CN109614518A - A kind of storage of network flow data, restoring method and system - Google Patents
A kind of storage of network flow data, restoring method and system Download PDFInfo
- Publication number
- CN109614518A CN109614518A CN201811359243.9A CN201811359243A CN109614518A CN 109614518 A CN109614518 A CN 109614518A CN 201811359243 A CN201811359243 A CN 201811359243A CN 109614518 A CN109614518 A CN 109614518A
- Authority
- CN
- China
- Prior art keywords
- data
- flow
- network
- data packet
- packet
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/06—Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a kind of storage of network flow data, restoring method and systems, the storage method includes: the data packet and data flow that independently column storage is added to timestamp, and establishes the first mapping relations of data flow and initial network data packet and the second mapping relations family of data stream ID and data content.Based on this storage method, according to the querying condition of the first mapping relations of foundation and the second mapping relations and user setting, restoring data stream ID, then initial network data packet is restored with this.The present invention independently storing data stream and data packet improve managerial ability and alleviate single storage section pressure, while by two layers of information restoring data packet of the mapping relations based on data flow, to improve reduction efficiency and reduction accuracy, facilitating user.
Description
Technical field
The present invention relates to technical field of data storage, and in particular to a kind of storage of network flow data, restoring method and is
System.
Background technique
In general, the data in network are transmitted using data packet, i.e., it before transmitting the data, can be according to transport protocol
Requirement data packet is packaged into data, after being sent to opposite end server, unpacked by server, and extract number
According to, but the data that other additional datas during this network data transmission will be dropped, however be dropped have very big valence
The security information of value, but the prior art is not directed to the side that the data (data flow relevant information) of the discarding are analyzed and researched
Method, there are security risk, and waste of resource.In addition, generalling use data packet index restores raw data packets information approach
And system, there is no for information design one of data flow by the method for data flow indirect reduction initial data package informatin and
System.
Therefore, the existing technology needs to be improved and developed.
Summary of the invention
The technical problem to be solved in the present invention is that in view of the above drawbacks of the prior art, providing a kind of network flow number
According to storage, restoring method and system, it is intended to individually store the data packet for being added to timestamp with data flow, pass through
The querying condition restoring data packet of index relative and user setting that data flow and data packet are established, realizes data flow and data
The differentiation and management of storage are wrapped, so that the reduction for making data packet by corresponding corresponding relationship is fast and accurately, facilitates user.
The technical proposal for solving the technical problem of the invention is as follows:
The present invention provides a kind of network flow data storage method, comprising the following steps:
Obtain the initial network data packet of stream transmission；
It will be combined after the initial network data packet addition timestamp of each stream transmission, be denoted as first network data packet,
It stores to the first buffer area；
The first network data packet is parsed, converts and generates data flow and store to the second buffer area, and establishes data flow and just
First mapping relations of beginning network packet, to store to the first mapping table；
Every data stream is added into data flow ID, extract the data content information in data flow and is analyzed, while establishing data flow
The second mapping relations of ID and data content information, to store to the second mapping table.
The network flow data storage method, wherein the timestamp is initial network data described in unique identification
Packet, the data flow ID is data flow described in unique identification.
The network flow data storage method, wherein the parsing first network data packet is converted and generated
Data flow is stored to the second buffer area, and establishes the first mapping relations of data flow Yu initial network data packet, at the same store to
First mapping table specifically includes:
According to transport protocol, initial network data packet in the first network data packet is parsed, initial network data packet is obtained
Source IP, destination IP, source port, destination port and direction；
Source IP, destination IP, source port, destination port and direction that parsing obtains are converted respectively with combination producing data packet index
Array；
Timestamp, source IP, destination IP, source port, destination port, direction and data packet array of indexes are sorted top to bottom and generate number
According to stream, store to the second buffer area；
The first mapping relations for establishing data flow Yu initial network data packet simultaneously, store to the first mapping table.
The network flow data storage method, wherein it is described that every data stream is added into data flow ID, extract data
Data content information in stream is simultaneously analyzed, while establishing the second mapping relations of data flow ID Yu data content information, with storage
It is specifically included to the second mapping table:
Every data stream is added data flow ID by the information for obtaining data flow；Wherein, the information of the data flow include agreement and
Data content；
The data content information in data flow is extracted, and carries out text analyzing, generates text keyword；
The second mapping relations of data flow ID Yu data content information are established, simultaneously to store to the second mapping table.
