Flow processing method and device based on deep packet inspection, equipment and medium

Abstract

The invention provides a traffic processing method and device based on deep packet inspection, equipment and a medium, relates to the technical field of network management, and is used for solving the problem that a traditional traffic management mode cannot accurately identify a complex protocol. Storing the at least one plug-in into an array corresponding to the target chain; when the target data packet enters the PREROUTING chain, extracting session information from the target data packet; performing deep packet inspection analysis according to the session information to obtain an analysis result; when the target data packet enters the target chain, calling at least one plug-in in sequence according to a preset priority; and the at least one plug-in processes the target data packet according to the analysis result. According to the method, a complex application layer protocol can be accurately identified through a deep packet inspection technology, and the plug-in dynamically processes the traffic according to a deep packet inspection result, so that efficient, intelligent and refined network traffic management is realized.

Description

Technical Field

[0001] The present application relates to the field of network management technology and provides a traffic processing method, device, equipment and medium based on deep packet inspection. Background Art

[0002] Traditional traffic management methods mainly rely on basic means such as firewalls, packet filtering, and network address translation to control gateway traffic. Although these methods are effective in some scenarios, as the network becomes increasingly complex, especially when dealing with encrypted traffic, multiple protocols, and dynamic network environments, traditional traffic management methods are unable to accurately identify complex application layer protocols and can no longer meet the needs of refined traffic control. Summary of the invention

[0003] The present application provides a traffic processing method, device, equipment and medium based on deep packet inspection, which is used to solve the problem that traditional traffic management methods cannot accurately identify complex protocols.

[0004] In a first aspect, the present application provides a traffic processing method based on deep packet inspection, comprising: Receive a registration request of at least one plug-in, and save the at least one plug-in into an array corresponding to a target chain; wherein the registration request includes the target chain; the target chain is a PREROUTING chain or a FORWARD chain; When a target data packet enters the PREROUTING chain, extracting session information from the target data packet; Perform deep packet inspection analysis based on the session information to obtain analysis results; When the target data packet enters the target chain, calling the at least one plug-in in sequence according to a preset priority; The at least one plug-in processes the target data packet according to the analysis result.

[0005] Optionally, the session information includes an IP address, port information, and protocol information; and performing deep packet inspection analysis according to the session information to obtain an analysis result includes: Obtaining the protocol type of the target data packet according to the port information and the protocol information; Obtaining the traffic type of the target data packet according to the port information and the protocol information; Malicious traffic analysis is performed based on the IP address to obtain a security detection result of whether the target data packet is malicious traffic.

[0006] Optionally, the at least one plug-in includes a malicious traffic detection plug-in and a traffic optimization plug-in; the at least one plug-in processes the target data packet according to the analysis result, including: If the malicious traffic detection plug-in determines that the target data packet is malicious traffic, the target data packet is discarded and a security alarm is triggered; If the malicious traffic detection plug-in determines that the target data packet is not malicious traffic, the traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type.

[0007] Optionally, the traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type, including: If the traffic optimization plug-in determines that the traffic type is voice traffic or video traffic, the priority of the target data packet is increased by modifying the DSCP value; If the traffic optimization plug-in determines that the traffic type is P2P traffic, the priority of the target data packet is lowered by modifying the DSCP value, and the bandwidth of the target data packet is limited.

[0008] Optionally, the IP address includes a target IP address; after the traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type, the method further includes: If the traffic optimization plug-in determines that the target data packet does not need to be redirected, forwarding the target data packet according to the target IP address; If the traffic optimization plug-in determines that the target data packet needs to be redirected, the target IP address is modified, and the target data packet is forwarded according to the modified target IP address.

[0009] Optionally, if the traffic optimization plug-in determines that the target data packet does not need to be redirected, before forwarding the target data packet according to the target IP address, the method further includes: The traffic optimization plug-in determines whether the target data packet needs to be redirected according to the protocol type and the target IP address.

[0010] Optionally, the at least one plug-in includes a traffic statistics plug-in, and before the malicious traffic detection plug-in determines that the target data packet is malicious traffic, the target data packet is discarded and a security alarm is triggered, the method further includes: The traffic statistics plug-in counts the traffic proportions of different protocol types in historical traffic according to the protocol type of the target data packet; the historical traffic includes the target data packet.

