WO2016107306A1 - Procédé d'abonnement à des messages, dispositif de nœud de traitement et bus de message - Google Patents

Procédé d'abonnement à des messages, dispositif de nœud de traitement et bus de message Download PDF

Info

Publication number
WO2016107306A1
WO2016107306A1 PCT/CN2015/094623 CN2015094623W WO2016107306A1 WO 2016107306 A1 WO2016107306 A1 WO 2016107306A1 CN 2015094623 W CN2015094623 W CN 2015094623W WO 2016107306 A1 WO2016107306 A1 WO 2016107306A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
event
processing node
message event
configuration information
Prior art date
Application number
PCT/CN2015/094623
Other languages
English (en)
Chinese (zh)
Inventor
朱禄
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2016107306A1 publication Critical patent/WO2016107306A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks

Definitions

  • the present invention relates to the field of data processing technologies, and in particular, to a message subscription method, a processing node device, and a message bus.
  • IDS Intrusion Detection Systems
  • IMS Intrusion Prevention System
  • SOC Security Operations Center
  • UDM Unified Threat Management
  • the present invention has been made in order to provide a message subscription method, a processing node device and a message bus that overcome the above problems or at least partially solve the above problems, and can realize dynamic expansion of a message bus, which is convenient for message events.
  • a processing node device is provided.
  • the processing node device is loaded on a message bus in a plug-in form, and the processing node device includes:
  • a first obtaining module configured to: when the event source issues a message event through the message bus, acquire a message event corresponding to the first configuration information in the message event according to the first configuration information;
  • a processing module configured to process the acquired message event according to the first configuration information.
  • a message bus comprising:
  • a loading module configured to load at least one first processing node in the form of a plug-in, and generate first configuration information of the first processing node
  • a search module configured to: when the event source issues a message event through the message bus, search for a message event corresponding to the first configuration information according to the first configuration information;
  • a sending module configured to send the searched message event to the first processing node, so that the first processing node processes the sent message event.
  • a message subscription method including:
  • the at least one first processing node that is loaded on the message bus acquires a message event corresponding to the first configuration information in the message event according to the first configuration information;
  • the first processing node processes the acquired message event according to the first configuration information
  • the first processing node is a node loaded on the message bus in a plug-in form.
  • a message subscription method including:
  • the message bus searches for a message event corresponding to the first configuration information according to the first configuration information, and sends the searched message event to the first processing node. So that the first processing node processes the transmitted message event.
  • a computer program comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform a message subscription according to the above method.
  • a computer readable medium storing the above computer program is provided.
  • the message subscription method, the processing node device and the message bus of the present invention acquire a message event in the message bus by dynamically loading at least one first processing node on the message bus, and process the acquired message event, and further It can dynamically expand the input/output message events in the message bus, facilitate post-maintenance of network security products with granularity of message events, and improve the efficiency of network security products.
  • FIG. 1 is a schematic flowchart of a message subscription method according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a message subscription method according to another embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a message subscription method according to another embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a message subscription method according to another embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a message subscription method according to another embodiment of the present invention.
  • FIG. 6 is a schematic flowchart diagram of a message subscription method according to another embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a processing node device according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a message bus according to an embodiment of the present invention.
  • Figure 9 is a schematic block diagram of a computing device for performing a message subscription method in accordance with the present invention.
  • Fig. 10 schematically shows a storage unit for holding or carrying program code implementing the message subscription method according to the present invention.
  • FIG. 1 is a schematic flowchart of a message subscription method according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a message subscription method according to another embodiment of the present invention. Referring to FIG. 1 and FIG. 2, the embodiment is shown in FIG.
  • the message subscription method is as follows.
  • the at least one first processing node that is loaded on the message bus acquires a message corresponding to the first configuration information in the message event according to the first configuration information. event.
  • the first processing node is a node dynamically loaded on the message bus in a plug-in form.
  • the first configuration information may be configuration information generated during a process of dynamically loading the first processing node by the message bus, and the first processing node acquires a message event in the message bus according to the configuration information.
  • the event source in this step can be understood as: a host event source in the server, a network event source in the Internet, and/or any access system that issues a message event through the message bus, a third party message Event source, etc.
  • the event source is merely an example in this embodiment, and any event that can publish a message event in the message bus can be understood as an event source of the message bus.
