Network protocol identification method and device

Abstract

The invention discloses a network protocol identification method. Code stream data of the same IP ports are compared, and then fixed characteristic information in network protocols are obtained; the characteristic information are stored in a protocol knowledge base according to a occurrence sequence of the characteristic information in the network protocols; a decision tree is built through the characteristic information stored in the protocol knowledge base, and leaf nodes in the decision tree identify the network protocol of branches where of the leaf nodes locate; according to information of the nodes and various node branch identifiers of the decision tree, protocol identification is performed on to-be-identified data; and, according to the leaf node where the identification reaches, the network protocol of the to-be-identified data is determined. Through usage of the network protocol identification method, the network protocol of code flow data can be rapidly identified. The invention further discloses a network protocol identification device.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a network protocol identification technology. Background technique [0002] With the rapid development of the network and the continuous emergence of new applications, the demand for network information security products such as network security audit, intrusion detection, and data leakage prevention is also increasing. These network security products are mainly based on the deep packet inspection technology DPI (DeepPacketInspection), and the core of deep packet inspection technology is application layer protocol identification, that is, to identify which application layer protocol is used for the data transmitted on the network link, and to restore and analyze these protocols. The specific implementation mechanism is to reorganize the application layer information in the OSI7 layer protocol by deeply reading the content of the IP packet load, thereby identifying the applicatio...

AI Technical Summary

Problems solved by technology

However, the solidified hardware uses the underlying compiled language, which is highly dependent on the hardware and cannot be updated in time, and cannot be deployed across devices. That is, when a single device reaches the processing limit, it can only be solved by adding devices. This method is difficult to work in the network environment of road mirroring

[0008] Unable to quickly identify new protocols: the development of network technology is changing with each passing day, new technologies and new applications emerge in an endless stream, and new network protocols continue to emerge. These protocols are not only customized according to open source protocols, but also closed private protocols. Protocol analysis has brought great challenges. Traditional network protocol analysis uses static signature database technology, which can only identify existing network protocols, and cannot respond to and judge new protocols. It can only passively wait for the signature database to be updated. If the signature database If the update is slow or missing, it will not be able to play the original role of protocol analysis

Images