Method and apparatus for network forensics compression and storage

An apparatus for network forensic compression and storage, comprising the following modules stored as computer program instructions in non-transitory memory:

• a data extracting module in non-transitory memory for extracting high level network service operation data;
• a data segmenting module in non-transitory memory for segmenting the network service operation data extracted by the data extraction module to obtain a plurality of data blocks;
• a data mapping module in non-transitory memory for calculating a hash value for each data block obtained by the data segmenting module;
• a data storage module in non-transitory memory for determining whether the hash value already exists in the hash mapping table or not, if the hash value already exists in the hash mapping table, saving the mapping relationship between the data block and the corresponding hash value in the data mapping table;
• if the hash value does not exist in the hash mapping table, saving the mapping relationship between the hash value and the corresponding original data content in the hash mapping table and then saving the mapping relationship between the data block and the corresponding hash value in the data mapping table,
• wherein the network service operation data comprises network service operation detailed information reflecting user's network operation details,
• wherein the data segmenting module further comprises:
• a segmenting unit for segmenting the network service operation data according to a fixed length;
• an adjusting unit for moving the segmentation boundary of the network service operation data back and forth according to a predetermined byte range till a byte string with the highest occurrence probability, then replacing the segmentation boundary with starting position of the byte string.

A computer readable storage medium having stored thereon computer program instructions in non-transitory memory for performing the following steps on a computer:

• Step S1, extracting high level network service operation data;
• Step S2, segmenting the network service operation data to obtain a plurality of data blocks;
• Step S3, calculating a hash value for each data block;
• Step S4, determining whether the hash value already exists in the hash mapping table or not, if the hash value already exists in the hash mapping table, saving the mapping relationship between the data block and the corresponding hash value in the data mapping table;
• if the hash value does not exist in the hash mapping table, saving the mapping relationship between the hash value and the corresponding original data content in the hash mapping table and then saving the mapping relationship between the data block and the corresponding hash value in the data mapping table,
• wherein the network service operation data comprises network service operation detailed information reflecting user's network operation details, and
• wherein the step of segmenting the network service operation data in step S2 comprises the following steps:
• Step S21, segmenting the network service operation data according to a fixed length;
• Step S23, moving the segmentation boundary of the network service operation data back and forth according to a predetermined byte range till a byte string with the highest occurrence probability, then replacing the segmentation boundary with starting position of the byte string.