Application identification method and related device

Abstract

The embodiment of the invention discloses an application identification method and a related device, and the method comprises the steps: obtaining parameter information, the parameter information is used for creating a connection, and the connection is used for bearing a data stream; and performing identification processing on the parameter information, and determining an application type corresponding to the data stream. According to the application type corresponding to the data stream, the data stream is recognized to determine one or more recognition results, and each recognition result indicates at least one application action corresponding to the data stream. And through two-stage identification, the efficiency and the identification precision of application identification are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and particularly relates to an application identification method and related device. BACKGROUND

[0002] In the face of emerging applications, how to accurately control application traffic is the biggest problem faced by network management. The premise of control is to accurately identify various applications in the network. With the increasing complexity of application programs, traditional application identification technology has been unable to meet the fine control requirements.

[0003] Currently, common application identification technologies include Deep Packet Inspection (DPI) and Deep Flow Inspection (DFI). DPI is a traffic detection and control technology based on the application layer, which disassembles packets, analyzes packet headers and application layer content, and thus identifies application programs and application content. DFI is an application identification technology based on traffic behavior, that is, it identifies the session connection behavior of different applications. By analyzing statistical characteristics of data flow, such as flow duration, flow size, flow rate, or flow direction, and then using machine learning or artificial intelligence technology, the data flow is classified or clustered to determine the application corresponding to the data flow.

[0004] However, the current application identification technology has the problem of poor recognition accuracy, and therefore, how to improve the recognition accuracy of the application identification technology has become a problem to be solved. SUMMARY

[0005] In a first aspect, an application identification method is provided, which includes: first, an application identification device obtains parameter information, the parameter information is used to create a connection, and the connection is used to carry a data flow. Then, the application identification device performs identification processing on the parameter information to determine an application type corresponding to the data flow. Finally, the application identification device performs identification processing on the data flow according to the application type corresponding to the data flow to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data flow, and the application action is an action performed by the application.

[0006] In the present application, the parameter information when creating a connection is first identified to determine the application type corresponding to the data flow carried by the connection. Then, the data flow is identified to determine the application action corresponding to the data flow. Through two-level identification, the efficiency and recognition accuracy of application identification are improved.

[0007] With reference to the first aspect, in a possible implementation of the first aspect, the application identification apparatus is configured to perform processing on the connection according to the identification result, wherein performing processing on the connection comprises: blocking the connection, and / or generating the application identification result of the connection.

[0008] In a possible implementation, the identification result of the data flow is that the application action is voice over internet protocol (VoIP) communication. In response to the identification result, a virtual private network (VPN) tunnel is interrupted to prevent the VoIP communication, wherein the VPN tunnel carries the data flow of the VoIP communication.

[0009] In another possible implementation, the identification result of the data flow is that the application action is instant messaging office (IMO) download of a configuration file. In response to the identification result, a push (PUSH) channel is interrupted to prevent the IMO download of the configuration file, wherein the PUSH channel carries a related data flow of the IMO.

[0010] In the embodiments of the present application, the application identification apparatus can further export the identification result and perform related processing on the connection according to the identification result, thereby improving user experience.

[0011] With reference to the first aspect, in a possible implementation of the first aspect, the application identification apparatus is configured to determine a window set corresponding to the application according to an application type corresponding to the data flow, wherein the window set comprises one or more identification windows, and each identification window is configured to identify at least one application action; and perform feature matching on the data flow using the window set to determine one or more identification results.

[0012] In the embodiments of the present application, the application identification apparatus can use one or more identification windows included in the window set to identify the data flow, thereby improving identification accuracy.

[0013] With reference to the first aspect, in a possible implementation of the first aspect, the identification window comprises any one or more of the following:

[0014] The fixed-size window has a granularity comprising: a number of data packets, a number of bytes, or a duration of the data flow;

[0015] Alternatively, the request-response corresponding window comprises at least one request and a response corresponding to the request, the request corresponds to one or more data packets in a first direction, and the response corresponds to one or more data packets in a second direction, the first direction being opposite to the second direction;

[0016] Or, a sliding window, a size of the sliding window is determined by the data stream identified by the identification window.

[0017] In the embodiments of the present application, the identification window can include multiple types, which improves the implementation flexibility of the scheme and improves the identification accuracy.

[0018] In combination with the first aspect, in a possible implementation manner of the first aspect, the feature matching includes: length matching of the data packets in the identification window, and / or, transmission direction matching of the data packets in the identification window.

[0019] The length matching of the data packets includes: Internet protocol (IP) layer packet length matching, Transmission Control Protocol (TCP) layer packet length matching, User Datagram Protocol (UDP) layer packet length matching, Transport Layer Security (TLS) layer packet length matching, Quick UDP Internet Connection (QUIC) layer packet length matching, or application layer packet length matching.

[0020] In the embodiments of the present application, the feature matching can include multiple types, which improves the implementation flexibility of the scheme and improves the identification accuracy.

[0021] In combination with the first aspect, in a possible implementation manner of the first aspect, the feature matching further includes: statistical feature matching, the statistical features include: a number of the data packets in the identification window, an average packet length of the data in the identification window, a bandwidth occupation of the data in the identification window, a maximum packet length of the data in the identification window, and / or, a minimum packet length of the data in the identification window.

[0022] In the embodiments of the present application, the feature matching can include multiple types, which improves the implementation flexibility of the scheme and improves the identification accuracy.

