Network risk tracing method and system, electronic equipment and storage medium
By establishing a pre-set traceability database in the local area network and using pre-set field structures to query the behavior logs of terminal devices, the problem of quickly locating target devices with risky behaviors is solved, thus improving the security of the local area network.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-05
- Publication Date
- 2026-03-17
AI Technical Summary
In local area networks (LANs), existing technologies cannot quickly locate target devices that trigger risky behaviors, leading to reduced LAN security.
By establishing a pre-set traceability database between the server and network transmission equipment, storing the behavior logs of each terminal device, and using a pre-set field structure for querying and matching, the target device can be quickly located.
It improves the speed of target device positioning and enhances the security of the local area network.
Smart Images
Figure CN121690708A_ABST
Abstract
Description
Technical Field
[0001] This disclosure belongs to the field of data processing technology, specifically relating to a method, system, electronic device, and storage medium for tracing network risks. Background Technology
[0002] A local area network (LAN) is a computer communication network that interconnects various devices such as computers, mobile devices, and databases within a localized area. To ensure the security of a LAN, it is necessary to quickly locate the target device when a risky behavior is identified.
[0003] In related technologies, due to differences between devices in a local area network (LAN), it is impossible to quickly locate the target device that caused the risky behavior after it has been identified, thereby reducing the security of the LAN. Summary of the Invention
[0004] This disclosure proposes a method, system, electronic device, and storage medium for tracing network risks.
[0005] The first aspect of this disclosure proposes a network risk tracing method, applied to a server, the method comprising: In response to receiving a source tracing instruction for a target risk behavior, the network information carried by the source tracing instruction is determined, wherein the data structure of the network information is a pre-set field structure; From the preset traceability database, query the target log that matches the network information; the preset traceability database is used to store the behavior logs of each terminal device, and the data structure of any behavior log is the preset field structure. The behavior log includes the identification information of the network transmission device used to transmit the behavior log. The target network transmission device is determined based on the device identification information in the target log, and a query command is sent to the network transmission device to obtain the terminal device information corresponding to the target risk behavior.
[0006] In this embodiment of the disclosure, querying the target logs that match the network information from the preset traceability database includes: Extract network entity information and timestamps from the network information; Based on the network entity information and the preset field structure, an initial log set is determined in the preset tracing database; Based on the timestamp, search the initial log set for the target log that matches the timestamp.
[0007] In this embodiment of the disclosure, the timestamp includes the date and time of the action, and the step of searching for the target log matching the timestamp in the initial log set includes: Generate a query key based on the network entity information and the behavior date; In the behavior log within the initial log set, query whether there exists an identifier for a sub-log set that matches the behavior date; If the identifier of the sub-log set does not exist in the initial log set, a report of no target log is returned. If the identifier of the sub-log set exists in the initial log set, then the corresponding target log is matched in the sub-log set based on the time of the action.
[0008] In this embodiment of the disclosure, the method further includes: in response to obtaining a new behavior log transmitted by any network transmission device, converting the structure of the new behavior log into the preset field structure to obtain a behavior log to be stored; The behavior logs to be stored are stored in the preset traceability database.
[0009] In this embodiment of the disclosure, storing the behavior log to be stored in the preset traceability database includes: Write the behavior log to be stored to the cache area of the preset traceability database; If the cache area reaches the preset storage conditions, the stored logs in the cache area are written to the target storage area; the preset storage conditions represent the rules that trigger the persistence of behavior logs in the cache area.
[0010] In this embodiment of the disclosure, the step of writing the stored logs of the cache region to the target storage region if the cache region reaches the preset storage conditions includes: If the cache area reaches a preset storage threshold, the stored logs in the cache area are compressed to obtain compressed logs; the compressed logs are then written to the target storage area. And / or, If the storage duration of the stored logs in the cache area is greater than the preset storage duration, then the stored logs will be written to the target storage area.
