[go: up one dir, main page]

WO2014187238A1 - Procédé d'identification de type d'application et dispositif de réseau - Google Patents

Procédé d'identification de type d'application et dispositif de réseau Download PDF

Info

Publication number
WO2014187238A1
WO2014187238A1 PCT/CN2014/076914 CN2014076914W WO2014187238A1 WO 2014187238 A1 WO2014187238 A1 WO 2014187238A1 CN 2014076914 W CN2014076914 W CN 2014076914W WO 2014187238 A1 WO2014187238 A1 WO 2014187238A1
Authority
WO
WIPO (PCT)
Prior art keywords
server
information
application
address
address information
Prior art date
Application number
PCT/CN2014/076914
Other languages
English (en)
Chinese (zh)
Inventor
陈浩
都林
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2014187238A1 publication Critical patent/WO2014187238A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/028—Capturing of monitoring data by filtering

Definitions

  • DPI Deep Packet Inspection
  • IP Internet Protocol
  • IP packets IP packets.
  • IP packets IP packets.
  • the text usually consists of IP quintuple and application layer data.
  • the network device can detect and analyze the source IP address, destination IP address, source port number, destination port number, and transport layer protocol in the quintuple, and can The application layer data of the IP packet is analyzed to identify the specific application of the IP packet.
  • the application type identification method and the network device are provided in the embodiment of the present invention to solve the problem that the application layer protocol type identification efficiency in the prior art is not high.
  • an application type identification method includes:
  • the method before the extracting the first server address information from the first data packet of the received data stream, the method further includes:
  • the server application information is saved to a server information database.
  • the obtaining, by using the data packet of the different data streams, the server application information includes:
  • the TCP data packet is identified as a WEB application for accessing the network WEB server.
  • HTTP hypertext transfer protocol
  • the URL address is analyzed to obtain an application type of the WEB server corresponding to the URL address.
  • the method further includes:
  • the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs.
  • the first server address information is extracted from the first data packet of the received data stream, specifically: the quintuple information of the first data packet from the received data stream And extracting a destination internet protocol IP address and a destination port number of the first data packet.
  • a network device in a second aspect, includes:
  • An extracting unit configured to extract first server address information from a first data packet of the received data stream; a matching unit, configured to match the first server address information extracted by the extracting unit with server application information
  • the server application information stores a correspondence between the server address information and the application type; the identification unit is configured to: when the matching unit matches the first server address information from the server application information, The application type corresponding to the first server address information is identified as the application type of the data stream.
  • the device further includes: The obtaining unit is configured to obtain the server application information by identifying the data packet of the different data streams, and the saving unit is configured to save the server application information obtained by the obtaining unit to the server information database.
  • the obtaining unit includes:
  • a TCP data packet determining subunit configured to determine that a TCP data packet is received
  • a WEB application message identification subunit configured to: when the application layer protocol of the TCP data packet is HTTP,
  • the TCP data packet When the TCP data packet includes the URL address, the TCP data packet is identified as a WEB application packet that accesses the WEB server.
  • the address information obtaining sub-unit is configured to obtain the destination address of the TCP data packet as the server address information, and the application type analysis sub-unit, configured to analyze the URL address to obtain an application type of the WEB server corresponding to the URL address.
  • the obtaining unit is further used to When the matching unit does not match the first server address information from the server application information, the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs;
  • the saving unit is further configured to save the first server application information obtained by the obtaining unit to the server information database.
  • the extracting unit is specifically configured to extract, from the quintuple information of the first data packet of the received data stream, a destination IP address and a destination port number of the first data packet. .
  • a network device in a third aspect, includes: a bus, and a memory, a network interface, and a processor connected through the bus, where
  • the memory is configured to save server application information
  • the network interface is configured to receive a first data packet of a data stream
  • the processor is configured to extract first server address information from the first data packet, match the first server address information with the server application information, and save the server address in the server application information Corresponding relationship between the information and the application type, when the first server address information is matched from the server application information, the application type corresponding to the first server address information is identified as the application type of the data flow.
  • the processor is further configured to pass Identifying data packets of different data streams, obtaining server application information, and saving the server application information to a server information database in the memory.
