WO2017118430A1

WO2017118430A1 - Method and device for packet error detection

Info

Publication number: WO2017118430A1
Application number: PCT/CN2017/070507
Authority: WO
Inventors: 吕正勇; 刘佳; 骆文
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-01-06
Filing date: 2017-01-06
Publication date: 2017-07-13
Also published as: CN106953775A

Abstract

Disclosed are a method and device for packet error detection. The method comprises: decomposing stored incoming packets and outgoing packets respectively into corresponding data blocks, and distributing the same to two or more pre-established analysis nodes; the analysis nodes performing, on the data blocks distributed thereto, matching of the parts of the incoming packets and outgoing packets that should be unchanged, to determine error-free packets; reallocating, according to a preset policy, and excluding those packets which are determined to be error-free, the remaining incoming packets and outgoing packets, and continuing to perform matching of the parts of the incoming packets and outgoing packets that should be unchanged, until all unmatched packets are at the same analysis node, at which point it is determined that errors have occurred in the unmatched packets. The method disclosed in the present invention enables detection of packets in which errors have occurred, by storing, decomposing and distributing incoming packets and outgoing packets and then matching the parts that should be unchanged.

Description

Method and device for realizing message error detection

Technical field

The present disclosure relates to the field of data communications, for example, to a method and apparatus for implementing message error detection.

Background technique

Network devices of a wide variety and quantity in networks such as carrier networks, enterprise networks, and Internet networks, such as broadband remote access server (BRAS) devices, access/core router devices, and access/core switch devices , three-layer switch equipment and various optical network equipment. These network devices run IP network protocols and build a world based on IP network protocols by interconnecting them. When a packet is transmitted over a network device, part of the packet field should not be changed. In the case of packet transmission, a packet error may occur. Taking the enterprise network as an example, assume that there are area A, area B, and area A. The communication link with area C, the communication link between area A and area B, the packet field that should not change due to the IP link problem such as high packet loss rate of the router or switch, system problem, etc. in area A and area A change occurs during transmission between B, causing a message error and affecting normal communication. The above system problem may be caused by the failure of the system software or hardware, or the external environment affecting the system performance (such as electromagnetic interference) and other factors affecting the normal transmission of the message. If the message field that should not be changed is changed, for example, the IP address field is modified, the message will be delivered to the wrong destination address, and finally discarded as a bad packet, affecting the normal communication of the network.

When the network size is small, after an error packet is found, it can be judged by experienced technicians whether the network device may have problems. Restart the network device that may be faulty, reconnect the network, or replace the network device. And other methods to solve the problem of packet error. When the network size is increased to a certain extent, it is very difficult to determine whether the packet has an error. The accuracy of the judgment based on the error packet based on the experience of the network device is greatly reduced. One attempt, and each attempt may cause a complete network interruption, affecting the normal communication of the network. For large-scale Internet networks, it is very difficult to determine the error of a message.

Summary of the invention

In order to solve the above technical problem, the present disclosure provides a method and apparatus for implementing packet error detection, which can It is enough to determine whether an error has occurred in the message when the network size is increased.

The present disclosure provides a method for implementing packet error detection, including:

Acquiring and storing the inbound packet and the outgoing packet transmitted by the detected network;

After the stored inbound message and the outgoing message are respectively decomposed into corresponding data blocks, the decomposed data block is distributed to two or more pre-established analysis nodes;

Each analysis node matches the inbound packet and the outgoing packet in the inbound packet to the data packet that is distributed to itself, and determines the packet that is not in error;

After the undue error message determined by each analysis node is removed, the inbound and outbound packets remaining in addition to the packets that are not erroneous are re-allocated according to the preset policy, and the inbound and outbound packets are continued. The matching of the changed part should not occur until all the packets that do not match successfully are in the same analysis node, and it is determined that the packet with no matching success is incorrect.

The detected network is a network of one or more network devices.

Optionally, the obtaining the inbound packet and the outgoing packet sent by the detected network may include:

When the network device is an electrical interface device, the inbound message and the outgoing message are configured to be copied on the network device of the detected network;

When the network device is an optical port device, the optical splitting of the incoming packet and the outgoing packet is performed by the optical splitter of the detected network.

Optionally, storing the inbound packet and the outgoing packet that are transmitted by the detected network may include:

The obtained inbound message and the outgoing message are respectively stored in the form of a binary file.

Optionally, the stored inbound packet and the outgoing packet are respectively decomposed into corresponding data blocks, which may include:

Decomposing the stored inbound packet into a corresponding data block according to a preset fixed value or a preset interval value;

The stored outgoing message is decomposed into corresponding data blocks according to a preset fixed value or a preset interval value.

When the current data block size is smaller than the preset fixed value, and the next message data block size is greater than And the preset fixed value is used to perform the complementary digital processing on the current data block, so that the data block size after the completion of the supplemental digital processing is equal to the preset fixed value, and the data block that completes the complementary digital processing is used as the decomposition. Data block; or,

When the current data block size is greater than a minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the next report. The data block of the text is used as a decomposed data block.

Optionally, the re-assignment of the inbound and outbound packets, except for the packets that are not in error, according to the preset policy, may include:

After the undue error message determined by each analysis node is removed, one or more analysis nodes are sequentially selected, and the remaining inbound packets and outgoing packets of the selected analysis node are distributed to other analysis nodes.

Optionally, the method further includes: distinguishing each packet in the data block.

Optionally, the distinguishing between the packets in the data block may include:

The length of each packet is recorded in a preset position of the data block, and each packet in the data block is distinguished by the length of the recorded packet.

Optionally, the inbound packet and the outgoing packet are not changed, and may include:

Matching the content of the incoming message in the incoming message with the content of the outgoing message that should not change; or

Extracting, in the inbound message, a feature value of the content of the change portion and a feature value of the content of the outgoing message that should not change;

And extracting, in the extracted inbound message, the feature value of the content that should not be changed, and the extracted feature value of the content of the outgoing message that should not change.

Optionally, before determining that an unmatched packet has an error, the method further includes:

And filtering an outgoing packet sent by the detected network and an incoming packet sent to the detected network.