[0011] An embodiment of the second aspect of this disclosure provides a network risk tracing method, applied to any one of a plurality of network transmission devices, including: The system receives a query command from a server, which is determined by the server based on the device identification information of the network transmission device in the target log. The target log is the network information carried by the server in response to receiving a tracing command for a target risk behavior. The data structure of the network information is a pre-set field structure. The system then queries a pre-set tracing database to find the network information that matches the target risk behavior. The data structure of the network information is also a pre-set field structure. The pre-set tracing database stores the behavior logs of various terminal devices. The data structure of any behavior log is the pre-set field structure, and the behavior log includes the identification information of the network transmission device used to transmit the behavior log. Query the information of the connected terminal devices, wherein the terminal device information indicates the terminal device corresponding to the target risk behavior; The terminal device information is sent to the server.
[0012] An embodiment of the third aspect of this disclosure provides a network risk tracing system, the system including a server and multiple network transmission devices; The server is used to respond to a source tracing instruction for a target risk behavior, determine the network information carried by the source tracing instruction, and the data structure of the network information is a pre-set field structure; From the preset traceability database, query the target log that matches the network information; the preset traceability database is used to store the behavior logs of each terminal device, and the data structure of any behavior log is the preset field structure. The behavior log includes the identification information of the network transmission device used to transmit the behavior log. The target network transmission device is determined based on the device identification information in the target log, and a query command is sent to the network transmission device. The network transmission device is configured to receive a query instruction from the server; query the connected terminal device information, wherein the terminal device information indicates the terminal device corresponding to the target risk behavior; and send the terminal device information to the server.
[0013] An embodiment of the fourth aspect of this disclosure provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the methods described in the first aspect, any alternative implementation of the first aspect, and the second aspect.
[0014] An embodiment of the fifth aspect of this disclosure provides a computer-readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the methods described in the first aspect, any optional implementation of the first aspect, and the second aspect.
[0015] The technical solutions provided in this disclosure have at least the following technical effects or advantages: In response to receiving a tracing instruction for a target risky behavior, this embodiment determines the network information carried by the tracing instruction. The data structure of the network information is a pre-set field structure. It then queries a pre-set tracing database to find target logs that match the network information. Since the pre-set tracing database stores behavior logs of various terminal devices, and the data structure of any behavior log is the pre-set field structure, including identification information of the network transmission device used to transmit the behavior log, the network information in the tracing instruction can be quickly determined based on the pre-set structure fields. Furthermore, it queries target logs that match the network information, and then determines the target network transmission device based on the device identification information in the target log. A query instruction is then sent to the network transmission device to obtain the terminal device information corresponding to the target risky behavior. This improves the location speed of the target device and enhances the security of the local area network to a certain extent.
[0016] Additional aspects and advantages of this disclosure will be set forth in part in the description which follows, and in part will be obvious from the description or may be learned by practice of this disclosure. Attached Figure Description
[0017] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this disclosure. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This diagram illustrates the structure of a network risk tracing system according to an embodiment of the present disclosure. Figure 2 A flowchart of a network risk tracing method provided in an embodiment of this disclosure is shown; Figure 3 A flowchart of a network risk tracing method provided in yet another embodiment of this disclosure is shown; Figure 4 A schematic diagram of the structure of a network risk tracing device provided in an embodiment of this disclosure is shown; Figure 5 A schematic diagram of the structure of a network risk tracing device provided in an embodiment of this disclosure is shown; Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure is shown; Figure 7 A schematic diagram of a storage medium provided according to an embodiment of the present disclosure is shown. Detailed Implementation
[0018] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
[0019] It should be noted that, unless otherwise stated, the technical or scientific terms used in this disclosure shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains.
[0020] The following describes the implementation scenarios and related technologies involved in the embodiments of this disclosure.
[0021] A local area network (LAN) is a computer communication network that interconnects computers, mobile devices, databases, and other devices within a localized area. To ensure LAN network security, it's crucial to quickly locate the target device when a risky behavior is identified. Campus networks, being large LANs, typically cover multiple areas such as teaching buildings, libraries, and dormitories. Due to the extensive and diverse coverage areas, and the large number and variety of terminal devices involved, it's often difficult to quickly pinpoint the target device responsible for a risky behavior after it's identified, thus compromising LAN security.
[0022] In view of the above, this disclosure provides a method, system, electronic device, and storage medium for tracing network risks. The technical solutions of this disclosure are described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this disclosure will now be described with reference to the accompanying drawings.