  • the processor is specifically configured to determine that the TCP data packet is received, when the TCP data packet is received.
  • the application layer protocol is HTTP
  • the TCP data packet includes the URL address
  • the TCP data packet is identified as a WEB application packet that accesses the WEB server, and the destination address of the TCP data packet is obtained as a server address.
  • the processor is further used when When the server information is matched to the first server address information, the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs, and the first server is obtained. Server application information is saved to the server information database.
  • the processor is specifically configured to extract, from the quintuple information of the first data packet, a destination IP address and a destination port number of the first data packet.
  • the first server address information is extracted from the first data packet of the received data stream, and the first server address information is matched with the server application information, and the first server is matched from the server application information.
  • the application type corresponding to the first server address information is identified as the application type of the data stream.
  • the server application information is established, so that when the data packet is received, no keyword extraction and rule matching are needed, but the server address information of the data packet is matched with the server application information, thereby quickly identifying The application type of the data stream to which the data packet belongs is improved, and the application type identification efficiency of the message is improved.
  • FIG. 1A is a schematic diagram of an application scenario according to an embodiment of the present invention
  • IB is a flowchart of an embodiment of an application type identification method according to the present invention
  • FIG. 2 is a flow chart of another embodiment of an application type identification method according to the present invention.
  • FIG. 3 is a flow chart of another embodiment of an application type identification method according to the present invention.
  • FIG. 4 is a block diagram of an embodiment of a network device of the present invention.
  • Figure 5 is a block diagram of another embodiment of a network device of the present invention.
  • FIG. 6 is a block diagram of another embodiment of a network device of the present invention.
  • FIG. 1A is a schematic diagram of an application scenario according to an embodiment of the present invention:
  • the terminal accesses the network device through the network, and the network device is connected to the server.
  • the terminal can be specifically a personal computer or a mobile phone; the network device can be specifically a gateway device, a routing device, a firewall device, etc.; the server can be specifically a TOB application server.
  • the network device can save the correspondence between the server address information and the application type through the database.
  • the network device sends the data stream to the network device, and the network device can send the server address in the data stream packet.
  • the information is matched with the database, and the application type of the data stream is directly identified, that is, the application type of the application on the server to be accessed by the data stream is obtained.
  • FIG. 1B it is a flowchart of an embodiment of an application type identification method according to the present invention.
  • the embodiment describes a process of identifying a data packet application from a network device side:
  • Step 101 Extract the first server address information from the first data packet of the received data stream.
  • each data packet of the data stream carries five-tuple information, where the quintuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol, and the transport layer protocol mainly includes Transmit ssion Control Protocol (TCP) and User Datagram Protocol (UDP).
  • TCP Transmit ssion Control Protocol
  • UDP User Datagram Protocol
  • the network device that receives the data packet may specifically refer to a gateway device, a routing device, a firewall device, and the like.
  • the network device may extract the destination IP address and the destination port number of the first data packet from the received quintuple information of the first data packet, and use the extracted information as the first server address information.
  • the first data packet of the data stream in this embodiment may be the first packet of the data stream, or may belong to the data stream. Other data messages except the first message.
  • Step 102 Match the first server address information with the server application information, where the server application information stores the correspondence between the server address information and the application type.
  • the server application information may be information obtained by the network device after identifying the data packets that access different TOB servers before identifying the first data packet.
  • the server application information stores the correspondence between the server address information and the application type.
  • the server address information may include the IP address and port number of the TOB server, and the application type mainly refers to the types of applications that the TOB server can provide, for example, video application, social Application, Peer to Peer (P2P) service application, etc.
  • P2P Peer to Peer
  • Step 103 When the first server address information is matched from the server application information, the application type corresponding to the first server address information is identified as the application type of the data stream to which the first data packet belongs.
  • the server application information since the server application information stores the correspondence between the server address information and the application type, when the first server address information of the first data packet is found from the server application information, the first server address information is used.
