Message receiving method, deep packet inspection device, and system

Abstract

Embodiments of the invention provide a message receiving method, a deep packet inspection device, and a system, relating to the field of communication, and by the method, the device and system, the message identification capacity of the deep packet inspection device is improved, thereby preventing bugs caused by insufficient identification. The message receiving method comprises: receiving a service request message sent by a terminal device, the message carrying a terminal domain name indicating the terminal device and a server domain name of a service server indicating the service request of the terminal device; analyzing the received server domain name so as to obtain an internet protocol (IP) address of the service server; and if the IP address of the service server does not belong to preset service server IP addresses corresponding to the received terminal domain name in a preset list, dropping the massage. Embodiments of the invention are used for processing messages.

Description

technical field [0001] The invention relates to the communication field, in particular to a message receiving method, deep packet detection equipment and a system. Background technique [0002] With the maturity of the Internet business, the types of services gradually increase. The websites that user terminals can visit include video websites, game websites, etc. These websites are free or charged according to the needs of operators. Requirements select access. [0003] In general, the service server used by the user to access the website corresponds to an IP (Internet Protocol, Internet Protocol) address, and the user can send a message carrying the domain name and information about the website to be visited. Usually, the DPI ( Deep Packet Inspection (Deep Packet Inspection) device needs to use the complete URL (Uniform Resource Location, Uniform Resource Locator) information that includes the host field when performing policy matching on message information, which is dif...

AI Technical Summary

Problems solved by technology

[0003] In general, the business server used by the user to access the website corresponds to an IP (Internet Protocol, Internet Protocol) address, and the user can send a message carrying the domain name and information about the website to be visited. Usually, the DPI ( Deep Packet Inspection (Deep Packet Inspection) device needs to use the complete URL (Uniform Resource Location, Uniform Resource Locator) information that includes the host field when performing policy matching on message information, which is different from the existing service server for message Different processing principles will cause loopholes in DPI device detection. For example, this kind of service server only detects the path information in the URL of the message, but does not detect the host field, so that the service server can return the access result according to the path information without judging the path. Whether the information is consistent with the path provided by the host field, that is, it is impossible to judge whether the user has tampered with the host field

This will cause the user to successfully access the charging service by tampering with the message, but the DPI device cannot identify whether the user terminal has achieved the purpose of fraudulently accessing the charging website for free by modifying the host field in the message, etc.

Images