Network traffic application identification method and system based on dynamic rule

Abstract

The invention relates to a network flow application identification method and system based on a dynamic rule, and the method comprises the steps: responding to a received message, analyzing the message, and checking the flow information of the message; if the flow information contains the APPID, applying the APPID to the message and the flow information and ending; if not, identifying the message through a preset message matching rule, acquiring the APPID and applying the APPID to the message and the flow information; if the identification of the message matching rule fails, extracting message feature information based on a preset feature extraction rule, identifying the feature information through the preset feature matching rule, obtaining APPID and applying the APPID to the message and flow information; and if feature extraction or feature matching fails, identifying the message through a preset dynamic rule, obtaining the APPID and applying the APPID to the message and the flow information. The identification rule is automatically generated through a small number of rules, and the maintenance cost is reduced. APPID is returned in advance by using a flow table and packet counting, so that the performance is improved. The dynamic rule adopts IP + PORT or IP identification, and the identification result APPID is updated to message and flow information.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic, and in particular, to a method and system for identifying network traffic applications based on dynamic rules. Background Art

[0002] Network traffic application identification is an important technology for parsing and analyzing network traffic to determine the applications or services to which it belongs. Its identification results are crucial for the fine management and control of network traffic (such as speed limiting, ACL, policy routing, etc.), and directly affect network service quality, security, and resource optimization.

[0003] Existing network traffic identification methods mainly include port identification, DPI (Deep Packet Inspection), and DFI (Deep Flow Inspection). Among them, DPI is currently the most main identification method in the production environment. DPI identifies applications by loading application identification rules and matching the payload content of packets. Port identification and DFI are usually used as auxiliary identification means due to their relatively low identification rate and accuracy.

[0004] However, the existing technology faces increasingly severe challenges and has significant defects. As the core identification method, the effectiveness of DPI highly depends on extracting application features from the packet payload and performing rule matching. However, with the improvement of network security requirements, more and more network traffic is transmitted in an encrypted manner, and the encryption key is dynamically negotiated, making it extremely difficult to extract effective application features from encrypted packets. At the same time, a large number of applications begin to use private protocols, and their features are also difficult to extract. This results in difficulty in writing and maintaining effective DPI identification rules for these encrypted traffic and private protocol traffic. As a result, fewer and fewer applications can be identified by the DPI method, and the overall identification rate has decreased significantly. The existing methods are difficult to accurately identify this growing part of the traffic. Therefore, the current network traffic application identification technology cannot fully meet the actual application requirements. Summary of the Invention

[0005] The purpose of the present invention is to provide a method and system for identifying network traffic applications based on dynamic rules to solve the problem that the existing technology has a low identification rate and cannot meet the actual needs.

[0006] To achieve one of the above-mentioned invention purposes, an embodiment of the present invention provides a method for identifying network traffic applications based on dynamic rules, the method includes,

[0007] In response to receiving a packet, parse the packet and check its flow information; if the flow information contains an APPID, apply the APPID to the packet and the flow information and end; if not, identify the packet through a preset packet matching rule, obtain the APPID and apply it to the packet and the flow information;

[0008] If the message matching rule recognition fails, the message feature information is extracted based on a preset feature extraction rule, the feature information is recognized through a preset feature matching rule, and the APPID is obtained and applied to the message and flow information;

[0009] If the feature extraction or feature matching fails, the message is recognized through a preset dynamic rule, and the APPID is obtained and applied to the message and flow information.

[0010] As a further improvement of an embodiment of the present invention, the method further includes that the recognizing the message through a preset message matching rule includes,

[0011] If the flow information does not include the APPID, the protocol information of the second to fourth layers of the message is parsed, and it is determined whether to perform application recognition through the preset message matching rule according to the parsed protocol type;

[0012] The message matching rule is an identification rule including an IP address, a port, a message size, a message content, and an APPID.

