Mobile application network traffic clustering device

Abstract

The invention discloses a mobile application network traffic clustering device comprising an acquisition unit used for acquiring network traffic generated by a mobile terminal; a preprocessing unit applicable to preprocessing the acquired network traffic, and generating DNS traffic record sets corresponding to the DNS traffic and the other network traffic record sets corresponding to the other network traffic except the DNS traffic; a first clustering unit applicable to clustering the DNS traffic record sets to acquire multiple DNS network traffic classes corresponding to the DNS traffic; a second clustering unit applicable to using the acquired DNS network traffic classes for clustering the other network traffic record sets to acquire multiple other network traffic classes corresponding to the other network traffic; and a combination unit application to combining the multiple DNS network traffic classes corresponding to the DNS traffic with the multiple other network traffic classes corresponding to the other network traffic to acquire a final mobile application network traffic clustering result. According to the abovementioned scheme, the clustering and analysis of the mobile application network traffic can be simply achieved.

Description

technical field [0001] The invention relates to the technical field of data processing, in particular to a mobile application network traffic clustering device. Background technique [0002] With the rapid development of mobile Internet and Internet of Things technology, mobile terminals, such as smart phones, flat Pads, smart glasses, smart watches, etc., have become important auxiliary tools for daily social activities. [0003] However, the widespread use of mobile terminals has also brought unprecedented challenges to network management and network security protection. For example, in an enterprise intranet, a malicious application is installed on a mobile terminal carried by an employee. The application calls the camera to capture confidential information, and then uses the mobile communication network or wireless network to transmit the captured confidential information to the attacker's server, resulting in confidential information Give way. Therefore, detecting mal...

AI Technical Summary

Problems solved by technology

However, in practice, there are many difficulties in directly installing the agent program on the mobile terminal, such as forcing the user to install, and the user can uninstall it by himself, etc.

[0005] However, there is no public research and report on automatic clustering of mobile application network traffic in the prior art

Images