The present invention also provides a kind of based on network flow data storage method described above to realize network flow number
According to restoring method, the network flow data restoring method the following steps are included:
The querying condition of user setting is obtained, the querying condition includes at least data content, time range and source IP, purpose
It is IP, source port, destination port, direction, one or more in data packet array of indexes；
According to querying condition and the second mapping relations, the data for reduction for meeting querying condition in the second mapping table are filtered out
Stream ID；
According to data flow ID, the first mapping relations and the querying condition filtered out, filters out and meet inquiry in the first mapping table
The initial network data packet for reduction of condition；
Obtain the corresponding timestamp of initial network data packet in the first buffer area, by be used for restore initial network data packet according to
Timestamp sequence assembly is at standard network data storage format；
Restore the initial network data packet transmitted as a stream.
The network flow data restoring method, wherein it is described according to querying condition and the second mapping relations, it filters out
The data flow ID for reduction for meeting querying condition in second mapping table is specifically included:
The data content for extracting the querying condition, according to the second mapping relations of data content and data flow ID, second
Several data flows ID for meeting querying condition is searched in mapping table.
The network flow data restoring method, wherein data flow ID that the basis filters out, the first mapping relations
And querying condition, filter out meet in the first mapping table querying condition for reduction initial network data packet specifically wrap
It includes:
The first mapping relations for obtaining several data flows ID and data flow and initial network data packet extract inquiry item
Time range in part filters out corresponding several initial network data packets for reduction in the first mapping table.
The network flow data restoring method, wherein the standard network data storage format is PCAP format.
The present invention also provides a kind of network flow data storage system, the network flow data storage system includes first
Buffer area, the second buffer area and a processor, it is real when being executed by processor when the network flow data storage system is run
Existing network flow data storage method described above.
The present invention also provides a kind of network flow data also original system, the network flow data also original system includes above-mentioned
The network flow data storage system, it is real when being executed by processor when the network flow data also original system is run
Existing network flow data restoring method described above.
The invention discloses a kind of storage of network flow data, restoring method and system the utility model has the advantages that
1. respectively storing data flow to different buffer areas from data packet, in order to distinguish and manage, single buffer area is reduced
Pressure is stored, overall performance is promoted；
2. establishing multi-level mapping relationship, facilitate calling and inquiry, while accurately filtering out the data flow ID for meeting user demand, it is real
Now quickly and efficiently positioning needs the data packet restored.
3. improving data flow utilization rate, there is great security study value, reduce security risk, realize and optimize also
It is former.
Detailed description of the invention
Fig. 1 is the flow chart of the first preferred embodiment of inventive network data on flows storage method.
Fig. 2 is the process schematic of inventive network data on flows storage method.
Fig. 3 is the flow chart of the first preferred embodiment of inventive network data on flows restoring method.
Fig. 4 is the process schematic of inventive network data on flows restoring method.
Fig. 5 is the functional schematic block diagram of inventive network data on flows storage system.
Specific embodiment
To make the objectives, technical solutions, and advantages of the present invention clearer and more explicit, right as follows in conjunction with drawings and embodiments
The present invention is further described.It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, and do not have to
It is of the invention in limiting.
Embodiment one
Referring to Figure 1, Fig. 1 is the flow chart of the first preferred embodiment of inventive network data on flows storage method.Such as Fig. 1 institute
Show, a kind of network flow data storage method the following steps are included:
Step S100 obtains the initial network data packet of stream transmission.
It is to be carried out data transmission according to ICP/IP protocol with packet form in the present invention, before transmitting data packet, mutually passes
Two defeated hosts can negotiate a transmission channel, and the transmission channel is the IP address and port numbers determination based on two hosts
, a large amount of data packet then is transmitted in this transmission channel according to the sequence of agreement, and the channel is then defined as data flow.Cause
This obtains the initial network data packet of stream transmission in the present invention is implemented, and the initial network data are surrounded by several, are in
Stream transmission, i.e., all initial network data packets are transmitted one by one in horizontally arranged, i.e., line transmits.As shown in Figure 2
10, label 10 indicates the initial network data packet of streaming, contains multiple data packets encapsulated.