[0023] In combination with the first aspect, in a possible implementation manner of the first aspect, the feature matching of the data stream using the window set to determine the feature matching result of the data stream includes: performing feature matching of the data stream using the window set according to a feature matching rule to determine the feature matching result of the data stream, the feature matching rule being used to indicate a number of the data packets that are not matched in the process of the feature matching, and / or, positions of the data packets that are not matched in the data stream.

[0024] Specifically, in the process of performing feature matching on the data stream using the window set, feature matching can also be performed according to the configured feature matching rule, so as to enhance the universality of application recognition. The feature matching rule in the embodiments of the present application includes but is not limited to: the number of data packets that are not matched in the process of feature matching, and / or the position of the data packets that are not matched in the data stream. For example, the feature matching rule indicates that the 0th data packet to the 8th data packet in the data stream are not matched, and the 9th data packet in the data stream is matched.

[0025] With reference to the first aspect, in a possible implementation form of the first aspect, after determining the application type corresponding to the data stream according to the parameter information, the method further includes: when the data stream does not belong to the data stream corresponding to the application type, stopping the application recognition on the data stream.

[0026] In the embodiments of the present application, when the application recognition device determines that the data stream does not belong to the data stream corresponding to the application type (in other words, all the recognition windows in the window set cannot match the data stream), the application recognition on the data stream is stopped. The recognition result of the data stream is set as "unrecognized", and the related data of the data stream is cleared from the cache of the application recognition device. Therefore, the computing resources can be effectively saved.

[0027] With reference to the first aspect, in a possible implementation form of the first aspect, the parameter information includes any one or more of the following: a keyword of a load of a connection bearer, a packet length of a data packet of the connection bearer, address information of a connection corresponding client, address information of a connection corresponding server, connection corresponding secret key information, domain name information supported by the server, or domain name information expected to be accessed by the client, wherein the server and the client establish a connection.

[0028] In the embodiments of the present application, the types of the parameter information include multiple types, and therefore the recognition accuracy can be improved.

[0029] In the second aspect, the embodiments of the present application provide an application recognition device, which includes a processing unit and a transceiver unit, and is configured to execute the method of the first aspect and any one of the implementation forms of the first aspect.

[0030] The third aspect of the embodiments of the present application provides a chip, which includes an interface circuit and a processing circuit, and the interface circuit and the processing circuit are interconnected through a line. The processing circuit is configured to run a computer program or an instruction to perform the method of the first aspect.

[0031] Optionally, the chip includes at least one processor and a communication interface, and the communication interface and the at least one processor are interconnected through a line. The at least one processor is configured to run a computer program or an instruction to perform the method of the first aspect.

[0032] Optionally, the communication interface of the chip can be an input / output interface, a pin, or a circuit, etc.

[0033] With reference to the third aspect, in an implementation form of the third aspect of the embodiments of the present application, the chip described above in the present application further includes at least one memory, and the at least one memory stores instructions. The memory can be a storage unit inside the chip, for example, a register, a cache, etc., or can be a storage unit of the chip (for example, a read-only memory, a random access memory, etc.).

[0034] The fourth aspect of the embodiments of the present application provides an application identification device, including at least one processor coupled with a memory; the memory is used to store programs or instructions; the at least one processor is used to execute the programs or instructions, so that the device realizes any one of the possible implementation manners of the first aspect.

[0035] The fifth aspect of the embodiments of the present application provides an application identification device, including a communication interface for inputting and / or outputting signaling or data; a processor for executing a computer executable program, so that the device realizes any one of the possible implementation manners of the first aspect.

[0036] The sixth aspect of the embodiments of the present application provides an application identification device, including at least one logic circuit and an input / output interface; the input / output interface is used to input or output information; the logic circuit is used to execute any one of the possible implementation manners of the first aspect.

[0037] The seventh aspect of the present application provides a computing system, including the application identification device as described in any one of the implementation manners of the sixth aspect.

[0038] The eighth aspect of the present application provides a computer readable storage medium, and the computer readable storage medium stores a computer program, when the computer program runs on a computer, the computer program causes the computer to execute the method of the first aspect.

[0039] The ninth aspect of the present application provides a computer program product, when the computer program product runs on a computer, the computer program product causes the computer to execute the method of the first aspect.

[0040] The tenth aspect of the present application provides a computing system, and the computing system includes an application identification device, wherein the application identification device is used to execute the method of any one of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 A schematic diagram of an application identification system is provided for the embodiments of the present application;

[0042] Figure 2Another application identification system according to an embodiment of the present application;

[0043] Figure 3 Another application identification system according to an embodiment of the present application;

[0044] Figure 4 A structural schematic diagram of a computer device according to an embodiment of the present application;

[0045] Figure 5 An embodiment flow schematic diagram of an application identification method according to an embodiment of the present application;

[0046] Figure 6 A schematic diagram of a data flow according to an embodiment of the present application;

[0047] Figure 7 A parameter information schematic diagram of a handshake stage;

[0048] Figure 8 An application scenario schematic diagram according to an embodiment of the present application;

[0049] Figure 9 Another application scenario schematic diagram according to an embodiment of the present application;

[0050] Figure 10 A structural schematic diagram of an application identification apparatus according to an embodiment of the present application;

[0051] Figure 11 A structural schematic diagram of an application identification apparatus 1101 according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] The terms "first", "second", and the like in the description and in the claims of the present application and in the above drawings are used for distinguishing between similar objects and not necessarily for describing a specific sequential or chronological order. It is to be understood that the terms so used are interchangeable under appropriate circumstances and are merely employed for descriptive purposes. Furthermore, the terms "comprise", "include", "have" and any variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, system, product or apparatus that comprises, includes or has a list of elements is not necessarily limited to those elements, but can include other elements not expressly listed or inherent to such process, method, system, product or apparatus.

