CN114448976A

CN114448976A - Network message assembling method, device, equipment, medium and program product

Info

Publication number: CN114448976A
Application number: CN202210243985.5A
Authority: CN
Inventors: 张仁辉; 陈兴; 周歆; 郑海青
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2022-03-11
Filing date: 2022-03-11
Publication date: 2022-05-06
Anticipated expiration: 2042-03-11
Also published as: CN114448976B

Abstract

The present disclosure relates to the field of cloud computing, and provides a method, an apparatus, a device, a medium, and a program product for assembling a network packet, the method including the steps of: collecting network messages and corresponding quadruple information; packaging the network message into a plurality of message messages according to the quadruple information; producing a plurality of message messages into a designated partition of a message queue; respectively consuming a plurality of message messages in the designated partition, and correspondingly caching the plurality of message messages into a plurality of local caches; when the specified conditions are met, assembling the message to obtain an application message; wherein the prescribed conditions include: when the local cache consumes the capacity with the preset size.

Description

Network message assembling method, device, equipment, medium and program product

Technical Field

The present disclosure relates to the field of cloud computing, and in particular, to a method, an apparatus, a device, a medium, and a program product for assembling a network packet.

Background

With the rapid increase of network traffic, the collection scale of network messages is larger. A common network packet collection device usually stores collected network packets to a local file, the network packet file collected in a high concurrency scenario is too bulky, and the requirements for system capacity and high availability for reading, writing and processing large packets are sharply increased. And after the network message acquisition device acquires the network message, writing the message into the local PCAP file, and after the acquisition is finished, opening the local PCAP file by using message assembly software to assemble the message.

Currently, mainstream message analysis software, such as Wireshark, adopts this method. However, when the number of the collected network messages is large, the memory occupation of the finally generated PCAP file is increased immediately. When the number of network messages reaches a certain bottleneck, higher requirements are required on the disk IO capacity, the memory and the large file processing capacity of the system. In summary, writing the message into the PCAP file and assembling the PCAP file is more suitable for a small file scene, and when the message PCAP file is large, the performance of the system will be affected.

Disclosure of Invention

In view of the above, the present disclosure provides a method, an apparatus, a device, a medium, and a program product for assembling a network packet, which aim to solve the problem that when a packet file is too large, system performance is affected.

According to a first aspect of the present disclosure, a method for assembling a network packet is provided, which includes the following steps:

collecting network messages and corresponding quadruple information;

packaging the network message into a plurality of message messages according to the quadruple information;

producing a plurality of message messages into a designated partition of a message queue;

respectively consuming a plurality of message messages in the designated partition, and correspondingly caching the plurality of message messages into a plurality of local caches;

when the specified conditions are met, assembling the message to obtain an application message;

wherein the prescribed conditions include: when the local cache consumes the capacity with the preset size.

According to the embodiment of the disclosure, the step of collecting the network message and the corresponding quadruple information comprises the following steps:

monitoring a host machine network card, and acquiring all messages in the host machine network card;

and filtering the message according to a preset rule to obtain a network message and obtain corresponding quadruple information.

According to the embodiment of the present disclosure, the step of correspondingly caching a plurality of message messages into a plurality of local caches includes:

creating a linked list according to the quadruple information corresponding to the message, wherein the message content of the message is a linked list node of the linked list;

and creating mapping cache data between the quadruple information and the linked list, and storing the mapping cache data into a local cache so as to cache the message into the local cache.

According to an embodiment of the present disclosure, the step of assembling the message to obtain the application message includes:

acquiring a request message and corresponding request quadruple information;

according to the request quadruple information, taking out a corresponding linked list from the mapping cache data;

acquiring reverse information of the request quadruple information, and obtaining a reverse linked list according to the reverse information;

and assembling and analyzing the message according to the linked list and the reverse linked list to obtain the application message.

According to the embodiment of the present disclosure, after the step of assembling the application packet, the method further includes:

and correspondingly deleting the message in the local cache.

