CN103685601A - Application identification method and device - Google Patents

Abstract

The embodiment of the invention provides an application identification method and device. The method comprises the following steps: a service message is received, wherein the service message carries a network protocol IP address of an application server; according to the mapping relation between the IP address of the application server and a domain name, a target domain name corresponding to the IP address of the application server is determined; according to the preset mapping relation between an application and the domain name, the application corresponding to the target domain name is determined. According to the IP address of the application server carried in the service message, the mapping relation between the IP address of the application server and the domain name and the mapping relation between the application and the domain name, the application corresponding to the IP address of the application server is determined, and therefore the application identification method and device realize application identification for communication adopting a proprietary protocol or an encryption protocol.

Description

Application identification method and device

technical field

Embodiments of the present invention relate to communication technologies, and in particular to an application identification method and device.

Background technique

With the rise of the mobile Internet, more and more Internet companies and e-commerce platforms regard applications (Application, APP for short) as one of the main battlefields for sales. Facts have shown that the major e-commerce platforms are also very inclined to mobile APP. The reason is not only the daily increase in traffic, but more importantly, the convenience of mobile terminals has accumulated more users for enterprises, and some users have a good experience. The APP has greatly improved the loyalty and activity of users, which has played a key role in the revenue generation and future development of the enterprise.

In the prior art, after the Network Access Server (NAS for short) or Service Gateway (SGW for short) receives the service request message sent by the terminal or the service response message sent by the application server, Because certain types of applications usually use encryption protocols or proprietary protocols to process packets sent between terminals and APP servers, NAS devices or SGW devices cannot identify service request packets or service response packets, and thus cannot identify these packets. The application corresponding to the file cannot be controlled and billed.

Contents of the invention

Embodiments of the present invention provide an application identification method and device to solve the problem that some applications cannot be identified by NAS equipment or SGW equipment.

In a first aspect, an embodiment of the present invention provides an application identification method, including:

receiving a service message, the service message carrying the network protocol IP address of the application server;

According to the mapping relationship between the IP address of the application server and the domain name, determine the target domain name corresponding to the IP address of the application server;

The application corresponding to the target domain name is determined according to the preset mapping relationship between the application and the domain name.

With reference to the first aspect, in the first possible implementation manner of the first aspect, before receiving the service message, it further includes:

Receiving a DNS response message sent by a domain name service DNS server, wherein the DNS response message at least carries the domain name corresponding to the application and the IP address of the application server;

A mapping relationship between the IP address of the application server and the domain name is established.

With reference to the first possible implementation of the first aspect, in the second possible implementation of the first aspect, after receiving the DNS response message sent by the domain name service DNS server, further include:

judging whether the domain name carried in the DNS response message is included in the preset mapping relationship between the application and the domain name;

If yes, the mapping relationship between the IP address of the application server and the domain name is established and saved.

With reference to the second possible implementation of the first aspect, in a third possible implementation of the first aspect, the DNS response message also carries the IP address of the DNS server, and the determination of the DNS Whether the domain name carried in the response message is included before the preset mapping relationship between the application and the domain name also includes:

judging whether the DNS server is an authorized server according to the IP address of the DNS server;

If yes, it is judged whether the domain name carried in the DNS response message is included in the preset mapping relationship between the application and the domain name.

In combination with the first aspect, any one of the first to third possible implementations of the first aspect, in a fourth possible implementation of the first aspect, the service message is: the terminal The service request message sent or the service response message sent by the application server.

In combination with the first aspect, any one of the first to fourth possible implementations of the first aspect, in the fifth possible implementation of the first aspect, the search application based on the preset domain name and The domain name mapping relationship, after determining the application corresponding to the target domain name, also includes:

Charging the determined application corresponding to the target domain name, and/or controlling the determined application corresponding to the target domain name.

In a second aspect, an embodiment of the present invention provides an application identification device, including:

A receiving module, configured to receive a service message, where the service message carries the network protocol IP address of the application server;

A processing module, configured to determine the target domain name corresponding to the IP address of the application server according to the mapping relationship between the IP address of the application server and the domain name; and determine the application corresponding to the target domain name according to the preset mapping relationship between the application and the domain name .

