Traffic processing method and protection system

A method, comprising:

• obtaining, by a protection device, a local statistical result, wherein the local statistical result indicates frequent key data in first traffic, the local statistical result comprises a first plurality of entries, each entry of the first plurality of entries comprises one piece of key data and a corresponding count value, and the first traffic is traffic that passes, in a first time segment, through a network location in which the protection device is applied;
• replacing, by the protection device, a respective piece of key data of each entry of the first plurality of entries in the local statistical result with masked data corresponding to the respective piece of key data, to obtain a local masking result;
• and
• sending, by the protection device, the local masking result to a security service server.

A method, comprising:

• receiving, by a security service server, N local masking results, wherein each of the N local masking results comes from a protection device, N is a natural number greater than or equal to 2, each local masking result comprises a first plurality of entries, and each entry of the first plurality of entries comprised in each local masking result comprises first masked data and a corresponding first count value;
• generating, by the security service server, a global masking result based on the N local masking results, wherein the global masking result comprises a second plurality of entries, each entry of the second plurality of entries comprised in the global masking result comprises second masked data, and the second masked data comprised in the global masking result is a subset of the first masked data comprised in the N local masking results;
• and
• sending, by the security service server, the global masking result to a protection device.

A system, comprising:

• a memory configured to store program instructions;
• at least one processor, wherein the program instructions, when executed by the at least one processor, enables the system to perform the following operations:
• obtaining a local statistical result, wherein the local statistical result indicates frequent key data in first traffic, the local statistical result comprises a first plurality of entries, each entry of the first plurality of entries comprises one piece of key data and a corresponding count value, and the first traffic is traffic that passes, in a first time segment, through a network location in which the system is applied;
• and
• replacing a respective piece of key data of each entry of the first plurality of entries in the local statistical result with masked data corresponding to the respective piece of key data, to obtain a local masking result;
• and
• a network interface configured to send the local masking result to a security service server.

A system, comprising:

• a memory configured to store program instructions;
• at least one processor, wherein the program instructions, when executed by the at least one processor, enables the system to perform the following operations:
• receiving N local masking results, wherein each of the N local masking results comes from a protection device, N is a natural number greater than or equal to 2, each local masking result comprises a first plurality of entries, and each entry of the first plurality of entries comprised in each local masking result comprises first masked data and a corresponding first count value;
• and
• generating a global masking result based on the N local masking results, wherein the global masking result comprises a second plurality of entries, each entry of the second plurality of entries comprised in the global masking result comprises second masked data, and the second masked data comprised in the global masking result is a subset of the first masked data comprised in the N local masking results;
• and
• a network interface configured to send the global masking result to at least one of the N protection devices.