CN104618142B - News subscribing method, treatment node device and bus apparatus - Google Patents
News subscribing method, treatment node device and bus apparatus Download PDFInfo
- Publication number
- CN104618142B CN104618142B CN201410850950.3A CN201410850950A CN104618142B CN 104618142 B CN104618142 B CN 104618142B CN 201410850950 A CN201410850950 A CN 201410850950A CN 104618142 B CN104618142 B CN 104618142B
- Authority
- CN
- China
- Prior art keywords
- event
- message event
- message
- treatment
- node
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 90
- 238000012545 processing Methods 0.000 claims description 55
- 238000013507 mapping Methods 0.000 claims description 17
- 238000012098 association analyses Methods 0.000 claims description 16
- 238000012217 deletion Methods 0.000 claims description 6
- 230000037430 deletion Effects 0.000 claims description 6
- 238000012986 modification Methods 0.000 claims description 6
- 230000004048 modification Effects 0.000 claims description 6
- 238000012423 maintenance Methods 0.000 abstract description 8
- 238000010586 diagram Methods 0.000 description 5
- 101000597193 Homo sapiens Telethonin Proteins 0.000 description 2
- 102100035155 Telethonin Human genes 0.000 description 2
- 238000004590 computer program Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 239000004744 fabric Substances 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000002265 prevention Effects 0.000 description 2
- 230000011664 signaling Effects 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 1
- 238000007596 consolidation process Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000001035 drying Methods 0.000 description 1
- 238000003780 insertion Methods 0.000 description 1
- 230000037431 insertion Effects 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Transfer Between Computers (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present invention provides a kind of news subscribing method, treatment node device and bus apparatus, wherein, news subscribing method includes：When event source gives out information event by messaging bus, at least one first treatment nodes being carried on the messaging bus obtain message event corresponding with first configuration information according to the first configuration information in the message event；The message event that the first treatment node is obtained according to first configuration information treatment；Wherein, the first treatment node is the node using card format dynamic load on the messaging bus.Above-mentioned news subscribing method can realize the dynamic expansion to bus, and the convenient network security product with message event as granularity carries out later maintenance.
Description
Technical field
The present invention relates to technical field of data processing, more particularly to a kind of news subscribing method, treatment node device and total
Line.
Background technology
In existing network safety product, many products are all the examples with message or event as granularity is counted or is fitted
Such as, intruding detection system (Intrusion Detection Systems, abbreviation IDS), intrusion prevention system in network security product
System (Intrusion Prevention System, abbreviation IPS), safe operation center (Security Operations
Center, abbreviation SOC) and security gateway (Unified Threat Management, abbreviation UTM) etc. all can be with message thing
Part is used as being input into or exports.
But, in existing network security product using message event as input or output messaging bus be it is fixed,
Later maintenance cannot be carried out, and then network security product cannot be extended, cause the efficiency of network security product low and right
The expansion bands of product function carry out a definite limitation.
The content of the invention
For defect of the prior art, the invention provides a kind of news subscribing method, treatment node and bus, can
Realize to the dynamic expansion to messaging bus, the convenient network security product with message event as granularity carries out later maintenance.
In a first aspect, the present invention provides a kind for the treatment of node device, treatment node is to be carried in message using card format
In bus, the treatment node includes：
First acquisition module, for when event source gives out information event by the messaging bus, according to the first configuration
Information obtains message event corresponding with first configuration information in the message event；
Processing module, for the message event obtained according to first configuration information treatment.
Alternatively, the treatment node also includes：
Load-on module, for loading at least one second processing node, generation and the second processing node corresponding second
Configuration information；
The message thing that the second processing node is subscribed to or issued according to second configuration information from the treatment node
Message event corresponding with second configuration information, and the message event that treatment is obtained are obtained in part.
Alternatively, at least one treatment node and at least one second processing node composition binary tree structure；
Or,
At least one treatment node and at least one second processing node composition chain structure.
Alternatively, the treatment node device also includes：
Second acquisition module, for the message subscribed to or issue from another treatment node according to first configuration information
Message event corresponding with first configuration information is obtained in event.
Alternatively, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
Alternatively, first configuration information includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
Alternatively, the processing module, specifically for：
The attribute of the message event for obtaining is changed, and the message event issue after attribute will be changed；
Or,
Abandon the message event for obtaining；
Or,
The message event that will be obtained is stored in database；
Or,
Message event according to obtaining carries out traffic statistics analysis or safety statistics analysis；
Or,
Message event according to obtaining is associated analysis；
Or,
Forward the message event for obtaining.
Alternatively, the message event is the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
Second aspect, present invention also offers a kind of bus apparatus, including：
Load-on module, for loading at least one first treatment nodes of card format, and generates the first treatment node
The first configuration information；
Searching modul, for when event source gives out information event by the messaging bus, according to the described first configuration
Information searching message event corresponding with first configuration information；
Sending module, the message event for that will search sends the first treatment node, so that the first treatment section
The message event that point treatment sends.
Optionally, the messaging bus also include：
Removing module, at least one first treatment nodes for deleting loading.
Optionally, the message event is the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
Optionally, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
Optionally, first configuration information includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
The third aspect, present invention also offers a kind of news subscribing method, including：
When event source gives out information event by messaging bus, at least one message on the messaging bus is carried in
Event, the message event is that the first treatment node is obtained and described first according to the first configuration information in the message event
The corresponding message event of configuration information；
The message event that the first treatment node is obtained according to first configuration information treatment；
Wherein, the first treatment node is the node being carried in using card format on the messaging bus.
Optionally, methods described also includes：
The first treatment node is additionally operable to load at least one second processing node, generation and the second processing node pair
The second configuration information answered；
The second processing node is according to disappearing that second configuration information is subscribed to or issued from the described first treatment node
Message event corresponding with second configuration information, and the message event that treatment is obtained are obtained in breath event.
Optionally, described at least one first treatment nodes and at least one second processing node composition binary tree knot
Structure；
Or,
Described at least one first treatment nodes and at least one second processing node composition chain structure.
Optionally, methods described also includes：
The first treatment node is subscribed to or issued according to first configuration information from the another first treatment node
Message event corresponding with first configuration information is obtained in message event.
