WO2010069214A1

WO2010069214A1 - Method and equipment for field filtering

Info

Publication number: WO2010069214A1
Application number: PCT/CN2009/074950
Authority: WO
Inventors: 贾林; 陈锦荣; 李永利; 王宝财
Original assignee: 北京中创信测科技股份有限公司
Priority date: 2008-12-19
Filing date: 2009-11-16
Publication date: 2010-06-24
Also published as: CN101442539B; CN101442539A

Abstract

A method and equipment for field filtering are provided. The method includes that: the field type of a field to be filtered is obtained (101); the filtering process corresponding to the field type of a field to be filtered is called, and the filtering process performs the filtering processing to the decoding result of the field to be filtered according to the filtering conditions of the field to be filtered (102). According to the embodiment of the invention, the field in the protocol could be filtered with releasing the workload of the development personnel.

Description

Method and device for realizing field filtering

The present application claims priority to Chinese Patent Application No. 200810239863.9, entitled "Implementation of Field Filtering Method and Apparatus" on December 19, 2008, the entire disclosure of which is incorporated herein by reference. .

Technical field

The present invention relates to the field of network communication technologies, and in particular, to a method and apparatus for implementing field filtering.

Background technique

With the rapid growth of network applications, there are more and more risks lurking in the network. Therefore, it is necessary to analyze the transmission packets in the network in order to find potential problems in the network. For example, when the sending of packets in the network is slow, the protocol analyzer is used to analyze the data packets transmitted by the network to determine the problem. Among them, the filtering of various fields in the protocol is the key technology of protocol analysis.

In the prior art, in order to implement field filtering, each field in the protocol corresponds to a specific filtering process, and the field filtering function is implemented by calling a filtering process corresponding to the field. For example, when filtering the field 1, the field 2, and the field 3, in order to implement the corresponding filtering function, the developer needs to establish the filtering processing flow for the field 1 respectively, the filtering processing flow 2 for the field 2, and the field for the field 3 Filter process flow 3. The sender establishes a specific filtering process for each field. This cumbersome field filtering method is bound to bring a huge amount of work to the developer, especially when implementing the filtering function of all the fields defined in the protocol specification. To implement the full field filtering function in the protocol, due to the large number of fields in the full field, it is not easy for developers to filter the entire field in the protocol during development. Summary of the invention

Embodiments of the present invention provide a method and apparatus for implementing field filtering to implement filtering of fields in a protocol on the basis of reducing the workload of a developer.

The embodiment of the present invention discloses a method for implementing field filtering, including: acquiring a field type of a field to be filtered; and invoking a filtering process corresponding to a field type of the field to be filtered, according to the filtering process according to the The filtering condition of the field to be filtered is performed on the decoding result of the filtered field. Filter processing.

Preferably, the obtaining the field type of the field to be filtered includes: establishing a protocol static information set and presenting the protocol static information set to the user, where the user selects a field to be filtered from the protocol static information set, the protocol The unit in the static information set is field information of a field, and the field information includes at least a field type; receiving a field to be filtered selected by the user from the static information set of the protocol; and reading field information of the field to be filtered , get the field type of the field to be filtered.

Preferably, the filtering processing of the decoding result by the filtering process according to the filtering condition of the to-be-filtered field includes: obtaining a filtering condition and a decoding result of the to-be-filtered field; determining whether the filtering condition of the to-be-filtered field is related to the to-be-filtered field The decoding results match.

Preferably, the filtering condition for obtaining the to-be-filtered field includes: receiving filtering logic selected by the user for the to-be-filtered field; receiving a filtering value set by the user for the filtering logic.

Preferably, the decoding result of the field to be filtered includes: establishing a decoding result set of the protocol, the unit in the decoding result set is a decoding result of the field, and the field to which the decoding result belongs is indicated by a field identifier; Decoding results of the fields to be filtered are found from the set of decoding results according to the field identifier of the field to be filtered.

The embodiment of the invention further discloses an apparatus for implementing field filtering, comprising: a pre-built unit, configured to pre-establish a filtering processing flow corresponding to a field type; and a field type obtaining unit, configured to obtain a field type of the field to be filtered; The filtering unit is configured to invoke a filtering process corresponding to the field type of the field to be filtered, and the filtering process is used to filter the decoding result of the filtering field according to the filtering condition of the to-be-filtered field.

Preferably, the field type obtaining unit includes: a protocol static information set establishing unit, and displaying the protocol static information set to the user, where the user selects a field to be filtered from the protocol static information set, and is used to establish a protocol static The information set, the unit in the static information set of the protocol is field information of a field, and the field information includes at least a field type. The first selecting unit is configured to receive, by the user, the selected one of the static protocol information sets. a filter unit, configured to read field information of the field to be filtered, and obtain a field type of the field to be filtered.