Step S200 will be combined after initial network data packet addition timestamp of each stream transmission, and be denoted as the
One network packet is stored to the first buffer area.
Specifically, the timestamp refers to is added recognition character, such as time or date in a series of data, to protect
Hinder local side (local) data updating sequence with distal end (remote) unanimously, be from January 1st, 1970 (08:00:00GMT,
That is Greenwich mean time) to total millisecond of number of current time, such as the time of Beijing time 2015-12-31 17:00:00
Stamp is 1451552400, just refers to and has been subjected to from Beijing time 1970-01-01 08:00:00 to 2015-12-31 17:00:00
It has gone 1451552400 seconds.The timestamp is shape data, can be identified in any appliance, and compatibility is high.At each
Timestamp is added in the initial network data packet of stream transmission, and is indexed, it being capable of unique identification initial network data packet.Each
Initial network data packet is combined with corresponding timestamp, is denoted as first network data packet, as shown in 20 in Fig. 2.Meanwhile according to when
Between the sequence stabbed by column mode (i.e. vertically, longitudinally) arrange initial network data packet, i.e., as in Fig. 2 with timestamp field for first
Column, packets fields corresponding with timestamp are that secondary series permutation and combination is stored to the first buffer area, that is to say, that will be all
First network data packet is arranged with same field and carries out column storage.
Step S300 parses the first network data packet, converts and generates data flow and stores to the second buffer area, and builds
First mapping relations of vertical data flow and initial network data packet, store to the first mapping table.
Specifically, step S300 includes:
Step S301 parses initial network data packet in the first network data packet, obtains initial network according to transport protocol
Source IP, destination IP, source port, destination port and the direction of data packet；
Step S302 converts in source IP, destination IP, source port, destination port and direction that parsing obtains respectively with combination producing
Data packet array of indexes；
Step S303, by timestamp, source IP, destination IP, source port, destination port, direction and data packet array of indexes, by column
Sequence generates data flow, stores to the second buffer area；
Step S304, while the first mapping relations of data flow Yu initial network data packet are established, it stores to the first mapping table.
Above-mentioned transport protocol refers to ICP/IP protocol.According to the ICP/IP protocol, the first network data are parsed
Initial network data packet in packet, the data flow after the conversion and storage conversion of data flow are carried out to the initial network data packet,
In specific implementation, by this 5 fields of the source IP of initial network resolve packet, destination IP, source port, destination port and direction
Information carries out streaming conversion with combination producing data packet array of indexes, at the same time, by timestamp, source IP, destination IP, source respectively
This 7 fields of port, destination port, direction and data packet array of indexes are ranked up the letter for generating data flow with same column
Breath, stores to the second buffer area.
The first mapping relations of data flow Yu initial network data packet are established simultaneously, as long as knowing the related letter of data flow
Breath, can restore corresponding initial network data packet by first mapping relations.First mapping relations are stored to
One mapping table.Certainly, first mapping table includes above-mentioned 7 field relevant informations.For example, as indicated at 30 in figure 2,30 indicate
The stream index of column is established, 1 indicates source IP field, and 2 indicate destination IP field, and 3 indicate source port, and 4 indicate destination port
Field, 5 indicate the direction field of data transmission.Data needed for can quickly improving search efficiency by index and be accurately positioned.
From the foregoing, it will be observed that technical solution of the present invention should storing initial network data relevant information, also to store corresponding
The information of data flow, and independently stored to corresponding buffer area.It is not only convenient for distinguishing in this way, accurate and quickly progress
Search index, while the information (i.e. attachment feature) of data flow being made full use of to improve utility value, reduce security risk.
Every data stream is added data flow ID by step S400, is extracted the data content information in data flow and is analyzed, together
The second mapping relations of Shi Jianli data flow ID and data content information are stored to the second mapping table.
Specifically, step S400 includes:
Step S401 obtains the information of data flow, and every data stream is added data flow ID；Wherein, the information of the data flow
Including agreement and data content；
Step S402 extracts the data content information in data flow, and carries out text analyzing, generates text keyword；
Step S403, while the second mapping relations of data flow ID Yu data content information are established, to store to the second mapping table.
