Network message analysis method and device, electronic equipment and storage medium

Abstract

The invention provides a network message analysis method and device, electronic equipment and a storage medium, and the method comprises the steps: carrying out the first analysis processing of a network message, and obtaining a first analysis result; the first analysis processing is carried out based on hardware analysis; determining an analysis interruption node according to the first analysis result; performing second analysis processing on unanalyzed data in the network message according to the analysis interruption node to obtain a second analysis result; the second analysis processing is carried out based on software analysis. According to the invention, the first analysis processing of hardware analysis is combined with the second analysis processing based on software analysis to perform analysis processing on the network message, so that the analysis speed is improved, the requirement of message protocol extension can be met, and the adaptability of message analysis is improved.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a network message parsing method, device, electronic device and storage medium. Background Art

[0002] In the communications field, parsing the frame header of network messages involves the physical layer, data link layer, and network layer. Parsing accuracy and efficiency have a significant impact on the reliability and performance of communication systems. Hardware-based parsing is faster, but it can only process fixed-format messages and cannot accommodate message protocol expansion for other services. Software-based parsing can meet the needs of message protocol expansion, but it requires more instruction cycles and is slower. Summary of the Invention

[0003] This application aims to solve the technical problems in the related art at least to a certain extent.

[0004] To this end, the present application proposes a method, an apparatus, an electronic device, and a storage medium.

[0005] In one embodiment of the present application, a method for parsing a network message is provided, comprising: Performing a first parsing process on the network message to obtain a first parsing result; wherein the first parsing process is performed based on hardware parsing; Determining the parsing interruption node according to the position of the first parsing interruption in the first parsing result; determining unparsed data in the network message according to the interrupt node; A second parsing process is performed on the unparsed data in the network message according to a preset software instruction to obtain a second parsing result.

[0006] Optionally, performing a first analysis on the network message to obtain a first analysis result includes: Determining the type of the network message; Perform a first analysis on the network message according to whether the type is a type supported by the first analysis process.

[0007] Optionally, determining the type of the network message includes: Determining a message header included in the network message; The type of the network message is determined according to the message header.

[0008] Optionally, the type supported by the first parsing process includes a message type of an Ethernet message header, and performing the first parsing on the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of an Ethernet message header in the network access protocol layer of the network message, the Ethernet message header is parsed according to the message type of the Ethernet message header to obtain Ethernet message header parsed data; In response to the Ethernet packet header not existing in the network access protocol layer of the network packet, it is determined that the first parsing is interrupted.

[0009] Optionally, the type supported by the first parsing process includes a message type of an internetwork IP message header, and performing the first parsing on the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of an internetwork IP header in the network protocol layer of the network message, the IP header is parsed according to a parsing logic of the IP header to obtain IP header parsing data; In response to the IP packet header not existing in the packet header in the network protocol layer of the network packet, it is determined that the first parsing is interrupted.

[0010] Optionally, the type supported by the first parsing process includes a message type of a Transmission Control Protocol TCP message header or a User Datagram Protocol UDP message header, and performing the first parsing of the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of either a Transmission Control Protocol (TCP) header or a User Datagram Protocol (UDP) header in the transport protocol layer of the network message, parsing the TCP header or the UDP header according to the parsing logic of the TCP header or the UDP header to obtain TCP header parsed data or the UDP header parsed data, and determining that the first parsing is successful; In response to the absence of the TCP message header or the UDP message header in the transport protocol layer of the network message, it is determined that the first parsing is interrupted.

[0011] Optionally, determining a parsing interruption node according to the first parsing result; and performing a second parsing process on unparsed data in the network message according to the parsing interruption node include: Determining the parsing interruption node according to the position of the first parsing interruption in the first parsing result; determining unparsed data in the network message according to the interrupt node; Perform a second parsing process on the unparsed data in the network message according to preset software instructions.

[0012] Optionally, performing a second parsing process on the network message that has not been parsed by the first parsing according to a preset soft instruction includes: Reading each software instruction in the soft instruction sequence, parsing the network message that was not parsed by the first parsing according to the software instruction to obtain an intermediate result; The intermediate results corresponding to the various software instructions are merged to obtain the second analysis result.

[0013] Another embodiment of the present application provides a network message parsing device, comprising: A first parsing module, configured to perform a first parsing process on the network message to obtain a first parsing result; wherein the first parsing process is performed based on hardware parsing; A node determination module, configured to determine a parsing interruption node according to the first parsing result; The second parsing module is used to perform a second parsing process on the unparsed data in the network message according to the parsing interruption node to obtain a second parsing result; the second parsing process is performed based on software parsing.

[0014] Optionally, the first parsing module includes: A type determination submodule, configured to determine the type of the network message; The parsing submodule is used to perform a first analysis on the network message according to whether the type is a type supported by the first parsing process.

