by protocol decoding. Then, based on the second protocol description file, protocol decoding of the traffic data of the target system can be realized. It can be seen that in the case of determining to perform protocol decoding on the traffic data of the target system, the solution provided by the present application does not require developers to be familiar with the programming language and communication protocol used by the target system. Instead, a protocol description file corresponding to the communication protocol adopted by the target system is directly selected from the pre-set protocol description files, and based on the programming language adopted by the target system, the selected protocol description file is converted into a protocol description file recognizable by protocol decoding, and then the converted protocol description file can be used to realize protocol decoding of the traffic data of the target system. In this way, protocol decoding of a specified network system can be quickly realized.

[0032] The above description is only an overview of the technical solution of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present application more obvious and understandable, the following specifically illustrates the specific embodiments of the present application. Brief Description of the Drawings

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0034] Figure 1 The flowchart of a protocol decoding method provided by an embodiment of the present application is shown;

[0035] Figure 2 The structural schematic diagram of a protocol decoding device provided by an embodiment of the present application is shown;

[0036] Figure 3 The structural schematic diagram of a protocol decoding device provided by another embodiment of the present application is shown. Detailed Embodiments

[0037] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be completely conveyed to those skilled in the art.

[0038] Currently, when it is necessary to perform protocol decoding on the traffic data generated by any specified network system, before developers write the corresponding protocol decoding logic for the specified network system, they need to invest a lot of time to familiarize themselves with the programming language and communication protocol adopted by the specified network system before they can write the protocol decoding logic suitable for performing protocol decoding on the specified network system. In this way, it is difficult to develop the protocol decoding logic in a short time, resulting in difficulty in quickly implementing protocol decoding on the specified network system.

[0039] The inventor has discovered through research that the current difficulty in quickly decoding the protocol of a specified network system is that developers need to spend time familiarizing themselves with the programming language and communication protocol used by the specified network system. The inventor considered that if protocol description files corresponding to each communication protocol were preset in advance. In this way, when it is determined to decode the protocol of the traffic data of a target system, regardless of the communication protocol and programming language used by the target system, there is no need for business personnel to be familiar with them. Instead, directly select the protocol description file corresponding to the communication protocol used by the target system from the preset protocol description files, and based on the programming language used by the target system, convert the selected protocol description file into a protocol description file that can be recognized by protocol decoding, and then the converted protocol description file can be used to decode the traffic data of the target system. In this way, since the process of business personnel being familiar with the communication protocol and programming language used by the target system is omitted, the protocol decoding of the specified network system can be quickly achieved.

[0040] Based on the above considerations, the embodiments of the present application specifically provide a technical solution for protocol decoding, specifically: preset protocol description files corresponding to at least one communication protocol, and the protocol description files are used to describe the corresponding communication protocols. In response to determining to decode the protocol of the traffic data of a target system, determine the target communication protocol and target programming language used by the target system. Select a first protocol description file corresponding to the target communication protocol from the preset protocol description files. Based on the target programming language, convert the first protocol description file into a second protocol description file that can be recognized by protocol decoding. Based on the second protocol description file, decode the traffic data of the target system.

[0041] The technical solution for protocol decoding provided in this embodiment can be applied to decoding the protocol of the traffic data of any network system, and the type of the network system is not specifically limited in this embodiment. Exemplarily, the network system is a firewall, a network data auditing device, etc.

[0042] Based on the above technical solution for protocol decoding, the embodiments of the present application specifically provide a protocol decoding method and device. The following specifically describes the protocol decoding method and device provided in this embodiment.

[0043] As Figure 1 shown, the embodiments of the present application provide a protocol decoding method, and this protocol decoding method mainly includes the following steps 101 to 104:

[0044] 101. In response to determining to decode the protocol of the traffic data of a target system, determine the target communication protocol and target programming language used by the target system.

[0045] The target system in this embodiment is a network system that needs to perform protocol decoding on its traffic data to control its network behavior based on the protocol decoding results. When a protocol decoding instruction for the target system is received or the protocol decoding period corresponding to the target system is reached, it is determined to perform protocol decoding on the traffic data of the target system.

[0046] The target system has a target communication protocol and a target programming language it uses. The traffic data of the target system is related to the target communication protocol and the target programming language used by the target system. Therefore, when it is determined to perform protocol decoding on the traffic data of the target system, in order to be able to perform protocol decoding on the traffic data of the target system, it is necessary to determine the target communication protocol and the target programming language used by the target system.

[0047] 102. Select the first protocol description file corresponding to the target communication protocol from the preset protocol description files.