[0011] In a second aspect, the present application provides a traffic processing device based on deep packet inspection, comprising: A plug-in registration module, used to receive a registration request of at least one plug-in, and save the at least one plug-in into an array corresponding to a target chain; wherein the registration request includes the target chain; the target chain is a PREROUTING chain or a FORWARD chain; A deep packet inspection and analysis module is used to extract session information from a target data packet when the target data packet enters the PREROUTING chain; perform deep packet inspection and analysis based on the session information to obtain an analysis result; A plug-in calling module, configured to call the at least one plug-in in sequence according to a preset priority when the target data packet enters the target chain; A plug-in processing module is used for the at least one plug-in to process the target data packet according to the analysis result.

[0012] In a third aspect, the present application provides a gateway device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the traffic processing method based on deep packet inspection described in the first aspect.

[0013] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and a processor executes the computer program to implement the traffic processing method based on deep packet inspection described in the first aspect.

[0014] Compared with the prior art, the beneficial effects of this application are as follows: The present application provides a traffic processing method based on deep packet inspection, the method comprising: receiving a registration request of at least one plug-in, and saving at least one plug-in to an array corresponding to a target chain; wherein the registration request includes a target chain; the target chain is a PREROUTING chain or a FORWARD chain; when a target data packet enters the PREROUTING chain, extracting session information from the target data packet; performing deep packet inspection and analysis based on the session information to obtain an analysis result; when a target data packet enters the target chain, calling at least one plug-in in sequence according to a preset priority; and at least one plug-in processing the target data packet based on the analysis result.

[0015] This application uses deep packet inspection technology to deeply analyze the content of the target data packet, can identify complex application layer protocols and traffic types, and external plug-ins can flexibly register and call back according to traffic characteristics. At different stages of the gateway device (PREROUTING chain and FORWARD chain), the target data packet is dynamically processed (such as optimization, discarding, forwarding, etc.) based on the deep packet inspection analysis results, thereby realizing efficient, intelligent and refined network traffic management. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0017] Figure 1 A schematic diagram of the structure of a gateway device in the hardware operating environment involved in the embodiment of the present application; Figure 2 A flow chart of a traffic processing method based on deep packet inspection provided in an embodiment of the present application; Figure 3 Some code examples provided for this application example Figure 1 ; Figure 4 Some code examples provided for this application example Figure 2 ; Figure 5 Some code examples provided for this application example Figure 3 ; Figure 6 Some code examples provided for this application example Figure 4 ; Figure 7 A schematic diagram of the processing flow of the plug-in provided in the embodiment of the present application; Figure 8 A schematic diagram of the structure of a traffic processing device based on deep packet inspection provided in an embodiment of the present application.

[0018] Markings in the figure: 101 - processor, 102 - communication bus, 103 - network interface, 104 - user interface, 105 - memory. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0020] In order to solve the problem that traditional traffic management methods cannot accurately identify complex protocols, an embodiment of the present application provides a traffic processing method based on deep packet inspection, which can be executed by a gateway device, such as a PON gateway, FTTR gateway, converged gateway, government and enterprise gateway, etc.

[0021] 1. PON Gateway: A gateway device based on Passive Optical Network (PON) technology that converts optical signals from a fiber optic network into Ethernet signals for use by home or office network devices.

[0022] 2. FTTR Gateway: A gateway device that connects the optical fiber to the room, converts the optical fiber signal into an electrical signal, and provides a network connection through the home wiring (such as Ethernet or Wi-Fi).

[0023] 3. Converged gateway: A gateway device that integrates multiple functions and can usually support different types of access technologies at the same time, such as ADSL, PON, LTE, WiFi, etc., aiming to provide users with one-stop network connection services.

[0024] 4. Government and enterprise gateway: A high-performance, highly secure gateway device designed specifically for government and enterprise networks, mainly used to connect internal enterprise or government local area networks (LANs) with external Internet or wide area networks (WANs).

[0025] Please refer to Figure 1 , which is a schematic diagram of the gateway device structure of the hardware operating environment involved in the embodiment of the present application.