[0053] The technical solutions in the embodiments of the present application will be clearly described below in conjunction with the drawings in the embodiments of the present application. In the description of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the present application is merely a description of the association relationship of associated objects, indicating that three relationships can exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the present application, "at least one" refers to one or more items, and "multiple items" refers to two or more items. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0054] For a possible implementation, see Figure 1 . Figure 1 A schematic diagram of an application identification system proposed in an embodiment of the present application, the system includes at least one client 101, at least one network device 102 and at least one server 103, each client 101 and network device 102 are connected to each other via a wired or wireless manner for communication, and each server 103 and network device 102 are also connected to each other via a wired or wireless manner for communication.

[0055] For any client 101, an application is installed on the client 101. When the client 101 runs the application, it generates data streams. At this time, the client 101 can send these data streams to the network device 102. When the network device 102 receives these data streams, it can process them to identify the application corresponding to the data stream. Afterwards, when these data streams are transmitted to the server 103, the server 103 can process these data streams to respond to the operations of the client 101.

[0056] The applications installed on client 101 can be private applications or public applications. Private applications are applications used within the enterprise, while public applications are applications that anyone can use. For example, private applications can be applications used for internal enterprise communications, while public applications can be applications used for internal enterprise communications with external parties.

[0057] The client 101 can be any electronic product that can interact with a user through one or more manners such as a keyboard, a touchpad, a touch screen, a remote controller, voice interaction, or a handwriting device, for example, a personal computer (PC), a mobile phone, a smart phone, a personal digital assistant (PDA), a wearable device, a pocket PC (PPC), a tablet computer, a smart car, a smart television, a smart speaker, and the like.

[0058] The network device 102 can be a core switch, an access switch, a router, a gateway (for example, an enterprise gateway, a home gateway, or a wireless gateway, etc.), or an embedded device, and the like. The server 103 can be a server, a server cluster composed of multiple servers, a cloud device, or a cloud computing service center.

[0059] In another possible implementation, please refer to Figure 2 , Figure 2 Another schematic diagram of an application identification system according to an embodiment of the present application. The application identification system includes at least one terminal device, at least one network device, and a cloud device. An application running on the terminal device generates a data stream, which is forwarded to the cloud device through the network device. In the application identification system, the terminal device, the network device, or the cloud device can execute the application identification method according to an embodiment of the present application.

[0060] In another possible implementation, please refer to Figure 3 , Figure 3 Another schematic diagram of an application identification system according to an embodiment of the present application. The application identification system includes at least one terminal device, a firewall, at least one network device, and a cloud device. An application running on the terminal device generates a data stream, which is forwarded to the cloud device through the firewall and the network device. In the application identification system, the terminal device, the firewall, the network device, or the cloud device can execute the application identification method according to an embodiment of the present application.

[0061] Please refer to Figure 4 , Figure 4 A structural schematic diagram of a computer device according to an embodiment of the present application. The computer device can be the client 101, the network device 102, or the server 103 shown in Figure 1 , can be the terminal device, the network device, or the cloud device in Figure 2 , or can be another computer device. Figure 3The computer device can be a terminal device, a firewall, a network device, or a cloud device in the network. The computer device is configured to execute the application identification method provided in the embodiments of the present application. The computer device comprises at least one processor 401, a communication bus 402, a memory 403, and at least one communication interface 404.

[0062] The processor 401 can be a general central processing unit (CPU), a network processor (NP), a microprocessor, or can be one or more integrated circuits used to implement the schemes of the present application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0063] The communication bus 402 is configured to transmit information between the above components. The communication bus 402 can be divided into an address bus, a data bus, a control bus, and the like. For the convenience of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or only one type of bus.

[0064] The memory 403 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, or can be a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or can be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to this. The memory 403 can exist independently and be connected to the processor 401 through the communication bus 402. The memory 403 can also be integrated with the processor 401.

[0065] The communication interface 404 is configured to communicate with other devices or communication networks. The communication interface 404 includes a wired communication interface, and can further include a wireless communication interface. The wired communication interface can be an Ethernet interface, for example. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof, etc.

[0066] In specific implementations, as an example, the processor 401 can include one or more CPUs, such as the CPU0 and the CPU1 shown in Figure 4 FIG. 1.

[0067] In specific implementations, as an example, the computer device can include multiple processors, such as the processor 401 and the processor 405 shown in Figure 4 FIG. 1. Each of these processors can be a single-CPU or a multi-CPU. The processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0068] In specific implementations, as an example, the computer device can further include an output device 406 and an input device 407. The output device 406 is in communication with the processor 401, and can display information in various ways. For example, the output device 406 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 407 is in communication with the processor 401, and can receive user input in various ways. For example, the input device 407 can be a mouse, a keyboard, a touch screen device, or a sensing device, etc.

[0069] In some embodiments, the memory 403 is configured to store program code 210 for implementing the solutions of the present application, and the processor 401 can execute the program code 210 stored in the memory 403. For example, the computer device can implement the application recognition method proposed in the present application by means of the processor 401 and the program code 210 in the memory 403. The computer device can run the application recognition apparatus proposed in the embodiments of the present application, which is configured to execute the application recognition method proposed in the embodiments of the present application.

