A big data distribution method for an industrial control security database auditing system

Abstract

The invention provides a big data distribution method for an industrial control security database auditing system, which comprises the following steps of: setting a network card which needs to capturedata, and acquiring a data packet which is sent into the network card in a mirror image manner; Analyzing the IP layer data of the data packet, obtaining a destination end IP and a source end IP, andabandoning a non-IP protocol data packet; Analyzing the TCP layer and the UDP layer of the data packet, obtaining a destination port number and a source port number, and discarding non-TCP and UDP protocol data packets; wherein a destination end IP in the network data packet, Source end IP, four pieces of data information of the destination port number and the source port number provide a basis for judging whether the data packet belongs to the same session; The data packet is distributed to which process or thread for processing by utilizing a data distribution algorithm, so that the requestdata of the client and the response data of the server are distributed to the same data processing process for processing, and data confusion caused by processing of the request data and the responsedata in different CPU processes is avoided.

Description

technical field [0001] The invention relates to the technical field of information processing, in particular to a big data distribution method used in an industrial control security database audit system. Background technique [0002] In the network environment of data mirroring, we often need to ensure that the network request data frames and response data frames belonging to the same session can be distributed to the same process or thread for processing, so as to ensure the uniformity and integrity of data requests and responses , under this requirement, the existing data distribution algorithm cannot meet this requirement. We propose this distribution algorithm, which uses the quaternion (destination IP, destination port number, source IP, source port number) of the TCP / IP network data frame to go through a series of calculations to ensure that the request data and response data can be distributed to the same A process and a thread to process. Contents of the inventio...

AI Technical Summary

Problems solved by technology

[0002] In the network environment of data mirroring, we often need to ensure that the network request data frames and response data frames belonging to the same session can be distributed to the same process or thread for processing, so as to ensure the uniformity and integrity of data requests and responses , under this requirement, the existing data distribution algorithm cannot meet this requirement

Images