CN117997886A - Message processing method and device, electronic equipment and storage medium - Google Patents

Abstract

The embodiment of the application discloses a message processing method, a message processing device, electronic equipment and a storage medium. Wherein the method comprises the following steps: obtaining a message to be processed; determining a session table matched with the message to be processed and a file index matched with the message to be processed; and if the file matched with the message to be processed is determined to be cached, clearing the file index in the session table, and determining the file processing result of the message to be processed. According to the technical scheme, the transmission files of different browsers can be subjected to non-differentiation processing, the transmission files can be rapidly identified through the file index marks of the session table, and the utilization rate of the memory and the consumption of the central processor are reduced.

Description

Message processing method and device, electronic equipment and storage medium

Technical Field

The present invention relates to the field of data transmission technologies, and in particular, to a method and apparatus for processing a message, an electronic device, and a storage medium.

Background

With the continuous development and popularization of internet technology, the speed of global informatization is continuously increased, and the hypertext transfer protocol (HTTP, hypertext Transfer Protocol) is the most widely applied protocol on the internet, and has been receiving more and more attention.

Many browsers widely used at present are developed based on the HTTP protocol, but the package types of messages of different browser transmission files are different, and the identification and security detection of different browser transmission files by a security gateway are not very challenging.

Disclosure of Invention

The invention provides a message processing method, a message processing device, electronic equipment and a storage medium, which are used for realizing quick identification of different types of browser transmission files and reducing memory consumption.

According to an aspect of the present invention, there is provided a message processing method, including:

Obtaining a message to be processed;

determining a session table matched with the message to be processed and a file index matched with the message to be processed;

And if the file matched with the message to be processed is determined to be cached, clearing the file index in the session table, and determining the file processing result of the message to be processed.

According to another aspect of the present invention, there is provided a message processing apparatus, including:

The message acquisition module is used for acquiring a message to be processed;

the file index determining module is used for determining a session table matched with the message to be processed and a file index matched with the message to be processed;

And the file processing result determining module is used for clearing the file index in the session table and determining the file processing result of the message to be processed if the file matched with the message to be processed is determined to be cached.

According to another aspect of the present invention, there is provided an electronic apparatus including:

at least one processor; and

A memory communicatively coupled to the at least one processor; wherein,

The memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the message processing method according to any one of the embodiments of the present invention.

According to another aspect of the present invention, there is provided a computer readable storage medium storing computer instructions for causing a processor to execute a method for processing a message according to any embodiment of the present invention.

The technical scheme of the embodiment of the application comprises the following steps: obtaining a message to be processed; determining a session table matched with the message to be processed and a file index matched with the message to be processed; and if the file matched with the message to be processed is determined to be cached, clearing the file index in the session table, and determining the file processing result of the message to be processed. According to the technical scheme, the transmission files of different browsers can be subjected to non-differentiation processing, the transmission files can be rapidly identified through the file index marks of the session table, and the utilization rate of the memory and the consumption of the central processor are reduced.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the invention or to delineate the scope of the invention. Other features of the present invention will become apparent from the description that follows.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flow chart of a message processing method according to a first embodiment of the present application;

FIG. 2 is a flow chart of a message processing method according to a second embodiment of the present application;

Fig. 3 is a schematic structural diagram of a message processing apparatus according to a third embodiment of the present application;

fig. 4 is a schematic structural diagram of an electronic device implementing a message processing method according to an embodiment of the present application.

Detailed Description

In order that those skilled in the art will better understand the present application, a technical solution in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present application, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present application without making any inventive effort, shall fall within the scope of the present application.

It should be noted that the terms "first," "second," "target," and the like in the description and claims of the present invention and in the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Example 1

Fig. 1 is a flowchart of a message processing method provided in an embodiment of the present application, where the embodiment of the present application is applicable to a case of extracting and processing transmission files of different types of browsers, the method may be performed by a message processing apparatus, the message processing apparatus may be implemented in a form of hardware and/or software, and the message processing apparatus may be configured in an electronic device having data processing capability. As shown in fig. 1, the method includes:

S110, obtaining a message to be processed.

The technical scheme of the embodiment of the application can rapidly identify the transmission file, and can perform non-differentiation processing on the transmission file of different browsers under the condition of not consuming the processing capacity of a central processing unit (central processing unit) and not consuming a large memory. The transmission file is matched with one or more messages to be processed, and if the transmission of the messages to be processed is finished, the file transmission is finished. The type of the transmission file may include a hypertext transfer protocol file, a hypertext markup language file, and the like, and the present embodiment does not limit the type of the transmission file.

