CN111200665B - User source tracing method and device and computer readable storage medium - Google Patents

Abstract

The present invention provides a user traceability method, a device and a computer-readable storage medium, which are used to solve the technical problem that the user traceability cannot be realized under the centralized CGN networking architecture in the prior art. The method includes: determining at least one NAT log associated with the DPI bill to be traced from a plurality of NAT logs according to a first association relationship between the DPI bill and the NAT log; wherein the first association includes: the DPI bill and the NAT log. The NAT log contains the same keyword; according to the second association relationship between the NAT log and the AAA log, at least one AAA log associated with the at least one NAT log is determined from multiple AAA logs; wherein, the second association relationship includes: NAT The log and the AAA log contain the same keywords; the user account in the at least one AAA log is determined, and the user account is determined as the traceability result of the DPI bill to be traced.

Description

A kind of user traceability method, device and computer readable storage medium

technical field

The present invention relates to the technical field of network communication, and in particular, to a user traceability method, device and computer-readable storage medium.

Background technique

At present, carrier-grade network address translation (Carrier-Grade Network Address Translation, CGN equipment has various deployment scenarios, mainly distributed and centralized.

FIG. 1 is a network structure diagram of a distributed CGN system in the prior art. In a distributed CGN system, the CGN device is directly mounted on the Broadband Remote Access Server (BRAS) device. The first network address translation technology uses static address mapping, that is, the private IP address of the internal network is converted to the public one. In the case of IP addresses, the IP addresses are one-to-one, and the ports are a block of fixed and continuous port numbers. After the user goes online, the Authentication-Authorization-Accounting (AAA) device records the user account, and the BRAS reports the user's private network IP, the mapped public network IP and port block serial number to the AAA device. A deep packet inspection (Deep Packet Inspection, DPI) device records the source IP, source port number, destination IP and destination port number of the user surfing the Internet. The association algorithm used for user source tracing in this networking architecture is: source IP in DPI device = public network IP in AAA device, source port number in DPI device > public network end block start number in AAA device & DPI .source port number < public network end block termination number in the AAA device.

FIG. 2 is a network structure diagram of a centralized CGN system in the prior art. The difference between the distributed system is that the CGN equipment in the centralized CGN system is mounted on the core router (Core Router, CR). The first network address translation technology uses dynamic address translation, that is, the private IP address of the internal network is converted to When the public network IP address is used, the converted public network IP is uncertain and random. However, under such a networking architecture, the existing technology cannot realize the traceability of the user's online records.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a user traceability method, device, and computer-readable storage medium, which are used to solve the technical problem in the prior art that user traceability cannot be achieved under a centralized CGN networking architecture.

In a first aspect, an embodiment of the present invention provides a user traceability method, which is applied to a centralized CGN system, and the method includes:

According to the first association relationship between the DPI bill and the NAT log, at least one NAT log associated with the to-be-traced DPI bill is determined from the multiple NAT logs; wherein the first association relationship includes: the DPI bill and the NAT log include: the same keyword;

According to the second association relationship between the NAT log and the AAA log, at least one AAA log associated with the at least one NAT log is determined from the plurality of AAA logs; wherein the second association relationship includes: the NAT log and the AAA log contain the same keyword;

Determine the user account in the at least one AAA log, and determine the user account as the traceability result of the DPI bill to be traced.

When performing user source tracing on DPI bills in this embodiment, at least one NAT log associated with the DPI bills to be traced is determined from multiple NAT logs according to the first association relationship between DPI bills and NAT logs; The second association relationship of AAA logs, determining at least one AAA log associated with the at least one NAT log from multiple AAA logs; determining a user account in the at least one AAA log, and determining the user account as all The traceability results of the DPI bills to be traced are described, which solves the technical problem that user traceability cannot be achieved in the centralized CGN networking architecture in the prior art, and the existing centralized CGN system networking architecture is relatively small and has strong applicability. .

Optionally, the first association relationship includes at least one of the following:

The source IP address in the DPI bill is the same as the IP address after NAT in the NAT log;

The source port in the DPI bill is the same as the port after NAT in the NAT log;

The destination IP address in the DPI bill is the same as the destination IP address in the NAT log;

The destination port in the DPI bill is the same as the destination port in the NAT log.

