Satellite-borne network data storage and backtracking method, device, equipment and medium

Abstract

The invention discloses a satellite-borne network data storage and backtracking method and device, equipment and a medium, and relates to the technical field of satellite-borne networks, and the method comprises the steps: writing a network data frame into a first target file, and determining a corresponding first offset value; session data frame information corresponding to different network sessions is determined based on the first offset values of the network data frames under different network sessions, the session data frame information is written into a second target file, and a corresponding second offset value is determined; saving session information corresponding to different network sessions and the second offset value to a session log, and sending the session log to a data demand end; receiving a data backtracking request sent by the data demand end based on the session log, and determining target session data frame information from the second target file according to the data backtracking request; and determining a target network data frame from the first target file based on the target session data frame information, and sending the target network data frame to the data demand end. According to the invention, efficient storage and second-level precise backtracking of the network data are realized.

Description

Technical Field

[0001] This application relates to the field of spaceborne network technology, and in particular to a method, apparatus, device and medium for spaceborne network data storage and tracing. Background Technology

[0002] With the development and application of next-generation satellite communication technologies, the demand for threat detection for satellite communication equipment has become increasingly important. Addressing the insufficient means of identifying and detecting attacks on space-based networks, research is needed to identify potential threats and attacks in space-based networks. This research aims to achieve threat identification, alerting, storage, backhaul, and presentation technologies under the limited resources of satellite-based systems, thereby improving the overall risk identification and monitoring capabilities of satellite networks. All of these challenges posed to satellite equipment in achieving large-scale network data storage, indexing, and backhaul under limited resources. Traditional network equipment relies on powerful computing power and array storage devices for network data storage and backhaul, which are not limited by resources and energy consumption and therefore do not meet the needs of space-based application scenarios. Summary of the Invention

[0003] In view of this, the purpose of this application is to provide a method, apparatus, device, and medium for storing and tracing data in a satellite network, enabling efficient storage of terabyte-level network data and accurate tracing within seconds under the limited resources of satellite equipment. The specific solution is as follows:

[0004] Firstly, this application provides a method for storing and backtracking data on a spaceborne network, applied to spaceborne equipment, including:

[0005] The acquired network data frames are written into a first target file, and a first offset value is determined for each network data frame; the first offset value is the offset value of the network data frame in the first target file.

[0006] The network session corresponding to the network data frame is determined. Based on the first offset value of the network data frame corresponding to different network sessions, the session data frame information corresponding to different network sessions is determined. The session data frame information is written into a second target file, and the second offset value corresponding to the session data frame information is determined. The session data frame information includes a set of first offset values ​​of the network data frames corresponding to the network session. The second offset value is the offset value of the session data frame information in the second target file.

[0007] The session information and second offset value corresponding to different network sessions are saved to the session log, and the session log is sent to the data request end so that the data request end can send a data backtracking request based on the session log;

[0008] Receive a data backtracking request sent by the data requesting end, and determine the corresponding target session data frame information from the second target file according to the second offset value in the data backtracking request;

[0009] Based on the first offset value set in the target session data frame information, the corresponding target network data frame is determined from the first target file, and the target network data frame is sent to the data requesting end.

[0010] Optionally, the step of writing the acquired network data frames into the first target file and determining the first offset value corresponding to each network data frame includes:

[0011] The acquired network data frames are written into the PCAP file in the order of receipt, and the starting position of each network data frame in the PCAP file is determined during the writing process. The starting position is used as the first offset value of the network data frame in the PCAP file.

[0012] Optionally, determining the network session corresponding to the network data frame, and determining the session data frame information corresponding to different network sessions based on the first offset value of the network data frames corresponding to different network sessions, includes:

[0013] The network session to which each network data frame belongs is determined based on the five-tuple information corresponding to the network data frame; the five-tuple information includes source IP address, destination IP address, source port number, destination port number, and transport protocol type;

[0014] For any network session, the first offset values ​​corresponding to all network data frames under the network session are sorted out to determine the corresponding first offset value set, and the session data frame information corresponding to the network session is constructed based on the network session and the corresponding first offset value set.

[0015] Optionally, saving the session information and second offset value corresponding to different network sessions to the session log includes:

[0016] For any network session, determine the second offset value of the five-tuple information, session time information, alarm information and corresponding session data frame information of the network session in the second target file;

[0017] According to the preset format, and based on the second offset value of the five-tuple information, session time information, alarm information and the corresponding session data frame information of any network session in the second target file, a corresponding session record is generated, and the session record corresponding to any network session is saved to the session log.