The HTTP transmission file is an HTTP transmission file transmitted from the data sender, and may be various types, such as pictures, videos, texts, and the like. The hypertext markup Language file refers to an HTML (hypertext markup Language) file.

Specifically, taking a transmission file as a hypertext transfer protocol file as an example, if a hypertext transfer protocol request of a data sender is received, responding to the request, and receiving a message to be processed through a network card. Specifically, the package-wrapping process may be performed by a data plane Development Kit (DATA PLANE Development Kit, DPDK). Further, the packet receiving processing of the DPDK means that the network card writes the received message to be processed into the packet receiving queue through DMA (Direct Memory Access ) hardware thereof, and then reads the message to be processed from the packet receiving queue. The message receiving may also be performed through NAPI (New Application Programming Interface, new application program interface), and the method of receiving the message is not limited in this embodiment.

It should be noted that the data sender may be various browsers, and the embodiment of the application is not limited to the package type of the message to be processed.

S120, determining a session table matched with the message to be processed and a file index matched with the message to be processed.

The session table is used for indicating whether the data sender of the message to be processed communicates with the data receiver. The file index is matched with the message to be processed and used for identifying the message to be processed, the corresponding message to be processed can be determined through the file index, and the file index can be managed through the file management module. Illustratively, the file index may be represented by a number, but the present embodiment does not limit the form of the file index.

Specifically, if it is determined that a session table matched with the message to be processed exists, and a file index exists in the session table, it is explained that the data sender of the message to be processed has previously communicated with the data receiver, and the file corresponding to the message to be processed is in a state of being sent, then it is determined that the file index is the file index of the message to be processed; if it is determined that a session table matched with the message to be processed exists, although a file index does not exist in the session table, it is determined that the message to be processed is file flow through service identification, at this time, the data sender of the message to be processed is described that the message to be processed has been communicated with the data receiver before, but the message to be processed may be the first message to be processed of the file currently transmitted, the file index is allocated to the message to be processed through the file management module, and the file index is stored in the session table matched with the message to be processed; if the conversation table matched with the message to be processed does not exist, the data sender of the message to be processed can communicate with the data receiver for the first time, the conversation table needs to be established, and meanwhile, after the message to be processed is determined to be the file flow through service identification, the file index is distributed to the message to be processed through the file management module and is stored in the conversation table matched with the message to be processed.

Specifically, when the session table exists but the file index does not exist, and when the message to be processed is the file traffic and the session table does not exist, determining the file index matched with the message to be processed through the file management module after generating the session table, or generating an idle file index through the file management module, applying for resources such as a memory occupied by the file index, and distributing the file index to the message to be processed.

Optionally, after determining the file index matched with the message to be processed, the method further includes: extracting the file of the message to be processed, caching the extracted file, and forwarding the message to be processed.

In the embodiment of the application, after the file index of the message to be processed is determined, the file index is stored in the session table, the message to be processed is extracted, the extracted file content is copied and cached, and the storage of the file flow and the association between the file flows are realized. Meanwhile, forwarding a message to be processed is performed based on a memory buffer, and when receiving a packet based on DPDK, the memory buffer may be referred to as mbuf (memory buffer). Specifically, the message to be processed can be cached in the memory cache, and the normal message forwarding flow is performed on the message to be processed in the memory cache.

And S130, if the file matched with the message to be processed is determined to be cached, clearing the file index in the session table, and determining the file processing result of the message to be processed.

In a possible embodiment, when the data sender generates a plurality of messages according to the transmission file to send, an end identifier may be set in the last message, and if the end identifier is identified in the message to be processed, it may be determined that the hypertext transfer protocol file matching with the message to be processed is cached.

In the embodiment of the application, after the last message of the transmission file is extracted, at least one file process is performed on the extracted file. The file processing result may include various situations, for example, if the file extracted from the message to be processed meets the security requirement, the message to be processed is forwarded to the target location; if the file extracted from the message to be processed does not meet the safety requirement, the message can be deleted, and meanwhile, the message stored in the mbuf based on DPDK can be discarded.

In the embodiment of the application, when the file transmission is completed, that is, when the current message to be processed is the last message corresponding to the file, the file extracted from the message to be processed is processed to obtain a file processing result. And simultaneously, clearing the file index corresponding to the file in the session table to indicate that the current file processing is completed.

According to the technical scheme provided by the embodiment of the application, the message corresponding to the file can be rapidly identified based on the file index in the session table, the situation of occupation of the file index is avoided by timely emptying the file index in the session table, and the availability of the file index in the transmission of other files is ensured as much as possible. Meanwhile, according to the technical scheme provided by the embodiment of the application, only the extracted file of the last message corresponding to the file is subjected to file processing, so that the consumption of the memory and the central processing unit is greatly reduced.