[0026] like Figure 1 As shown, the gateway device may include: a processor 101, such as a central processing unit (CPU), a communication bus 102, a user interface 104, a network interface 103, and a memory 105. Among them, the communication bus 102 is used to realize the connection and communication between these components. The user interface 104 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 104 may include a standard wired interface and a wireless interface. The network interface 103 may include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 105 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 105 may optionally also be a storage device independent of the aforementioned processor 101.

[0027] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation of the device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0028] like Figure 1 As shown, the memory 105 as a storage medium may include an operating system, a network communication module, a user interface module, and a traffic processing device based on deep packet inspection.

[0029] exist Figure 1 In the gateway device shown, the network interface 103 is mainly used for data communication with the network server; the user interface 104 is mainly used for data interaction with the user; the processor 101 and the memory 105 in the gateway device of the present invention can be set in the gateway device, and the gateway device calls the deep packet inspection-based traffic processing device stored in the memory 105 through the processor 101, and executes the deep packet inspection-based traffic processing method provided in the embodiment of the present application.

[0030] based on Figure 1 The gateway device shown below Figure 2 A traffic processing method based on deep packet inspection is introduced as shown.

[0031] S201. Receive a registration request of at least one plug-in, and save the at least one plug-in into an array corresponding to a target chain.

[0032] In the specific implementation process, any plug-in can initiate a registration request to the gateway device through the ctSgw_appRegisterFunc() function, so that the gateway device knows that the plug-in can process the traffic after Deep Packet Inspection (DPI) analysis.

[0033] The registration request includes the target chain, which is the PREROUTING chain or the FORWARD chain. If the target chain is the PREROUTING chain, the gateway device saves the plug-in to the g_preProcInfo[] array so that the plug-in is registered on the PREROUTING chain and can be called when traffic enters the PREROUTING chain. If the target chain is the FORWARD chain, the gateway device saves the plug-in to the g_forwardProcInfo[] array so that the plug-in is registered on the FORWARD chain and can be called when traffic enters the FORWARD chain.

[0034] It should be noted that the gateway device supports multiple plug-in registrations, each of which can provide different functions, such as malicious traffic detection plug-ins, traffic optimization plug-ins, traffic statistics plug-ins, etc., allowing these plug-ins to perform in-depth detection of traffic on the PREROUTING chain or FORWARD chain. The core code is as follows Figure 3 As shown, ctSgw_appRegisterFunc() is used to register the plug-in.

[0035] In a possible embodiment, the gateway device includes a plug-in information management module, which is used to provide plug-in information registration and query functions, and the gateway device dynamically loads the plug-in according to the description provided by the plug-in.

[0036] S202: When the target data packet enters the PREROUTING chain, extract session information from the target data packet.

[0037] In the specific implementation process, the PREROUTING hook is triggered when the data packet just enters the gateway device (before the routing decision), and the FORWARD hook is triggered when the data packet is forwarded by the routing decision. Therefore, after the target data packet enters the gateway device, it will first enter the PREROUTING chain and then the FORWARD chain. The nf_conntrack module is a connection tracking module in the Linux kernel, which is used to track network connections through firewalls or routers. When the target data packet enters the PREROUTING chain, the gateway device can capture the target data packet in real time through the nf_conntrack module, extract the session information from the target data packet, and finally encapsulate the session information into a CtSgwTupleInfo structure.

[0038] Among them, the session information is the key feature of the target data packet, including IP address, port information, protocol information and session status. The IP address includes the source IP address and the target IP address, the port information includes the source port and the target port, the protocol information includes the transport layer protocol, and the session status is used to indicate whether it is a new session. The CtSgwTupleInfo structure is shown in Table 1.

[0039] Table 1

[0040] S203: Perform deep packet inspection analysis based on the session information to obtain analysis results.

[0041] In a possible embodiment, the protocol type of the target data packet is obtained based on the port information and the protocol information; the traffic type of the target data packet is obtained based on the port information and the protocol information; malicious traffic analysis is performed based on the IP address to obtain the security detection result of the target data packet.

[0042] In the specific implementation process, the gateway device can perform DPI analysis based on the CtSgwTupleInfo structure. First, the protocol type of the target data packet (such as HTTP, HTTPS, DNS, FTP, etc.) can be determined by using DPI rule matching based on the port information and protocol information.