Preferably, the filtering unit includes: a first acquiring unit, configured to acquire a filtering condition of the field to be filtered; a second acquiring unit, configured to obtain a decoding result of the field to be filtered; and a determining unit, configured to determine Whether the filtering condition of the field to be filtered matches the decoding result of the field to be filtered. Preferably, the first obtaining unit includes: a first receiving subunit, configured to receive filtering logic set by the user for the to-be-filtered field; and a second receiving subunit, configured to receive, by the user, the filtering logic Filter the value.

Preferably, the second obtaining unit includes: a decoding result set establishing unit, configured to establish a decoding result set of the protocol, where a unit in the decoding result set is a decoding result of the field, and a field to which the decoding result belongs is The field identifier indicates that the field identifier is used to find the decoding result of the field to be filtered from the decoding result set according to the field identifier of the field to be filtered.

It can be seen from the foregoing embodiment of the present invention that the filtering process is established according to the field type, and the fields of the same field type are filtered by the same filtering process. Because the field types of each field in the protocol are limited, usually several There are more than a dozen, so the developer's workload is greatly saved, and it is easier for developers to implement filtering of all fields in the protocol.

DRAWINGS

FIG. 1 is a flowchart of a method for implementing field filtering according to a first embodiment of the present invention; FIG. 2 is a flowchart of a method for implementing field filtering according to Embodiment 2 of the present invention; A schematic diagram of the structure of a static information tree corresponding to a static information set;

FIG. 4 is a structural diagram of an apparatus for implementing field filtering according to Embodiment 3 of the present invention.

detailed description

The present invention will be further described in detail with reference to the accompanying drawings and specific embodiments.

The invention is applicable to a wide variety of general purpose or special purpose computing system environments or configurations. For example: personal computer, server computer, handheld or portable device, tablet device, multiprocessor system, distributed computing environment including any of the above systems or devices, and so on.

The invention may be described in the general context of computer-executable instructions executed by a computer, such as a program module. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located locally, including storage devices. And remote computer storage media. Embodiment 1

Referring to FIG. 1 , FIG. 1 is a flowchart of a method for implementing field filtering according to an embodiment of the present disclosure, which may include the following steps:

Step 101: Obtain a field type of a field to be filtered.

The field type of the field to be filtered includes: establishing a protocol static information set, where the unit in the static information set of the protocol is field information, the field information includes a field type; and selecting a to-be-set from the protocol static information set Filtering the field; reading the field information of the field to be filtered to obtain the field type of the field to be filtered.

Step 102: Invoke a filtering process corresponding to the field type of the field to be filtered, and the filtering process performs filtering processing on the decoding result of the filtering field according to the filtering condition of the to-be-filtered field.

The filtering process of the decoding information by the filtering process according to the filtering condition of the to-be-filtered field includes: obtaining a filtering condition and a decoding result of the to-be-filtered field; determining whether the filtering condition of the to-be-filtered field is related to the decoding result of the to-be-filtered field match.

It can be seen from the foregoing embodiment of the present invention that the filtering process is established according to the field type, and the fields of the same field type are filtered by the same filtering process. Because the field types of each field in the protocol are limited, usually several to ten. Several, therefore, greatly save the developer's workload, making it easier for developers to filter the entire field in the protocol. Embodiment 2

Referring to FIG. 2, FIG. 2 is a flowchart of a method for implementing field filtering according to Embodiment 2 of the present invention. The difference from the first embodiment is that the embodiment is a specific implementation manner for implementing field filtering. .

In this embodiment, a filtering process corresponding to the field type is established in advance, for example, a string type field filtering processing flow corresponding to a string type field and a numerical field filtering processing corresponding to a numeric type field. The process, after the filtering process is established for the field types of all the fields defined in the protocol specification, the filtering process for the fields in the protocol may specifically include The following steps:

Step 201: Select a field to be filtered;

A protocol static information set is established for each protocol, and the protocol static information set is used to completely describe the information of the entire protocol, for example, the coding mode of the protocol, the number of fields, and the attributes of each field. Each unit in the protocol static information set corresponds to one field information. The protocol static information set is a set of all field information, and the field information of each field mainly includes the field type and the field identifier. Through the field type, the filtering process corresponding to the field can be invoked, and the field identifier can be used to distinguish each field in the protocol static information tree.