[0013] As a further improvement of an embodiment of the present invention, the method further includes that the recognizing the message through a preset message matching rule further includes,

[0014] If the fourth-layer protocol type of the message is TCP or UDP, application recognition is performed through the preset message matching rule to obtain the APPID;

[0015] If the fourth-layer protocol type of the message is not TCP or UDP, the predefined APPID corresponding to the highest-layer protocol recognizable by the message is applied to the message and flow information.

[0016] As a further improvement of an embodiment of the present invention, the method further includes that the extracting the message feature information based on a preset feature extraction rule includes,

[0017] The message feature information includes: domain name information and / or corresponding IP address information in a Domain Name System (DNS) protocol message, Header field information or Body field information in a Hypertext Transfer Protocol (HTTP) protocol message, or predefined field content in a private protocol message and its corresponding IP address information;

[0018] The preset feature extraction rule includes at least one extraction rule corresponding to the message feature information.

[0019] As a further improvement of an embodiment of the present invention, the method further includes that the recognizing the feature information through a preset feature matching rule includes,

[0020] If the APPID of the feature information is successfully identified through the preset feature matching rule, then use this APPID to apply to the message and flow information;

[0021] The feature matching rule is an identification rule that includes a string or byte sequence and an APPID.

[0022] As a further improvement of an embodiment of the present invention, the method further includes that the identifying the message through the preset dynamic rule includes,

[0023] The preset dynamic rule includes a rule based on IP address and port or a rule based on IP address, and the preset dynamic rule is updated after being successfully identified based on the message matching rule or the feature matching rule;

[0024] If the packet count of the message is greater than the preset threshold, then identify it through the preset dynamic rule; if it is less than or equal to the preset threshold, then apply the predefined APPID corresponding to the highest layer protocol that the message can identify to the message and flow information.

[0025] As a further improvement of an embodiment of the present invention, the method further includes that the identifying the message through the preset dynamic rule further includes,

[0026] If the APPID is not identified through the preset dynamic rule, then apply the predefined APPID corresponding to the highest layer protocol that the message can identify to the message and flow information.

[0027] To achieve one of the above-mentioned invention purposes, an embodiment of the present invention further provides a network traffic application identification system based on a dynamic rule, and the system includes a message matching module, a feature extraction module and a dynamic identification module;

[0028] The message matching module is used to respond to receiving a message, parse the message and check its flow information; if the flow information contains an APPID, then apply this APPID to the message and flow information and end; if it does not contain, then identify the message through the preset message matching rule, obtain the APPID and apply it to the message and flow information;

[0029] The feature extraction module is used to if the message matching rule identification fails, then extract the message feature information based on the preset feature extraction rule, identify the feature information through the preset feature matching rule, obtain the APPID and apply it to the message and flow information;

[0030] The dynamic identification module is used to if the feature extraction or feature matching fails, then identify the message through the preset dynamic rule, obtain the APPID and apply it to the message and flow information.

[0031] To achieve one of the above-mentioned invention purposes, an embodiment of the present invention further provides an electronic device, including a memory and a processor. It is characterized in that a computer program that can run on the processor is stored in the memory, and when the program is executed on the processor, the steps in the above-mentioned method for identifying network traffic applications based on dynamic rules are implemented.

[0032] To achieve one of the above-mentioned invention purposes, an embodiment of the present invention further provides a storage medium. The storage medium stores a computer program, and it is characterized in that when the computer program is executed by a processor, the steps in the above-mentioned method for identifying network traffic applications based on dynamic rules are implemented.

[0033] Compared with the prior art, the present invention provides a method and system for identifying network traffic applications based on dynamic rules. As a supplement to the existing identification solutions, it does not require redeveloping the identification engine, can identify encrypted traffic and private protocol traffic, and expands the identification scope. It automatically generates identification rules through a small number of rules, reducing the maintenance cost. It uses flow tables and packet counts to return the APPID in advance, improving the performance. The dynamic rules use IP+PORT or IP for identification, and the identification result APPID is updated to the packet and flow information, supporting functions such as traffic statistics, ACL, rate limiting, and load balancing, and optimizing network management. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is the overall flowchart of the method for identifying network traffic applications based on dynamic rules of the present invention.