Optionally, when the packet of the packet transmitted by the detected network is a common packet, the method further includes: performing packet learning on the content of the differentiated field included in the incoming packet and the outgoing packet that should not be changed;

The packet learning result obtained by obtaining the content of the distinguishing field included in the incoming message and the outgoing message should not be changed in the incoming message and the outgoing message in the message learning result. The packets matching the matching fields are filtered, and the matching of the changed packets in the incoming packets and the outgoing packets is performed on the remaining packets.

Optionally, determining the message that is not in error may include:

Each analysis node performs hash mapping and reduction calculation on the inbound message and the outgoing message respectively included in the data block distributed to itself;

The inbound and outbound packets of the inbound and outbound packets that are used for the mapping and the grammar calculations are not matched in the inbound and outbound packets, and the inbound and outbound packets corresponding to the successfully matched key-value pairs are determined. The text is a message that has not gone wrong.

Optionally, culling the determined unerrored message may include:

Determining, according to the mapping calculated by the hash, the location of the inbound message and the outgoing message in the data block corresponding to the key pair that is successfully matched, and performing the culling process.

Optionally, the inbound packet and the outgoing packet that are sent by the detected network are sent to the inbound packet and the outgoing packet that are transmitted by the detected network in the preset time span. The method further includes:

The packets whose time attributes in the time interval TR are not matched in the current time span are detected, and are stored in the inbound and outgoing packets of the detected network stored in the next time span T. In the middle, the message is checked.

Optionally, the method further includes: distinguishing the inbound message and the outgoing message.

In another aspect, the present disclosure further provides a system for implementing packet error detection, including: a processing device and two or more analysis nodes; wherein

The processing device includes: a storage unit, a decomposition distribution unit, and a re-segment unit; wherein

Obtaining a storage unit, configured to acquire and store an inbound message and an outgoing message transmitted by the detected network;

The decomposition distribution unit is configured to respectively decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data blocks to the pre-established analysis nodes;

The re-segment unit is configured to re-allocate the remaining inbound packets and the outgoing packets in addition to the packets that are determined to be in error according to the preset policy.

Each analysis node includes a matching unit, a culling unit, and a determining unit; wherein

The matching unit is configured to perform an inbound message and an outgoing message in the data block distributed to itself. The part that should not be changed should be matched to determine the message that has not been erroneous;

a culling unit configured to reject the determined unerrored message;

The determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that are not successfully matched are incorrect.

The detected network is a network of one or more network devices.

In a further aspect, the disclosure further provides a processing device for implementing packet error detection, comprising: acquiring a storage unit, decomposing a distribution unit, and a re-segment unit;

Optionally, the obtaining storage unit can be configured as,

When the network device is an electrical interface device, the inbound packet and the outgoing packet are configured to be copied on the network device of the detected network, and the inbound packet transmitted by the detected detected network is configured. Outbound message storage;

When the network device is an optical interface device, the optical splitter of the detected network performs the optical splitting of the incoming packet and the outgoing packet, and the inbound packet transmitted by the detected network of the split optical replica is transmitted. And outgoing messages are stored.

Optionally, the obtaining storage unit can be configured as,

The inbound packet and the outgoing packet transmitted by the detected network are obtained, and the obtained incoming packet and the outgoing packet are respectively stored in the form of a binary file.

Optionally, the decomposition distribution unit can be configured to

Decomposing the stored inbound message into corresponding data blocks according to a preset fixed value or a preset interval value; and,

Decomposing the stored outgoing message into a corresponding data block according to a preset fixed value or a preset interval value;

The decomposed data blocks are distributed to the pre-established analysis nodes for message error detection.

Optionally, the decomposition distribution unit can be configured to

When the current data block size is smaller than the preset fixed value, and the next message data block size is greater than the preset fixed value, the current data block is subjected to complementary digital processing, so that the data after the complementary digital processing is completed The block size is equal to the preset fixed value, and the data block that completes the digital processing is used as the decomposed data block; or

When the current data block size is greater than a minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the next report. The data block of the text is used as a decomposed data block;

Optionally, the processing device further includes a distinguishing unit configured to distinguish each of the packets in the data block.

Optionally, the distinguishing unit can be configured to

Optionally, the re-segment unit may be configured to: after rejecting the error-free message determined by each analysis node, select one or more analysis nodes one by one, and select the remaining inbound message and the outgoing direction of the selected analysis node. Messages are distributed to other analysis nodes.

Optionally, the inbound packet and the outgoing packet sent by the detected network are inbound packets and outgoing packets transmitted by the detected network within a preset time span, and the processing device further includes a boundary processing unit configured to The packets whose time attributes in the time interval TR are not matched in the current time span are detected, and are stored in the inbound and outgoing packets of the detected network stored in the next time span T. In the middle, the message is checked.

Optionally, the processing device further includes an inbound and outbound distinguishing unit configured to distinguish the inbound message from the outgoing message.

In an aspect, the disclosure further provides an analysis node that implements packet error detection, including a matching unit, a culling unit, and a determining unit;

The matching unit is configured to perform inbound and outbound messages on the received data block. The change part is matched to determine the message that has not been erroneous;

a culling unit configured to reject the determined unerrored message;

The determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that do not match successfully are incorrect.

Optionally, the matching unit may be configured to, for the inbound message and the outgoing message in the data block distributed to itself,

Optionally, the analyzing node further includes a filtering unit, configured to filter an outgoing message actively sent by the detected network and an incoming report sent to the detected network before determining that a packet that is not successfully matched has an error. Text.

Optionally, the analysis node further includes a message learning unit and a learning filtering unit.

The message learning unit is configured to: when the common message of the packet transmitted by the detected network is used, perform packet learning on the content of the distinguishing field included in the incoming message and the outgoing message;

The learning filtering unit is configured to obtain the packet learning result of the distinguishing field content included in the incoming message and the outgoing message, and should not be included in the incoming message and the outgoing message in the message learning result. The packet that matches the matching field included in the changed part is filtered, and the remaining packets are sent to the matching unit to perform matching in the incoming packet and the outgoing packet.

Optionally, the matching unit can be configured to

Performing hash mapping and reduction calculation on the incoming message and the outgoing message included in the received data block;

Optionally, the culling unit may be configured to determine the matching according to the hash calculated mapping The position of the corresponding inbound message and the outgoing message in the data block of the successful key value pair is subjected to the culling process.

The present disclosure also provides a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the above method.