For example, the content of the protocol static information collection can be:

{

(A, Data),

(B, Data),

( C, String ) ,

( D, Time ) ,

( E, Float ) ,

If the (A, Data) unit is used as an example, then A is a field identifier, indicating that the unit is the field information of the field A, Data is the field type, and the field type of the field A is a numeric value.

The protocol static information set can be physically implemented by using an array, so that the protocol static information collection is on the data structure, and the field identification is more convenient for quickly locating a field information unit in the collection. The protocol static information set can be logically in the form of a tree. Each node in the tree corresponds to a field information. Taking the IP protocol as an example, a static information set of the IP protocol is established, and a static information tree corresponding to the static information set of the IP protocol is established. As shown in Figure 3.

After the protocol static information set is established, the protocol static information set can be presented to the user in the form of a static information tree as shown in FIG. 3, and the user can directly select the field to be filtered from the static information tree.

Step 202: Set a filter condition for each field to be filtered, and generate a filter condition set. After the field to be filtered is selected from the static information set of the protocol, the user sets a filtering condition for each field to be filtered, where the filtering condition includes filtering logic and a filtering value corresponding to the filtering logic. The filter condition set by the user generates a filter condition set. Each unit in the filter condition set corresponds to a filter condition of the field to be filtered. For example, the content of the filter condition set may be:

(A, Data, >, 5),

(B, Data, <, 10),

(C , String, == , "zctt" ), Here, the field A, the field B and the field C are selected from the above-mentioned protocol static information set as the field to be filtered, if (A, Data, >, 5) The unit is taken as an example. Then, the numeric field A is set to have a field logic of " >", and the corresponding field logic has a field value of 5.

Similarly, the protocol static information set can also be physically implemented using an array.

Step 203: Call a filtering process corresponding to the field type of each field to be filtered according to the field type of each field to be filtered.

After the field to be filtered is selected, the field type and the field identifier of each field to be filtered are obtained from the field information of the field to be filtered, and the corresponding relationship between the previously established field type and the filtering process is invoked. The filtering process corresponding to the field type of the field to be filtered. In the filtering process of each field to be filtered, the decoding result of each field to be filtered is found from the decoding result set by the field identifier of each field to be filtered, and the field identifier of each field to be filtered is filtered from the same. The filter condition of each field to be filtered is found in the condition set. After the filter condition and the decoding result of each field to be filtered are determined, it is sequentially determined whether the filter condition of each field to be filtered matches the decoding result, thereby completing the pair. Filtering of all fields to be filtered.

The decoding result in the above may be stored in the form of a set of decoding results. After receiving the data packet and decoding the data packet, the decoding result of the data packet is established into a decoding result set, and each unit in the decoding result set corresponds to a decoding result of one field, and each decoding is indicated by a field identifier. The field to which the result belongs. For example, when it is determined that the fields to be filtered are the field A, the field B, and the field C, the field information of the field A and the field B are all numeric, and the field type of the field C is a string type. Field A and field B call the filtering process corresponding to the numeric field, and field C calls the filtering process corresponding to the string type field to complete the filtering process.

It can be seen from the foregoing embodiment of the present invention that the filtering process is established according to the field type, and the fields of the same field type are filtered by the same filtering process. Because the field types of each field in the protocol are limited, usually several There are more than a dozen, so the developer's workload is greatly saved, and it is easier for developers to implement filtering of all fields in the protocol. Embodiment 3

Corresponding to the foregoing method for implementing field filtering, an embodiment of the present invention further provides an apparatus for implementing field filtering. Referring to FIG. 4, FIG. 4 is a structural diagram of an apparatus for implementing field filtering according to Embodiment 3 of the present invention. The apparatus includes a preset unit 401, a field type obtaining unit 402, and a filtering unit 403. The internal structure and connection relationship will be further described below in conjunction with the working principle of the device.

The pre-built unit 401 is configured to pre-establish a filtering process corresponding to the field type; the field type obtaining unit 402 is configured to obtain a field type of the field to be filtered;

The filtering unit 403 is configured to invoke a filtering process corresponding to the field type of the field to be filtered, and the filtering process is used to filter the decoding result of the filtering field according to the filtering condition of the to-be-filtered field.

The field type obtaining unit 402 includes: a protocol static information set establishing unit 404, a first selecting unit 405, and a reading unit 406, and a protocol static information set establishing unit 404, configured to establish a protocol static information set, and the protocol static information set The unit in the field is field information, and the field information includes a field type. The first selecting unit 405 is configured to select a field to be filtered from the static protocol information set. The reading unit 406 is configured to read the The field information of the field is filtered to obtain the field type of the field to be filtered.

