A method and a device for automatically identifying traffic and extracting an application rule

Abstract

The invention discloses a device for automatically identifying traffic and extracting an application rule, and relates to the technical field of information, in particular to the field of network supervision traffic automatic identification. The device is composed of a traffic classification module, a traffic filtering module, an http traffic automatic learning analysis module and a non-http traffic feature extraction module. The traffic classification module is composed of a traffic comparator and an http traffic feature table; the traffic filtering module is composed of a traffic filter anda traffic rule fingerprint database. The http traffic automatic learning analysis module is composed of a traffic type judgment module, a feature character string matching analyzer, a domain name andwebpage tile analyzer and a server ip address analyzer; the non-http traffic feature extraction module is composed of a non-http traffic recorder and a hexadecimal feature converter. According to theinvention, the network application traffic type can be identified by automatically learning and analyzing the network traffic under the condition that traffic model fingerprints are not provided, andthe automatically learned traffic features can generate the rule characteristic library. The popularization of the device can reduce the workload of people and improve the working efficiency.

Description

technical field [0001] The invention relates to the field of information technology, especially the field of automatic traffic identification in network security supervision. Background technique [0002] With the continuous expansion of Internet traffic, it has evolved from 2G network, 3G network, 4G network, and later to 5G network. This evolution has led to continuous expansion of Internet application traffic and diversification of traffic. The application is born quickly! Network supervision has to face such a huge network data flow and changing network data flow. It is difficult to solve the timeliness of supervision and network security by traditional manual traffic analysis and application rule extraction, and a lot of manpower is invested. And time can not completely solve this problem, so a new method is urgently needed to deal with this situation. [0003] At present, the main method is to use Internet traffic to match the fingerprint of the existing traffic mode...

AI Technical Summary

Problems solved by technology

However, the disadvantages of this method are: 1. It does not take into account the increasing number of new traffic types, and the frequently updated traffic types do not have traffic model fingerprint matching; 2. The feature rule base that the traffic model fingerprint depends on cannot be automatically generated; 3. It cannot Automatically update the rule base; 4. Unable to quickly and automatically identify network data traffic and traffic trend graphs

Images