The present disclosure also provides an electronic device, including:

At least one processor;

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the method described above.

Compared with the related art, the technical solution of the present disclosure includes: separately decomposing the stored inbound message and the outgoing message into corresponding data blocks, and distributing the two to two or more analysis nodes that are pre-established; The data block that is distributed to itself is matched with the non-changing part of the incoming message and the outgoing message, and the error-free message is determined; the remaining inbound direction except the message that determines the error is re-allocated according to the preset policy. Packets and outgoing packets, and the matching between the incoming packets and the outgoing packets should not be changed until all the packets that are not successfully matched are in the same analysis node. . By storing, decomposing and distributing the inbound message and the outgoing message, the disclosed method performs matching of the portion that should not be changed, thereby realizing the detection of the error message.

BRIEF abstract

The drawings described herein are intended to provide an understanding of the present disclosure, and are intended to be a part of this disclosure. In the drawing:

1 is a flowchart of a method for implementing packet error detection according to the present disclosure;

2 is a structural diagram of a system for implementing packet error detection according to the present disclosure;

3 is a structural block diagram of a processing apparatus for implementing packet error detection according to the present disclosure;

4 is a structural block diagram of an analysis node for implementing packet error detection according to the present disclosure;

Figure 5 is a flowchart of a method of the first embodiment of the present disclosure;

Figure 6 is a flow chart of a method according to a second embodiment of the present disclosure;

Figure 7 is a flowchart of a method of a third embodiment of the present disclosure;

Figure 8 is a flow chart of a method according to a fourth embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.

detailed description

In order to make the technical solutions and advantages of the present disclosure more apparent, the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. It should be noted that the embodiments in the present disclosure and the features in the embodiments may be arbitrarily combined with each other without conflict.

FIG. 1 is a flowchart of a method for implementing packet error detection according to the present disclosure. As shown in FIG. 1, the method includes:

Step 100: Acquire and store an inbound packet and an outgoing packet transmitted by the detected network. Here, the detected network is a network composed of one or more network devices.

In this step, the inbound and outbound packets transmitted by the detected network may be obtained, and may include:

When the network device is an electrical interface device, the inbound and outbound packets and the outgoing packets are configured on the network device of the detected network.

When the network device is an optical interface device, the optical splitting of the incoming packet and the outgoing packet is performed by the optical splitter of the detected network.

Storing the inbound and outbound packets transmitted by the detected network may include:

The obtained inbound message and outgoing message are stored in the form of a binary file.

Step 101: Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;

In this step, the stored inbound packet and the outgoing packet are respectively decomposed into corresponding data blocks, which may include:

Decomposing the stored inbound and outbound packets into corresponding data blocks, respectively, may include:

When the current data block size is smaller than the preset fixed value, and the next message data block size is greater than the preset fixed value, the current data block is subjected to complementary digital processing, so that the data block size after the completion of the complementary digital processing is equal to the pre- A fixed value is set, and the data block that completes the digital processing is used as the decomposed data block; or

When the current data block size is greater than the minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the data block of the next message. As a decomposed data block.

It should be noted that the data block of the incoming message and the data block of the outgoing message are separately decomposed, and the next message refers to the corresponding incoming message or outgoing message, that is, the data block of the incoming message. The next message must be an incoming message, and the next block of the outgoing message must be an outgoing message.

Step 102: Each analysis node performs matching on the inbound packet and the outgoing packet in the data packet distributed to itself, and determines the packet that is not in error;

In this step, the incoming packet and the outgoing packet are not changed, and may include:

Matching the content of the inbound message that should not change with the content of the outgoing message that should not change; or,

Extracting feature values of content that should not change in the incoming message and feature values of content that should not change in the outgoing message;

The feature value of the content of the extracted inbound message that should not be changed is matched with the feature value of the content of the extracted outgoing message that should not change.

It should be noted that the matching here means that the content or the feature value is the same.

Identify the packets that have not gone wrong, which can include:

Step 103: After removing the error-free packets determined by each analysis node, reallocating according to the preset policy In addition to determining the inbound and outbound messages remaining in the error-free message, and continuing the match between the incoming message and the outgoing message, the matching part should not be changed until all the unmatched messages are in the same analysis. When a node is determined, it is determined that an unmatched packet has an error.

In this step, the re-assignment of the inbound and outbound packets, except for the packets that are determined to be in error, according to the preset policy, may include:

After each of the analysis nodes culls the determined unerrored message, one or more analysis nodes are sequentially selected, and the remaining inbound packets and outgoing messages of the selected analysis node are distributed to other analysis nodes.

It should be noted that, one or more analysis nodes may be selected one by one, and one analysis node may be selected, and the inbound and outbound messages remaining in the analysis node except the unidentified message are equally divided into other analysis nodes; You can also select two, three, half analysis nodes, and even more analysis nodes. The selected analysis nodes are divided into other analysis nodes except for the inbound packets and outgoing packets.

Excluding the determined unerrored messages may include:

The location of the corresponding incoming message and the outgoing message in the data block is determined according to the hash-calculated mapping, and the culling process is performed.

It should be noted that, when the mapping calculation is performed, the inbound packet and the outgoing packet are extracted from the data block and mapped into the hash list. Since the mapping calculation is required, the incoming packet and the outgoing packet are in the data block. The offset in is the default parameter.

The disclosed method also includes distinguishing between pieces of messages in the data block.

Here, the distinguishing between the packets in the data block may include: distinguishing each incoming message in the data block of the incoming message; and sending out the outgoing message in the data block of the outgoing message. Make a distinction.

Differentiating each packet in a data block may include:

Before determining that an unmatched message has an error, the disclosed method further includes:

Filtering outgoing packets sent by the detected network and incoming packets sent to the detected network.

It should be noted that before the packet is successfully matched, it may be before the matching occurs, or after the matching, the time may be set according to the network configuration and performance.

When the common message of the packet transmitted by the network is detected, the method of the disclosure further includes: performing packet learning on the content of the distinguishing field included in the incoming packet and the outgoing packet that should not be changed;

By obtaining the message learning result of the content of the distinguishing field included in the incoming message and the outgoing message, the difference between the incoming message and the outgoing message in the incoming message should not be changed. The matched packets are filtered, and the matching packets in the incoming packets and outgoing packets should not be matched in the outgoing packets.

