Network traffic depth recognition system and recognition method based on many-core processors

Abstract

The invention discloses a network traffic depth recognition system based on many-core processors and a corresponding recognition method. Firstly, a semantic-based rule base is established through a semantic-based rule module, and rules in the rule base are analyzed through a rule analysis module. , and then generate a hierarchical matching tree through the hierarchical matching tree module; obtain the original network data through the receiving module, and perform IP fragment reassembly processing and TCP reassembly processing in turn to obtain the transport layer data; identify the The protocol type used by the transport layer data in the application layer, and then the application layer data is structured through the structured protocol data module; finally, the structured application layer data is matched according to the hierarchical matching tree through the matching engine module, and the matching The successful results are handed over to the user behavior statistics module for statistics to complete the in-depth identification of network traffic.

Description

technical field [0001] The invention belongs to the technical field of network flow management, relates to a network flow deep recognition system based on many-core processors, and also relates to a recognition method for deep recognition of network flow by using the recognition system. Background technique [0002] At present, the management of network traffic by major network operators is limited to extensive management. Many operators still rely on SNMP technology to manage their own networks. The supervision of network traffic is limited to the consideration of the carrying capacity of their own network equipment. As for the specific content of network traffic, the users included in the traffic Behavioral information has not been effectively monitored and utilized. [0003] The previous port-based method to monitor network traffic is fast and simple to use, but with the exhaustion of IPv4 addresses, the conversion of IP addresses and ports is becoming more and more freq...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a network traffic depth recognition system based on many-core processors. A load-based traffic classification technology is adopted on the platform of many-core processors, which not only solves the problem that traditional network traffic recognition systems can only analyze traffic protocols types, the problem of not being able to obtain detailed user behavior information, and also solves the problem that traditional network traffic identification systems cannot process high-speed network traffic online in real time

Images