[0035] Figure 2 is the specific flowchart of the method for identifying network traffic applications based on dynamic rules of the present invention.

[0036] Figure 3 is the schematic architecture diagram of the system for identifying network traffic applications based on dynamic rules of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0037] The present invention will be described in detail below in conjunction with the specific embodiments shown in the drawings. However, these embodiments do not limit the present invention, and any structural, method, or functional transformation made by those of ordinary skill in the art based on these embodiments is included in the protection scope of the present invention.

[0038] The embodiments of the present invention will be described in detail below. Examples of the embodiments are shown in the drawings, where the same or similar reference numerals represent the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

[0039] In the first embodiment of the present invention, the present invention provides a method for identifying network traffic applications based on dynamic rules, as Figure 1 , 2 shown. The method includes:

[0040] S1: In response to receiving a packet, parse the packet and check its flow information; if the flow information contains an APPID, apply the APPID to the packet and the flow information and end; if not, identify the packet through a preset packet matching rule, obtain the APPID, and apply it to the packet and the flow information;

[0041] S2: If the packet matching rule fails to identify, extract the packet feature information based on a preset feature extraction rule, identify the feature information through a preset feature matching rule, obtain the APPID, and apply it to the packet and the flow information;

[0042] S3: If the feature extraction or feature matching fails, identify the packet through a preset dynamic rule, obtain the APPID, and apply it to the packet and the flow information.

[0043] In a specific embodiment of the present invention, identifying a packet through a preset packet matching rule specifically means:

[0044] If the flow information does not contain an APPID, parse the protocol information of the second to fourth layers of the packet, and determine whether to perform application identification through the preset packet matching rule according to the parsed protocol type;

[0045] The packet matching rule is an identification rule including IP address, port, packet size, packet content, and APPID.

[0046] It should be noted that identifying a packet through a preset packet matching rule means that first, check whether the flow information to which the packet belongs already contains an APPID. If there is no APPID in the flow information, parse the protocol of the packet, extract the protocol information of the second layer (such as Ethernet protocol), the third layer (such as IP protocol), and the fourth layer (such as TCP or UDP protocol). Based on the parsed protocol type, determine whether it is suitable to use the preset packet matching rule for application identification. The packet matching rule is a predefined rule set, and each rule includes an IP address, a port, a packet size, a packet content, and the corresponding APPID, etc. By matching the IP address, port number, size, and payload of the packet, determine the application to which the packet belongs and obtain the corresponding APPID. The rules are stored using an efficient lookup structure (such as a hash table, AC multi-pattern matching, Trie, etc.) to ensure the performance of the identification process. ]

[0047] Furthermore, if the fourth layer protocol type of the packet is TCP or UDP, perform application identification through the preset packet matching rule to obtain the APPID;

[0048] If the fourth-layer protocol type of the packet is not TCP or UDP, apply the predefined APPID corresponding to the highest-layer protocol that can be recognized based on the packet to the packet and flow information.

[0049] It should be noted that when identifying a packet through a preset packet matching rule, if the parsed fourth-layer protocol is TCP or UDP, it indicates that the packet may contain recognizable application-layer data. At this time, application identification is performed through the packet matching rule. Specifically: match the IP address, port number, size, and payload of the packet with the IP address, port number, packet size, and packet content in the rule. If the match is successful, obtain the corresponding APPID in the rule. If the fourth-layer protocol is not TCP or UDP (such as ARP, ICMP, etc.), the application cannot be identified through the packet matching rule. At this time, according to the highest-layer protocol that can be parsed from the packet (for example, the IP protocol at the third layer or the ARP protocol at the second layer), look up the predefined protocol-APPID mapping table, obtain the corresponding predefined APPID, and apply this APPID to the packet and flow information for subsequent modules to use. The predefined APPID in the mapping table is set during system initialization to ensure global uniqueness.