[0070] Please refer to Figure 5 , Figure 5An embodiment flowchart of an application identification method is provided for the embodiments of the present application. The application identification method provided by the embodiments of the present application comprises the following steps.

[0071] S1, parameter information is acquired, the parameter information is used for creating a connection, and the connection is used for carrying a data stream.

[0072] In step S1, the application identification device acquires parameter information, which refers to parameter information related to the creation of a connection in the process of creating the connection, and the connection is used to carry a data stream of an application. By way of example, please refer to Figure 6 , Figure 6 A schematic diagram of a data stream in the embodiments of the present application. A connection is first created between a client and a server, and the stage of creating the connection can also be referred to as a connection handshake stage or a handshake stage. The application identification device acquires parameter information of the stage of creating the connection. Over time, when the connection is created, the connection carries a data stream, and the data stream at different time periods often carries data of different applications or different application behaviors in the application. For example Figure 6 In the example in the application identification device, the data stream first carries data related to the sending of a video, then carries data related to the sending of a picture, and finally carries data related to voice.

[0073] In a possible implementation, the parameter information comprises any one or more of the following: a keyword of a load carried by the connection, a packet length of a data packet carried by the connection, address information of a client corresponding to the connection, address information of a server corresponding to the connection, secret key information corresponding to the connection, domain name information supported by the server, or domain name information expected to be accessed by the client, wherein the server and the client establish the connection.

[0074] For example, in the connection handshake stage between the client and the server, the application identification device can acquire handshake messages exchanged between the client and the server, and then acquire the parameter information from the handshake messages. The parameter information is, for example, a server name indication (SNI) field. It is an extension of the transport layer security (TLS) protocol, which allows the client to explicitly indicate the domain name of the server it wants to connect to in the process of establishing a secure connection with the server. This mechanism is introduced in the ClientHello stage of the TLS handshake process, and the client sends the hostname it tries to connect to through the SNI field, so that the server can provide the correct certificate to the client according to the hostname, thereby completing the establishment of secure communication.

[0075] S2, the parameter information is identified and processed, and the application type corresponding to the data stream is determined.

[0076] In step S2, after the application identification device obtains the parameter information, the application identification device performs identification processing on the parameter information, and then determines the application type corresponding to the data flow or the type of the connection carrying the data flow. For example, after the application identification device obtains the parameter information, the application identification device performs identification processing on the parameter information. If the identification result is that the parameter information is not application-related parameter information, the application identification process ends. If the identification result is that the parameter information is application-related parameter information, the application identification device further performs subsequent application identification methods.

[0077] Further, after the application corresponding to the data flow is determined, the window set corresponding to the application needs to be determined. The window set includes one or more identification windows, and each identification window is used to identify at least one application action. For example, the window set is shown in Table 1.

[0078] Table 1

[0079]

[0080] For example, as shown in Table 1, when the application type of the data flow #1 is identified as a VPN tunnel in step S2, it is determined that the identification windows included in the window set #1 are used to identify the data flow #1. When the application type of the data flow #2 is identified as a PUSH channel in step S2, it is determined that the identification windows included in the window set #2 are used to identify the data flow #2. When the application type of the data flow #3 is identified as a P2P connection in step S2, it is determined that the identification windows included in the window set #3 are used to identify the data flow #3.

[0081] In a possible implementation, the identification window includes any one or more of the following: a fixed-size window, a window corresponding to a request-response pair, or a sliding window. The following will be introduced respectively.

[0082] Fixed size window, the granularity of fixed size window includes: the number of data packets, the number of bytes, or the duration of the data flow. Specifically, the fixed size window refers to the definition of the size of the window according to the number of data packets of the data flow carried by the connection (the number of data packets can also be referred to as the number of packets), the number of bytes of the data flow in a period of time, the number of bytes of the data packet, or the duration of the data flow. For example, every 100 data packets as a window; or every 2000 bytes of traffic as a window; or every 10 seconds of communication data as a window. For example, consider a special network communication scenario, such as an asymmetric routing scenario, in which the application recognition device can only receive communication data in a single direction of the connection. Therefore, in the asymmetric routing scenario, the definition of the fixed size window can be the number of packets in a single direction, the number of bytes of the data flow, or the duration of the data flow. For the fixed size window, it is suitable for identifying application actions with large traffic, such as downloading, watching video, VoIP call, etc. The above communication scenarios have the characteristics of long duration and large traffic, so the fixed size window can effectively identify the above application actions.

[0083] Request-response corresponding window, the request-response corresponding window includes at least one request and the response corresponding to the request, the request corresponds to one or more data packets in the first direction, and the response corresponds to one or more data packets in the second direction, the first direction is opposite to the second direction. For example, the first direction is the uplink direction from the client to the server, and the downlink direction from the server to the client is the second direction. Specifically, for application actions with small traffic, such as application programming interface (API) requests, account login, or configuration viewing, etc., a request and a response can complete an application action. Therefore, the request-response corresponding window is suitable for identifying a group of requests and responses, in which one or more data packets (or messages) in the first direction are regarded as a request, one or more data packets (or messages) in the second direction are regarded as a response, and a request and the response corresponding to the request are combined as a group of requests and responses.

