CN116847005B - Message analysis method, analysis device and network equipment - Google Patents

Message analysis method, analysis device and network equipment Download PDF

Info

Publication number
CN116847005B
CN116847005B CN202311120363.4A CN202311120363A CN116847005B CN 116847005 B CN116847005 B CN 116847005B CN 202311120363 A CN202311120363 A CN 202311120363A CN 116847005 B CN116847005 B CN 116847005B
Authority
CN
China
Prior art keywords
protocol
bit
message
column
configuration
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202311120363.4A
Other languages
Chinese (zh)
Other versions
CN116847005A (en
Inventor
方梁炜
刘天宇
陈罡
张越超
邱建刚
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Xinqi Electronic Technology Co ltd
Original Assignee
Hangzhou Xinqi Electronic Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Xinqi Electronic Technology Co ltd filed Critical Hangzhou Xinqi Electronic Technology Co ltd
Priority to CN202311120363.4A priority Critical patent/CN116847005B/en
Publication of CN116847005A publication Critical patent/CN116847005A/en
Application granted granted Critical
Publication of CN116847005B publication Critical patent/CN116847005B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/50—Routing or path finding of packets in data switching networks using label swapping, e.g. multi-protocol label switch [MPLS]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Communication Control (AREA)

Abstract

The application discloses a message analysis method, an analysis device and network equipment, which relate to the technical field of communication networks, wherein the message analysis method comprises the following steps: determining protocol fields in message headers of each layer in each protocol forwarding path in a protocol analysis tree, performing key bit extraction on all the protocol fields, obtaining key bit strings and key bit positions corresponding to each protocol forwarding path, receiving a target message, wherein the target message comprises message headers of a plurality of protocol layers which are nested in sequence, and extracting bit values at bit positions corresponding to each message header according to the stored key bit positions to form a target bit string; and matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and the corresponding protocol types of all layers of protocols according to the matching result. The application can improve the efficiency and throughput of message analysis.