Optionally, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
Optionally, at least one first treatment nodes being carried on the messaging bus are according to the first configuration information
Before message event corresponding with first configuration information is obtained in the message event, methods described also includes：
The messaging bus loading at least one first processes node, and generation is matched somebody with somebody with the first treatment node corresponding first
Confidence ceases；
And/or,
First configuration information includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
Optionally, the message event that the first treatment node is obtained according to first configuration information treatment, including：
The attribute of the message event that the first treatment node modification is obtained, and the message event hair after attribute will be changed
Cloth；
Or,
The first treatment node abandons the message event for obtaining；
Or,
The message event that the first treatment node will be obtained is stored in database；
Or,
The first treatment node carries out traffic statistics analysis or safety statistics analysis according to the message event for obtaining；
Or,
The first treatment node is associated analysis according to the message event for obtaining；
Or,
The message event that the first treatment node forwarding is obtained.
Optionally, the message event is the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
Fourth aspect, present invention also offers a kind of news subscribing method, including：
At least one first treatment nodes of messaging bus loading card format, and generate the first of the first treatment node
Configuration information；
When event source gives out information event by the messaging bus, the messaging bus match somebody with somebody confidence according to described first
Breath searches message event corresponding with first configuration information, and the message event that will be searched sends the first treatment node,
So that the message event that the first treatment node processing sends.
Optionally, methods described also includes：
The messaging bus delete at least one first treatment nodes of loading.
Optionally, the message event is the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
Optionally, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
Optionally, first configuration information includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
As shown from the above technical solution, news subscribing method of the invention, treatment node device and bus apparatus, by dynamic
The message event that at least one first treatment nodes that state is carried on messaging bus are obtained in messaging bus, and process acquisition
Message event, and then can realize carrying out the message event of input/output in messaging bus dynamic expansion, it is convenient with message event
For the network security product of granularity carries out later maintenance, the efficiency of network security product is improved.
Brief description of the drawings
The schematic flow sheet of the news subscribing method that Fig. 1 is provided for one embodiment of the invention；
The schematic diagram of the news subscribing method that Fig. 2 is provided for another embodiment of the present invention；
The schematic diagram of the news subscribing method that Fig. 3 is provided for another embodiment of the present invention；
The schematic flow sheet of the news subscribing method that Fig. 4 is provided for another embodiment of the present invention；
The schematic diagram of the news subscribing method that Fig. 5 is provided for another embodiment of the present invention；
The schematic flow sheet of the news subscribing method that Fig. 6 is provided for another embodiment of the present invention；
The structural representation of the treatment node that Fig. 7 is provided for one embodiment of the invention；
The structural representation of the bus that Fig. 8 is provided for one embodiment of the invention.
Specific embodiment
With reference to the accompanying drawings and examples, specific embodiment of the invention is described in further detail.Hereinafter implement
Example is not limited to the scope of the present invention for illustrating the present invention.
Wherein, in all embodiments of the invention, "/" represents the relation of "or".
Fig. 1 shows the schematic flow sheet of the news subscribing method that one embodiment of the invention is provided, and Fig. 2 shows the present invention
The schematic diagram of the news subscribing method that another embodiment is provided, with reference to shown in Fig. 1 and Fig. 2, the news subscribing method of the present embodiment
It is as described below.
101st, when event source gives out information event by messaging bus, it is carried on the messaging bus at least one
First treatment node obtains message corresponding with first configuration information according to the first configuration information in the message event
Event.
Wherein, the first treatment node is the node using card format dynamic load on the messaging bus.The
One configuration information can be the configuration information of generation in the treatment node process of messaging bus dynamic load first, and the configuration information is used for
Make the first treatment node that the message event in messaging bus is obtained according to the configuration information.
For example, the event source in the step can be regarded as：The network in host event source, internet in server
Event source, and/or, any access system of the event that given out information by the messaging bus, third party's message event source etc..
The present embodiment the equal of event that can be given out information in messaging bus by way of example only, arbitrarily to event source is managed
Solve the event source for the messaging bus.
102nd, the message event that the first treatment node is obtained according to first configuration information treatment.
In the present embodiment, messaging bus can run in the internal memory of a server, be similar to a stream for broadcast, Ke Yiguang
Any message event is broadcast/issued, but does not store the message event.Can be with the multiple first treatment sections of dynamic load on the messaging bus
Point, as shown in Fig. 2 the first treatment node can subscribe to the message event broadcasted in messaging bus according to the first configuration information.
First treatment node can be abandoned to the message event in messaging bus, be deleted message event, add message
Attribute, storage message event etc..The present embodiment is not defined to the first treatment node, and the first treatment node can be regarded as
The treatment to message event in messaging bus is realized in the plug-in unit insertion realized in a software form within hardware.For example, the first treatment
Node can be subscription plug-in unit, news release plug-in unit etc..
If the first treatment node is to the event that given out information in messaging bus, it is believed that the first treatment node is the message
One event source of bus.
It should be noted that the form of the message event in the present embodiment in messaging bus is key-value form, i.e. key-
Value forms.
News subscribing method in the present embodiment, at least one first treatment sections by dynamic load on messaging bus
Point obtains the message event in messaging bus, and processes the message event of acquisition, and then can realize to input in messaging bus/defeated
The message event for going out carries out dynamic expansion, and the convenient network security product with message event as granularity carries out later maintenance, improves
The efficiency of network security product.
Additionally, message event can be the message event of MAP types in the messaging bus shown in above-mentioned Fig. 2, MAP is movement
The signaling of message is transmitted between entity, MAP message can be to include TCAP Transaction Capability Application Part (Transaction
Capabilities Application Part, abbreviation TCAP), SCCP (Signaling Connection
Control Part, abbreviation SCCP), media transmission protocol (Media Transfer Protocol, abbreviation MTP) protocol layer
Protocol data.
In the flow chart shown in Fig. 1, methods described also includes：Can also mutually be subscribed between multiple first treatment nodes
Message event, i.e. the first treatment node is subscribed to or issued according to first configuration information from the another first treatment node
Message event corresponding with first configuration information is obtained in message event.
As shown in figure 3, the first treatment node a2 is according to disappearing that the first configuration information can be subscribed to from the first treatment node a1
Message event corresponding with the first configuration information is obtained in breath event.