With reference to the second aspect, in a first possible implementation manner of the second aspect, the receiving module is further configured to:

Before receiving the business message, receiving a DNS response message sent by a domain name service DNS server, the DNS response message at least carries the domain name corresponding to the application and the IP address of the application server;

The processing module is further configured to establish a mapping relationship between the IP address of the application server and the domain name.

With reference to the first possible implementation of the second aspect, in the second possible implementation of the second aspect, the processing module is further configured to:

judging whether the domain name carried in the DNS response message received by the receiving module is included in the preset mapping relationship between the application and the domain name; if so, establishing the mapping relationship between the application server IP address and the domain name, and save.

With reference to the second possible implementation of the second aspect, in a third possible implementation of the second aspect, the DNS response message further carries the IP address of the DNS server, and the processing module further uses At:

Before determining whether the domain name carried in the DNS response message is included in the preset mapping relationship between the application and the domain name, determine whether the DNS server is an authorized server according to the IP address of the DNS server; if , then determine whether the domain name carried in the DNS response message is included in the preset mapping relationship between the application and the domain name.

In combination with the second aspect, any one of the first to third possible implementations of the second aspect, in a fourth possible implementation of the second aspect, the service message is: the terminal The service request message sent or the service response message sent by the application server.

In combination with the second aspect, any one of the first to fourth possible implementations of the second aspect, in a fifth possible implementation of the second aspect, the processing module is further configured to:

After determining the application corresponding to the target domain name according to the preset mapping relationship between the domain name search application and the domain name, charging the determined application corresponding to the target domain name, and/or charging the determined application Control the application corresponding to the above target domain name.

In the embodiment of the present invention, the mapping relationship between the IP address of the application server and the domain name is queried according to the IP address of the application server carried in the service message, and the target domain name corresponding to the IP address of the application server is determined; then the application and domain name are queried according to the target domain name. The mapping relationship of the domain name determines the application corresponding to the target domain name, so as to realize the effective identification of the application.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

FIG. 1 is a flow chart of Embodiment 1 of the application identification method of the present invention;

FIG. 2 is a flow chart of Embodiment 2 of the application identification method of the present invention;

FIG. 3 is a schematic structural diagram of Embodiment 1 of the application identification device of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Embodiment one

Figure 1 is a flow chart of Embodiment 1 of the application identification method of the present invention, the method is executed by an application identification device, the device can be integrated in a NAS device or an SGW device, and the NAS device can be a fixed network broadband access server (Broadband Remote Access Server, BRAS for short) or mobile network equipment, for example, Gateway GPRS Support Node (Gateway GPRS Support Node, GGSN for short) and Packet Data Serving Node (PDSN for short), etc. Specifically, it can be realized by software, or hardware, or a combination of software and hardware. The method specifically includes:

S101. Receive a service message.

Wherein, the above-mentioned service message carries an Internet Protocol (Internet Protocol abbreviation: IP) address of the application server. The service message may be a service request message sent by the terminal or a service response message sent by the application server.

S102. Determine a target domain name corresponding to the IP address of the application server according to the mapping relationship between the IP address of the application server and the domain name.

Each application may correspond to multiple domain names. For example, the domain name corresponding to the Taobao application may be taobao.com or taobao.com.uk and so on. Domain name configuration usually follows certain rules. For example, domain name configuration needs to support wildcards and regular expressions. Optionally, the NAS device or the SGW device establishes the mapping relationship between the IP address of the application server and the domain name according to the domain name authentication table. Wherein, the domain name authentication table is pre-set by the operator according to operation requirements, for example, the domain name facebook.com or whatspp.com of a mainstream social application is set.

A domain name may correspond to multiple application server IP addresses, and the physical database and memory cache of the above-mentioned devices (such as NAS devices or SGW devices) can store a domain name and its corresponding multiple application server IP addresses at the same time.

Based on the scenario where one domain name corresponds to multiple application server IP addresses, the IP address of the application server can be retrieved from the above mapping relationship between the application server IP address and the domain name, so as to determine the target domain name corresponding to the application server IP address.

S103. Determine the application corresponding to the target domain name according to the preset mapping relationship between the application and the domain name.