This embodiment provides multiple implementation manners of the first association relationship, so that the source tracing process from the DPI bill to the NAT log can be more flexible.

Optionally, according to the first association relationship between the DPI bill and the NAT log, determine at least one NAT log associated with the DPI bill to be traced from the multiple NAT logs, including:

It is determined from multiple NAT logs that the start time of the NAT session is earlier than the time identified by the minimum time stamp in the DPI CDR to be traced, and the end time of the NAT session is later than the maximum time stamp in the DPI CDR to be traced. at least one NAT log for the identified time; or

It is determined from multiple NAT logs that the start time of the NAT session is earlier than the time identified by the minimum time stamp in the DPI CDR to be traced, and the end time of the NAT session is later than the maximum time stamp in the DPI CDR to be traced. At least one NAT log for a preset time after the identified time.

This embodiment further avoids the problem of matching errors caused by the reuse of private network IP addresses, and further improves the accuracy of user source tracing.

Optionally, the second association relationship includes:

The pre-NAT IP address in the NAT log is the same as the private network IP address in the AAA log.

This embodiment implements the source tracing process from the NAT log to the AAA log based on the pre-NAT IP address in the NAT log and the private network IP address in the AAA log, which ensures the reliability of user source tracing.

Optionally, according to the second association relationship between the NAT log and the AAA log, determine at least one AAA log associated with the at least one NAT log from multiple AAA logs, including:

It is determined from the plurality of AAA logs that the user online time is earlier than the NAT session start time in the at least one NAT log and the user offline time is later than the NAT session end time in the at least one NAT log.

This embodiment can avoid the problem of matching errors caused by the reuse of private network IP addresses, and further improve the accuracy of user source tracing.

Optionally, before the at least one AAA log associated with the at least one NAT log is determined from the multiple AAA logs, the method further includes:

Determine the online record and the offline record corresponding to the same user from the multiple AAA logs according to the session_ID and BRAS_IP, and associate the online record and the offline record corresponding to the same user into one record;

When it is determined that any online record does not have a corresponding offline record, any online record is associated with an offline record whose offline time is infinite.

This embodiment can avoid the problem of matching errors caused by the repeated use of private network IP addresses by different users, and further improve the accuracy of user source tracing.

Optionally, before determining at least one NAT log associated with the DPI bill to be traced from the multiple NAT logs according to the first association relationship between the DPI bill and the NAT log, the method further includes:

Collect the DPI bill to be traced from the DPI device;

Collect the multiple NAT logs from the NAT device;

The multiple AAA logs are collected from the AAA device.

The data required for the user traceability process can be obtained through this implementation manner, thereby ensuring the reliability of the user traceability method.

In a second aspect, an embodiment of the present invention provides a user traceability device, including:

The first determining unit is configured to determine at least one NAT log associated with the DPI bill to be traced from the plurality of NAT logs according to the first association relationship between the DPI bill and the NAT log; wherein the first association relationship includes: DPI bills and NAT logs contain the same keywords;

A second determining unit, configured to determine at least one AAA log associated with the at least one NAT log from a plurality of AAA logs according to the second association relationship between the NAT log and the AAA log; wherein the second association relationship includes: NAT logs contain the same keywords as AAA logs;

The third determining unit is configured to determine the user account in the at least one AAA log, and determine the user account as the traceability result of the DPI bill to be traced.

Optionally, the first association relationship includes at least one of the following:

The source IP address in the DPI bill is the same as the IP address after NAT in the NAT log;

The source port in the DPI bill is the same as the port after NAT in the NAT log;

The destination IP address in the DPI bill is the same as the destination IP address in the NAT log;

The destination port in the DPI bill is the same as the destination port in the NAT log.

Optionally, the first determining unit is specifically configured to: determine from multiple NAT logs that the start time of the NAT session is earlier than the time identified by the minimum time stamp in the DPI bill of the source to be traced and the end time of the NAT session is later. At least one NAT log at the time identified by the maximum timestamp in the to-be-traced DPI CDR; or

It is determined from multiple NAT logs that the start time of the NAT session is earlier than the time identified by the minimum time stamp in the DPI CDR to be traced, and the end time of the NAT session is later than the maximum time stamp in the DPI CDR to be traced. At least one NAT log for a preset time after the identified time.

