CN101465809B - Method, equipment and system for managing network flux - Google Patents

Abstract

The invention discloses a network traffic management method, equipment and system, which belong to the field of network applications. The network traffic of the traffic management device is matched with the at least one keyword to obtain the matched keyword, the behavior information corresponding to the keyword is obtained, and the received network traffic is managed according to the behavior information. The device includes an analysis module, a matching module, an acquisition module and a management module. The system includes a network flow control center and a network flow management device in a serial access network link, and the network control center generates a management signal and sends it to the network flow management device. The network flow management method, equipment and system disclosed by the invention realize effective management of network flow.

Description

A network traffic management method, device and system

technical field

The invention relates to the field of network applications, in particular to a network flow management method, device and system.

Background technique

With the expansion of the scope of Internet applications and the rapid increase in the number of users, network applications are also developing rapidly on the basis of traditional E-mail, Web page access, and FTP file transmission, and the traffic of data transmission is also increasing, resulting in network congestion. . Existing flow control is generally implemented by using software methods such as flow control algorithms. A router or access device sets a threshold on each network link, and performs flow control when the flow exceeds the threshold. But this method has the problems of low speed and poor scalability.

In addition, due to the lack of solutions for effective management of user network behaviors, operators cannot expand services in a targeted manner, which limits the sustainable development of network applications to a certain extent. In addition, illegal information such as network viruses, network attacks, and spam seriously threaten the credible, safe and efficient operation of the network.

It can be seen that there is a contradiction between increasing demand for network applications and effective management in network applications, which greatly limits the development of network applications. We generally call the network signals aggregated by various services transmitted on network links as network traffic. Therefore, effective management of network traffic has become an urgent problem to be solved.

Contents of the invention

The network flow management method, equipment and system provided by the invention solve the problem of effectively managing network flow.

In one aspect, a network traffic management method is provided, including

Analyzing the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword;

matching the network traffic passing through the network traffic management device with the at least one keyword to obtain the matched keyword, acquiring behavior information corresponding to the matched keyword, and managing the network traffic according to the behavior information .

On the other hand, a network traffic management device is also provided, including

An analysis module, configured to analyze the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword;

A matching module, configured to match the network traffic passing through the device with at least one keyword obtained by the parsing module to obtain a matched keyword;

An acquisition module, configured to acquire behavior information corresponding to the keywords found by the matching module;

A management module, configured to manage the network traffic according to the behavior information acquired by the acquisition module.

In yet another aspect, a network traffic management system is also provided, the system includes a network traffic control center and a network traffic management device in a serial access network link, and the network control center generates traffic information containing keywords and behavior information A management signal is issued to the network traffic management device;

The network traffic management device includes,

An analysis module, configured to analyze the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword;

A matching module, configured to match the network traffic passing through the device with at least one keyword obtained by the parsing module to obtain a matched keyword;

An acquisition module, configured to acquire behavior information corresponding to the keywords found by the matching module;

A management module, configured to manage the network traffic according to the behavior information acquired by the acquisition module.

The beneficial effects of the network traffic management method, device and system provided by the present invention are: effective management of network traffic is realized, and further, the network traffic management device designed and developed by FPGA or ASIC greatly improves the processing capacity. In addition, Using TCAM to realize the table look-up function of floating keywords makes the management of network traffic more flexible and diversified. Moreover, through the management of user behavior, it provides a premise for operators to carry out targeted service promotion. In addition, The filtering management improves the security of the network. Thirdly, the network traffic management equipment is serially connected to the network link, enabling more flexible and effective management of the network traffic.

Description of drawings

Fig. 1 is a flow chart of a network traffic management method provided by an embodiment of the present invention;

FIG. 2 is a structural diagram of a network traffic management device provided by an embodiment of the present invention;

FIG. 3 is a circuit block diagram of a preferred network traffic management device provided by an embodiment of the present invention;

Fig. 4 is a structural diagram of a network traffic management system provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the implementation manner of the present invention will be further described in detail below in conjunction with the accompanying drawings.

