NAT (Network Address Translation) flow identification method based on transmission layer flow characteristic

Abstract

The invention relates to the Internet application technology field, and especially relates to an NAT (Network Address Translation) flow identification method based on a transmission layer flow characteristic in Internet application. The method comprises the following steps: acquiring a data packet which goes through an NAT device as training data; learning a classifier in the training data; sending all subsequent acquired data packets which go through the NAT device to the classifier; according to a characteristic of a data flow of the sending data packets, distinguishing an NAT flow from a non NAT flow by the classifier. The NAT flow identification method is independent of an operation system or a passive identification method of any special field, has a wide application range and is noteasy to fail. Through carrying out characteristic extraction and characteristic selection on a network flow, an optimal characteristic subset of carrying out NAT identification is effectively screened out. According to the screened optimal characteristic subset, data is divided into different clusters through a cluster algorithm, an application type of a cluster is determined by utilizing a few labeled data, and the NAT identification is realized.

Description

technical field [0001] The invention relates to the technical field of Internet applications, and in particular to a method for identifying data traffic passing through NAT based on characteristics of a transport layer in Internet applications. Background technique [0002] IPv4 (IP protocol version 4) specifies 32 bits for IP addresses, for a theoretical total of 4,294,967,296 IP addresses. However, in practical applications, because some IP addresses are reserved for testing, multicasting and other special purposes, only about 3.3 billion IP addresses can be allocated for use. Due to the rapid development of the Internet, more and more users have joined the ranks of using the Internet, and the problem of global IP address resource shortage has become increasingly prominent, and the number of available IP addresses is now obviously insufficient. Although the new IPv6 (IP protocol version 6) has opened up a huge IP address space, it can solve the problem of insufficient net...

AI Technical Summary

Problems solved by technology

[0025] The present invention proposes a method for identifying NAT traffic based on the traffic characteristics of the transport layer. By applying data mining technology to NAT identification, the existing NAT identification methods rely on the operating system or cannot avoid NAT devices modifying the content of the protocol header.

Images