Optionally, the second association relationship includes:

The pre-NAT IP address in the NAT log is the same as the private network IP address in the AAA log.

Optionally, the second determining unit is specifically used for:

It is determined from the plurality of AAA logs that the user online time is earlier than the NAT session start time in the at least one NAT log and the user offline time is later than the NAT session end time in the at least one NAT log.

Optionally, the device further includes:

an association unit, configured to determine from the multiple AAA logs according to session_ID and BRAS_IP that the corresponding same User's online record and offline record, and associate the online record and offline record corresponding to the same user into one record; when it is determined that any online record does not have a corresponding offline record, associate any online record with a record The offline time is an infinite offline record.

Optionally, the device further includes:

The collecting unit is configured to, before the first determining unit determines at least one NAT log associated with the DPI bill to be traced from the multiple NAT logs according to the first association relationship between the DPI bill and the NAT log, from the DPI device The DPI bills to be traced are collected, the multiple NAT logs are collected from the NAT device, and the multiple AAA logs are collected from the AAA device.

In a third aspect, an embodiment of the present invention provides a user traceability device, including:

at least one processor, and

a memory communicatively coupled to the at least one processor;

Wherein, the memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the first aspect or any one of the first aspects of the embodiments of the present invention by executing the instructions stored in the memory. The method described in the selected embodiment.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and when the computer instructions are executed on a computer, the computer can execute the first aspect of the embodiment of the present invention. or the method described in any optional implementation manner of the first aspect.

One or more technical solutions provided in the embodiments of the present invention have at least the following technical effects or advantages:

The technical solution of the embodiment of the present invention is to determine at least one NAT log associated with the DPI bill to be traced from the plurality of NAT logs according to the first association relationship between the DPI bill and the NAT log; The second association relationship between the NAT log and the AAA log is to determine at least one AAA log associated with the at least one NAT log from multiple AAA logs; determine the user account in the at least one AAA log, and assign the user account to the user account. It is determined to be the traceability result of the DPI bill to be traced, solves the technical problem that user traceability cannot be realized under the centralized CGN networking architecture in the prior art, and the transformation of the existing centralized CGN system networking architecture is relatively small, Strong applicability.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

Fig. 1 is a network structure diagram of a distributed CGN system in the prior art;

Fig. 2 is the networking structure diagram of the centralized CGN system in the prior art;

3 is a schematic flowchart of a user traceability method in an embodiment of the present invention;

4 is a schematic diagram of the generation and collection process of DPI bills, NAT logs, and AAA logs in an embodiment of the present invention;

5 is a schematic diagram of a possible method for multiple data association in an embodiment of the present invention;

6 is a schematic structural diagram of a user traceability device in an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a user traceability device in an embodiment of the present invention.

Detailed ways

The technical solutions of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. If there is no conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

It should be understood that, in the description of the embodiments of the present invention, words such as "first" and "second" are only used for the purpose of distinguishing the description, and should not be understood as indicating or implying relative importance, nor should it be understood as indicating or implied order. In the description of the embodiments of the present invention, "plurality" refers to two or more.

The term "and/or" in this embodiment of the present invention is only an association relationship for describing associated objects, indicating that there may be three kinds of relationships, for example, A and/or B, which may indicate that A exists alone, and A and B exist at the same time. B, there are three cases of B alone. In addition, the character "/" in this document generally indicates that the related objects are an "or" relationship.

Embodiments of the present invention provide a user traceability method, device, and computer-readable storage medium, which are applied in a centralized CGN system to solve the technical problem that user traceability cannot be achieved in the prior art under the centralized CGN networking architecture.

Referring to Figure 3, the user traceability method includes:

S101: According to the first association relationship between the DPI bill and the NAT log, determine at least one NAT log associated with the DPI bill to be traced from multiple NAT logs; wherein the first association includes: the DPI bill and the NAT log The logs contain the same keywords;

S102: Determine at least one AAA log associated with the at least one NAT log from multiple AAA logs according to the second association relationship between the NAT log and the AAA log; wherein the second association relationship includes: the NAT log and the AAA log contain the same keywords;

S103: Determine the user account in the at least one AAA log, and determine the user account as the traceability result of the DPI bill to be traced.

