Application identification method, data mining method, device and system

Abstract

The embodiment of the invention discloses a data mining method, device and system. The UBA (user behavior analysis) data mining method comprises the steps of: obtaining data to be processed, wherein the data to be processed comprises a plurality of records, each record comprises application information and far-end triad information which are in corresponding relation; clustering the records of which the far-end triad information and the application information are the same in the data to be processed, calculating service charge capacities corresponding to the far-end triad information and the application information according to the records of which the far-end triad information and the application information are the same in the data to be processed to obtain a clustering result comprising the far-end triad information and the application information which are in the corresponding relation, and the service charge capacities; selecting the far-end triad information and the application information which are high in credibility and in corresponding relation from the clustering result according to the size or specific weight of the service charge capacities; and sending the far-end triad information and the application information which are high in credibility and in corresponding relation to a DPI (Deep Packet Inspection) subsystem so as to improve the DPI identification performance and application identification rate.

Description

technical field [0001] The present invention relates to the field of communication technologies, in particular to an application identification method, a data mining method, a device and a system. Background technique [0002] With the rapid development of broadband services, it brings both opportunities and challenges to operators. A series of issues such as billing and information security processing. [0003] Deep Packet Inspection (DPI) technology is considered to be a method to deal with management problems caused by multiple service operations in the network, that is, the use of DPI technology can quickly parse network data, so that the operator network can Supports application-based services, such as email tariff packages, video tariff packages, game tariff packages, blocking of specific downloaded software, etc. [0004] like Figure 1A As shown, it is a protocol hierarchy diagram. From the perspective of the transport layer, network applications are mostly carried...

AI Technical Summary

Problems solved by technology

[0006] In addition, since the update speed of Internet applications is much faster than that of DPI’s feature library, and many applications are increasingly using encryption methods such as SSL and HTTPS for data transmission for security reasons, resulting in low DPI recognition performance. The application identification of the encryption protocol can only identify the L7 protocol information, and the running application on the L7 is still unable to identify; for example, encrypted data such as HTTPS cannot identify the application, which leads to the failure of DPI identification

Images