It should be noted that the incoming field and the outgoing message should not change. The distinguished field included in the outgoing packet matches the packet indicating that the partial packet is an error.

The method for storing the inbound packet and the outgoing packet transmitted by the detected network is the inbound packet and the outgoing packet transmitted by the detected network in the preset time span. The method further includes:

The packets whose time attributes in the time interval (TR) are not matched in the current time span are detected, and are stored in the inbound packet and the outgoing direction of the detected network stored in the next time span (T). In the message, the message is checked for errors. The T is mainly calculated according to the size of the decomposed data block divided by the flow rate. The data block size is mainly set according to the system performance, and the flow rate is set according to the system capacity; TR is mainly set according to the network delay condition, and the TR value is set. Generally no more than 2 minutes.

It should be noted that the method of the present disclosure may use a hash algorithm to perform matching between the inbound message and the outgoing message, and the length of the packet, the time attribute, and the offset of the message in the database during the matching process. The amount can be stored by keyword.

The method of the present disclosure also includes: distinguishing between an incoming message and an outgoing message.

By storing, decomposing and distributing the inbound message and the outgoing message, the disclosed method performs matching of the portion that should not be changed, thereby realizing the detection of the error message.

2 is a structural diagram of a system for implementing packet error detection according to the present disclosure. As shown in FIG. 2, the method includes: a processing device and two or more analysis nodes; wherein

The matching unit is configured to perform matching on the inbound packet and the outgoing packet in the data packet distributed to itself, and determine the packet that is not in error;

a culling unit configured to reject the determined unerrored message;

The detected network is a network of one or more network devices.

3 is a structural block diagram of a processing device for implementing packet error detection according to the present disclosure. As shown in FIG. 3, the method includes: acquiring a storage unit, decomposing a distribution unit, and a re-segment unit;

Obtaining a storage unit can be configured to

When the network device is an electrical interface device, the inbound and outbound packets transmitted by the detected network are configured to be stored in the network device of the network to be detected, and the inbound and outbound packets transmitted by the detected network are configured to be stored;

When the network device is an optical interface device, the optical splitter of the detected network performs the optical splitting of the incoming packet and the outgoing packet, and stores the incoming packet and the outgoing packet transmitted by the detected network.

Obtaining a storage unit can be configured to

Obtaining the inbound and outbound packets transmitted by the detected network, and storing the obtained inbound and outbound packets in the form of binary files.

The decomposition distribution unit can be configured to

When the current data block size is greater than the minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the data block of the next message. As a decomposed data block;

The re-segment unit may be configured to, after rejecting the unerrored message determined by each analysis node, successively select one or more analysis nodes, and distribute the remaining inbound and outbound messages of the selected analysis node to other analysis. node.

The disclosed processing apparatus further includes a distinguishing unit configured to distinguish between pieces of messages in the data block.

The distinguishing unit can be configured to

And storing the inbound packet and the outgoing packet transmitted by the detected network as the inbound packet and the outgoing packet transmitted by the detected network within the preset time span, the disclosed processing apparatus further includes a boundary processing unit configured to set the current time The packets whose time attributes are in the time boundary (TR) are detected in the packets that are not matched in the span, and are stored in the inbound and outgoing packets of the detected network that is stored in the next time span (T). , the message error detection.

The disclosed processing apparatus further includes an inbound and outbound distinguishing unit configured to distinguish between an incoming message and an outgoing message.

4 is a structural block diagram of an analysis node for implementing packet error detection according to the present disclosure. As shown in FIG. 4, the method includes a matching unit, a culling unit, and a determining unit.

The matching unit is configured to match the inbound packet of the received data block with the unchanged portion of the outgoing packet, and determine the packet that is not erroneous;

The matching unit may be configured to, for the inbound message and the outgoing message in the data block distributed to itself,

a culling unit configured to reject the determined unerrored message;

The present disclosure analysis node further includes a filtering unit configured to filter the outgoing message actively sent by the detected network and the incoming message sent to the detected network before the packet with the unmatched success is determined to be in error.

The disclosed analysis node further includes a message learning unit and a learning filtering unit.

The packet learning unit is configured to perform packet learning on the content of the distinguishing field included in the incoming packet and the outgoing packet in the incoming packet and the outgoing packet when the packet is detected by the detected network;

The learning filtering unit is configured to obtain the packet learning result of the distinguishing field content included in the incoming message and the outgoing message, and should not be included in the incoming message and the outgoing message in the message learning result. The packets matching the matching fields included in the change part are filtered, and the remaining packets are sent to the matching unit to perform matching between the incoming packets and the outgoing packets.

The matching unit can be configured to

The culling unit may be configured to determine, according to the hash calculated mapping, the location of the incoming message and the outgoing message in the data block corresponding to the successfully matched key value pair for culling processing.

The method of the present disclosure is described in detail below by way of examples, which are merely used to illustrate the disclosure and are not intended to limit the scope of the present disclosure.

Example 1

In this embodiment, when the packet is detected, the detected network may be a network composed of one or more network devices, and the network device may be a router or a switch. In this embodiment, the inbound packet and the outgoing packet transmitted by the detected network are obtained. The inbound packet and the outgoing packet are separately stored; the storage mode can be performed in the form of a file, and each incoming packet or outgoing packet is stored with corresponding packet content, time attribute, and packet. Flow direction information, etc.; after the stored message is decomposed into data blocks according to a preset decomposition strategy, the decomposed data block is sent to two or more analysis nodes for inbound and outgoing messages. The matching of the changed part determines whether the packet has an error by the matching result. Here, the decomposed data block needs to ensure the integrity of the incoming message or the outgoing message, that is, each incoming message and outgoing message should be complete. Message. FIG. 5 is a flowchart of a method according to a first embodiment of the present disclosure. As shown in FIG. 5, the method includes:

Step 500: Acquire and store the inbound packet and the outgoing packet transmitted by the detected network. In this embodiment, the packet flowing through the detected network is differentiated according to the inflow interface and the outbound interface, and then copied and stored in the form of a binary file. ;

In this embodiment, if the network device included in the detected network is an electrical interface device, the inbound and outbound packets and the outgoing packets may be configured on the network device; if the optical device is in the optical device, the inflow is on the optical splitter. The incoming packet and the outgoing outgoing packet are split-spectrum.