[0050] In a specific embodiment of the present invention, packet feature information is extracted based on a preset feature extraction rule. Specifically,

[0051] The packet feature information includes: domain name information and / or corresponding IP address information in a Domain Name System (DNS) protocol packet, Header field information or Body field information in a Hypertext Transfer Protocol (HTTP) protocol packet, or predefined field content and its corresponding IP address information in a private protocol packet;

[0052] The preset feature extraction rule includes at least one extraction rule corresponding to the packet feature information.

[0053] It should be noted that extracting message feature information based on preset feature extraction rules means that for messages of different protocol types, specific feature extraction rules are applied to extract feature data that can identify the application from the application layer or relevant fields of the message. The message feature information specifically includes: for Domain Name System (DNS) protocol messages, domain name information and / or corresponding IP address information are extracted to identify applications related to DNS requests; for Hypertext Transfer Protocol (HTTP) protocol messages, according to the encapsulation formats of different enterprise applications, HTTP Header field information (such as User-Agent or Host fields) or Body field information (such as specific keywords) is extracted, and combined with IP address information to identify application characteristics; for private protocol messages, since the protocol format is not public, the field positions and contents (such as specific identifiers or data blocks) are predefined, and combined with the corresponding IP address information to extract features to support application identification. The preset feature extraction rules are a pre-configured rule set, which at least contains one extraction rule for the above-mentioned feature information types, and the field positions, lengths and extraction conditions are specified in the rules. The extraction process uses an efficient parsing algorithm to ensure that feature acquisition is quickly completed under the network throughput requirements, providing basic data for subsequent application identification.

[0054] In a specific embodiment of the present invention, the feature information is identified by preset feature matching rules. Specifically,

[0055] If the APPID of the feature information is successfully identified through the preset feature matching rules, then this APPID is used for the message and flow information.

[0056] The feature matching rules are identification rules that include strings or byte sequences and APPIDs.

[0057] It should be noted that identifying feature information through a preset feature matching rule means using the feature information extracted from the packet (such as domain name, HTTP field or private protocol field content and its corresponding IP address) to compare with the preset feature matching rule to determine the application to which the feature information belongs. The feature matching rule is a predefined rule set, and each rule contains an application feature (string or byte sequence) and a corresponding APPID. Based on the feature extraction result, the feature matching rule is searched to identify the application to which the extracted feature information belongs. For example, the string or byte sequence in the feature information is matched with the application feature (string or byte sequence) address in the rule. If the match is successful, it indicates that the feature information corresponds to a certain rule. At this time, the APPID in the rule is extracted and applied to the packet and flow information, specifically writing the APPID into the metadata field of the packet and the flow information table, so that subsequent modules (such as traffic statistics or rate limiting modules) can directly use it. The feature matching rule is stored using an efficient data structure (such as AC multi-pattern matching) to improve the matching efficiency and ensure that the identification process meets the real-time requirements. When the match fails, the subsequent dynamic rule identification process is entered.

[0058] In a specific embodiment of the present invention, the packet is identified through a preset dynamic rule. Specifically,

[0059] The preset dynamic rule includes a rule based on IP address and port or a rule based on IP address, and the preset dynamic rule is updated after the packet matching rule or the feature matching rule is successfully identified;

[0060] If the packet count of the packet is greater than a preset threshold, it is identified through the preset dynamic rule; if it is less than or equal to the preset threshold, it is applied to the packet and flow information based on the predefined APPID corresponding to the highest layer protocol that the packet can identify.