Description

Message analysis method, analysis device and network equipment
Technical Field
The present application relates to the field of communications networks, and in particular, to a method, an parsing device, and a network device for parsing a message.
Background
The parser is a key component of the network data plane, and is configured to parse the message to determine key fields of the message, such as a protocol type, a destination address carried by the message, and the like, and provide key information of the message for other processing components of the data plane.
In the related art, the schemes for extracting the key fields of the message by the parser generally include two schemes, namely a serial scheme and a parallel scheme. In the serial scheme, the system is generally composed of a plurality of stages of resolvers connected in series in a slicing way, a pipeline structure is formed, and key fields of the message are analyzed from the message in a pipeline operation mode. Each parser slice is only used for parsing one protocol field in the message, so that the parsing capability of the parser is determined according to the number of the parser slices, and the larger the number of the parser slices is, the larger the number of the protocol fields which can be parsed by the parser is, so that when some complex messages can comprise dozens of protocol fields, the parsing of the complex messages can be realized by dozens of parser slices. Since the serial parsing is performed, the larger the number of parser slices is, the performance of parsing, delay, etc. are affected, and the power consumption area increases correspondingly. In the parallel scheme, the parser parses all protocol fields in the message at the same time, the parsing process of the parser is implemented by looking up a matching table, and the matching table used needs to contain all possible parsing results. Therefore, when some complex messages may include tens of protocol fields, the number of entries in the matching table increases exponentially, and the parser cannot extract all the protocol fields in one period, so that the processing period of the parser becomes long, the delay of the parser is increased, the parsing efficiency is low, and the throughput of message processing is low.
Disclosure of Invention
The application aims at a message analysis method which can improve the efficiency of message analysis and the throughput of message analysis.
Based on the above objects, the present application provides a message parsing method, which includes:
determining a protocol field in each layer of message header in each protocol forwarding path in a preset protocol analysis tree, performing compression and key bit extraction on all the protocol fields, and determining a key bit string and a key bit position corresponding to each protocol forwarding path, wherein the key bit string comprises a plurality of key bits, the key bit position is used for indicating the bit position of each key bit in each layer of message header, and the key bit string is used for indicating conversion path information among each layer of protocols in the protocol forwarding path and the protocol type of each layer of protocol;
storing key bit strings and key bit positions, and storing the mapping relation between each key bit string and a corresponding protocol forwarding path;
receiving a target message, wherein the target message comprises message heads of a plurality of protocol layers which are nested in sequence, extracting bit values at bit positions corresponding to each message head according to the stored key bit positions, and forming a target bit string;
And matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and the protocol types of the corresponding layers of protocols according to the matching result.
Further, the protocol analysis tree includes a root node and a plurality of sub-nodes, the root node and each sub-node are used for indicating the network protocol type corresponding to the message header of each layer, a plurality of different protocol forwarding paths are formed between the root node and each sub-node, and the protocol forwarding paths are used for indicating the conversion path information among the protocols of each layer in the message.
Further, performing compression and key bit extraction on all protocol fields, determining key bit strings and key bit positions corresponding to each protocol forwarding path, including:
constructing a corresponding configuration message based on each protocol forwarding path, wherein the configuration message comprises message heads and message bodies of a plurality of protocol layers which are nested in sequence, the nesting sequence of the protocol layers is the same as that of the protocol forwarding paths, the message heads comprise protocol fields, and the values in the protocol fields indicate the protocol types of the message heads of the next layer of the message heads;
setting x for all the rest bits except the protocol field in each configuration message, and generating each configuration message into a corresponding configuration bit string;
Acquiring the lengths of all configuration bit strings to obtain the maximum value of the lengths;
calculating the length to be complemented of a configuration bit string with the length of the configuration bit string smaller than the maximum value by taking the maximum value of the length as a reference, and adding bits x with corresponding lengths at the tail end of the configuration bit string so that the lengths of all the configuration bits are the maximum value;
and arranging all the configuration bits to obtain configuration bit data with M rows and Y columns, wherein the M rows correspond to M configuration bit strings, and the Y columns correspond to bit positions of each bit in the configuration message.
Further, performing compression and key bit extraction on all the protocol fields, determining a key bit string and a key bit position corresponding to each protocol forwarding path, and further including:
s401, traversing each column of configuration bit data, deleting the column if the bit value of the column is x, recording the reserved column number, and recording the configuration bit data after the column deleting operation as first configuration bit data;
s402, traversing any two columns of the first configuration bit data, deleting one column if the bit values of the two columns are the same, recording the reserved column numbers, and recording the configuration bit data after the column deleting operation as second configuration bit data;
S403, traversing each column of the second configuration bit data, deleting the column if the bit value of the column is only x and 1, recording the reserved column number, and recording the configuration bit data after the column deleting operation as third configuration bit data;
s404, traversing each column of the third configuration bit data, deleting the column if the bit value of the column is only x and 0, recording the reserved column number, and recording the configuration bit data after the column deleting operation as fourth configuration bit data.
Further, performing compression and key bit extraction on all the protocol fields, determining a key bit string and a key bit position corresponding to each protocol forwarding path, and further including:
traversing bit values of any two rows of fourth configuration bit data, and if the bit values are inconsistent, storing the fourth configuration bit data, wherein each row of data in the fourth configuration bit data corresponds to a key bit string of each protocol forwarding path, and a column number in the fourth configuration bit data corresponds to a key bit position;
if two identical rows of bit values exist, second configuration bit data are stored, each row of data of the second configuration bit data corresponds to a key bit string of each protocol forwarding path, and a column number in the second configuration bit data corresponds to a key bit position.
Further, performing compression and key bit extraction on all the protocol fields, determining a key bit string and a key bit position corresponding to each protocol forwarding path, and further including:
s501, assuming that the total column number of the fourth configuration bit data is L columns and the total line number is M lines, the M lines represent M configuration bit strings corresponding to M protocol forwarding paths, and setting the initial column number L of traversal 0 Is that=/>；
S502, obtaining L from L columns 0 Traversing each column combination, stopping traversing if no repeated configuration bit string exists in the selected column combination, and recording column numbers in the selected column combination to obtain M key bit strings corresponding to M protocol forwarding paths, wherein the column numbers in the selected column combination correspond to the key bit positions;
s503, if the repeated configuration bit string exists in the selected column combination, L is set as 0 Increment 1, select L from L columns 0 All column combinations of +1 columns, repeatedly performing step S502;
s504, repeatedly executing the step S503 until the selected column combination in the L columns enables the M row configuration bit strings not to be repeated, stopping traversing, and recording the column numbers in the selected column combination to obtain M key bit strings corresponding to the M protocol forwarding paths, wherein the column numbers in the selected column combination correspond to the key bit positions.