In this embodiment, when storing the inbound packet and the outgoing packet transmitted by the detected network, in addition to the content of the packet, the time attribute (ie, transmission time) of the packet, the flow direction information of the packet, the length of the packet, and the like may be stored. Check the error in the message.

Step 501: Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;

In this step, the distribution of data blocks can be performed according to load balancing technology. In addition, each packet in the data block is distinguished by the length of the recorded packet; the length of each packet is added in the preset position by, for example, recording the length of the packet in an int before recording a packet, and then adding Corresponding report In the case of matching, each message is distinguished according to the length of the recorded message, and the message is read based on the difference of the message.

In this embodiment, in order to ensure load balancing of each analysis node, this embodiment first needs to determine the size of each data block, and the data block size is generally determined by the performance of the analysis node, and the data block size is generally 2 to the power of N; currently, A general PC can satisfy the matching of the inbound packet data block and the outgoing packet data block with the data block size of 64M. This embodiment is decomposed into the stored inbound packet according to a preset fixed value or a preset interval value. The corresponding data block of the outgoing message, where the stored inbound message and the outgoing message are respectively decomposed into data blocks; this embodiment is still based on the matching of the data block whose data block size is 64M is satisfied by the PC. Assume that the preset fixed value is 64M. When the data block is decomposed, when the current data block size is less than 64M, the current data block is added to the size of the next message. If it is greater than 64M, the current data block is supplemented with digital processing. For example, the process of supplementing the number of digits of 0 is such that the data block that completes the zero-padding process reaches 64M as a decomposed data block; the next message is decomposed into the next data block. in. When the second method is used for data block decomposition, the preset interval value needs to be limited first. In this embodiment, the preset interval value is set to be a reasonable size from 63M to 65M, that is, the current data block is added to the size of the next message. When between 63M and 65M, the current data block is added to the data block of the next message as the decomposed data block.

It should be noted that the number of the analysis nodes is generally determined according to the traffic volume of the network port to be detected. When the average network traffic reaches 1 Gigabit, an analysis node needs to change the inbound and outbound packets. Partial match.

Step 502: Each analysis node performs matching on the inbound packet and the outgoing packet in the data block distributed to itself, and determines the packet that is not in error;

It should be noted that, when a packet is transmitted through a network device, the change does not change from the incoming network device to the outgoing network device, and the content does not change, that is, if the link does not occur on the network, the incoming packet is sent. The message field that should not change in the middle part of the message field and the message field that should not change in the outgoing message part are the same. When the matching content is consistent, the message is determined to have no error; for example, the network is assumed. If the message transmitted by the device should not change, the content of the message is [0x10, 0x20, 0x30]. If the device that detects the error of the packet obtains an incoming message, the content of the change should not be [0x10, 0x20, 0x30]; The device for error detection of the packet determines that the packet does not have an error according to the matching of the incoming packet and the outgoing packet. In this embodiment, if the packet should not change, the transmission occurs during the transmission. If the change is made, for example, the outgoing message obtained becomes [0x10, 0x20, 0x31], at this time, The device that detects the error of the packet cannot match the outgoing packet with the same change as the incoming packet, and determines that the packet has an error. Different types of packets may be different in the field of the message field that does not change when the network device transmits the information, and may be determined according to common knowledge of those skilled in the art. The changed message field refers to the message except that the change does not occur. The content of the text field, such as the TTL field of the IP packet, is legally modified by the network device during transmission (for example, a router for the network device at this time).

The matching between the incoming message and the outgoing message should not be changed. The content of the incoming message should not be changed, and the content of the outgoing message should not be changed. For example, Loading the unchanged part of the incoming message into the first list, loading the outgoing part of the outgoing message into the second list, and the order of loading into the list is generally sorted by time. The outbound packets in the second list are matched one by one to match the inbound packets in the first list until the inbound packets of the same content are matched.

The matching between the incoming message and the outgoing message should not be changed. The feature value can be extracted separately after the change should not be made in the incoming message and the change should not be made in the outgoing message. The feature value extracted in the packet should not match the feature value extracted in the outgoing packet, and the feature value extracted from the outgoing packet can be improved.

The method of extracting the eigenvalues can be implemented by calculating the hash value. The eigenvalues of the packets are mapped to the packets in the matching process. The hash calculation is used as an example. The eigenvalues of the packets and the packets are corresponding. The VALUE value and the KEY value corresponding to the message in the hash table may be separately stored, and the VALUE value is successfully matched according to the matching of the KEY value, thereby determining that the message is successfully matched. In this embodiment, the position offset of each packet can be calculated, and when the inbound packet and the outgoing packet are hashed, the position offset of each packet is calculated. According to the position offset, the message that determines that no error has occurred is deleted from the hash calculation.

When the method of calculating the hash value is used to perform the matching between the inbound packet and the outgoing packet, the method in this embodiment further includes:

Matching the message length, and/or source address, and/or destination address, and/or source port, and/or destination port as feature values;

It should be noted that only the increase of the packet length, and/or the source address, and/or the destination address, and/or the source port, and/or the destination port as the feature values are mainly matched by considering different messages for hashing. When calculating, the obtained hash value may be the same, the source port, and/or destination port is mainly for TCP/UDP. For the message, in addition, when the message is hashed, if the message is long, the message can be segmented and then hashed, and the hash value calculated by the segmentation is used as the feature value of the message. There should be no matching part of the incoming message and the outgoing message.

Step 503: After the undue error message determined by each analysis node is removed, one or more analysis nodes are selected one by one, and the remaining inbound packets and outgoing packets of the selected analysis node are distributed to other analysis nodes, and the continuation is performed. The match between the incoming packet and the outgoing packet should not be changed until all the packets that do not match successfully are in the same analysis node.

It should be noted that here is a logical loop process, which assumes that the inbound and outbound packets that are not successfully matched by the first analysis node are equally divided and then assigned to the second analysis node and the third analysis node, in the second analysis. After the node and the third analysis node are removed from the packet to determine that no error has occurred, the node or the outbound packet that has not been successfully matched is sent to another analysis according to the preset re-segmentation policy. The node continues to perform matching in the incoming packet and the outgoing packet, and the entire packet error detection process is completed when all the unmatched packets are finally in the same analysis node.