Specifically, before performing the above steps S101, S102 and S103, first collect the DPI bills to be traced from the DPI device, collect the multiple NAT logs from the NAT device, and collect the multiple NAT logs from the AAA device AAA logs. FIG. 4 is a schematic diagram of a process of generating and collecting a DPI bill, a NAT log, and an AAA log in an embodiment of the present invention.

During specific implementation, since the same private network IP may be used by different users in different time periods, in order to avoid the matching error problem caused by the reuse of the private network IP address, after collecting the AAA log from the AAA device, Before at least one AAA log associated with the at least one NAT log is determined from the multiple AAA logs, the online record and the offline record of the same user may be further associated.

The specific implementation of associating the online and offline records of the same user includes: using the combination of session_ID and BRAS_IP as a unique identifier to match the online and offline records corresponding to the same user within a predetermined time range, and matching the online records corresponding to the same user. It is associated with the offline record to form a record. If it is determined that any online record does not have a corresponding offline record, any online record is associated with an offline record whose offline time is infinite. The BRAS_IP is the IP address of the BRAS device that assigns the private network IP to the user; the session_ID is the unique identifier of each session when the BRAS device assigns the private network IP to the user.

In this embodiment of the present invention, the first association relationship in step S101 includes but is not limited to the following four types:

1) The source IP address in the DPI CDR is the same as the post-NAT IP address in the NAT log (also referred to as the source IP address in the NAT log);

2) The source port in the DPI bill is the same as the post-NAT port in the NAT log (also referred to as the source port in the NAT log);

3) The destination IP address in the DPI bill is the same as the destination IP address in the NAT log;

4) The destination port in the DPI bill is the same as the destination port in the NAT log.

During specific implementation, the above-mentioned four kinds of association relationships may be implemented separately, or may be implemented in combination with each other, which is not specifically limited in the embodiment of the present invention.

For example, a possible correlation algorithm for DPI bills and NAT logs is:

DPI.sourceIP=NAT.sourceIP;

DPI.destination IP=NAT.destination IP;

DPI.sourceport=NAT.sourceport;

DPI.destination port=NAT.destination port.

In order to further avoid the problem of matching errors caused by the reuse of private network IP addresses, in step S101, when at least one NAT log associated with the DPI bill to be traced is determined from multiple NAT logs, the data scope of the above association algorithm may be further performed. Restrictions, for example, determine the data scope of the correlation algorithm based on the NAT session start time and NAT session end time of the NAT log, so as to further improve the accuracy of user traceability. Specific implementations include but are not limited to the following four:

1) The start time of the NAT session is earlier than the time identified by the minimum timestamp in the DPI bill to be traced and the end time of the NAT session is later than the time identified by the maximum timestamp in the DPI bill to be traced;

2) The start time of the NAT session is earlier than the time identified by the minimum time stamp in the DPI CDR to be traced and the end time of the NAT session is later than the time identified by the maximum time stamp in the DPI CDR to be traced; a preset time;

3) The start time of the NAT session is earlier than the second preset time before the time identified by the minimum timestamp in the DPI bill to be traced and the end time of the NAT session is later than the maximum timestamp in the DPI bill to be traced the time identified;

4) The start time of the NAT session is earlier than the third preset time before the time identified by the minimum timestamp in the DPI bill to be traced and the end time of the NAT session is later than the maximum timestamp in the DPI bill to be traced A fourth preset time after the identified time.

E.g:

The session aging time of the NAT device is X=NAT session aging time;

The minimum delay of data batch processing = X;

A=minimum timestamp in DPI CDR;

B=Maximum timestamp in DPI CDR;

DPI data range = time domain A to B;

Then the range of NAT log data used by the algorithm in the batch process = time domain A to (B+X).

In this embodiment of the present invention, the second association relationship in step S102 includes: the pre-NAT IP address in the NAT log is the same as the private network IP address in the AAA log.