Above-mentioned data flow ID is the corresponding data flow of unique identification.Protocol-dependent data content is extracted from data flow
Information carries out text analyzing, generates text keyword, for screening and quick locating query.At this point, establishing data flow ID and number
According to the second mapping relations of content information, corresponding data flow ID can be searched by second mapping relations, for restoring
Data flow.Second mapping relations are stored into the second mapping table, second mapping table further include data flow ID, agreement with
And data content fields.For example, 40 indicate to establish data content index as shown in 40 in Fig. 2, indexed by the data content
Inquire data flow ID.
Certainly, those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method,
It is that related hardware (such as processor, controller etc.) can be instructed by network flow data storage program to complete, it is described
Program can be stored in a computer-readable storage medium, which may include such as above-mentioned each method embodiment when being executed
Process.Wherein the storage medium can be memory, magnetic disk, CD etc..
Embodiment two
The present invention also provides a kind of network flow data restoring method, the network flow data restoring method is based on embodiment
It is realized on the basis of network flow data storage method described in one.Therefore the network flow data storage method is not herein
It repeats.
Fig. 3 is the flow chart of the first preferred embodiment of inventive network data on flows restoring method.As shown in figure 3, institute
Stating network flow data restoring method includes:
Step S500, obtains the querying condition of user setting, the querying condition include at least data content, time range and
It is source IP, destination IP, source port, destination port, direction, one or more in data packet array of indexes.
In embodiments of the present invention, the data content is text information, stores keyword message, for quick-searching and
Inquiry.The information to be inquired is arranged in user on demand, i.e. setting querying condition, and specifically, the querying condition includes at least number
According to content and the information of time range field, in addition to this, it is also necessary to including source IP, destination IP, source port, destination port, side
To at least one of, data packet array of indexes field information.In this manner it is possible to ensure by way of restoring data stream also originally
Beginning network packet.
Step S600 is filtered out in the second mapping table according to querying condition and the second mapping relations and is met querying condition
Data flow ID for reduction.
Specifically, the second mapping table is obtained, the data content information in querying condition set by user is then extracted,
According to the second mapping relations of data content and data flow ID, the data flow for meeting querying condition is found out in the second mapping table
ID carries out preliminary screening.ID number of the data flow found out may be one, it is also possible to and it is multiple, constitute cluster.According to institute
The time range for stating querying condition extraction, the postsearch screening in several data flows ID for needing to restore, finishing screen select needs
The data flow ID of reduction.For example, as shown in Figure 4 110,110 indicate that, by data content and time range, selection needs restore
Data flow ID.
Step S700 filters out the first mapping according to data flow ID, the first mapping relations and the querying condition filtered out
Meet the initial network data packet for reduction of querying condition in table.
In the present invention, based on several data flows ID that step S600 is filtered out, restored required for filtering out initial
Network packet, when it is implemented, obtaining the of the first mapping relations of stream ID and initial network data packet for storing data
One mapping table, according to the initial network data extracted in first mapping relations and all data flow ID and querying condition
One or more content informations in 5 fields of Packet analyzing, in the first mapping table, finishing screen selects several for needing to restore
Initial network data packet.For example, as shown in Figure 3 210,201 indicate that the data flow ID, the user that obtain according to 110 need to restore
The source IP address and/or purpose IP address and time range of initial network data packet, selection need the initial network number restored
According to packet.
Step S800 obtains the corresponding timestamp of initial network data packet in the first buffer area, initial by be used to restore
Network packet is according to timestamp sequence assembly at standard network data storage format.
Specifically, obtain institute reduction in need initial network data packet, lookup the first buffer area described in initial network
The corresponding timestamp of data packet, and the information of corresponding initial network data packet is obtained, while in timestamp order by initial network
Data packet is spliced into standard network data storage format (column storage).The standard network data storage format is PCAP file
Format, the PCAP file format are a kind of datagram storage formats, are made of file header, datagram header and datagram content,
Mainstream packet capturing software including wireshark can generate the data packet of this format, and timestamp is located at the data
In header, datagram content is data packet.
The format of pcap file are as follows:
24 byte of file header (size)
Datagram header+datagram data packet header is 16 bytes, followed by datagram
Datagram header+datagram ...