For example, in figure 3, if the first treatment node a1 is that source IP is 198.102.151.11 in subscribing to messaging bus
Message event, and will subscribe to message event storage.Now, the first treatment node a2 can be subscribed to from the first treatment node a1
Meet the message event of demand.Because the first treatment node a1 is that the message event storage that will be subscribed to is processed, then the first treatment is saved
Point a2 can subscribe to all message events that the first treatment node a1 had subscribed to.
If the message event that source IPs of the first treatment node a1 not to subscribing to is 198.102.151.11 is put in storage
Treatment, the then message event that the first treatment node a2 can only be subscribed in the treatment node of subscription first a1 of dynamic realtime.That is, first
Treatment node a2 cannot be subscribed to first before the first treatment node a1 and the first treatment node a2 does not set up subscribing relationship
The message event that treatment node a1 is subscribed to from messaging bus.
Generally, the first treatment node a1 and the first treatment node a2 may be constructed tree, such as binary tree structure, this reality
Apply example by way of example only, be not limited thereof.
Fig. 4 shows the schematic flow sheet of the news subscribing method that another embodiment of the present invention is provided, and Fig. 5 shows this hair
The schematic diagram of the news subscribing method that bright another embodiment is provided, with reference to shown in Fig. 4 and Fig. 5, the message subscribing side of the present embodiment
Method is as described below.
401st, the treatment of messaging bus dynamic load at least one first node, generation first processes node corresponding the with this
One configuration information.
For example, the first configuration information in the present embodiment includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet message event of preset rules etc..
402nd, when event source gives out information event by messaging bus, at least one first treatment nodes are matched somebody with somebody according to first
Confidence breath obtains message event corresponding with first configuration information in the message event.
403rd, the message event that the first treatment node is obtained according to first configuration information treatment.
For example, the attribute of the message event that the first treatment node can be obtained according to the modification of the first configuration information, and will modification
Message event issue after attribute；Or, the first treatment node can abandon the message event for obtaining according to the first configuration information；Or
Person, the message event that the first treatment node be able to will be obtained according to the first configuration information is stored in database；Or, the first treatment
Node can carry out traffic statistics analysis or safety statistics analysis according to the message event for obtaining；Or, first treatment node according to
The message event of acquisition is associated analysis (such as name mapping)；Or, message event that the first treatment node forwarding is obtained etc.
Deng.How the first treatment node processes the message event of acquisition by way of example only at this, and the present embodiment is not limited thereof,
Can be processed according to actual needs.
404th, the first treatment node is additionally operable to the second processing node of dynamic load at least one, generation and the second processing section
Corresponding second configuration information of point；
The second processing node is according to disappearing that second configuration information is subscribed to or issued from the described first treatment node
Message event corresponding with second configuration information, and the acquired message event for the treatment of are obtained in breath event.
It will be appreciated that M treatment nodes can also dynamically be loaded onto few M+1 treatment node, generation and the M+1
The corresponding M+1 configuration informations for the treatment of node；
The M+1 processes node and is obtained from the message event of M treatment node subscription or issue according to M+1 configuration informations
Message event corresponding with M+1 configuration informations is taken, to process acquired message event.
Above-mentioned M values can be positive integer.
That is, M treatment nodes and M+1 treatment nodes may make up tree, such as binary tree structure；Or,
M processes node and M+1 treatment nodes may make up chain structure, and the present embodiment is not limited thereof, and is illustrated that in Fig. 5
Constitute first treatment node a2 and second processing node b1, b2 of binary tree structure.
In the present embodiment, before event source gives out information event by messaging bus, the messaging bus need dynamic to add
Carry at least one and process node, so that those treatment nodes can be to obtaining the message event in messaging bus.
For example, treatment node can be the plug-in unit of product access, or capture the plug-in unit of a certain source IP flow, or
It is to invade plug-in unit that inspection system is analyzed etc..Those plug-in units can be realized by software, a pre-loaded server
In messaging bus.The messaging bus can issue the message event of consolidation form, for being carried in the multiple on messaging bus
Plug-in unit is subscribed to.
On messaging bus between the subscription of plug-in unit or plug-in unit and plug-in unit subscription with the messaging bus where server/
Main frame is not associated, and is also onrelevant with the network where server/main frame.
It will be appreciated that in any of the above-described embodiment, the attribute of any message event in messaging bus may each comprise this
The information such as the source IP of message event, purpose IP, source port and destination interface.
The message format dynamic extending of the message event in above-described embodiment, and then set up for the message format
A set of messaging bus based on publish-subscribe model, the subscription plug-in unit or issue plug-in unit on messaging bus are in the way of dynamic load
It is suspended on messaging bus, to reach pluggable information mode bus.
Issue plug-in unit is given out information event by messaging bus, and the various subscription plug-in units of dynamic load, right on messaging bus
The message event that issue plug-in unit sends is processed, for example, delete, addition message attributes are issued, abandon etc..
In the embodiment of the present invention conventional network safety system, such as log services can be built based on above-mentioned messaging bus
Device, safety auditing system, flow statistical system etc..
Fig. 6 shows the schematic flow sheet of the news subscribing method that another embodiment of the present invention is provided, as shown in fig. 6, this
The news subscribing method of embodiment is as described below.
601st, at least one first treatment nodes of messaging bus dynamic load card format, and generate the first treatment section
First configuration information of point.
For example, the first configuration information may include following one or more：Subscribed in the messaging bus and met
The message event of preset rules, deletion meet the category that the message event of preset rules, addition meet the message event of preset rules
Property, the event that gives out information, discarding meet the message event of preset rules, forwarding and meet message event, the system of real name of preset rules
Mapping meet the message event of preset rules, association analysis meet preset rules message event, storage meet preset rules
Message event etc..
602nd, when event source gives out information event by the messaging bus, the messaging bus are matched somebody with somebody according to described first
Information searching message event corresponding with first configuration information is put, the message event that will be searched sends the first treatment section
Point, so that the message event that the first treatment node processing sends.
For example, message event described in the present embodiment is the message event of MAP message type；
The form of the message event is the key-value form (key-value) of dynamic expansion；The attribute of message event can be wrapped
Include：The source IP of the message event, purpose IP, source port number and destination slogan.