[0084] Alternatively, a sliding window, the size of the sliding window is determined by the data flow identified by the identification window. Specifically, for some flexible application actions, a sliding window can be used for matching. After each new data packet in the data flow arrives at the application recognition device, it is added to the sliding window, and then the oldest data packet in the sliding window is eliminated from the sliding window.

[0085] For ease of understanding, please refer to Figure 7 , Figure 7 is a schematic diagram of parameter information in the handshake phase. The parameter information obtained by the application recognition device is as followsFigure 7 As shown, the parameter information "SNI: mtalk.google.com" indicates that the connection corresponding to the parameter information is a push channel. This parameter information is application-related and requires execution of the subsequent step S3. For example, the application identification device determines that it is necessary to further identify the data stream of the application corresponding to the parameter information. Specifically, it identifies the data stream starting from the first application data packet in the data stream.

[0086] S3. Identify and process the data stream according to the application type corresponding to the data stream, and determine one or more identification results.

[0087] In step S3, after the application type corresponding to the data stream is determined, the window set corresponding to the application type is used to perform identification processing on the data stream to determine one or more identification results, each of which indicates at least one application action corresponding to the data stream.

[0088] In one possible implementation, a window set is used to perform feature matching on the data stream to determine one or more recognition results. Feature matching includes, but is not limited to, matching the length of packets within the recognition window and / or matching the transmission direction of packets within the recognition window.

[0089] Specifically, the "length matching" in the embodiments of the present application includes: matching the message length of a single data packet within the identification window, or matching the message lengths of multiple data packets within the identification window. The message length matching can be a fixed value, such as 500KB, which means that if the message length of the data packet within the identification window is 500KB, the match is successful; the message length matching can also be a range value, such as (20KB, 500KB), which means that if the message length of the data packet within the identification window is greater than 20KB and less than 500KB, the match is successful.

[0090] Furthermore, packet length matching can also be performed for different transport protocols in the data stream. For example, packet length matching includes: length matching at the Internet Protocol (IP) layer, length matching at the Transmission Control Protocol (TCP) layer, length matching at the User Datagram Protocol (UDP) layer, length matching at the Transport Layer Security (TLS) layer, length matching at the Quick UDP Internet Connection (QUIC) layer, or length matching at the application layer.

[0091] Further optionally, feature matching also includes: statistical feature matching, the statistical features including: the number of data packets in the identification window, the average packet length of the data in the identification window, the bandwidth occupancy of the data in the identification window, the maximum packet length of the data in the identification window, and / or the minimum packet length of the data in the identification window.

[0092] For the convenience of understanding, one possible implementation of the window set is shown in Table 2.

[0093] Table 2

[0094]

[0095] Further optionally, in the process of performing feature matching on the data stream using the window set, feature matching can also be performed according to the configured feature matching rule to enhance the universality of application recognition. The feature matching rule in the embodiments of the present application includes, but is not limited to, the number of data packets that are not matched in the process of feature matching, and / or the position of the data packets that are not matched in the data stream. For example, the feature matching rule indicates that the 0th data packet to the 8th data packet in the data stream are not matched, and the 9th data packet in the data stream is matched.

[0096] S4, performing processing on the connection according to the recognition result.

[0097] In step S4, after the application recognition device determines the recognition result, processing is performed on the connection according to the recognition result. Specifically, the processing performed on the connection includes blocking the connection, and / or generating the application recognition result of the connection.

[0098] For example, the recognition result determined by the application recognition device is VoIP communication, and the application recognition device blocks the connection. In addition, the application recognition device generates the application recognition result of the connection, which includes that the application action of the connection is VoIP, and the connection is blocked.

[0099] For another example, the recognition result determined by the application recognition device is IMO downloading configuration file, and the application recognition device blocks the connection. In addition, the application recognition device generates the application recognition result of the connection, which includes that the application action of the connection is IMO downloading configuration file, and the connection is blocked.

[0100] Optionally, in the above steps S2 to S3, when the application recognition device determines that the data stream does not belong to the data stream corresponding to the application type (in other words, all the recognition windows in the window set cannot match the data stream), the application recognition of the data stream is stopped. The recognition result of the data stream is set to "unrecognized", and the related data of the data stream is cleared from the cache of the application recognition device.

[0101] In the embodiments of the present application, first, the parameter information when creating a connection is identified to determine the application type corresponding to the data stream carried by the connection. Then, the data stream is identified to determine the application action corresponding to the data stream. Through two-level identification, the efficiency and accuracy of application identification are improved. The targets for identification in different stages are different, which can improve the identification accuracy. In addition, the parameter information is identified in the handshake stage, which can help filter irrelevant connections and improve the identification processing performance. The data stream is identified through multiple identification windows to improve the identification accuracy. The application identification device can also export the identification result and perform related processing on the connection according to the identification result to improve the user experience.

[0102] In combination with the foregoing embodiments, some application scenarios of the embodiments of the present application are introduced next.

[0103] Please refer to Figure 8 , Figure 8 is a schematic diagram of one application scenario in the embodiments of the present application. Take the identification processing of the Internet instant messaging office (IMO) application by the application identification device as an example to introduce the specific process of application identification. The IMO can change its traffic characteristics to evade blocking. The traffic characteristic change of the IMO is performed according to the configuration file of the IMO, which describes how the traffic characteristics change and the information related to the change, such as secret keys, server Internet Protocol (IP) addresses, and / or domain names. The client running the IMO needs to download the configuration file from the server of the IMO regularly, and the IMO can change the traffic characteristics in time. In order to hide the download traffic of the configuration file, the client running the IMO uses the PUSH channel to transmit the configuration file. The PUSH channel is a public communication mechanism provided by the current "Android" or "iOS" operating system, and multiple applications can use the PUSH channel to transmit their own related data, so the PUSH channel carries data of different application actions. In addition, since the PUSH channel needs to transmit the data of the application in real time, the client generally creates a connection after starting, and the connection will not be disconnected until the client is shut down or the network of the client is interrupted.