  • the first processing node processes the acquired message event according to the first configuration information.
  • the message bus can run in the memory of a server, similar to a broadcast stream, and can broadcast/publish any message event, but does not store the message event.
  • a plurality of first processing nodes can be dynamically loaded on the message bus. As shown in FIG. 2, the first processing node can subscribe to a message event broadcasted in the message bus according to the first configuration information.
  • the first processing node may discard message events in the message bus, delete message events, add message attributes, store message events, and the like. This embodiment does not limit the first processing node, and the first processing node can understand Insertion of plug-ins implemented in software implements processing of message events in the message bus in hardware.
  • the first processing node can be a subscription plugin, a message publishing plugin, or the like.
  • the first processing node issues a message event to the message bus, the first processing node may be considered to be an event source of the message bus.
  • the format of the message event in the message bus in this embodiment is a key-value format, that is, a key-value format.
  • the message subscription method in this embodiment obtains a message event in the message bus by dynamically loading at least one first processing node on the message bus, and processes the acquired message event, thereby implementing an input/output message in the message bus.
  • the event is dynamically expanded to facilitate post-maintenance of network security products with granularity of message events, improving the efficiency of network security products.
  • the message event in the message bus shown in FIG. 2 above may be a MAP type message event
  • the MAP is a signaling for transmitting a message between mobile entities
  • the MAP message may be a Transaction Capabilities Application Part (Transaction Capabilities Application Part, The protocol data of the TCAP), the Signaling Connection Control Part (SCCP), and the Media Transfer Protocol (MTP) protocol layer.
  • Transaction Capabilities Application Part Transaction Capabilities Application Part
  • SCCP Signaling Connection Control Part
  • MTP Media Transfer Protocol
  • the method further includes: the plurality of first processing nodes may also subscribe to each other for a message event, that is, the first processing node performs another first processing according to the first configuration information.
  • a message event corresponding to the first configuration information is obtained in a message event subscribed or published in the node.
  • the first processing node a2 may obtain a message event corresponding to the first configuration information from a message event subscribed in the first processing node a1 according to the first configuration information.
  • the first processing node a1 is a message event in the subscription message bus whose source IP is 198.102.151.11, and the subscribed message event is stored. At this time, the first processing node a2 may subscribe to the message event that meets the requirement from the first processing node a1. Since the first processing node a1 is to process the subscribed message event, the first processing node a2 can subscribe to all message events that the first processing node a1 has subscribed to.
  • the first processing node a2 can only subscribe to the subscribed message event in the first processing node a1 in real time. That is, the first processing node a2 cannot subscribe to the message event that the first processing node a1 and the first processing node a2 subscribed from the message bus before the subscription relationship is established.
  • the first processing node a1 and the first processing node a2 may form a tree structure, such as a binary tree structure. This embodiment is for illustrative purposes only and is not limited thereto.
  • FIG. 4 is a schematic flowchart diagram of a message subscription method according to another embodiment of the present invention
  • FIG. 5 is a schematic diagram of a message subscription method according to another embodiment of the present invention. Referring to FIG. 4 and FIG. Case message The method of reading is as follows.
  • the message bus dynamically loads the at least one first processing node, and generates first configuration information corresponding to the first processing node.
  • the first configuration information in this embodiment includes one or more of the following:
  • Subscribing to a message event conforming to a preset rule deleting a message event conforming to a preset rule, adding an attribute of a message event conforming to a preset rule, publishing a message event, discarding a message event conforming to a preset rule, and forwarding the message in the message bus
  • the message event of the preset rule, the real name system maps the message event that meets the preset rule, the associated event message that matches the preset rule, the message event that matches the preset rule, and the like.
  • the at least one first processing node acquires a message event corresponding to the first configuration information in the message event according to the first configuration information.
  • the first processing node processes the acquired message event according to the first configuration information.
  • the first processing node may modify the attribute of the obtained message event according to the first configuration information, and issue the message event after the attribute is modified; or the first processing node may discard the obtained message event according to the first configuration information; or The first processing node may store the acquired message event in the database according to the first configuration information; or the first processing node may perform traffic statistics analysis or security statistical analysis according to the acquired message event; or the first processing node is configured according to the obtained
  • the message event is subjected to association analysis (such as name mapping); or the first processing node forwards the acquired message event and the like.
  • association analysis such as name mapping
  • the first processing node is further configured to dynamically load the at least one second processing node, and generate second configuration information corresponding to the second processing node.