[0023] See Figure 1 , Figure 1This document illustrates an exemplary system architecture diagram of the network risk tracing system provided in this disclosure. The system includes a server 10 and multiple network transmission devices 11. The server 10 and any of the network transmission devices 11 communicate via a network. The server 10 can be an independent physical server, a server cluster, a distributed system, or a cloud platform composed of multiple physical servers. The server 10 can deploy resources and computing power. Any of the network transmission devices 11 can be a gateway, firewall, Broadband Remote Access Server (BRAS), or switch, etc. This application does not limit the number and type of the aforementioned network transmission devices; those skilled in the art can set them according to actual conditions. In a local area network (LAN), each network transmission device 11 is close to the terminal device, requiring real-time collection of the terminal device's raw logs and network status information. The terminal device can be an electronic device such as a mobile phone, personal computer, tablet computer, wearable device, etc. Figure 1 (Not shown in the image).
[0024] Server 10 is used to respond to a source tracing instruction for a target risk behavior, determine the network information carried by the source tracing instruction, and the data structure of the network information is a pre-set field structure; query the target log that matches the network information from the preset source tracing database; the preset source tracing database is used to store the behavior logs of various terminal devices, and the data structure of any behavior log is a pre-set field structure, and the behavior log includes the identification information of the network transmission device used to transmit the behavior log; determine the target network transmission device based on the device identification information in the target log, and send a query instruction to the network transmission device; Network transmission device 11 is used to receive query instructions from the server; query the information of the connected terminal devices, the terminal device information indicating the terminal device corresponding to the target risk behavior; and send the terminal device information to the server.
[0025] The following is combined with Figure 1 The illustrated embodiments are used to describe a network risk tracing method proposed according to embodiments of this disclosure. For example... Figure 2 As shown in the embodiments of this disclosure, a method for tracing network risks is provided. This method can be applied to the server side and includes: In step S21, in response to receiving a tracing instruction for the target risk behavior, the network information carried by the tracing instruction is determined.
[0026] The data structure for network information is a pre-defined field structure.
[0027] For example, the tracing instruction can be a request issued by relevant personnel or generated by a security analysis platform, and may include content such as "Please associate a certain risky behavior with a specific user and device." The target risky behavior may be behaviors such as frequent logins or sensitive data leaks. Network information can be clues to the occurrence of the target risky behavior, such as public IP address, public port, protocol, start time, and sometimes accompanied by peer IP address, URL, or DNS domain name. This information constitutes the network information corresponding to the tracing instruction in a predefined field structure. The field structure can be a predefined standardized field table, which may include field names, types, order, and delimiters, to unify logs from different vendors.
[0028] Furthermore, after obtaining the tracing command, the tracing command can be parsed and the fields verified using the pre-obtained field structure to extract network information such as public IP address, public port, protocol, start and end time.
[0029] In step S22, the target log that matches the network information is queried from the preset traceability database.
[0030] The preset traceability database is used to store the behavior logs of each terminal device. The data structure of any behavior log is a preset field structure. The behavior log includes the identification information of the network transmission device used to transmit the behavior log.
[0031] For example, the field to be matched is the query key obtained by standardizing the public IP, port, protocol, time window, and other clues in the tracing command according to the preset field structure. The preset tracing database is a pre-established database used to store the behavior logs of all terminal devices. Terminal devices can refer to entities that generate traffic, such as mobile phones, personal computers, and tablets within the campus network. A behavior log is a record of a terminal device's network activity, which may include user ID, private IP, MAC, timestamp, public IP, port, protocol, and the identifier of the network transmission device that retrieved the log. The network transmission device identifier can be the serial number or management IP of a firewall / BRAS, etc.
[0032] After generating standardized field tuples (fields to be matched) for the source tracing instructions, since the behavior logs stored in the source tracing database are all stored based on these standardized fields, the target logs can be quickly matched in the source tracing database based on the field tuples corresponding to the source tracing instructions. This enables rapid location of the behavior logs corresponding to the target risk behavior and improves the efficiency of network risk source tracing to a certain extent.