Embodiment one

Referring to Fig. 1, a network traffic management method provided by an embodiment of the present invention includes

Step 101: the network traffic management device receives the management signal generated by the network traffic control center;

The network traffic control center generates management signals according to operational requirements and sends them to network traffic management devices. Each management signal contains keywords and behavior information, where the keywords can be ID numbers, which are used to uniquely identify a certain user or a certain type of business , or user behavior, etc., are determined by operational needs.

Preferably, the network traffic control center collects basic data information, including management results reported by network traffic management equipment, and basic data information in network traffic passing through the network traffic control center, and analyzes the collected basic data information, such as: Network server traffic statistics and analysis, network link traffic statistics and analysis, etc., analysis and prediction of business flow, analysis of business profit contribution rate, analysis of business resource utilization, analysis of business traffic distribution characteristics, analysis of customer groups within the business, Analysis of TOPN sites in the business, etc.; formulate macro strategies based on the above analysis results, such as customer group resource utilization analysis, customer loyalty analysis, etc., and generate management signals containing keywords and behavior information according to macro strategies, so that the network traffic control center can According to the current situation, it continuously adjusts the management signals issued by each network traffic management device, and performs real-time control and management of the entire network.

Step 102: The network traffic management device parses the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword;

Step 103: matching the network traffic passing through the network traffic management device with the above at least one keyword to obtain the matched keyword;

The keywords in the embodiment of the present invention include fixed keywords and/or floating keywords. Correspondingly, the network traffic passing through the network traffic management device is matched with the at least one keyword, and the step of obtaining the matched keyword is specifically as follows : matching the content at a fixed position of the network traffic passing through the network traffic management device with the at least one fixed keyword to obtain a matched fixed keyword; and/or matching the content at any position of the network traffic passing through the network traffic management device with the at least one fixed keyword The at least one floating keyword is matched to obtain the matched floating keyword.

In general, the location of user information in network traffic is relatively fixed, so fixed keywords can be used to search for user information, but the location of information such as business type and access content in network traffic is not fixed. Sometimes it will be more convenient to use floating keywords to search. Preferably, the analytical formula of the message header is realized by the fixed keyword strategy, the analytical formula of the message load area is realized by the floating keyword strategy, the user is identified by the five-tuple, and the service is identified by the fixed keyword strategy, User business is jointly identified by fixed keyword strategy and floating keyword strategy. Of course, in practical applications, it is not limited to use fixed keywords to search for user information, use floating keywords to search for information such as business and access content, and also use floating keywords to search for user information. The method for analyzing the header of the network traffic message provided in the embodiment of the present invention can realize fixed keyword and/or floating keyword analysis, and the number of floating keywords supported by the embodiment of the present invention is not limited to one, and can be multiple, for Realizing network traffic management provides great convenience.

Furthermore, the matching in the embodiment of the present invention can also be extended to support "multi-dimensional" keyword content-level service perception of fixed keywords, floating keywords, and range keywords, where the range keyword is related to a certain range of network traffic content to match.

Multi-level keyword query can be realized. For example, fixed keywords are used to match user information in network traffic first, and then floating keywords are used to match business information in network traffic.

In order to obtain a better effect, the embodiment of the present invention also includes a step of converting the format of the signal before matching the network traffic, that is, converting the received network traffic in the original physical frame format into a signal in the IP packet format.

Step 104: Obtain behavior information corresponding to the above keywords;

Step 105: Manage the network traffic passing through the network traffic management device according to the above behavior information.

