Multimode integration core network user traffic application identification method easy to expand

Abstract

A multimode integration core network user traffic application identification method easy to expand comprises the following steps that hierarchical data message analysis is conducted, and tunnel traffic is identified and restored; five-tuple information of IP layer and transport layer protocols is analyzed and managed; according to flow node information, the application identification method integrating a pre-identification method, a port identification method, an HTTP identification method, a P2P identification method and a PA identification method is adopted for obtaining data messages and specific application information of a data flow where the data messages belong. The identification methods support independent expansion, the identification method simple in processing logic and high in response speed is preferentially used, identification loads on the follow-up complex methods are lowered, and identification processing efficiency is improved; the HTTP identification method supports two-level identification, and identification effectiveness and accuracy are improved; meanwhile, a DPI identification mode and a DFI identification mode are supported, and encrypted application protocol and P2P protocol data flows are identified effectively.

Description

technical field [0001] The present invention relates to the field of communication network traffic identification, and more specifically, the present invention relates to an easy-to-extend multi-method fusion core network real-time user traffic application identification method. Background technique [0002] In order to understand the usage of different network applications and the bandwidth occupation in the communication network, so as to carry out effective traffic monitoring or network user analysis, it is necessary to effectively identify the data flow of the communication network first. [0003] There are two main types of traditional communication network user traffic application identification technologies, Deep Packet Inspection (DPI) and Deep Flow Inspection (DFI). [0004] DPI is to identify the message by deeply reading the content of the message load. In addition to analyzing the content of the message L2 (data link layer), L3 (network layer), and L4 (transport ...

AI Technical Summary

Problems solved by technology

For example, many mobile terminal third-party applications (APPs) or network video applications use the HTTP protocol to carry content. Therefore, it is obviously not enough to only recognize the HTTP protocol

Images