[0033] Since there are many fields and types to be matched, matching any tuple in any of these fields would result in a large amount of computation, thus slowing down the query. Therefore, in some embodiments, the above-mentioned matching of the target log from the preset traceability database based on the fields to be matched can also be done in the following way to improve the query speed: extracting network entity information and timestamps from network information; determining an initial log set in the preset traceability database based on the network entity information and a preset field structure; and searching for the target log that matches the timestamp in the initial log set.
[0034] For example, network entity information specifically refers to the "public IP + public port + protocol" triple parsed from alarms / traffic mirroring, which is the unique foreign key for all subsequent indexing operations. The pre-defined field structure matching relationship can be a static lookup table, specifying the mapping rules and data type conversion methods between external alarm field names and internal unified field names, ensuring that logs from different vendors can generate query keys in the same format. Based on the pre-defined field structure matching relationship, the network entity information and timestamp are filled in according to the order of the field matching relationship to obtain the query key corresponding to the source database. The corresponding target log is then queried in the source database using this query key.
[0035] To further improve the query speed of target logs, in some embodiments, the tracing database is typically stored in buckets based on date, storing behavioral logs for a single day into one bucket (log set). Therefore, timestamps can be divided into behavioral date and behavioral time. This allows for the generation of query keys based on network entity information and behavioral date. The query then checks if a sub-log set identifier matching the behavioral date exists within the initial log set. If no sub-log set identifier exists in the initial log set, a "no target log" report is returned. If a sub-log set identifier exists in the initial log set, the corresponding target log is matched within the sub-log set based on the behavioral time.
[0036] For example, each log set (a log set stored in date buckets) corresponding to the traceability database can be assigned an identifier for each behavior log in the log set. The identifier is stored with network entity information and behavior date. For example, a hash value is generated based on the network entity information and behavior date corresponding to each log. The bitmap corresponding to the hash value is set to 1, indicating that the behavior log corresponding to the hash value exists.
[0037] In querying the initial log set, a query hash value can also be generated based on the network entity information and behavior date corresponding to the tracing instruction. If the query hash value matches the hash value in the bitmap or the corresponding bitmap is 1, it indicates that the target log may exist in the initial log set. Then, the target log corresponding to the behavior time can be further queried in the initial log set based on the behavior time. This query method can also be used to query based on hash values.
[0038] First, a preliminary query is performed in the source database based on the behavior date. Since the query is based on the storage bucket corresponding to the date, the query range is large and the corresponding data volume is small. If no corresponding initial log set identifier is found, it means that there is no corresponding behavior log, and the query can stop. After finding the corresponding initial log set identifier, subsequent searches are performed. By setting up a two-level query, blind matching in a large number of behavior logs is avoided, which improves the query speed to a certain extent.
[0039] In step S23, the target network transmission device is determined based on the device identification information in the target log, and a query command is sent to the network transmission device to obtain the terminal device information corresponding to the target risk behavior.
[0040] For example, the identifier of the network transmission device can be a unique number of a network element such as a firewall / BRAS / switch carried in the target log, which can be used to reverse-engineer "which device saw this behavior log at that time". Extract network element identifiers from the target logs, and then identify the target network transmission device from these identifiers. Based on this, the terminal device information corresponding to the target logs can be obtained from the target network transmission device.
[0041] For example, a terminal device information acquisition instruction can be sent to the target network transmission device. This acquisition instruction may include the relevant MAC address of the behavior log, DHCP / ARP table (IP↔MAC), etc., so that the target network transmission device can obtain the corresponding terminal device information from the pre-stored authentication information based on this information.
[0042] Based on the above embodiments, the server is also used to respond to the acquisition of new behavior logs transmitted by any network transmission device, determine the target conversion rule corresponding to the network transmission device; based on the target conversion rule, convert the structure of the new behavior log into a preset field structure to obtain the behavior log to be stored; and store the behavior log to be stored in a preset traceability database.
[0043] For example, the newly added behavior log is the raw log just generated by a network transmission device, and its format still retains the proprietary field layout of the corresponding network transmission device manufacturer. The target transformation rule is a pre-defined "field name → standard field name" mapping table for a specific manufacturer and model of the network transmission device, including sub-rules such as type conversion, unit conversion, and time format standardization. The behavior log to be stored is a standardized record that has been transformed by the target transformation rule, fully conforms to the pre-set field structure, and can be directly written to the index and compressed file.