Further, performing compression and key bit extraction on all the protocol fields, determining a key bit string and a key bit position corresponding to each protocol forwarding path, and further including:
s601, assuming that the total column number of the fourth configuration bit data is L columns and the total row number is M rows, wherein the M rows represent M configuration bit strings corresponding to M protocol forwarding paths, and the number of initial traversed columns is L columns;
s602, selecting one column from L columns, judging whether repeated configuration bit strings exist in all columns remaining after the columns are removed, if not, executing the step S604, and if so, executing the step S603;
s603, reselecting a column from L columns, wherein the selected column and the last selected column cannot be repeated, judging whether repeated configuration bit strings exist in all columns remaining after the column is removed, if not, executing step S604, if yes, executing step S603 again, and if all columns in L columns are selected and cannot be deleted again, executing step S605;
s604, deleting the selected column from the L columns, recording the remaining column numbers, recording the remaining configuration bit data after the operation of deleting the column, and executing the step S602;
s605, the remaining column numbers are recorded to obtain M key bit strings corresponding to the M protocol forwarding paths, and the remaining column numbers correspond to key bit positions.
Based on the above object, the present application provides an analytical device, the device comprising:
the extraction module is used for determining protocol fields in each layer of message header in each protocol forwarding path in a preset protocol analysis tree, performing compression and key bit extraction on all the protocol fields, determining a key bit string and a key bit position corresponding to each protocol forwarding path, wherein the key bit string comprises a plurality of key bits, the key bit position is used for indicating the bit position of each key bit in each layer of message header, and the key bit string is used for indicating conversion path information among each layer of protocols in the protocol forwarding path and the protocol type of each layer of protocol;
the storage module is used for storing the key bit strings and the key bit positions and storing the mapping relation between each key bit string and the corresponding protocol forwarding path;
the analysis module is used for receiving a target message, wherein the target message comprises message heads of a plurality of protocol layers which are nested in sequence, and bit values are extracted from bit positions corresponding to each message head according to the stored key bit positions to form a target bit string;
and the matching module is used for matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and the protocol types of the corresponding layers of protocols according to the matching result.
Based on the above object, the present application provides a network device comprising the parsing means as described above.
In view of the above, the present application provides a computer-readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method as described above.
The application can shorten the processing period of message analysis, reduce the delay of message analysis, improve the efficiency of message analysis and improve the throughput of message processing.
Drawings
FIG. 1 is a first flowchart of a message parsing method according to an embodiment of the present application;
FIG. 2 is a schematic diagram of a protocol parsing tree provided in accordance with an embodiment of the present application;
FIG. 3 is a second flowchart of a message parsing method according to an embodiment of the present application;
FIG. 4 is a third flowchart of a message parsing method according to an embodiment of the present application;
fig. 5 is a fourth flowchart of a message parsing method according to an embodiment of the present application;
fig. 6 is a fifth flowchart of a message parsing method according to an embodiment of the present application;
FIG. 7 is a system block diagram of a resolution device provided in accordance with an embodiment of the present application;
fig. 8 is a schematic structural diagram of a network device according to an embodiment of the present application.
Detailed Description
The present application will be described in detail below with reference to the specific embodiments shown in the drawings, but these embodiments are not limited to the present application, and structural, method, or functional modifications made by those skilled in the art based on these embodiments are included in the scope of the present application.
Referring to fig. 1, an embodiment of the present application provides a method for parsing a message, including the steps of:
s101, determining a protocol field in each layer of message header in each protocol forwarding path in a preset protocol analysis tree, performing compression and key bit extraction on all the protocol fields, and determining a key bit string and a key bit position corresponding to each protocol forwarding path, wherein the key bit string comprises a plurality of key bits, the key bit position is used for indicating the bit position of each key bit in each layer of message header, and the key bit string is used for indicating conversion path information among each layer of protocols in the protocol forwarding path and the protocol type of each layer of protocol;
s102, storing key bit strings and key bit positions, and storing the mapping relation between each key bit string and a corresponding protocol forwarding path;
S103, receiving a target message, wherein the target message comprises message heads of a plurality of protocol layers which are nested in sequence, extracting bit values at bit positions corresponding to each message head according to the stored key bit positions, and forming a target bit string;
s104, matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and the protocol types of the corresponding layers of protocols according to the matching result.
Computer networks are divided into seven layers in the open systems interconnection (Open System Interconnect, OSI) model, and various network protocols also correspond to one of the layers, respectively, such as "Ethernet type" corresponding to the data link layer of the OSI layer and "IPv4" corresponding to the network layer of the OSI model. Before the network message is sent to the network, the message header of the network message is also encapsulated according to the hierarchical relationship, the highest layer protocol is encapsulated at the innermost layer, then the lower layer protocol is adopted, and the unpacking process is just opposite. Because of this hierarchical relationship between protocols, in the parsing process of the header, any inner layer protocol header is unknown before parsing the previous protocol except the outermost protocol header, and can be confirmed only after the previous protocol header is parsed. Therefore, when the message header parser is designed, all network protocols supported by the message header parser can be known according to the design, and a directed acyclic graph is used to clearly represent the relationship, which is called a protocol parse tree. When the analysis method provided by the embodiment of the application is designed, the corresponding protocol analysis tree is designed according to the clear analysis requirement of the network protocol or the user requirement. The protocol analysis tree comprises a root node and a plurality of sub-nodes, the root node and each sub-node are used for indicating the network protocol type corresponding to the message header of each layer, a plurality of different protocol forwarding paths are formed between the root node and each sub-node, and the protocol forwarding paths are used for indicating conversion path information among the protocols of each layer in the message. As shown in fig. 2, the exemplary protocol parsing tree includes 7 protocol layers, where protocol layer 1 is an Ethernet protocol layer, protocol layer 2 is an MPLS protocol layer, protocol layer 3 is an MPLS protocol layer, protocol layer 4 is an MPLS protocol layer, protocol layer 5 is an MPLS protocol layer, protocol layer 6 is an MPLS protocol layer, and protocol layer 7 includes IPv4 and IPv6. Protocol layer 1 can be indicated to protocol layer 2 and protocol layer 7 respectively, and protocol layer 2 can be indicated to protocol layer 3 and protocol layer 7 respectively, so that a plurality of different protocol forwarding paths can be formed, for example, protocol layer 1 Ethernet protocol layer- > protocol layer 2 MPLS protocol layer- > protocol layer 7 IPv4 forms a protocol forwarding path, and protocol layer 1 Ethernet protocol layer- > protocol layer 2 MPLS protocol layer- > protocol layer 3 MPLS protocol layer- > protocol layer 7 IPv6 forms a protocol forwarding path.
