A method for analyzing tcp flow long connection data

Abstract

The invention discloses a TCP flow long connection data analysis method. For the established TCP connection data flow, the four-tuple information establishes a session, caches a small amount of TCP data, and uses the data packet boundary and port number information to detect the content to match Know the characteristics of the protocol, and then distinguish the direction of the connection according to the content, IP address and port information analyzed by the protocol, completely analyze the protocol message, distinguish the boundary of the message body, and add a simulated handshake in the existing communication analysis process Connection information, compatible with maintaining the TCP standard communication protocol, and continuously analyzing subsequent valid data. The present invention solves the problem of protocol identification, analysis and restoration of valid data for the data of established connections in the flow, and restores the complete session behavior of the application layer protocol in the network flow data, which is used as an information source for behavior audit and risk discovery; Through data flow on unknown system services, it is used to discover information sources associated with data flow.

Description

technical field [0001] The invention belongs to the field of network connection analysis, in particular to a method for analyzing TCP flow long connection data. Background technique [0002] The common network communication process is that the TCP client initiates a network connection, connects to the server, performs data communication on a specific protocol, and closes the connection after completion. There will be a large number of such connection initiation and closing operations for the server-oriented terminal. For system services with large traffic, usually a single server cannot complete the task, but multiple servers provide services equally through proxy. Establish TCP long-term connections in time, and respond to customer requests and provide services on this connection. The effective time of these long-term connections can range from minutes to hours or days. At present, most of the protocol analysis connection technologies on the mirrored traffic need or be bas...

AI Technical Summary

Problems solved by technology

At present, most of the protocol analysis connection technologies on the mirrored traffic need or be based on a complete TCP session connection. For the transmission data on the established connection, it is generally ignored and no longer processed, resulting in the loss of the currently established connection traffic data.