Example 2

FIG. 6 is a flowchart of a method according to a second embodiment of the present disclosure. As shown in FIG. 6, the method includes:

Step 600: Acquire and store an inbound packet and an outgoing packet transmitted by the detected network.

Step 601: Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;

Step 602: Each analysis node performs mapping and reduction calculation on the inbound message and the outgoing message included in the data block distributed to itself.

Step 603: Perform matching on the inbound and outbound messages of the inbound and outbound packets for completing the mapping and the protocol calculation, and remove the unchanged packets from the data block.

The culling of the message that determines that no error has occurred can be implemented by the method of position offset calculation in Embodiment 1, that is, the message in which no error occurs in the data block is determined by the position offset to perform the culling process.

In step 604, one or more analysis nodes are selected one by one, and the remaining inbound packets and outgoing packets of the selected analysis node are distributed to other analysis nodes, and the inbound and outbound messages are not changed. Partial matches until all unmatched messages are on the same analysis node.

Step 605: Filter the outgoing packets that are sent by the detected network and the incoming packets that are sent to the detected network, and obtain the packets that determine the error.

It should be noted that step 605 can be processed before the matching of the incoming message and the outgoing message should not be changed, thereby reducing data transmission and improving matching efficiency.

Example 3

In this embodiment, the inbound packet and the outgoing packet transmitted by the detected network are stored according to the time span T. The stored inbound packet and the outgoing packet may be stored in files stored in different time spans. A time-boundary TR is used to prevent incoming packets and outgoing packets from appearing in files stored in different time spans. The unmatched packets in the time boundary are added to the stored inbound traffic of the next time span according to the flow direction. Text and outgoing messages.

It is assumed that the present embodiment is the first time to perform the storage of the inbound packet and the outgoing packet transmitted by the detected network. FIG. 7 is a flowchart of the method according to the third embodiment of the present disclosure. As shown in FIG. 7, the method includes:

Step 700: Acquire and store an inbound packet and an outgoing packet transmitted by the detected network.

It should be noted that, in the case that the inbound packet and the outgoing packet are transmitted in the Nth time, the Nth packet is successfully added in the step S700;

Step 701: Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;

Step 702: Each analysis node performs mapping and reduction calculation on the inbound message and the outgoing message included in the data block distributed to itself.

Step 703: Perform matching on the inbound and outbound messages of the inbound and outbound packets that complete the mapping and the protocol calculation, and remove the unchanged packets from the data block.

Step 704: Select one or more analysis nodes one by one, and distribute the remaining inbound packets and outgoing packets of the selected analysis node to other analysis nodes, and continue to perform inbound and outbound messages. Partial matching, until all the packets that do not match successfully are in the same analysis node, it is determined that the packet with no matching success is incorrect.

It should be noted that the matching process here is the same as the matching process in step 703.

Step 705: Filter the outgoing packets that are sent by the detected network and the incoming packets that are sent to the detected network, and obtain the packets that determine the error.

Step 706: The packet whose time attribute in the time interval TR is not matched in the current time span is detected, and is stored in the inbound packet of the detected network stored in the next time span T. In the outgoing message, the message is checked for error.

Example 4

If the number of packets is too large, the matching efficiency is too low. You can improve the matching efficiency by learning common packets. The number of common packets is large, the content is fixed, and the packets are abnormal. Possibility is low.

In this embodiment, the packet learning is mainly for special distinguishing fields in the incoming and outgoing packets that should not change, including protocols and/or lengths and/or flags, for example, a large number of TCP SYNs. The parameters carried by the message are almost the same, such as the length, SYN flag, and so on. In this embodiment, after obtaining the inbound packet and the outgoing packet, the obtaining unit extracts the distinguishing field of the protocol and/or the length and/or the flag bit, and does not occur in the incoming packet and the outgoing packet. The distinguishing field extracted by the change part is matched after the packet learning; the matching is successful, and it is determined that the packet does not have an error. If the match fails, the packet is not a common packet. The method in the first embodiment is used to match the inbound packet and the outgoing packet in the inbound packet to determine whether the packet has an error.

It should be noted that whether the packet learning of the distinguishing field is performed may be analyzed by a person skilled in the art to analyze the frequency and quantity of the packet, and when the packet learning is determined by analysis, the presence or absence of the packet is monitored. When the part of the packet is detected, the packet learning is automatically triggered.

FIG. 8 is a flowchart of a method according to a fourth embodiment of the present disclosure. As shown in FIG. 8, the method includes:

Step 800: Acquire and store an inbound packet and an outgoing packet transmitted by the detected network.

Step 801: Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;

Step 802: Each analysis node performs mapping and reduction calculation on the inbound message and the outgoing message included in the data block distributed to itself.

Step 803: Each analysis node extracts a distinguishing field in the inbound and outbound messages that should not change, and performs packet learning on the differentiated field.

Step 804: Match the distinguishing field of the packet learning; if the matching is successful, go to step 8050; if the matching fails, go to step 8060;

Step 8050: Determine that the packet matching the successfully matched packet is a packet with no error, and remove the packet that determines that no error occurs in the data block.

In step 8060, a matching part of the incoming message and the outgoing message is not matched, and the packet that does not have an error is determined.

It should be noted that the inbound packet and the outgoing packet that are sent to the detected network and the detected network are sent by the detected network.

Step 8061: After each of the analysis nodes culls the determined unerrored message, one or more analysis nodes are sequentially selected, and the remaining inbound and outgoing packets of the selected analysis node are distributed to other analysis nodes, and the continuation is continued. The match between the incoming packet and the outgoing packet should not be changed until all the packets that do not match successfully are in the same analysis node.

The present disclosure also provides a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the method of any of the above embodiments.

The present disclosure also provides a schematic structural diagram of an electronic device. Referring to FIG. 9, the electronic device includes:

At least one processor 90, which is exemplified by a processor 90 in FIG. 9; and a memory 91, may further include a communication interface 92 and a bus 93. The processor 90, the communication interface 92, and the memory 91 can complete communication with each other through the bus 93. Communication interface 92 can be used for information transfer. Processor 90 can invoke logic instructions in memory 91 to perform the methods of the above-described embodiments.

In addition, the logic instructions in the memory 91 described above may be implemented in the form of a software functional unit and sold or used as a stand-alone product, and may be stored in a computer readable storage medium.