The architecture of the network protocol is typically a layered architecture, and messages conforming to the network protocol are typically layered. For example, a message typically includes a message body and multiple layers of message headers that are encapsulated in sequence outside the message body, each layer of message header corresponding to one protocol layer, each layer of message header conforming to the protocol of the corresponding protocol layer. Wherein, each layer of message header includes a protocol field, the value in the protocol field indicates the protocol type of the next layer of message header of the message header, and the protocol type of the next layer of message header of the message header is different according to the difference of the value in the protocol field. For example, the key protocol field in the ethernet header may be an ethernet type (eth_type) field, and the value in the eth_type field may indicate that the next layer of the ethernet header is an internet protocol version 4 (internet protocol version 4, ipv 4) header or an internet protocol version 6 (internet protocol version, ipv 6) header. The critical protocol field in the user datagram protocol (user datagram protocol, UDP) header may be a destination port (destport) field, and the value in the destport field may indicate that the next layer header of the UDP header is a dynamic host configuration protocol (dynamic host configurationprotocol, DHCP) header or a file transfer protocol (file transfer protocol, FTP) header.
Based on the determined protocol analysis tree, the embodiment of the application can determine all protocol forwarding paths in the protocol analysis tree, and can determine the protocol field in each protocol layer message header in each protocol forwarding path, wherein the value in the protocol field indicates the protocol type of the message header in the next layer, so that compression and key bit extraction are performed on all the obtained protocol fields, and the key bit string and key bit position corresponding to each protocol forwarding path can be determined, wherein the key bit string comprises a plurality of key bits, and the key bit position is used for indicating the bit position of each extracted key bit in the corresponding message header in each layer. According to the obtained key bit positions, bit values corresponding to the message heads of all layers in each protocol forwarding path at the key bit positions can be determined, so that corresponding key bit strings are determined, and the key bit strings are used for indicating conversion path information among all layers of protocols in the protocol forwarding path and protocol types of all corresponding layers of protocols. Extracting bit values from bit positions corresponding to message headers of all layers of the received target message to form a target bit string, and matching the target bit string with the stored key bit string to determine conversion path information among all layers of protocols in the target message and protocol types of the corresponding layers of protocols. By compressing the protocol field and extracting the key bits, the length of the original protocol field is shortened, the delay of message analysis is reduced, the analysis efficiency is improved, and the throughput of message processing is improved.
The embodiment will be specifically described with reference to fig. 2. Fig. 2 is a determined protocol parsing tree, so that all protocol forwarding paths in the protocol parsing tree can be determined as follows:
ethernet->mpls1->mpls2->mpls3->mpls4->mpls5->ipv4；
ethernet->mpls1->mpls2->mpls3->mpls4->mpls5->ipv6；
ethernet->mpls1->mpls2->mpls3>mpls4->ipv4；
ethernet->mpls1->mpls2->mpls3>mpls4->ipv6；
ethernet->mpls1->mpls2->mpls3->ipv4；
ethernet->mpls1->mpls2->mpls3->ipv6；
ethernet->mpls1->mpls2 ->ipv4；
ethernet->mpls1->mpls2 ->ipv6；
ethernet->mpls1 ->ipv4；
ethernet->mpls1 ->ipv6；
ethernet->ipv4；
ethernet->ipv6。
based on all the protocol forwarding paths listed above, for each protocol forwarding path, the protocol field values in the respective protocol layer header on that path can be determined. Based on all the determined protocol field values, compression and key bit extraction are performed to enable a reduction in the length of the protocol field.
As an alternative implementation, as shown in fig. 3, performing compression and key bit extraction on all protocol fields, determining a key bit string and a key bit position corresponding to each protocol forwarding path includes:
s301, constructing a corresponding configuration message based on each protocol forwarding path, wherein the configuration message comprises message heads and message bodies of a plurality of protocol layers which are nested in sequence, and the nesting sequence of the protocol layers is the same as that of the protocol forwarding paths, wherein the message heads comprise values in protocol fields to indicate the protocol types of the message heads of the next layer of the message heads;
s302, setting x for all the rest bits except the protocol field in each configuration message, and generating each configuration message into a corresponding configuration bit string;
S303, acquiring the lengths of all configuration bit strings to obtain the maximum value of the lengths;
s304, calculating the length to be complemented of the configuration bit string with the length of the configuration bit string smaller than the maximum value by taking the maximum value of the length as a reference, and adding bits x with corresponding lengths at the tail of the configuration bit string so that the lengths of all the configuration bits are the maximum value;
s305, arranging all configuration bits to obtain configuration bit data with M rows and Y columns, wherein the M rows correspond to M configuration bit strings, and the Y columns correspond to bit positions of each bit in a configuration message.
Because each protocol forwarding path is already determined, that is, conversion path information between protocols of each layer in the message and a protocol layer corresponding to a message header of each layer can be determined, a corresponding configuration message can be constructed. And configuring message heads and message bodies of a plurality of protocol layers of which the messages are nested in sequence, wherein the nesting sequence of the protocol layers is the same as that of the protocol forwarding path, the message heads comprise protocol fields, and the values in the protocol fields indicate the protocol types of the message heads of the next layer of the message heads. And setting all the rest bits except the protocol field in the configuration message to x, wherein the protocol field value in the configuration message is kept unchanged, and the other bits are set to x, so that a corresponding configuration bit string can be obtained. And acquiring the lengths of all the configuration bit strings to obtain the maximum value of the lengths. Because the protocol forwarding paths of the configuration messages are different, the lengths of the configuration messages are different, so that bit alignment operation needs to be performed on all configuration bit strings so that all configuration bit strings have the same length. Specifically, taking the maximum value as a reference, calculating the bit length to be complemented of the configuration bits with the length smaller than the maximum value, and adding the bit x with the corresponding length at the tail end of the configuration bit string so that the lengths of all the configuration bits are the maximum value. And arranging all the configuration bits after the completion of the filling to obtain configuration bit data with M rows and Y columns, wherein the configuration bit data of M rows is M configuration bit strings, namely the configuration bit strings corresponding to M protocol forwarding paths, and the Y columns correspond to the bit positions of each bit in the configuration message.
As an alternative implementation, as shown in fig. 4, performing compression and key bit extraction on all protocol fields, determining a key bit string and a key bit position corresponding to each protocol forwarding path includes:
s401, traversing each column of configuration bit data, deleting the column if the bit value of the column is x, recording the reserved column number, and recording the configuration bit data after the column deleting operation as first configuration bit data;
s402, traversing any two columns of the first configuration bit data, deleting one column if the bit values of the two columns are the same, recording the reserved column numbers, and recording the configuration bit data after the column deleting operation as second configuration bit data;
s403, traversing each column of the second configuration bit data, deleting the column if the bit value of the column is only x and 1, recording the reserved column number, and recording the configuration bit data after the column deleting operation is performed as third configuration bit data;
s404, traversing each column of the third configuration bit data, deleting the column if the bit value of the column is only x and 0, recording the reserved column number, and recording the configuration bit data after the column deleting operation is performed as fourth configuration bit data.
