An easy-to-extend multi-mode fusion core network user traffic application identification method

Abstract

An easy-to-expand multi-mode fusion core network user traffic application identification method, including hierarchical data message analysis and identification and restoration of tunnel traffic; analysis of five-tuple information for management of IP layer and transport layer protocols; according to flow node information, The application identification method of the fusion of pre-identification, port identification, HTTP identification, P2P identification and PA identification method is adopted to obtain the specific application information of the data message and the data flow to which it belongs. Each identification method supports independent expansion, and the identification method with simple processing logic and fast response speed is front-loaded to reduce the identification load of subsequent complex methods and improve the efficiency of identification processing; HTTP supports secondary identification to improve the effectiveness and accuracy of identification; At the same time, it supports the identification methods of DPI and DFI, effectively identifying encrypted application protocols and P2P protocol data streams.

Description

technical field [0001] The present invention relates to the field of communication network traffic identification, and more specifically, the present invention relates to an easy-to-extend multi-method fusion core network real-time user traffic application identification method. Background technique [0002] In order to understand the usage of different network applications and the bandwidth occupation in the communication network, so as to carry out effective traffic monitoring or network user analysis, it is necessary to effectively identify the data flow of the communication network first. [0003] There are two main types of traditional communication network user traffic application identification technologies, Deep Packet Inspection (DPI) and Deep Flow Inspection (DFI). [0004] DPI is to identify the message by deeply reading the content of the message load. In addition to analyzing the content of the message L2 (data link layer), L3 (network layer), and L4 (transport ...

AI Technical Summary

Problems solved by technology

For example, many mobile terminal third-party applications (APPs) or network video applications will use the HTTP protocol to carry content. Therefore, it is obviously not enough to only recognize the HTTP protocol

Images