[0104] When the connection handshake phase of the PUSH channel, the application recognition device recognizes the PUSH channel through the SNI field of the handshake message. Then, the data stream carried by the PUSH channel is recognized. Specifically, the first application data message of the data stream is used to recognize, and when the application data message appears in the data stream, it means that it enters the data transmission phase. In combination with the foregoing Table 2, the application recognition device uses the window set #2 in the recognition window set to perform the recognition processing on the data stream, wherein the sliding window #2“[367KB, 601KB, 150KB]” matches the three data packets in the data stream in turn, which means that the sliding window #2 successfully matches the data stream, and the recognition result of the data stream is that the application action is IMO download configuration file. In response to the recognition result, the PUSH channel is interrupted, and the IMO download configuration file is prevented.

[0105] Please refer to Figure 9 , Figure 9 is another application scenario in the embodiments of the present application. Taking the recognition processing of the VoIP application by the application recognition device as an example, the specific process of application recognition is introduced. After the client creates a VPN tunnel using the VPN application, the VPN application transmits all the traffic or the traffic of the specified application on the client through the VPN tunnel. In this case, when the client runs the VoIP application, the traffic of the VoIP application will use the VPN tunnel to perform transmission. When the application recognition device needs to block the communication of the VoIP application, it needs to identify the traffic of the VoIP application from the multiple traffics carried by the VPN tunnel.

[0106] In the process of creating the VPN tunnel, the client obtains the parameter information related to the creation of the VPN tunnel, such as the payload keyword, the packet length, or the IP address information of the server. Then, the application recognition device determines that the created connection is a VPN tunnel according to the parameter information, and determines that the application type of the data stream to be recognized is a VPN tunnel. The application recognition device further performs recognition processing on the data stream carried in the VPN tunnel. In one possible implementation manner, the handshake phase of the VPN tunnel is usually completed in the first 64 data packets of the data stream, so the recognition processing is performed from the 64th data packet of the data stream. In combination with the foregoing Table 2, the application recognition device uses the window set #1 in the recognition window set to perform the recognition processing on the data stream, wherein the fixed-size window #1 matches the data stream. Therefore, the recognition result of the data stream is that the application action is VoIP communication. In response to the recognition result, the VPN tunnel is interrupted, and the VoIP communication is prevented.

[0107] In Figures 5 to 9 the embodiments corresponding to the foregoing embodiments, in order to better implement the foregoing scheme of the embodiments of the present application, the related equipment for implementing the foregoing scheme is further provided.Figure 10 , Figure 10 A structural schematic diagram of an application identification device is provided for an embodiment of the present application. The application identification device 1000 comprises a transceiver module 1001 and a processing module 1002, and the application identification device 1000 comprises:

[0108] The transceiver module 1001 is configured to obtain parameter information, the parameter information being used to create a connection, and the connection being used to carry a data stream;

[0109] The processing module 1002 is configured to perform identification processing on the parameter information to determine an application type corresponding to the data stream.

[0110] The processing module 1002 is further configured to perform identification processing on the data stream according to the application type corresponding to the data stream to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data stream, and the application action is an action performed by an application.

[0111] In a possible implementation, the processing module 1002 is further configured to block the connection according to the identification result, and / or generate an application identification result of the connection.

[0112] In a possible implementation, the processing module 1002 is further configured to determine a window set corresponding to the application according to the application type corresponding to the data stream, and the window set comprises one or more identification windows, and each identification window is used to identify at least one application action.

[0113] The processing module 1002 is further configured to perform feature matching on the data stream using the window set to determine one or more identification results.

[0114] In a possible implementation, the identification window comprises any one or more of the following:

[0115] A fixed-size window, and a granularity of the fixed-size window comprises a number of data packets, a number of bytes, or a duration of the data stream;

[0116] Or, a request-response corresponding window, the request-response corresponding window comprises at least one request and a response corresponding to the request, the request corresponds to one or more data packets in a first direction, and the response corresponds to one or more data packets in a second direction, and the first direction is opposite to the second direction;

[0117] Or, a sliding window, and a size of the sliding window is determined by the data stream identified by the identification window.

[0118] In a possible implementation, the feature matching comprises length matching of data packets in the identification window, and / or transmission direction matching of data packets in the identification window.

[0119] The length matching of the data packet includes: message length matching of an Internet Protocol (IP) layer, message length matching of a Transmission Control Protocol (TCP) layer, message length matching of a User Datagram Protocol (UDP) layer, message length matching of a Transport Layer Security (TLS) layer, message length matching of a Quick UDP Internet Connections (QUIC) layer, or message length matching of an application layer.

[0120] In a possible implementation, the feature matching further includes: statistical feature matching, and the statistical feature includes: a number of data packets in the identification window, an average packet length of data in the identification window, a bandwidth occupation of data in the identification window, a maximum packet length of data in the identification window, and / or a minimum packet length of data in the identification window.