[0048] In this embodiment, at least one protocol description file corresponding to a communication protocol is preset in advance. The protocol description file is used to describe the corresponding communication protocol. The purpose of presetting at least one protocol description file corresponding to a communication protocol in this embodiment is that when it is necessary to perform protocol decoding on the traffic data of any target system, developers do not need to be familiar with the communication protocol and programming language used by the target system. Instead, they can directly select the first protocol description file corresponding to the communication protocol used by the target system from the preset protocol description files, so as to quickly implement protocol decoding on the traffic data of the target system according to the communication protocol described in the first protocol description file.

[0049] In this embodiment, the specific process of presetting at least one protocol description file corresponding to a communication protocol may include: determining the communication protocols for which protocol description files need to be preset, and for each determined communication protocol, performing the following steps 102A to 102E:

[0050] 102A. Obtain the protocol data use cases corresponding to the communication protocol.

[0051] In practical applications, the communication protocols for which protocol description files need to be preset can be flexibly determined according to business requirements. Here, the communication protocol can be a general standard communication protocol such as the HTTP protocol, or some private communication protocols set by enterprises or institutions.

[0052] After determining the communication protocols for which protocol description files need to be preset, for any communication protocol, it is necessary to obtain the protocol data use cases corresponding to the communication protocol in order to obtain the protocol parameters related to the communication protocol based on the protocol data use cases. Here, the protocol parameters are used to indicate the interaction format and interaction content of the two parties interacting based on this communication protocol.

[0053] The specific process of obtaining the protocol data use cases corresponding to the communication protocol may include the following steps: controlling a preset sample system to perform target communication with a preset interaction end using the communication protocol; collecting traffic data related to the target communication generated by the preset sample system; and performing binary format conversion on the collected traffic data to obtain the protocol data use cases corresponding to the communication protocol.

[0054] In order to obtain the protocol data use cases more accurately, the preset sample system is controlled to perform target communication with the preset interaction end using the communication protocol, so as to obtain the real traffic data corresponding to the communication protocol. In addition, it should be noted that the programming language of the communication protocol can use a specified programming language, so that the protocol parameters obtained after analyzing the protocol data use cases are also the protocol parameters described in the specified programming language, which is convenient for subsequent writing of the corresponding protocol description file. The specific type of the preset interaction end can be selected based on business requirements, and this embodiment does not make a limitation. An exemplary sample system is a firewall, and the preset interaction end is a specified client.

[0055] After controlling the preset sample system to perform target communication with the preset interaction end using the communication protocol, monitor the traffic data generated during the target communication, and after monitoring the traffic data, collect the traffic data related to the target communication generated by the preset sample system. The collected traffic data includes the protocol parameters related to the communication protocol.

[0056] After collecting the traffic data, in order to facilitate subsequent writing of the relevant protocol description file and subsequent use of the protocol description file for corresponding protocol decoding, the traffic data is converted into binary to obtain the traffic data in binary format. Finally, the traffic data in binary format is used as the protocol data use cases corresponding to the communication protocol.

[0057] 102B. Analyze the protocol data use cases based on the protocol format of the communication protocol to obtain the protocol parameters related to the communication protocol.

[0058] The protocol data use cases must include the protocol parameters related to the communication protocol. Therefore, analyze the protocol data use cases based on the protocol format of the communication protocol. The process of analyzing the protocol data use cases based on the protocol format of the communication protocol is as follows: based on the protocol format of the communication protocol, determine the position of the protocol parameters related to the communication protocol in the protocol data use cases, for example, in the request header, request body, or request line. Extract the data field at the determined position, and the data field is used to describe the corresponding protocol parameter. Obtain the protocol parameters related to the communication protocol based on the data field. For example, if the data field is name, the corresponding protocol parameter is name.

[0059] 102C. Set the decoding data corresponding to each protocol parameter, and the decoding data is used to protocol-decode the parameter value of the corresponding protocol parameter from the traffic data.

[0060] The decoded data is used to decode the parameter values of the corresponding protocol parameters from the traffic data corresponding to the communication protocol for security control operations such as data auditing. Here, the parameter values are the interaction formats and interaction contents of the two parties in the interaction based on the communication protocol. The decoded data includes protocol parameters, the description fields corresponding to the protocol parameters, and the protocol decoding methods corresponding to each description field. The protocol decoding method is used to decode the object described by the corresponding description field, and the object described by the description field indicates the parameter value of the corresponding protocol parameter.

[0061] Exemplarily, the decoded data corresponding to Protocol Parameter 1 is shown in Table - 1.

[0062] Table - 1

[0063]

[0064]

[0065] In this embodiment, further, in order to ensure the availability of the decoded data, after setting the decoding parameters corresponding to each protocol parameter, the protocol decoding method may further include the following steps: for each protocol parameter, detect whether the correct parameter value corresponding to the protocol parameter can be decoded from the preset test traffic data based on the corresponding decoded data. If so, execute the step of associating the protocol parameter with the corresponding decoded data to form a corresponding parameter structure. Otherwise, issue an alarm for prompting an abnormality in the decoded data corresponding to the protocol parameter.