[0015] Optionally, the type determination submodule includes: A message header determining unit, configured to determine a message header included in the network message; A type determination unit is used to determine the type of the network message according to the message header.

[0016] Another embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method described in the above aspect is implemented.

[0017] Another aspect of the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method described in the aforementioned aspect is implemented.

[0018] Another embodiment of the present application provides a chip, which includes a processing circuit configured to execute the method described in the above aspect.

[0019] Another embodiment of the present application provides a computer program product, which implements the method described in the above aspect when the program is executed by a processor.

[0020] The network message parsing method, device, electronic device, chip and storage medium proposed in this application parse and process network messages through a first parsing process based on hardware parsing combined with a second parsing process based on software parsing, thereby improving the parsing speed, meeting the requirements of message protocol expansion, and improving the adaptability of message parsing.

[0021] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which: Figure 1 A flowchart of a network message parsing method provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a network message parsing device provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application; Figure 4 A schematic structural diagram of a chip proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0024] The following describes the network message parsing method, device, electronic device, chip and storage medium of the embodiments of the present application with reference to the accompanying drawings.

[0025] Figure 1 A schematic diagram of a flow chart for network message parsing provided in an embodiment of the present application.

[0026] As an implementation method, the network message parsing method of the embodiment of the present application can be configured in a network message parsing device, and the network message parsing device can be applied to any electronic device so that the electronic device can perform a network message parsing function.

[0027] Among them, the electronic device can be any device with computing capabilities, such as a mobile terminal. The mobile terminal can be, for example, a mobile phone, tablet computer, personal digital assistant, wearable device, or other hardware device with various operating systems, touch screens and / or display screens.

[0028] As another implementation method, the network message parsing method of the embodiment of the present application can also be executed by a chip with processing capabilities, including an image signal processing chip (Image Signal Processor, ISP), a central processing unit (Central Processing Unit, CPU), an application-specific integrated circuit (Application-Specific Integrated Circuit, ASIC), a microprocessor (Digital Signal Processor, DSP), a field programmable gate array (Field-Programmable Gate Array, FPGA), a system on a chip (System On A Chip, SOC), a reduced instruction set computer RISC (Reduced Instruction Set Computer, reduced instruction set computer), etc., which are not listed one by one here.

[0029] It should be noted that the collection of user-related data in this application is carried out with the user's authorization and strictly abides by relevant laws and regulations such as privacy and security.

[0030] like Figure 1 As shown, the method may include the following steps: Step 101: Perform a first parsing process on the network message to obtain a first parsing result; the first parsing process is performed based on hardware parsing; Step 102: determining the parsing interruption node according to the position of the first parsing interruption in the first parsing result; Step 103, determining unparsed data in the network message according to the interrupt node; Step 104 : performing a second parsing process on the unparsed data in the network message according to a preset software instruction to obtain a second parsing result.

[0031] In this embodiment, a network message refers to a data unit transmitted in a computer network, usually composed of multiple bytes or bits, containing certain control information and user data, and used to implement information transmission and communication between network devices. The structure of a network message includes: Header: Located at the beginning of a network message, it is a key component of the message and contains a variety of important information used to control and manage network communications. Common headers include Ethernet headers, IP headers, TCP headers, and UDP headers.

[0032] Payload: Located after the header, it is the core of the network message and carries the data that the user actually needs to transmit. Its length can be varied to meet the data transmission requirements of different application scenarios.

[0033] Trailer: Usually located at the end of a network message, it is mainly used to store some auxiliary information related to message transmission, such as the frame check sequence (FCS). It is used by the receiver to perform integrity verification on the received message to ensure the correctness and reliability of data transmission.

[0034] When a network message arrives at the receiving end, the link layer protocol first processes the received frame, checking its integrity and correctness, extracting key information from the link layer header and trailer, and decapsulating the link layer frame to restore the IP message. The network layer protocol then further processes the IP message, determining whether fragmentation and reassembly are necessary based on information in the IP header. It then decapsulates the IP message and extracts the transport layer message. Upon receiving the message, the transport layer protocol passes the data to the appropriate application based on information such as the port number in the header. It then implements the transport layer protocol's control mechanisms (such as TCP's three-way handshake and four-way handshake) to ensure reliable data transmission and connection management. Finally, the application receives the complete user data, completing the process of receiving and processing the network message.

