Method and device for network traffic identification

Abstract

The application provides a method and a device for network traffic identification. The method comprises the following steps: identifying the head of an obtained data packet to be identified, determining network protocols respectively used by a transmission layer and all layers below the transmission layer, extracting an IP address and a port from the head of the data packet to be identified, searching the IP address and the port in a preset flow table, if the IP address and the port are searched, determining that a network protocol and an application which correspond to the IP address and the port are the network protocol and the application which are used by an application layer, if the IP address and the port are not searched, matching load data in the data packet to be identified with feature keywords in a preset feature library, and if matching is successfully carried out, determining that a network protocol and an application which correspond to the feature keywords are the network protocol and the application which are used by the application layer. Compared with the prior art, the application has the advantages that not only can the protocol of the application layer be accurately identified through the flow table and the feature library which are previously set, the application type can also be determined according to corresponding relationships record in the flow table and the feature library; the recognizing results are more comprehensive.

Description

technical field [0001] The present application relates to the technical field of network traffic identification, in particular to an identification method and device that can accurately and comprehensively identify protocols and applications used by network traffic. Background technique [0002] The OSI (Open System Interconnection) network protocol includes seven layers, which are the physical layer, data link layer, network layer, transport layer, session layer, presentation layer and application layer. Among them, the data link layer, network layer, transport layer and application layer each contain a variety of network protocols, which are important research objects in network traffic analysis. Specifically, network traffic analysis is to identify network protocols used by network data packets. [0003] At present, the identification method of network traffic is to extract the field value from some specific fields in the data packet, and use the internationally stipulat...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the present invention provides a network traffic identification method and device to solve the technical problems of low accuracy and incomplete identification results of existing identification methods

Images