  • the corresponding application type can be directly identified as the application type of the data stream to which the first data message belongs.
  • the server application information is established in this embodiment, so that when the data packet is received, no keyword extraction and rule matching are needed, but the server address information of the data packet and the server application information are used. Matching, thereby quickly identifying the application type of the data stream to which the data message belongs, and improving the application type identification efficiency of the message.
  • FIG. 2 it is a flowchart of another embodiment of an application type identification method according to the present invention.
  • the embodiment describes in detail a process of establishing server application information before applying data type identification to a data packet:
  • Step 201 Determine that a TCP data packet is received.
  • each data packet carries quintuple information
  • the quintuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol
  • the transport layer protocol mainly includes TCP and UDP.
  • the network device that receives the data packet may specifically refer to a gateway device, a routing device, a firewall device, and the like.
  • the network device may determine whether to receive the TCP data packet according to the transport layer protocol in the quintuple information of the data packet.
  • Step 202 Determine whether the TCP data packet is a TOB application message, and if yes, execute step 203; otherwise, end the current process.
  • the network device After the network device identifies the TCP data packet, it further identifies whether the TCP data packet is a TOB application packet.
  • the condition for identifying the TOB application message may include: the application layer protocol of the TCP data message is a Hypertext Transfer Protocol (HTTP), and the TCP data message includes a Uniform Resource Locator (URL).
  • HTTP Hypertext Transfer Protocol
  • URL Uniform Resource Locator
  • Step 203 Obtain a destination address of the TCP data packet as server address information.
  • the destination device to be accessed by the TCP data packet is a TOB server, and the network device extracts the destination IP address from the quintuple information of the TCP data packet.
  • the destination port number, the destination IP address and the destination port number are the server address information of the TOB server.
  • Step 204 Analyze the URL address of the TCP data packet to obtain the application type of the TOB server corresponding to the URL address.
  • the URL address is the webpage address
  • the URL address of the TCP data packet reflects the webpage address of the application on the TOB server to be accessed by the TCP data packet.
  • the application type of the TOB server can be obtained by analyzing the webpage address, and the application type can be Including video applications, social applications, peer-to-peer applications, and more. For example, if the URL address of the TCP data message is "www.tv. ***.com", then by analyzing the keyword "tv" contained in the URL address, it can be determined that the TCP data message is to be accessed on the TOB server.
  • the application type of the app is a video app.
  • a TOB server has an IP address
  • a TOB server may have more than one application, and each application may correspond to a port number, that is, an IP address and a port number may correspond to a TOB server.
  • Step 205 Save the correspondence between the server address information and the application type as the server application information to the server information database, and end the current process.
  • FIG. 3 is a flowchart of another embodiment of an application type identification method according to the present invention.
  • the embodiment identifies the application of the received data packet based on the server application information saved in the embodiment shown in FIG. 2: Step 301: The network device receives the first data packet of the data stream.
  • the network device that receives the data packet may specifically refer to a gateway device, a routing device, a firewall device, and the like.
  • the first data packet of the data stream may be the first packet of the data stream.
  • Step 302 Extract the destination IP address and the destination port number from the quintuple information of the first data packet.
  • each data packet carries quintuple information
  • the quintuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol
  • the transport layer protocol mainly includes TCP and UDP.
  • the network device may extract the destination IP address and the destination port number of the first data packet from the quintuple information of the first data packet, and use the extracted information as the first server address information of the first data packet.
  • Step 303 Match the destination IP address and the destination port number with the server application information saved in the server information database.
  • the server application information of the server information database in the server application information of the server information database, the correspondence between the server address information and the application type is saved.
  • the destination IP address and the destination port number of the first data packet extracted in step 302 are matched with the saved server application information, so as to determine whether the destination address can be found from the server address information of the server application information. IP address and destination port number.
  • Step 304 Determine whether the destination IP address and the destination port number are matched from the server application information. If yes, go to step 305; otherwise, go to step 306.
  • Step 305 Identify the application type corresponding to the destination IP address and the destination port number as the application type of the data stream to which the first data packet belongs, and end the current process.