[0066] The preset test traffic data is the traffic data of the corresponding communication protocol. The specific process of detecting whether the correct parameter value corresponding to the protocol parameter can be decoded from the preset test traffic data based on the corresponding decoded data may include the following steps: form a corresponding target decoding logic based on the corresponding decoded data, and the target decoding logic is only used to decode the parameter value of the protocol parameter corresponding to the corresponding decoded data. Use the target decoding logic to decode the preset test traffic data. If the parameter value of the corresponding protocol parameter is not obtained after decoding, or the parameter value of the corresponding protocol parameter is obtained and the parameter value is not the correct parameter value, it is determined that the corresponding decoded data is abnormal. At this time, a prompt can be issued for the business personnel to perform the corresponding decoded data correction process. If the parameter value of the corresponding protocol parameter is obtained and the parameter value is the correct parameter value after decoding, it is determined that the corresponding decoded data is the correct decoded data, and the subsequent step 102D can be continued.

[0067] 102D. Associate the protocol parameter with the corresponding decoded data to form a corresponding parameter structure.

[0068] After determining the decoded data corresponding to each protocol parameter, associate the protocol parameter with the corresponding decoded data to form a corresponding parameter structure. The parameter structure is used to indicate the protocol parameters involved in both parties of the interaction based on the communication protocol, and the protocol decoding method for indicating the parameter values for protocol decoding of the corresponding protocol parameters from the traffic data.

[0069] 102E. Describe the parameter structure using a specified programming language to form a protocol description file corresponding to the communication protocol.

[0070] The specific process of forming a protocol description file corresponding to the communication protocol based on the specified programming language to describe the parameter structure is as follows: Based on the syntax file corresponding to the specified programming language, describe the parameter structure, and a protocol description file corresponding to the communication protocol can be formed. Moreover, the protocol description file describes the parameter structure of the corresponding communication protocol based on the specified programming language.

[0071] The specific type of the specified programming language is not limited in this embodiment and can be determined based on business requirements. Exemplarily, the specified programming language is the yaml programming language. Since yaml is a data serialization language with simple expression and easy conversion to an extraction language, the preset programming language can be selected as the yaml programming language.

[0072] In this embodiment, further, to ensure the usability and accuracy of the protocol description file, after forming the protocol description file corresponding to the communication protocol, it is not directly set as the preset protocol description file, but first its syntax is checked. Specifically, the protocol decoding method may further include the following steps: Based on the specified programming language, detect whether there are syntax errors in the protocol description file; if not, determine that the protocol description file corresponding to the communication protocol is available; if so, issue a prompt indicating that there are syntax errors in the protocol description file, and / or locate the position of the syntax error in the protocol description file for modification.

[0073] The protocol description file is implemented based on the specified programming language. Therefore, in order to detect the syntax of the protocol description file specifically, based on the syntax of the specified programming language, detect whether there are syntax errors in the protocol description file.

[0074] If it is detected that there are errors in the protocol description file, it means that if subsequent protocol decoding is performed based on the existing protocol description file, it may cause protocol decoding failure or protocol decoding errors. Therefore, to ensure the smooth progress of protocol decoding, the following two operations need to be performed: First, issue a prompt indicating that there are syntax errors in the protocol description file so that business personnel can eliminate the corresponding syntax errors in the protocol description file based on this prompt. Second, locate the position of the syntax error in the protocol description file for modification. Such a clear positioning of the syntax error location can facilitate business personnel to quickly eliminate syntax errors. The above two operations can be used in combination or separately. It should be noted that after business personnel perform syntax error elimination processing, it is necessary to detect again whether there are syntax errors in the protocol description file. If there are still errors, continue with the corresponding syntax error elimination until there are no errors in the protocol description file. If there are no errors, it is determined that the protocol description file corresponding to the communication protocol is available, and this protocol description file can be preset for protocol decoding use.

[0075] If it is detected that there are no errors in the protocol description file, it means that if subsequent protocol decoding is performed based on the existing protocol description file, the probability of protocol decoding failure or protocol decoding errors is not high. Therefore, it is determined that the protocol description file corresponding to the communication protocol is available, and this protocol description file can be preset for protocol decoding use.

[0076] After presetting the protocol description file, if it is determined to perform protocol decoding on the traffic data of the target system, the communication protocol currently adopted by the target system is determined as the target communication protocol adopted by the target system, and the protocol description file corresponding to the target communication protocol in the preset protocol description file is determined as the first protocol description file, so as to perform protocol decoding on the traffic data of the target system based on the first protocol description file.

[0077] 103. Convert the first protocol description file into a second protocol description file that can be recognized by protocol decoding based on the target programming language.