Event source in step 602 can be following one or more：In host event source, internet in server
Event source in network event source and the first treatment node, third party's event source, given out information event by the messaging bus
Any access system etc..
Alternatively, in a particular application, the step of method shown in above-mentioned Fig. 6 may also include not shown in following figures 603：
603rd, at least one first treatment nodes of loading are deleted.
The news subscribing method of the present embodiment, the treatment node of messaging bus dynamic load at least one first, and then to extremely
Few one first treatment node sends the message event in the messaging bus that the first treatment node is subscribed to, so that at least one the
The message event that one treatment node processing is obtained, and then can realize entering action to the message event of input/output in messaging bus
State extends, and the convenient network security product with message event as granularity carries out later maintenance, improves the efficiency of network security product.
Messaging bus ftms in any of the above-described embodiment can be understood as a stml for main frame, and messaging bus broadcast has
The message event of uniform type is defined, many plug-in units can be defined on messaging bus and is processed node, each plug-in unit can be offseted
Breath event is added, deletes or changes.The messaging bus are similar to physical bus, the message broadcasted on the messaging bus
Event is not stored, after the treatment node that is carried on the messaging bus be total message before cannot knowing treatment node loading
The content broadcasted in line.
Multiple treatment nodes are loaded with the messaging bus of the present embodiment, in concrete application, those treatment nodes can be to adopt
It is carried on messaging bus with card format.
Fig. 7 shows a kind of structural representation for processing node device provided in an embodiment of the present invention, as shown in fig. 7, should
Treatment node device includes：First acquisition module 71 and processing module 72.
First acquisition module 71 is used for when event source gives out information event by the messaging bus, according to the first configuration
Information obtains message event corresponding with first configuration information in the message event；
Processing module 72 is used for the message event obtained according to first configuration information treatment.
Alternatively, the treatment node device also includes the load-on module not shown in figure；The load-on module, for loading
At least one second processing node, generates the second configuration information corresponding with the second processing node；
The message thing that the second processing node is subscribed to or issued according to second configuration information from the treatment node
Message event corresponding with second configuration information, and the message event that treatment is obtained are obtained in part.
For example, first configuration information includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
In the present embodiment, at least one treatment node and at least one second processing node composition binary tree
Structure；
Or,
At least one treatment node and at least one second processing node composition chain structure.
In another possible implementation, the treatment node device may also include the second acquisition mould not shown in figure
Block, second acquisition module, for the message thing subscribed to or issue from another treatment node according to first configuration information
Message event corresponding with first configuration information is obtained in part.
Event source in the present embodiment may include following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
It will be appreciated that processing module in the present embodiment can be specifically for：The attribute of the message event for obtaining is changed, and
The message event issue after attribute will be changed；Or, abandon the message event for obtaining；Or, the message event storage that will be obtained
In database；Or, traffic statistics analysis or safety statistics analysis are carried out according to the message event for obtaining；Or, according to obtaining
The message event for taking is associated analysis；Or, forward the message event for obtaining.
Message event in any of the above-described embodiment can be the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or, the attribute of the message event includes：The source IP of the message event, purpose IP, source port number and purpose
Port numbers.
The message event that the treatment node processing of the present embodiment is obtained, and then can realize to input/output in messaging bus
Message event carry out dynamic expansion, the convenient network security product with message event as granularity carries out later maintenance, improves net
The efficiency of network safety product.
Fig. 8 shows a kind of structural representation of bus apparatus provided in an embodiment of the present invention, as shown in figure 8, the bus
Equipment includes：Load-on module 81, generation module 82, searching modul 83 and sending module 84；
Load-on module 81 is used to load at least one first treatment nodes of card format；
Generation module 82 is used at least one first treatment nodes loaded according to the load-on module, generates this at first
Manage the first configuration information of node；
Searching modul 83 is used for when event source gives out information event by the messaging bus, according to the described first configuration
Information searching message event corresponding with first configuration information；
The message event that sending module 84 is used to search sends the first treatment node, so that the first treatment section
The message event that point treatment sends.
Alternatively, the messaging bus may also include the removing module not shown in figure, and the removing module 84 is used to delete
At least one first treatment nodes of loading.
For example, the message event is the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；And/or, the message event
Attribute includes：The source IP of the message event, purpose IP, source port number and destination slogan.
In the present embodiment, event source may include following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
First configuration information includes following one or more：Subscribed in the messaging bus and meet preset rules
Message event, deletion meet preset rules message event, addition meet preset rules message event attribute, issue disappear
Breath event, discarding meet preset rules message event, forwarding meet preset rules message event, system of real name mapping meet pre-
If the message event of rule, association analysis meet the message event that the message event of preset rules, storage meet preset rules.
Bus in the present embodiment can be realized carrying out the message event of input/output dynamic expansion, convenient with message thing
Part carries out later maintenance for the network security product of granularity, improves the efficiency of network security product.
Embodiment of the invention discloses that：
A1, a kind for the treatment of node device, the treatment node is to be carried on messaging bus using card format, the place
Reason node includes：
First acquisition module, for when event source gives out information event by the messaging bus, according to the first configuration
Information obtains message event corresponding with first configuration information in the message event；
Processing module, for the message event obtained according to first configuration information treatment.
A2, the treatment node device according to A1, the treatment node device also include：
Load-on module, for loading at least one second processing node, generation and the second processing node corresponding second
Configuration information；
The message thing that the second processing node is subscribed to or issued according to second configuration information from the treatment node
Message event corresponding with second configuration information, and the message event that treatment is obtained are obtained in part.
A3, the treatment node device according to A2, at least one treatment node and described at least one second
Reason node composition binary tree structure；
Or,
At least one treatment node and at least one second processing node composition chain structure.
A4, according to any described treatment node devices of A1 to A3, the treatment node device also includes：
Second acquisition module, for the message subscribed to or issue from another treatment node according to first configuration information
Message event corresponding with first configuration information is obtained in event.