  • the second processing node acquires a message event corresponding to the second configuration information from a message event subscribed or issued by the first processing node according to the second configuration information, and processes the acquired message event.
  • the Mth processing node can also dynamically load the at least one M+1th processing node to generate the M+1 configuration information corresponding to the M+1th processing node.
  • the M+1 processing node acquires a message event corresponding to the M+1 configuration information from the message event subscribed or issued by the Mth processing node according to the M+1 configuration information, to process the acquired message event.
  • the above M value can be a positive integer.
  • the Mth processing node and the M+1th processing node may form a tree structure, such as a binary tree structure; or the Mth processing node and the M+1th processing node may form a chain structure, which is not performed in this embodiment.
  • a first processing node a2 and a second processing node b1, b2 constituting a binary tree structure.
  • the message bus needs to dynamically load at least one processing node so that the processing nodes can acquire message events in the message bus.
  • the processing node can be a plug-in for product admission, or a plug-in for capturing a source IP traffic, or a plug-in for intrusion check system analysis.
  • the plugins can be implemented in software and preloaded in a message bus of a server.
  • the message bus can publish message messages in a uniform format for subscription by multiple plugins loaded on the message bus.
  • the subscription of the plug-in on the message bus or the subscription between the plug-in and the plug-in is not associated with the server/host where the message bus is located, and is also unrelated to the network in which the server/host is located.
  • the attribute of any message event in the message bus may include information such as a source IP address, a destination IP address, a source port, and a destination port of the message event.
  • the message format of the message event in the above embodiment may be dynamically extended, and then a set of message-based subscription message-based message bus is established for the message format, and the subscription plug-in or the release plug-in on the message bus is dynamically loaded to the message bus. Up to reach the pluggable message bus mode.
  • the publishing plug-in publishes a message event through the message bus, and various subscription plug-ins dynamically loaded on the message bus process the message events sent by the publishing plug-in, for example, deleting, adding message attribute publishing, discarding, and the like.
  • a common network security system such as a log server, a security audit system, a traffic statistics system, etc.
  • a traffic statistics system can be constructed based on the above message bus.
  • FIG. 6 is a schematic flowchart diagram of a message subscription method according to another embodiment of the present invention. As shown in FIG. 6, the message subscription method in this embodiment is as follows.
  • the message bus dynamically loads at least one first processing node in the form of a plug-in, and generates first configuration information of the first processing node.
  • the first configuration information may include one or more of the following: subscribing to a message event that meets a preset rule in the message bus, deleting a message event that meets a preset rule, and adding a message that conforms to a preset rule.
  • the message bus searches for a message event corresponding to the first configuration information according to the first configuration information, and sends the searched message event to the first process. a node to cause the first processing node to process the transmitted message event.
  • the message event in this embodiment is a message event of a MAP message type
  • the format of the message event is a dynamically extended key-value format; the attributes of the message event may include: a source IP, a destination IP, a source port number, and a destination port number of the message event.
  • the event source in step 602 can be one or more of the following: a host event source in the server, a network event source in the Internet, and an event source in the first processing node, a third-party event source, through the message. Bus release message Any access system of the event, etc.
  • the method shown in FIG. 6 above may further include step 603 not shown in the following figure:
  • the message bus dynamically loads the at least one first processing node, and further sends the message event in the message bus subscribed by the first processing node to the at least one first processing node, so that the at least one first processing node The obtained message event is processed, thereby dynamically expanding the input/output message events in the message bus, facilitating post-maintenance of the network security product with the granularity of the message event, and improving the efficiency of the network security product.
  • the message bus ftms in any of the above embodiments can be understood as a stml of a host.
  • the message bus broadcast has a message event defining a uniform type.
  • the message bus can define a plurality of plug-ins, that is, processing nodes, and each plug-in can add a message event. , delete, or modify.
  • the message bus is similar to the physical bus, and message events broadcast on the message bus are not stored, and the processing node loaded on the message bus cannot know the content broadcasted in the message bus before loading.
  • a plurality of processing nodes are loaded.
  • the processing nodes may be loaded on the message bus in a plug-in form.
  • FIG. 7 is a schematic structural diagram of a processing node device according to an embodiment of the present invention. As shown in FIG. 7, the processing node device includes: a first obtaining module 71 and a processing module 72.
  • the first obtaining module 71 is configured to: when the event source issues a message event through the message bus, acquire a message event corresponding to the first configuration information in the message event according to the first configuration information;
  • the processing module 72 is configured to process the acquired message event according to the first configuration information.