  • the application type corresponding to the destination IP address and the destination port number is directly identified as the application of the data stream to which the first data packet belongs. Types of.
  • Step 306 Determine whether the subsequent packet of the data stream to which the first data packet belongs is a TOB application packet, and if yes, execute step 307; otherwise, end the current process.
  • the data stream to which the first data packet belongs is a data stream that is not recognized by the network device, and the network device receives the data stream.
  • the subsequent packet of the data stream it is determined whether the subsequent packet is a WEB application packet, so as to further identify the application of the data stream.
  • the condition for identifying the TOB application message may include: when the application layer protocol of the TCP data packet is HTTP, and the TCP data packet includes the URL address, the TCP data packet may be identified as a TOB application report that accesses the TOB server. Text.
  • Step 307 Analyze the application type of the TOB server corresponding to the URL address included in the subsequent message.
  • the destination device to which the first data packet belongs is a WEB server, and the destination IP address and the destination port number of the subsequent packet are the TOB server.
  • Server address information; and, by analyzing the URL, an application type of the TOB server may be obtained, and the application type may include a video application, a social application, a peer-to-peer service application, and the like.
  • the data stream to which the first data packet belongs is used as a new data stream to identify the application type, and the recognition result is saved, and the specific process is not described again.
  • the network device may identify the application of the data stream to which the first data packet belongs according to the identification method in the prior art, which is not described in this embodiment.
  • Step 308 Save the correspondence between the destination IP address and the destination port number of the subsequent packet and the application type as the server application information to the server information database, and end the current process.
  • the subsequent network device receives the same application as the data stream to which the first data packet belongs.
  • the network device can quickly identify the application type of the data stream by searching the server information database.
  • the server application information is established in this embodiment, so that when the data packet is received, no keyword extraction and rule matching are needed, but the server address information of the data packet and the server application information are used. Matching, thereby quickly identifying the application type of the data stream to which the data message belongs, and improving the application type identification efficiency of the message.
  • the present invention also provides an embodiment of a network device that performs the application type identifying method.
  • FIG. 4 it is a block diagram of an embodiment of a network device according to the present invention:
  • the network device includes: an extracting unit 410, a matching unit 420, and an identifying unit 430.
  • the extracting unit 410 is configured to extract first server address information from the first data packet of the received data stream;
  • the matching unit 420 is configured to match the first server address information extracted by the extracting unit 410 with server application information, where the server application information stores the server address information and the application type. Correspondence relationship
  • the identifying unit 430 is configured to identify, when the matching unit 420 matches the first server address information from the server application information, an application type corresponding to the first server address information as the data stream. App types.
  • the extracting unit 410 is specifically configured to extract, from the quintuple information of the received first data packet, a destination IP address and a destination port number of the first data packet.
  • FIG. 5 it is a block diagram of another embodiment of a network device according to the present invention:
  • the network device includes: an obtaining unit 510, a saving unit 520, an extracting unit 530, a matching unit 540, and an identifying unit 550.
  • the obtaining unit 510 is configured to obtain the server application information by identifying data packets of different data streams.
  • the saving unit 520 is configured to save the server application information obtained by the obtaining unit 510 to a server information database;
  • the extracting unit 530 is configured to extract first server address information from the first data packet of the received data stream
  • the matching unit 540 is configured to match the first server address information extracted by the extracting unit 530 with the server application information, where the server application information stores a correspondence between the server address information and the application type.
  • the identifying unit 550 is configured to identify, when the matching unit 540 matches the first server address information from the server application information, an application type corresponding to the first server address information as the first data.
  • the obtaining unit 510 may include (not shown in FIG. 5): a TCP data packet determining subunit, configured to determine that a TCP data packet is received; and a TOB application message identifying subunit, configured to be used as the TCP datagram
  • the application layer protocol of the text is HTTP
  • the TCP data packet includes the URL address
  • the TCP data packet is identified as a TOB application packet for accessing the WEB server
  • the address information obtaining subunit is configured to acquire the TCP