[0018] Optionally, determining the corresponding target session data frame information from the second target file based on the second offset value in the data backtracking request includes:

[0019] Based on the second offset value in the data backtracking request, the corresponding session data frame information is determined from the second target file, and it is determined whether the five-tuple information corresponding to the session data frame information determined from the second target file is consistent with the five-tuple information of the target network session corresponding to the data backtracking request.

[0020] If they match, the session data frame information determined from the second target file will be used as the target session data frame information corresponding to the data backtracking request.

[0021] Firstly, this application provides a method for storing and tracing data in a spaceborne network, applied to the data demand side, including:

[0022] Obtain the session logs sent by the onboard equipment;

[0023] Determine the target network session corresponding to the network data frame that needs to be traced back, and determine the second offset value of the target session data frame information corresponding to the target network session in the second target file from the session log;

[0024] A data backtracking request is generated based on the second offset value, and the data backtracking request is sent to the onboard equipment so that the onboard equipment can determine the corresponding target network data frame according to the data backtracking request;

[0025] Receive the target network data frame returned by the onboard equipment to realize the backtracking of the target network data frame.

[0026] Optionally, after receiving the target network data frame returned by the spaceborne device, the method further includes:

[0027] Integrity verification is performed on the target network data frame. If the verification result indicates that the verification has failed, a data backtracking request is regenerated and sent to the onboard device based on the corresponding five-tuple information and the second offset value in the session log.

[0028] Thirdly, this application provides a spaceborne network data storage and retrieval device, applied to spaceborne equipment, comprising:

[0029] The first offset value determination module is used to write the acquired network data frames into a first target file and determine the first offset value corresponding to each network data frame; the first offset value is the offset value of the network data frame in the first target file.

[0030] The second offset value determination module is used to determine the network session corresponding to the network data frame, determine the session data frame information corresponding to different network sessions based on the first offset value of the network data frame corresponding to different network sessions, write the session data frame information into a second target file, and determine the second offset value corresponding to the session data frame information respectively; the session data frame information includes a set of first offset values ​​of network data frames corresponding to the network session; the second offset value is the offset value of the session data frame information in the second target file;

[0031] The log sending module is used to save the session information and second offset value corresponding to different network sessions to the session log, and send the session log to the data request end so that the data request end can send a data backtracking request based on the session log;

[0032] The request receiving module is used to receive a data backtracking request sent by the data requesting end, and determine the corresponding target session data frame information from the second target file according to the second offset value in the data backtracking request.

[0033] The data frame sending module is used to determine the corresponding target network data frame from the first target file based on the first offset value set in the target session data frame information, and send the target network data frame to the data requesting end.

[0034] Fourthly, this application provides an electronic device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor is used to execute the computer program to implement the aforementioned spaceborne network data storage and backtracking method.

[0037] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned spaceborne network data storage and retrieval method.

[0038] In this application, the acquired network data frames are written into a first target file, and a first offset value corresponding to each network data frame is determined. The first offset value is the offset value of the network data frame in the first target file. The network session corresponding to the network data frame is determined, and the session data frame information corresponding to different network sessions is determined based on the first offset value of the network data frames corresponding to different network sessions. The session data frame information is written into a second target file, and a second offset value corresponding to each session data frame information is determined. The session data frame information includes a set of first offset values ​​of network data frames corresponding to the network session. The second offset value is the offset value of the session data frame information in the second target file. The session information and second offset values ​​corresponding to different network sessions are saved to a session log, and the session log is sent to the data request end so that the data request end can send a data backtracking request based on the session log. The data backtracking request sent by the data request end is received, and the corresponding target session data frame information is determined from the second target file according to the second offset value in the data backtracking request. The corresponding target network data frame is determined from the first target file based on the set of first offset values ​​in the target session data frame information, and the target network data frame is sent to the data request end. As shown above, this application directly writes the acquired network data frames into the first target file in the order of reception and synchronously records the first offset value of each network data frame in the file. This eliminates the need for computational power to process data formats and avoids storage redundancy caused by temporary caching. For different network sessions, only the set of first offset values ​​of all data frames in that session is written into the second target file, instead of repeatedly storing the original data. Subsequent session logs also only record "session information + second offset value", significantly compressing the storage volume of non-original data and enabling the satellite to carry TB-level original data with limited storage resources. The data requesting end initiates a request based on the second offset value in the session log. The satellite directly locates the target session data frame information in the second target file using the second offset value, without traversing the entire data. At the same time, based on the set of first offset values ​​in the target session data frame information, the accurate position of the corresponding original data frame in the first target file can be directly located without additional calculation or format conversion. The target data can be quickly extracted and transmitted back, ensuring that a second-level backtracking response can still be achieved under the limited computing power of the onboard equipment. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0040] Figure 1This is a flowchart of a spaceborne network data storage and backtracking method disclosed in this application;