The longer the length of the configuration bit data of the M rows and Y columns, the longer the message processing time is caused when the message is analyzed in a single clock cycle and when the message is matched and searched, and the throughput of the message processing is low, so that the length of the configuration bit data needs to be compressed, and firstly, irrelevant bits and repeated bits in the configuration bit data are deleted, so that the length of the bit data is shortened. Specifically, first, columns with all x bit values in the configuration bit data columns are deleted, columns with repeated or equal bit values are deleted, columns with only x and 1 bit values are deleted, columns with only x and 0 bit values are deleted, the reserved column numbers are recorded, and the column numbers are used for indicating the bit positions of the bits of the columns in the configuration message. By shortening the length of the bit data, the speed and efficiency of message processing are improved, the delay of message analysis is reduced, and the throughput of message processing is improved.
As an alternative implementation manner, the steps of performing compression and key bit extraction on all the protocol fields, and determining the key bit string and the key bit position corresponding to each protocol forwarding path further include: traversing bit values of any two rows of fourth configuration bit data, if the bit values are inconsistent, storing the fourth configuration bit data, wherein each row of data in the fourth configuration bit data corresponds to a key bit string of each protocol forwarding path, and a column number in the fourth configuration bit data corresponds to a key bit position; if two identical rows of bit values exist, second configuration bit data are stored, each row of data of the second configuration bit data corresponds to a key bit string of each protocol forwarding path, and a column number in the second configuration bit data corresponds to a key bit position. Steps S401 and S402 are processing of configuration bit data without loss of information amount, i.e., second configuration bit data without loss of information amount. The processing in steps S403 and S404 may result in a loss of information, i.e., the fourth configuration bit data is lost in information, and thus the above-described processing is required. The length of the fourth configuration bit data is relatively smaller than the length of the second configuration bit data, however, the fourth configuration bit data is a preferred choice. The reason for the processing in steps S403 and S404 will now be described by way of example. It is assumed that the configuration bit data has two bit strings a and B, the bit string length is 1, the bit string a is 1, and the bit string B is x. In the matching judgment of the target message, if the input bit string is 0, it can be judged that the input bit string matches the bit string B, because it is impossible to match the bit string a, and the bit string a is 1, but when the input bit string is 1, it cannot be judged whether it matches the bit string a or B. It is assumed that the configuration bit data has two bit strings C and D, the bit string length is 2, the bit string C is 0x, and the bit string D is x1. When the matching judgment is performed on the target message, if the input bit string is 00 or 01, it can be judged that the input bit string matches bit string C or bit string D, but when the input bit string is 01, it cannot be judged whether it matches bit string C or bit string D. Therefore, since the amount of information that can be provided by a certain column of bits cannot be guaranteed to be correctly judged when only x and 1 or only x and 0 are present, these columns are deleted in steps S403 and S404.
In one embodiment, matching may be performed on the target packet based on the obtained key bit string and the key bit position, and conversion path information between the protocols of each layer in the target packet and the protocol types of the corresponding protocols of each layer are determined according to the matching result.
The length of the configuration bit string of each row in the fourth configuration bit data obtained according to the above steps is relatively shortened, although the length of the configuration bit string is not the smallest, but the length of the configuration bit string can be further shortened, so that the embodiment of the application further shortens the length of the configuration bit string by means of violent searching. As can be seen from the above embodiments, the second configuration bit data and the fourth configuration bit data may be used as initial data for searching, and if the fourth configuration bit data is obtained, the fourth configuration bit data is used as initial data for searching, and if the second configuration bit data is obtained, the second configuration bit data is used as initial data for searching. In this embodiment, the fourth configuration bit data will be described as an example. The second configuration bit data is similar in embodiment and will not be described again here. As an alternative implementation manner, as shown in fig. 5, compression and key bit extraction are performed on all protocol fields, and a key bit string and a key bit position corresponding to each protocol forwarding path are determined, which further includes:
S501, assuming that the total column number of the fourth configuration bit data is L columns and the total line number is M lines, the M lines represent M configuration bit strings corresponding to M protocol forwarding paths, and setting the initial column number L of traversal 0 Is that=/>；
S502, obtaining L from L columns 0 Traversing each column combination, stopping traversing if no repeated configuration bit string exists in the selected column combination, and recording column numbers in the selected column combination to obtain M key bit strings corresponding to M protocol forwarding paths, wherein the column numbers in the selected column combination correspond to the key bit positions;
s503, if the repeated configuration bit string exists in the selected column combination, L is set as 0 Increment 1, select L from L columns 0 All column combinations of +1 columns, repeatedly performing step S502;
s504, repeatedly executing the step S503 until the selected column combination in the L columns enables the X row configuration bit strings not to be repeated, stopping traversing, recording the column numbers in the selected column combination, and obtaining M key bit strings corresponding to M protocol forwarding paths, wherein the column numbers in the selected column combination correspond to the key bit positions.
In one embodiment, the bit matching may be performed on the received target packet based on the key bit string and the key bit position acquired in steps S502 and S504. The target message comprises message heads of a plurality of protocol layers which are nested in sequence. Extracting bit values at bit positions corresponding to all message headers according to the stored key bit positions to form a target bit string, matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and protocol types of the corresponding layers of protocols according to matching results. According to the embodiment, through performing traversal search on the combination of the plurality of columns, repeated bit strings are removed, the length of a protocol field is further shortened, the speed and the efficiency of message processing are further improved, the delay of message analysis is greatly reduced, and the throughput of message processing is greatly improved.
In actual operation of the embodiment shown in fig. 5, the traversal method has a large calculation amount, so that the operation process is long, and the resource consumption of the FPGA is affected. Therefore, an embodiment of local optimization traversal is proposed, as shown in fig. 6, performing compression and key bit extraction on all protocol fields, and determining key bit strings and key bit positions corresponding to each protocol forwarding path, which further includes:
s601, assuming that the total column number of the fourth configuration bit data is L columns and the total row number is M rows, wherein the M rows represent M configuration bit strings corresponding to M protocol forwarding paths, and the number of initial traversed columns is L columns;
s602, selecting one column from L columns, judging whether repeated configuration bit strings exist in all columns remaining after the columns are removed, if not, executing the step S604, and if so, executing the step S603;
s603, reselecting a column from L columns, wherein the selected column and the last selected column cannot be repeated, judging whether repeated configuration bit strings exist in all columns remaining after the column is removed, if not, executing step S604, if yes, executing step S603 again, and if all columns in L columns are selected and cannot be deleted again, executing step S605;
S604, deleting the selected column from the L columns, recording the remaining column numbers, recording the remaining configuration bit data after the operation of deleting the column, and executing the step S602;
s605, the remaining column numbers are recorded to obtain M key bit strings corresponding to the M protocol forwarding paths, and the remaining column numbers correspond to key bit positions.