  • the destination address of the data packet is used as server address information.
  • the application type analysis sub-unit is configured to analyze the URL address to obtain an application type of the TOB server corresponding to the URL address.
  • the obtaining unit 510 may be further configured to: when the matching unit does not use the server application information When the first server address information is configured, the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs;
  • the saving unit 520 is further configured to save the first server application information obtained by the obtaining unit 510 to the server information database.
  • the extracting unit 530 may be specifically configured to extract a destination IP address and a destination port number of the first data packet from the quintuple information of the first data packet of the received data stream.
  • FIG. 6 a block diagram of another embodiment of a network device according to the present invention:
  • the network device includes: a bus 610, and a memory 620, a network interface 630, and a processor 640 connected by the bus 610.
  • the memory 620 is configured to save server application information.
  • the network interface 630 is configured to receive a first data packet of the data stream.
  • the processor 640 is configured to extract first server address information from the first data packet, match the first server address information with the server application information, and save the server in the server application information. Corresponding relationship between the address information and the application type, when the first server address information is matched from the server application information, identifying an application type corresponding to the first server address information as an application type of the data flow .
  • the processor 640 is further configured to: obtain server application information by identifying data packets of different data streams, and save the server application information to a server information database in the memory.
  • the processor 640 may be specifically configured to determine that the TCP data packet is received.
  • the application layer protocol of the TCP data packet is HTTP
  • the TCP data packet includes a URL address
  • the TCP data is identified.
  • the message is a TOB application message that accesses the TOB server, obtains a destination address of the TCP data packet as server address information, and analyzes the URL address to obtain an application type of the TOB server corresponding to the URL address.
  • the processor 640 is further configured to: after the first server address information is not matched from the server application information, identify, by obtaining, a subsequent packet of the data stream to which the first data packet belongs First server application information, and saving the first server application information to the server information data Library.
  • the processor 640 is specifically configured to extract a destination IP address and a destination port number of the first data packet from the quintuple information of the first data packet.
  • the first server address information is extracted from the first data packet of the received data stream, the first server address information is matched with the server application information, and the first server is matched from the server application information.
  • the application type corresponding to the first server address information is identified as the application type of the data stream to which the first data message belongs.
  • the server application information is established, so that when the data packet is received, no keyword extraction and rule matching are needed, but the server address information of the data packet is matched with the server application information, thereby quickly identifying The application type of the data stream to which the data packet belongs is improved, and the application type identification efficiency of the message is improved.
  • the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform.
  • the technical solution in the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, and the computer software product may be stored in a storage medium, such as a ROM/RAM. , a diskette, an optical disk, etc., comprising instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or in certain portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente invention, selon un mode de réalisation, concerne un procédé d'identification de type d'application et un dispositif de réseau, le procédé consistant : à extraire les premières informations d'adresse de serveur du premier paquet de données d'un flux de données reçu ; à mettre en correspondance les premières informations d'adresse de serveur avec des informations d'application de serveur, les informations d'application de serveur contenant une relation de correspondance entre les informations d'adresse de serveur et un type d'application y étant contenu ; et, lorsque les premières informations d'adresse de serveur ont été mises en correspondance avec les informations d'application de serveur, à identifier le type d'application correspondant aux premières informations de serveur en tant que type d'application du flux de données. La présente invention, selon le mode de réalisation, établit des informations d'application de serveur, de sorte que, lors de la réception d'un paquet données, les informations d'adresse de serveur du paquet de données soient mises en correspondance avec les informations d'application de serveur, sans extraction de mots-clés ni correspondance de règles, d'où une identification rapide du type d'application d'un flux de données du paquet de données, et une amélioration de l'efficacité d'identification du type d'application d'un paquet.
PCT/CN2014/076914 2013-05-24 2014-05-07 Procédé d'identification de type d'application et dispositif de réseau WO2014187238A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2013101985612A CN103297270A (zh) 2013-05-24 2013-05-24 应用类型识别方法及网络设备
CN201310198561.2 2013-05-24

