Establishment, identification control method and device for network flow characteristic identification rule

Abstract

The invention discloses an establishment method for a network flow characteristic identification rule. The establishment comprises the following steps of: receiving a network flow sample by using an analysis centre server; acquiring load data of the network flow sample; extracting a flow characteristic from the load data; when the characteristic parameters contained in the flow characteristic reach a corresponding threshold, determining the type to which a network flow belongs corresponding to the corresponding threshold; storing the flow characteristic and the type correspondingly to generate the characteristic identification rule; and transmitting the characteristic identification rule to network flow equipment. By adopting the method of the embodiment, the analysis centre server can extract the flow characteristic of the network flow and establish the characteristic identification rule without pre-installing and operating application software for generating the network flow; and the analysis, identification and control capacity of the network flow equipment to the network flow can be continuously improved by transmitting dynamically updated characteristic identification rule tothe network flow equipment.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a method for establishing a network traffic feature recognition rule, a method for recognition control and a device. Background technique [0002] Flow (Flow)-based Flow analysis technology is currently the mainstream network traffic analysis technology, mainly including NetFlow, sFlow, cFlow and NetStream. [0003] NetFlow is the most widely used traffic analysis technology today. NetFlow can collect the information of layer 2 to layer 4 network traffic in the Open System Interconnect (OSI) reference model, including source IP address, destination IP address, source port, destination port, IP layer protocol type, etc., and can answer Questions about IP traffic, such as who is at what time, where, what protocol is used, who is accessing, and how much traffic is specific. However, NetFlow only analyzes the IP packet header in the network traffic, and cannot really judge the app...

AI Technical Summary

Problems solved by technology

[0007] It can be seen that for unknown network traffic, the existing DPI technology cannot effectively analyze and control it; and, when the application software that generates the network traffic is not known, the application protocol feature recognition rule cannot be established to update the feature database

Therefore, when the proportion of unknown traffic in the network is high, the analysis and control capabilities of the management system based on DPI technology will be significantly reduced

Images