A5, the treatment node device according to A1 to A3 is any, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
A6, according to any described treatment node devices of A1 to A5, first configuration information include following one kind or
It is various：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
A7, according to any described treatment node devices of A1 to 6A, the processing module, specifically for：
The attribute of the message event for obtaining is changed, and the message event issue after attribute will be changed；
Or,
Abandon the message event for obtaining；
Or,
The message event that will be obtained is stored in database；
Or,
Message event according to obtaining carries out traffic statistics analysis or safety statistics analysis；
Or,
Message event according to obtaining is associated analysis；
Or,
Forward the message event for obtaining.
A8, the treatment node device according to A1 to A7 is any, the message event is the message thing of MAP message type
Part；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
B9, a kind of bus apparatus, including：
Load-on module, at least one first treatment nodes for loading card format；
Generation module, at least one first treatment nodes loaded according to the load-on module, generates this at first
Manage the first configuration information of node；
Searching modul, for when event source gives out information event by the messaging bus, according to the described first configuration
Information searching message event corresponding with first configuration information；
Sending module, the message event for that will search sends the first treatment node, so that the first treatment section
The message event that point treatment sends.
B10, the bus apparatus according to B9, the messaging bus equipment also include：
Removing module, at least one first treatment nodes for deleting loading.
B11, the bus apparatus according to B9 or B10, the message event are the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
B12, the bus apparatus according to B9 to B11 is any, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
B13, according to any described bus apparatus of B9 to B12,
First configuration information includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
C14, a kind of news subscribing method, including：
When event source gives out information event by messaging bus, on the messaging bus at least one first are carried in
Treatment node obtains message event corresponding with first configuration information according to the first configuration information in the message event；
The message event that the first treatment node is obtained according to first configuration information treatment；
Wherein, the first treatment node is the node being carried in using card format on the messaging bus.
C15, the method according to C14, methods described also include：
The first treatment node is additionally operable to load at least one second processing node, generation and the second processing node pair
The second configuration information answered；
The second processing node is according to disappearing that second configuration information is subscribed to or issued from the described first treatment node
Message event corresponding with second configuration information, and the message event that treatment is obtained are obtained in breath event.
C16, the method according to C15, described at least one first treatment node and at least one second processings
Node constitutes binary tree structure；
Or,
Described at least one first treatment nodes and at least one second processing node composition chain structure.
C17, according to any described methods of C14 to C16, methods described also includes：
The first treatment node is subscribed to or issued according to first configuration information from the another first treatment node
Message event corresponding with first configuration information is obtained in message event.
C18, the method according to C14 to C16 is any, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
C19, according to any described methods of C14 to C18, it is described be carried on the messaging bus at least one first
Treatment node obtains message event corresponding with first configuration information according to the first configuration information in the message event
Before, methods described also includes：
The messaging bus loading at least one first processes node, and generation is matched somebody with somebody with the first treatment node corresponding first
Confidence ceases；
And/or,
First configuration information includes following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
C20, according to any described methods of C14 to C19, the first treatment node according to first configuration information at
The message event for obtaining is managed, including：
The attribute of the message event that the first treatment node modification is obtained, and the message event hair after attribute will be changed
Cloth；
Or,
The first treatment node abandons the message event for obtaining；
Or,
The message event that the first treatment node will be obtained is stored in database；
Or,
The first treatment node carries out traffic statistics analysis or safety statistics analysis according to the message event for obtaining；
Or,
The first treatment node is associated analysis according to the message event for obtaining；
Or,
The message event that the first treatment node forwarding is obtained.
C21, the method according to C14 to C20 is any, the message event is the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
D22, a kind of news subscribing method, including：
At least one first treatment nodes of messaging bus loading card format, and generate the first of the first treatment node
Configuration information；
When event source gives out information event by the messaging bus, the messaging bus match somebody with somebody confidence according to described first
Breath searches message event corresponding with first configuration information, and the message event that will be searched sends the first treatment node,
So that the message event that the first treatment node processing sends.
D23, the method according to D22, methods described also include：
The messaging bus delete at least one first treatment nodes of loading.
D24, the method according to D22 or D23, the message event are the message event of MAP message type；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination interface
Number.
D25, the method according to D22 to D24 is any, the event source includes following one or more：
It is the event source in network event source in host event source, internet and the first treatment node in server, logical
The messaging bus are crossed to give out information any access system of event.
D26, the method according to D22 to D25 is any, first configuration information include following one or more：
Subscribed in the messaging bus and meet the message event of preset rules, delete the message thing for meeting preset rules
Part, addition meet the attribute of message event of preset rules, the event that gives out information, discarding meet preset rules message event,
Forwarding meets the message event of preset rules, system of real name mapping and meets the message event of preset rules, association analysis and meet default
The message event of rule, storage meet the message event of preset rules.
Above-mentioned treatment node, messaging bus can perform the flow of foregoing embodiment of the method, and the present invention is no longer to above-mentioned place
Reason node and messaging bus carry out detailed illustration.
In specification of the invention, numerous specific details are set forth.It is to be appreciated, however, that embodiments of the invention can be with
Put into practice in the case of without these details.In some instances, known method, structure and skill is not been shown in detail
Art, so as not to obscure the understanding of this description.
Similarly, it will be appreciated that disclose and help understand or many in each inventive aspect to simplify the present invention
Individual, in above to the description of exemplary embodiment of the invention, each feature of the invention is grouped together into single sometimes
In embodiment, figure or descriptions thereof.It is intended in reflection is following however, should not explain the method for the disclosure：Want
Seek the application claims features more more than the feature being expressly recited in each claim of protection.More precisely, such as
As following claims reflect, inventive aspect is all features less than single embodiment disclosed above.
Therefore, it then follows thus claims of specific embodiment are expressly incorporated in the specific embodiment, wherein each right will
Itself is asked all as separate embodiments of the invention.
It will be understood by those skilled in the art that can adaptively be changed to the module in the equipment in embodiment
And they are provided in one or more different equipment of the embodiment.Can the module or unit in embodiment or
Component is combined into a module or unit or component, and can be divided into multiple submodule or subelement or subgroup in addition
Part.At least some in except such feature and/or process or unit are mutually exclusive parts, can use any combinations
To all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so disclosed any side
All processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification (including adjoint right will
Ask, make a summary and accompanying drawing) disclosed in each feature can the alternative features of or similar purpose identical, equivalent by offer replace.