For example, as shown in Figure 4 310,301 indicate initial network data packet temporally stabbing sequence, are spliced into standard network number and deposit
Format is stored up, such as PCAP file format.
Step S900 restores the initial network data packet transmitted as a stream.
Based on step S800, the standard network data storage format of splicing is subjected to program conversion, removes timestamp, so that
The corresponding initial network data packet of timestamp is restored in streaming, at once arrangement reduction, and thus reduction is transmitted as a stream
Initial network data packet.For example, as shown in the figure 410,410 indicate the information of standard network data storage format removing timestamp,
And temporally stamp is restored by row, i.e. streaming manner, the initial network data packet transmitted as a stream.
Certainly, those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method,
It is that related hardware (such as processor, controller etc.) can be instructed by network flow data storage and reducing program to complete,
The program can be stored in a computer-readable storage medium, which may include such as above-mentioned each method when being executed
The process of embodiment.Wherein the storage medium can be memory, magnetic disk, CD etc..
Embodiment three
The present invention also provides a kind of network flow data storage system, as shown in figure 5, the network flow data storage system
Including the first buffer area 21, the second buffer area 22 and a processor 10, first buffer area 21, the second buffer area 22 are and institute
The connection of processor 10 is stated, first buffer area 21 is used to store the initial network packet information of column, second caching
Area 22 is used to store the information of corresponding data flow and is held when the network flow data storage system is run by processor 10
Network flow data storage method described above is realized when row, specifically as described in embodiment one.
Example IV
The present invention also provides a kind of network flow data also original system, the network flow data also original system is based on embodiment
Network flow data storage system described in three realizes network flow data reduction side described above when executing by processor
Method, specifically as described in embodiment two.
In conclusion the invention discloses a kind of storage of network flow data, restoring method and systems.The network flow
Date storage method is the following steps are included: obtain the initial network data packet of stream transmission；By the initial of each stream transmission
It is combined after network packet addition timestamp, is denoted as first network data packet, stores to the first buffer area；Parse described
One network packet, converts and generates data flow and store to the second buffer area, and establishes data flow and initial network data packet
First mapping relations, to store to the first mapping table；Every data stream is added into data flow ID, is extracted in the data in data flow
Hold information and analyze, while establishing the second mapping relations of data flow ID Yu data content information, to store to the second mapping table.
Based on this storage method, according to the querying condition of the first mapping relations of foundation and the second mapping relations and user setting, also
Former data flow ID, then initial network data packet is restored with this.The present invention independently storing data stream and data packet, improve pipe
Reason ability and single storage section pressure is alleviated, while passing through the information restoring data of data flow by two layers of mapping relations
Packet facilitates user to improve reduction efficiency and reduction accuracy.
It should be understood that the application of the present invention is not limited to the above for those of ordinary skills can
With improvement or transformation based on the above description, all these modifications and variations all should belong to the guarantor of appended claims of the present invention
Protect range.
Claims (10)
1. a kind of network flow data storage method, which is characterized in that the network flow data storage method includes following step
It is rapid:
Obtain the initial network data packet of stream transmission；
It will be combined after the initial network data packet addition timestamp of each stream transmission, be denoted as first network data packet,
It stores to the first buffer area；
The first network data packet is parsed, converts and generates data flow and store to the second buffer area, and establishes data flow and just
First mapping relations of beginning network packet are stored to the first mapping table；
Every data stream is added into data flow ID, extract the data content information in data flow and is analyzed, while establishing data flow
The second mapping relations of ID and data content information are stored to the second mapping table.
2. network flow data storage method according to claim 1, which is characterized in that the timestamp is unique identification
The initial network data packet, the data flow ID are data flows described in unique identification.
3. network flow data storage method according to claim 1, which is characterized in that the parsing first network
Data packet, converts and generates data flow and store to the second buffer area, and establishes data flow and reflect with the first of initial network data packet
Relationship is penetrated, while storing to the first mapping table and specifically including:
According to transport protocol, initial network data packet in the first network data packet is parsed, initial network data packet is obtained
Source IP, destination IP, source port, destination port and direction；
Source IP, destination IP, source port, destination port and direction that parsing obtains are converted respectively with combination producing data packet index
Array；
Timestamp, source IP, destination IP, source port, destination port, direction and data packet array of indexes are sorted top to bottom and generate number
According to stream, store to the second buffer area；
The first mapping relations for establishing data flow Yu initial network data packet simultaneously, store to the first mapping table.