[0035] The core of the network packet parsing process lies in the collaborative operation of hardware and software parsing. First, the network packet undergoes a first parsing process. This process is entirely based on hardware parsing, leveraging the hardware's efficient computing power to quickly parse the initial portion of the network packet, resulting in a first parsing result. Hardware parsing is typically performed at the hardware level of network devices, such as network interface cards (NICs). Hardware parsing is fast and efficient, primarily parsing fixed, standardized packet header formats. It can quickly extract key information from the packet header, such as the destination MAC address, source MAC address, and Ethernet type. This information allows the hardware to quickly make preliminary packet processing and forwarding decisions, alleviating the burden on upper-layer software parsing. Because the first parsing is based on hardware parsing, which supports fixed protocols, if the network packet contains a protocol that the hardware cannot parse, the first parsing process will not be able to fully parse the network packet. Based on this first parsing result, the parsing interruption node can be determined, which accurately indicates the point where the hardware parsing process was interrupted and unable to continue.

[0036] Based on the interrupt node, the data portion of the network message that has not been parsed can be determined, and a second parsing process is carried out on the unparsed data portion. At this time, a software-based parsing method is adopted. Software parsing is highly flexible and can handle complex and changeable data in network messages that are difficult for hardware parsing to handle. Ultimately, a second parsing result is obtained, and then the entire network message is fully parsed, effectively improving the comprehensiveness and accuracy of the parsing. Software parsing is to parse network messages through software programs running on the processor. Software parsing has higher flexibility and scalability and can handle a variety of complex and diverse message formats and protocol types. Based on hardware parsing, for some complex messages that cannot be fully parsed by hardware or messages that require further in-depth analysis, software parsing can continue to perform detailed parsing of the remaining message data, including parsing of high-level protocols such as the transport layer and application layer, extracting more detailed user data and control information, and providing richer data and functional support for network applications.

[0037] Optionally, performing a first analysis on the network message to obtain a first analysis result includes: Determining the type of the network message; Perform a first analysis on the network message according to whether the type is a type supported by the first analysis process.

[0038] In this embodiment, when performing the first analysis of the network message to obtain the first analysis result, the type of the network message must be determined first. Different network message types have their own unique structures and characteristics. By accurately judging the message type, it is possible to determine which analysis strategy to adopt subsequently. Subsequently, the method for performing the first analysis of the network message is determined based on whether the determined type is a type supported by the first analysis process. If the message type falls within the range that the hardware analysis can efficiently process, the hardware analysis proceeds smoothly according to the corresponding rules to obtain the first analysis result; conversely, if the message type is not supported by the hardware analysis, the subsequent interrupt processing mechanism is activated accordingly to pave the way for the subsequent software analysis intervention.

[0039] In a possible embodiment, the types of network packets supported by the first parsing process include but are not limited to: Ethernet packets are transmitted based on the Ethernet protocol and are widely used in local area networks (LANs). The packet header contains information such as the source MAC address, destination MAC address, and type / length fields. These fields are used to identify the sender and receiver within the LAN and determine the type of upper-layer protocol or data length carried.

[0040] IP packets are the basic data unit of Internet Protocol (IP) transmission, operating at the network layer. The IP packet header contains key fields such as the source IP address, destination IP address, protocol version, total length, identifier, flags, fragment offset, time to live (TTL), and protocol type. These fields are used to route packets within the network, reassemble fragments, and determine the packet's transmission path and destination device.

[0041] TCP messages are used by the Transmission Control Protocol (TCP), providing reliable, connection-oriented byte stream services at the transport layer. The TCP message header contains a wealth of information, including the source and destination port numbers, sequence numbers, acknowledgment numbers, data offsets, reserved bits, control bits (such as SYN, ACK, and FIN), window size, checksum, and urgent pointer. These information implements complex functions such as message sequence control, acknowledgment and response, flow control, and connection establishment and release, ensuring data reliability and integrity during transmission.

[0042] UDP packets are messages used by the User Datagram Protocol (UDP), providing simple, connectionless communication services at the transport layer. The UDP packet header is relatively simple, primarily consisting of fields such as the source port number, destination port number, length, and checksum. Its lightweight transmission mechanism makes it suitable for applications with high real-time requirements but relatively low reliability requirements, such as live video streaming and voice calls.

[0043] Optionally, determining the type of the network message includes: Determining a message header included in the network message; The type of the network message is determined according to the message header.

[0044] In this embodiment, to determine the type of a network message, it is first necessary to identify the message header contained in the network message. As a key component of a network message, the message header carries a wealth of important information about the message type, such as the source address, destination address, protocol version, and other key fields. By carefully analyzing these fields in the message header, the type of the network message can be accurately identified, providing a precise basis for subsequent decisions such as whether to employ the first parsing process and how to perform the first parsing, thus ensuring the orderly execution of the entire parsing process.

