Data processing method, device and equipment of security and protection monitoring system and storage medium

Abstract

The invention relates to a data processing method and device of a security monitoring system, equipment and a storage medium. The method comprises the following steps: acquiring an initial data packet set obtained by performing network packet capture on a security and protection monitoring system; desensitizing the network layer address of each initial data packet in the initial data packet set to obtain a first desensitized data packet set; for each first desensitized data packet in the first desensitized data packet set, desensitizing the first desensitized data packet based on the load type of the first desensitized data packet to obtain a second desensitized data packet set; and sending the second desensitized data packet set to a cloud server. By adopting the method, the data security and privacy can be guaranteed.

Description

Technical Field

[0001] This application relates to the field of cloud-native security video surveillance technology, and in particular to a data processing method, apparatus, equipment and storage medium for a security monitoring system. Background Technology

[0002] Security monitoring systems are networked systems designed to maintain public safety, comprehensively utilizing technologies such as audio and video acquisition, transmission, control, and display. Currently, networked and cloud-based security monitoring systems are widely used in smart cities, traffic management, park security, and other fields. They typically include front-end acquisition devices, network transmission modules, edge processing units, and a cloud management platform. During operation, they can generate and transmit various types of business data, including but not limited to device status information, control commands, configuration parameters, and real-time audio and video media content.

[0003] Acquiring and analyzing network data plays a crucial role in the deployment, operation, and troubleshooting of security monitoring systems. For example, during system integration testing, it's necessary to verify the correctness of signaling interaction processes; in daily maintenance, it's essential to monitor network transmission quality and equipment online status; and when faults such as video interruptions or control malfunctions occur, capturing and analyzing data packets is necessary to pinpoint the root cause. All of these scenarios rely on capturing and processing the actual communication data of the security monitoring system. However, current methods of directly acquiring and transmitting network data from security monitoring systems present significant privacy and security vulnerabilities. Summary of the Invention

[0004] Therefore, it is necessary to provide a data processing method, device, equipment, and storage medium for a security monitoring system that can ensure data security, addressing the aforementioned technical problems.

[0005] Firstly, this application provides a data processing method for a security monitoring system, including:

[0006] Obtain the initial set of data packets obtained from network packet capture targeting the security monitoring system;

[0007] The network layer addresses of each initial data packet in the initial data packet set are de-identified to obtain the first de-identified data packet set;

[0008] For each first de-identified data packet in the first de-identified data packet set, the first de-identified data packet is de-identified based on the payload type of the first de-identified data packet to obtain a second de-identified data packet set;

[0009] Send the second set of de-identified data packets to the cloud server.

[0010] In one embodiment, the step of de-identifying each first de-identified data packet in the first de-identified data packet set based on the payload type of the first de-identified data packet to obtain a second de-identified data packet set includes:

[0011] For each of the first de-identified data packets, if the payload type of the first de-identified data packet is a signaling interaction type, the field value of the preset field in the first de-identified data packet is replaced with the de-identified value corresponding to the field value to obtain the second de-identified data packet in the second de-identified data packet set.

[0012] In one embodiment, the preset field is a field in the signaling header field of the first de-identified data packet, and the preset field includes at least one of a route tracing field, an identity field, and a device attribute field.

[0013] In one embodiment, the preset field is a field in the signaling message body of the first de-identified data packet, and the preset field includes at least one of the following: device identifier field, device attribute field, network address field, authentication field, and location information field.

[0014] In one embodiment, replacing the field value of a preset field in the first de-identified data packet with the de-identified value corresponding to that field value includes:

[0015] In the preset desensitization mapping relationship, if there is a desensitized value that matches the field value of the preset field, the field value is replaced with the desensitized value;

[0016] In the preset desensitization mapping relationship, if there is no desensitized value that matches the field value of the preset field, a desensitized value that matches the preset field is generated based on the preset generation rules, and the field value is replaced with the desensitized value.

[0017] In one embodiment, the step of de-identifying each first de-identified data packet in the first de-identified data packet set based on the payload type of the first de-identified data packet to obtain a second de-identified data packet set includes:

[0018] For each of the first de-identified data packets, if the payload type of the first de-identified data packet is streaming media, the video frame data of the first de-identified data packet is obtained; the video frame data includes video content data and encoding parameter data corresponding to the video content data;

[0019] For each of the first de-identified data packets, the video content data in the first de-identified data packet is replaced with blank content data to obtain the second de-identified data packet in the second de-identified data packet set.

[0020] In one embodiment, the step of de-identifying the network layer addresses of each initial data packet in the initial data packet set to obtain a first de-identified data packet set includes:

[0021] Extract the Internet Protocol address and Media Access Control address from each of the initial data packets;

[0022] The Internet Protocol address is replaced with a preset pseudo Internet Protocol address, and the Media Access Control address is replaced with a preset pseudo Media Access Control address to obtain the first de-identified data packet set.

[0023] In one embodiment, the first host applied at the edge end, the step of acquiring the initial set of data packets obtained by network packet capture targeting the security monitoring system includes:

[0024] In response to a diagnostic request for the security monitoring system, a main packet capture task instruction is sent to the target packet capture agent in the second host; the diagnostic request includes the object to be diagnosed and the content information to be diagnosed; the main packet capture task instruction includes the communication session address corresponding to the diagnostic request and the content information to be diagnosed; the communication session address is used to characterize the network address of the communication link related to the content information to be diagnosed, which is participated in by the object to be diagnosed.

[0025] The system receives the initial data packet set corresponding to the main packet capture task sent by the target packet capture agent running on the second host; the initial data packet set corresponding to the main packet capture task is determined by the target packet capture agent of the second host in response to the main packet capture task instruction.

[0026] In one embodiment, the method further includes:

[0027] Receive a sub-capture request from the target packet capture agent in the second host; the sub-capture request includes a push stream address and a receive stream address; the push stream address and the receive stream address are identified by the target packet capture agent in the second host in the signaling interaction data packet carrying the invitation session keyword;

[0028] In response to the sub-packet capture request, a sub-packet capture task instruction is sent to the target packet capture agent in the corresponding third host based on the push address and the receive address;

[0029] The system receives the initial data packet set corresponding to the sub-capture task sent by the target packet capture agent running on the third host; the initial data packet set corresponding to the sub-capture task is determined by the target packet capture agent of the third host in response to the sub-capture task instruction.