4. network flow data storage method according to claim 1, which is characterized in that described to add every data stream
Data flow ID extracts the data content information in data flow and analyzes, while establishing the of data flow ID and data content information
Two mapping relations are specifically included with storing to the second mapping table:
Every data stream is added data flow ID by the information for obtaining data flow；Wherein, the information of the data flow include agreement and
Data content；
The data content information in data flow is extracted, and carries out text analyzing, generates text keyword；
The second mapping relations for establishing data flow ID Yu data content information simultaneously, store to the second mapping table.
5. one kind is based on network flow data storage method according to any one of claims 1-4 to realize network flow number
According to restoring method, which is characterized in that the network flow data restoring method the following steps are included:
The querying condition of user setting is obtained, the querying condition includes at least data content, time range and source IP, purpose
It is IP, source port, destination port, direction, one or more in data packet array of indexes；
According to querying condition and the second mapping relations, the data for reduction for meeting querying condition in the second mapping table are filtered out
Stream ID；
According to data flow ID, the first mapping relations and the querying condition filtered out, filters out and meet inquiry in the first mapping table
The initial network data packet for reduction of condition；
Obtain the corresponding timestamp of initial network data packet in the first buffer area, by be used for restore initial network data packet according to
Timestamp sequence assembly is at standard network data storage format；
Restore the initial network data packet transmitted as a stream.
6. network flow data restoring method according to claim 5, which is characterized in that described according to querying condition and
Two mapping relations, filter out meet in the second mapping table querying condition for reduction data flow ID specifically include:
The data content for extracting the querying condition, according to the second mapping relations of data content and data flow ID, second
Several data flows ID for meeting querying condition is searched in mapping table.
7. network flow data restoring method according to claim 6, which is characterized in that the data that the basis filters out
Stream ID, the first mapping relations and querying condition filter out and meet the initial for what is restored of querying condition in the first mapping table
Network packet specifically includes:
The first mapping relations for obtaining several data flows ID and data flow and initial network data packet extract inquiry item
Time range in part filters out corresponding several initial network data packets for reduction in the first mapping table.
8. network flow data restoring method according to claim 5, which is characterized in that the standard network data storage
Format is PCAP format.
9. a kind of network flow data storage system, which is characterized in that the network flow data storage system includes first slow
Area, the second buffer area and a processor are deposited, when the network flow data storage system is run, realization when being executed by processor
Any one of the claim 1-4 network flow data storage method.
10. a kind of network flow data also original system, which is characterized in that the network flow data also original system includes such as right
It is required that network flow data storage system described in 9 is executed when the network flow data also original system is run by processor
Any one of the Shi Shixian claim 5-8 network flow data restoring method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811359243.9A CN109614518A (en) | 2018-11-15 | 2018-11-15 | A kind of storage of network flow data, restoring method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811359243.9A CN109614518A (en) | 2018-11-15 | 2018-11-15 | A kind of storage of network flow data, restoring method and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109614518A true CN109614518A (en) | 2019-04-12 |
Family
ID=66004045
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811359243.9A Pending CN109614518A (en) | 2018-11-15 | 2018-11-15 | A kind of storage of network flow data, restoring method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109614518A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110191174A (en) * | 2019-05-28 | 2019-08-30 | 西门子（上海）电气传动设备有限公司 | Data monitoring system, method and computer-readable medium based on http protocol |
| WO2020215425A1 (en) * | 2019-04-26 | 2020-10-29 | 张明明 | Software operating method and system, computing device and storage medium |
| CN112995184A (en) * | 2021-03-05 | 2021-06-18 | 中电积至(海南)信息技术有限公司 | Multi-source network flow content complete restoration method and device |