In order to further avoid the problem of matching errors caused by the reuse of private network IP addresses, in step S102, when at least one AAA log associated with the at least one NAT log is determined from multiple AAA logs, the data scope of the association algorithm may be further performed. Restrictions, such as determining the data scope of the correlation algorithm based on the user's online and offline time in the AAA log, to further improve the accuracy of traceability. Specific implementations include: the user online time is earlier than the NAT session start time in the at least one NAT log and the user offline time is later than the NAT session end time in the at least one NAT log.

In order to facilitate a clearer understanding of the technical solutions of the embodiments of the present invention, a possible method for multiple data associations is exemplified below.

Referring to Figure 5, when tracing the source of the DPI bill, it is first determined from multiple NAT logs within a preset time range that the IP after NAT is the same as the source IP in the DPI bill, and the port after NAT is the same as the source IP in the DPI bill. The source IP is the same, the destination IP is the same as the destination IP in the DPI bill, and the NAT log of the destination port is the same as the destination port in the DPI bill; then the private network IP is determined from multiple AAA logs within the preset time range The AAA log is the same as the private network IP in the determined NAT log (that is, the IP before NAT). Finally, according to the correspondence between the private network IP and the user account, the user account corresponding to the private network IP in the AAA log is determined to complete the user source tracing.

In the embodiment of the present invention, when performing user source tracing on DPI bills, at least one NAT log associated with the DPI bills to be traced is determined from a plurality of NAT logs according to the first association relationship between the DPI bills and the NAT log; According to the second association relationship between the NAT log and the AAA log, determine at least one AAA log associated with the at least one NAT log from multiple AAA logs; determine a user account in the at least one AAA log, and assign the user account to the user account. The account number is determined as the traceability result of the DPI bill to be traced, which solves the technical problem that the user traceability cannot be realized in the centralized CGN networking architecture in the prior art, and the transformation of the existing centralized CGN system networking architecture is relatively small. , the applicability is strong.

Referring to FIG. 6, based on the same inventive concept, an embodiment of the present invention further provides a user traceability device, including:

The first determining unit 201 is configured to determine at least one NAT log associated with the DPI bill to be traced from a plurality of NAT logs according to the first association relationship between the DPI bill and the NAT log; wherein the first association includes: : DPI CDRs and NAT logs contain the same keywords;

The second determining unit 202 is configured to determine at least one AAA log associated with the at least one NAT log from a plurality of AAA logs according to the second association relationship between the NAT log and the AAA log; wherein the second association relationship includes : NAT logs contain the same keywords as AAA logs;

The third determining unit 203 is configured to determine the user account in the at least one AAA log, and determine the user account as the traceability result of the DPI bill to be traced.

Optionally, the first association relationship includes at least one of the following:

The source IP address in the DPI bill is the same as the IP address after NAT in the NAT log;

The source port in the DPI bill is the same as the port after NAT in the NAT log;

The destination IP address in the DPI bill is the same as the destination IP address in the NAT log;

The destination port in the DPI bill is the same as the destination port in the NAT log.

Optionally, the first determining unit 201 is specifically configured to: determine from multiple NAT logs that the start time of the NAT session is earlier than the time identified by the minimum timestamp in the DPI bill to be traced and the end time of the NAT session is At least one NAT log that is later than the time identified by the maximum timestamp in the to-be-traced DPI CDR; or

It is determined from multiple NAT logs that the start time of the NAT session is earlier than the time identified by the minimum time stamp in the DPI CDR to be traced, and the end time of the NAT session is later than the maximum time stamp in the DPI CDR to be traced. At least one NAT log for a preset time after the identified time.

Optionally, the second association relationship includes:

The pre-NAT IP address in the NAT log is the same as the private network IP address in the AAA log.

Optionally, the second determining unit 202 is specifically configured to:

It is determined from the plurality of AAA logs that the user online time is earlier than the NAT session start time in the at least one NAT log and the user offline time is later than the NAT session end time in the at least one NAT log.

Optionally, the device further includes:

an associating unit, configured to determine, according to session_ID and BRAS_IP, from the plurality of AAA logs corresponding On-line record and off-line record of the same user, and associate the on-line record and off-line record corresponding to the same user into one record; when it is determined that any on-line record does not have a corresponding off-line record, associate any on-line record An offline record with infinite offline time.