According to an embodiment of the present disclosure, the prescribed conditions further include: the caching time of the message reaches the preset time.

According to an embodiment of the present disclosure, the quadruple information includes a source IP, a source port, a destination IP, and a destination port of the network packet.

A second aspect of the present disclosure provides an apparatus for assembling a network packet, including:

the acquisition module is used for acquiring the network message and the corresponding quadruple information;

the encapsulation module is used for encapsulating the network message into a plurality of message messages according to the quadruple information;

the production module is used for correspondingly producing the information into a plurality of specified partitions of the information queue;

the cache module is used for respectively consuming the message messages in the designated partitions and correspondingly caching the message messages into a plurality of local caches; and the number of the first and second groups,

and the assembling module is used for assembling the message to obtain the application message when the local cache consumes the capacity with the preset size.

A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the above-described method of assembling a network message.

A fourth aspect of the present disclosure also provides a computer-readable storage medium having stored thereon executable instructions, which when executed by a processor, cause the processor to perform the above-mentioned method for assembling a network packet.

A fifth aspect of the present disclosure also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the computer program implements the method for assembling the network packet.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be apparent from the following description of embodiments of the disclosure, which proceeds with reference to the accompanying drawings, in which:

fig. 1 schematically illustrates an application scenario diagram of a method, apparatus, device, medium, and program product for assembling a network packet according to an embodiment of the present disclosure;

fig. 2 schematically illustrates a flow chart of a method of assembling a network packet according to an embodiment of the present disclosure;

FIG. 3 schematically shows a flowchart of an embodiment of step S10 in FIG. 2;

FIG. 4 schematically shows a flowchart of an embodiment of step S40 in FIG. 2;

FIG. 5 schematically illustrates a flowchart of one embodiment of step S50 in FIG. 2;

FIG. 6 is a flow diagram that schematically illustrates another embodiment of a method of assembling the network messages of FIG. 2;

fig. 7 is a block diagram schematically illustrating an assembly apparatus of network packets according to an embodiment of the present disclosure;

fig. 8 schematically shows a block diagram of an electronic device adapted to implement the method of assembling a network packet according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

In the technical scheme of the disclosure, the acquisition, storage, application and the like of the personal information of the related user all accord with the regulations of related laws and regulations, necessary security measures are taken, and the customs of the public order is not violated.

The present disclosure provides a method for assembling a network packet, which includes the following steps:

collecting a network message and corresponding quadruple information;

Fig. 1 schematically shows an application scenario diagram of a network packet assembling method and apparatus according to an embodiment of the present disclosure.

As shown in fig. 1, the application scenario according to this embodiment may include a financial service field. Network 102 is the medium used to provide communication links between terminal devices 101 and server 103. Network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

A user may use terminal device 101 to interact with server 103 over network 102 to receive or send messages and the like. Various communication client applications, such as shopping applications, web browser applications, search applications, instant messaging tools, mailbox clients, social platform software, etc. (for example only) may be installed on the terminal device 101.

The terminal device 101 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.

The server 103 may be a server that provides various services, such as a background management server (for example only) that provides support for websites browsed by users using the terminal devices 101. The background management server may analyze and perform other processing on the received data such as the user request, and feed back a processing result (e.g., a webpage, information, or data obtained or generated according to the user request) to the terminal device.

It should be noted that the method for assembling a network packet provided by the embodiment of the present disclosure may be generally executed by the server 103. Accordingly, the information prompting device provided by the embodiment of the present disclosure may be generally disposed in the server 103. The method for assembling the network packet provided by the embodiment of the present disclosure may also be executed by a server or a server cluster that is different from the server 103 and is capable of communicating with the terminal device 101 and/or the server 103. Accordingly, the information prompting device provided in the embodiment of the present disclosure may also be disposed in a server or a server cluster that is different from the server 103 and is capable of communicating with the terminal device 101 and/or the server 103.