[0030] In one embodiment, the second host applied at the edge end, the step of acquiring the initial set of data packets obtained by network packet capture targeting the security monitoring system includes:

[0031] The system receives a main packet capture task instruction from the edge diagnostic service in the first host at the edge end. The main packet capture instruction is generated by the edge diagnostic service in response to a diagnostic requirement for the security monitoring system. The diagnostic requirement includes an object to be diagnosed and information about the content to be diagnosed. The packet capture task instruction includes the communication session address corresponding to the diagnostic requirement and the information about the content to be diagnosed. The communication session address is used to characterize the network address of the communication link related to the information about the content to be diagnosed, in which the object to be diagnosed participates. In response to the main packet capture task instruction, the system obtains the set of raw data packets corresponding to the diagnostic requirement based on the communication session address.

[0032] Based on the specified session type corresponding to the content information to be diagnosed, an initial data packet set is extracted from the original data packet set; the initial data packet set includes signaling interaction data packets and / or streaming media data packets that match the specified session type;

[0033] Send the initial set of data packets corresponding to the main packet capture task to the edge diagnostic service in the first host.

[0034] In one embodiment, the method further includes:

[0035] If the signaling interaction data packet contains a stream invitation session keyword, obtain the session description information of the signaling interaction data packet;

[0036] Extract the push stream address and receive stream address from the session description information;

[0037] Send a sub-packet capture request to the edge diagnostic service in the first host; the sub-packet capture request includes the push address and the receive address.

[0038] Secondly, this application also provides a data processing device for a security monitoring system, comprising:

[0039] The data acquisition module is used to acquire the initial set of data packets obtained by network packet capture for the security monitoring system.

[0040] The first desensitization module is used to desensitize the network layer address of each initial data packet in the initial data packet set to obtain the first desensitized data packet set.

[0041] The second desensitization module is used to desensitize each first desensitized data packet in the first desensitized data packet set based on the payload type of the first desensitized data packet, to obtain the second desensitized data packet set.

[0042] The data sending module is used to send the second set of de-identified data packets to the cloud server.

[0043] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the data processing method of the security monitoring system provided in the first aspect of this application.

[0044] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the data processing method of the security monitoring system provided in the first aspect of this application.

[0045] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the data processing method for the security monitoring system provided in the first aspect of this application.

[0046] The aforementioned data processing method, apparatus, equipment, and storage medium for the security monitoring system obtains an initial set of data packets from network packet capture targeting the security monitoring system. The network layer addresses of each initial data packet in the initial set are anonymized to obtain a first set of anonymized data packets. For each first anonymized data packet in the first set, anonymization is performed based on its payload type to obtain a second set of anonymized data packets, which is then sent to the cloud server. This application, by constructing a layered and progressive anonymization mechanism, can remove sensitive information from the original packet capture data while preserving the network communication structure and protocol interaction characteristics. This effectively prevents the leakage of critical privacy data such as user network topology, device identification, and audio / video content during remote diagnosis, ensuring compliance with data security regulations. Furthermore, by maintaining the protocol integrity and temporal correlation of data packets, it provides a high-quality data foundation for accurate network fault diagnosis and performance analysis in the cloud, thus achieving an effective balance between ensuring data security and improving operational efficiency. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1This is an application environment diagram of a data processing method for a security monitoring system in one embodiment;

[0049] Figure 2 This is a flowchart illustrating a data processing method for a security monitoring system in one embodiment;

[0050] Figure 3 This is a schematic diagram of the process for obtaining the first de-identified data packet set in one embodiment;

[0051] Figure 4 This is a schematic diagram of the process for obtaining the second de-identified data packet set in one embodiment;

[0052] Figure 5 This is a schematic diagram of the architecture of a security monitoring system in one embodiment;

[0053] Figure 6 This is a timing diagram of a data processing method for a security monitoring system in one embodiment;

[0054] Figure 7 This is a structural block diagram of the data processing device of a security monitoring system in one embodiment;

[0055] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0058] First, the relevant terms or concepts in the embodiments of this application will be explained:

[0059] GB / T28181: The full name is "Technical Requirements for Information Transmission, Exchange and Control of Security Video Surveillance Network System". It is a security monitoring technology requirement, specifically a control protocol based on SIP (Session Initialization Protocol).

[0060] Front-end equipment: network IP cameras (IPC), network video recorders (NVR), security monitoring platforms, etc.

[0061] SIP (Session Initiation Protocol) is a communication protocol used to establish, modify, and terminate multimedia sessions. It is commonly used in VoIP and real-time communication applications such as voice calls, video calls, and instant messaging.

[0062] Signaling service: The signaling service plays a crucial role in the GB / T28181 standard. It is responsible for communication and control between video surveillance devices, ensuring that these devices can network and work collaboratively. The signaling service can be understood as the communication control center in a video surveillance system, responsible for managing and coordinating the networking of various monitoring devices.

[0063] Streaming media service: Streaming media service plays an important role in the GB / T28181 standard. It is responsible for receiving, forwarding and storing real-time media data, as well as accessing and forwarding historical media data.

[0064] BPF (Berkeley Packet Filter): It is a filtering mechanism used to filter out packets that the user is interested in when capturing packets.

[0065] The Data Security Law clarifies the obligations and responsibilities of relevant entities to conduct data activities in accordance with laws and regulations, establish and improve data security management systems, strengthen risk monitoring, and promptly handle data security incidents. This law aims to promote the healthy development of the digital economy, fully leverage the fundamental resource and innovation engine role of data by regulating data activities, and better serve my country's economic and social development.

[0066] GDPR: The General Data Protection Regulation (GDPR) is a regulation of the European Union.

[0067] The data processing method for the security monitoring system provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, edge device 102 communicates with cloud server 104 via the network. Edge device 102 also communicates with front-end devices of the security monitoring system via the network, such as the intranet environment where user cameras and other front-end devices are located. Edge device 102 can obtain the initial data packet set obtained by network packet capture targeting the security monitoring system, perform de-identification processing on the initial data packet set, and then send the de-identified data packet set to the cloud server.

[0068] The edge device 102 can be, but is not limited to, hardware devices or software services with computing and networking capabilities deployed on the user side, such as intelligent network video recorders (NVRs), security-specific edge computing gateways, switches with integrated computing modules, or edge computing platforms deployed on the user's local server. The edge device 102 can connect to multiple local networks, including signaling and streaming media services, and is responsible for managing and processing data from various local devices. For example, cameras register with edge nodes, and the edge nodes process and store data, ensuring data privacy and security on the client side. The cloud server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud-native services, big data analytics, or artificial intelligence diagnostic capabilities.