Domain names are generally named according to the naming rules of domain names, that is, domain names can be divided into different levels, including top-level domain names and second-level domain names. Among them, the top-level domain name includes country code and international domain name, country code, for example, the domain name of China is . A level domain name refers to the domain name under the top-level domain name. Under the international top-level domain name, it refers to the online name of the domain name registrant, such as ibm, yahoo, microsoft, etc.; under the national top-level domain name, it is a symbol indicating the category of the registered enterprise. Such as com, edu, gov, net, etc.

Based on the above domain name naming rules, the operator presets the concerned applications and the domain names corresponding to these applications according to the operation requirements, establishes the mapping relationship between the applications and the domain names, and stores them in, for example, NAS devices or SGW devices.

According to the target domain name determined in step S102, the target domain name is searched in the mapping relationship between the application and the domain name, so as to determine the application corresponding to the target domain name.

In the embodiment of the present invention, the mapping relationship between the IP address of the application server and the domain name is queried according to the IP address of the application server carried in the service message, and the target domain name corresponding to the IP address of the application server is determined; and then the application and the domain name are queried according to the target domain name The mapping relationship determines the application corresponding to the target domain name, so as to realize the identification of the application using the private protocol or encryption protocol for communication.

Embodiment two

FIG. 2 is a flow chart of Embodiment 2 of the application identification method of the present invention. As shown in Figure 2, this embodiment installs the application terminal, NAS device or SGW device (the mapping relationship between the application and the domain name is preset in these devices and the DNS authentication table, that is, the IP address list of the authorized DNS server), the domain name The interaction process between the service (Domain Name Service, referred to as: DNS) server and the application server illustrates a specific implementation process of the application identification method provided by the present invention, wherein S201-S207 are the mapping relationship between the application server IP address and the domain name In the process of establishing (or storing), S208-S210 is the process of determining the application, and S211 is charging and/or controlling the application. Specifically include:

S201. The terminal sends a DNS request message to the NAS device or the SGW device.

Wherein, the terminal can send the DNS request message through the application client installed by itself. Specifically, when a user uses a terminal to access social services such as social services through an application client, the terminal first sends a DNS request message carrying the domain name corresponding to the application to the NAS device or SGW device, and the NAS device or SGW device forwards it to the DNS server; After the device or the SGW device receives the DNS request message, execute S202.

S202. The NAS device or the SGW device forwards the DNS request message to the DNS server.

Wherein, after receiving the DNS request message, the DNS server assembles the DNS response message according to the domain name carried in the DNS request message and the IP address of the application server corresponding to the domain name stored in itself, and sends it to the NAS device or SGW equipment.

S203. The NAS device or the SGW device receives the DNS response message sent by the DNS server.

Wherein, the DNS response message at least carries the domain name corresponding to the application and the IP address of the application server.

S204. The NAS device or the SGW device determines whether the DNS server is an authorized server according to the DNS server IP address in the DNS response message.

Specifically, the NAS device or the SGW device judges whether the source address of the DNS response message is the IP address of the authorized DNS server configured in the DNS authentication table, and if so, analyzes the DNS response message, and uses the domain name , execute S205; if not, directly execute S207.

Since the DNS servers corresponding to different sites or different applications may be different, the DNS authentication table can be used to implement the authentication of the DNS server, and the DNS server IP address in the DNS authentication table can be identified as authorized. , thereby improving the reliability of the domain name and the IP address of the application server obtained through resolution. Wherein, the DNS server IP address in the DNS authentication table can be maintained according to the requirements of the operator.

S205. The NAS device or the SGW device determines whether the domain name carried in the DNS response message is included in the above preset mapping relationship between the application and the domain name.

The NAS device or SGW device judges whether the domain name matches the domain name configured in the preset mapping relationship between the application and the domain name according to the domain name obtained by parsing the DNS response message. If it matches, execute S206; if not, execute step 207.

In this step, only the domain name that needs to manage the corresponding relationship between the domain name and the IP needs to continue to parse the DNS response message to obtain the application server IP address, thereby avoiding the system performance caused by storing the mapping relationship between all application server IP addresses and domain names The reduction, enhance the stability of system performance.

S206. The NAS device or the SGW device establishes and saves the mapping relationship between the IP address of the application server and the domain name.

According to the domain name obtained through the above analysis and the IP address of the application server, the mapping relationship between the IP address of the application server and the domain name is established, and the mapping relationship between the IP address of the application server and the domain name is stored in the physical database.