Optionally, the device further includes:

The collection unit is configured to, before the first determining unit 201 determines at least one NAT log associated with the DPI bill to be traced from the plurality of NAT logs according to the first association relationship between the DPI bill and the NAT log, from the DPI device The DPI bills to be traced are collected from the NAT device, the multiple NAT logs are collected from the NAT device, and the multiple AAA logs are collected from the AAA device.

The method and device of the present invention are based on the same inventive concept. Since the principles of the method and device for solving problems are similar, the specific implementation of the operations performed by the above units can refer to the corresponding steps in the above-mentioned user traceability method according to the embodiment of the present invention. For the implementation of the method, reference may be made to each other, and repeated descriptions will not be repeated.

Referring to FIG. 7 , based on the same inventive concept, an embodiment of the present invention also provides a user traceability device, including:

at least one processor 301, and

a memory 302 connected to the at least one processor;

Wherein, the memory 302 stores instructions that can be executed by the at least one processor 301, and the at least one processor 301 executes the instructions stored in the memory 302 by executing the instructions described in the foregoing method embodiments of the embodiments of the present invention. The steps of the user traceability method.

Optionally, the processor 301 may specifically include a central processing unit (central processing unit, CPU), an application specific integrated circuit (application specific integrated circuit, ASIC), may be one or more integrated circuits for controlling program execution, may It is a hardware circuit developed using a field programmable gate array (FPGA), which can be a baseband processor.

Optionally, the processor 301 may include at least one processing core.

Optionally, the apparatus further includes a memory 302, and the memory 302 may include a read only memory (ROM), a random access memory (RAM), and a disk memory. The memory 302 is used to store data required by the processor 301 when it operates.

Based on the same inventive concept, embodiments of the present invention further provide a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and when the computer instructions are executed on a computer, the computer can execute the above-mentioned embodiments of the present invention. The steps of the user traceability method.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention. Thus, provided that these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims (12)

1. A user tracing method is applied to a centralized carrier-level network address translation (CGN) system, and comprises the following steps:

according to a first association relation between the DPI call ticket and the NAT log converted by the network address, determining at least one NAT log associated with the DPI call ticket to be traced from the plurality of NAT logs; wherein the first association relationship comprises: the DPI ticket and the NAT log contain the same keywords;

determining at least one AAA log related to the at least one NAT log from the plurality of AAA logs according to a second association relation between the NAT log and an authentication, authorization and accounting (AAA) log; wherein the second association relationship comprises: the NAT log and the AAA log contain the same keywords;

determining a user account in the at least one AAA log, and determining the user account as a tracing result of the DPI ticket to be traced;

wherein the second association relationship includes: the IP address before NAT in the NAT log is the same as the private network IP address in the AAA log;

determining at least one AAA log associated with the at least one NAT log from the plurality of AAA logs according to the second association relationship between the NAT log and the AAA log, comprising: and determining the AAA log with the user online time earlier than the NAT session starting time in the at least one NAT log and the user offline time later than the NAT session ending time in the at least one NAT log from the plurality of AAA logs.

2. The method of claim 1, wherein the first association comprises at least one of:

the source IP address in the DPI ticket is the same as the IP address after NAT in the NAT log;

the source port in the DPI ticket is the same as the port after NAT in the NAT log;

the destination IP address in the DPI ticket is the same as the destination IP address in the NAT log;

the destination port in the DPI ticket is the same as the destination port in the NAT log.

3. The method of claim 2, wherein determining at least one NAT log associated with the DPI ticket to be traced from the plurality of NAT logs according to the first association relationship between the DPI ticket and the NAT log comprises:

determining at least one NAT log of which the NAT session starting time is earlier than the time identified by the minimum timestamp in the DPI call ticket to be traced and the NAT session ending time is later than the time identified by the maximum timestamp in the DPI call ticket to be traced from the plurality of NAT logs; or

And determining at least one NAT log of which the NAT session starting time is earlier than the time identified by the minimum timestamp in the DPI call ticket to be traced and the NAT session ending time is later than the preset time after the time identified by the maximum timestamp in the DPI call ticket to be traced from the plurality of NAT logs.