[0043] For example: If the target port is 80 and the transport layer protocol is TCP, the protocol type of the target data packet is determined to be HTTP. If the target port is 443 and the transport layer protocol is TCP, the protocol type of the target data packet is determined to be HTTPS. If the target port is 53 and the transport layer protocol is UDP, the protocol type of the target data packet is determined to be DNS. If the target port is 21 and the transport layer protocol is TCP, the protocol type of the target data packet is determined to be FTP.

[0044] Then, the gateway device can obtain the traffic type of the target data packet based on the port information and protocol information, such as video traffic (YouTube, Netflix), P2P traffic (BitTorrent), voice traffic (VoIP), etc.

[0045] Common port information and protocols for video traffic are as follows: 1. Real-Time Messaging Protocol (RTMP): The default port is 1935 and the transport layer protocol is TCP.

[0046] 2. Microsoft Media Services (MMS): The default port is 1755 and the transport layer protocol is TCP.

[0047] 3. Real-Time Streaming Protocol (RTSP): The default port is 554 and the transport layer protocol is TCP.

[0048] Common port information and protocols for P2P traffic are as follows: 1. BitTorrent: The default port is 6881-6889 and the transport layer protocol is TCP.

[0049] 2. eMule: The default port is 4662 and the transport layer protocol is TCP.

[0050] 3. eDonkey: The default port is 4242 and the transport layer protocol is TCP.

[0051] Common port information and protocols for voice traffic are as follows: 1. Session Initiation Protocol (SIP): The commonly used port is 5060 and the transport layer is TCP or UDP.

[0052] 2. Real-Time Protocol (RTP): The commonly used port range is [16384, 32767] and the transmission protocol is UDP.

[0053] 3. H.323: The commonly used port is 1720 and the transmission protocol is TCP.

[0054] Finally, there are many ways for gateway devices to perform malicious traffic analysis, which are introduced below.

[0055] The first method: matching malicious IP addresses.

[0056] The gateway device has a pre-stored blacklist that contains some malicious IP addresses, which are usually related to known attack sources, botnets, or bad actors. The gateway device can match the target IP address of the target data packet with the malicious IP address in the blacklist. If the match is successful, it means that the target data packet is malicious traffic.

[0057] The second method: detecting abnormal behavior.

[0058] The gateway device can also perform DPI analysis to extract potential attack features by analyzing the packet header, data payload, and other contents of the target data packet, thereby determining whether the target data packet has abnormal behavior. If so, it means that the target data packet is malicious traffic.

[0059] For example, Distributed Denial of Service (DDoS) attacks and port scan attacks. DDoS attacks are often accompanied by an abnormal increase in traffic, especially a surge in traffic to a specific target. DDoS attacks can be identified through traffic pattern analysis. Attackers may scan the open ports of the system to find potential vulnerabilities. Port scan attacks can be identified by detecting unconventional port access patterns, frequent requests, or scanning of a wide range of ports.

[0060] The third method: identifying the signature code.

[0061] A signature code refers to a specific pattern, character string or behavioral feature in a data packet. Based on DPI analysis, the gateway device can perform a detailed analysis of the data packet content. If a signature code is identified, it means that the target data packet is malicious traffic.

[0062] For example, if a Trojan communicates with its control server (C2), its signature may be a specific URL path in the request, such as / update.php?cmd=run or a specific identifier, such as X-Trojan-ID:1234567.

[0063] In a possible embodiment, the gateway device includes a DPI analysis module, which is responsible for traffic parsing, session management and DPI analysis. The DPI session context is created through the dpi_if_call_ctx_create() function, and the DPI analysis result is stored in ct->layer7_id, and the nf_conntrack event is monitored to update the session information in real time. The core code is as follows Figure 4 shown.

[0064] S204: When the target data packet enters the target chain, at least one plug-in is called in sequence according to the priority.

[0065] In the specific implementation process, multiple plug-ins may be registered on the PREROUTING chain and the FORWARD chain. For example, the PREROUTING chain has registered malicious traffic detection plug-ins and traffic statistics plug-ins, and the FORWARD chain has registered traffic optimization plug-ins. When the target data packet enters the PREROUTING chain, at least one plug-in registered on the PREROUTING chain is called in sequence according to the priority. When the target data packet enters the FORWARD chain, at least one plug-in registered on the FORWARD chain is called in sequence according to the priority.