[0041] Figure 2 This is a schematic diagram of a spaceborne network data storage disclosed in this application;

[0042] Figure 3 This is a schematic diagram of a spaceborne network data storage and backtracking method disclosed in this application;

[0043] Figure 4 This is a flowchart of a spaceborne network data storage and backtracking method disclosed in this application;

[0044] Figure 5 This is a schematic diagram of the structure of a spaceborne network data storage and backtracking device disclosed in this application;

[0045] Figure 6 This is a schematic diagram of the structure of an electronic device disclosed in this application. Detailed Implementation

[0046] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] The demand for threat detection for satellite communication equipment is becoming increasingly important. Addressing the insufficient means of identifying and detecting attacks on space-based networks, research into identifying potential threats and attack methods in space-based networks, and improving the overall risk identification and monitoring capabilities of satellite networks, all pose challenges to satellite equipment in achieving large-scale network data storage, indexing, and backtracking under limited resources. Traditional network equipment relies on powerful computing power and array storage devices for network data storage and backtracking, which are not limited by resources and energy consumption and therefore do not meet the needs of spaceborne applications. To address this, this application provides a method for spaceborne network data storage and backtracking, enabling efficient storage of TB-level network data and accurate backtracking within seconds under the limited resources of satellite equipment. This provides a fundamental function for threat identification and attack research in spaceborne scenarios and improves the overall risk identification and monitoring capabilities of satellite networks.

[0048] See Figure 1 As shown in the figure, this application discloses a method for data storage and backtracking in a spaceborne network, applied to spaceborne equipment, including:

[0049] Step S11: Write the acquired network data frames into the first target file and determine the first offset value corresponding to each network data frame; the first offset value is the offset value of the network data frame in the first target file.

[0050] In this embodiment, the acquired network data frames can be directly streamed into a PCAP (Packet Capture) file without buffering, according to the order of reception. Figure 2 As shown, the starting position of each network data frame written to the PCAP file is determined during the writing process, and the starting position is used as the first offset value of the network data frame in the PCAP file.

[0051] Understandably, due to the limitations of onboard equipment resources, the input and storage of raw network data cannot be reassembled or cached to merge the raw data of the same session for storage, or to directly store a session in a single file. Therefore, data frames can be written directly to the raw data storage file in the order they are received, with the position of each data frame recorded within the file.

[0052] Step S12: Determine the network session corresponding to the network data frame, determine the session data frame information corresponding to different network sessions based on the first offset value of the network data frame corresponding to different network sessions, write the session data frame information into the second target file, and determine the second offset value corresponding to the session data frame information respectively; the session data frame information includes a set of first offset values ​​of the network data frame corresponding to the network session; the second offset value is the offset value of the session data frame information in the second target file.

[0053] In this embodiment, the network session to which each network data frame belongs can first be determined based on the 5-tuple information corresponding to the network data frame; wherein the 5-tuple information includes, but is not limited to, source IP address, destination IP address, source port number, destination port number, and transport protocol type. For any network session, the first offset values ​​corresponding to all network data frames under that network session are organized to determine the corresponding set of first offset values, and the session data frame information corresponding to that network session is constructed based on any network session and the corresponding set of first offset values. Then, the session data frame information is written to a second target file, and the second offset value corresponding to each session data frame information is determined.

[0054] For example Figure 2 As shown, based on the session to which the network data frame belongs, the data frame position of the network data frames included in different sessions in the first target file is determined to obtain session data frame information. Then, the session data frame information can be recorded in the data frame index file on a session-by-session basis, and the position of the session data frame information in the data frame index file is recorded.

