Network application-level protocol recognition method and system

Abstract

The invention discloses a network application-level protocol recognition method and a network application-level protocol recognition system, which can recognize multi-type and / or multi-state network application-level protocols. The system mainly comprises a description method interpreter for analyzing protocol recognition mode describing files, a Method List data structure module for storing an analyzed data structure Method List, and a protocol recognition operation executing module for recognizing the protocols according to the Method List, wherein the protocol recognition mode describing files are used for describing network application-level protocol recognition modes. The method and the system can be used for realizing the recognition of the multi-type protocols and the recognition of the multi-state protocols through state recognition, and simultaneously conveniently update characteristics and the recognition modes.

Description

technical field [0001] The invention relates to a description method of a network application layer protocol identification method and a protocol identification system based on the method. Background technique [0002] With the popularization of network applications and the development of network technology, new network application services emerge in an endless stream, followed by the diversification of application layer traffic characteristics and the complexity of corresponding identification methods. Traditional network application services use fixed service ports, which can easily identify application layer protocols through application ports. With the use of P2P, VOD and VoIP technologies, today's network application protocols mainly use dynamic ports for communication, so the traditional method of identifying application protocols through ports is no longer applicable. [0003] In order to solve this situation, there are currently two main types of identification meth...

AI Technical Summary

Problems solved by technology

It can realize feature update without recompilation, but the regular expression matching speed is slower than the matching function, and it cannot match some features, such as the related features of data packet content and data packet length

Moreover, the feature description method of regular expressions is relatively abstract, which increases the difficulty for managers to increase the identification methods by themselves.

In the existing method, the combined features in multiple data packets are realized by storing multiple data packets and combining them together for comprehensive feature matching. This method is inefficient and requires a large storage space. There are large performance defects when used in

Images