The memory 91 is a computer readable storage medium and can be used to store a software program, a computer executable program, and a program instruction/module corresponding to the method in the embodiment of the present invention. The processor 90 executes the function application and the data processing by executing the software program, the instruction and the module stored in the memory 91, that is, the method for implementing the message error detection in the above method embodiment.

The memory 91 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to usage of the terminal device, and the like. In addition, the memory 91 may include a high speed random access memory, and may also include Non-volatile memory.

The technical solution of the embodiment of the present invention may be embodied in the form of a software product stored in a storage medium, including one or more instructions for causing a computer device (which may be a personal computer, a server, or a network) The device or the like) performs all or part of the steps of the method described in the embodiments of the present invention. The foregoing storage medium may be a non-transitory storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like. A medium that can store program code, or a transitory storage medium.

The embodiments disclosed in the present disclosure are as described above, but are merely used to facilitate the understanding of the present disclosure, and are not intended to limit the present disclosure. Any modification and variation in the form and details of the embodiments may be made by those skilled in the art without departing from the scope of the embodiments of the present disclosure. The scope defined by the claims is subject to.

Industrial applicability

The method and apparatus for implementing message error detection of the present disclosure implements detection of an error message.

Claims

A method for implementing packet error detection, including:

Acquiring and storing the inbound packet and the outgoing packet transmitted by the detected network;

After the stored inbound message and the outgoing message are respectively decomposed into corresponding data blocks, the decomposed data block is distributed to two or more pre-established analysis nodes;

Each analysis node matches the inbound packet and the outgoing packet in the inbound packet to the data packet that is distributed to itself, and determines the packet that is not in error;

After the undue error message determined by each analysis node is removed, the inbound and outbound packets remaining in addition to the packets that are not erroneous are re-allocated according to the preset policy, and the inbound and outbound packets are continued. The matching of the changed part should not occur until all the packets that do not match successfully are in the same analysis node, and it is determined that the packet with no matching success is incorrect.

The detected network is a network of one or more network devices.
The method of claim 1, wherein the obtaining the inbound message and the outgoing message transmitted by the detected network comprises:

When the network device is an electrical interface device, the inbound message and the outgoing message are configured to be copied on the network device of the detected network;

When the network device is an optical port device, the optical splitting of the incoming packet and the outgoing packet is performed by the optical splitter of the detected network.
The method of claim 1, wherein the storing the inbound message and the outgoing message transmitted by the detected network comprises:

The obtained inbound message and the outgoing message are respectively stored in the form of a binary file.
The method of claim 1 wherein said stored inbound and outbound messages are to be stored Decomposed into corresponding data blocks, including:

Decomposing the stored inbound packet into a corresponding data block according to a preset fixed value or a preset interval value;

The stored outgoing message is decomposed into corresponding data blocks according to a preset fixed value or a preset interval value.
The method according to claim 4, wherein the respectively decomposing the stored inbound message and the outgoing message into corresponding data blocks comprises:

When the current data block size is smaller than the preset fixed value, and the next message data block size is greater than the preset fixed value, the current data block is subjected to complementary digital processing, so that the data after the complementary digital processing is completed The block size is equal to the preset fixed value, and the data block that completes the digital processing is used as the decomposed data block; or

When the current data block size is greater than a minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the next report. The data block of the text is used as a decomposed data block.
The method according to any one of claims 1 to 5, wherein the re-allocating the inbound and outbound messages remaining in addition to the message that is determined to be in error according to the preset policy includes:

After the undue error message determined by each analysis node is removed, one or more analysis nodes are sequentially selected, and the remaining inbound packets and outgoing packets of the selected analysis node are distributed to other analysis nodes.
The method according to any one of claims 1 to 5, further comprising: distinguishing each of the packets in the data block.
The method of claim 7, wherein distinguishing each of the packets in the data block comprises:

The length of each packet is recorded in a preset position of the data block, and each packet in the data block is distinguished by the length of the recorded packet.
The method according to any one of claims 1 to 5, wherein the incoming message and the outgoing message are There should be no changes to match, including:

Matching the content of the incoming message in the incoming message with the content of the outgoing message that should not change; or

Extracting, in the inbound message, a feature value of the content of the change portion and a feature value of the content of the outgoing message that should not change;

And extracting, in the extracted inbound message, the feature value of the content that should not be changed, and the extracted feature value of the content of the outgoing message that should not change.
The method according to any one of claims 1 to 5, wherein before the determining that the unmatched message has an error, the method further comprises:

And filtering an outgoing packet sent by the detected network and an incoming packet sent to the detected network.
The method according to any one of claims 1 to 5, wherein, when the packet of the packet transmitted by the detected network is a common packet, the method further comprises: not occurring in the incoming packet and the outgoing packet The content of the distinguishing field included in the change part is used for message learning;

By obtaining the message learning result of the content of the distinguishing field included in the incoming message and the outgoing message, the difference between the incoming message and the outgoing message in the incoming message should not be changed. The matched packets are filtered, and the matching packets in the incoming packets and outgoing packets should not be matched in the remaining packets.
The method according to any one of claims 1 to 5, wherein the determining the message that is not erroneous comprises:

Each analysis node performs hash mapping and reduction calculation on the inbound message and the outgoing message respectively included in the data block distributed to itself;

Inbound and outgoing packets for incoming and outgoing packets for mapping and protocol calculations The matching of the changed part should not occur, and the incoming message and the outgoing message corresponding to the successful key-value pair are determined to be unerrorized.
The method of claim 12 wherein said culling of the determined error-free message comprises:

Determining, according to the mapping calculated by the hash, the location of the inbound message and the outgoing message in the data block corresponding to the key pair that is successfully matched, and performing the culling process.
The method according to any one of claims 1 to 5, wherein the inbound packet and the outgoing packet transmitted by the detected network are inbound packets and outgoing packets transmitted by the detected network within a preset time span. The method further includes:

The packets whose time attributes in the time interval TR are not matched in the current time span are detected, and are stored in the inbound and outgoing packets of the detected network stored in the next time span T. In the middle, the message is checked.
The method according to any one of claims 1 to 5, wherein the method further comprises: distinguishing between the incoming message and the outgoing message.
A system for implementing packet error detection, comprising: a processing device and two or more analysis nodes; wherein

The processing device includes: a storage unit, a decomposition distribution unit, and a re-segment unit; wherein

Obtaining a storage unit, configured to acquire and store an inbound message and an outgoing message transmitted by the detected network;

The decomposition distribution unit is configured to respectively decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data blocks to the pre-established analysis nodes;

The re-segment unit is configured to re-allocate the remaining inbound packets and the outgoing packets in addition to the packets that are determined to be in error according to the preset policy.