Although additionally, it will be appreciated by those of skill in the art that some embodiments described herein include other embodiments
In included some features rather than further feature, but the combination of the feature of different embodiments means in of the invention
Within the scope of and form different embodiments.For example, in the following claims, embodiment required for protection is appointed
One of meaning mode can be used in any combination.
All parts embodiment of the invention can be realized with hardware, or be run with one or more processor
Software module realize, or with combinations thereof realize.It will be understood by those of skill in the art that can use in practice
Microprocessor or digital signal processor (DSP) are come in the equipment for realizing a kind of browser terminal according to embodiments of the present invention
Some or all parts some or all functions.The present invention is also implemented as performing side as described herein
Some or all equipment or program of device (for example, computer program and computer program product) of method.It is such
Realize that program of the invention can be stored on a computer-readable medium, or there can be the shape of one or more signal
Formula.Such signal can be downloaded from internet website and obtained, or be provided on carrier signal, or with any other shape
Formula is provided.
It should be noted that above-described embodiment the present invention will be described rather than limiting the invention, and ability
Field technique personnel can design alternative embodiment without departing from the scope of the appended claims.In the claims,
Any reference symbol being located between bracket should not be configured to limitations on claims.Word "comprising" is not excluded the presence of not
Element listed in the claims or step.Word "a" or "an" before element is not excluded the presence of as multiple
Element.The present invention can come real by means of the hardware for including some different elements and by means of properly programmed computer
It is existing.If in the unit claim for listing equipment for drying, several in these devices can be by same hardware branch
To embody.The use of word first, second, and third does not indicate that any order.These words can be explained and run after fame
Claim.
Finally it should be noted that：Various embodiments above is merely illustrative of the technical solution of the present invention, rather than its limitations；To the greatest extent
Pipe has been described in detail with reference to foregoing embodiments to the present invention, it will be understood by those within the art that：Its according to
The technical scheme described in foregoing embodiments can so be modified, or which part or all technical characteristic are entered
Row equivalent；And these modifications or replacement, the essence of appropriate technical solution is departed from various embodiments of the present invention technology
The scope of scheme, it all should cover in the middle of the scope of claim of the invention and specification.
Claims (25)
1. it is a kind of to process node device, it is characterised in that treatment node is to be carried on messaging bus using card format, described
Treatment node includes：
First acquisition module, in message event of the event source by the messaging bus distribution subscription, matching somebody with somebody according to first
Confidence breath obtains message event corresponding with first configuration information in the message event, and the first configuration information is message
The configuration information generated in the treatment node process of bus dynamic load first, the attribute of the message event includes：The message
The source IP of event, purpose IP, source port number and destination slogan；
Processing module, for the message event obtained according to first configuration information treatment.
2. treatment node device according to claim 1, it is characterised in that the treatment node device also includes：
Load-on module, for loading at least one second processing node, generates the second configuration corresponding with the second processing node
Information；
The second processing node is according to second configuration information from the message event for the treatment of node subscription or issue
Obtain message event corresponding with second configuration information, and the message event that treatment is obtained.
3. treatment node device according to claim 2, it is characterised in that described at least one first treatment node and institutes
State at least one second processing node composition binary tree structure；
Or,
Described at least one first treatment nodes and at least one second processing node composition chain structure.
4. according to any described treatment node device of claims 1 to 3, it is characterised in that the treatment node device is also wrapped
Include：
Second acquisition module, for the message event subscribed to or issue from another treatment node according to first configuration information
It is middle to obtain message event corresponding with first configuration information.
5. according to any described treatment node device of claims 1 to 3, it is characterised in that the event source includes following
One or more：
The event source in network event source in host event source, internet and the first treatment node in server, by institute
Messaging bus are stated to give out information any access system of event.
6. treatment node device according to claim 5, it is characterised in that first configuration information includes following
Plant or various：
Subscription meets the message event of preset rules, deletion and meets the message event of preset rules, adds in the messaging bus
Plus meet the attribute of the message event of preset rules, the event that gives out information, discarding and meet the message event of preset rules, forwarding symbol
The message event of preset rules, system of real name mapping is closed to meet the message event of preset rules, association analysis and meet preset rules
Message event, storage meet the message event of preset rules.
7. treatment node device according to claim 6, it is characterised in that the processing module, specifically for：
The attribute of the message event for obtaining is changed, and the message event issue after attribute will be changed；
Or,
Abandon the message event for obtaining；
Or,
The message event that will be obtained is stored in database；
Or,
Message event according to obtaining carries out traffic statistics analysis or safety statistics analysis；
Or,
Message event according to obtaining is associated analysis；
Or,
Forward the message event for obtaining.
8. a kind of bus apparatus, it is characterised in that including：
Load-on module, at least one first treatment nodes for loading card format；
Generation module, at least one first treatment nodes loaded according to the load-on module, generates the first treatment section
First configuration information of point；
Searching modul, in message event of the event source by the messaging bus distribution subscription, matching somebody with somebody according to described first
Information searching message event corresponding with first configuration information is put, the first configuration information is messaging bus dynamic load first
The configuration information generated in treatment node process；
Sending module, the message event for that will search sends the first treatment node, so that at the first treatment node
The message event that haircut is sent.
9. bus apparatus according to claim 8, it is characterised in that the messaging bus also include：
Removing module, at least one first treatment nodes for deleting loading.
10. bus apparatus according to claim 8, it is characterised in that the message event is the message of MAP message type
Event；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination slogan.
11. bus apparatus according to claim 8, it is characterised in that the event source includes following one or more：
The event source in network event source in host event source, internet and the first treatment node in server, by institute
Messaging bus are stated to give out information any access system of event.
12. bus apparatus according to claim 8, first configuration information includes following one or more：
Subscription meets the message event of preset rules, deletion and meets the message event of preset rules, adds in the messaging bus
Plus meet the attribute of the message event of preset rules, the event that gives out information, discarding and meet the message event of preset rules, forwarding symbol
The message event of preset rules, system of real name mapping is closed to meet the message event of preset rules, association analysis and meet preset rules
Message event, storage meet the message event of preset rules.