The technical scheme of the embodiment of the application comprises the following steps: obtaining a message to be processed, wherein the message to be processed is a message matched with a file; determining a session table matched with the message to be processed and a file index matched with the message to be processed; and if the file matched with the message to be processed is determined to be cached, clearing the file index in the session table, and determining the file processing result of the message to be processed. According to the technical scheme, the transmission files of different browsers can be subjected to non-differentiation processing, the transmission files can be rapidly identified through the file index marks of the session table, and the utilization rate of the memory and the consumption of the central processor are reduced.

Example two

Fig. 2 is a flowchart of a message processing method according to a second embodiment of the present application, where the embodiments of the present application are based on the foregoing embodiments to embody and/or optimize a session table, a file index, and a file processing result.

As shown in fig. 2, the method in the embodiment of the present application specifically includes the following steps:

s210, obtaining a message to be processed.

Specifically, after the network card receives the message to be processed, the packet is received by the DPDK.

S220, determining a session table matched with the message to be processed.

In the embodiment of the present application, optionally, determining a session table matched with the to-be-processed message includes: determining a conversation table matched with the message to be processed in the saved conversation tables according to the five-tuple information of the message to be processed; if the stored session table does not exist, generating the session table according to the five-tuple information of the message to be processed and storing the session table.

Specifically, the session table may be generated according to five-tuple information through a Hash algorithm, but the specific manner of generating the session table is not limited in this embodiment.

Wherein, the quintuple information refers to: source IP (Internet Protocol ) address, source port, destination IP address, destination port, and transport layer protocol.

Specifically, generating a Hash index of the message to be processed through a Hash algorithm according to five-tuple information of the message to be processed, traversing a stored session table according to the Hash index, and determining that the session table is matched with the message to be processed if a session table matched with the five-tuple information of the message to be processed exists; if the session table matched with the five-tuple information of the message to be processed does not exist, generating the session table according to the Hash index of the message to be processed, and determining the session table as the session table matched with the message to be processed. Further, the new session table is stored together with the existing session table. It should be noted that, the generation of the session table according to the five-tuple information is in the prior art, and the embodiments of the present application will not be repeated.

And S230, if the file index exists in the session table, determining the file index in the session table as the file index matched with the message to be processed.

The file management module can complete file index management functions such as generating file indexes, deleting file indexes and the like. Specifically, if the file index exists in the session table, the message to be processed is the content of the transmission file, and the message to be processed is not the first message to be processed of the transmission file, and the transmission file is in the process of transmitting the message. At this time, the file index in the session table is the file index matched with the message to be processed, so as to indicate that the message to be processed is the message corresponding to the transmission file.

In the embodiment of the present application, optionally, if it is determined that the file index does not exist in the session table, file flow identification is performed on the message to be processed; if the message to be processed is determined to be the file flow, determining a file index matched with the message to be processed through a file management module, and storing the file index into a session table matched with the message to be processed.

The file flow refers to that the corresponding message to be processed is a part of the file.

Specifically, if the file index does not exist in the session table, the file to be processed may have an abnormality, and whether the message to be processed is file traffic needs to be judged, so that the conditions of virus invasion and the like are avoided, and the security is ensured. It should be noted that, whether the message to be processed is the file traffic may be determined according to the file name, the file feature, the POST request information, etc. of the message to be processed, and obviously, whether the message to be processed is the file traffic may be determined according to one or more conditions.

Further, if the message to be processed is the file flow, the file management module can determine the available file index as the file index matched with the message to be processed, and store the file index into the session table matched with the message to be processed.

It should be noted that, if the file index does not exist in the session table and the message to be processed is not the file traffic, normal mbuf message forwarding processing based on DPDK is performed on the message to be processed.

S240, extracting the file of the message to be processed, caching the extracted file, and forwarding the message to be processed.

The buffer memory can rapidly store the message to be processed, and is convenient for the subsequent processing of the message to be processed. Specifically, the message to be processed can be determined as a part of the transmission file and cached if the session table is matched with the file index. Obviously, if the session table has no file index, but the message to be processed is file flow, the file index is saved to the session table, and file extraction and file caching of the message to be processed can be performed.

S250, if the fact that the message to be processed contains the end identifier is determined, file caching matched with the message to be processed is determined to be completed.

The end identifier may reflect that the message to be processed is the last message of the hypertext transfer protocol file, and the embodiment of the application does not limit the specific content of the end identifier.

