A method and system for network application layer protocol identification

Abstract

The invention discloses a network application layer protocol identification method and system. The method includes the following steps that: feature information of a communication process is acquired, wherein the feature information contains at least one kind of or the combination of information selected from the IP address, main feature code and protocol port of the communication process, as well as the length of data packets in the communication process; and the communication process is identified according to any one of a preset IP address hash table, main feature code hash table, protocol port hash table and length hash table of the data packets, or a preset identification plug-in, if the communication process is recognized, the protocol ID of the communication process is obtained, otherwise, the protocol of the communication process is marked as undefined. In an identification process of a communication process to be identified, a corresponding protocol ID can be queried in a hash table according to the hash value of the feature information of the communication process to be identified, and therefore, the application layer protocol ID in the communication process can be identified quickly and accurately.

Description

technical field [0001] The invention belongs to the technical field of the Internet, and in particular relates to a method and system for network application layer protocol identification. Background technique [0002] With the rapid development of Internet application technology, Internet applications have been greatly enriched, and more and more network applications use proprietary protocols. These network protocols have no publicly available protocol specification documents, which brings great challenges to the classification and precise identification of network protocols. new challenges. Typical examples are peer-to-peer (P2P) transmission protocols, audio and video applications, and various encrypted communication tools. [0003] In the traditional client-server communication model, a typical communication process is that the client initiates a request to the server, and the server receives the request and responds. Most session requests are initiated by the client. ...

AI Technical Summary

Problems solved by technology

The traditional port-based detection technology has a particularly fast identification speed, but because many protocols do not have fixed transport layer ports, and some protocols even use dynamic port or masquerade port technology, the accuracy of port-based identification methods cannot meet the current needs

The traditional technology based on deep packet inspection can achieve a more accurate recognition effect by identifying precise feature strings, but the recognition speed is slow, and the recognition effect for some encryption protocols is poor

Images