Behavior information is specifically flow control behavior information. The management of network traffic based on the behavior information may be to trigger the flow control behavior based on the above flow control behavior information, and compare the threshold included in the behavior information with the flow value of the network flow. When the flow value exceeds When the threshold is reached, the flow control management is performed on the received network traffic. Among them, the flow control behavior can be uplink total flow control behavior, downlink total flow control behavior, uplink sub-protocol flow control behavior, downlink sub-laundry flow control behavior, single user uplink total flow control behavior, single user downlink total flow control behavior, etc. The method of flow control management can be carried out by directly discarding traffic packets, and the traffic packets can be service connection establishment messages (such as TCP, UDP link establishment messages, etc.), or service messages, etc., so that it can be selective The flow control of users or business is carried out, which solves the problem of affecting the normal business flow of users. In addition, traffic control can be based on users or services. For example, we can send management signals to network traffic management equipment through the network traffic control center to control the upper or lower limit of traffic of a certain type of business, or a certain type of traffic of a certain user. The upper or lower limit of service flow can even be controlled for the service of a certain group of users. That is to say, the granularity of control can be adjusted. It can be seen that the flow control management method provided by the embodiment of the present invention is more flexible.

Behavior information is specifically user business statistical behavior information and/or user group copy behavior information. Management of network traffic based on behavior information can also be management of user behavior, including user business behavior management and/or user access behavior management,

The user business behavior management is to trigger the business statistical behavior according to the business statistical behavior information, update the business statistics counter, and implement the user business behavior management on the network traffic; for example, the keywords parsed from the management signal include the fixed key that identifies user A keyword A and the floating keyword B that identifies the P2P service, then when user A accesses the P2P service, when the corresponding network traffic passes through the network traffic management device, the network traffic management device first matches the network traffic with at least one fixed keyword , get the matching fixed keyword A, identify user A, and then match the network traffic with at least one floating keyword, get the matching floating keyword B, and identify the P2P service. The service statistics counter is incremented by 1. In this way, the network traffic management device can know the user business behavior of user A. Through analysis, it can know the business and other information that user A is more interested in, and realize the management of user business behavior.

User access behavior management is to trigger user group copy behavior based on user group copy behavior information, copy user information to user group corresponding to access content information, and implement user access behavior management on network traffic. For example, the keywords parsed from the management signal include a fixed keyword A identifying user A and a floating keyword B identifying a financial website, then when user A visits a financial website, the corresponding network traffic passes through network traffic management device, the network traffic management device first matches the network traffic with at least one fixed keyword, obtains the matching fixed keyword A, identifies user A, and then matches the network traffic with at least one floating keyword to obtain the matching floating key The word B indicates that the user is visiting a financial website. In this way, the network traffic management device will copy the information of user A to the user group corresponding to the access to financial content information. In this way, the network traffic management device can obtain different user group information, such as User groups for accessing financial content, user groups for accessing sports content, etc., realize the management of user access behavior, so that operators can push corresponding service items to different user groups.

Further, the network traffic management method provided by the embodiment of the present invention also includes a step in which the network traffic control center pushes service information to the user according to the statistical results of the above-mentioned service statistics counter and/or different types of user groups, where the service information includes service items, advertising etc. For example, the result of the service statistics counter statistics shows that P2P services are currently the most used, then operators can customize service items for P2P services, and the network traffic control center pushes the service items customized by operators for P2P services to users; another example, User groups are divided into financial user groups, sports user groups, etc., then operators will customize financial service items, sports service items or advertisements according to different user groups, and the network traffic control center will push them to corresponding users according to user groups The corresponding service information provides more space for the continuous development of network business applications.

Behavior information can also specifically be network filtering behavior information, and the management of the received network traffic according to the behavior information can also be, triggering network filtering behavior according to the network filtering behavior information, filtering network traffic corresponding to keywords, and realizing receiving Incoming network traffic is managed through network filtering. For example, keywords can be set to keywords related to viruses, pornographic websites, etc. When the network traffic flows through the network traffic management device, it can screen and filter the website information that matches the keywords related to the above-mentioned viruses, pornographic websites, etc. Therefore, the security of the network is greatly improved.

The network traffic management method provided by the embodiments of the present invention is not limited to at least one of the three types of network traffic control management, user behavior management, and network traffic filtering management. Setting the combination of keywords and behavior information, and triggering behaviors in behavior information for corresponding management by querying and matching keywords in network traffic are included in the idea of the present invention.