[0078] The target system has its own target programming language. To be able to perform protocol decoding on the target system based on the first protocol description file, it is necessary to convert the first protocol description file into a second protocol description file that can be recognized by protocol decoding based on the target programming language. The second protocol description file uses the target programming language.

[0079] In this embodiment, to simplify the conversion process, the preset protocol description file describes the corresponding communication protocol using a specified programming language, and the specified programming language can be the yaml programming language. Therefore, the method of converting the first protocol description file into a second protocol description file that can be recognized by protocol decoding based on the target programming language can include the following two:

[0080] One way is to obtain the language conversion logic required to convert a specified programming language into a target programming language; based on the language conversion logic, convert the first protocol description file into a second protocol description file in the target programming language.

[0081] To facilitate the rapid implementation of the language conversion of the first protocol description file, multiple language conversion logics can be preset in advance. The language conversion logic is used to convert a protocol description file in one programming language into a protocol description file in another programming language.

[0082] The language conversion logic obtained in this embodiment is the conversion logic for converting the first protocol description file described in a specified programming language into a second protocol description file described in the target programming language. After obtaining the language conversion logic, run the language conversion logic to convert the first protocol description file into a second protocol description file in the target programming language through the language conversion logic.

[0083] Another way is to input the first protocol description file into a language conversion model, so that the language conversion model converts the protocol description file described in a specified programming language into a second protocol description file described in the target programming language.

[0084] Exemplarily, the first protocol description file uses the yaml language, and the programming language used by the target system is the rust language. Convert the first protocol description file described in the yaml language into a second protocol description file described in the rust language.

[0085] 104. Based on the second protocol description file, perform protocol decoding on the traffic data of the target system.

[0086] The second protocol description file matches the target communication protocol and target programming language used by the target system. Therefore, based on the second protocol description file, perform protocol decoding on the traffic data of the target system.

[0087] The methods for performing protocol decoding on the traffic data of the target system based on the second protocol description file can include the following two:

[0088] The first one, the specific process of performing protocol decoding on the traffic data of the target system based on the second protocol description file can include the following steps: select a target parameter structure from the parameter structure of the second protocol description file; import the target parameter structure into the hard decoding logic matching the target system to form a decoding logic for performing protocol decoding on the traffic data of the target system; based on the decoding logic, perform protocol decoding on the traffic data of the target system.

[0089] The parameter structure is used to indicate the protocol parameters involved in the interaction format and interaction content of both parties of the interaction based on the corresponding communication protocol, and the protocol decoding method used to indicate the parameter values for protocol decoding of the corresponding protocol parameters from the traffic data. The target parameter structure can be flexibly selected from the parameter structure of the second protocol description file based on specific service requirements.

[0090] The hard decoding logic matching the target system is selected from the preset hard decoding logics based on the communication protocol and programming language adopted by the target system. The hard decoding logic is a general logic for protocol decoding of the target system, and currently it does not have the ability to perform protocol decoding on the traffic data of the target system. By importing the target parameter structure into the hard decoding logic, a decoding logic with the ability to perform protocol decoding on the traffic data of the target system can be formed. The formed decoding logic has the ability to decode the traffic data of the target system and can be used for protocol decoding of the target system, and it can extract the corresponding parameter values from the traffic data for use in security control operations such as data auditing.

[0091] The specific process of importing the target parameter structure into the hard decoding logic matching the target system to form a decoding logic for protocol decoding of the traffic data of the target system can be as follows: determine the embedding position of the target parameter structure in the hard decoding logic, and embed the target parameter structure into the corresponding position; after all the target parameter structures are embedded, compile the hard decoding logic to form a decoding logic for protocol decoding of the traffic data of the target system.

[0092] After forming a decoding logic for protocol decoding of the traffic data of the target system, the traffic data of the target system can be protocol decoded, and after the protocol decoding, the parameter values of the protocol parameters corresponding to the target parameter structure can be obtained for use in security control operations such as data auditing.

[0093] Second, based on the second protocol description file, the specific process of protocol decoding the traffic data of the target system can include the following steps: select the target parameter structure from the parameter structure of the second protocol description file; compile the target parameter structure using a runtime module matching the target system to form a decoding logic for protocol decoding of the traffic data of the target system; based on the decoding logic, protocol decode the traffic data of the target system.

[0094] The parameter structure is used to indicate the protocol parameters involved in the interaction format and interaction content of both parties of the interaction based on the corresponding communication protocol, and the protocol decoding method used to indicate the parameter values for protocol decoding of the corresponding protocol parameters from the traffic data. The target parameter structure can be flexibly selected from the parameter structure of the second protocol description file based on specific service requirements.

[0095] The runtime module matching the target system is selected from the preset runtime modules based on the communication protocol and programming language adopted by the target system. The runtime module is a module used to compile the target parameter structure to form the corresponding decoding logic. The target parameter structure is compiled using the runtime module matching the target system to form the decoding logic for protocol decoding of the traffic data of the target system. After forming the decoding logic for protocol decoding of the traffic data of the target system, the traffic data of the target system can be protocol decoded, and after protocol decoding, the parameter values of the protocol parameters corresponding to the target parameter structure can be obtained for use in security control operations such as data auditing.

