Method and system for online update of protocol signature database

Abstract

The present invention relates to a method and system for online update of a protocol feature library. The method includes: a traffic probe device identifies suspicious and unknown data flow through DPI technology and DFI technology, and samples; sends the sample to a feature library analysis platform; the feature library analysis platform Statistical characteristics and behavior pattern characteristics of the sample, and match with the data traffic of new protocols or applications not recorded in the protocol signature database, determine the corresponding statistical characteristics and behavior pattern characteristics, and form signature database files or signature entries; then update to the protocol feature library. The present invention detects suspicious and unknown data traffic in time by arranging traffic probe devices using DPI technology and DFI technology, and determines statistical characteristics and behavior pattern characteristics corresponding to new protocols or applications by collecting samples and matching them with new protocols or applications , and based on this, the protocol feature library is updated online, so as to realize the rapid online update of the protocol feature library and improve the efficiency of protocol identification.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and system for online updating of a protocol feature library. Background technique [0002] With the rapid development of Internet applications, especially mobile Internet in recent years, various new applications and new protocols are constantly emerging, and the versions of existing applications and protocols are also constantly updated, followed by the diversification of application layer protocol features As well as continuous evolution and changes, the corresponding identification methods also need to be continuously upgraded. Early network application protocols generally used fixed port numbers, and servers on the network side also usually used fixed Internet Protocol (IP) addresses. The corresponding ports can be easily identified by simply adding the port number to the IP address. Application protocols, so that different application protocols can be proce...

AI Technical Summary

Problems solved by technology

[0006] At present, on the one hand, the popular application protocols are in order to avoid being identified, and on the other hand, it is also the demand for the continuous improvement of the application itself, which leads to frequent updates of the version and features of the application protocols, making the update speed of the above-mentioned protocol feature identification methods of the application protocol identification equipment unable to keep up. , which leads to a low protocol recognition rate, and even makes the existence of protocol recognition equipment seem dispensable

Images