[0045] Optionally, the type supported by the first parsing process includes a message type of an Ethernet message header, and performing the first parsing on the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of an Ethernet message header in the network access protocol layer of the network message, the Ethernet message header is parsed according to the message type of the Ethernet message header to obtain Ethernet message header parsed data; In response to the Ethernet packet header not existing in the network access protocol layer of the network packet, it is determined that the first parsing is interrupted.

[0046] In this embodiment, when an Ethernet header is present in the network access protocol layer of a network message, the hardware parsing process will perform detailed parsing of the Ethernet header based on the message type defined in the Ethernet header and the corresponding parsing logic, thereby obtaining Ethernet header parsing data, which is a crucial component of the first parsing result. Conversely, if an Ethernet header is absent from the network access protocol layer of the network message, this indicates that the current hardware parsing process is unable to effectively process this portion of the message. At this point, the first parsing process is terminated, indicating that the hardware parsing process cannot proceed further at this point. This serves as a clearing point for the subsequent software parsing process to intervene and complete the parsing of the remaining portion.

[0047] In one possible embodiment, the Ethernet packet header primarily includes three key fields: the destination MAC address, the source MAC address, and the type / length field. The destination MAC address is a 6-byte field that identifies the physical address of the Ethernet frame's receiver. If the destination MAC address is the MAC address of a specific device, the Ethernet frame is sent to that specific device. In a multicast scenario, the destination MAC address can be a multicast group address, indicating that the frame is to be sent to all devices belonging to the multicast group. For example, in an enterprise network, when a server needs to send an update file to multiple workstations simultaneously, multicast technology can be used to set the destination MAC address to the multicast group address, allowing all workstations belonging to the group to receive the Ethernet frame.

[0048] The Source MAC Address (SMAC) is also 6 bytes and identifies the physical address of the sender of an Ethernet frame. This field allows the receiver to identify the device from which the data originated. For example, in network communications, when workstation A sends a request frame to a server, the source MAC address identifies the frame as originating from workstation A. This allows the server to send a response frame back to workstation A.

[0049] The Type / Length field is a 2-byte field used to identify the type of Ethernet frame or the length of the data portion.

[0050] Type: When the value of this field is greater than or equal to 0x0600, it indicates the type of Ethernet frame, indicating the type of higher-layer protocol, that is, the upper-layer protocol to which the data carried by the frame belongs. For example, when the value is 0x0800, it means that the frame carries an IP datagram; when the value is 0x0806, it means that the frame carries an ARP request or reply message.

[0051] Length: When the value of this field is less than 0x0600, it indicates the length of the data portion of the frame, that is, the length of the user data. For example, when this field value is 0x0030, it means that the data portion of the Ethernet frame contains 0x0030, or 48 bytes of data. However, due to certain restrictions on the length of the data portion of Ethernet frames (usually a minimum of 46 bytes and a maximum of 1500 bytes), if the data length is less than 46 bytes, padding is required to meet the minimum length requirement.

[0052] Optionally, the type supported by the first parsing process includes a message type of an internetwork IP message header, and performing the first parsing on the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of an internetwork IP header in the network protocol layer of the network message, the IP header is parsed according to a parsing logic of the IP header to obtain IP header parsing data; In response to the IP packet header not existing in the packet header in the network protocol layer of the network packet, it is determined that the first parsing is interrupted.

[0053] In this embodiment, when an internetwork IP header is present in the network protocol layer of a network message, the hardware parsing process will proceed according to the established parsing logic for the IP header, fully parsing the IP header and obtaining IP header parsing data to enrich the first parsing result. However, if the network protocol layer header of the network message lacks the IP header, the hardware parsing process will be unable to continue according to the established IP header parsing rules, and the first parsing will be terminated. At this point, the hardware parsing process will cease, paving the way for subsequent software parsing to achieve a complete parsing of the entire network message.

[0054] In a possible embodiment, the IP packet header is divided into two types: the IPv4 packet header and the IPv6 packet header: The IPv4 header contains several important fields that identify the characteristics and transmission requirements of the IP packet. Its basic format is as follows: |Version|Header Length|Type of Service|Total Length|Identifier|Flag|Fragment Offset|Time to Live|Protocol Type|Header Checksum|Source IP Address|Destination IP Address|Options (optional)|Padding (optional). The Version field is a 4-bit field that identifies the IP protocol version. The value for IPv4 is 4. The Header Length field is a 4-bit field that indicates the length of the IP header, including the optional portion. The minimum value is 5, indicating a 20-byte header length without options. The Type of Service (TOS) field is an 8-bit field that specifies the service type and priority of the packet. It is typically divided into a 6-bit DSCP (Differentiated Services Code Point) and a 2-bit ECN (Explicit Congestion Notification). The Total Length field is a 16-bit field that indicates the total length of the entire IP packet, including the header and data. The maximum length is 65535 bytes. The Identification field is a 16-bit field that identifies the original datagram. When a packet is fragmented, this value is retained across all fragments to facilitate reassembly by the destination device. Flags: A 3-bit field. The least significant bit is MF (More Fragments), the middle bit is DF (Don't Fragment), and the most significant bit is reserved. The DF bit is used to control whether fragmentation is allowed.