  • the processing node device further includes a loading module not shown in the figure; the loading module is configured to load at least one second processing node, and generate second configuration information corresponding to the second processing node;
  • the second processing node acquires a message event corresponding to the second configuration information from a message event subscribed or issued by the processing node device according to the second configuration information, and processes the acquired message event.
  • processing node device in this embodiment is the first processing node.
  • the first configuration information includes one or more of the following:
  • Subscribing to a message event conforming to a preset rule deleting a message event conforming to a preset rule, adding an attribute of a message event conforming to a preset rule, publishing a message event, discarding a message event conforming to a preset rule, and forwarding the message in the message bus
  • the message event of the preset rule the real name system maps the message event that matches the preset rule, the associated event message that matches the preset rule, and the message event that matches the preset rule.
  • processing node device and the at least one second processing node form a binary tree structure
  • the processing node device and the at least one second processing node form a chain structure.
  • the processing node device may further include a second acquiring module, not shown, for acquiring the first configuration information from another processing node device according to the first configuration information. Obtaining a message event corresponding to the first configuration information in a subscribed or published message event.
  • a host event source in the server a network event source in the Internet, and an event source in the processing node device, any access system that issues a message event through the message bus.
  • the processing module in this embodiment may be specifically configured to: modify an attribute of the obtained message event, and issue a message event after modifying the attribute; or discard the obtained message event; or, the obtained message event Stored in the database; or, according to the obtained message event, perform traffic statistical analysis or security statistical analysis; or, perform association analysis according to the acquired message event; or forward the obtained message event.
  • the message event in any of the above embodiments may be a message event of a MAP message type
  • the format of the message event is a dynamically extended key-value key-value format
  • the attributes of the message event include: a source IP, a destination IP, a source port number, and a destination port number of the message event.
  • the processing node device in this embodiment processes the acquired message event, thereby dynamically expanding the input/output message events in the message bus, facilitating post-maintenance of the network security product with the message event granularity, and improving the efficiency of the network security product.
  • FIG. 8 is a schematic structural diagram of a message bus according to an embodiment of the present invention.
  • the message bus includes: a loading module 81, a generating module 82, a searching module 83, and a sending module 84;
  • the loading module 81 is configured to load at least one first processing node in the form of a plug-in;
  • the generating module 82 is configured to generate first configuration information of the first processing node according to the at least one first processing node loaded by the loading module;
  • the searching module 83 is configured to: when the event source issues a message event through the message bus, search for a message event corresponding to the first configuration information according to the first configuration information;
  • the sending module 84 is configured to send the searched message event to the first processing node, so that the first processing node processes the sent message event.
  • the message bus may further include a deletion module not shown in the figure, and the deletion module 84 is configured to delete the loaded at least one first processing node.
  • the message event is a message event of a MAP message type
  • the format of the message event is a dynamically extended key-value key-value format; and/or the attributes of the message event include: a source IP, a destination IP, a source port number, and a destination port number of the message event.
  • the event source may include one or more of the following:
  • the first configuration information includes one or more of the following: a message event that meets a preset rule is subscribed to in the message bus, a message event that matches a preset rule is deleted, and an attribute of a message event that meets a preset rule is added. , publishing a message event, discarding a message event that meets the preset rule, forwarding a message event that conforms to the preset rule, a message event that matches the preset rule by the real name system, a message event that is associated with the preset rule, and a message that matches the preset rule. event.
  • the message bus in this embodiment can dynamically expand the input/output message events, facilitate post-maintenance of network security products with message events as granularity, and improve the efficiency of network security products.
  • the foregoing processing node and the message bus can execute the flow of the foregoing method embodiment, and the foregoing processing node and the message bus are not described in detail in the present invention.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the processing node devices and message buses in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • Figure 9 illustrates a computing device that can implement a message subscription method.
  • the computing device conventionally includes a processor 910 and a computer program product or computer readable medium in the form of a memory 920.
  • the memory 920 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 920 has a memory space 930 for program code 931 for performing any of the method steps described above.
  • storage space 930 for program code may include various program code 931 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 920 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 931', ie, code that can be read by a processor, such as 910, that when executed by a computing device causes the computing device to perform each of the methods described above step.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