The embodiment confirms the least columns in a locally optimal mode, so that the calculation amount is reduced, the efficiency of system resources is improved, the length of a protocol field can be further shortened, the speed and the efficiency of message processing can be further improved, and the throughput of message processing is greatly improved. As can be seen from the above embodiments, the second configuration bit data and the fourth configuration bit data may be used as initial data for traversal, and if the fourth configuration bit data is obtained, the fourth configuration bit data is used as initial data for traversal, and if the second configuration bit data is obtained, the second configuration bit data is used as initial data for traversal. In this embodiment, the fourth configuration bit data will be described as an example. The second configuration bit data is similar in embodiment and will not be described again here.
In one embodiment, the received target packet may be bit matched based on the key bit string and the key bit position obtained in step S605. The target message comprises message heads of a plurality of protocol layers which are nested in sequence. Extracting bit values at bit positions corresponding to all message headers according to the stored key bit positions to form a target bit string, matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and protocol types of the corresponding layers of protocols according to matching results. The embodiment can further shorten the length of the protocol field, further improve the speed and efficiency of message processing, greatly reduce the delay of message analysis and greatly improve the throughput of message processing.
As shown in fig. 7, as an alternative implementation manner, the parsing device provided in the embodiment of the present application includes:
the extracting module 701 is configured to determine a protocol field in each layer of header in each protocol forwarding path in a preset protocol parsing tree, perform compression and key bit extraction on all the protocol fields, determine a key bit string and a key bit position corresponding to each protocol forwarding path, where the key bit string includes a plurality of key bits, the key bit position is used to indicate a bit position of each key bit in each layer of header, and the key bit string is used to indicate conversion path information between each layer of protocol in the protocol forwarding path and a protocol type of each layer of protocol;
A storage module 702, configured to store a key bit string and the key bit positions, and store a mapping relationship between each key bit string and a corresponding protocol forwarding path;
the parsing module 703 is configured to receive a target message, where the target message includes message headers of multiple protocol layers nested in sequence, and extract bit values at bit positions corresponding to each message header according to the stored key bit positions, so as to form a target bit string;
and a matching module 704, configured to match the target bit string with the stored key bit string, and determine conversion path information between the protocols of each layer in the target packet and the protocol types of the corresponding protocols of each layer according to the matching result.
The embodiment of the application also provides a network device, which comprises the analysis device, for example, the network device comprises the analysis device shown in fig. 7. The network device may be any network device used for traffic forwarding in a communication network. For example, the network device may be a switch, a router, etc., depending on the type of device. The network device may be an edge network device, a core network device, or a network device in a data center, as classified by device deployment location.
As an example, please refer to fig. 8, which illustrates a schematic structural diagram of a network device according to an embodiment of the present application. The network device comprises a parsing device 801, a communication interface 802, a processor 803, a memory 804 and a bus 805. The processor 803, memory 804, communication interface 802, and analyzing device 801 are communicatively coupled to each other via a bus 805. The connection between the processor 803, the memory 804, the communication interface 802, and the analyzing device 801 shown in fig. 8 is merely exemplary, and in the implementation, the processor 803, the memory 804, the communication interface 802, and the analyzing device 801 may be communicatively connected to each other by a connection other than the bus 805.
The memory 804 may be used to store a computer program 8041, which computer program 8041 may include instructions and data. In an embodiment of the present application, the memory 804 may be various types of storage media, such as random access memory (random access memory, RAM), read Only Memory (ROM), non-volatile RAM (NVRAM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (electrical erasablePROM, EEPROM), flash memory, optical memory, registers, and so on. The memory 804 may include a hard disk and/or memory.
The processor 803 may be a general purpose processor, which may be a processor that performs certain steps and/or operations by reading and executing a computer program (e.g., computer program 8041) stored in a memory (e.g., memory 804), which may use data stored in the memory (e.g., memory 804) in performing the steps and/or operations. A general purpose processor may be, for example, but is not limited to, a central processing unit (centralprocessing unit, CPU). Furthermore, processor 803 may also be a special purpose processor, which may be a specially designed processor for performing certain steps and/or operations, such as, but not limited to, an ASIC, FPGA, or the like. Furthermore, the processor 803 may also be a combination of multiple processors, such as a multi-core processor.
Communication interface 802 may include input/output (I/O) interfaces, physical interfaces, logical interfaces, and the like for implementing device interconnections within a network device, as well as interfaces for implementing network device interconnections with other devices (e.g., network devices). The physical interface may be a Gigabit Ethernet (GE) interface, which may be used to implement interconnection of the network device with other devices, and the logical interface is an interface internal to the network device, which may be used to implement interconnection of devices internal to the network device. It is readily understood that communication interface 802 may be used for a network device to communicate with other devices, such as communication interface 802 for the transmission and reception of messages between the network device and other devices.
The bus 805 may be any type of communication bus, such as a system bus, that is used to interconnect the processor 803, memory 804, communication interface 802, and the analyzing device 801.
The analyzing device 801 may be various possible chips such as ASIC chip, FPGA chip, etc., and the structure of the analyzing device 801 may refer to the embodiment shown in fig. 7, which is not described herein. Any device of the processor 803, the memory 804, and the communication interface 802 and the parsing device 801 interconnect may specifically refer to the device of the any device and the parsing device 801 interconnect. In some embodiments, the processor 803, the memory 804, and the communication interface 802 may be integrated on the parsing device 801, or the processor 803, the memory 804, and the communication interface 802 may be disposed on separate chips, or at least partially or entirely on the same chip. Whether the individual devices are independently disposed on different chips or integrally disposed on one or more chips is often dependent on the needs of the product design. The application is not limited to the specific implementation of the above device.
The network device shown in fig. 8 is merely exemplary, and in implementation, the network device may include other components, which are not listed here.
In the above embodiments, the implementation may be in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, may be embodied in whole or in part in the form of a computer program product comprising one or more computer instructions. When loaded and executed on a computer, produces a flow or function in accordance with embodiments of the present application, in whole or in part. The computer may be a general purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by a wired (e.g., coaxial cable, fiber optic, digital subscriber line), or wireless (e.g., infrared, wireless, microwave, etc.). Computer readable storage media can be any available media that can be accessed by a computer or data storage devices, such as servers, data centers, etc., that contain one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium, or a semiconductor medium (e.g., solid state disk), etc.
The disclosed embodiments also provide a computer readable storage medium having instructions stored therein, which when run on a computer, cause the computer to perform the message parsing method according to any of the above embodiments.
Although the preferred embodiments of the present application have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope and spirit of the application as disclosed in the accompanying claims.