| CN113886201A (en) * | 2021-09-17 | 2022-01-04 | 厦门立林科技有限公司 | Multi-node system performance analysis method and system based on communication data packet and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2005093576A1 (en) * | 2004-03-28 | 2005-10-06 | Robert Iakobashvili | Visualization of packet network performance, analysis and optimization for design |
| CN101814977A (en) * | 2010-04-22 | 2010-08-25 | 北京邮电大学 | TCP flow on-line identification method and device utilizing head feature of data stream |
| CN105072196A (en) * | 2015-08-27 | 2015-11-18 | 携程计算机技术（上海）有限公司 | Distributed data package storage, recall method and system |
-
2018
- 2018-11-15 CN CN201811359243.9A patent/CN109614518A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2005093576A1 (en) * | 2004-03-28 | 2005-10-06 | Robert Iakobashvili | Visualization of packet network performance, analysis and optimization for design |
| CN101814977A (en) * | 2010-04-22 | 2010-08-25 | 北京邮电大学 | TCP flow on-line identification method and device utilizing head feature of data stream |
| CN105072196A (en) * | 2015-08-27 | 2015-11-18 | 携程计算机技术（上海）有限公司 | Distributed data package storage, recall method and system |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020215425A1 (en) * | 2019-04-26 | 2020-10-29 | 张明明 | Software operating method and system, computing device and storage medium |
| CN110191174A (en) * | 2019-05-28 | 2019-08-30 | 西门子（上海）电气传动设备有限公司 | Data monitoring system, method and computer-readable medium based on http protocol |
| CN112995184A (en) * | 2021-03-05 | 2021-06-18 | 中电积至(海南)信息技术有限公司 | Multi-source network flow content complete restoration method and device |
| CN112995184B (en) * | 2021-03-05 | 2022-07-12 | 中电积至(海南)信息技术有限公司 | Multi-source network flow content complete restoration method and device |
| CN113886201A (en) * | 2021-09-17 | 2022-01-04 | 厦门立林科技有限公司 | Multi-node system performance analysis method and system based on communication data packet and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109614518A (en) | A kind of storage of network flow data, restoring method and system | |
| CN112468370B (en) | High-speed network message monitoring and analyzing method and system supporting custom rules | |
| CN106209506B (en) | A kind of virtualization deep-packet detection flow analysis method and system | |
| US8416695B2 (en) | Method, device and system for network interception | |
| CN103699580B (en) | Database synchronization method and device | |
| US9210090B1 (en) | Efficient storage and flexible retrieval of full packets captured from network traffic | |
| US9608879B2 (en) | Methods and apparatus to collect call packets in a communications network | |
| CN108400909A (en) | A kind of flow statistical method, device, terminal device and storage medium | |
| US9614766B2 (en) | System and method to analyze congestion in low latency network | |
| CN111222019B (en) | Feature extraction method and device | |
| CN105868169B (en) | A kind of data acquisition device, collecting method and system | |
| CN104378234A (en) | Cross-data-center data transmission processing method and system | |
| CN106713351B (en) | Secure communication method and device based on serial server | |
| CN111737222A (en) | Message queue data packet storage and retrieval method based on one-to-many request response model | |
| CN103067389B (en) | High safety file transfer method based on short website | |
| CN114338439B (en) | Universal network flow analysis device and method | |
| CN109783330B (en) | Log processing method, log display method, and related device and system | |
| CN110020243A (en) | Querying method, device, Internet of Things server and the storage medium of internet of things data | |
| CN101321097A (en) | Tencent network living broadcast business recognition method based on payload depth detection | |
| CN111988343B (en) | System and method for remotely setting rules and monitoring industrial network intrusion | |
| CN110691007A (en) | Method for accurately measuring QUIC connection packet loss rate | |
| CN109933712A (en) | A kind of extracting method and system of message data | |
| CN113114968A (en) | Video processing method, device, equipment and storage medium | |
| CN102595467B (en) | Data acquisition method and data acquisition device | |
| CN102137414A (en) | Time-delay-evaluating method and device for mobile video service |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information | ||
| CB02 | Change of applicant information |
Address after: Room 2306, east block, Skyworth semiconductor design building, 18 Gaoxin South 4th Road, Gaoxin community, Yuehai street, Nanshan District, Shenzhen, Guangdong 518052 Applicant after: Shenzhen Kukai Network Technology Co.,Ltd. Address before: 518052 A 1502, South SKYWORTH building, Shennan Avenue, Nanshan District, Shenzhen, Guangdong. Applicant before: Shenzhen Coocaa Network Technology Co.,Ltd. |
|
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190412 |