L'invention concerne un procédé d'abonnement à des messages, un dispositif de nœud de traitement et un bus de message. Le procédé d'abonnement à des messages comprend les étapes suivantes: lorsqu'une source d'événements publie un événement de message par l'intermédiaire d'un bus de message, au moins un premier nœud de traitement chargé sur le bus de message acquiert un événement de message correspondant à des premières informations de configuration à partir de l'événement de message en fonction des premières informations de configuration (101) ; et le premier nœud de traitement traite l'événement de message acquis en fonction des premières informations de configuration (102). Le premier nœud de traitement est un nœud chargé dynamiquement sur le bus de message sous la forme d'un module d'extension. Le procédé d'abonnement à des messages permet une extension dynamique d'un bus de message, qui facilite l'entretien ultérieur d'un produit de sécurité de réseau en considérant un événement de message comme une granularité.
PCT/CN2015/094623 2014-12-30 2015-11-13 Procédé d'abonnement à des messages, dispositif de nœud de traitement et bus de message WO2016107306A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410850950.3A CN104618142B (zh) 2014-12-30 2014-12-30 消息订阅方法、处理节点设备和总线设备
CN201410850950.3 2014-12-30

Publications (1)

Publication Number Publication Date
WO2016107306A1 true WO2016107306A1 (fr) 2016-07-07

Family

ID=53152433

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/094623 WO2016107306A1 (fr) 2014-12-30 2015-11-13 Procédé d'abonnement à des messages, dispositif de nœud de traitement et bus de message

Country Status (2)

