Message analysis and shunt method and apparatus

Abstract

The invention provides a message analysis and shunt method and apparatus. The method comprises the following steps: receiving a message and establishing key information Key; querying a preset behaviorpreset table according to the constructed key information Key; judging whether the received message is a large-flow message according to the query result; if so, querying a preset DPI resource analysis table, and obtaining a DPI processing unit that is in an idle state at present; sending the large-flow message to the DPI processing unit that is in the idle state at present to process the message; and sending the message processed by the DPI processing unit to a destination port. According to the message analysis and shunt method and apparatus, classification processing is performed on the message to effectively remove illegal messages and quickly and accurately process the legal messages, thereby improving the processing ability of a large number of messages, making response to the preferred processing of real-time messages with high priority, improving the processing performance of the back end DPI and other network DPI analysis devices, and saving the network resources.

Description

technical field [0001] The invention relates to the technical field of service message analysis, in particular to a method and device for message analysis and distribution. Background technique [0002] With the rapid development of the Internet and the diversification and complexity of network services, the network analysis tasks of communication units are becoming more and more heavy, so higher requirements are put forward for the identification and distribution of network traffic. The identification processing of the existing network flow is mainly based on the packet length value inspection of the first three packets of the network flow extracted from the network flow, so as to identify the type of the protocol to which it belongs. Network traffic identification processing, if the traffic object is small, perform coarse-grained network traffic identification processing. For example, the patent application number is: 201310676369.X, and the name is "A Protocol Identifica...

AI Technical Summary

Problems solved by technology

[0004] However, the processing of large-flow packets in this method is based on the processing of in-depth network packet loads, which takes a long time and is limited by bandwidth restrictions under high-speed conditions; at the same time, it does not consider the need to In the case of discarding first, it does not take into account that if it is a real-time message, it needs to be processed in a timely manner; and it does not care about the real-time processing of the back-end unit, which may cause the analysis unit in the network topology to have a low processing capacity.

Images