[0096] Both of the above two methods involve the step of selecting the target parameter structure from the parameter structure of the second protocol description file. The specific implementation methods of this step can include the following three:

[0097] First, determine the target protocol parameters corresponding to the target communication protocol, where the parameter values corresponding to the target protocol parameters are the data that needs to be traffic controlled; select the parameter structure related to the target protocol parameters in the parameter structure of the second protocol description file as the target parameter structure.

[0098] Each communication protocol has corresponding target protocol parameters, and the parameter values corresponding to the target protocol parameters are the data that needs to be traffic controlled. In order to reduce the workload of protocol decoding, the parameter structure related to the target protocol parameters in the parameter structure of the second protocol description file is selected as the target parameter structure. In this way, when performing protocol decoding subsequently, only the parameter values of the target protocol parameters can be protocol decoded for use in traffic control.

[0099] Second, display all the parameter structures of the second protocol description file for selection; if there is a selected parameter structure, select the selected parameter structure as the target parameter structure.

[0100] Displaying all the parameter structures of the second protocol description file gives the user the option to choose the target parameter structure, and the user can flexibly select the target parameter structure based on their own needs.

[0101] Third, select all the parameter structures of the second protocol description file as the target parameter structures.

[0102] Selecting all the parameter structures of the second protocol description file as the target parameter structures enables the parameter values of all protocol parameters in the traffic data of the target system to be obtained during subsequent protocol decoding. In this way, based on these parameter values, the traffic data of the target system can be comprehensively controlled, which is more conducive to the network security protection of the target system.

[0103] The protocol decoding method provided by the embodiments of the present application presets one or more protocol description files corresponding to communication protocols in advance. When it is determined that protocol decoding is to be performed on the traffic data of the target system, a first protocol description file corresponding to the target communication protocol adopted by the target system is selected from the preset protocol description files, and based on the target programming language adopted by the target system, the first protocol description file is converted into a second protocol description file recognizable by protocol decoding. Then, based on the second protocol description file, protocol decoding of the traffic data of the target system can be achieved. It can be seen that in the case where it is determined that protocol decoding is to be performed on the traffic data of the target system, the solution provided by the embodiments of the present application does not require developers to be familiar with the programming language and communication protocol used by the target system. Instead, a protocol description file corresponding to the communication protocol adopted by the target system is directly selected from the preset protocol description files, and based on the programming language adopted by the target system, the selected protocol description file is converted into a protocol description file recognizable by protocol decoding, and then the converted protocol description file can be used to achieve protocol decoding of the traffic data of the target system. In this way, protocol decoding of a specified network system can be quickly achieved.

[0104] In some embodiments of the present application, in order to enable users to flexibly decode the traffic data of the target system in the way they need, the protocol decoding method provided in this embodiment may further include the following steps:

[0105] Judge whether the user needs to decode the traffic data of the target system according to the preset protocol description file; if so, execute the step of selecting the first protocol description file corresponding to the target communication protocol from the preset protocol description files; if not, prompt the target communication protocol and target programming language adopted by the target system for the user to write the decoding logic for decoding the traffic data of the target system based on the target communication protocol and target programming language.

[0106] When the user needs to decode the traffic data of the target system according to the preset protocol description file, a corresponding instruction will be issued. If the instruction exists, it is determined that the user needs to decode the traffic data of the target system according to the preset protocol description file; if the instruction does not exist, it is determined that the user does not need to decode the traffic data of the target system according to the preset protocol description file.

[0107] When it is determined that the user needs to decode the traffic data of the target system according to the preset protocol description file, execute step 102 above to select the first protocol description file corresponding to the target communication protocol from the preset protocol description files, so as to quickly achieve protocol decoding of the target system based on the first protocol description file.

[0108] When it is determined that the user does not need to perform protocol decoding on the traffic data of the target system according to the preset protocol description file, it indicates that the user needs to perform protocol decoding on the traffic data of the target system in a hard-coded manner. Therefore, the target communication protocol and target programming language adopted by the target system are prompted for the user to perform corresponding protocol analysis and language understanding based on the prompted target communication protocol and target programming language, and write the decoding logic for performing protocol decoding on the traffic data of the target system based on the results of the protocol analysis and language understanding.

[0109] In this embodiment, by determining whether the user needs to perform protocol decoding on the traffic data of the target system according to the preset protocol description file, the protocol decoding operation on the target system can be flexibly selected according to the user's needs.

