Network traffic depth identification system and method based on many-core processor

Abstract

The invention discloses a network traffic depth identification system based on a many-core processor and a corresponding identification method. The identification method comprises: firstly, establishing a semantic-based rule base by use of a semantic-based rule module, analyzing rules in the rule base by use of a rule analysis module and then generating a hierarchy match tree by use of a hierarchy match tree module; obtaining original network data by virtue of a receiving module and orderly performing IP fragment recombination processing and TCP recombination processing to obtain transport layer data; identifying the type of a protocol used by the transport layer data at an application layer according to a protocol specification regular expression defined by a protocol specification module and then performing structuring processing on the application layer data by virtue of a structured protocol data module; and finally, performing rule matching on the structured application layer data according to the hierarchy match tree by virtue of a matching engine module, sending a successful matching result to a user behavior statistical module for statistics, and then completing the network traffic depth identification.

Description

technical field [0001] The invention belongs to the technical field of network flow management, relates to a network flow deep recognition system based on many-core processors, and also relates to a recognition method for deep recognition of network flow by using the recognition system. Background technique [0002] At present, the management of network traffic by major network operators is limited to extensive management. Many operators still rely on SNMP technology to manage their own networks. The supervision of network traffic is limited to the consideration of the carrying capacity of their own network equipment. As for the specific content of network traffic, the users included in the traffic Behavioral information has not been effectively monitored and utilized. [0003] The previous port-based method to monitor network traffic is fast and simple to use, but with the exhaustion of IPv4 addresses, the conversion of IP addresses and ports is becoming more and more freq...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a network traffic depth recognition system based on many-core processors. A load-based traffic classification technology is adopted on the platform of many-core processors, which not only solves the problem that traditional network traffic recognition systems can only analyze traffic protocols types, the problem of not being able to obtain detailed user behavior information, and also solves the problem that traditional network traffic identification systems cannot process high-speed network traffic online in real time

Images