Claims (10)

1. The message parsing method is characterized by comprising the following steps:
determining a protocol field in each layer of message header in each protocol forwarding path in a preset protocol analysis tree, performing compression and key bit extraction on all the protocol fields, and determining a key bit string and a key bit position corresponding to each protocol forwarding path, wherein the key bit string comprises a plurality of key bits, the key bit position is used for indicating the bit position of each key bit in each layer of message header, and the key bit string is used for indicating conversion path information among each layer of protocols in the protocol forwarding path and the protocol type of each layer of protocol;
Storing the key bit strings and the key bit positions, and storing the mapping relation between each key bit string and the corresponding protocol forwarding path;
receiving a target message, wherein the target message comprises message heads of a plurality of protocol layers which are nested in sequence, extracting bit values at bit positions corresponding to each message head according to the stored key bit positions, and forming a target bit string;
and matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and the protocol types of the corresponding layers of protocols according to a matching result.
2. The message parsing method according to claim 1, wherein the protocol parsing tree includes a root node and a plurality of sub-nodes, the root node and each sub-node are used for indicating a network protocol type corresponding to each layer of message header, a plurality of different protocol forwarding paths are formed between the root node and each sub-node, and the protocol forwarding paths are used for indicating conversion path information between each layer of protocols in the message.
3. The method of claim 1, wherein the compressing and extracting key bits for all protocol fields, determining key bit strings and key bit positions corresponding to each protocol forwarding path, comprises:
Constructing a corresponding configuration message based on each protocol forwarding path, wherein the configuration message comprises message heads and message bodies of a plurality of protocol layers which are nested in sequence, the nesting sequence of the protocol layers is the same as that of the protocol forwarding paths, the message heads comprise protocol fields, and the values in the protocol fields indicate the protocol types of the message heads of the next layer of the message heads;
setting x for all the rest bits except the protocol field in each configuration message, and generating each configuration message into a corresponding configuration bit string;
acquiring the lengths of all configuration bit strings to obtain the maximum value of the lengths;
calculating the length required to be supplemented by the configuration bit string with the length of the configuration bit string smaller than the maximum value by taking the maximum value of the length as a reference, and adding bits x with corresponding lengths at the tail end of the configuration bit string so that the lengths of all the configuration bits are the maximum value;
and arranging all the configuration bits to obtain configuration bit data with M rows and Y columns, wherein the M rows correspond to M configuration bit strings, and the Y columns correspond to bit positions of each bit in the configuration message.
4. The method of claim 3, wherein the compressing and the extracting key bits are performed on all protocol fields, and determining key bit strings and key bit positions corresponding to each protocol forwarding path further comprises:
S401, traversing each column of configuration bit data, deleting the column if the bit value of the column is x, recording the reserved column number, and recording the configuration bit data after the column deleting operation as first configuration bit data;
s402, traversing any two columns of the first configuration bit data, deleting one column if the bit values of the two columns are the same, recording the reserved column numbers, and recording the configuration bit data after the column deleting operation as second configuration bit data;
s403, traversing each column of the second configuration bit data, deleting the column if the bit value of the column is only x and 1, recording the reserved column number, and recording the configuration bit data after the column deleting operation as third configuration bit data;
s404, traversing each column of the third configuration bit data, deleting the column if the bit value of the column is only x and 0, recording the reserved column number, and recording the configuration bit data after the column deleting operation as fourth configuration bit data.
5. The method of claim 4, wherein compressing and extracting key bits are performed on all protocol fields, and determining key bit strings and key bit positions corresponding to each protocol forwarding path further comprises:
Traversing bit values of any two rows of the fourth configuration bit data, and if the bit values are inconsistent, storing the fourth configuration bit data, wherein each row of data in the fourth configuration bit data corresponds to a key bit string of each protocol forwarding path, and a column number in the fourth configuration bit data corresponds to the key bit position;
and if the two same rows of bit values exist, storing the second configuration bit data, wherein each row of data of the second configuration bit data corresponds to a key bit string of each protocol forwarding path, and a column number in the second configuration bit data corresponds to a key bit position.
6. The method of claim 5, wherein compressing and extracting key bits are performed on all protocol fields, and determining key bit strings and key bit positions corresponding to each protocol forwarding path further comprises:
s501, assuming that the total column number of the fourth configuration bit data is L columns and the total row number is M rows, the M rows represent M configuration bit strings corresponding to M protocol forwarding paths, and setting the initial column number L of traversal 0 Is that=/>；
S502, obtaining L from L columns 0 Traversing each column combination, stopping traversing if no repeated configuration bit string exists in the selected column combination, and recording column numbers in the selected column combination to obtain M key bit strings corresponding to M protocol forwarding paths, wherein the column numbers in the selected column combination correspond to the key bit positions;
s503, if the repeated configuration bit string exists in the selected column combination, L is set as 0 Increment 1, select L from L columns 0 All column combinations of +1 columns, repeatedly performing step S502;
s504, repeatedly executing the step S503 until the selected column combination in the L columns enables the M rows of configuration bit strings not to be repeated, stopping traversing, recording the column numbers in the selected column combination, and obtaining M key bit strings corresponding to M protocol forwarding paths, wherein the column numbers in the selected column combination correspond to the key bit positions.
7. The method of claim 5, wherein compressing and extracting key bits are performed on all protocol fields, and determining key bit strings and key bit positions corresponding to each protocol forwarding path further comprises:
s601, assuming that the total column number of the fourth configuration bit data is L columns and the total row number is M rows, wherein the M rows represent M configuration bit strings corresponding to M protocol forwarding paths, and the number of initial traversed columns is L columns;
S602, selecting one column from L columns, judging whether repeated configuration bit strings exist in all columns remaining after the columns are removed, if not, executing the step S604, and if so, executing the step S603;
s603, reselecting a column from L columns, wherein the selected column and the last selected column cannot be repeated, judging whether repeated configuration bit strings exist in all columns remaining after the column is removed, if not, executing step S604, if yes, executing step S603 again, and if all columns in L columns are selected and cannot be deleted again, executing step S605;
s604, deleting the selected column from the L columns, recording the remaining column numbers, recording the remaining configuration bit data after the operation of deleting the column, and executing the step S602;
s605, the remaining column numbers are recorded to obtain M key bit strings corresponding to the M protocol forwarding paths, and the remaining column numbers correspond to key bit positions.
8. A resolution device, the device comprising:
the extraction module is used for determining protocol fields in each layer of message header in each protocol forwarding path in a preset protocol analysis tree, performing compression and key bit extraction on all the protocol fields, and determining a key bit string and a key bit position corresponding to each protocol forwarding path, wherein the key bit string comprises a plurality of key bits, the key bit position is used for indicating the bit position of each key bit in each layer of message header, and the key bit string is used for indicating conversion path information among each layer of protocols in the protocol forwarding path and the protocol type of each layer of protocol;
The storage module is used for storing the key bit strings and the key bit positions and storing the mapping relation between each key bit string and the corresponding protocol forwarding path;
the analysis module is used for receiving a target message, the target message comprises message heads of a plurality of protocol layers which are nested in sequence, bit values are extracted from bit positions corresponding to each message head according to the stored key bit positions, and a target bit string is formed;
and the matching module is used for matching the target bit string with the stored key bit string, and determining conversion path information among all layers of protocols in the target message and the protocol types of the corresponding layers of protocols according to a matching result.
9. A network device comprising the resolution means according to claim 8.
10. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method according to any one of claims 1 to 7.
CN202311120363.4A 2023-09-01 2023-09-01 Message analysis method, analysis device and network equipment Active CN116847005B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311120363.4A CN116847005B (en) 2023-09-01 2023-09-01 Message analysis method, analysis device and network equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311120363.4A CN116847005B (en) 2023-09-01 2023-09-01 Message analysis method, analysis device and network equipment