Optionally, in order to quickly obtain the mapping relationship between the IP address of the application server and the domain name, the mapping relationship between the IP address of the application server and the domain name may be cached in memory.

S207. The NAS device or the SGW device forwards the DNS response message to the terminal.

S208. The NAS device or the SGW device receives the service packet.

Specifically, those skilled in the art can understand this step as two specific scenarios, and only one of them can be satisfied:

S2081. The NAS device or the SGW device receives the service request message sent by the terminal.

S2082. The NAS device or the SGW device receives the service response message sent by the application server.

The service request packet or the service response packet carries the IP address of the application server.

After the NAS device or SGW device receives the service message initiated by the terminal, it checks the IP address and domain name of the application server through the IP address of the application server carried in the service message (the uplink is the destination IP address; the downlink is the source IP address) mapping relationship.

S209. Determine the target domain name corresponding to the IP address of the application server according to the mapping relationship between the IP address of the application server and the domain name.

S210. Determine the application corresponding to the target domain name according to the preset mapping relationship between the domain name retrieval application and the domain name.

Wherein, S209 and S210 are the same as S102 and S103 in the first embodiment, and will not be repeated here.

S211. Charge the application corresponding to the determined target domain name, and/or control the application corresponding to the determined target domain name.

It should be noted that the control can be blocking, allowing, redirecting, threshold control (Gating Control) or bandwidth control, etc. of the application's business packets; the billing can be the billing of the business traffic of the application, the billing of the duration , event charging, or superimposed charging of the above-mentioned types of charging.

In the embodiment of the present invention, the NAS device or SGW device parses the DNS response message to obtain the mapping relationship between the domain name corresponding to the application and the IP address of the application server, and then according to the destination IP address or source IP address in the service message, the above domain name and Apply the mapping relationship between the IP address of the application server and the mapping relationship between the preset application and the domain name, and determine the application corresponding to the destination IP address or source IP address, thereby improving the recognition rate and accuracy of applications that use private protocols or encryption protocols for communication in data services , and there is no need to dynamically track the change of the IP address of the application server, reducing the complexity of system maintenance, and then realizing billing and/or control of the application.

It should be noted that, in order to ensure the accuracy and timeliness of the mapping relationship between the IP address of the application server and the domain name, and to reduce the occupation of memory resources by long-term unused data, optionally, the cached data in the memory and the physical database Synchronize the data in the database, and regularly clean up aging data and garbage data that have not been used for a long time.

FIG. 3 is a schematic structural diagram of Embodiment 1 of the application identification device of the present invention. The apparatus of this embodiment can be integrated in a NAS device or an SGW device, and the NAS device can be a BRAS or a mobile network device, for example, a gateway GGSN and a PDSN. As shown in FIG. 3 , the device of this embodiment includes a receiving module 31 and a processing module 32 .

Wherein, the receiving module 31 is used to receive the service message, which carries the IP address of the application server; the processing module 32 is used to determine the target corresponding to the IP address of the application server according to the mapping relationship between the application server IP address and the domain name a domain name; and, according to a preset mapping relationship between an application and a domain name, determine the application corresponding to the above target domain name.

The application identification device of this embodiment can be used to execute the technical solution of the application identification method embodiment shown in FIG. 1 and FIG. 2 , and its implementation principle and technical effect are similar, and will not be repeated here.

On the above basis, the receiving module 32 can also be used to receive the DNS response message sent by the DNS server before receiving the service message, and the DNS response message at least carries the domain name corresponding to the application and the IP address of the application server; then The processing module 31 can also be used to establish the above-mentioned mapping relationship between the IP address of the application server and the domain name.

Optionally, the processing module 32 can also be used to determine whether the domain name carried in the above-mentioned DNS response message received by the receiving module 31 is included in the above-mentioned preset mapping relationship between the application and the domain name; if so, establish the application server IP address and Domain name mapping relationship, and save.

Further, the above-mentioned DNS response message may also carry the IP address of the DNS server, and the processing module 32 may also be used to determine whether the domain name carried in the above-mentioned DNS response message is included in the above-mentioned preset mapping relationship between the application and the domain name Before, judge whether the DNS server is an authorized server according to the IP address of the DNS server; if so, judge whether the domain name carried in the DNS response message is included in the preset mapping relationship between the application and the domain name.