It should be understood that the number of terminal devices, networks, and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

The following describes the method for assembling a network packet according to the disclosed embodiment in detail with reference to fig. 2 to 6 based on the scenario described in fig. 1.

Fig. 2 schematically shows a flowchart of a method for assembling a network packet according to an embodiment of the present disclosure.

As shown in fig. 2, the method for assembling a network packet of this embodiment includes steps S10 to S50, and the method for assembling a network packet may be executed by an assembling apparatus of a network packet.

In operation S10, collecting a network packet and corresponding quadruple information;

in operation S20, encapsulating the network message into a plurality of message messages according to the quadruple information;

in operation S30, a plurality of message messages are generated into a designated partition of a message queue;

in operation S40, respectively consuming the plurality of message messages in the designated partition, and correspondingly caching the plurality of message messages in a plurality of local caches;

in operation S50, when a prescribed condition is satisfied, assembling a message to obtain an application message;

In the embodiment provided by the disclosure, collected network messages are packaged into message messages, the message messages are produced into different partitions of a message queue in a grouping manner, all the message messages in the message queue can be consumed and cached simultaneously through the setting of the message queue, the processing time of the message queue is saved, when the local cache reaches a certain scale, it is indicated that a complete request can be obtained through the assembled messages, and at the moment, the message can be assembled. System performance loss is reduced through packet and message queues. And the scale of assembling messages each time is reduced, and the assembling efficiency is improved through real-time assembling and analyzing.

It should be noted that, in this embodiment, in the process of encapsulating a message, a hash algorithm is used to calculate a partition position of a message queue to which the message should be uploaded according to four-tuple information of a header of the message, and the message is produced into a designated partition of the message queue

Further, referring to fig. 3, step S10 includes:

s11, monitoring a host machine network card, and acquiring all messages in the host machine network card;

and S12, filtering the message according to a preset rule to obtain a network message, and acquiring corresponding quadruple information.

In this embodiment, after obtaining all network messages in the host, only the network messages of the required portion are left through the preset rule, and by obtaining the corresponding quadruple information, it should be noted that, in this embodiment, the preset rule aims to filter the required messages from all the messages, and there are various implementation manners, for example, filtering the keywords through the expression to obtain a certain type of messages, or filtering through the ip address, as long as the messages in a specific range can be obtained according to the requirements, and no specific limitation is made herein.

On the other hand, referring to fig. 4, step S40 includes:

s41, creating a linked list according to the quadruple information corresponding to the message, wherein the message content of the message is a linked list node of the linked list;

s42, creating mapping cache data between the four-tuple information and the linked list, and storing the mapping cache data into a local cache so as to cache the message into the local cache.

In this embodiment, the linked list mode does not need to know the data size in advance, the linked list structure can fully utilize the memory space of the computer, flexible dynamic memory management is realized, the mapping cache data between the quadruple information and the linked list is established after the message is converted through the linked list storage structure, the corresponding linked list can be conveniently obtained by direct query according to the quadruple information, and then the corresponding message is obtained, and the memory is saved.

Specifically, in this embodiment, a Map cache is established, in which a quadruplet is used as a Key and a linked list is used as a Value; the key-value distributed storage system has the advantages of high query speed, large data storage amount and high support concurrency, and is very suitable for query through a main key.

Further, referring to fig. 5, step S50 includes:

s51, acquiring a request message and corresponding request quadruple information;

s52, taking out a corresponding linked list from the mapping cache data according to the request quadruple information;

s53, acquiring reverse information of the request quadruple information, and obtaining a reverse linked list according to the reverse information;

and S54, assembling and analyzing the message according to the linked list and the reverse linked list to obtain the application message.

Since key-value distributed storage is adopted, in this embodiment, the quadruple information of the request message is directly acquired, that is, the corresponding linked list can be obtained through query, in order to assemble the queried linked list, the reverse linked list is obtained through the reverse quadruple information to obtain the correct assembly sequence of the message messages in the linked list, and the message messages are assembled through assembly and analysis of the two linked lists to obtain the application message.

