Network traffic refined screening device and method

Abstract

The invention provides a network traffic refined screening device and method, which are realized based on Cavium equipment and are applied to the technical field of internet network traffic filtering.The device comprises a message capturing module, a rule receiving and analyzing module, a traffic restoring module, a rule matching module, a message packaging module and a message forwarding module.According to the method, a traffic capture core is used for capturing a network traffic packet from an active optical port, a service processing core is used for carrying out rule matching on the network traffic packet, and through flexible combination of rules such as quintuple matching, multimode and regular matching, the network traffic hitting a matching rule is searched for and forwarded. According to the invention, high-performance refined screening and multi-port message forwarding of multi-user traffic can be realized for large-scale network traffic, and the operation and maintenancecost of network traffic screening is reduced.

Description

technical field [0001] The invention relates to the technical field of Internet network traffic filtering, in particular to a method and device for packet detection and screening based on various traffic characteristics. Background technique [0002] With the rapid growth of mobile network traffic and the explosive growth of audio and video traffic in the 5G era, the cost of processing and analyzing full access to mobile network traffic is too high. In order to reduce processing costs, extract key traffic information, and filter low-value traffic, it is necessary to According to specific business requirements, fine-grained and high-precision screening is carried out through rules such as quintuple information and traffic characteristics. [0003] Ordinary packet detection and traffic screening equipment mainly rely on quintuples (including source IP, destination IP, source port, destination port, transport layer protocol) to analyze and filter traffic, but simple quintuple i...

AI Technical Summary

Problems solved by technology

However, the TCAM hardware unit can only return a single rule hit, and cannot process quintuples that hit multiple rules, while a single cluster DPI server has low processing performance and high maintenance costs

[0004] To sum up, the current traffic screening equipment appears in the form of a combination of multiple traffic filtering equipment, with complex logic, difficult management, and low overall traffic screening efficiency. And it is difficult to realize complex business analysis of multi-target users and multi-service scenarios, which is not enough to meet the analysis business under the current mobile network traffic volume

Images