4. The method of claim 1, wherein prior to determining at least one AAA log associated with the at least one NAT log from a plurality of AAA logs, further comprising:

determining an online record and an offline record corresponding to the same user from the plurality of AAA logs according to the session _ ID and the BRAS _ IP, and associating the online record and the offline record corresponding to the same user into a record;

and when any online record is determined not to have a corresponding offline record, associating the online record with an offline record with the offline time being infinite.

5. The method according to any of claims 1-4, wherein before determining at least one NAT log associated with a DPI ticket to be traced back from a plurality of NAT logs according to the first association relationship between the DPI ticket and the NAT log, the method further comprises:

collecting the DPI call ticket to be traced from DPI equipment;

collecting the plurality of NAT logs from NAT equipment;

collecting the plurality of AAA logs from the AAA device.

6. A user tracing apparatus, comprising:

the first determining unit is used for determining at least one NAT log associated with the DPI call ticket to be traced from the plurality of NAT logs according to the first association relation between the DPI call ticket and the NAT log; wherein the first association relationship comprises: the DPI ticket and the NAT log contain the same keywords;

a second determining unit, configured to determine, according to a second association relationship between the NAT log and the AAA log, at least one AAA log associated with the at least one NAT log from the multiple AAA logs; wherein the second association relationship comprises: the NAT log and the AAA log contain the same keywords;

a third determining unit, configured to determine a user account in the at least one AAA log, and determine the user account as a tracing result of the DPI ticket to be traced;

wherein the second association relationship includes: the IP address before NAT in the NAT log is the same as the private network IP address in the AAA log;

the second determining unit is specifically configured to: and determining the AAA log with the user online time earlier than the NAT session starting time in the at least one NAT log and the user offline time later than the NAT session ending time in the at least one NAT log from the plurality of AAA logs.

7. The apparatus of claim 6, wherein the first association comprises at least one of:

the source IP address in the DPI ticket is the same as the IP address after NAT in the NAT log;

the source port in the DPI ticket is the same as the port after NAT in the NAT log;

the destination IP address in the DPI ticket is the same as the destination IP address in the NAT log;

and the destination port in the DPI ticket is the same as the destination port in the NAT log.

8. The apparatus of claim 7, wherein the first determining unit is specifically configured to: determining at least one NAT log of which the NAT session starting time is earlier than the time identified by the minimum timestamp in the DPI call ticket to be traced and the NAT session ending time is later than the time identified by the maximum timestamp in the DPI call ticket to be traced from the plurality of NAT logs; or

And determining at least one NAT log from the plurality of NAT logs, wherein the NAT session starting time is earlier than the time identified by the minimum timestamp in the DPI call ticket to be traced, and the NAT session ending time is later than the preset time after the time identified by the maximum timestamp in the DPI call ticket to be traced.

9. The apparatus of claim 6, wherein the apparatus further comprises:

the association unit is used for determining the online record and the offline record corresponding to the same user from the plurality of AAA logs according to the session _ ID and the BRAS _ IP before the second determination unit determines at least one AAA log associated with the at least one NAT log from the plurality of AAA logs, and associating the online record and the offline record corresponding to the same user into one record; and when any online record is determined not to have a corresponding offline record, associating the online record with an offline record with the offline time being infinite.

10. The apparatus of any of claims 6-9, wherein the apparatus further comprises:

the collection unit is used for collecting the DPI call tickets to be traced from the DPI equipment, collecting the NAT logs from the NAT equipment and collecting the AAA logs from the AAA equipment before the first determination unit determines at least one NAT log associated with the DPI call tickets to be traced from the NAT logs according to the first association relation between the DPI call tickets and the NAT logs.

11. A user tracing apparatus, comprising:

at least one processor, and

a memory communicatively coupled to the at least one processor;

wherein the memory stores instructions executable by the at least one processor to perform the method of any one of claims 1-5 by executing the instructions stored by the memory.

12. A computer-readable storage medium characterized by:

the computer readable storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the method of any of claims 1-5.

Images