[0044] After obtaining the newly added behavior log, the network transmission device that sent the log can be determined based on the identifier of the network channel that retrieved it (a mapping relationship between network channels and network transmission devices needs to be established in advance). Alternatively, the corresponding network transmission device can be determined by parsing the packet header and other information associated with the log. Once the network transmission device is identified, its structure is transformed into a pre-defined field structure according to a pre-set standardization method, resulting in the behavior log to be stored. This standardization method corresponds one-to-one with the network transmission device. The behavior log to be stored is then stored in the traceability database.
[0045] In some embodiments, to improve storage efficiency, storing behavior logs to be stored in a preset traceability database includes: writing the behavior logs to be stored to a cache area of the preset traceability database; if the cache area reaches a preset storage condition, writing the stored logs in the cache area to a target storage area; the preset storage condition represents the rule that triggers the persistence of behavior logs in the cache area.
[0046] For example, the cache area can be a storage area in the source database used to temporarily store newly added behavior logs; the preset storage condition is a pre-defined method for refreshing the cache area; the target storage area is a persistence layer, which may include bitmap files, index files, and behavior logs of the corresponding log set in the source database, wherein the bitmap files are used for first-level queries and the index files are used for second-level queries. Behavior logs to be stored can be appended to the cache area.
[0047] Before writing, a mapping table can be created, which can store two hash tables. The first hash table (public IP, public port, protocol, minute bucket) contains information such as private IP, user ID, MAC address, and geographic location; the second hash table (private IP, minute bucket) contains information such as public IP, public port, and protocol. This ensures that when querying behavior logs later, whether the query is initiated from the public or private network, the relevant information can be quickly located.
[0048] During the writing process, if the cache area reaches the preset storage threshold, the stored logs in the cache area are compressed to obtain compressed logs; the compressed logs are written to the target storage area; and / or, if the storage duration of the stored logs in the cache area is greater than the preset storage duration, the stored logs are written to the target storage area.
[0049] For example, if the number of behavior logs stored in the cache area exceeds the preset storage threshold, or if the current behavior logs have been fully stored, the corresponding behavior logs need to be packaged, compressed, and bucketed for storage. Alternatively, the cache area can be used as a hot storage area, temporarily storing behavior logs that are modified or read / written within a preset time period in the cache area, and writing those with a storage duration longer than the preset storage duration to the target storage area.
[0050] Based on the above embodiments, risk behaviors can be further analyzed based on the target log and its context, and relevant operations can be performed on the terminal device information to prevent the risk behaviors from escalating their impact.
[0051] In summary, in response to receiving a tracing instruction for a target risky behavior, this embodiment determines the network information carried by the tracing instruction. The data structure of the network information is a pre-set field structure. It then queries a target log matching the network information from a pre-set tracing database. Since the pre-set tracing database stores the behavior logs of various terminal devices, and the data structure of any behavior log is a pre-set field structure, including the identification information of the network transmission device used to transmit the behavior log, the network information in the tracing instruction can be quickly determined based on the pre-set structure fields. Furthermore, the target log matching the network information can be queried, and the target network transmission device can be determined based on the device identification information in the target log. A query instruction is then sent to the network transmission device to obtain the terminal device information corresponding to the target risky behavior. This improves the location speed of the target device and enhances the security of the local area network to a certain extent.
[0052] Corresponding to the above embodiments, such as Figure 3 As shown in the embodiments, this disclosure also discloses a network risk tracing method, which is applied to, for example... Figure 1 The network transmission device shown, the method includes: Step S31: Receive a query command from the server.
[0053] The query command is determined by the server based on the device identification information of the network transmission device in the target log; the target log is obtained by the server in response to receiving the tracing command for the target risk behavior, determining the network information carried by the tracing command, and the data structure of the network information is a pre-set field structure; the query is performed from the preset tracing database to match the network information; the data structure of the network information is a pre-set field structure; the preset tracing database is used to store the behavior logs of each terminal device, and the data structure of any behavior log is a pre-set field structure, and the behavior log includes the identification information of the network transmission device used to transmit the behavior log.