[0055] Step S13: Save the session information and second offset value corresponding to different network sessions to the session log, and send the session log to the data request end so that the data request end can send a data backtracking request based on the session log.

[0056] In this embodiment, for any network session, the five-tuple information, session time information, alarm information, and the second offset value of the corresponding session data frame information in the second target file can be determined. Then, according to a preset format, and based on the five-tuple information, session time information, alarm information, and the second offset value of the corresponding session data frame information in the second target file, a corresponding session record is generated, and the session record corresponding to any network session is saved to the session log. Finally, the session log can be sent to a database or a third-party application, such as a ground operations control center application.

[0057] The data requester receives and saves the aforementioned session logs. When ground control or third-party applications need to backtrack and extract the original network data frames, it determines the target network session corresponding to the network data frame to be backtracked, and determines the second offset value of the target session data frame information corresponding to the target network session in the second target file from the session log. Based on the second offset value, a data backtracking request is generated and sent to the onboard equipment.

[0058] Step S14: Receive the data backtracking request sent by the data requesting end, and determine the corresponding target session data frame information from the second target file according to the second offset value in the data backtracking request.

[0059] In this embodiment, the onboard device determines the corresponding session data frame information from the second target file based on the second offset value in the data backtracking request, and determines whether the 5-tuple information corresponding to the session data frame information determined from the second target file is consistent with the 5-tuple information of the target network session corresponding to the data backtracking request. If they are consistent, the session data frame information determined from the second target file is used as the target session data frame information corresponding to the data backtracking request.

[0060] Step S15: Determine the corresponding target network data frame from the first target file based on the first offset value set in the target session data frame information, and send the target network data frame to the data requesting end.

[0061] In this embodiment, the onboard device determines the corresponding target network data frame from the first target file based on the first offset value set in the target session data frame information, and sends the target network data frame to the data requesting end to realize the backtracking of the original network data frame.

[0062] For example Figure 3As shown, the data requester determines the location information of the session data frame corresponding to the target network session from the session log based on the target network session corresponding to the network data frame to be traced back. Based on the location information of the session data frame, a data tracing request is constructed and sent to the onboard equipment. The onboard equipment then reads the session data frame information from the data frame index file according to the location information of the session data frame in the data tracing request. In turn, it reads the original network data frame in the PCAP file according to the data frame location information in the session data frame information and returns the original network data frame to the data requester.

[0063] As shown above, this embodiment directly writes network data frames into the first target file in the order of reception, synchronously recording the offset value of each data frame in the file, avoiding resource consumption caused by complex reassembly and caching. Based on the network session to which the data frame belongs, the session data frame information corresponding to different network sessions is determined according to the offset value set of data frames under different network sessions. The session data frame information is written into the second target file, and the second offset value of the session data frame information in the second target file is recorded. A session log is generated based on the second offset value of the session data frame information in the second target file. When the data requester initiates a backtracking request based on the session log, the onboard system can quickly locate the position of the original network data frame in the first target file through the second offset value in the backtracking request, achieving efficient backtracking through a three-level indexing mechanism.

[0064] See Figure 4 As shown in the figure, this application discloses a method for storing and backtracking data in a spaceborne network, applied to the data demand side, including:

[0065] Step S21: Obtain the session logs sent by the onboard equipment.

[0066] Step S22: Determine the target network session corresponding to the network data frame that needs to be traced back, and determine the second offset value of the target session data frame information corresponding to the target network session in the second target file from the session log.

[0067] Step S23: Generate a data backtracking request based on the second offset value, and send the data backtracking request to the onboard device so that the onboard device can determine the corresponding target network data frame according to the data backtracking request.

[0068] Step S24: Receive the target network data frame returned by the spaceborne equipment to realize the backtracking of the target network data frame.

[0069] In this embodiment, after receiving the target network data frame returned by the spaceborne device, the method may further include: performing integrity verification on the target network data frame; if the verification result indicates that the verification failed, then regenerating the data backtracking request and sending it to the spaceborne device based on the corresponding five-tuple information and the second offset value in the session log.

[0070] For more detailed processing procedures of steps S21, S22, S23, and S24, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0071] As can be seen from the above, this embodiment ensures high-speed storage of network data under low resource conditions, provides basic storage and backtracking functions for threat identification and attack research of spaceborne equipment under limited resource requirements, and improves the overall risk identification and monitoring capabilities of satellite networks.