Specifically, if the message to be processed does not contain the end identifier, S210-S240 are repeatedly executed, and the receiving of the message to be processed, the judgment of the session table, the allocation of the file index and the caching of the extracted file in the message are continued until it is determined that the message to be processed contains the end identifier, and then it is determined that the message to be processed is the last message of the corresponding file, and the caching of the file matched with the message to be processed is completed.

In the embodiment of the application, the five-tuple information of the message to be processed of the transmission file is different from other files, so that the difference exists in the session table information, and the transmission files of different types are not confused.

S260, clearing the file index in the session table, and determining the file processing result of the message to be processed.

In the embodiment of the present application, optionally, determining a file processing result of the message to be processed includes steps A1-A3:

And A1, performing at least one file processing on the file extracted from the message to be processed, wherein the file processing comprises virus scanning, content detection and mail filtering.

The method and the device for detecting the content of the extracted file are not limited by the specific modes of virus scanning, content detection and mail filtering.

And step A2, if the file processing result of the message to be processed is determined to be that the message is released, forwarding the message to be processed.

Message release means that the extracted file corresponding to the message is free of abnormality and trusted. The message discarding means that the extracted file corresponding to the message has an abnormal file and is not trusted.

And step A3, if the file processing result of the message to be processed is determined to be that the message is discarded, deleting the cached message corresponding to the file matched with the message to be processed, and stopping forwarding the message to be processed.

Specifically, at least one file processing is carried out on a file extracted from a message to be processed, and if the file processing result is that the message is released, the message is forwarded to a target position and/or equipment; if the file processing result is that the message is discarded, discarding the message stored in the mbuf based on the DPDK, deleting all the cached messages matched with the transmission file, deleting the message to be processed in the memory cache, and further stopping forwarding the message to be processed.

In the scheme, the file extraction and the file processing can be carried out on the message to be processed containing the end identifier, if the result of the file processing is that the message is discarded, the exception of the hypertext transfer protocol file can be determined, the file is discarded, and the message processing is not required to be carried out on all the messages, so that the effect of improving the processing speed is achieved; in addition, the scheme ensures that the memories of other mbuf large pages can be normally forwarded and recycled by controlling the mbuf of the last DPDK (digital video broadcasting) based on the hypertext transfer protocol file message.

According to the technical scheme, a conversation table matched with a message to be processed is determined by acquiring the message to be processed; if the file index exists in the session table, determining the file index as a file index matched with the message to be processed; extracting the file from the message to be processed and caching the extracted file; if the message to be processed contains the end identifier, determining that the transmission file matched with the message to be processed is cached; and clearing the file index in the session table, and determining the file processing result of the message to be processed. According to the technical scheme, the file index mark of the DPDK session table can be used for quickly and efficiently identifying the transmission file and caching the file, so that the utilization rate of the memory and the consumption of the central processor are reduced. According to the technical scheme, corresponding operation is carried out through the session table and the file index of the message to be processed, the package types of the messages of different browsers are not required to be considered, the problem that the memory and/or the central processing unit are occupied by the processing of different package types is avoided, and the compatibility and the processing speed of receiving and transmitting files are improved.

Example III

Fig. 3 is a schematic structural diagram of a message processing apparatus according to a third embodiment of the present application, where the apparatus may execute the message processing method according to any embodiment of the present application, and the apparatus has functional modules and beneficial effects corresponding to the execution method. As shown in fig. 3, the apparatus includes:

A message obtaining module 310, configured to obtain a message to be processed, where the message to be processed is a message matched with a hypertext transfer protocol file;

a file index determining module 320, configured to determine a session table matched with the to-be-processed message and a file index matched with the to-be-processed message;

And the file processing result determining module 330 is configured to empty the file index in the session table and determine the file processing result of the to-be-processed message if it is determined that the file buffering matched with the to-be-processed message is completed.

According to the technical scheme, a conversation table matched with the message to be processed and a file index matched with the message to be processed are determined by acquiring the message to be processed; and if the file matched with the message to be processed is determined to be cached, clearing the file index in the session table, and determining the file processing result of the message to be processed. According to the technical scheme, the transmission files of different browsers can be subjected to non-differentiation processing, the transmission files can be rapidly identified through the file index marks of the session table, and the utilization rate of the memory and the consumption of the central processor are reduced.

Optionally, the file index determining module 320 includes:

The conversation table determining unit is used for determining a conversation table matched with the message to be processed in the saved conversation tables according to the five-tuple information of the message to be processed;

And the conversation table generating unit is used for generating and storing the conversation table according to the five-tuple information of the message to be processed if the conversation table matched with the message to be processed does not exist in the stored conversation table.

Optionally, the file index determining module 320 includes:

And the first file index determining unit is used for determining that the file index in the session table is the file index matched with the message to be processed if the file index exists in the session table.

