Network application flow recognition method and apparatus and network application flow management apparatus

Abstract

The invention discloses a network application traffic identification method, a network application traffic identification device and network application traffic management equipment. The method comprises the following steps of: associating a characteristic sequence template of known network application and corresponding specific plaintext characteristics; taking a source IP of network session as a key value to record the characteristic sequence template which is identified by DPI and is associated with the specific plaintext characteristics into a first list; and for network session which fails to be identified by the prior art, recording characteristic information of a current message, and adapting the characteristic information to the entire characteristic sequence templates under a corresponding key value when a preset threshold is reached to obtain a network application traffic identification result. The network application traffic identification method and the network application traffic identification device can identify network application traffic which fails to be identified by a DPI identification method, improve identification efficiency at the same time, reduce identification cost, and reduce the false report rate of the identification.

Description

technical field [0001] The present invention relates to the technical field of communication networks, in particular to a network application flow identification method and a network application flow identification device, and also relates to a network application flow management device. Background technique [0002] Network application traffic identification is a key common technology of many core network services, which distinguishes the traffic of different application types or application protocols for separate processing. [0003] The existing network application traffic identification technologies mainly include the following types: [0004] (1) Identification technology based on IP / port: identify network application traffic according to the source IP address, destination IP address or source port number and destination port number of the TCP data packet or UDP data packet header; [0005] This IP / port-based identification technology can effectively identify network t...

AI Technical Summary

Problems solved by technology

Although this scheme can realize the identification of encrypted P2P network traffic, it needs to extract N data packets for each network application traffic and traverse all feature sequence templates in the P2P feature template library for matching, so the efficiency is low, and it is also lead to large system overhead

Images