[0061] It should be noted that identifying a message through a preset dynamic rule means quickly matching the message using an application identification rule generated dynamically to determine the application to which it belongs. The preset dynamic rules include two categories: one is the rule based on IP address and port, which contains IP address, port, and APPID fields; the other is the rule based on IP address, which contains IP address and APPID fields. The preset dynamic rules are updated after successful identification based on the message matching rule or the feature matching rule. Specifically, when the message is successfully identified through the message matching rule, the IP address, port number, and the identified APPID of the message are extracted to generate a dynamic rule based on IP address and port; when the feature information is successfully identified through the feature matching rule, the IP address and the identified APPID in the feature information are extracted to generate a dynamic rule based on IP address. The generated dynamic rules are stored in the dynamic rule table for subsequent message identification. During identification, first, the packet count of the flow to which the message belongs (i.e., the number of messages that have been processed) is checked and compared with a preset threshold (the default value is 10, which can be configured during system initialization). If the packet count is greater than the preset threshold, the message is identified through the dynamic rule, specifically, the IP address and port number (or only the IP address) of the message are matched with the rules in the dynamic rule table to obtain the corresponding APPID; if the packet count is less than or equal to the preset threshold, the dynamic rule is not used, but the highest layer protocol that the message can identify (such as TCP, UDP, or ARP) is parsed, and the corresponding APPID is obtained according to the predefined protocol-APPID mapping table, and this APPID is written into the message metadata field and the flow information table for subsequent use. The dynamic rule table is stored using an efficient index structure (such as a hash table) to improve the matching performance. The update process of the dynamic rule table adopts an incremental method, only adding new rules when the identification is successful, and periodically cleaning up expired rules to maintain performance.

[0062] Furthermore, if the APPID is not identified through the preset dynamic rule, the predefined APPID corresponding to the highest layer protocol that the message can identify is applied to the message and the flow information.

[0063] It should be noted that if the APPID cannot be recognized through the preset dynamic rules, it indicates that the IP address and / or port number of the message do not match any rules in the dynamic rule table. At this time, the system will parse the highest-layer protocol that the message can recognize. For example, if the message is TCP or UDP, the highest-layer protocol is TCP / UDP; if it is ARP or ICMP, it is the corresponding protocol. Based on the highest-layer protocol, query the predefined protocol-APPID mapping table to obtain the corresponding predefined APPID. The mapping table is configured during system initialization to ensure that each protocol type corresponds to a unique APPID value. The obtained APPID is then written into the metadata field of the message and the flow information table to ensure that the message and flow information contain available application identifiers to support the processing of subsequent functional modules (such as ACL or rate limiting). This process serves as a fallback mechanism for failed dynamic rule recognition to ensure that all messages can obtain an APPID.

[0064] In the second embodiment of the present invention, the present invention provides a network traffic application recognition system based on dynamic rules, as Figure 3 shown. The system includes a message matching module 1, a feature extraction module 2, and a dynamic recognition module 3;

[0065] The message matching module 1 is used to, in response to receiving a message, parse the message and check its flow information; if the flow information contains an APPID, apply the APPID to the message and the flow information and end; if not, identify the message through the preset message matching rules, obtain the APPID, and apply it to the message and the flow information;

[0066] The feature extraction module 2 is used to, if the message matching rules fail to recognize, extract the message feature information based on the preset feature extraction rules, identify the feature information through the preset feature matching rules, obtain the APPID, and apply it to the message and the flow information;

[0067] The dynamic recognition module 3 is used to, if the feature extraction or feature matching fails, identify the message through the preset dynamic rules, obtain the APPID, and apply it to the message and the flow information.

[0068] In the third embodiment of the present invention, the present invention provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and the steps in the above-mentioned network traffic application recognition method based on dynamic rules are implemented when the program is executed on the processor.

[0069] In the fourth embodiment of the present invention, the present invention provides a storage medium, the storage medium stores a computer program, characterized in that the steps in the above-mentioned network traffic application recognition method based on dynamic rules are implemented when the computer program is executed by a processor.

[0070] In summary, it should be understood that although this specification is described in terms of embodiments, not every embodiment contains only one independent technical solution. This narrative style of the specification is only for clarity. Those skilled in the art should regard the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

[0071] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described modules can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0072] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0073] In addition, in each embodiment of the present application, the functional modules can be integrated into a processing module, or each module can exist physically alone, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of a combination of hardware and software functional modules.

[0074] The above integrated modules implemented in the form of software functional modules can be stored in a computer-readable storage medium. The above software functional modules stored in a storage medium include several instructions for causing a computer system (which can be a personal computer, a server, or a network system, etc.) or a processor to execute some steps of the methods described in each embodiment of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0075] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not intended to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments or perform equivalent replacements for some of the technical features. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of each embodiment of the present application.