[0110] Furthermore, an embodiment of the present application also provides a protocol decoding device, which presets protocol description files corresponding to at least one communication protocol, and the protocol description files are used to describe the corresponding communication protocols, such as Figure 2 shown, the protocol decoding device includes:

[0111] A determination module 21, configured to determine the target communication protocol and target programming language adopted by the target system in response to determining to perform protocol decoding on the traffic data of the target system;

[0112] A selection module 22, configured to select a first protocol description file corresponding to the target communication protocol from the preset protocol description files;

[0113] A conversion module 23, configured to convert the first protocol description file into a second protocol description file recognizable by protocol decoding based on the target programming language;

[0114] A decoding module 24, configured to perform protocol decoding on the traffic data of the target system based on the second protocol description file.

[0115] The protocol decoding device provided by the embodiment of the present application presets protocol description files corresponding to one or more communication protocols in advance. When it is determined that protocol decoding is to be performed on the traffic data of the target system, a first protocol description file corresponding to the target communication protocol adopted by the target system is selected from the preset protocol description files, and based on the target programming language adopted by the target system, the first protocol description file is converted into a second protocol description file that can be recognized by the protocol decoding. Then, based on the second protocol description file, protocol decoding of the traffic data of the target system can be realized. It can be seen that in the solution provided by the embodiment of the present application, when it is determined that protocol decoding is to be performed on the traffic data of the target system, it is not necessary for developers to be familiar with the programming language and communication protocol used by the target system. Instead, a protocol description file corresponding to the communication protocol adopted by the target system is directly selected from the preset protocol description files, and based on the programming language adopted by the target system, the selected protocol description file is converted into a protocol description file that can be recognized by the protocol decoding, and then the converted protocol description file can be used to realize protocol decoding of the traffic data of the target system. In this way, protocol decoding of a specified network system can be quickly realized.

[0116] In some embodiments of the present application, as Figure 3 shown, if the preset protocol description file describes the corresponding communication protocol in a specified programming language, then the conversion module 23 is specifically configured to obtain the language conversion logic required to convert the specified programming language into the target programming language; based on the language conversion logic, convert the first protocol description file into a second protocol description file in the target programming language.

[0117] In some embodiments of the present application, as Figure 3 shown, the protocol decoding device further includes:

[0118] A first determination module 25, configured to determine the communication protocol for which a protocol description file needs to be preset;

[0119] An acquisition module 26, configured to acquire the protocol data use cases corresponding to the communication protocol;

[0120] A second determination module 27, configured to obtain the protocol parameters related to the communication protocol based on the protocol data use cases acquired by the protocol format analysis of the communication protocol by the acquisition module 25; set the decoding data corresponding to each protocol parameter, where the decoding data is used to protocol decode the parameter value of the corresponding protocol parameter from the traffic data;

[0121] A setting module 28, configured to associate the protocol parameters with the corresponding decoding data to form a corresponding parameter structure; describe the parameter structure in a specified programming language to form the protocol description file corresponding to the communication protocol.

[0122] The obtaining module 26, the second determining module 27, and the setting module 28 are configured to process for each determined communication protocol.

[0123] In some embodiments of the present application, as Figure 3 shown, the obtaining module 26 is specifically configured to control a preset sample system to perform target communication with a preset interaction end using the communication protocol; collect traffic data related to the target communication generated by the preset sample system; perform binary format conversion on the collected traffic data to obtain protocol data use cases corresponding to the communication protocol.

[0124] In some embodiments of the present application, as Figure 3 shown, the protocol decoding device further includes:

[0125] The first detection module 29 is configured to, after the second determining module 27 sets the decoded data corresponding to each protocol parameter, for each protocol parameter, detect whether the correct parameter value corresponding to the protocol parameter can be protocol decoded from the preset test traffic data based on the corresponding decoded data. If so, trigger the setting module 28 to execute the step of associating the protocol parameter with the corresponding decoded data to form a corresponding parameter structure. Otherwise, trigger the alarm module 30 to issue an alarm for prompting that the decoded data corresponding to the protocol parameter is abnormal.

[0126] In some embodiments of the present application, as Figure 3 shown, the protocol decoding device further includes:

[0127] The second detection module 31 is configured to, after the setting module 28 describes the parameter structure in a specified programming language to form a protocol description file corresponding to the communication protocol, based on the specified programming language, detect whether there is a syntax error in the protocol description file; if not, determine that the protocol description file corresponding to the communication protocol is available; if so, issue a prompt that there is a syntax error in the protocol description file, and / or, locate the position where the syntax error is located in the protocol description file for modification.

[0128] In some embodiments of the present application, as Figure 3 shown, the decoding module 24 includes:

[0129] The selection unit 241 is configured to select a target parameter structure from the parameter structure of the second protocol description file;

[0130] The first decoding unit 242 is configured to import the target parameter structure into a hard decoding logic matching the target system to form a decoding logic for protocol decoding the traffic data of the target system; based on the decoding logic, perform protocol decoding on the traffic data of the target system.