A kind of 13. news subscribing methods, it is characterised in that including：
When event source is by the message event of messaging bus distribution subscription, on the messaging bus at least one the are carried in
One treatment node obtains message thing corresponding with first configuration information according to the first configuration information in the message event
Part, the first configuration information is the configuration information of generation in the treatment node process of messaging bus dynamic load first；
The message event that the first treatment node is obtained according to first configuration information treatment；
Wherein, the first treatment node is the node being carried in using card format on the messaging bus.
14. methods according to claim 13, it is characterised in that methods described also includes：
The first treatment node is additionally operable to load at least one second processing node, generates corresponding with the second processing node
Second configuration information；
The message thing that the second processing node is subscribed to or issued according to second configuration information from the described first treatment node
Message event corresponding with second configuration information, and the message event that treatment is obtained are obtained in part.
15. methods according to claim 14, it is characterised in that described at least one first treatment nodes and it is described at least
One second processing node constitutes binary tree structure；
Or,
Described at least one first treatment nodes and at least one second processing node composition chain structure.
16. methods according to claim 13, methods described also includes：
The message that the first treatment node is subscribed to or issued according to first configuration information from the another first treatment node
Message event corresponding with first configuration information is obtained in event.
17. methods according to claim 13, it is characterised in that the event source includes following one or more：
The event source in network event source in host event source, internet and the first treatment node in server, by institute
Messaging bus are stated to give out information any access system of event.
18. methods according to claim 13, it is characterised in that it is described be carried on the messaging bus at least one
First treatment node obtains message corresponding with first configuration information according to the first configuration information in the message event
Before event, methods described also includes：
The messaging bus loading at least one first processes node, and generation matches somebody with somebody confidence with the first treatment node corresponding first
Breath；
And/or,
First configuration information includes following one or more：
Subscription meets the message event of preset rules, deletion and meets the message event of preset rules, adds in the messaging bus
Plus meet the attribute of the message event of preset rules, the event that gives out information, discarding and meet the message event of preset rules, forwarding symbol
The message event of preset rules, system of real name mapping is closed to meet the message event of preset rules, association analysis and meet preset rules
Message event, storage meet the message event of preset rules.
19. methods according to claim 13, it is characterised in that the first treatment node matches somebody with somebody confidence according to described first
The message event that breath treatment is obtained, including：
The attribute of the message event that the first treatment node modification is obtained, and the message event issue after attribute will be changed；
Or,
The first treatment node abandons the message event for obtaining；
Or,
The message event that the first treatment node will be obtained is stored in database；
Or,
The first treatment node carries out traffic statistics analysis or safety statistics analysis according to the message event for obtaining；
Or,
The first treatment node is associated analysis according to the message event for obtaining；
Or,
The message event that the first treatment node forwarding is obtained.
20. method according to any claim in claim 13-19, it is characterised in that the message event is MAP
The message event of type of message；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination slogan.
A kind of 21. news subscribing methods, it is characterised in that including：
At least one first treatment nodes of messaging bus loading card format, and generate the first configuration of the first treatment node
Information；
In event source during the message event by the messaging bus distribution subscription, the messaging bus are according to the described first configuration
Information searching message event corresponding with first configuration information, the message event that will be searched sends the first treatment section
Point, so that the message event that the first treatment node processing sends.
22. methods according to claim 21, it is characterised in that methods described also includes：
The messaging bus delete at least one first treatment nodes of loading.
23. methods according to claim 21, it is characterised in that the message event is the message thing of MAP message type
Part；
The form of the message event is the key-value key-value forms of dynamic expansion；
And/or,
The attribute of the message event includes：The source IP of the message event, purpose IP, source port number and destination slogan.
24. methods according to claim 21, it is characterised in that the event source includes following one or more：
The event source in network event source in host event source, internet and the first treatment node in server, by institute
Messaging bus are stated to give out information any access system of event.
25. methods according to claim 21, it is characterised in that first configuration information includes following one kind or many
Kind：
Subscription meets the message event of preset rules, deletion and meets the message event of preset rules, adds in the messaging bus
Plus meet the attribute of the message event of preset rules, the event that gives out information, discarding and meet the message event of preset rules, forwarding symbol
The message event of preset rules, system of real name mapping is closed to meet the message event of preset rules, association analysis and meet preset rules
Message event, storage meet the message event of preset rules.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410850950.3A CN104618142B (en) | 2014-12-30 | 2014-12-30 | News subscribing method, treatment node device and bus apparatus |
| PCT/CN2015/094623 WO2016107306A1 (en) | 2014-12-30 | 2015-11-13 | Message subscription method, processing node device and message bus |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410850950.3A CN104618142B (en) | 2014-12-30 | 2014-12-30 | News subscribing method, treatment node device and bus apparatus |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104618142A CN104618142A (en) | 2015-05-13 |
| CN104618142B true CN104618142B (en) | 2017-07-07 |
Family
ID=53152433
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410850950.3A Active CN104618142B (en) | 2014-12-30 | 2014-12-30 | News subscribing method, treatment node device and bus apparatus |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN104618142B (en) |