[0121] In a possible implementation, the processing module 1002 is further configured to perform feature matching on the data stream according to a feature matching rule, and determine a feature matching result of the data stream, where the feature matching rule is used to indicate a number of data packets that are not matched in the feature matching process, and / or a position of the data packets that are not matched in the data stream.

[0122] In a possible implementation,

[0123] The processing module 1002 is further configured to stop application identification on the data stream when the data stream does not belong to a data stream corresponding to the application type.

[0124] In a possible implementation, the parameter information includes any one or more of the following:

[0125] A keyword of a load of a connection, a packet length of a data packet of the connection, address information of a connection corresponding client, address information of a connection corresponding server, connection corresponding key information, domain name information supported by the server, or domain name information expected to be accessed by the client, where the server and the client establish a connection.

[0126] For details, refer to Figure 11 , Figure 11 FIG. 1 is a structural schematic diagram of an application identification device 1101 provided by an embodiment of the present application. The application identification device 1101 can be the application identification device in the foregoing embodiments. As shown in FIG. 1, the application identification device 1101 includes a receiving module 1102, a processing module 1104, and a sending module 1106. Figure 11As shown, the application recognition device 1101 includes a processor 1103 coupled to a system bus 1105. The processor 1103 can be one or more processors, each of which can include one or more processor cores. A video adapter 1107 can drive a display 1109 coupled to the system bus 1105 via the bus bridge 2111. The system bus 1105 is coupled to an I / O bus via the bus bridge 2111. An I / O interface 1126 is coupled to the I / O bus. The I / O interface 1126 communicates with various I / O devices, such as input devices 2117 (e.g., touch screen, etc.), external storage 2110 (e.g., disk drives, floppy disks, CD-ROMs, or USB keys), multimedia interface 1127, etc. A transceiver 1123 (which can transmit and / or receive wireless communication signals) and an external USB port 1125 are also connected to the I / O interface 1126. Optionally, the interface connected to the I / O interface 1126 can be a USB interface.

[0127] The processor 1103 can be any conventional processor, including a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, or a combination of both. Alternatively, the processor can be a special purpose device, such as an ASIC.

[0128] A hard drive interface 1131 is coupled to the system bus 1105. A hard drive 1133 is coupled to the hard drive interface 1131. A memory 1135 is coupled to the system bus 1105. The data stored in the memory 1135 can include an operating system (OS) 1137 of the application recognition device 1101, an application program 1143, and a schedule.

[0129] The processor 1103 can communicate with the memory 1135 over the system bus 1105 to retrieve and execute instructions and data from the application program 1143 stored in the memory 1135.

[0130] The operating system includes a shell 1139 and a kernel 1141. The shell 1139 is an interface between the user and the kernel of the operating system. The shell is the outermost layer of the operating system. The shell manages the interaction between the user and the operating system: waiting for the user's input, interpreting the user's input to the operating system, and processing the various outputs of the operating system.

[0131] The kernel 1141 is composed of those parts of an operating system that manage memory, files, devices, and system resources. The kernel 1141 directly interacts with hardware, and the operating system kernel usually runs processes and provides inter-process communication, provides CPU time slicing management, interrupts, memory management, and IO management, and the like.

[0132] The application also provides a computer program product, which, when running on a computer, causes the computer to perform the steps performed by the application recognition device or causes the computer to perform the steps performed by the computing device.

[0133] The application also provides a computer readable storage medium, which stores a program for signal processing, and when the program runs on a computer, causes the computer to perform the steps performed by the application recognition device or causes the computer to perform the steps performed by the application recognition device or the computing device.

[0134] The application recognition device or the computing device provided by the embodiments of the application can be a chip, which includes a processing unit, for example, a processor, and a communication unit, for example, an input / output interface, a pin, or a circuit, etc. The processing unit can execute computer execution instructions stored in a storage unit, so that the chip in the application recognition device performs the compiling method described in the above embodiments. Alternatively, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit can also be a storage unit outside the chip in the wireless access device, such as a read-only memory (ROM) or other types of static application recognition devices that can store static information and instructions, a random access memory (RAM), etc.

[0135] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the system, device and unit described above can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0136] In the several embodiments provided by the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of the units is only a logical function division. There can be another division manner for actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0137] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e., may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0138] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0139] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various media that can store program codes.

Claims

1. An application identification method characterized by comprising: The method comprises: obtaining parameter information, the parameter information being used to create a connection, the connection being used to carry a data flow; performing identification processing on the parameter information to determine an application type corresponding to the data flow; performing identification processing on the data flow according to the application type corresponding to the data flow to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data flow, the application action being an action performed by an application.

2. The method of claim 1, wherein, The method further comprises: blocking the connection and / or generating an application identification result of the connection according to the identification result.

3. The method according to claim 1 or 2, characterized in that, The identification processing on the data flow according to the application type corresponding to the data flow to determine the one or more identification results comprises: determining a window set corresponding to the application according to the application type corresponding to the data flow, the window set comprising one or more identification windows, each identification window being used to identify at least one application action; performing feature matching on the data flow using the window set to determine the one or more identification results.

4. The method of claim 3, wherein, The identification window comprises any one or more of: a fixed-size window, a granularity of the fixed-size window comprising a number of data packets, a number of bytes, or a duration of the data flow; or a request-response corresponding window, the request-response corresponding window comprising at least one request and a response corresponding to the request, the request corresponding to one or more data packets in a first direction, and the response corresponding to one or more data packets in a second direction, the first direction being opposite to the second direction; or a sliding window, a size of the sliding window being determined by the data flow identified by the identification window.