[0054] Step S32: Query the information of the connected terminal devices. The terminal device information indicates the terminal device corresponding to the target risk behavior.
[0055] Step S33: Send the terminal device information to the server.
[0056] For example, the relevant implementation methods corresponding to the embodiments of this disclosure are similar to the network risk tracing method corresponding to the server described above, and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein, and will not be repeated here.
[0057] correspond Figure 4 The illustrated network risk tracing method, in this embodiment of the disclosure, also provides a network risk tracing device, applied to the server side, such as... Figure 4 As shown, the device includes: The information determination module 401 is used to determine the network information carried by the tracing instruction for the target risk behavior in response to the acquisition of the tracing instruction, wherein the data structure of the network information is a preset field structure; The matching module 402 is used to query target logs that match the network information from a preset traceability database; the preset traceability database is used to store the behavior logs of each terminal device, the data structure of any behavior log is the preset field structure, and the behavior log includes the identification information of the network transmission device used to transmit the behavior log. The device information acquisition module 403 is used to determine the target network transmission device based on the device identification information in the target log, and send a query command to the network transmission device to obtain the terminal device information corresponding to the target risk behavior.
[0058] correspond Figure 5 The illustrated network risk tracing method, in this disclosure embodiment, also provides a network risk tracing device, such as... Figure 5 As shown, a network transmission device is applied to any one of a plurality of network transmission devices, the device comprising: The query instruction receiving module 501 is used to receive a query instruction from the server. The query instruction is determined by the server based on the device identification information of the network transmission device in the target log. The target log is obtained by the server in response to receiving a tracing instruction for a target risk behavior, determining the network information carried by the tracing instruction, and the data structure of the network information is a preset field structure. The server queries a preset tracing database to find the network information that matches the network information. The data structure of the network information is also a preset field structure. The preset tracing database is used to store the behavior logs of various terminal devices, and the data structure of any behavior log is the preset field structure. The behavior log includes the identification information of the network transmission device used to transmit the behavior log. The query module 502 is used to query the information of the connected terminal devices, wherein the terminal device information indicates the terminal device corresponding to the target risk behavior; Sending module 503 is used to send the terminal device information to the server. The network risk tracing device and the network risk tracing method provided in the above embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.
[0059] This disclosure also provides an electronic device for performing a network risk tracing method. Please refer to... Figure 6 This illustrates a schematic diagram of an electronic device provided by some embodiments of the present disclosure. For example... Figure 6 As shown, the electronic device 6 includes: a processor 600, a memory 601, a bus 602, and a communication interface 603. The processor 600, the communication interface 603, and the memory 601 are connected via the bus 602. The memory 601 stores a computer program that can run on the processor 600. When the processor 600 runs the computer program, it executes the network risk tracing method provided in any of the foregoing embodiments of this disclosure.
[0060] The memory 601 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between the virtual devices in the system is achieved through at least one communication interface 603 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network.
[0061] Bus 602 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 601 is used to store programs. After receiving an execution instruction, the processor 600 executes the program. The network risk tracing method disclosed in any of the foregoing embodiments of this disclosure can be applied to the processor 600, or implemented by the processor 600.
[0062] The processor 600 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 600 or by instructions in software form. The processor 600 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 601. Processor 600 reads the contents of memory 601 and, in conjunction with its hardware, completes the steps of the above method.
[0063] The electronic device provided in this disclosure and the network risk tracing method provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.
[0064] This disclosure also provides a computer-readable storage medium corresponding to the network risk tracing method provided in the foregoing embodiments. Please refer to... Figure 7 The computer-readable storage medium shown is an optical disc 30, on which a computer program (i.e., a program product) is stored. When the microprocessor runs, the computer program executes the network risk tracing method provided in any of the aforementioned embodiments.
[0065] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.
[0066] The computer-readable storage medium provided in the above embodiments of this disclosure and the network risk tracing method provided in the embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.
[0067] Although alternative embodiments of this disclosure have been described, those skilled in the art, upon learning the basic inventive concept, can make further changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this disclosure.