It should be noted that the request packet includes a request packet and a response packet TCP flow packet of the network transport layer, and the network packet sequence linked list node before several minutes is intercepted, so as to obtain a network packet sequence linked list before several minutes, and the network packet sequence linked list and the linked list created according to the packet message are subjected to packet assembly analysis, so as to obtain a request packet and a response packet of the actual application layer.

Referring to fig. 6, in order to release the memory in time, in this embodiment, step S50 further includes:

and S60, correspondingly deleting the message in the local cache.

The assembled message is removed from the local cache to release the local cache memory, and in this embodiment, the mapping cache data is deleted.

On the other hand, the specified condition further includes that the buffering time of the message reaches the preset time.

In the embodiment, unassembled message messages which exceed a certain time are obtained from the local cache at regular time and are assembled, so that the situation that the message messages occupy too much memory meaninglessly due to overlong buffer time is prevented.

It should be noted that, in the process of assembling the message, the request response network transmission message corresponding to the corresponding IP and port is directly obtained according to the linked list of the message, and then the full-quantity assembly analysis is directly performed according to the linked list, so as to obtain the application layer message.

It should be noted that, in this embodiment, the quadruple information includes a source IP, a source port, a destination IP, and a destination port of the network packet.

Based on the above method for assembling a network packet, the present disclosure also provides an apparatus for assembling a network packet, which will be described in detail below with reference to fig. 7.

Fig. 7 is a block diagram schematically illustrating a structure of an apparatus for assembling a network packet according to an embodiment of the present disclosure.

As shown in fig. 7, the assembling apparatus 200 for network packets includes an obtaining module 1, an encapsulating module 2, a producing module 3, a caching module 4, and an assembling module 5; the acquisition module 1 is used for acquiring network messages and corresponding quadruple information; the encapsulation module 2 is used for encapsulating the network message into a plurality of message messages according to the quadruple information; the production module 3 is used for correspondingly producing the message into a plurality of specified partitions of the message queue; the cache module 4 is used for respectively consuming the message messages in the plurality of designated partitions and correspondingly caching the plurality of message messages into a plurality of local caches; the assembling module 5 is configured to assemble the message to obtain the application message when the local cache consumes the capacity of the preset size.

Any number of modules, sub-modules, units, sub-units, or at least part of the functionality of any number thereof according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, sub-modules, units, sub-units according to embodiments of the present disclosure may be implemented at least in part as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in any other reasonable manner of hardware or firmware by integrating or packaging a circuit, or in any one of or a suitable combination of software, hardware, and firmware implementations. Alternatively, one or more of the modules, sub-modules, units, sub-units according to embodiments of the disclosure may be at least partially implemented as a computer program module, which when executed may perform the corresponding functions.

Fig. 8 schematically shows a block diagram of an electronic device adapted for a method of assembling a network message according to an embodiment of the disclosure.

As shown in fig. 8, the electronic device 300 according to the embodiment of the present disclosure includes a processor 3001 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)3002 or a program loaded from a storage section 3008 into a Random Access Memory (RAM) 3003. The processor 3001 may comprise, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 3001 may also include on-board memory for caching purposes. The processor 3001 may include a single processing unit or multiple processing units for performing the different actions of the method flows according to embodiments of the present disclosure.