Publications (1)

Publication Number Publication Date
WO2014187238A1 true WO2014187238A1 (fr) 2014-11-27

Family

ID=49097618

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/076914 WO2014187238A1 (fr) 2013-05-24 2014-05-07 Procédé d'identification de type d'application et dispositif de réseau

Country Status (2)

Country Link
CN (1) CN103297270A (fr)
WO (1) WO2014187238A1 (fr)

Families Citing this family (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103297270A (zh) * 2013-05-24 2013-09-11 华为技术有限公司 应用类型识别方法及网络设备
CN103701809A (zh) * 2013-12-27 2014-04-02 山石网科通信技术有限公司 应用的识别方法和装置
CN103916294B (zh) 2014-04-29 2018-05-04 华为技术有限公司 协议类型的识别方法和装置
CN105227599B (zh) * 2014-06-12 2017-12-26 腾讯科技（深圳）有限公司 Web应用的识别方法和装置
CN105592137B (zh) * 2015-10-14 2019-04-09 新华三技术有限公司 一种应用类型的识别方法和装置
CN105939287A (zh) * 2016-05-23 2016-09-14 杭州迪普科技有限公司 处理报文的方法及装置
CN107787003A (zh) * 2016-08-24 2018-03-09 中兴通讯股份有限公司 一种流量检测的方法和装置
CN106330768B (zh) * 2016-08-31 2019-04-12 成都飞鱼星科技股份有限公司 一种基于云计算的应用识别方法
CN106254384B (zh) * 2016-09-14 2019-12-06 新华三技术有限公司 一种服务访问方法及装置
CN106506400B (zh) * 2016-11-04 2019-12-06 锐捷网络股份有限公司 一种数据流识别方法及出口设备
CN108063692B (zh) * 2016-11-08 2019-11-26 中国移动通信有限公司研究院 流量识别方法及装置
CN107547437B (zh) * 2017-05-11 2020-09-08 新华三信息安全技术有限公司 应用识别方法及装置
CN107222369A (zh) * 2017-07-07 2017-09-29 北京小米移动软件有限公司 应用程序的识别方法、装置、交换装置和存储介质
CN107707549B (zh) * 2017-09-30 2020-07-28 迈普通信技术股份有限公司 一种自动提取应用特征的装置及方法
CN107864127B (zh) * 2017-10-30 2020-07-10 北京神州绿盟信息安全科技股份有限公司 一种应用程序的识别方法及装置
CN108282414B (zh) * 2017-12-29 2020-05-29 网宿科技股份有限公司 一种数据流的引导方法、服务器和系统
CN108418758B (zh) * 2018-01-05 2021-01-29 网宿科技股份有限公司 一种单包识别方法及流量引导方法
CN108900374B (zh) * 2018-06-22 2021-05-25 网宿科技股份有限公司 一种应用于dpi设备的数据处理方法和装置
CN109067762B (zh) * 2018-08-29 2020-10-27 深信服科技股份有限公司 一种物联网设备的识别方法、装置及设备
CN111404768A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种dpi识别的实现方法及设备
CN111953552B (zh) 2019-05-14 2022-12-13 华为技术有限公司 数据流的分类方法和报文转发设备
CN112564991B (zh) * 2019-09-10 2024-11-12 华为技术有限公司 应用识别方法、装置及存储介质
CN110808921B (zh) * 2019-11-05 2023-01-03 赵宇飞 应用识别方法、系统及网络设备
CN111177595B (zh) * 2019-12-20 2024-04-05 杭州九略智能科技有限公司 一种针对http协议模板化提取资产信息的方法
CN111143743B (zh) * 2019-12-26 2023-09-26 杭州迪普科技股份有限公司 一种自动扩充应用识别库的方法及装置
CN112653740A (zh) * 2020-12-11 2021-04-13 北京金山云网络技术有限公司 支持quic连接迁移的负载均衡方法、装置及计算机产品
CN114979073B (zh) * 2021-08-30 2023-09-05 中移互联网有限公司 地址信息获取系统、方法、电子设备及存储介质
CN115801916A (zh) * 2021-09-08 2023-03-14 中国移动通信集团山东有限公司 一种流量识别方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101183988A (zh) * 2007-11-19 2008-05-21 华为技术有限公司 一种识别报文对应的业务类型的方法及其装置
CN101202652A (zh) * 2006-12-15 2008-06-18 北京大学 网络应用流量分类识别装置及其方法
CN102195882A (zh) * 2011-05-18 2011-09-21 深信服网络科技（深圳）有限公司 根据数据流应用类型选路的方法及装置
US8121030B2 (en) * 2007-03-06 2012-02-21 Hewlett-Packard Development Company, L.P. Network service monitoring
CN103297270A (zh) * 2013-05-24 2013-09-11 华为技术有限公司 应用类型识别方法及网络设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101202652A (zh) * 2006-12-15 2008-06-18 北京大学 网络应用流量分类识别装置及其方法
US8121030B2 (en) * 2007-03-06 2012-02-21 Hewlett-Packard Development Company, L.P. Network service monitoring
CN101183988A (zh) * 2007-11-19 2008-05-21 华为技术有限公司 一种识别报文对应的业务类型的方法及其装置
CN102195882A (zh) * 2011-05-18 2011-09-21 深信服网络科技（深圳）有限公司 根据数据流应用类型选路的方法及装置
CN103297270A (zh) * 2013-05-24 2013-09-11 华为技术有限公司 应用类型识别方法及网络设备