[0066] S205. At least one plug-in processes the target data packet according to the analysis result.

[0067] In a possible embodiment, if the malicious traffic detection plug-in determines that the target data packet is malicious traffic, the target data packet is discarded and a security alarm is triggered. If the malicious traffic detection plug-in determines that the target data packet is not malicious traffic, the traffic optimization plug-in optimizes the traffic of the target data packet according to the traffic type.

[0068] In the specific implementation process, the malicious traffic detection plug-in is first called to identify whether the target data packet is malicious traffic based on the security detection results in the DPI analysis results. If so, the target data packet is discarded through the DPI_DNY operation. Some codes are as follows Figure 5 If not, call the traffic optimization plug-in to further optimize the traffic.

[0069] In the embodiments of the present application, by combining DPI technology and plug-ins, malicious traffic can be detected and intercepted in real time, which can effectively identify and prevent various network attacks, protect the network from the intrusion of malicious traffic, and ensure the security and stability of the network.

[0070] In a possible embodiment, the traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type, including: If the traffic optimization plug-in determines that the traffic type is voice traffic or video traffic, it increases the priority of the target data packet by modifying the DSCP value; If the traffic optimization plug-in determines that the traffic type is P2P traffic, it lowers the priority of the target data packet by modifying the DSCP value and limits the bandwidth of the target data packet.

[0071] In the specific implementation process, Differentiated Services Code Point (DSCP) is a technology used for quality of service (QoS) management in IP packets, mainly used for priority marking of network traffic. It is embedded in the 6-bit DSCP field in the IP header and is used to identify the priority of traffic between routers and switches, thereby supporting different processing methods for different types of traffic.

[0072] By modifying the DSCP value, you can increase the priority of video traffic, reduce jamming, and ensure low latency and high-quality video playback. By modifying the DSCP value, you can increase the priority of voice traffic and ensure that voice traffic is processed first to avoid loss of call quality. By modifying the DSCP value, you can lower the priority of P2P traffic and limit the bandwidth of P2P traffic (limit the maximum upload and download rate of P2P traffic) to ensure that it does not occupy too much bandwidth, thereby avoiding bandwidth restrictions for other applications.

[0073] The traffic optimization plug-in can perform QoS optimization through dpi_set_qos() and dpi_set_dscp(), perform DSCP marking based on the DPI analysis results to control traffic priority, and process the DPI results through dpi_session_handing() to decide whether to perform NAT or QoS optimization. Some codes are as follows Figure 6 shown.

[0074] In the embodiment of the present application, based on the DPI analysis results, the DSCP value is dynamically adjusted to increase the priority of key traffic, optimize the scheduling of network traffic, ensure the priority transmission of key traffic, and effectively improve network performance, reduce delays and packet loss. Combined with QoS strategy and feedback mechanism, flexible traffic management can be achieved, ensuring that network resources are reasonably allocated and improving the reliability of key applications.

[0075] In a possible embodiment, after the traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type, the method further includes: If the traffic optimization plug-in determines that the target data packet does not need to be redirected, the target data packet is forwarded according to the target IP address; if the traffic optimization plug-in determines that the target data packet needs to be redirected, the target IP address is modified and the target data packet is forwarded according to the modified target IP address.

[0076] In the specific implementation process, the traffic optimization plug-in determines whether the target data packet needs to be redirected based on the protocol type and the target IP address. For example, DNS hijacking: If the protocol type of the target data packet is DNS and the target IP address is 8.8.8.8, the target data packet may be redirected to the intranet DNS. Or for example, HTTP proxy: If the protocol type of the target data packet is HTTP, the target data packet may be redirected to a transparent proxy.

[0077] In a possible embodiment, if the malicious traffic detection plug-in determines that the target data packet is malicious traffic, before discarding the target data packet and triggering a security alarm, the method further includes: The traffic statistics plug-in counts the traffic proportion of different protocol types in historical traffic based on the protocol type of the target data packet; the historical traffic includes the target data packet.

