Method and device for identifying traffic of access network

Abstract

The invention discloses a method and a device for identifying the traffic of an access network. The method comprises the following steps of: extracting a sub-stream, which corresponds to each data stream, from each data stream of the access network; sampling all the sub-streams to obtain sampling sub-streams; identifying the application layer protocol of each sampling sub-stream and establishing a mapping relationship between the sampling sub-stream and the application layer protocol according to the identification result; extracting initial data from each sub-stream and establishing sub-stream characteristic vectors which correspond to the sub-streams according to the initial data; clustering the sub-streams according to all the sub-stream characteristic vectors to form a plurality of clusters; establishing a mapping relationship between the clusters and the application layer protocols according to the mapping relationship between the sampling sub-stream and the application layer protocol; and identifying the application layer protocol, which each sub-stream in each cluster corresponds to, according to the mapping relationship between the clusters and the application layer protocols so as to identify the application layer protocol of the data stream which correspond to the sub-stream in the access network. The method and the device for identifying the traffic of the access network can perform high-speed on-line flow identification for the access network and can identify the application layer protocol of an encrypted data stream in the access network.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a flow identification method and device for an access network. Background technique [0002] With the diversification of network service types, network traffic identification technology has become a hot spot in the industry. The access network is a network that connects the core network and user terminals, or connects the core network and the user premises network. It can identify different types of network traffic in the access network in a timely and accurate manner, which is very important for traffic engineering, quality of service (QoS) and network security. Management is important. [0003] In the process of network communication, the original data information needs to be divided into many small data packets in order to pass through the network at high speed. Therefore, the network traffic transmitted in the access network is in the form of data packets. The...

AI Technical Summary

Problems solved by technology

[0005] However, in the above-mentioned DPI implementation process, all data packets transmitted in the access network need to be copied, stored, and then calculated and processed. Used for high-speed online traffic identification on the access network

[0006] In addition, in the above-mentioned DPI implementation process, the communication management device detects by acting as a specific application data flow agent, and the encrypted data packet cannot find the defined variables in this way, so it cannot be connected Encrypted data packets transmitted in the network for detection

Images