[0069] In one exemplary embodiment, such as Figure 2 As shown, a data processing method for a security monitoring system is provided, which is applied to... Figure 1 Taking edge 102 as an example, the explanation includes steps 202 to 206. Wherein:

[0070] Step 202: Obtain the initial set of data packets obtained by network packet capture targeting the security monitoring system.

[0071] The initial data packet set can refer to the set of network transmission data packets that meet preset filtering conditions and are captured by monitoring the internal network communication links of the security monitoring system. It can record the signaling interaction and media stream transmission process between devices.

[0072] For example, the edge device can obtain an initial set of data packets by actively probing or passively monitoring network traffic. For instance, this can be achieved by deploying a data mirroring port at a critical network node to replicate and forward all data packets flowing through that node; or by a software agent running on the monitoring device itself or a dedicated hardware probe, selectively capturing data packets based on assigned task rules (such as target IP address, port number, and protocol type).

[0073] In this embodiment, the data packet for a security monitoring system can refer to a data unit transmitted within the security monitoring network, and may include signaling interaction data packets for device control and session management, as well as streaming media data packets for transmitting real-time audio and video content. The signaling interaction data packets can be used to carry system control commands and status information, while the streaming media data packets can be used to encapsulate encoded and compressed audio and video frame data.

[0074] Step 204: De-identify the network layer addresses of each initial data packet in the initial data packet set to obtain the first de-identified data packet set.

[0075] Network layer addresses refer to the core identifiers for data packets in network routing and addressing, and may include, but are not limited to, IP addresses and MAC addresses. De-identification refers to the process of irreversibly or reversibly replacing sensitive addresses using pseudo-identifiers with no business meaning.

[0076] For example, the edge device traverses each data packet in the initial data packet set, parses its network layer header, and searches for the pseudo address corresponding to each network layer address that needs to be de-identified in a pre-configured de-identification mapping table. If the address does not exist in the de-identification mapping table, a corresponding pseudo address is generated according to preset rules, and a mapping relationship is established between the newly generated pseudo address and the network layer address that needs to be de-identified. The edge device uses this pseudo address to replace the original address in the data packet, ensuring that the same original address is replaced with the same pseudo address in all data packets. This removes the real network topology information while preserving the communication correlation between data packets for analysis.

[0077] Step 206: For each first de-identified data packet in the first de-identified data packet set, perform de-identification processing on the first de-identified data packet based on the payload type of the first de-identified data packet to obtain the second de-identified data packet set.

[0078] The payload type refers to the specific application layer protocol type carried in the payload portion of the data packet, such as the SIP protocol payload used in signaling interaction types, or the RTP / RTCP protocol payload used in streaming media types. In this embodiment, after de-identifying the network layer address of the initial data packet, the application layer data of the first de-identified data packet undergoes further de-identification processing.

[0079] For example, the edge device iterates through each of the first de-identified data packets in the first de-identified data packet set, parses its transport layer header to determine its payload type (e.g., determining whether it is SIP signaling or RTP media stream by the port number). For different payload types, the edge device invokes the corresponding de-identification policy.

[0080] For example, if the payload is a signaling interaction type of data packet (such as SIP messages), the edge device can identify and desensitize sensitive information included in the payload, such as terminal device ID, registered user credentials, and call ID, to ensure that the signaling content does not reveal the real identity and session details. If the payload is a streaming media type of data packet (such as RTP / RTCP), the edge device can selectively perform desensitization processing on sensitive frames according to policies, such as encryption, randomization padding, or direct deletion, to eliminate identifiable audio and video content while preserving traffic characteristics to the greatest extent.

[0081] Step 208: Send the second set of de-identified data packets to the cloud server.

[0082] For example, after receiving the second set of de-identified data packets, the server can import them into a big data analysis platform or an artificial intelligence diagnostic platform for data processing and analysis such as network traffic anomaly detection, device status prediction, or system health diagnosis.

[0083] In the data processing method of the aforementioned security monitoring system, an initial set of data packets obtained by capturing network packets for the security monitoring system is acquired. The network layer addresses of each initial data packet in the initial set are then anonymized to obtain a first set of anonymized data packets. For each first anonymized data packet in the first set, anonymization is performed based on its payload type to obtain a second set of anonymized data packets. This second set of anonymized data packets is then sent to the cloud server. This embodiment of the application, by constructing a layered and progressive anonymization mechanism, can remove sensitive information from the original captured packet data while preserving the network communication structure and protocol interaction characteristics. This not only effectively prevents the leakage of key privacy data such as user network topology, device identification, and audio / video content during remote diagnosis, ensuring compliance with data security regulations, but also provides a high-quality data foundation for accurate network fault diagnosis and performance analysis in the cloud by maintaining the protocol integrity and temporal correlation of data packets. Thus, an effective balance is achieved between ensuring data security and improving operational efficiency.

[0084] It is understandable that after the edge device obtains the initial data packet set of the security monitoring system based on processing needs, it parses the structure and payload content of the initial data packets one by one, and performs general network layer desensitization, signaling payload desensitization or streaming media payload desensitization according to the data packet protocol type and application layer characteristics.

[0085] The following explains the general de-identification method, namely the de-identification processing of network layer addresses.

[0086] In one exemplary embodiment, such as Figure 3 As shown, step 204 includes steps 302 and 304. Wherein:

[0087] Step 302: Extract the Internet Protocol address and Media Access Control address from each initial data packet.

[0088] Among them, the Internet Protocol address is the network layer address used to identify the logical location of a network device, which can include a source address and a destination address. The Media Access Control address is the link layer address used to identify the physical identity of a network device, which can also include a source address and a destination address.

[0089] For example, after obtaining the initial set of data packets, the edge device reads the initial data packets one by one using a packet parsing library. For each initial data packet, the server parses its Ethernet frame header to extract the source MAC address and destination MAC address; then it parses its IP packet header to extract the source IP address and destination IP address.

[0090] Step 304: Replace the Internet Protocol address with a preset pseudo Internet Protocol address and replace the Media Access Control address with a preset pseudo Media Access Control address to obtain the first set of de-identified data packets.