Country Link
CN (1) CN104618142B (fr)
WO (1) WO2016107306A1 (fr)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104618142B (zh) * 2014-12-30 2017-07-07 北京奇安信科技有限公司 消息订阅方法、处理节点设备和总线设备
CN105119966B (zh) * 2015-07-15 2018-07-13 中国联合网络通信集团有限公司 一种公众号管理方法及装置
CN108737522B (zh) * 2018-05-09 2021-07-20 中兴通讯股份有限公司 一种消息的处理方法、装置和系统
CN109614164B (zh) * 2018-11-29 2021-09-28 深圳前海微众银行股份有限公司 实现插件可配置的方法、装置、设备及可读存储介质
CN109710432B (zh) * 2018-12-29 2020-11-20 苏州思必驰信息科技有限公司 用于应用程序开发中的多节点通信方法及系统
CN111324469A (zh) * 2020-01-20 2020-06-23 天津美腾科技股份有限公司 偏向应用的结构优化的分布式事件中心的方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020156601A1 (en) * 2001-04-19 2002-10-24 Tu Kevin Hsiaohsu Event monitoring and detection system
US20120089659A1 (en) * 2010-10-06 2012-04-12 Hbr Labs Inc. System and method for synchronizing collaborative form filling
US20130058262A1 (en) * 2011-04-20 2013-03-07 IBT- Internet Business Technologies Methods and systems for access to real-time full-duplex web communications platforms
CN104618142A (zh) * 2014-12-30 2015-05-13 北京奇虎科技有限公司 消息订阅方法、处理节点设备和总线设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101013949B (zh) * 2006-12-21 2011-05-18 建龙钢铁控股有限公司 一种消息广播通信方法
CN102938731B (zh) * 2012-11-22 2015-01-21 北京锐易特软件技术有限公司 一种基于代理缓存适配模型的交换集成装置及方法
CN103259701A (zh) * 2012-12-04 2013-08-21 中国科学院沈阳自动化研究所 面向复杂生产过程管理系统的消息总线实现方法
CN103927163B (zh) * 2014-03-06 2017-05-17 中国人民解放军装甲兵工程学院 插件框架处理装置及插件系统
CN103986710B (zh) * 2014-05-15 2017-12-15 华为技术有限公司 一种消息传输的方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020156601A1 (en) * 2001-04-19 2002-10-24 Tu Kevin Hsiaohsu Event monitoring and detection system
US20120089659A1 (en) * 2010-10-06 2012-04-12 Hbr Labs Inc. System and method for synchronizing collaborative form filling
US20130058262A1 (en) * 2011-04-20 2013-03-07 IBT- Internet Business Technologies Methods and systems for access to real-time full-duplex web communications platforms
CN104618142A (zh) * 2014-12-30 2015-05-13 北京奇虎科技有限公司 消息订阅方法、处理节点设备和总线设备

Also Published As

Publication number Publication date
CN104618142B (zh) 2017-07-07
CN104618142A (zh) 2015-05-13

Similar Documents

Publication Publication Date Title
WO2016107306A1 (fr) Procédé d'abonnement à des messages, dispositif de nœud de traitement et bus de message
US11880721B2 (en) Processing a query having calls to multiple data sources
US10320566B2 (en) Distributed logging of application events in a blockchain
US9501535B2 (en) System and method for correlating cloud-based big data in real-time for intelligent analytics and multiple end uses
US9798882B2 (en) Real-time model of states of monitored devices
US20140351227A1 (en) Distributed Feature Collection and Correlation Engine
JP2015079504A (ja) ネットワーク動作アーチファクトの順序によるマルウェアの分類
WO2018184535A1 (fr) Procédé et dispositif de traitement de service d'assurance, serveur et support de stockage
WO2017190580A1 (fr) Procédé et dispositif d'accès à une base de données
CN111752799A (zh) 一种业务链路跟踪方法、装置、设备及储存介质
CN111581397A (zh) 一种基于知识图谱的网络攻击溯源方法、装置及设备
WO2018161881A1 (fr) Procédé de traitement de données structurées, support de stockage de données et appareil informatique
US10659486B2 (en) Universal link to extract and classify log data
WO2015149628A1 (fr) Procédé, dispositif et système de traitement d'informations de cache dns
CN114208114B (zh) 每参与者的多视角安全上下文
CN113965378B (zh) 一种威胁邮件溯源分析方法、系统、设备及存储介质
CN110071898B (zh) 一种去中心检测节点合法性的方法
CN108628895B (zh) 一种地图数据的处理方法及装置
CN113779021B (zh) 数据处理方法、装置、计算机系统及可读存储介质
CN115328734A (zh) 跨服务的日志处理方法、装置及服务器
CN114363002A (zh) 一种网络攻击关系图的生成方法及装置
CN109741180B (zh) 区块链连续交易序号生成方法及装置、区块链网络节点
CN107547601B (zh) 用于消息发送的方法及路由设备、服务器、系统
CN113032820A (zh) 文件存储方法、访问方法、装置、设备及存储介质
WO2017028553A1 (fr) Procédé, dispositif et système de commande de sécurité de message

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15874987

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15874987

Country of ref document: EP

Kind code of ref document: A1