There is at least one network traffic management device in the embodiment of the present invention, each network traffic management device manages the network traffic passing through the device according to the management signal sent by the network traffic control center to each network traffic management device, each network traffic The management device will report to the network traffic control center at fixed time intervals or other preset rules, and the network traffic control center will analyze the management results, such as network situation analysis, abnormal traffic analysis and value-added services, etc., according to the above The analysis results generate new management signals, so that the network traffic control center can continuously adjust the management signals sent to each network traffic management device according to the current situation, and carry out real-time control and management of the entire network.

In order to obtain a better effect, before the network traffic is output from the network traffic management device in the embodiment of the present invention, a step of performing signal shaping on the network traffic is also included.

Embodiment two

Referring to FIG. 2, a network traffic management device provided by an embodiment of the present invention includes:

An analysis module, configured to analyze the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword;

A matching module, configured to match the network traffic passing through the device with at least one keyword obtained by the parsing module to obtain a matched keyword;

An acquisition module, configured to acquire behavior information corresponding to keywords found by the matching module;

The management module is configured to manage the above-mentioned received network traffic according to the behavior information acquired by the acquisition module.

Among them, the matching module includes,

A fixed keyword matching unit, configured to match the content at a fixed location of the network traffic passing through the device with at least one fixed keyword obtained in the parsing module to obtain a matching fixed keyword; and/or match the floating keyword A unit, configured to match the content at any position of the network traffic passing through the device with the at least one floating keyword obtained in the parsing module to obtain the matched floating keyword.

The behavior information acquired by the acquisition module is specifically flow control behavior information, and the management module is specifically a flow control management module, which is specifically used to trigger a flow control behavior based on the flow control behavior information, and compare the information contained in the behavior information The threshold and the flow value of the network flow, when the flow value exceeds the threshold, process control management is performed on the network flow.

The management module is specifically a user behavior management module, including

The behavior information acquired by the acquisition module is specifically business statistical behavior information, and the user business behavior management unit is used to trigger the business statistical behavior according to the business statistical behavior information, update the business statistics counter, and implement user business behavior on the network traffic. management; and/or

The behavior information acquired by the acquisition module is specifically the user group copy behavior information, and the user access behavior management unit is used to trigger the user group copy behavior according to the user group copy behavior information, and copy the user information to the user group corresponding to the access content information , implementing user access behavior management on the network traffic.

The behavior information acquired by the acquisition module is specifically network filtering behavior information, and the management module is specifically a network filtering management module, which is specifically used to trigger network filtering behavior according to the network filtering behavior information, filter the network traffic, and realize all Network filtering management for the above network traffic.

Preferably, the matching module in the embodiment of the present invention can be realized by the triple content addressable memory TCAM, at least one behavior information can be stored in the static random access memory SRAM, and the analysis module, the acquisition module and the management module can be integrated in the field programmable gate array FPGA or application-specific large-scale integrated circuit ASIC medium implementation. Because the network traffic management equipment that the embodiment of the present invention provides adopts FPGA (or ASIC)+TCAM+SRAM hardware mode to realize, referring to Fig. 3, it is a preferred example of a network traffic management equipment, wherein keywords are set in the TCAM, Behavior information is stored in the SRAM, and the analysis module, acquisition module and management module are integrated in one FPGA, so it can support high processing capabilities, such as 10Gbps or higher processing capabilities.

Embodiment three,

Referring to Fig. 4, a network traffic management system provided by an embodiment of the present invention is characterized in that the system includes a network traffic control center and a network traffic management device in a serial access network link, and the network control center Generate a management signal and send it to the network traffic management device;

The network traffic management device includes,

An analysis module, configured to analyze the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword;

A matching module, configured to match the network traffic passing through the device with at least one keyword obtained by the parsing module to obtain a matched keyword;

An acquisition module, configured to acquire behavior information corresponding to the keyword found by the matching module;

A management module, configured to manage the received network traffic according to the behavior information acquired by the acquisition module.