[0091] In this context, pseudo-Internet Protocol addresses and pseudo-Media Access Control addresses refer to alternative identifiers that are randomly generated according to the corresponding address format specifications or mapped according to preset rules, and have no corresponding relationship with the real network environment. Pseudo-addresses can logically maintain uniqueness and consistency to ensure the continuity of communication sessions.

[0092] For example, extract the original IP address and original MAC address from the network layer, and randomly generate new pseudo IP and pseudo MAC addresses. Write the original IP address and pseudo IP address as key-value pairs into the de-identification dictionary, and write the original MAC address and pseudo MAC address as key-value pairs into the de-identification dictionary. Replace the original IP address with the pseudo IP address and replace the original MAC address with the pseudo MAC address.

[0093] In this embodiment, by replacing the network layer identification information in the data packet, the real network topology information and device hardware identification contained in the original data packet can be effectively stripped away. This not only eliminates the risk of network structure exposure caused by IP address and MAC address leakage, but also ensures that the communication correlation between data packets after desensitization is preserved by maintaining the consistency of the address replacement rules, thus providing a usable and secure data foundation for subsequent network protocol analysis and fault diagnosis.

[0094] The following explains the desensitization process for the first desensitized data packet when the payload type is signaling interaction type.

[0095] In an exemplary embodiment, step 206 includes: for each first de-identified data packet, if the payload type of the first de-identified data packet is a signaling interaction type, replacing the field value of a preset field in the first de-identified data packet with the de-identified value corresponding to the field value, so as to obtain the second de-identified data packet in the second de-identified data packet set.

[0096] Among them, signaling interaction type can refer to the message type whose data packet payload conforms to the specifications of a specific signaling protocol (such as SIP protocol) and is used to carry system control commands and status interaction information. Preset field can refer to the field attribute name in the signaling message that is identified as needing to be de-identified according to data security specifications and privacy protection requirements. De-identified value can refer to alternative data that is not directly related to the original field value of the preset field, used to hide the real information while maintaining the validity of data format and protocol specifications.

[0097] In one possible implementation, replacing the field value of a preset field in the first desensitized data packet with the corresponding desensitized value includes: if a desensitized value matching the field value of the preset field exists in the preset desensitization mapping relationship, replacing the field value with the desensitized value; if no desensitized value matching the field value of the preset field exists in the preset desensitization mapping relationship, generating a desensitized value matching the preset field based on preset generation rules, and replacing the field value with the desensitized value.

[0098] For example, after obtaining the first set of de-identified data packets by completing general network layer de-identification, the edge device performs application layer protocol identification on each data packet in the set. When the payload of a data packet is identified as a signaling interaction type, its signaling message structure is parsed. Based on a predefined signaling de-identification strategy, the edge device locates preset fields in the signaling header and message body (such as header fields like Via, From, To, Contact, etc., and message body fields like DeviceID, Name, Address, etc.), queries preset de-identification mapping relationships (such as a locally maintained de-identification dictionary), obtains the de-identified value corresponding to the field value, and replaces it. If the de-identification dictionary does not contain a mapping for a certain original field value, a new de-identified value is generated according to the rules and replaced, and the mapping relationship between the original field value and the de-identified value is recorded in the dictionary to ensure that the same original field value can be replaced with the same de-identified value in all data packets.

[0099] In one possible implementation, the preset field can be a field in the signaling header field of the first de-identified data packet, and the preset field may include at least one of the following: a route tracing field, an identity field, and a device attribute field.

[0100] The signaling header field can refer to the structured data area contained in the beginning part of the first de-identified data packet, i.e., the signaling interaction data packet, used to control message routing, identify the communicating parties, and describe session attributes. Routing trace fields (such as the Via header field) can be used to record the path information traversed by the message; identification fields (such as From and To header fields) can be used to identify the initiator and receiver of the session; and device attribute fields (such as the User-Agent header field) can be used to describe the software and hardware characteristics of the terminal device.

[0101] For example, when parsing the signaling header field, the edge device replaces the IP address and port number of the routing path recorded in the Via header field with the corresponding pseudo address from the de-identification dictionary; for the Uniform Resource Identifier contained in the From and To header fields, it extracts the user identifier and domain name portion for de-identification, for example, replacing the real national standard device ID with a pseudo ID that conforms to the same encoding rules; for the User-Agent header field, it can be replaced entirely with a task identifier related to this packet capture task to remove device feature information.

[0102] In one possible implementation, the preset field can be a field in the signaling message body of the first de-identified data packet. The preset field may include at least one of the following: device identifier field, device attribute field, network address field, authentication field, and location information field.

[0103] The signaling message body refers to the data portion of a signaling message that follows the header field and carries specific control content or device description information. It is typically organized in a specific format (such as XML). Device identification fields (such as Device ID) can be used to represent the unique identifier of the device; device attribute fields (such as Name, Manufacturer) can be used to describe static information such as the device's name and model; network address fields can be used to record the IP address and port required for device communication; authentication fields (such as Username, Password) can be used to indicate authentication credentials; and location information fields (such as Longitude, Latitude) can be used to describe the physical deployment location of the device.

[0104] For example, when parsing the signaling message body, the edge device locates the aforementioned sensitive preset fields based on predefined XML tag paths or keywords. For device identifier and attribute fields, pseudo-identifiers and pseudo-attributes from the de-identification dictionary can be used for replacement; for authentication fields, they are replaced with random strings that have no practical meaning; for location information fields, they can be replaced with coordinates generated by random offsets within a reasonable range. All replacement operations ensure that the overall structure and syntactic validity of the message body are not compromised.

[0105] For example, the first de-identified data packet is a signaling interaction data packet conforming to RFC3261, which includes a signaling header field (Header part) and a signaling message body (Body part).

[0106] For the Header section, the main focus is on anonymizing preset fields such as Uri, Via, From, To, Contact, and User-agent. For example, the national standard ID information is extracted, and a replacement rule is searched in the anonymization dictionary. If a rule exists, it is directly replaced; otherwise, a pseudo-national standard ID is regenerated according to the national standard ID generation rules, keeping the device type identifier bits (11th to 13th bits) unchanged. Finally, this pseudo-ID is written as a key-value pair into the anonymization dictionary, replacing the original field. Similarly, the IP address and domain information are extracted, and a replacement rule is searched in the anonymization dictionary. If a rule exists, it is directly replaced; otherwise, a pseudo-IP and domain are regenerated according to the IP address and domain generation rules. Finally, this pseudo-IP and domain are written as key-value pairs into the anonymization dictionary, replacing the original field. Finally, the User-agent field is extracted and replaced with the task identifier for this packet capture for easy tracking.