The filtering unit 403 includes: a first obtaining unit 407, a second obtaining unit 408, and a determining unit 409, a first obtaining unit 407, configured to obtain a filtering condition of the field to be filtered, and a second obtaining unit 408, configured to acquire a field to be filtered. Decoding result; the determining unit 409, configured to determine the field to be filtered Whether the filter condition matches the decoding result of the field to be filtered.

The first obtaining unit 407 includes: a first receiving subunit, configured to receive filtering logic set by the user for the to-be-filtered field; and a second receiving subunit, configured to receive a filtering value set by the user for the filtering logic .

The second obtaining unit 408 includes: a decoding result set establishing unit, configured to establish a decoding result set of the protocol, where a unit in the decoding result set is a decoding result of the field, and a field to which the decoding result belongs is identified by a field The second selection unit searches for a decoding result of the to-be-filtered field from the decoding result set according to the field identifier of the field to be filtered.

It can be seen from the foregoing embodiment of the present invention that the filtering process is established according to the field type, and the fields of the same field type are filtered by the same filtering process. Because the field types of each field in the protocol are limited, usually several There are more than a dozen, so the developer's workload is greatly saved, and it is easier for developers to implement filtering of all fields in the protocol. The method and apparatus for implementing field filtering provided by the present invention are described in detail above, and the description is only for helping to understand the method and core idea of the present invention. Meanwhile, for those skilled in the art, the idea according to the present invention is The details of the present invention and the scope of application are subject to change, and the contents of the present specification should not be construed as limiting the present invention.

Claims

Rights request

A method for implementing field filtering, characterized in that a filtering process corresponding to a field type is established in advance, and the method includes:

Get the field type of the field to be filtered;

The filtering process corresponding to the field type of the field to be filtered is invoked, and the filtering process of the filtering field is filtered by the filtering process according to the filtering condition of the to-be-filtered field.

2. The method according to claim 1, wherein the obtaining the field type of the field to be filtered comprises:

Establishing a protocol static information set and presenting the protocol static information set to the user, and the user selects a field to be filtered from the protocol static information set, where the unit in the static information set is a field field information, The field information includes at least a field type;

Receiving a field to be filtered selected by the user from the static information set of the protocol;

The field information of the field to be filtered is read, and the field type of the field to be filtered is obtained.

The method according to claim 1, wherein the filtering process is performed by the filtering process according to the filtering condition of the field to be filtered, including:

Obtaining the filtering condition and decoding result of the field to be filtered;

The method according to claim 3, wherein the obtaining the filtering condition of the field to be filtered comprises:

Receiving filtering logic selected by the user for the to-be-filtered field;

The filtered value set by the user for the filtering logic is received.

The method according to claim 3, wherein the obtaining the decoding result of the field to be filtered comprises:

Establishing a decoding result set of the protocol, where a unit in the decoding result set is a decoding result of the field, and a field to which the decoding result belongs is indicated by a field identifier;

Decoding the field to be filtered from the decoded result set according to the field identifier of the field to be filtered.

6. An apparatus for implementing field filtering, wherein the apparatus comprises: a pre-built unit, configured to pre-establish a filtering process corresponding to the field type; and a field type obtaining unit, configured to obtain a field type of the field to be filtered;

And a filtering unit, configured to invoke a filtering processing process corresponding to the field type of the to-be-filtered field, where the filtering processing process performs filtering processing on the decoding result of the filtering field according to the filtering condition of the to-be-filtered field.

The device according to claim 6, wherein the field type obtaining unit comprises:

a protocol static information collection establishing unit, configured to establish a protocol static information set and display the protocol static information set to the user, where the user selects a field to be filtered from the protocol static information set, where the protocol static information set The unit is field information of a field, and the field information includes at least a field type;

a first selecting unit, configured to receive a to-be-filtered field selected by the user from the static protocol information set;

a reading unit, configured to read field information of the to-be-filtered field, to obtain a field type of the to-be-filtered field.

The device according to claim 6, wherein the filtering unit comprises: a first acquiring unit, configured to acquire a filtering condition of a field to be filtered;

a second obtaining unit, configured to obtain a decoding result of the field to be filtered; the results match.

The device according to claim 8, wherein the first acquiring unit comprises: a first receiving subunit, configured to receive filtering logic set by the user for the to-be-filtered field; a second receiving subunit, It is used to receive a filter value set by the user for the filtering logic.

The apparatus according to claim 8, wherein the second obtaining unit comprises: a decoding result set establishing unit, configured to establish a decoding result set of the protocol, where the unit in the decoding result set is the field The decoding result, the field to which the decoding result belongs is indicated by the field identifier;

The second selecting unit searches for a decoding result of the to-be-filtered field from the decoding result set according to the field identifier of the field to be filtered.