Also Published As

Publication number Publication date
CN103297270A (zh) 2013-09-11

Similar Documents

Publication Publication Date Title
WO2014187238A1 (fr) Procédé d'identification de type d'application et dispositif de réseau
US10348631B2 (en) Processing packet header with hardware assistance
US20190075049A1 (en) Determining Direction of Network Sessions
CN104994079B (zh) 访问请求的处理方法和装置、加速服务器
CN106936791B (zh) 拦截恶意网址访问的方法和装置
US10237151B2 (en) Attributing network address translation device processed traffic to individual hosts
CN109039775A (zh) 业务质量监控方法、装置及系统
CN102724317A (zh) 一种网络数据流量分类方法和装置
WO2015165296A1 (fr) Procédé et dispositif d'identification d'un type de protocole
EP3128713B1 (fr) Procédé et système d'envoi de page
CN107613037A (zh) 一种域名重定向方法和系统
RU2621961C2 (ru) Шлюз и соответствующие ему способ, компьютерная программа и носитель информации
TW201312369A (zh) 網頁內容過濾方法以及具網頁內容過濾功能之網路設備
CN103618661A (zh) 一种数据分离方法及系统
CN103139205B (zh) 报文处理方法、装置及网络服务器
CN108040124B (zh) 基于DNS-Over-HTTP协议的控制移动端应用的方法及装置
CN106961393B (zh) 网络会话中udp报文的检测方法及装置
JP2021529470A (ja) データストリームのプロトコルの識別
CN106341342A (zh) 维持通信连接的方法、装置、终端及服务器
CN113285920B (zh) 业务访问方法、装置、设备及存储介质
JP5925287B1 (ja) 情報処理装置、方法およびプログラム
EP2860911B1 (fr) Procédé et dispositif pour la classification de flux de données chiffrées entre au moins un client web et au moins un serveur web
CN112565106B (zh) 流量业务识别方法、装置、设备及计算机存储介质
CN104702706A (zh) 一种获取dns报文的方法及设备
CN111212137B (zh) 由防火墙执行的点对点数据传输的识别方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14801186

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14801186

Country of ref document: EP

Kind code of ref document: A1