Further, the system further includes a switching module connected in parallel with the network traffic management device, and the network traffic management device also includes a switching control module, which is used to control the switching module to be in a connected or disconnected state. Preferably, the switch module can be realized by using a switch device. When the network traffic management equipment monitors that there is a problem with the operating status of key chips and devices in the system, including link layer chips, TCAM table lookup devices, flow control queue scheduling FPGA, board-level processors, etc., the switching control module will switch to the switching module. Issue an instruction to set the switching module (such as an optical coupler switch) to the Unicom state, so that the network traffic passes directly through the switching module, that is, the serial connection mode of the network traffic passing through the network traffic management device is switched to the straight-through mode of the network traffic passing through the switching module , so as to avoid affecting the operation of network traffic.

Still further, the network traffic control center further includes a service information push module, configured to push service information to users according to the statistical result of the service statistics counter obtained by the network traffic management device and/or the user groups.

There is at least one network traffic management device in the embodiment of the present invention, each network traffic management device manages the network traffic passing through the device according to the management signal sent by the network traffic control center to each network traffic management device, each network traffic The management device will report to the network traffic control center at fixed time intervals or other preset rules, and the network traffic control center will analyze the management results, such as network situation analysis, abnormal traffic analysis and value-added services, etc., according to the above The analysis results generate new management signals, so that the network traffic control center can continuously adjust the management signals sent to each network traffic management device according to the current situation, and carry out real-time control and management of the entire network.

In the embodiment of the present invention, the network traffic management device is serially connected to the network link, so that the output network traffic is the signal after being managed by the network traffic management device, compared with the method of connecting the network traffic management device to the network link in parallel As a result, greater management efforts can be achieved.

The network traffic management system provided by the embodiment of the present invention adopts the idea of separating the network traffic control center and the network traffic management equipment, which is beneficial for independent upgrade and maintenance.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims (17)