[0055] The IPv6 packet header is simplified and optimized compared to IPv4. The basic format is as follows: |Version|Traffic Class|Flow Label|Payload Length|Next Header|Hop Limit|Source IP Address|Destination IP Address|, where the Version field is a 4-bit field with a value of 6, identifying the IPv6 protocol version. The Traffic Class field is an 8-bit field used to indicate the priority and classification of the packet, similar to the Type of Service in IPv4. The Flow Label field is a 20-bit field, combined with the source address, used to identify flows that require special processing. The Payload Length field is a 16-bit field that indicates the total length of the packet, including extension headers and data. The Next Header field is an 8-bit field that indicates the next header type (such as TCP, UDP, ICMP, etc.). The Hop Limit field is an 8-bit field, similar to the TTL in IPv4. The hop count is decremented by 1 after each router passed. When the hop count reaches 0, the packet is discarded. The Source IP Address field is a 128-bit field that identifies the sender's IP address. Destination IP Address: A 128-bit field that identifies the IP address of the recipient.

[0056] The source and destination IP addresses in the IP packet header are key identifiers for data transmission. Network devices such as routers select routes based on the destination IP address and forward data packets to the target network device. The protocol type field (IPv4) or the next header field (IPv6) is used to identify the upper-layer protocol type, helping the receiver to correctly pass data to the corresponding upper-layer protocol for processing. IPv4 implements packet fragmentation and reassembly through fields such as identification, flags, and fragment offsets, ensuring that large data packets can be transmitted smoothly within the network. The service type field (IPv4) or traffic class field (IPv6) is used to implement quality of service control, giving priority to the transmission of high-priority packets. The time-to-live field (IPv4) or the hop limit field (IPv6) is used to limit the life cycle of IP packets within the network, preventing packets from looping indefinitely and reducing the waste of network resources.

[0057] Optionally, the type supported by the first parsing process includes a message type of a Transmission Control Protocol TCP message header or a User Datagram Protocol UDP message header, and performing the first parsing of the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of either a Transmission Control Protocol (TCP) header or a User Datagram Protocol (UDP) header in the transport protocol layer of the network message, parsing the TCP header or the UDP header according to the parsing logic of the TCP header or the UDP header to obtain TCP header parsed data or the UDP header parsed data, and determining that the first parsing is successful; In response to the absence of the TCP message header or the UDP message header in the transport protocol layer of the network message, it is determined that the first parsing is interrupted.

[0058] In this embodiment, during the hardware parsing process, if either a Transmission Control Protocol (TCP) header or a User Datagram Protocol (UDP) header exists in the transport protocol layer of the network message, the hardware parsing will accurately parse the corresponding header based on the specific parsing logic followed by the TCP header or UDP header, obtaining TCP header parsed data or UDP header parsed data, respectively, thereby determining that the first parsing is successful. Conversely, if the TCP header or UDP header does not exist in the transport protocol layer of the network message, it indicates that the hardware parsing was unable to complete the task at the transport protocol layer, and the first parsing is interrupted so that the subsequent software parsing can intervene in time to continue processing the remaining unparsed data.

[0059] In one possible embodiment, TCP (Transmission Control Protocol) is a connection-oriented, reliable byte stream service transport layer protocol. The TCP header identifies the characteristics and transmission requirements of a TCP message and has the following format: Source Port: A 16-bit field that identifies the sender's application port number.

[0060] Destination Port: A 16-bit field that identifies the application port number of the recipient.

[0061] Sequence Number: A 32-bit field used to identify the data sequence number in a TCP segment. Each byte of data has a sequence number. After the connection is established, the sequence number is generated from a random number to ensure that the data in each segment can be correctly sorted and reassembled.

[0062] Acknowledgment Number: A 32-bit field used to confirm received data. The acknowledgment number is the next expected data sequence number. The acknowledgment number field is valid only when the ACK flag is 1. For example, if the sender sends a segment with sequence number 100 and 1000 bytes of data, the receiver will send an acknowledgment segment with acknowledgment number 1100 upon successful receipt.

[0063] Data Offset: A 4-bit field that indicates the length of the TCP header and is used to determine the starting position of the data portion. The minimum length of a TCP header is 20 bytes and the maximum length is 60 bytes.

[0064] Reserved: A 6-bit field that is currently unused and reserved for future expansion.

