Packet sampling and application signature based internet application flux identifying method

Abstract

The invention relates to an internet application flow rate identification method based on message sampling and application signing, comprising the following steps: firstly, message sampling capture: in accordance with sampling strategy and sampling rate the message is captured and decoded; secondly, decoding: the flow information and application data of the message is analyzed by decoding the message; thirdly, flow classification: according to the flow information of the message, a flow state table is found and maintained; fourthly, flow state distinguishing: the signature is matched if the application type of the flow state found through the flow classification is unknown; finally, signature matching: according to the application signature bank, the application data of the message is matched, if matched successfully, the application type of the flow state is updated, and the flow information and application type of that data stream is output. The method is of high accuracy in identification, high efficiency in processing, good expandability, high possibility in realization, and is applicable not only for message processing, but also for flow data analysis. The invention can be achieved in not only the network equipment, but also the network analysis system.

Description

technical field [0001] The invention relates to an Internet application flow identification method, in particular to an Internet application flow identification method based on packet sampling and application signature. Applied to high-speed networks, the method uses application signatures to identify application traffic on sampled packets. Background technique [0002] Accurately identifying Internet application traffic is extremely important for access networks, enterprise networks, and network researchers. Both the access network and the enterprise network need to accurately identify network application traffic for network operation and management, application-based traffic engineering, capacity planning, differentiated services, and reduced operating costs. Some network devices (such as Cisco devices) already provide the ability to identify application traffic. Network researchers also need to accurately identify network application traffic in order to perform passive ...

AI Technical Summary

Problems solved by technology

It is not feasible to analyze each message on a high-speed (Gbp and Tbps) network, because the processing speed of the software cannot match the high-speed link speed, and signature matching for each message consumes a lot of processing resources. And capturing each message also requires a lot of processing power, memory cache, system IO and network bandwidth

Images