[0072] See Figure 5 As shown in the embodiments, this application also discloses a spaceborne network data storage and tracing device, applied to spaceborne equipment, including:

[0073] The first offset value determination module 11 is used to write the acquired network data frames into a first target file and determine the first offset value corresponding to each network data frame; the first offset value is the offset value of the network data frame in the first target file.

[0074] The second offset value determination module 12 is used to determine the network session corresponding to the network data frame, determine the session data frame information corresponding to different network sessions based on the first offset value of the network data frame corresponding to different network sessions, write the session data frame information into a second target file, and determine the second offset value corresponding to the session data frame information respectively; the session data frame information includes a set of first offset values ​​of the network data frames corresponding to the network session; the second offset value is the offset value of the session data frame information in the second target file;

[0075] The log sending module 13 is used to save the session information and second offset value corresponding to different network sessions to the session log, and send the session log to the data request end so that the data request end can send a data backtracking request based on the session log;

[0076] Request receiving module 14 is used to receive a data backtracking request sent by the data requesting end, and determine the corresponding target session data frame information from the second target file according to the second offset value in the data backtracking request;

[0077] The data frame sending module 15 is used to determine the corresponding target network data frame from the first target file based on the first offset value set in the target session data frame information, and send the target network data frame to the data requesting end.

[0078] In some specific embodiments, the first offset value determination module 11 includes:

[0079] The data writing unit is used to write the acquired network data frames into a PCAP file in the order of receipt, and to determine the starting position of each network data frame in the PCAP file during the writing process, and to use the starting position as the first offset value of the network data frame in the PCAP file.

[0080] In some specific embodiments, the second offset value determination module 12 includes:

[0081] The session determination unit is used to determine the network session to which each network data frame belongs based on the five-tuple information corresponding to the network data frame; the five-tuple information includes source IP address, destination IP address, source port number, destination port number, and transport protocol type;

[0082] The information construction unit is used to organize the first offset values ​​corresponding to all network data frames under any network session for any network session to determine the corresponding first offset value set, and construct the session data frame information corresponding to any network session based on the any network session and the corresponding first offset value set.

[0083] In some specific embodiments, the log sending module 13 includes:

[0084] The information determination unit is used to determine, for any network session, the second offset value of the five-tuple information, session time information, alarm information and the corresponding session data frame information in the second target file.

[0085] The recording and saving unit is used to generate a corresponding session record in the second target file according to a preset format and based on the second offset value of the five-tuple information, session time information, alarm information and corresponding session data frame information corresponding to any network session in the second target file, and save the session record corresponding to any network session to the session log.

[0086] In some specific embodiments, the request receiving module 14 includes:

[0087] The judgment unit is used to determine the corresponding session data frame information from the second target file based on the second offset value in the data backtracking request, and to determine whether the five-tuple information corresponding to the session data frame information determined from the second target file is consistent with the five-tuple information of the target network session corresponding to the data backtracking request.

[0088] The processing unit is configured to, if consistent, use the session data frame information determined from the second target file as the target session data frame information corresponding to the data backtracking request.

[0089] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0090] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the spaceborne network data storage and backtracking method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0091] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0092] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0093] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the spaceborne network data storage and traceback method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0094] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed method for storing and backtracking data on a spaceborne network. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0095] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0096] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0097] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0098] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0099] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for data storage and backtracking in a spaceborne network, characterized in that, Applications in spaceborne equipment, including: The acquired network data frames are written into a first target file, and a first offset value is determined for each network data frame; the first offset value is the offset value of the network data frame in the first target file. The network session corresponding to the network data frame is determined. Based on the first offset value of the network data frame corresponding to different network sessions, the session data frame information corresponding to different network sessions is determined. The session data frame information is written into a second target file, and the second offset value corresponding to the session data frame information is determined. The session data frame information includes a set of first offset values ​​of the network data frames corresponding to the network session. The second offset value is the offset value of the session data frame information in the second target file. The session information and second offset value corresponding to different network sessions are saved to the session log, and the session log is sent to the data request end so that the data request end can send a data backtracking request based on the session log; Receive a data backtracking request sent by the data requesting end, and determine the corresponding target session data frame information from the second target file according to the second offset value in the data backtracking request; Based on the first offset value set in the target session data frame information, the corresponding target network data frame is determined from the first target file, and the target network data frame is sent to the data requesting end.