In the RAM 3003, various programs and data necessary for the operation of the electronic apparatus 300 are stored. The processor 3001, the ROM 3002, and the RAM 3003 are connected to each other by a bus 3004. The processor 3001 performs various operations of the method flows according to the embodiments of the present disclosure by executing programs in the ROM 3002 and/or the RAM 3003. Note that the program may also be stored in one or more memories other than the ROM 3002 and the RAM 3003. The processor 3001 may also perform various operations of method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

According to an embodiment of the present disclosure, electronic device 300 may also include an input/output (I/O) interface 3005, input/output (I/O) interface 3005 also connected to bus 3004. The electronic device 300 may also include one or more of the following components connected to the I/O interface 3005: an input portion 3006 including a keyboard, a mouse, and the like; an output section 3007 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 3008 including a hard disk and the like; and a communication section 3009 including a network interface card such as a LAN card, a modem, or the like. The communication section 3009 performs communication processing via a network such as the internet. Drivers 3010 are also connected to I/O interface 3005 as needed. A removable medium 3011 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 3010 as necessary, so that a computer program read out therefrom is mounted in the storage section 3008 as necessary.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include one or more memories other than the ROM 3002 and/or the RAM 3003 and/or the ROM 3002 and the RAM 3003 described above.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the method illustrated in the flow chart. When the computer program product runs in a computer system, the program code is used for causing the computer system to realize the assembling method of the network message provided by the embodiment of the disclosure.

The computer program performs the above-described functions defined in the system/apparatus of the embodiments of the present disclosure when executed by the processor 3001. The systems, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In one embodiment, the computer program may be hosted on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted in the form of a signal on a network medium, distributed, downloaded and installed via the communication section 3009, and/or installed from the removable medium 3011. The computer program containing program code may be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 3009, and/or installed from the removable medium 3011. The computer program performs the above-described functions defined in the system of the embodiment of the present disclosure when executed by the processor 3001. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In accordance with embodiments of the present disclosure, program code for executing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, these computer programs may be implemented using high level procedural and/or object oriented programming languages, and/or assembly/machine languages. The programming language includes, but is not limited to, programming languages such as Java, C + +, python, the "C" language, or the like. The program code may execute entirely on the user computing device, partly on the user device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

The above-mentioned embodiments are intended to illustrate the objects, aspects and advantages of the present disclosure in further detail, and it should be understood that the above-mentioned embodiments are only illustrative of the present disclosure and are not intended to limit the present disclosure, and any modifications, equivalents, improvements and the like made within the spirit and principle of the present disclosure should be included in the scope of the present disclosure.

Claims

1. A method for assembling network messages is characterized by comprising the following steps:

collecting network messages and corresponding quadruple information;

respectively consuming a plurality of message messages in the designated subarea, and correspondingly caching the message messages into a plurality of local caches;

when a specified condition is met, assembling the message to obtain an application message;

wherein the prescribed conditions include: and when the local cache consumes the capacity with the preset size.

2. The method of assembling network messages according to claim 1, wherein the step of collecting the network messages and the corresponding quadruple information comprises:

and filtering the message according to a preset rule to obtain the network message and obtain the corresponding quadruple information.

3. The method according to any one of claims 1 or 2, wherein the step of correspondingly caching a plurality of message messages into a plurality of local caches comprises:

and creating mapping cache data between the four-tuple information and the linked list, and storing the mapping cache data into a local cache so as to cache the message into the local cache.

4. The method for assembling network messages according to claim 3, wherein the step of assembling the message messages to obtain the application messages comprises:

acquiring a request message and corresponding request quadruple information;

according to the request quadruple information, taking out the corresponding linked list from the mapping cache data;

acquiring reverse information of the request quadruple information, and acquiring a reverse linked list according to the reverse information;

5. The method for assembling network packets according to claim 1, wherein the step of assembling the application packet further comprises:

and correspondingly deleting the message in the local cache.

6. The method for assembling network packets according to claim 1, wherein the specified conditions further include: the caching time of the message reaches the preset time.

7. The method of assembling network packets of claim 1, wherein the quadruple information comprises a source IP, a source port, a destination IP and a destination port of a network packet.

8. An apparatus for assembling a network packet, comprising:

and the assembling module is used for assembling the message to obtain an application message when the local cache consumes the capacity with the preset size.

9. An electronic device, comprising:

one or more processors;

a storage device for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-7.

10. A computer-readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that it comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 7.