[0078] In the specific implementation process, the gateway device records the protocol type of each data packet in the historical traffic (including the target data packet) after each DPI analysis. The traffic statistics plug-in can calculate the traffic proportion of each protocol type in the historical traffic based on the number of packets of each protocol type, the amount of data (bytes), or the duration of the traffic. These methods are introduced below.

[0079] Method 1: You can calculate the ratio between the number of packets of each protocol type and the number of packets of historical traffic to obtain the traffic proportion of different protocol types.

[0080] Method 2: You can calculate the ratio between the data volume (bytes) of each protocol type and the data volume (bytes) of historical traffic to obtain the traffic proportion of different protocol types.

[0081] Method 3: The ratio between the duration of traffic of each protocol type and the duration of traffic of historical traffic can be calculated to obtain the traffic proportion of different protocol types.

[0082] In the embodiment of the present application, the plug-in counts the traffic proportion of different protocol types in the historical traffic, thereby performing traffic monitoring, which can help administrators analyze bandwidth usage and then dynamically adjust bandwidth in the network. If the traffic proportion of a certain protocol suddenly increases, traffic monitoring can help administrators identify potential risks and make adjustments or expansions in advance.

[0083] Please refer to Figure 7 , which is a schematic diagram of the processing flow of the plug-in provided in an embodiment of the present application.

[0084] 1. Plug-in registration: The plug-in is registered using ctSgw_appRegisterFunc(), so that the gateway device knows that the plug-in can be used to process traffic after DPI analysis.

[0085] 2. Gateway calls the plug-in interface: When traffic reaches the PREROUTING chain or FORWARD chain, the gateway device calls the registered plug-in.

[0086] 3. Plug-in callback interface: The plug-in receives traffic information and performs DPI analysis.

[0087] 4. The plug-in performs traffic analysis: The plug-in performs corresponding processing based on the analysis results of DPI, such as QoS optimization, discarding, modifying NAT rules, etc.

[0088] In summary, the present application provides a traffic processing method based on deep packet inspection, which has the following beneficial effects: 1. Deep traffic analysis: Combined with deep packet inspection technology, it can comprehensively analyze application layer data, identify potential security threats and abnormal traffic, and improve network security.

[0089] 2. Dynamic QoS management: Through DSCP settings, the traffic priority can be dynamically adjusted according to different application requirements and network status, effectively ensuring the bandwidth and delay requirements of key applications.

[0090] 3. Flexible scalability: Supports user-defined plug-ins, allowing users to expand data packet processing logic according to different needs to meet network traffic management needs in different scenarios.

[0091] 4. Efficient connection management: Through the connection tracking mechanism, it is possible to monitor the connection status in real time and perform different processing operations according to the connection type, thereby improving the flexibility and efficiency of network traffic processing.

[0092] Based on the same inventive concept, the present application also provides a traffic processing device based on deep packet inspection, such as Figure 8 As shown, the device comprises: A plug-in registration module, used for receiving a registration request of at least one plug-in, and saving at least one plug-in into an array corresponding to a target chain; wherein the registration request includes a target chain; the target chain is a PREROUTING chain or a FORWARD chain; The deep packet inspection and analysis module is used to extract the session information from the target data packet when the target data packet enters the PREROUTING chain; perform deep packet inspection and analysis based on the session information to obtain the analysis result; A plug-in calling module, used for calling at least one plug-in in sequence according to a preset priority when a target data packet enters a target chain; The plug-in processing module is used for at least one plug-in to process the target data packet according to the analysis result.

[0093] It should be noted that each module in the traffic processing device based on deep packet inspection in this embodiment corresponds one-to-one to each step in the traffic processing method based on deep packet inspection in the aforementioned embodiment. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned traffic processing method based on deep packet inspection, which will not be repeated here.

[0094] In addition, in one embodiment, the present application also provides a gateway device, which includes a processor, a memory, and a computer program stored in the memory, and the computer program implements the aforementioned deep packet inspection-based traffic processing method when executed by the processor.

[0095] In addition, in one embodiment, the present application also provides a computer storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the aforementioned traffic processing method based on deep packet inspection is implemented.

[0096] In some embodiments, the computer readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or various devices including one or any combination of the above memories. The computer may be various computing devices including intelligent terminals and servers.

[0097] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0098] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file storing other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0099] By way of example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one site, or on multiple computing devices distributed across multiple sites and interconnected by a communication network.