2. The spaceborne network data storage and backtracking method according to claim 1, characterized in that, The step of writing the acquired network data frames into the first target file and determining the first offset value corresponding to each network data frame includes: The acquired network data frames are written into the PCAP file in the order of receipt, and the starting position of each network data frame in the PCAP file is determined during the writing process. The starting position is used as the first offset value of the network data frame in the PCAP file.

3. The spaceborne network data storage and backtracking method according to claim 1, characterized in that, The step of determining the network session corresponding to the network data frame, and determining the session data frame information corresponding to different network sessions based on the first offset value of the network data frames corresponding to different network sessions, includes: The network session to which each network data frame belongs is determined based on the five-tuple information corresponding to the network data frame; the five-tuple information includes source IP address, destination IP address, source port number, destination port number, and transport protocol type; For any network session, the first offset values ​​corresponding to all network data frames under the network session are sorted out to determine the corresponding first offset value set, and the session data frame information corresponding to the network session is constructed based on the network session and the corresponding first offset value set.

4. The spaceborne network data storage and backtracking method according to claim 3, characterized in that, The step of saving the session information and second offset value corresponding to different network sessions to the session log includes: For any network session, determine the second offset value of the five-tuple information, session time information, alarm information and corresponding session data frame information of the network session in the second target file; According to the preset format, and based on the second offset value of the five-tuple information, session time information, alarm information and the corresponding session data frame information of any network session in the second target file, a corresponding session record is generated, and the session record corresponding to any network session is saved to the session log.

5. The spaceborne network data storage and backtracking method according to claim 3, characterized in that, The step of determining the corresponding target session data frame information from the second target file based on the second offset value in the data backtracking request includes: Based on the second offset value in the data backtracking request, the corresponding session data frame information is determined from the second target file, and it is determined whether the five-tuple information corresponding to the session data frame information determined from the second target file is consistent with the five-tuple information of the target network session corresponding to the data backtracking request. If they match, the session data frame information determined from the second target file will be used as the target session data frame information corresponding to the data backtracking request.

6. A method for data storage and backtracking in a spaceborne network, characterized in that, Applied to the data demand side, including: Obtain the session logs sent by the onboard equipment; Determine the target network session corresponding to the network data frame that needs to be traced back, and determine the second offset value of the target session data frame information corresponding to the target network session in the second target file from the session log; A data backtracking request is generated based on the second offset value, and the data backtracking request is sent to the onboard equipment so that the onboard equipment can determine the corresponding target network data frame according to the data backtracking request; Receive the target network data frame returned by the onboard equipment to realize the backtracking of the target network data frame.

7. The spaceborne network data storage and backtracking method according to claim 6, characterized in that, After receiving the target network data frame returned by the spaceborne equipment, the method further includes: Integrity verification is performed on the target network data frame. If the verification result indicates that the verification has failed, a data backtracking request is regenerated and sent to the onboard device based on the corresponding five-tuple information and the second offset value in the session log.

8. A spaceborne network data storage and retrieval device, characterized in that, Applications in spaceborne equipment, including: The first offset value determination module is used to write the acquired network data frames into a first target file and determine the first offset value corresponding to each network data frame; the first offset value is the offset value of the network data frame in the first target file. The second offset value determination module is used to determine the network session corresponding to the network data frame, determine the session data frame information corresponding to different network sessions based on the first offset value of the network data frame corresponding to different network sessions, write the session data frame information into a second target file, and determine the second offset value corresponding to the session data frame information respectively; the session data frame information includes a set of first offset values ​​of network data frames corresponding to the network session; the second offset value is the offset value of the session data frame information in the second target file; The log sending module is used to save the session information and second offset value corresponding to different network sessions to the session log, and send the session log to the data request end so that the data request end can send a data backtracking request based on the session log; The request receiving module is used to receive a data backtracking request sent by the data requesting end, and determine the corresponding target session data frame information from the second target file according to the second offset value in the data backtracking request. The data frame sending module is used to determine the corresponding target network data frame from the first target file based on the first offset value set in the target session data frame information, and send the target network data frame to the data requesting end.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the spaceborne network data storage and backtracking method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the spaceborne network data storage and retrieval method as described in any one of claims 1 to 7.

Images