A nat detection method based on the fusion of user behavior and Thunder id

Abstract

The invention discloses an NAT detection method based on converged user behaviors and Thunder ID. The method comprises the following steps: (1) enabling a traffic processing platform to extract the User-Agent, Cookie ID and Thunder ID information from the captured network traffic, and splicing the extracted information to an JSON string; (2) loading and balancing the JSON string to a corresponding server in the traffic processing platform for processing according to quintuples of the network traffic; and (3) enabling the server to classify the data according to the quintuples, and when determining that the TCP flow corresponding to a certain quintuple ends, on-line processing the TCP flow, wherein the on-line processing method comprises the following steps: calculating the host out-degree and host in-degree of the client IP according to the quintuples, determining the NAT attribute of the client IP, and calculating the host scale of the client IP. According to the NAT detection method disclosed by the invention, a large number of IP attributes can be calibrated, and the NAT scale can be accurately determined.

Description

Technical field [0001] The invention belongs to the technical field of Internet passive flow analysis and NAT detection, and relates to a NAT detection method based on fusion of user behavior and Thunder ID. Background technique [0002] The application of NAT (Network Address Translation) technology slows the exhaustion of the IP address space and realizes the mapping relationship between the private network IP address and the public network IP address, so that the internal and external networks are isolated, thereby isolating all computers in the local area network It is hidden and protected and cannot be accessed through public networks, effectively preventing various illegal attacks from public networks. Therefore, NAT technology also provides new ideas for the development of firewall technology. Nowadays, NAT technology is integrated in most routers, which provides a certain guarantee for the security of private networks. [0003] However, like many other technologies in his...

AI Technical Summary

Problems solved by technology

[0009] However, the User-Agent identification method is largely restricted by the user's online habits. The use of some operating systems and browsers, such as opening two different browsers on a host, will cause misjudgment, and due to User-Agent The Agent field can be easily modified by the user, and the detection effect of this method is not guaranteed

The Cookie ID identification method is largely restricted by the user's online habits, and it is difficult to ensure that different users visit the same website within the same detection period

Moreover, some users will clear the Cookie information on the machine at any time, and these factors will make the detection error of the Cookie ID identification method relatively large

Images