Wherein, the above service message may be: a service request message sent by a terminal or a service response message sent by an application server.

The processing module 32 may also be configured to charge the determined application corresponding to the target domain name after determining the application corresponding to the target domain name according to the preset mapping relationship between the domain name search application and the domain name, and/or charge the determined application corresponding to the target domain name. The application corresponding to the determined target domain name is controlled.

In the embodiment of the present invention, the mapping relationship between the IP address of the application server and the domain name is queried according to the IP address of the application server carried in the service message, and the target domain name corresponding to the IP address of the application server is determined; and then the application and the domain name are queried according to the target domain name The mapping relationship determines the application corresponding to the target domain name, so as to realize the identification of the application using the private protocol or encryption protocol for communication.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by program instructions and related hardware. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above-mentioned method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (12)

1. an application and identification method, is characterized in that, comprising:

Receive service message, the procotol IP address of carrying application server in described service message;

According to the mapping relations of application server IP address and domain name, determine the target domain name corresponding to IP address of described application server;

According to default application and the mapping relations of domain name, determine application corresponding to described target domain name.

2. method according to claim 1, is characterized in that, before described reception service message, also comprises:

Receive the DNS response message that domain name service dns server sends, in described DNS response message, at least carry application corresponding domain name and application server IP address;

Set up the mapping relations of described application server IP address and domain name.

3. method according to claim 2, is characterized in that, after the DNS response message that described reception domain name service dns server sends, also comprises:

Judge whether the domain name of carrying in described DNS response message is included in the mapping relations of described default application and domain name;

If so, set up the mapping relations of described application server IP address and domain name, and preserve.

4. method according to claim 3, it is characterized in that, in described DNS response message, also carry the IP address of described dns server, described judge whether the domain name of carrying in described DNS response message is included in the mapping relations of described default application and domain name before, also comprise:

According to the IP address of described dns server, judge whether described dns server is authorization server;

If so, judge whether the domain name of carrying in described DNS response message is included in the mapping relations of described default application and domain name.

5. according to the method described in claim 1-4 any one, it is characterized in that, described service message is: the service response message that the service request message that described terminal sends or described application server send.

6. according to the method described in claim 1-5 any one, it is characterized in that the domain name retrieve application that described basis is default and the mapping relations of domain name, after determining application corresponding to described target domain name, also comprise:

To determined described target domain name, charging is carried out in corresponding application, and/or corresponding application is controlled to determined described target domain name.

7. an application identification device, is characterized in that, comprising:

Receiver module, for receiving service message, carries the procotol IP address of application server in described service message;

Processing module, for according to the mapping relations of application server IP address and domain name, determines the target domain name corresponding to IP address of described application server; And, according to default application and the mapping relations of domain name, determine application corresponding to described target domain name.

8. device according to claim 7, is characterized in that, described receiver module also for:

Before receiving described service message, receive the DNS response message that domain name service dns server sends, in described DNS response message, at least carry application corresponding domain name and application server IP address;

Described processing module is also for setting up the mapping relations of described application server IP address and domain name.

9. device according to claim 8, is characterized in that, described processing module also for:

Judge whether the domain name of carrying in the described DNS response message of described receiver module reception is included in the mapping relations of described default application and domain name; If so, set up the mapping relations of described application server IP address and domain name, and preserve.

10. device according to claim 9, is characterized in that, also carries the IP address of described dns server in described DNS response message, described processing module also for:

Before whether described domain name of carrying in judging described DNS response message is included in the mapping relations of described default application and domain name, according to the IP address of described dns server, judge whether described dns server is authorization server; If so, judge whether the domain name of carrying in described DNS response message is included in the mapping relations of described default application and domain name.

11. according to the device described in claim 7-10 any one, it is characterized in that, described service message is: the service response message that the service request message that described terminal sends or described application server send.

12. according to the device described in claim 7-11 any one, it is characterized in that, described processing module also for:

In the default domain name retrieve application of described basis and the mapping relations of domain name, after determining application corresponding to described target domain name, to determined described target domain name, charging is carried out in corresponding application, and/or corresponding application is controlled to determined described target domain name.

Images