[0107] The Body section is in XML format. Based on the definition of signaling control content, the following tags are primarily replaced, with the replacement logic being the same as the Header. These include various identifiers (such as Device ID, Civil Code ID, Parent ID, Business Group ID), device attributes (such as Name, Model, Address, Manufacturer), device IP address and port information (commonly found in Session Description Information (SDP) or device details push notifications), device username and password (some national standard devices will carry Username and Password fields in the signaling message for authentication), and device location information (such as Location, Position, Latitude, Longitude, MobilePosition).

[0108] In this embodiment, by performing field-level anonymization on the application layer payload of signaling messages, core privacy information such as device identity, network configuration, geographic coordinates, and authentication credentials can be eliminated. While preserving the integrity of signaling interaction logic and protocol flow, the possibility of tracing directly from data packets to the real device and specific environment is cut off. This provides a key guarantee for securely handing over data to the cloud for in-depth protocol analysis, and achieves a balance between privacy protection and operational efficiency.

[0109] The following explains the desensitization process for streaming media data packets when the payload type of the first desensitized data packet is streaming media.

[0110] In one exemplary embodiment, such as Figure 4 As shown, step 206 includes steps 402 and 404. Wherein:

[0111] Step 402: For each first de-identified data packet, if the payload type of the first de-identified data packet is streaming media, obtain the video frame data of the first de-identified data packet.

[0112] In this context, "streaming media type" refers to data packets whose payloads encapsulate encoded audio and video data transmitted using streaming media protocols such as real-time transmission protocols. Video frame data includes video content data and encoding parameter data. Video content data refers to the actual pixel data that has been compressed and encoded, representing specific image information. Encoding parameter data refers to metadata embedded in the video stream, used to define decoding rules such as frame type, resolution, and encoding format.

[0113] For example, after identifying the first de-identified data packet as a streaming media type, the edge device keeps its RTP header and other transmission information unchanged, and only parses its payload, i.e., the video frame data. Based on the video encoding format specified in the payload, it separates the encoding parameter data and the video content data that depends on these parameters from the payload data.

[0114] Step 404: For each first de-identified data packet, replace the video content data in the first de-identified data packet with blank content data to obtain the second de-identified data packet in the second de-identified data packet set.

[0115] Blank content data can refer to alternative data generated based on the acquired encoding parameter data, which matches the original video content data in format and size but does not contain any valid visual information.

[0116] For example, the edge device uses the encoding parameter data parsed from the payload of the first de-identified data packet to generate a blank video frame conforming to the same encoding specifications. The original video content data is replaced with this blank content data in the video frame data, while the original encoding parameter data in the payload, as well as the RTP header, IP header, etc., of the entire data packet remain unchanged. The affected checksums at each level are recalculated to ensure the data packet format is valid, thereby forming the second de-identified data packet.

[0117] For example, when the first de-identified data packet is a streaming media type packet, such as an RTP packet, the edge device parses the structure of the RTP packet and extracts the RTP header information and video data portion. RTP packets typically include an RTP header and payload data; the payload data is the video frame data. The edge device replaces the content portion of the video frame data with blank frame data. For H.264 or H.265 encoded video streams, a blank video frame is generated, with the same size and encoding format as the original video frame. Specifically, the resolution and frame rate are kept consistent, ensuring the blank frame's resolution and frame rate are exactly the same as the original frame; the same encoding parameters are used, such as pixel format, bit depth, and encoding configuration, when encoding the blank frame; the encoder settings are kept completely consistent, ensuring the same encoding settings, such as bitrate and GOP structure, are used when encoding the blank frame; and the encoder output is checked, for example, after encoding the blank frame, the size of the generated encoded data is checked, comparing the size of the blank frame's encoded data with that of the original frame to ensure they are completely equal. At the edge, the original RTP header information and the replaced video frame data are used to reconstruct new RTP packets, ensuring that fields such as the sequence number in the RTP header remain unchanged. To retain the original packet loss retransmission capabilities, it's necessary to ensure that the sequence number and other information in the newly generated RTP packets are consistent with the original packets, allowing the receiving end to correctly handle packet loss retransmissions. The processed RTP packets are then repackaged into a new data stream.

[0118] In this embodiment, by replacing the original video content in the first desensitized data packet with blank frame data that is consistent with the original format, it is possible to completely eliminate the visual privacy information contained in the monitoring screen while fully preserving key diagnostic information such as the transmission sequence, encapsulation structure and encoding parameters of the streaming media data packet.

[0119] In practical applications, the entire lifecycle operation and management of security monitoring systems presents various technical needs for acquiring their underlying network communication data. These include remote fault diagnosis for issues such as offline positioning devices, interrupted video streams, and malfunctioning control commands; compliance audits and security forensics to meet industry regulations and internal security policies; system performance monitoring and tuning to analyze system bottlenecks, assess bandwidth usage, and optimize service performance; and dataset collection for training and validating AI-based anomaly detection and behavior analysis algorithms. All these scenarios rely on capturing and analyzing signaling and media stream data during system operation. However, the sensitive information contained in the raw data poses significant privacy and security risks when used directly.

[0120] The following section uses the requirement for fault diagnosis as an example to further illustrate this application.

[0121] In today's digital age, the number of public cloud users is growing rapidly, and they are located all over the world. This widely distributed user base presents significant challenges for the installation, maintenance, and troubleshooting of equipment. Addressing these issues through on-site service, as is the traditional manufacturer approach, would incur substantial time and financial costs. This model not only burdens service providers but could also lead to users experiencing excessively long wait times for equipment repairs, severely impacting the user experience.

[0122] To improve efficiency, current technical methods typically involve local installation and maintenance personnel capturing packets from security monitoring systems and directly transmitting the captured source files to a server via the internet for analysis. However, GB / T28181 is a plaintext packet standard, and its captured packets contain a large amount of sensitive user information, such as the IP address, MAC address, model, name, distribution, detailed location, and even the monitoring footage of the monitoring points. If not properly processed, this sensitive information may be improperly leaked, posing a serious threat to user privacy.