Each analysis node includes a matching unit, a culling unit, and a determining unit; wherein

The matching unit is configured to perform matching on the inbound packet and the outgoing packet in the data packet distributed to itself, and determine the packet that is not in error;

a culling unit configured to reject the determined unerrored message;

The determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that are not successfully matched are incorrect.

The detected network is a network of one or more network devices.
A processing device for implementing packet error detection, comprising: acquiring a storage unit, a decomposition distribution unit, and a re-segment unit; wherein

Obtaining a storage unit, configured to acquire and store an inbound message and an outgoing message transmitted by the detected network;

The decomposition distribution unit is configured to respectively decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data blocks to the pre-established analysis nodes;

The re-segment unit is configured to re-allocate the remaining inbound and outbound packets except the packets that are determined to be in error according to the preset policy.
The processing device according to claim 17, wherein the acquisition storage unit is configured to

When the network device is an electrical interface device, the inbound packet and the outgoing packet are configured to be copied on the network device of the detected network, and the inbound packet transmitted by the detected detected network is configured. Outbound message storage;

When the network device is an optical interface device, the optical splitter of the detected network performs the optical splitting of the incoming packet and the outgoing packet, and the inbound packet transmitted by the detected network of the split optical replica is transmitted. And outgoing messages are stored.
The processing apparatus according to claim 17 or 18, wherein said acquisition storage unit is Configured as,

The inbound packet and the outgoing packet transmitted by the detected network are obtained, and the obtained incoming packet and the outgoing packet are respectively stored in the form of a binary file.
The processing device according to claim 17 or 18, wherein the decomposition distribution unit is configured to

Decomposing the stored inbound message into corresponding data blocks according to a preset fixed value or a preset interval value; and,

Decomposing the stored outgoing message into a corresponding data block according to a preset fixed value or a preset interval value;

The decomposed data blocks are distributed to the pre-established analysis nodes for message error detection.
The processing device according to claim 17 or 18, wherein the decomposition distribution unit is configured to

When the current data block size is smaller than the preset fixed value, and the next message data block size is greater than the preset fixed value, the current data block is subjected to complementary digital processing, so that the data after the complementary digital processing is completed The block size is equal to the preset fixed value, and the data block that completes the digital processing is used as the decomposed data block; or

When the current data block size is greater than a minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the next report. The data block of the text is used as a decomposed data block;

The decomposed data blocks are distributed to the pre-established analysis nodes for message error detection.
The processing apparatus according to claim 17 or 18, further comprising a distinguishing unit configured to distinguish each of the pieces of the data block.
The processing device according to claim 22, wherein the distinguishing unit is configured to

Recording the length of each packet at a preset position of the data block, and distinguishing the data by the length of the recorded packet Each message in the block.
The processing apparatus according to claim 17 or 18, wherein the re-dividing unit is configured to, after rejecting the error-free message determined by each analysis node, sequentially select one or more analysis nodes, and select the selected analysis node The remaining inbound and outbound messages are distributed to other analysis nodes.
The processing device according to claim 17 or 18, wherein the inbound packet and the outgoing packet transmitted by the detected network are inbound packets and outgoing packets transmitted by the detected network within a preset time span. The processing device further includes a boundary processing unit configured to detect a message whose time attribute in the unmatched message within the current time span is within the time boundary TR, and store the message stored in the next time span T Detects incoming packets and outgoing packets transmitted by the network, and performs packet error detection.
The processing apparatus according to claim 17 or 18, further comprising an inbound and outbound distinguishing unit configured to distinguish the inbound message from the outgoing message.
An analysis node for implementing packet error detection, comprising a matching unit, a culling unit and a determining unit; wherein

The matching unit is configured to match the inbound packet of the received data block with the unchanged portion of the outgoing packet, and determine the packet that is not erroneous;

a culling unit configured to reject the determined unerrored message;

The determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that do not match successfully are incorrect.
The analysis node according to claim 27, wherein said matching unit is configured to, for an inbound message and an outgoing message in a data block distributed to itself,

Matching the content of the incoming message in the incoming message with the content of the outgoing message that should not change; or

Extracting, in the inbound message, the feature value of the content of the change portion and the outgoing message The feature value of the content of the changed part should not occur;

And extracting, in the extracted inbound message, the feature value of the content that should not be changed, and the extracted feature value of the content of the outgoing message that should not change.
The analysis node according to claim 27 or 28, further comprising a filtering unit configured to filter an outgoing message actively sent by the detected network and send the detected message to the detected device before determining that the packet that is not successfully matched is incorrect. Inbound message of the network.
The analysis node according to claim 27 or 28, further comprising a message learning unit and a learning filtering unit,

The message learning unit is configured to: when the common message of the packet transmitted by the detected network is used, perform packet learning on the content of the distinguishing field included in the incoming message and the outgoing message;

The learning filtering unit is configured to obtain the packet learning result of the distinguishing field content included in the incoming message and the outgoing message, and should not be included in the incoming message and the outgoing message in the message learning result. The packet that matches the matching field included in the changed part is filtered, and the remaining packets are sent to the matching unit to perform matching in the incoming packet and the outgoing packet.
The analysis node according to claim 27, wherein said matching unit is configured to

Performing hash mapping and reduction calculation on the incoming message and the outgoing message included in the received data block;

The inbound and outbound packets of the inbound and outbound packets that are used for the mapping and the grammar calculations are not matched in the inbound and outbound packets, and the inbound and outbound packets corresponding to the successfully matched key-value pairs are determined. The text is a message that has not gone wrong.
The analysis node according to claim 31, wherein the culling unit is configured to determine, according to the mapping of the hash calculation, an inbound message and an outbound message corresponding to the successfully matched key value pair in the data block. The position in the middle for culling.
A non-transitory computer readable storage medium storing computer executable instructions The computer executable instructions are arranged to perform the method of any of claims 1-15.