[0100] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0101] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not indicate the advantages or disadvantages of the embodiments.

[0102] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software optical communication device, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a multimedia terminal device to execute the methods described in each embodiment of the present application.

[0103] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A traffic processing method based on deep packet inspection, characterized in that: include: Receive a registration request of at least one plug-in, and save the at least one plug-in into an array corresponding to a target chain; wherein the registration request includes the target chain; the target chain is a PREROUTING chain or a FORWARD chain; When a target data packet enters the PREROUTING chain, extracting session information from the target data packet; Perform deep packet inspection analysis based on the session information to obtain analysis results; When the target data packet enters the target chain, calling the at least one plug-in in sequence according to a preset priority; The at least one plug-in processes the target data packet according to the analysis result.

2. The traffic processing method based on deep packet inspection according to claim 1, characterized in that: The session information includes IP address, port information and protocol information; The performing deep packet inspection analysis according to the session information to obtain the analysis result includes: Obtaining the protocol type of the target data packet according to the port information and the protocol information; Obtaining the traffic type of the target data packet according to the port information and the protocol information; Malicious traffic analysis is performed based on the IP address to obtain a security detection result of whether the target data packet is malicious traffic.

3. The traffic processing method based on deep packet inspection according to claim 2, characterized in that: The at least one plug-in includes a malicious traffic detection plug-in and a traffic optimization plug-in; The at least one plug-in processes the target data packet according to the analysis result, including: If the malicious traffic detection plug-in determines that the target data packet is malicious traffic, the target data packet is discarded and a security alarm is triggered; If the malicious traffic detection plug-in determines that the target data packet is not malicious traffic, the traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type.

4. The traffic processing method based on deep packet inspection according to claim 3, characterized in that: The traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type, including: If the traffic optimization plug-in determines that the traffic type is voice traffic or video traffic, the priority of the target data packet is increased by modifying the DSCP value; If the traffic optimization plug-in determines that the traffic type is P2P traffic, the priority of the target data packet is lowered by modifying the DSCP value, and the bandwidth of the target data packet is limited.

5. The traffic processing method based on deep packet inspection according to claim 3, characterized in that: The IP address includes a target IP address; After the traffic optimization plug-in performs traffic optimization on the target data packet according to the traffic type, the method further includes: If the traffic optimization plug-in determines that the target data packet does not need to be redirected, forwarding the target data packet according to the target IP address; If the traffic optimization plug-in determines that the target data packet needs to be redirected, the target IP address is modified, and the target data packet is forwarded according to the modified target IP address.

6. The traffic processing method based on deep packet inspection according to claim 5, characterized in that: If the traffic optimization plug-in determines that the target data packet does not need to be redirected, before forwarding the target data packet according to the target IP address, the method further includes: The traffic optimization plug-in determines whether the target data packet needs to be redirected according to the protocol type and the target IP address.

7. The traffic processing method based on deep packet inspection according to claim 3, characterized in that: The at least one plug-in includes a traffic statistics plug-in. If the malicious traffic detection plug-in determines that the target data packet is malicious traffic, before the target data packet is discarded and a security alarm is triggered, the method further includes: The traffic statistics plug-in counts the traffic proportions of different protocol types in historical traffic according to the protocol type of the target data packet; the historical traffic includes the target data packet.

8. A traffic processing device based on deep packet inspection, characterized in that: include: A plug-in registration module, used to receive a registration request of at least one plug-in, and save the at least one plug-in into an array corresponding to a target chain; wherein the registration request includes the target chain; the target chain is a PREROUTING chain or a FORWARD chain; A deep packet inspection and analysis module is used to extract session information from a target data packet when the target data packet enters the PREROUTING chain; perform deep packet inspection and analysis based on the session information to obtain an analysis result; A plug-in calling module, configured to call the at least one plug-in in sequence according to a preset priority when the target data packet enters the target chain; A plug-in processing module is used for the at least one plug-in to process the target data packet according to the analysis result.

9. A gateway device, characterized in that: The gateway device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the traffic processing method based on deep packet inspection as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the processor executes the computer program to implement the traffic processing method based on deep packet inspection as described in any one of claims 1 to 7.

Images