[0123] With the implementation of data security laws, the importance of user data security has become increasingly prominent, making the security of data collection and transmission a serious issue that must be addressed. This requires not only protecting users' privacy from leakage but also ensuring compliance with relevant regulations during data transmission and storage. Traditional packet capture and location methods for security systems, based on the GB / T28181 national standard, are prone to leaking user data and pose significant security risks.

[0124] To protect user system privacy while providing remote technicians with on-site packet capture capabilities, fully leverage the advantages of technical center experts and cloud-edge collaborative diagnostic systems, and effectively and quickly diagnose and resolve GB / T28181 interoperability issues to reduce after-sales maintenance costs and improve user satisfaction, this application provides a security monitoring system. Based on the existing security monitoring system, packet capture proxy services, edge diagnostic services, and cloud-based comprehensive diagnostic services are added from bottom to top, without intruding on the original business architecture.

[0125] In some embodiments, please refer to Figure 5 The local environment of a security monitoring system includes the intranet environment where customer cameras and other devices reside. The edge devices of the security monitoring system can be deployed on the customer side and can connect to multiple local networks. They include signaling and streaming media services, managing and processing data from various local devices. Cameras register with edge nodes, which then process and store the data, ensuring data privacy and security on the customer side. The cloud-based security monitoring system can deploy management services, providing a unified management interface and functions, facilitating customer management of data and storage across various edge nodes, and offering advanced data analytics, alarms, and other value-added services.

[0126] This application embodiment adds an edge diagnostic service at the edge and deploys a packet capture agent on each host of the edge node. After the packet capture agent starts, it automatically registers with the edge diagnostic service and reports the network card information of its host. A comprehensive diagnostic service is deployed in the cloud to receive anonymized packet captures from the edge nodes for result analysis and fault collection.

[0127] In one exemplary embodiment, please refer to the reference Figure 5 and Figure 6 This application also provides a data processing method for a security monitoring system, the method comprising:

[0128] S1, the first host at the edge responds to the diagnostic needs of the security monitoring system by sending the main packet capture task instruction to the target packet capture agent in the second host.

[0129] Diagnostic needs can be triggered manually, such as when maintenance personnel discover system anomalies, like seeing a camera offline, a video stream failing to play, or receiving a system alarm on the cloud management interface. Alternatively, diagnostic needs can be triggered automatically by the system, when intelligent monitoring modules in the cloud or at the edge detect abnormal system indicators, such as a health monitoring system detecting a timeout in a heartbeat packet with a signaling server, or a streaming media service reporting a persistently low bitrate for a certain channel.

[0130] It should be noted that the first host at the edge is configured with an edge diagnostic service, and the second host at the edge is configured with a target packet capture proxy. The first host and the second host can be the same or different.

[0131] In one possible implementation, the edge diagnostic service, in response to a diagnostic request for a security monitoring system, sends a main packet capture task instruction to a target packet capture agent in a second host. The diagnostic request may include information about the object to be diagnosed and the content to be diagnosed. The main packet capture task instruction may include the communication session address corresponding to the diagnostic request and the content to be diagnosed. The communication session address is used to characterize the network address of the communication link related to the content to be diagnosed, which is participated in by the object to be diagnosed.

[0132] For example, the edge diagnostic service issues a packet capture task to the packet capture agent service A based on diagnostic needs. The task includes at least the diagnostic intent content and the communication session address. The communication session address may include the signaling upper-level network address and the signaling lower-level network address, such as the signaling upper-level interaction IP address (UP_IP) and port (UP_PORT), and the signaling lower-level interaction IP address (DOWN_IP) and port (DOWN_PORT).

[0133] S2, the target packet capture agent of the second host responds to the main packet capture task instruction and executes the main packet capture task. During the execution of the main packet capture task, it identifies whether the data packet contains a preset invitation session keyword.

[0134] In one possible implementation, the process of executing the main packet capture task may include: the target packet capture agent of the second host receiving the main packet capture task instruction from the edge diagnostic service of the first host at the edge end, extracting an initial packet set from the original packet set based on the specified session type corresponding to the content to be diagnosed in the main packet capture task instruction; the initial packet set may include signaling interaction packets and / or streaming media packets that match the specified session type; and sending the initial packet set corresponding to the main packet capture task to the edge diagnostic service in the first host.

[0135] For example, the packet capture agent service A of the second host sets up BPF according to the main packet capture task instruction of the upstream edge diagnostic service, and preprocesses the data stream after BPF filtering, performs application layer filtering according to GB / T28181, filters the signaling interaction packets and front-end device push stream packets of the specified session, and packages the packet capture data after the task is completed and passes it to the edge diagnostic service.

[0136] For example, after receiving a packet capture request, the packet capture agent converts the specific captured information into a BPF expression, represented as:

[0137] Capture data packets from parent to child in the parent-child direction: src host UP_IP and src port UP_PORT and dsthost DOWN_IP and dst port DOWN_PORT;

[0138] Capture data packets from lower level to upper level: src host DOWN_IP and src port DOWN_PORT and dst host UP_IP and dst port UP_PORT;

[0139] The above two-way conditions are ORed and used as input to construct the BPF.

[0140] S3, if the target packet capture agent of the second host recognizes the preset invitation session keyword, it reports a sub-packet capture task request to the first host at the edge.

[0141] In one possible implementation, when the target packet capture agent on the second host detects that the signaling interaction data packet includes a stream invitation session keyword, it obtains the session description information of the signaling interaction data packet; from the session description information, it extracts the push stream address and the receive stream address; and sends a sub-packet capture request to the edge diagnostic service on the first host; the sub-packet capture request includes the push stream address and the receive stream address. In response to the sub-packet capture request, the edge diagnostic service sends a sub-packet capture task instruction to the target packet capture agent on the corresponding third host based on the push stream address and the receive stream address; the edge diagnostic service receives the initial data packet set corresponding to the sub-packet capture task sent by the target packet capture agent running on the third host; the initial data packet set corresponding to the sub-packet capture task is captured by the target packet capture agent on the third host in response to the sub-packet capture task instruction.