[0065] Control Bits: 6-bit field, from left to right: URG, ACK, PSH, RST, SYN, FIN. Each bit has a specific function: URG (Urgent Pointer): Urgent pointer flag. When URG = 1, it means that there is urgent data in this message segment and the receiver needs to give priority to it.

[0066] ACK (Acknowledgment): Acknowledgment flag. When ACK = 1, the acknowledgment number field is valid. TCP stipulates that, except for the initial SYN segment establishing the connection, all other segments must have ACK set to 1.

[0067] PSH (Push Function): Push flag. When PSH = 1, the receiver should submit the data in this segment to the upper-layer application as soon as possible, rather than waiting until there is enough data.

[0068] RST (Reset the Connection): Reset flag. When RST = 1, it indicates that the other party is requested to reestablish the connection. This flag is usually used to force a connection termination when a serious error occurs (such as a host crash).

[0069] SYN (Synchronize Sequence Numbers): The synchronization flag is used to synchronize sequence numbers when establishing a connection. When establishing a connection, the client sends a SYN segment to request a connection. The server responds with a SYN+ACK segment, and the client then sends an ACK segment to complete the connection.

[0070] FIN (Finish): The end flag. Used to release a connection. When FIN = 1, it indicates that the sender has no more data to send and wishes to terminate the connection. Connection termination typically requires both parties to perform a handshake, known as the four-way handshake.

[0071] Window Size: A 16-bit field used for flow control. The receiver uses the window size field to tell the sender the amount of data it can receive (in bytes). The sender must ensure that the amount of data sent does not exceed the receiver's window size.

[0072] Checksum: A 16-bit field used to detect errors in the TCP header and data during transmission. Unlike the IP header checksum, the TCP checksum calculation includes the pseudo header (IP address and other information), the TCP header, and the TCP data.

[0073] Urgent Pointer: A 16-bit field that is valid only when the URG flag is 1. This field indicates the end of the urgent data, which is the sequence number of the last byte of the urgent data + 1.

[0074] UDP (User Datagram Protocol) is a connectionless, simple transport layer protocol. The UDP message header structure is relatively simple, and its format is as follows: Source Port: A 16-bit field that identifies the sender's application port number. This field is optional and is set to 0 when not used.

[0075] Destination Port: A 16-bit field that identifies the application port number of the recipient.

[0076] Length: This 16-bit field indicates the total length of the UDP packet, including the header and data. The minimum length is 8 bytes (header only, no data).

[0077] Checksum: A 16-bit field used to detect errors during UDP packet transmission. Similar to TCP, the UDP checksum calculation also includes the pseudo header, UDP header, and UDP data portion. However, the UDP checksum is optional. If the checksum field is 0, it indicates that the checksum is not used.

[0078] In one possible embodiment, since the structure of a network message is layered, the first parsing process for the network message is performed from the outside to the inside. The structure of the network message is, from the outside to the inside, the network access layer, the network layer, the transport layer, and the application layer. For the network access layer parsing, it is necessary to determine whether the network access layer contains an Ethernet message header. If it does, the first parsing is performed; then, for the network layer, it is determined whether it contains an IP message header. If it does, the first parsing is performed; then, for the transport layer, it is determined whether it contains a UDP message header or a TCP message header. If any of the links does not contain the above-mentioned message header, the first parsing is interrupted, and the first parsing is no longer performed on the deeper layer. Instead, the second parsing is performed on the unparsed data in the network message.

[0079] Optionally, determining a parsing interruption node according to the first parsing result; and performing a second parsing process on unparsed data in the network message according to the parsing interruption node include: Determining the parsing interruption node according to the position of the first parsing interruption in the first parsing result; determining unparsed data in the network message according to the interrupt node; Perform a second parsing process on the unparsed data in the network message according to preset software instructions.

[0080] In this embodiment, the parsing interruption node is precisely determined based on the location of the first parsing interruption, clearly recorded in the first parsing result. This node acts as a precise positioning point, clearly indicating the specific location of the interruption in the hardware parsing process. Next, using the interruption node as a reference, the unparsed data portion of the network message is determined, specifically the range and starting position of the unparsed data. Subsequently, a second parsing process is performed on this unparsed data based on preset software instructions—a series of pre-programmed software program instructions specifically designed to process the unparsed portions of such network messages. Leveraging the flexibility and versatility of software parsing, the unparsed data is parsed one by one, thereby completing the complete parsing of the entire network message.

[0081] Optionally, performing a second parsing process on the network message that has not been parsed by the first parsing according to a preset soft instruction includes: Reading each software instruction in the soft instruction sequence, parsing the network message that was not parsed by the first parsing according to the software instruction to obtain an intermediate result; The intermediate results corresponding to the various software instructions are merged to obtain the second analysis result.