1. A network traffic management method, characterized in that the method comprises: Analyzing the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword; wherein the management signal is generated according to operational requirements; matching the network traffic passing through the network traffic management device with the at least one keyword to obtain the matched keyword, acquiring behavior information corresponding to the matched keyword, and managing the network traffic according to the behavior information . 2. The network traffic management method according to claim 1, wherein the keywords include fixed keywords and/or floating keywords, Correspondingly, the step of matching the network traffic passing through the network traffic management device with the at least one keyword, and obtaining the matched keyword is specifically: matching the content of the fixed position of the network traffic passing through the network traffic management device with the at least one keyword Matching the fixed keywords to obtain the matched fixed keywords; and/or matching the content at any position of the network traffic passing through the network traffic management device with the at least one floating keyword to obtain the matched floating keywords. 3. The network traffic management method according to claim 1 or 2, wherein the behavior information is specifically traffic control behavior information, and the step of managing the network traffic according to the behavior information is specifically, according to the The flow control behavior information triggers the flow control behavior, compares the threshold included in the flow control behavior information with the flow value of the network flow, and performs flow control management on the network flow when the flow value exceeds the threshold. 4. The network traffic management method according to claim 1 or 2, wherein the behavior information is specifically user business statistics behavior information and/or user group copy behavior information, and the network traffic is analyzed according to the behavior information The step of managing is specifically: triggering user business statistical behavior according to the user business statistical behavior information, updating user business statistical counters, and implementing user business behavior management on the network traffic; and/or copying behavior information according to the user grouping Trigger the user group copy behavior, copy the user information to the user group corresponding to the access content, and implement user access behavior management on the network traffic. 5. The network traffic management method according to claim 4, further comprising the step of pushing service information to users according to the statistics result of the service statistics counter and/or the user groups. 6. The network traffic management method according to claim 1 or 2, wherein the behavior information is specifically network filtering behavior information, and the step of managing the network traffic according to the behavior information is specifically, according to the The network filtering behavior information triggers the network filtering behavior, filters the network traffic, and implements network filtering management on the network traffic. 7. A network traffic management device, characterized in that the device comprises: An analysis module, configured to analyze the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword; the management signal is generated according to operational requirements; A matching module, configured to match the network traffic passing through the device with at least one keyword obtained by the parsing module to obtain a matched keyword; An acquisition module, configured to acquire behavior information corresponding to the keyword found by the matching module; A management module, configured to manage the network traffic according to the behavior information acquired by the acquisition module. 8. The network traffic management device according to claim 7, wherein the matching module comprises A fixed keyword matching unit, configured to match the content at a fixed location of the network traffic passing through the device with at least one fixed keyword obtained in the parsing module to obtain a matched fixed keyword; and/or The floating keyword matching unit is configured to match the content at any position of the network traffic passing through the device with at least one floating keyword obtained in the parsing module to obtain a matching floating keyword. 9. The network traffic management device according to claim 7 or 8, wherein the behavior information acquired by the acquisition module is specifically traffic control behavior information, and the management module is specifically a traffic control management module, which is specifically used according to The flow control behavior information triggers the flow control behavior, compares the threshold included in the flow control behavior information with the flow value of the network flow, and performs process control management on the network flow when the flow value exceeds the threshold . 10. The network traffic management device according to claim 7 or 8, wherein the management module is specifically a user behavior management module; The behavior information acquired by the acquisition module is specifically business statistical behavior information, and the user behavior management module includes: a user business behavior management unit, the user business behavior management unit is used to trigger business statistical behavior according to the business statistical behavior information, updating the service statistics counter to implement user service behavior management on the network traffic; or The behavior information acquired by the acquisition module is specifically user group copy behavior information, and the user behavior management module includes: a user access behavior management unit, and the user access behavior management unit is used to trigger user grouping based on the user group copy behavior information The copy behavior is to copy the user information to the user group corresponding to the access content information, so as to implement user access behavior management on the network traffic. 11. The network traffic management device according to claim 7 or 8, wherein the management module is specifically a user behavior management module; The behavior information acquired by the acquisition module is specifically business statistical behavior information and user group copy behavior information, and the user behavior management module includes: a user business behavior management unit and a user access behavior management unit, and the user business behavior management unit is used for triggering business statistics behavior according to the business statistics behavior information, updating business statistics counters, implementing user business behavior management on the network traffic, and the user access behavior management unit is used to trigger user group replication based on the user group replication behavior information Behavior, the user information is copied to the user group corresponding to the access content information, so as to implement user access behavior management on the network traffic. 12. The network traffic management device according to claim 7 or 8, wherein the behavior information acquired by the acquisition module is specifically network filtering behavior information, and the management module is specifically a network filtering management module, which is specifically used to The network filtering behavior information triggers the network filtering behavior, filters the network traffic, and implements network filtering management on the network traffic. 13. The network traffic management device according to claim 7 or 8, wherein the matching module is specifically a triple content addressable memory TCAM, the at least one behavior information is stored in a static random access memory (SRAM), and the parsing module Module, acquisition module and management module are integrated in field programmable gate array FPGA or application-specific large-scale integrated circuit ASIC. 14. A network traffic management system, characterized in that the system includes a network traffic control center and a network traffic management device in a serial access network link, and the network traffic control center generates traffic information containing keywords and behavior information A management signal is issued to the network traffic management device; The network traffic management device includes, An analysis module, configured to analyze the received management signal to obtain at least one keyword and at least one behavior information respectively corresponding to the keyword; the management signal is generated according to operational requirements; A matching module, configured to match the network traffic passing through the device with at least one keyword obtained by the parsing module to obtain a matched keyword; An acquisition module, configured to acquire behavior information corresponding to the keywords found by the matching module; A management module, configured to manage the network traffic according to the behavior information acquired by the acquisition module. 15. The network traffic management system according to claim 14, characterized in that, the system further comprises a switching module connected in parallel with the network traffic management device, and the network traffic management device also includes a switching control module for controlling The switching module is in the connected or disconnected state. 16. The network traffic management system according to claim 15, wherein the switching module is specifically a switch. 17. The network traffic management system according to claim 14, wherein the network traffic control center further includes a service information push module, which is used to obtain statistical results of service statistics counters obtained by the network traffic management device and/or Or the user group corresponding to the content accessed by the user pushes the service information to the user.

Images