[0131] In some embodiments of the present application, as Figure 3 shown, the decoding module 24 includes:

[0132] A selection unit 241, configured to select a target parameter structure from the parameter structure of the second protocol description file;

[0133] A second decoding unit 243, configured to compile the target parameter structure by using a runtime module matching the target system to form a decoding logic for protocol decoding of the traffic data of the target system; and perform protocol decoding on the traffic data of the target system based on the decoding logic.

[0134] In some embodiments of the present application, as Figure 3 shown, the selection unit 231 is specifically configured to determine target protocol parameters corresponding to the target communication protocol, where parameter values corresponding to the target protocol parameters are data that needs to be traffic controlled; select a parameter structure related to the target protocol parameters from the parameter structure of the second protocol description file as the target parameter structure;

[0135] Or, display all parameter structures of the second protocol description file for selection; if there is a selected parameter structure, select the selected parameter structure as the target parameter structure;

[0136] Or, select all parameter structures of the second protocol description file as the target parameter structures.

[0137] In some embodiments of the present application, as Figure 3 shown, the specified programming language is the yaml programming language.

[0138] In some embodiments of the present application, as Figure 3 shown, the protocol decoding device further includes:

[0139] A judgment module 32, configured to judge whether a user needs to perform protocol decoding on the traffic data of the target system according to a preset protocol description file; if so, trigger the selection module 22 to execute the step of selecting a first protocol description file corresponding to the target communication protocol from the preset protocol description file; if not, trigger the prompt module 33 to prompt the target communication protocol and target programming language adopted by the target system for the user to write a decoding logic for protocol decoding of the traffic data of the target system based on the target communication protocol and the target programming language.

[0140] In the protocol decoding device provided in the embodiments of the present application, the detailed explanations adopted during the operation of each functional module can be referred to the corresponding explanations in the above embodiments of the protocol decoding method, which will not be elaborated here.

[0141] Further, an embodiment of the present application also provides a computer-readable storage medium, where the storage medium includes a stored program, and when the program runs, it controls the device where the storage medium is located to execute the above-mentioned protocol decoding method.

[0142] Further, an embodiment of the present application also provides an electronic device, where the electronic device includes: a memory for storing a program; a processor coupled to the memory for running the program to execute the above-mentioned protocol decoding method.

[0143] In the above embodiments, the descriptions of the respective embodiments have their own focuses. For parts not detailed in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

[0144] It can be understood that the relevant features in the above methods and devices can be referred to each other. In addition, the "first", "second", etc. in the above embodiments are used to distinguish the respective embodiments, and do not represent the advantages or disadvantages of the respective embodiments.

[0145] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be elaborated herein.

[0146] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The structure required to construct such a system is obvious from the above description. In addition, the present application is not directed to any particular programming language. It should be understood that the content of the present application described herein can be implemented using various programming languages, and the description of the specific language above is for the purpose of disclosing the preferred embodiments of the present application.

[0147] In addition, the memory may include non-permanent memory in a computer-readable medium, forms such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0148] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.

[0149] This application is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram can be implemented by computer program instructions, and the combination of the flows and / or blocks in the flowchart and / or block diagram can also be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 or a device for implementing the functions specified in multiple blocks.

[0150] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 or the functions specified in multiple blocks.

[0151] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 or the functions specified in multiple blocks.

[0152] In a typical configuration, a computing device includes one or more processors (CPUs), an input / output interface, a network interface, and a memory.

[0153] The memory may include non-permanent memory in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of a computer-readable medium.

[0154] A computer-readable medium includes permanent and non-permanent, removable and non-removable media and can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transitory medium that can be used to store information accessible by a computing device. As defined herein, a computer-readable medium does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0155] It should also be noted that the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or apparatus comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or apparatus. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising the element.

[0156] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0157] The above are only the embodiments of the present application and are not intended to limit the present application. For those skilled in the art, various changes and modifications can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the scope of the claims of the present application.

Claims

1. A protocol decoding method, characterized in that, Preset protocol description files corresponding to at least one communication protocol, where the protocol description files are used to describe the corresponding communication protocols, and the method includes: In response to determining to perform protocol decoding on the traffic data of the target system, determine the target communication protocol and the target programming language adopted by the target system; Select a first protocol description file corresponding to the target communication protocol from the preset protocol description files; Based on the target programming language, convert the first protocol description file into a second protocol description file recognizable by protocol decoding; Based on the second protocol description file, perform protocol decoding on the traffic data of the target system.

2. The method according to claim 1, characterized in that, If the preset protocol description files describe the corresponding communication protocols in a specified programming language, then, based on the target programming language, converting the first protocol description file into a second protocol description file recognizable by protocol decoding includes: Obtain the language conversion logic required to convert the specified programming language into the target programming language; Based on the language conversion logic, convert the first protocol description file into a second protocol description file in the target programming language.