Claims

1. A method for identifying network traffic applications based on dynamic rules, characterized in that: including Upon receiving a message, parse the message and check its flow information; If the flow information contains an APPID, apply the APPID to the message and the flow information and end; If not, identify the message through a preset message matching rule, obtain the APPID and apply it to the message and the flow information; If the message matching rule fails to identify, extract the message feature information based on a preset feature extraction rule, identify the feature information through a preset feature matching rule, obtain the APPID and apply it to the message and the flow information; If the feature extraction or feature matching fails, identify the message through a preset dynamic rule, obtain the APPID and apply it to the message and the flow information.

2. The method for identifying network traffic applications based on dynamic rules according to claim 1, characterized in that: The identifying the message through a preset message matching rule includes If the flow information does not contain an APPID, parse the protocol information of the second to fourth layers of the message, and determine whether to perform application identification through the preset message matching rule according to the parsed protocol type; The message matching rule is an identification rule including an IP address, a port, a message size, a message content, and an APPID.

3. The method for identifying network traffic applications based on dynamic rules according to claim 2, wherein: The identifying the message through a preset message matching rule further includes If the fourth layer protocol type of the message is TCP or UDP, perform application identification through the preset message matching rule to obtain the APPID; If the fourth layer protocol type of the message is not TCP or UDP, apply the predefined APPID corresponding to the highest layer protocol that the message can identify to the message and the flow information.

4. The method for identifying network traffic applications based on dynamic rules according to claim 3, wherein: The extracting the message feature information based on a preset feature extraction rule includes The message feature information includes: domain name information and / or corresponding IP address information in a Domain Name System (DNS) protocol message, Header field information or Body field information in a Hypertext Transfer Protocol (HTTP) protocol message, or predefined field content and its corresponding IP address information in a private protocol message; The preset feature extraction rule includes at least one extraction rule corresponding to the message feature information.

5. The method for identifying network traffic applications based on dynamic rules according to claim 4, characterized in that: The identifying the feature information through a preset feature matching rule includes If the APPID of the feature information is successfully identified through the preset feature matching rule, use the APPID to apply to the message and the flow information; The feature matching rule is an identification rule including a string or a byte sequence and an APPID.

6. The method for identifying network traffic applications based on dynamic rules according to claim 5, wherein: The identifying the message through a preset dynamic rule includes The preset dynamic rule includes a rule based on an IP address and a port or a rule based on an IP address, and the preset dynamic rule is updated after the message matching rule or the feature matching rule is successfully identified; If the packet count of the message is greater than a preset threshold, identify through the preset dynamic rule; if it is less than or equal to the preset threshold, apply the predefined APPID corresponding to the highest layer protocol that the message can identify to the message and the flow information.

7. The method for identifying network traffic applications based on dynamic rules according to claim 6, characterized in that: The identifying the message through a preset dynamic rule further includes If the APPID is not identified through the preset dynamic rule, apply the predefined APPID corresponding to the highest layer protocol that the message can identify to the message and the flow information.

8. A network traffic application recognition system based on dynamic rules, characterized in that: It includes a message matching module, a feature extraction module, and a dynamic recognition module; The message matching module is used to, in response to receiving a message, parse the message and check its flow information; If the flow information contains an APPID, apply the APPID to the message and the flow information and end; if not, identify the message through a preset message matching rule, obtain the APPID, and apply it to the message and the flow information; The feature extraction module is used to, if the message matching rule fails to identify, extract message feature information based on a preset feature extraction rule, identify the feature information through a preset feature matching rule, obtain the APPID, and apply it to the message and the flow information; The dynamic recognition module is used to, if the feature extraction or the feature matching fails, identify the message through a preset dynamic rule, obtain the APPID, and apply it to the message and the flow information.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the method for identifying network traffic applications based on dynamic rules according to any one of claims 1-7.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the steps in the method for identifying network traffic applications based on dynamic rules according to any one of claims 1-7.

Images