Publications (2)

Publication Number Publication Date
CN116847005A CN116847005A (en) 2023-10-03
CN116847005B true CN116847005B (en) 2023-11-03

Family

ID=88174710

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311120363.4A Active CN116847005B (en) 2023-09-01 2023-09-01 Message analysis method, analysis device and network equipment

Country Status (1)

Country Link
CN (1) CN116847005B (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107665191A (en) * 2017-10-19 2018-02-06 中国人民解放军陆军工程大学 A kind of proprietary protocol message format estimating method based on expanded prefix tree
CN110266702A (en) * 2019-06-25 2019-09-20 上海电气泰雷兹交通自动化系统有限公司 Wireshark protocol analysis method based on XML
CN114706615A (en) * 2022-06-08 2022-07-05 国家工业信息安全发展研究中心 Automatic reverse analysis method and device for industrial robot protocol
CN114827043A (en) * 2022-03-31 2022-07-29 中国电子科技集团公司第三十研究所 Flow characteristic matching method based on fingerprint dynamic update and key message identification

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11586182B2 (en) * 2020-11-04 2023-02-21 The Boeing Company System and device to automatically identify data tags within a data stream

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107665191A (en) * 2017-10-19 2018-02-06 中国人民解放军陆军工程大学 A kind of proprietary protocol message format estimating method based on expanded prefix tree
CN110266702A (en) * 2019-06-25 2019-09-20 上海电气泰雷兹交通自动化系统有限公司 Wireshark protocol analysis method based on XML
CN114827043A (en) * 2022-03-31 2022-07-29 中国电子科技集团公司第三十研究所 Flow characteristic matching method based on fingerprint dynamic update and key message identification
CN114706615A (en) * 2022-06-08 2022-07-05 国家工业信息安全发展研究中心 Automatic reverse analysis method and device for industrial robot protocol

Also Published As

Publication number Publication date
CN116847005A (en) 2023-10-03

Similar Documents

Publication Publication Date Title
EP1788490B1 (en) Method and apparatus for monitoring traffic in a network
US8856203B1 (en) System and method for algorithmic TCAM packet classification
US8442931B2 (en) Graph-based data search
US20120182891A1 (en) Packet analysis system and method using hadoop based parallel computation
US9270519B2 (en) Address translation device, address translation method, and computer product
WO2003042782A2 (en) Routing and forwarding table management for network processor architectures
US11496596B2 (en) Streaming network monitoring caching infrastructure
CN111131159A (en) Message parser and design method thereof
WO2020087400A1 (en) Header parsing apparatus and method
CN112787927A (en) Segmented routing message forwarding method and device and preset logic circuit unit
CN115883681A (en) Message analysis method and device, electronic equipment and storage medium
CN116847005B (en) Message analysis method, analysis device and network equipment
CN108933691B (en) Method for obtaining standard configuration template of network equipment and computing equipment
CN114946167B (en) Message parsing method and device
CN114422624B (en) Data receiving method
JP5643609B2 (en) COMMUNICATION DEVICE, PROCESSING METHOD THEREOF, AND PROGRAM
CN115174414A (en) Method, system and electronic device for automatically identifying devices and device paths in session
CN114781293A (en) Chip bottleneck analysis method, device, equipment and medium
US9444731B2 (en) Methods and systems for data packet routing
CN111431929B (en) Method and system for constructing multi-protocol distinguishing flow table of software defined network
CN116074404A (en) Parsing device, message parsing method, forwarding chip and network equipment
AU2004201912B2 (en) A packet processor
CN117527757A (en) IPV6 address simplification method, device, equipment and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant