A TCP stream length connection data analysis method

Abstract

The invention discloses a TCP stream long connection data analysis method. For the established TCP connection data stream, sending the TCP connection data stream to the server; establishing a sessionaccording to the quaternion information; caching few TCP data, the content is detected by data packet boundary and port number information; the characteristics of a known protocol are matched; analyzing a protocol message, distinguishing a connection direction according to content, an IP address and port information analyzed by the protocol, completely analyzing the protocol message, distinguishing a boundary of a message body, adding simulated handshake connection information in an existing communication analysis process, keeping a TCP standard communication protocol in a compatible manner, and continuously analyzing subsequent effective data. According to the invention, protocol identification, analysis and effective data reduction are carried out on data with established connection in traffic, and complete session behaviors of an application layer protocol are restored in network traffic data for an information source for behavior audit and risk discovery; information sources associated with a data flow are discovered through the data flow on an unknown system service.

Description

technical field [0001] The invention belongs to the field of network connection analysis, in particular to a method for analyzing TCP flow long connection data. Background technique [0002] The common network communication process is that the TCP client initiates a network connection, connects to the server, performs data communication on a specific protocol, and closes the connection after completion. There will be a large number of such connection initiation and closing operations for the server-oriented terminal. For system services with large traffic, usually a single server cannot complete the task, but multiple servers provide services equally through proxy. Establish TCP long-term connections in time, and respond to customer requests and provide services on this connection. The effective time of these long-term connections can range from minutes to hours or days. At present, most of the protocol analysis connection technologies on the mirrored traffic need or be bas...

AI Technical Summary

Problems solved by technology

At present, most of the protocol analysis connection technologies on the mirrored traffic need or be based on a complete TCP session connection. For the transmission data on the established connection, it is generally ignored and no longer processed, resulting in the loss of the currently established connection traffic data.