[0068] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this disclosure. It should be understood that the above description is only a specific embodiment of this disclosure and is not intended to limit the scope of protection of this disclosure. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of this disclosure should be included within the scope of protection of this invention.
Claims
1. A network risk tracing method, characterized in that, Applied to the server side, the method includes: In response to receiving a source tracing instruction for a target risk behavior, the network information carried by the source tracing instruction is determined, wherein the data structure of the network information is a pre-set field structure; From the preset traceability database, query the target log that matches the network information; the preset traceability database is used to store the behavior logs of each terminal device, and the data structure of any behavior log is the preset field structure. The behavior log includes the identification information of the network transmission device used to transmit the behavior log. The target network transmission device is determined based on the device identification information in the target log, and a query command is sent to the network transmission device to obtain the terminal device information corresponding to the target risk behavior.
2. The method of claim 1, wherein, The step of querying the target logs that match the network information from the preset source tracing database includes: Extract network entity information and timestamps from the network information; Based on the network entity information and the preset field structure, an initial log set is determined in the preset tracing database; Based on the timestamp, search the initial log set for the target log that matches the timestamp.
3. The method of claim 2, wherein, The timestamp includes the date and time of the action. The step of searching the initial log set for the target log matching the timestamp includes: Generate a query key based on the network entity information and the behavior date; In the behavior log within the initial log set, query whether there exists an identifier for a sub-log set that matches the behavior date; If the identifier of the sub-log set does not exist in the initial log set, a report of no target log is returned. If the identifier of the sub-log set exists in the initial log set, then the corresponding target log is matched in the sub-log set based on the time of the action.
4. The method of claim 1, wherein, The method further includes: In response to obtaining a new behavior log transmitted by any network transmission device, the structure of the new behavior log is converted into the preset field structure to obtain the behavior log to be stored. The behavior logs to be stored are stored in the preset traceability database.
5. The method of claim 4, wherein, The step of storing the behavior log to be stored in the preset traceability database includes: Write the behavior log to be stored to the cache area of the preset traceability database; If the cache area reaches the preset storage conditions, the stored logs in the cache area are written to the target storage area; the preset storage conditions represent the rules that trigger the persistence of behavior logs in the cache area.
6. The method of claim 5, wherein, If the cache region reaches the preset storage conditions, then the stored logs in the cache region are written to the target storage region, including: If the cache area reaches a preset storage threshold, the stored logs in the cache area are compressed to obtain compressed logs; the compressed logs are then written to the target storage area. And / or, If the storage duration of the stored logs in the cache area is greater than the preset storage duration, then the stored logs will be written to the target storage area.
7. A network risk tracing method, characterized by, Any of a plurality of network transmission devices, including: receive a query instruction from the server, the query instruction being determined by the server based on device identification information of a network transmission device in a target log; the target log being determined by the server in response to obtaining a trace instruction for a target risk behavior, network information carried by the trace instruction, the data structure of the network information being a pre-set field structure; query from a pre-set trace database, the network information matching the network information; the data structure of the network information being a pre-set field structure; the pre-set trace database being used to store behavior logs of each terminal device, the data structure of any behavior log being the pre-set field structure, the behavior log including identification information of a network transmission device used to transmit the behavior log; query connected terminal device information, the terminal device information indicating a terminal device corresponding to the target risk behavior; send the terminal device information to the server.
8. A data query system, characterized by, The system includes a server, a plurality of network transmission devices; The server is configured to determine network information carried by a trace instruction in response to obtaining a trace instruction for a target risk behavior, the data structure of the network information being a pre-set field structure; query a target log matching the network information from a pre-set trace database; the pre-set trace database is used to store behavior logs of each terminal device, the data structure of any behavior log being the pre-set field structure, the behavior log including identification information of a network transmission device used to transmit the behavior log; determine a target network transmission device according to the device identification information in the target log, and send a query instruction to the network transmission device; The network transmission device is configured to receive a query instruction from the server, query connected terminal device information, the terminal device information indicating a terminal device corresponding to the target risk behavior, and send the terminal device information to the server. 9.An electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor, when executing the computer program, implements the method of any one of claims 1 to 7. 10.A computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program, when executed by a processor, implements the method of any one of claims 1 to 7.