[0142] In this embodiment, the packet capture task may include a main packet capture task and multiple sub-packet capture tasks. During the execution of the main packet capture task, the target packet capture agent of the second host can automatically infer additional sub-packet capture tasks based on the application layer session. When the signaling packet payload captured by the target packet capture agent of the second host based on static BPF contains the INVITE keyword, i.e., the stream invitation session keyword, the target packet capture agent of the second host will automatically parse the session description information carried in the stream invitation packet, extract the receiving and pushing IPs and ports of the upper and lower levels, and notify the edge diagnostic service. The edge diagnostic service then issues additional sub-packet capture task instructions to the designated packet capture agent service based on the host information (receiving streaming media address). The task parameters can be the same as those of the main packet capture task; for example, the diagnostic requirements can be the same as those of the main packet capture task.

[0143] S4, the first host at the edge responds to the sub-capture task request and sends the sub-capture task instruction to the target capture agent of the third host.

[0144] S5, the target packet capture agent of the third host responds to the sub-packet capture task instruction, executes the sub-packet capture task to capture the initial data packet set corresponding to the sub-packet capture task, and sends the initial data packet set corresponding to the sub-packet capture task to the first host at the edge.

[0145] S6, after the target packet capture agent of the second host captures the initial data packet set corresponding to the main packet capture task, it sends the initial data packet set corresponding to the main packet capture task to the first host at the edge.

[0146] S7, the first host at the edge performs desensitization processing on each initial data packet in the initial data packet set corresponding to the main packet capture task and the sub-packet capture task respectively, to obtain the second desensitized data packet set.

[0147] For example, the edge diagnostic service at the edge is responsible for distributing and aggregating specific master-slave packet capture tasks, as well as de-identifying the original packet capture data. It also constructs a local sensitive data lookup table, repackages the de-identified data into a pcap file, and uploads it to the cloud-based comprehensive diagnostic service. Upon receiving the diagnostic results, the service scans the diagnostic report, restores known de-identified fields according to the local de-identification dictionary, and allows intranet users to access the data. The de-identification includes general de-identification, signaling de-identification, and streaming media de-identification.

[0148] For example, the edge diagnostics service can read the original pcap file from the packet capture agent, create a handle of type pcap_t, and use the pcap_next function to read packets one by one from the pcap file. Each packet contains a packet header (pcap_pkthdr) and data (u_char array). For each packet, we will perform general desensitization and signaling desensitization, or general desensitization and streaming media desensitization, depending on its payload type. Finally, we recalculate fields such as checksum and length to reconstruct the packet, and write the modified packet to a new pcap file for further analysis or use.

[0149] S8, the first host at the edge sends a second set of de-identified data packets to the comprehensive diagnostic service on the cloud server to request fault cause diagnosis for the second set of de-identified data packets.

[0150] S9, the cloud server performs fault cause diagnosis based on the second set of de-identified data packets, obtains the diagnosis results, and returns the diagnosis results to the first host at the edge.

[0151] For example, a cloud server may be configured with a comprehensive cloud-based diagnostic service, which can refer to a component or service with signaling or RTP analysis capabilities. This service can automatically analyze the integrity, correctness, and legality of NICT / ICT / NIST / IST transactions and push streams as defined in RFC3261 based on standard pcap format data packets. The fault diagnosis operations of the comprehensive cloud-based diagnostic service can employ various methods, including manual diagnosis, large-scale model diagnosis, and fault database diagnosis.

[0152] S9: After receiving the diagnostic results, the first host at the edge restores the desensitized values ​​of the fields included in the diagnostic results.

[0153] For example, after receiving the diagnosis results, the diagnosis report is scanned, and the known de-identified fields are restored according to the local de-identification dictionary, and intranet users are allowed to access them. The de-identification restoration includes the restoration of general de-identification, signaling de-identification, and streaming media de-identification.

[0154] The embodiments of this application have the following beneficial effects:

[0155] (1) The GB / T28181 master-sub-task packet capture mode supported by the distributed packet capture service is as follows: After the packet capture agent receives the main packet capture task directly issued by the edge diagnostic service, it will automatically identify the invitation session according to the characteristics of GB / T28181. Once the invitation session is identified, it will report the sub-task to the edge diagnostic service according to the session description information it carries. At this time, the edge diagnostic service will immediately allocate the packet capture agent on the specified host to perform packet capture according to the sub-task information. After the packet capture is completed, the edge diagnostic service integrates the master-sub-task packet capture. The above method can better adapt to the multi-machine and multi-instance architecture of the GB / T28181 security system and media service. Since the target push address of the camera is mostly randomly allocated by the system according to the real-time load, the packet capture service can analyze the SIP load, actively infer the target receiving machine, and quickly initiate the sub-packet capture task to the specified machine through the master-sub-task mode, which can reduce the workload of operation and maintenance personnel.

[0156] (2) After performing a general desensitization task on all captured packets, application-layer desensitization is performed separately for different signaling packets and streaming media packets. While randomly replacing sensitive fields in the signaling, a local desensitization dictionary is constructed, and privacy information is restored after receiving the diagnostic report. Video frames captured from streaming media packets are replaced with blank frames in place to ensure that the bitstream information remains unchanged while removing the customer's private video data. The above method can remove all privacy information in the captured packets while retaining the packet capture fault information. This allows the cloud-based fault location system to complete fault location for captured packets without being aware of the actual local environment, protecting the privacy and security of the customer's local environment without reducing fault location efficiency.

[0157] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0158] Based on the same inventive concept, this application also provides a data processing device for a security monitoring system to implement the data processing method of the security monitoring system described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations in one or more embodiments of the data processing device for a security monitoring system provided below can be found in the limitations of the data processing method for the security monitoring system described above, and will not be repeated here.

[0159] In one exemplary embodiment, such as Figure 7 As shown, a data processing device for a security monitoring system is provided, comprising: a data acquisition module 702, a first desensitization module 704, a second desensitization module 706, and a data transmission module 708, wherein:

[0160] The data acquisition module 702 is used to acquire the initial set of data packets obtained by network packet capture for the security monitoring system.

[0161] The first de-identification module 704 is used to de-identify the network layer address of each initial data packet in the initial data packet set to obtain the first de-identified data packet set.

[0162] The second desensitization module 706 is used to perform desensitization processing on each first desensitized data packet in the first desensitized data packet set based on the payload type of the first desensitized data packet, to obtain the second desensitized data packet set.

[0163] The data sending module 708 is used to send the second set of de-identified data packets to the cloud server.

[0164] The modules in the data processing device of the aforementioned security monitoring system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0165] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data processing method for a security monitoring system.

[0166] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0167] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the data processing method of the security monitoring system provided in the first aspect of the present application.