5. The method according to claim 3 or 4, characterized in that, The feature matching comprises length matching of data packets in the identification window and / or direction matching of data packets in the identification window. The length matching of data packets comprises Internet Protocol (IP) layer packet length matching, Transmission Control Protocol (TCP) layer packet length matching, User Datagram Protocol (UDP) layer packet length matching, Transport Layer Security (TLS) layer packet length matching, Quick UDP Internet Connections (QUIC) layer packet length matching, or application layer packet length matching.

6. The method according to any one of claims 3-5, characterized in that, The feature matching further comprises statistical feature matching, the statistical features comprising a number of data packets in the identification window, an average packet length of data in the identification window, a bandwidth occupancy of data in the identification window, a maximum packet length of data in the identification window, and / or a minimum packet length of data in the identification window.

7. The method according to any one of claims 3-6, characterized in that, The feature matching on the data flow using the window set to determine the feature matching result of the data flow comprises: performing feature matching on the data flow using the window set according to a feature matching rule to determine the feature matching result of the data flow, the feature matching rule being used to indicate a number of data packets that are not matched in the feature matching process and / or positions of the data packets that are not matched in the data flow.

8. The method according to any one of claims 1-7, characterized in that, After determining the application type corresponding to the data flow according to the parameter information, the method further comprises: When the data stream does not belong to the data stream corresponding to the application type, stopping application identification of the data stream.

9. The method according to any one of claims 1-8, characterized in that, The parameter information includes any one or more of the following: The key of the load carried by the connection, the packet length of the data packet carried by the connection, the address information of the client corresponding to the connection, the address information of the server corresponding to the connection, the key information corresponding to the connection, the domain name information supported by the server, or the domain name information expected to be accessed by the client, wherein the connection is established between the server and the client.

10. An application recognition apparatus characterized by comprising: The device includes a processing module and a transceiver module, and the device includes: The transceiver module is configured to obtain parameter information, wherein the parameter information is used to create a connection, and the connection is used to carry a data stream. The processing module is configured to perform identification processing on the parameter information to determine an application type corresponding to the data stream. The processing module is further configured to perform identification processing on the data stream according to the application type corresponding to the data stream to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data stream.

11. The device of claim 10, wherein: The processing module is further configured to block the connection according to the identification result, and / or generate an application identification result of the connection.

12. The device of claim 10 or 11, wherein: The processing module is further configured to determine a window set corresponding to the application according to the application type corresponding to the data stream, wherein the window set includes one or more identification windows, and each identification window is used to identify at least one application action. The processing module is further configured to perform feature matching on the data stream using the window set to determine the one or more identification results.

13. The apparatus of claim 12, wherein, The identification window includes any one or more of the following: A fixed-size window, wherein the granularity of the fixed-size window includes the number of data packets, the number of bytes, or the duration of the data stream. Or, a request-response corresponding window, wherein the request-response corresponding window includes at least one request and a response corresponding to the request, the request corresponds to one or more data packets in a first direction, and the response corresponds to one or more data packets in a second direction, wherein the first direction is opposite to the second direction. Or, a sliding window, wherein the size of the sliding window is determined by the data stream identified by the identification window.

14. The apparatus of claim 12 or 13, wherein, The feature matching includes length matching of data packets in the identification window and / or transmission direction matching of data packets in the identification window. The length matching of data packets includes Internet Protocol (IP) layer packet length matching, Transmission Control Protocol (TCP) layer packet length matching, User Datagram Protocol (UDP) layer packet length matching, Transport Layer Security (TLS) layer packet length matching, Quick UDP Internet Connections (QUIC) layer packet length matching, or application layer packet length matching.

15. The apparatus of any one of claims 12-14, wherein, The feature matching further includes statistical feature matching, and the statistical features include a number of data packets in the identification window, an average packet length of data in the identification window, a bandwidth occupation of data in the identification window, a maximum packet length of data in the identification window, and / or a minimum packet length of data in the identification window.

16. The apparatus of any of claims 12-15, wherein, The processing module is further configured to perform feature matching on the data stream using the window set according to a feature matching rule, and determine a feature matching result of the data stream, the feature matching rule being used to indicate a number of data packets that are not matched in the feature matching process and / or positions of the data packets that are not matched in the data stream.

17. The apparatus of any of claims 10-16, wherein, The processing module is further configured to stop application identification on the data stream when the data stream does not belong to a data stream corresponding to the application type.

18. The apparatus of any one of claims 10-17, wherein, The parameter information includes any one or more of the following: a keyword of a load of the connection, a packet length of a data packet of the connection, address information of a client corresponding to the connection, address information of a server corresponding to the connection, key information corresponding to the connection, domain name information supported by the server, or domain name information expected to be accessed by the client, wherein the connection is established between the server and the client.

19. An application recognition apparatus characterized by comprising: The processor device includes a communication interface and a processor: The communication interface is configured to input and / or output signaling or data. The processor is configured to execute a computer executable program, so that the method in any one of claims 1-9 is executed.

20. A chip, characterized by including: an interface circuit and a processing circuit, the interface circuit and the processing circuit being connected, and the chip being configured to execute the method in any one of claims 1-9.

21. A computer program product, characterised in that, The computer program product stores instructions, which, when executed by a computer, cause the computer to implement the method in any one of claims 1-9.

Images