3. The method according to claim 1 or 2, characterized in that, The method further includes: Determine the communication protocols for which protocol description files need to be preset; For each determined communication protocol: obtain the protocol data use cases corresponding to the communication protocol; analyze the protocol data use cases based on the protocol format of the communication protocol to obtain the protocol parameters related to the communication protocol; set the decoding data corresponding to each protocol parameter, where the decoding data is used to protocol decode the parameter values of the corresponding protocol parameters from the traffic data; associate the protocol parameters with the corresponding decoding data to form a corresponding parameter structure; describe the parameter structure in a specified programming language to form the protocol description file corresponding to the communication protocol.

4. The method according to claim 3, characterized in that, Obtaining the protocol data use cases corresponding to the communication protocol includes: Control a preset sample system to perform target communication with a preset interaction end using the communication protocol; Collect the traffic data related to the target communication generated by the preset sample system; Perform binary format conversion on the collected traffic data to obtain the protocol data use cases corresponding to the communication protocol.

5. The method according to claim 3, characterized in that, After setting the decoding data corresponding to each protocol parameter, the method further includes: For each protocol parameter, detect whether the correct parameter value corresponding to the protocol parameter can be protocol decoded from the preset test traffic data based on the corresponding decoding data. If so, perform the step of associating the protocol parameter with the corresponding decoding data to form a corresponding parameter structure. Otherwise, issue an alarm for prompting an abnormality in the decoding data corresponding to the protocol parameter.

6. The method according to claim 3, characterized in that, After describing the parameter structure in a specified programming language to form the protocol description file corresponding to the communication protocol, the method further includes: Based on the specified programming language, detect whether there are syntax errors in the protocol description file; If not, determine that the protocol description file corresponding to the communication protocol is available; If there are, issue a prompt that there are syntax errors in the protocol description file, and / or locate the position of the syntax errors in the protocol description file for modification.

7. The method according to claim 3, characterized in that, Based on the second protocol description file, perform protocol decoding on the traffic data of the target system, including: Select a target parameter structure from the parameter structures of the second protocol description file; Import the target parameter structure into the hard decoding logic matching the target system to form a decoding logic for performing protocol decoding on the traffic data of the target system; Based on the decoding logic, perform protocol decoding on the traffic data of the target system.

8. The method according to claim 3, characterized in that, Based on the second protocol description file, perform protocol decoding on the traffic data of the target system, including: Select a target parameter structure from the parameter structures of the second protocol description file; Compile the target parameter structure using a runtime module matching the target system to form a decoding logic for performing protocol decoding on the traffic data of the target system; Based on the decoding logic, perform protocol decoding on the traffic data of the target system.

9. The method according to claim 7 or 8, characterized in that, Selecting a target parameter structure from the parameter structures of the second protocol description file includes: Determine the target protocol parameters corresponding to the target communication protocol, where the parameter values corresponding to the target protocol parameters are the data that needs to be traffic-controlled; select the parameter structure related to the target protocol parameters in the parameter structures of the second protocol description file as the target parameter structure; Or, display all the parameter structures of the second protocol description file for selection; if there is a selected parameter structure, select the selected parameter structure as the target parameter structure; Or, select all the parameter structures of the second protocol description file as the target parameter structures.

10. The method according to claim 3, characterized in that, The specified programming language is the yaml programming language.

11. The method according to any one of claims 1-2, 4-8, 10, characterized in that, The method further includes: Judge whether the user needs to perform protocol decoding on the traffic data of the target system according to a preset protocol description file; if so, execute the step of selecting the first protocol description file corresponding to the target communication protocol from the preset protocol description file; if not, prompt the target communication protocol and target programming language adopted by the target system for the user to write a decoding logic for performing protocol decoding on the traffic data of the target system based on the target communication protocol and the target programming language.

12. A protocol decoding device, characterized in that, Preset protocol description files corresponding to at least one communication protocol, where the protocol description files are used to describe the corresponding communication protocols, and the device includes: A determination module, configured to determine the target communication protocol and target programming language adopted by the target system in response to determining to perform protocol decoding on the traffic data of the target system; A selection module, configured to select the first protocol description file corresponding to the target communication protocol from the preset protocol description files; A conversion module, configured to convert the first protocol description file into a second protocol description file recognizable by protocol decoding based on the target programming language; A decoding module, configured to perform protocol decoding on the traffic data of the target system based on the second protocol description file.

13. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, where when the program runs, it controls the device where the storage medium is located to execute the protocol decoding method according to any one of claims 1 to 11.

14. An electronic device, characterized in that, The electronic device includes: A memory for storing programs; A processor coupled to the memory for running the programs to execute the protocol decoding method according to any one of claims 1 to 11.

Images