Optionally, the file index determining module 320 includes:

The file flow identification unit is used for identifying the file flow of the message to be processed if the file index does not exist in the session table;

And the file index matching unit is used for determining the file index matched with the message to be processed through the file management module if the message to be processed is determined to be the file flow, and storing the file index into a session table matched with the message to be processed.

Optionally, the apparatus further includes:

and the caching module is used for extracting the file of the message to be processed, caching the extracted file and forwarding the message to be processed.

Optionally, the file processing result determining module 330 includes:

And the buffer completion determining unit is used for determining that the file matched with the message to be processed is completed if the message to be processed contains the end identifier.

Optionally, the file processing result determining module 330 includes:

the message processing unit is used for carrying out at least one file processing on the file extracted from the message to be processed, wherein the file processing comprises virus scanning, content detection and mail filtering;

The message forwarding unit is used for forwarding the message to be processed if the file processing result of the message to be processed is determined to be that the message is released;

And the message discarding unit is used for deleting the cached message corresponding to the file matched with the message to be processed and stopping forwarding the message to be processed if the file processing result of the message to be processed is determined to be message discarding.

The message processing device provided by the embodiment of the application can execute the message processing method provided by any embodiment of the application, and has the corresponding functional modules and beneficial effects of the execution method.

Example IV

Fig. 4 shows a schematic diagram of the structure of an electronic device 10 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.

As shown in fig. 4, the electronic device 10 includes at least one processor 11, and a memory, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., communicatively connected to the at least one processor 11, in which the memory stores a computer program executable by the at least one processor, and the processor 11 may perform various appropriate actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM 12 and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.

Various components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, etc.; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.

The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (central processor), a Graphics Processing Unit (GPU), various dedicated Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, digital Signal Processors (DSPs), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as message processing methods.

In some embodiments, the message processing method may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. One or more of the steps of the message processing method described above may be performed when the computer program is loaded into RAM 13 and executed by processor 11. Alternatively, in other embodiments, the processor 11 may be configured to perform the message processing method in any other suitable way (e.g. by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.

The computing system may include clients and servers. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.

The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.

Claims (10)

1. A method for processing a message, comprising:

Obtaining a message to be processed;

determining a session table matched with the message to be processed and a file index matched with the message to be processed;

And if the file matched with the message to be processed is determined to be cached, clearing the file index in the session table, and determining the file processing result of the message to be processed.

2. The method of claim 1, wherein determining a session table that matches the pending message comprises:

determining a conversation table matched with the message to be processed in the saved conversation tables according to the five-tuple information of the message to be processed;

if the stored session table does not exist, generating the session table according to the five-tuple information of the message to be processed and storing the session table.

3. The method of claim 2, wherein determining a file index matching the message to be processed comprises:

If the file index exists in the session table, the file index in the session table is determined to be the file index matched with the message to be processed.

4. The method of claim 2, wherein determining a file index matching the message to be processed comprises:

if the fact that the file index does not exist in the session table is determined, file flow identification is conducted on the message to be processed;

if the message to be processed is determined to be the file flow, determining a file index matched with the message to be processed through a file management module, and storing the file index into a session table matched with the message to be processed.

5. The method of claim 1, further comprising, after determining the file index matching the pending message:

extracting the file of the message to be processed, caching the extracted file, and forwarding the message to be processed.

6. The method of claim 5, wherein determining that the file buffering matching the pending message is complete comprises:

if the message to be processed contains the end identifier, the file cache matched with the message to be processed is determined to be completed.

7. The method of claim 5, wherein determining the file processing result of the message to be processed comprises:

at least one file processing is carried out on the file extracted from the message to be processed, wherein the file processing comprises virus scanning, content detection and mail filtering;

if the file processing result of the message to be processed is determined to be that the message is released, forwarding the message to be processed;

If the file processing result of the message to be processed is determined to be that the message is discarded, deleting the cached message corresponding to the file matched with the message to be processed, and stopping forwarding the message to be processed.

8. A message processing apparatus, comprising:

The message acquisition module is used for acquiring a message to be processed;

the file index determining module is used for determining a session table matched with the message to be processed and a file index matched with the message to be processed;

And the file processing result determining module is used for clearing the file index in the session table and determining the file processing result of the message to be processed if the file matched with the message to be processed is determined to be cached.

9. An electronic device, the electronic device comprising:

at least one processor; and

A memory communicatively coupled to the at least one processor; wherein,

The memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the message processing method of any one of claims 1-7.

10. A computer readable storage medium storing computer instructions for causing a processor to perform the message processing method of any one of claims 1-7.