[0082] In this embodiment, each software instruction in a preset soft instruction sequence is read. These instructions are arranged and combined according to a specific logical order and rules. Each software instruction has a precise parsing function for a specific portion or specific type of unparsed data. Each software instruction is executed in sequence according to the instruction sequence. According to each software instruction, the corresponding portion of the network message that was not fully parsed by the first parsing is parsed, and intermediate results are gradually obtained. Subsequently, the intermediate results corresponding to each software instruction are fused and processed. Through a specific data integration algorithm or logical rules, these scattered intermediate results are aggregated and integrated together to finally obtain a complete second parsing result, achieving a thorough parsing of the entire network message and ensuring that every useful information in the network message can be accurately extracted and utilized.

[0083] In a possible embodiment, the second parsing process is as follows: The network message that has not been parsed by the first parsing is temporarily stored in the receiving buffer.

[0084] According to the predefined message format, determine the starting position of the message header in the data and extract the data in the message header; Read software instructions from the software instruction storage, execute the software instructions to process the network messages that have not been parsed, and input the intermediate results of the processing into the intermediate result storage, wherein the software instructions include categories such as read, write, and operation; Determine whether the end instruction has been reached. If not, continue to return to the step of reading the software instruction in the software instruction storage; if reached, it means that the second parsing process is completed, and the intermediate results stored in the intermediate result storage can be merged to obtain the parsing result of the entire network message header.

[0085] In order to implement the above embodiment, the embodiment of the present application also proposes a network message parsing device.

[0086] Figure 2 A schematic diagram of the structure of a network message parsing device provided in an embodiment of the present application.

[0087] like Figure 2 As shown, the device may include: A first parsing module 210 is configured to perform a first parsing process on the network message to obtain a first parsing result; the first parsing process is performed based on hardware parsing; A node determination module 220 is configured to determine the parsing interruption node according to the position of the first parsing interruption in the first parsing result; an unparsed data determining module 230, configured to determine unparsed data in the network message according to the interrupt node; The second parsing module 240 is configured to perform a second parsing process on the unparsed data in the network message according to a preset software instruction to obtain a second parsing result.

[0088] Optionally, the first parsing module includes: A type determination submodule, configured to determine the type of the network message; The parsing submodule is used to perform a first analysis on the network message according to whether the type is a type supported by the first parsing process.

[0089] Optionally, the type determination submodule includes: A message header determining unit, configured to determine a message header included in the network message; A type determination unit is used to determine the type of the network message according to the message header.

[0090] It should be noted that the above explanation of the method embodiment is also applicable to the device of this embodiment and will not be repeated here.

[0091] In order to implement the above embodiments, the present application also proposes a non-transitory computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the above method embodiments is implemented.

[0092] In order to implement the above embodiments, the present application further proposes a computer program product on which a computer program is stored. When the computer program is executed by a processor, the method described in the above method embodiments is implemented.

[0093] In order to implement the above embodiments, the present application also proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method described in the above method embodiments is implemented.

[0094] Figure 3 The electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0095] Reference Figure 3 Electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0096] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operation, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the above-described method. In addition, the processing component 802 may include one or more modules to facilitate interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.

[0097] The memory 804 is configured to store various types of data to support operations on the electronic device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, pictures, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0098] The power component 806 provides power to the various components of the electronic device 800. The power component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0099] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, it may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensors can not only sense the boundaries of a touch or slide action, but also detect the duration and pressure associated with the touch or slide action. In some embodiments, the multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the electronic device 800 is in an operating mode, such as a capture mode or a video mode, the front-facing camera and / or the rear-facing camera can receive external multimedia data. Each front-facing camera and the rear-facing camera can have a fixed optical lens system or have focal length and optical zoom capabilities.

[0100] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC) that is configured to receive external audio signals when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0101] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as a keyboard, click wheel, buttons, etc. These buttons may include, but are not limited to, a home button, volume buttons, a start button, and a lock button.

[0102] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the electronic device 800, the relative positioning of components, such as the display and keypad of the electronic device 800. The sensor assembly 814 can also detect changes in the position of the electronic device 800 or a component of the electronic device 800, the presence or absence of user contact with the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and temperature changes of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0103] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, 4G or 5G, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0104] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0105] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions. The instructions can be executed by the processor 820 of the electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0106] In order to implement the above embodiments, the present application further proposes a chip, including: the chip includes a processing circuit, and the processing circuit is configured to execute the method provided in the above embodiments.

[0107] Figure 3 A schematic diagram of the structure of a chip proposed in the application embodiment. Figure 3 The structural diagram of the chip 1100 is shown, but is not limited thereto.

[0108] The chip 1100 includes a processing circuit 1101 , which is configured to execute any of the above methods.

