Method and system for mobile application flow feature automatic analysis

Abstract

The invention provides a method and system for mobile application flow feature automatic analysis. The downloading and the installation of a mobile application as well as the use and the triggering of flow can be automatically completed, features in the flow are extracted, grammar description required by a feature base is generated, and the grammar description is added into the feature base, so that the creating efficiency of the feature base is improved, the labor cost is saved, and the artificial errors due to application feature analysis and extraction of the traditional manual off-line mode are avoided.

Description

【Technical Field】 [0001] The invention mainly relates to the technical field of network traffic identification. 【Background technique】 [0002] Existing traffic identification systems all perform identification through a feature library established in advance. Deploy traffic identification equipment or software in a network node in series or in parallel, and the system will pre-load a feature library containing an application protocol defined in a certain format. When the collected network traffic and feature library are When the features match, the corresponding recognition result is returned. [0003] The method of creating and maintaining the application protocol feature library is: first define a task list, including the application to be analyzed; then set up a packet capture environment (usually using tools such as wireshark / sniffer), and manually install the corresponding on the phone The application simulates business operations and captures the network traffic generated ...

AI Technical Summary

Problems solved by technology

Since each application requires multiple steps, and there are tens of thousands of applications in the mobile network, maintaining the timeliness of the feature database will consume a lot of labor costs

[0009] 2. Manual analysis depends on the experience and quality of individual personnel, the quality of the extracted features cannot be guaranteed, and human error is unavoidable

[0010] 3. The update cycle of the application protocol feature library is long, which seriously lags behind the actual network scenario

Due to this purely manual work method, there are many steps, and it is impossible to keep up with the rhythm of new applications on the mobile network. As a result, the application protocol feature library seriously lags behind the actual network scene, and the update speed cannot meet the needs of users. is in a passive state of responding to questions

[0011] The means of custom protocols are limited, and users cannot meet individual needs in a timely manner

Since the analysis and extraction of application features rely on the manual completion of professionals, the custom protocol can only use the simplest IP and port instead of all the syntax of the feature library, which greatly limits the expression range of the custom protocol

Images