Application identification method and equipment for user definition

Abstract

The invention discloses an application identification method and application identification equipment for user definition. The method comprises the following steps of: A, performing packet sniffing on application to be analyzed; B, extracting application signature characteristics from a data packet; C, compiling the application signature characteristics; and D, loading the compiled signature characteristics. The equipment comprises a packet sniffing module, a signature extraction module, a signature compiling module, a signature loading module and an application identification testing module, wherein the packet sniffing module is used for acquiring the data packet; the signature extraction module is used for extracting a signature in a data packet load; the signature compiling module is used for compiling the signature characteristics; the signature loading module is used for loading the compiled signature; and the application identification testing module is used for testing whether the application can be identified or not. The method and the equipment are wide in identification range and highly accurate and extensible, and can be implemented as a network equipment function.

Description

technical field [0001] The invention relates to an application identification technology, in particular to a user-defined application identification method and equipment thereof. Background technique [0002] Data signature (Digital Signature) technology is a typical application of asymmetric encryption algorithm. The process of digital signature is that the sender of the data source uses its own private key to encrypt the data checksum or other variables related to the data content, and complete the data encryption process. The data receiver uses the other party's public key to interpret the received "digital signature", and uses the interpretation result to verify the integrity of the data to confirm the validity of the signature. [0003] Digital signatures are used to identify the uniqueness of application and protocol features. When a new application or protocol is invented, there will also be a corresponding signature, which will be identified and added to the signatur...

AI Technical Summary

Problems solved by technology

Similarly, signatures are also constantly changing. For example, every time an application is upgraded to a new version, there may be a new signature. It cannot be accurately identified by the application layer network flow control device

[0004] With the rapid development of Internet technology, new applications carried on the Internet are also emerging one after another. The lack of a fast feedback mechanism for the application protocol type identification of new applications on the Internet will lead to the inability to obtain new applications quickly and effectively. support

However, in actual operation, the signature feature library of the application layer network flow control device requires professionals to update it periodically, which is cumbersome and inefficient.

Images