[0109] In some embodiments, chip 1100 further includes one or more interface circuits 1102. Optionally, interface circuit 1102 is connected to memory 1103. Interface circuit 1102 can be used to receive signals from memory 1103 or other devices, and can be used to send signals to memory 1103 or other devices. For example, interface circuit 1102 can read instructions stored in memory 1103 and send the instructions to processing circuit 1101.

[0110] In some embodiments, the interface circuit 1102 performs at least one of the communication steps such as sending and / or receiving in the above method, and the processing circuit 1101 performs the other steps.

[0111] In some embodiments, terms such as interface circuit, interface, transceiver pin, and transceiver may be used interchangeably.

[0112] In some embodiments, the chip 1100 further includes one or more memories 1103 for storing instructions. Alternatively, all or part of the memories 1103 may be located outside the chip 1100 .

[0113] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0114] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. Throughout the description of this application, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0115] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0116] The logic and / or steps represented in a flowchart or otherwise described herein, for example, can be considered a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" is any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (not exhaustive) of computer-readable media include: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0117] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having logic gate circuits for implementing logical functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field-programmable gate array (FPGA), etc.

[0118] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0119] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0120] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A network message parsing method, characterized in that: include: Performing a first parsing process on the network message to obtain a first parsing result; The first parsing process is performed based on hardware parsing; Determining the parsing interruption node according to the position of the first parsing interruption in the first parsing result; determining unparsed data in the network message according to the interrupt node; A second parsing process is performed on the unparsed data in the network message according to a preset software instruction to obtain a second parsing result.

2. The method according to claim 1, characterized in that The performing a first analysis on the network message to obtain a first analysis result includes: Determining the type of the network message; Perform a first analysis on the network message according to whether the type is a type supported by the first analysis process.

3. The method according to claim 2, characterized in that The determining the type of the network message includes: Determining a message header included in the network message; The type of the network message is determined according to the message header.

4. The method according to claim 3, characterized in that The type supported by the first parsing process includes a message type of an Ethernet message header, and performing a first parsing on the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of an Ethernet message header in the network access protocol layer of the network message, the Ethernet message header is parsed according to the message type of the Ethernet message header to obtain Ethernet message header parsed data; In response to the Ethernet packet header not existing in the network access protocol layer of the network packet, it is determined that the first parsing is interrupted.

5. The method according to claim 3, characterized in that The types supported by the first parsing process include message types of internetwork IP message headers, and performing the first parsing of the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of an internetwork IP header in the network protocol layer of the network message, the IP header is parsed according to a parsing logic of the IP header to obtain IP header parsing data; In response to the IP packet header not existing in the packet header in the network protocol layer of the network packet, it is determined that the first parsing is interrupted.

6. The method according to claim 3, characterized in that The types supported by the first parsing process include message types of a Transmission Control Protocol TCP message header or a User Datagram Protocol UDP message header, and performing a first parsing of the network message according to whether the type is a type supported by the first parsing process includes: In response to the presence of either a Transmission Control Protocol (TCP) header or a User Datagram Protocol (UDP) header in the transport protocol layer of the network message, parsing the TCP header or the UDP header according to the parsing logic of the TCP header or the UDP header to obtain TCP header parsed data or the UDP header parsed data, and determining that the first parsing is successful; In response to the absence of the TCP message header or the UDP message header in the transport protocol layer of the network message, it is determined that the first parsing is interrupted.

7. The method according to claim 1, characterized in that The performing a second parsing process on the network message that has not been parsed by the first parsing according to the preset soft instruction includes: Reading each software instruction in the soft instruction sequence, parsing the network message that was not parsed by the first parsing according to the software instruction to obtain an intermediate result; The intermediate results corresponding to the various software instructions are merged to obtain the second analysis result.

8. A network message parsing device, characterized in that: include: A first parsing module, configured to perform a first parsing process on the network message to obtain a first parsing result; The first parsing process is performed based on hardware parsing; a node determination module, configured to determine the parsing interruption node according to a position of the first parsing interruption in the first parsing result; an unparsed data determining module, configured to determine the unparsed data in the network message according to the interrupt node; The second parsing module is used to perform a second parsing process on the unparsed data in the network message according to a preset software instruction to obtain a second parsing result.

9. The device according to claim 8, characterized in that The first parsing module includes: A type determination submodule, configured to determine the type of the network message; The parsing submodule is used to perform a first analysis on the network message according to whether the type is a type supported by the first parsing process.

10. The device according to claim 9, characterized in that The type determination submodule includes: A message header determining unit, configured to determine a message header included in the network message; A type determination unit is used to determine the type of the network message according to the message header.

11. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

13. A chip, characterized in that: The chip comprises a processing circuit configured to execute the method according to any one of claims 1 to 7.

14. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images