Method and device for extracting characteristic string, network equipment and storage medium
A technology for extracting features and feature strings, which is applied in the field of application recognition and can solve problems such as the inability to automatically extract feature strings
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0087] figure 1 A schematic diagram of a process of extracting a feature string provided by an embodiment of the present invention, the process includes the following steps:
[0088] S101: According to each first five-tuple information corresponding to the application, count each first session corresponding to each first five-tuple information; for each first session, determine the feature to be extracted in the first session A data packet of a string, and determine the word segmentation of the data packet; use each determined word as each candidate feature string.
[0089] The method for extracting a characteristic string provided by the embodiment of the present invention is applied to a network device, and the network device may be a network security device, a traffic monitoring device, and the like.
[0090] After the client triggers the application, the application performs session transmission, and the client can obtain each first quintuple information corresponding to ...
Embodiment 2
[0110] In order to make the determination of the transition entropy of the candidate feature string more accurate, on the basis of the above-mentioned embodiments, in the embodiment of the present invention, the candidate is determined according to the transition probability of each adjacent two characters and the logarithm of the transition probability. The transfer entropy of the feature string includes:
[0111] Calculate the product of the transition probability of each adjacent two characters and the logarithm of the transition probability, sum each of the obtained products, and determine the negative number of the obtained sum value as the transition entropy of the candidate feature string.
[0112] After the network device determines the transition probability of every two adjacent characters in the candidate feature string, it can calculate the logarithm of the transition probability of every two adjacent characters, and then calculate the logarithm of the transition pr...
Embodiment 3
[0120] In order to reduce the amount of calculation for extracting feature strings and ensure the validity of the extracted feature strings as much as possible, on the basis of the above-mentioned embodiments, in this embodiment of the present invention, for each first session, determine the first The data packets to be extracted feature string in the session include:
[0121] For each first session, in the preset data packet transmission direction, obtain a preset number of data packets in the first session, and use the preset number of data packets as the feature string to be extracted in the first session data packets.
[0122] A preset data packet transmission direction is stored in the network device, wherein the preset data packet transmission direction may be from the client to the server, or from the server to the client, or from the client to the server or from the server to the client. Moreover, a preset number is stored in the network device, and after each first s...
PUM
Abstract
Description
Claims
Application Information
- R&D Engineer
- R&D Manager
- IP Professional
- Industry Leading Data Capabilities
- Powerful AI technology
- Patent DNA Extraction
Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic, Popular Technical Reports.
© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap|About US| Contact US: help@patsnap.com