[0168] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the data processing method of the security monitoring system provided in the first aspect of the present application.

[0169] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the data processing method for the security monitoring system provided in the first aspect of the present application.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0171] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0172] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0173] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data processing method for a security monitoring system, characterized in that, Applied to the edge, the method includes: Obtain the initial set of data packets obtained from network packet capture targeting the security monitoring system; The network layer addresses of each initial data packet in the initial data packet set are de-identified to obtain the first de-identified data packet set; For each first de-identified data packet in the first de-identified data packet set, the first de-identified data packet is de-identified based on the payload type of the first de-identified data packet to obtain a second de-identified data packet set; Send the second set of de-identified data packets to the cloud server.

2. The method according to claim 1, characterized in that, The step involves de-identifying each first de-identified data packet in the first de-identified data packet set based on its payload type to obtain a second de-identified data packet set, including: For each of the first de-identified data packets, if the payload type of the first de-identified data packet is a signaling interaction type, the field value of the preset field in the first de-identified data packet is replaced with the de-identified value corresponding to the field value to obtain the second de-identified data packet in the second de-identified data packet set.

3. The method according to claim 2, characterized in that, The preset fields are fields in the signaling header field of the first de-identified data packet, and the preset fields include at least one of the following: a route tracing field, an identity field, and a device attribute field.

4. The method according to claim 2, characterized in that, The preset fields are fields in the signaling message body of the first de-identified data packet, and the preset fields include at least one of the following: device identifier field, device attribute field, network address field, authentication field, and location information field.

5. The method according to claim 2, characterized in that, The step of replacing the field value of the preset field in the first de-identified data packet with the de-identified value corresponding to the field value includes: In the preset desensitization mapping relationship, if there is a desensitized value that matches the field value of the preset field, the field value is replaced with the desensitized value; In the preset desensitization mapping relationship, if there is no desensitized value that matches the field value of the preset field, a desensitized value that matches the preset field is generated based on the preset generation rules, and the field value is replaced with the desensitized value.

6. The method according to claim 1, characterized in that, The step involves de-identifying each first de-identified data packet in the first de-identified data packet set based on its payload type to obtain a second de-identified data packet set, including: For each of the first de-identified data packets, if the payload type of the first de-identified data packet is streaming media, the video frame data of the first de-identified data packet is obtained; the video frame data includes video content data and encoding parameter data corresponding to the video content data; For each of the first de-identified data packets, the video content data in the first de-identified data packet is replaced with blank content data to obtain the second de-identified data packet in the second de-identified data packet set.

7. The method according to claim 1, characterized in that, The first de-identified data packet set is obtained by de-identifying the network layer addresses of each initial data packet in the initial data packet set, including: Extract the Internet Protocol address and Media Access Control address from each of the initial data packets; The Internet Protocol address is replaced with a preset pseudo Internet Protocol address, and the Media Access Control address is replaced with a preset pseudo Media Access Control address to obtain the first de-identified data packet set.

8. The method according to claim 1, characterized in that, The first host applied at the edge, wherein obtaining the initial set of data packets obtained by network packet capture targeting the security monitoring system includes: In response to a diagnostic request for the security monitoring system, a main packet capture task instruction is sent to the target packet capture agent in the second host; the diagnostic request includes the object to be diagnosed and the content information to be diagnosed; the main packet capture task instruction includes the communication session address corresponding to the diagnostic request and the content information to be diagnosed; the communication session address is used to characterize the network address of the communication link related to the content information to be diagnosed, which is participated in by the object to be diagnosed. The system receives the initial data packet set corresponding to the main packet capture task sent by the target packet capture agent running on the second host; the initial data packet set corresponding to the main packet capture task is determined by the target packet capture agent of the second host in response to the main packet capture task instruction.

9. The method according to claim 8, characterized in that, The method further includes: Receive a sub-capture request from the target packet capture agent in the second host; the sub-capture request includes a push stream address and a receive stream address; the push stream address and the receive stream address are identified by the target packet capture agent in the second host in the signaling interaction data packet carrying the invitation session keyword; In response to the sub-packet capture request, a sub-packet capture task instruction is sent to the target packet capture agent in the corresponding third host based on the push address and the receive address; The system receives the initial data packet set corresponding to the sub-capture task sent by the target packet capture agent running on the third host; the initial data packet set corresponding to the sub-capture task is determined by the target packet capture agent of the third host in response to the sub-capture task instruction.

10. The method according to claim 1, characterized in that, The second host applied at the edge end, wherein obtaining the initial set of data packets obtained by network packet capture targeting the security monitoring system includes: The system receives a main packet capture task instruction from the edge diagnostic service in the first host at the edge end. This instruction is generated by the edge diagnostic service in response to a diagnostic requirement for the security monitoring system. The diagnostic requirement includes an object to be diagnosed and information about the content to be diagnosed. The packet capture task instruction includes the communication session address corresponding to the diagnostic requirement and the information about the content to be diagnosed. The communication session address represents the network address of the communication link related to the information about the content to be diagnosed, in which the object to be diagnosed participates. In response to the main packet capture task instruction, the system obtains the set of raw data packets corresponding to the diagnostic requirement based on the communication session address. Based on the specified session type corresponding to the content information to be diagnosed, an initial data packet set is extracted from the original data packet set; the initial data packet set includes signaling interaction data packets and / or streaming media data packets that match the specified session type; Send the initial set of data packets corresponding to the main packet capture task to the edge diagnostic service in the first host.

11. The method according to claim 10, characterized in that, The method further includes: If the signaling interaction data packet contains a stream invitation session keyword, obtain the session description information of the signaling interaction data packet; Extract the push stream address and receive stream address from the session description information; Send a sub-packet capture request to the edge diagnostic service in the first host; the sub-packet capture request includes the push address and the receive address.

12. A data processing device for a security monitoring system, characterized in that, The device includes: The data acquisition module is used to acquire the initial set of data packets obtained by network packet capture for the security monitoring system. The first desensitization module is used to desensitize the network layer address of each initial data packet in the initial data packet set to obtain the first desensitized data packet set. The second desensitization module is used to desensitize each first desensitized data packet in the first desensitized data packet set based on the payload type of the first desensitized data packet, to obtain the second desensitized data packet set. The data sending module is used to send the second set of de-identified data packets to the cloud server.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 11.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

Images