| WO (1) | WO2016107306A1 (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104618142B (en) * | 2014-12-30 | 2017-07-07 | 北京奇安信科技有限公司 | News subscribing method, treatment node device and bus apparatus |
| CN105119966B (en) * | 2015-07-15 | 2018-07-13 | 中国联合网络通信集团有限公司 | A kind of public platform management method and device |
| CN108737522B (en) * | 2018-05-09 | 2021-07-20 | 中兴通讯股份有限公司 | Message processing method, device and system |
| CN109614164B (en) * | 2018-11-29 | 2021-09-28 | 深圳前海微众银行股份有限公司 | Method, device and equipment for realizing configurable plug-in and readable storage medium |
| CN109710432B (en) * | 2018-12-29 | 2020-11-20 | 苏州思必驰信息科技有限公司 | Multi-node communication method and system for application program development |
| CN111324469A (en) * | 2020-01-20 | 2020-06-23 | 天津美腾科技股份有限公司 | Method and system for distributed event center with biased application structure optimization |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101013949A (en) * | 2006-12-21 | 2007-08-08 | 建龙钢铁控股有限公司 | Message broadcast communication method |
| CN102938731A (en) * | 2012-11-22 | 2013-02-20 | 北京锐易特软件技术有限公司 | Exchange and integration device and method based on proxy cache adaptation model |
| CN103259701A (en) * | 2012-12-04 | 2013-08-21 | 中国科学院沈阳自动化研究所 | Message bus implementation method for complex production process management system |
| CN103927163A (en) * | 2014-03-06 | 2014-07-16 | 中国人民解放军装甲兵工程学院 | Plugin frame processing device and plugin system |
| CN103986710A (en) * | 2014-05-15 | 2014-08-13 | 华为技术有限公司 | Method, device and system for transmitting information |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020156601A1 (en) * | 2001-04-19 | 2002-10-24 | Tu Kevin Hsiaohsu | Event monitoring and detection system |
| US9043386B2 (en) * | 2010-10-06 | 2015-05-26 | Hbr Labs Inc. | System and method for synchronizing collaborative form filling |
| US8797920B2 (en) * | 2011-04-20 | 2014-08-05 | IBT—Internet Business Technologies | Methods and systems for access to real-time full-duplex web communications platforms |
| CN104618142B (en) * | 2014-12-30 | 2017-07-07 | 北京奇安信科技有限公司 | News subscribing method, treatment node device and bus apparatus |
-
2014
- 2014-12-30 CN CN201410850950.3A patent/CN104618142B/en active Active
-
2015
- 2015-11-13 WO PCT/CN2015/094623 patent/WO2016107306A1/en active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101013949A (en) * | 2006-12-21 | 2007-08-08 | 建龙钢铁控股有限公司 | Message broadcast communication method |
| CN102938731A (en) * | 2012-11-22 | 2013-02-20 | 北京锐易特软件技术有限公司 | Exchange and integration device and method based on proxy cache adaptation model |
| CN103259701A (en) * | 2012-12-04 | 2013-08-21 | 中国科学院沈阳自动化研究所 | Message bus implementation method for complex production process management system |
| CN103927163A (en) * | 2014-03-06 | 2014-07-16 | 中国人民解放军装甲兵工程学院 | Plugin frame processing device and plugin system |
| CN103986710A (en) * | 2014-05-15 | 2014-08-13 | 华为技术有限公司 | Method, device and system for transmitting information |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2016107306A1 (en) | 2016-07-07 |
| CN104618142A (en) | 2015-05-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104618142B (en) | News subscribing method, treatment node device and bus apparatus | |
| US11716335B2 (en) | Detection and restriction of unwanted messages through time interval cluster analysis | |
| US20170264627A1 (en) | Cost Prioritized Evaluations of Indicators of Compromise | |
| US9003023B2 (en) | Systems and methods for interactive analytics of internet traffic | |
| CN102833240B (en) | A kind of malicious code catching method and system | |
| US9703974B1 (en) | Coordinated file system security via rules | |
| US20130246335A1 (en) | System and method for providing data protection workflows in a network environment | |
| CN111740868B (en) | Alarm data processing method and device and storage medium | |
| CN111752799A (en) | Service link tracking method, device, equipment and storage medium | |
| CN109074454A (en) | Malware is grouped automatically based on artefact | |
| US20220159043A1 (en) | Multi-perspective security context per actor | |
| CN111488594B (en) | Permission checking method and device based on cloud server, storage medium and terminal | |
| CN114548706A (en) | Early warning method for business risk and related equipment | |
| CN112347501A (en) | Data processing method, device, equipment and storage medium | |
| CN111191247A (en) | Database security audit system | |
| CN110941823B (en) | Threat information acquisition method and device | |
| KR101783298B1 (en) | Method for creating and managing node information from input data based on graph database and server using the same | |
| CN109977139B (en) | Data processing method and device based on class structured query statement | |
| CN107885634B (en) | Method and device for processing abnormal information in monitoring | |
| CN105978908B (en) | A kind of non-real-time information web portal security guard method and device | |
| CN114826790B (en) | Block chain monitoring method, device, equipment and storage medium | |
| CN110221961B (en) | Global hook automatic repair method, device, equipment and storage medium | |
| CN111885088A (en) | Log monitoring method and device based on block chain | |
| CN111901199A (en) | Mass data-based quick early warning matching implementation method | |
| US20220247763A1 (en) | Dynamic Computer Threat Alert System and Method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C41 | Transfer of patent application or patent right or utility model | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20161206 Address after: 100015 Chaoyang District Road, Jiuxianqiao, No. 10, building No. 3, floor 15, floor 17, 1701-26, Applicant after: BEIJING QIANXIN TECHNOLOGY Co.,Ltd. Address before: 100088 Beijing city Xicheng District xinjiekouwai Street 28, block D room 112 (Desheng Park) Applicant before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Applicant before: Qizhi software (Beijing) Co.,Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CP03 | Change of name, title or address | ||
| CP03 | Change of name, title or address |
Address after: Room 332, 3 / F, Building 102, 28 xinjiekouwei street, Xicheng District, Beijing 100088 Patentee after: Qianxin Technology Group Co.,Ltd. Address before: 100015 15, 17 floor 1701-26, 3 building, 10 Jiuxianqiao Road, Chaoyang District, Beijing. Patentee before: BEIJING QIANXIN TECHNOLOGY Co.,Ltd. |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20201229 Address after: 100044 2nd floor, building 1, yard 26, Xizhimenwai South Road, Xicheng District, Beijing Patentee after: LEGENDSEC INFORMATION TECHNOLOGY (BEIJING) Inc. Patentee after: Qianxin Technology Group Co.,Ltd. Address before: Room 332, 3 / F, Building 102, 28 xinjiekouwei street, Xicheng District, Beijing 100088 Patentee before: Qianxin Technology Group Co.,Ltd. |
|
| CP01 | Change in the name or title of a patent holder | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 100044 2nd floor, building 1, yard 26, Xizhimenwai South Road, Xicheng District, Beijing Patentee after: Qianxin Wangshen information technology (Beijing) Co.,Ltd. Patentee after: Qianxin Technology Group Co.,Ltd. Address before: 100044 2nd floor, building 1, yard 26, Xizhimenwai South Road, Xicheng District, Beijing Patentee before: LEGENDSEC INFORMATION TECHNOLOGY (BEIJING) Inc. Patentee before: Qianxin Technology Group Co.,Ltd. |