Method and system for classifying local area network http application services

A kind of application business and type of technology, applied in the direction of transmission system, digital transmission system, data exchange network, etc., can solve the problems of inaccuracy, flow control, business differentiation trouble, etc., and achieve the effect of good performance and accuracy

Inactive Publication Date: 2010-12-01
BEIJING VENUS INFORMATION TECH +1
View PDF6 Cites 25 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

At present, many online behavior monitoring products are mostly based on ports and the analysis of the http protocol for application classification. When faced with a large number of http messages, the current online behavior monitoring and auditing systems only rely on ports or the analysis of the http protocol and cannot distinguish between Ordinary IE browsing, save as, or multi-threaded downloads such as network ants or even Thunder, it is obviously not accurate enough to report as a general http application
This brings certain problems to accurate online behavior monitoring and auditing, and also brings a certain degree of trouble to subsequent traffic control and business differentiation.

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method and system for classifying local area network http application services
  • Method and system for classifying local area network http application services
  • Method and system for classifying local area network http application services

Examples

Experimental program
Comparison scheme
Effect test

example 1

[0038]Example 1: Message information of a single-threaded http application triggered by IE:

[0039] Source IP: 192.168.1.102, destination IP: 60.19.64.40, source port: 1112 destination port 80.

[0040] The content of the http message is parsed as follows:

[0041] GET / gougou / sprite2.gif HTTP / 1.1

[0042] Accept: * / *

[0043] Referer:

[0044] http: / / www.gougou.com / search? search=%E9%87%91%E5%88%9A%E7%8B%BC&id=0

[0045] Accept-Language: zh-cn

[0046] Accept-Encoding: gzip, deflate

[0047] User-Agent: Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; InfoPath.1)

[0048] Host: img.gougou.com

[0049] Connection: Keep-Alive

example 2

[0050] Example 2: The HTTP application analysis content triggered by Xunlei is as follows:

[0051] GET / files / dd6aa97e14dcb028037bd2171bblc579 / %5Bbbs.gogodutch.com%5D? ? ? ? cd 1.rmvb HTTP / 1.1

[0052] Accept: * / *

[0053] Cache-Control: no-cache

[0054] Connection: Keep-Alive

[0055] Host: www340.megaupload.com

[0056] Pragma: no-cache

[0057] Range: bytes=27852800-27918335

[0058] User-Agent: Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727).

[0059] The protocol parser provides the parsed field information to the message feature filter for feature matching.

[0060] Step 203: While performing protocol analysis in step 302, the traffic collector generates and saves traffic records within a predetermined time interval according to all data packets currently captured, stores the records in the form of quintuples and provides them to the traffic pattern recognizer for for further identification;

[0061] The traffi...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention relates to a method and a system for classifying local area network http application services. The invention provides a system for classifying network message application services. The system comprises a message capturer, a protocol analyzer and a message character filter, which are connected one by one, wherein the message capturer is arranged for capturing a network message; the protocol analyzer is arranged for analyzing a protocol for the captured network message, taking a corresponding field message and supplying the network message and the field message to the message character filter; the message character filter is arranged for matching the field message with a preset application service character message so as to classify the network message according to a matching result. The method and the system of the invention can accurately classify the network message.

Description

technical field [0001] The invention relates to a method and a system for classifying all http data messages in a local area network environment. The method and system can be used in online behavior monitoring or business auditing products, and belong to the network technology field. Background technique [0002] The Internet behavior monitoring system is an important means of network behavior monitoring that is increasingly widely used at present. It achieves the discovery of specific security events, the regulation of network behavior, and the management of network resources through real-time monitoring of business in the actual network. Security purpose is an effective way to realize IT monitoring and management. With the increasing number of network services, more and more applications use the standard http protocol and port 80 for information interaction. Standard port 80. At present, many online behavior monitoring products are mostly based on ports and the analysis ...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
IPC IPC(8): H04L29/08H04L12/56H04L47/2475
Inventor 孙海波
Owner BEIJING VENUS INFORMATION TECH
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap