A method for identifying instant call services based on relationship analysis

Abstract

The present invention discloses a method for identifying instant call services based on relationship analysis, and the method comprises: a parsing program accesses a network data stream; the parsing program identifies an instant messaging data message, i.e. identifies the session in which the message is located as an instant messaging data message; the parsing program extracts key data according to the features of the instant messaging data message; the parsing program sends the last extracted key data to an aggregation program; the aggregation program receives the key data sent by the parsing program and determines whether it is a personal call or a group call; if it is a personal call, enters a personal call processing module, and if it is a group call, enters a group call processing module; the method has the advantages of high applicability and strong adaptability.

Description

Technical Field

[0001] The present invention relates to the field of physics, and in particular to network instant messaging technology, and in particular to an identification method for instant messaging services based on relationship analysis. Background Art

[0002] In the existing technology, there are many instant messaging services, and the data streams are encrypted and transmitted, so very little information can be extracted. In addition, each data stream only contains information about a single participant, and it is difficult to extract and integrate which participants are making calls from a large number of data streams. It is difficult for operators to control the relevant data of online instant messaging and to detect illegal activities of lawbreakers through online instant messaging. Summary of the invention

[0003] The purpose of the present invention is to provide a method for identifying instant call services based on relationship analysis, which aims to solve the technical problems in the prior art that operators find it difficult to control the relevant data of network instant calls and to detect illegal acts of illegal persons through network instant calls.

[0004] The instant call service identification method based on relationship analysis of the present invention comprises:

[0005] 1) Use the parser to access the network data stream;

[0006] 2) When the parsing program identifies an instant messaging data message, it identifies the session in which the message is located as an instant messaging data message;

[0007] 3) Use the parsing program to extract key data based on the characteristics of instant messaging data messages;

[0008] 4) Use the parsing program to send the key data extracted in step 3) to the aggregation program;

[0009] 5) Using the aggregation program to receive the key data sent by the analysis program, determine whether it is a personal call or a group call; if it is a personal call, enter the personal call processing module, if it is a group call, enter the group call processing module.

[0010] Furthermore, the analysis procedure includes:

[0011] The network data traffic is connected, and the parsing program takes out the data from the network card and starts parsing;

[0012] According to the Ethernet data encapsulation format, the data is parsed from the link layer, network layer and transport layer to the transport layer in sequence. The five-tuple information is extracted from the data and a hash session mapping table, i.e., a session flow table, is established based on the five-tuple information.

[0013] Use the five-tuple as the key to check whether the key exists in the session flow table. If so, determine whether the session flow is successfully identified as an instant messaging protocol. If not, create a new flow table session using the five-tuple information as the key.

[0014] When judging whether the session is successfully identified as an instant call protocol, if so, enter the instant call parsing module, if not, enter the protocol identification module, when a new flow table session is created with the five-tuple information as the key, directly enter the protocol identification module, and after entering the protocol identification module, re-judge whether it is successfully identified as a technical call protocol, if so, enter the instant call parsing module;

[0015] After entering the instant call analysis module, key information is extracted and sent to the aggregation program.

[0016] Furthermore, the “determining whether the session is successfully identified as an instant messaging protocol” includes:

[0017] Weakly identify instant messaging data based on UDP payload;

[0018] Strongly identify data that is weakly identified as instant messaging data.

[0019] Furthermore, the step of “weakly identifying the instant messaging data according to the UDP payload” includes:

[0020] Define three characteristic messages: characteristic message 1, characteristic message 2 and characteristic message 3;

[0021] Only UDP packets with port number 8000 are allowed to perform weak identification of instant messaging protocols;

[0022] Determine whether the UDP payload of the data message meets one of the three characteristic messages in Table 1. If so, it is successfully weakly identified as instant messaging data, and the message and the session it belongs to are marked as instant messaging data. If not, the weak identification fails and is discarded.

[0023] Furthermore, the “strongly identifying data that is weakly identified as instant messaging” includes:

[0024] Define three characteristic messages: characteristic message A, characteristic message B and characteristic message C;

[0025] Strong recognition of personal call types and strong recognition of group call types.

[0026] Furthermore, the "personal call processing module" process includes:

[0027] Check whether the data is reasonable. If so, construct a key using the personal ID and the other party's ID. If not, discard the data.

[0028] Check whether the key exists in the personal call hash table; if it exists, update the data information corresponding to the key and output the log record after waiting for a timeout; if it does not exist, add new data with the key.

[0029] Furthermore, the "group call processing module" process includes:

[0030] Check whether the data is reasonable. If so, construct a key using the group ID. If not, discard the data.

[0031] Check whether the key exists in the group call hash table; if it exists, update the data information corresponding to the key and output the log record after waiting for a timeout; if it does not exist, add data with the key.

[0032] The present invention has the following advantages:

[0033] The present invention has a wider adaptability, supports more types of instant call services, and supports one-to-one and many-to-many session identification and association with session participants, and finally forms a one-to-one and many-to-many instant call association record. The present invention can also dynamically solve the analysis and association of the constantly developing and updated instant call data streams through custom rules without modifying the code to achieve adaptation. The present invention does not need to deeply analyze the data stream, and can identify the associated data stream only according to certain characteristics. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a simple data flow pattern diagram of the software framework utilized by the present invention;

[0035] Figure 2 It is the main flow chart of the parsing program;

[0036] Figure 3 It is a flow chart of data that is weakly identified as instant messaging;

[0037] Figure 4 It is the main flow chart of the aggregation procedure;

[0038] Figure 5 It is a process flow chart of the personal call module;

[0039] Figure 6 It is a processing flow chart of the group call module;

[0040] Figure 7 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings. Example

[0042] In this embodiment, refer to the attached manual Figure 1-7 The technical problem to be solved by this embodiment is that there are many instant call services at this stage, and data streams are encrypted for transmission, so very little information can be extracted, and each data stream only contains information of a single participant. It is difficult to extract and integrate which participants are making calls from a large number of data streams, so a method for identifying instant call services based on relationship analysis is provided, and the method for identifying instant call services based on relationship analysis includes:

[0043] 1) The parser accesses the network data stream;

[0044] 2) The parsing program identifies the instant messaging data message, i.e., identifies the session in which the message is located as an instant messaging data message;

[0045] 3) The parsing program extracts key data based on the characteristics of the instant messaging data message;

[0046] 4) The parsing program sends the key data extracted in step 3) to the aggregation program;

[0047] 5) The aggregation program receives the key data sent by the analysis program and determines whether it is a personal call or a group call; if it is a personal call, it enters the personal call processing module; if it is a group call, it enters the group call processing module.

[0048] In a specific embodiment, the parsing procedure includes:

[0049] The network data traffic is connected, and the parsing program takes out the data from the network card and starts parsing;

[0050] According to the Ethernet data encapsulation format, the data is parsed from the link layer, network layer and transport layer to the transport layer in sequence. The five-tuple information is extracted from the data and a hash session mapping table, i.e., a session flow table, is established based on the five-tuple information.

[0051] Use the five-tuple as the key to check whether the key exists in the session flow table. If so, determine whether the session flow is successfully identified as an instant messaging protocol. If not, create a new flow table session using the five-tuple information as the key.

[0052] When judging whether the session is successfully identified as an instant call protocol, if so, enter the instant call parsing module, if not, enter the protocol identification module, when a new flow table session is created with the five-tuple information as the key, directly enter the protocol identification module, and after entering the protocol identification module, re-judge whether it is successfully identified as a technical call protocol, if so, enter the instant call parsing module;

[0053] After entering the instant call analysis module, key information is extracted and sent to the aggregation program.

[0054] In a specific implementation, the “determining whether the session is successfully identified as an instant messaging protocol” includes:

[0055] Weakly identify instant messaging data based on UDP payload;

[0056] Strongly identify data that is weakly identified as instant messaging data.

[0057] In a specific implementation, the step of "weakly identifying instant messaging data according to UDP payload" includes:

[0058] Define three characteristic messages: characteristic message 1, characteristic message 2 and characteristic message 3;

[0059] Only UDP packets with port number 8000 are allowed to perform weak identification of instant messaging protocols;

[0060] Determine whether the UDP payload of the data message meets one of the three characteristic messages in Table 1. If so, it is successfully weakly identified as instant messaging data, and the message and the session it belongs to are marked as instant messaging data. If not, the weak identification fails and is discarded.

[0061] In a specific implementation, the “strongly identifying data weakly identified as instant messaging” includes:

[0062] Define three characteristic messages: characteristic message A, characteristic message B and characteristic message C;

[0063] Strong recognition of personal call types and strong recognition of group call types.

[0064] In a specific implementation, the "personal call processing module" process includes:

[0065] Check whether the data is reasonable. If so, build a key using the personal ID and the other party's ID. If not, discard the data.

[0066] Check whether the key exists in the personal call hash table; if it exists, update the data information corresponding to the key and output the log record after waiting for a timeout; if it does not exist, add new data with the key.

[0067] In a specific implementation, the "group call processing module" process includes:

[0068] Check whether the data is reasonable. If so, construct a key using the group ID. If not, discard the data.

[0069] Check whether the key exists in the group call hash table; if it exists, update the data information corresponding to the key and output the log record after waiting for a timeout; if it does not exist, add data with the key.

[0070] The present invention constructs a set of identification and association models for solving instant call data streams, which is not limited to QQ instant calls and is applicable to a variety of similar instant call data stream identification and association.

[0071] The software consists of two parts: parsing program and aggregation association program. The parsing program is mainly used for large-volume data access.

[0072] Weak recognition is performed on speech data. The purpose of weak recognition is to reduce useless traffic and relieve the pressure of subsequent strong recognition.

[0073] The data traffic will enter the corresponding instant call analysis module for strong recognition. The data successfully recognized will extract the data information required for association and provide

[0074] Get the associated data information and send it to the aggregation association program in real time.

[0075] The aggregation association program receives the data information extracted by the parsing program and establishes an association group based on the unique identifier in the extracted key information.

[0076] The corresponding association groups are continuously added to the subsequent data streams of a single instant call. After the instant call ends, the data is output in units of association groups.

[0077] Call record information, which includes the call participants in addition to the five-tuple, call start and end time, call duration and other basic information

[0078] This instant call takes QQ instant call as an example.

[0079] The overall process steps are:

[0080] 1) The parser accesses the network data stream;

[0081] 2) The parsing program identifies the instant messaging data message, i.e., identifies the session in which the message is located as an instant messaging data message;

[0082] 3) The parsing program extracts key data based on the characteristics of the instant messaging data message;

[0083] 4) The parsing program sends the key data extracted in step 3) to the aggregation program;

[0084] 5) The aggregation program builds a hash mapping table based on the IDs of both parties and the group ID in the key data, waits for the data of both parties to arrive, and then associates and outputs the call behavior records of both parties in the instant call;

[0085] 6) When the aggregation program is associated with the two parties of the call, the instant call behavior record is output. If it is not associated with the two parties of the call, the instant call behavior record is output after waiting for the data timeout.

[0086] Furthermore, the parsing program is mainly used to be deployed to each node to access large-volume data and filter, parse and extract the data. This time, we mainly focus on instant call data, so we will perform weak identification on instant call-like data. Weak identification is a relatively broad rule to ensure that all instant call data is included, but there is a certain proportion of misidentification. After weak identification, the traffic will be greatly reduced, thereby reducing the pressure on the instant call strong identification and parsing extraction modules; the weakly identified data will be further strongly identified, and useful data information will be extracted and sent to the aggregation association program.

[0087] Main process of analysis program

[0088] 1) Network data traffic is connected to the parsing device, and the parsing program takes out data from the network card and starts parsing;

[0089] 2) The parsing program parses the Ethernet data encapsulation format from the link layer, network layer, and transport layer layer one by one. When parsing to the transport layer, it then establishes a hash session mapping table, i.e., a session flow table, based on the five-tuple information (source IP, destination IP, source port, destination port, and transport layer protocol number) extracted from the data. The session flow table is a mapping table established with the five-tuple as the key. The five-tuples of subsequent messages in the forward or reverse direction (i.e., source and destination IPs are interchanged, source and destination ports are interchanged) are all classified as the same session. The session mentioned later also has this meaning;

[0090] 3) The duration of session survival is determined by whether there are continuous messages arriving in the subsequent session. If there are continuous messages arriving, the timeout time of the session is updated in real time to the latest time. When no messages arrive, the session will determine whether the difference between the last message arrival time and the current time exceeds the preset timeout time. If the timeout time is exceeded, the session is considered to have timed out and the session is deleted from the hash mapping flow table.

[0091] 4) Extract the data part carried by the UDP transport layer of each message. Do not process the data without payload. The payload is the data part carried by UDP. The UDP payload is used to identify the data protocol and extract key information. The target data for this identification is QQ instant messaging data. Follow the steps below to identify and extract data.

[0092] 5) Weak identification of QQ instant messaging data based on UDP payload

[0093] The characteristic message is defined as follows:

[0094]

[0095] QQ instant messaging data weak identification steps:

[0096] a. Limit the UDP packets with port number 8000 to perform weak identification of QQ instant messaging protocol;

[0097] b. The UDP payload of the data message satisfies one of the three characteristic messages in the above table, that is, it is successfully weakly identified as QQ instant messaging data, indicating that the message and the conversation it is in are QQ instant messaging data;

[0098] 6) Strongly identify data that is weakly identified as QQ instant messaging data

[0099] Define characteristic messages:

[0100]

[0101] QQ instant call data features include personal calls (one-to-one calls) and group calls (calls involving more than 3 people).

[0102] a. Strong identification of individual call types:

[0103] Type 1: The message in the session contains only "signature message B";

[0104] Type 2: In a session, "signature message A" arrives first, followed by "signature message C";

[0105] If any of the above two types appear, it is determined to be personal call session data;

[0106] b. Strong identification of group call types:

[0107] In the conversation, "characteristic message A" arrives first, and "characteristic message B" appears later, which means that the conversation is determined to be group call data.

[0108] 7) Extract key information from QQ instant messaging

[0109] Personal calls:

[0110] After investigation and research, we found that QQ instant call data, one-to-one through the data message will carry the personal internal unique identification ID and the internal unique identification ID of the other party. We extract these two identification IDs and build a hash key with these two identification IDs to associate the data information of the two parties. Since the other party's call data also carries the personal internal QQ identification and the internal QQ identification of the other party, the key constructed by this can uniquely associate the data of both parties. The main data extraction methods are as follows:

[0111] Extract 4 bytes starting from the 19th byte of the "Signature Message B" payload and convert them into an integer as the personal QQ internal identification ID;

[0112] Extract 4 bytes starting from the 31st byte of the "Feature Message B" payload and convert them into an integer as the internal identification ID of the other party's QQ.

[0113] The 25th byte of the "characteristic message B" payload is used as the data to identify the start, progress, and end of the call status;

[0114] Parse and extract the source IP, destination IP, source port, destination port, first message arrival time, maximum message arrival time, own QQ internal identification ID, the other party's QQ internal identification ID, number of messages, total UDP payload byte data, and send these key information to the aggregation program through the socket.

[0115] Group call:

[0116] Extract the 4-byte integer at index 13 of the "Feature Message B" payload as the QQ internal identification ID of a single participant in the group call;

[0117] Extract the 4-byte integer at index 17 of the "Feature Message B" payload as the internal group ID of the group call;

[0118] Parse and extract the source IP, destination IP, source port, destination port, first message arrival time, last message arrival time, own QQ internal ID, group call group ID, QQ internal ID list of other participants in the group call, number of messages, total number of UDP payload bytes, and send these key information to the aggregation program through socket.

[0119] Furthermore, the aggregation program is independent of the parsing program, and exchanges data with the parsing program through sockets. The main function of the aggregation program is to associate the participants of instant calls one-to-one or many-to-many. Because it is independent of the parsing, the actual deployment can not only be deployed on the same device, but also on different machines, making it easy to deploy and expand.

[0120] step:

[0121] 1) From the aggregation and association program to the parsing program, key information of the participants in the QQ instant messaging conversation is extracted;

[0122] Personal calls include source IP, destination IP, source port, destination port, first message arrival time, last message arrival time, own QQ internal ID, the other party's QQ internal ID, message quantity, and UDP payload total bytes;

[0123] A group call includes the source IP, destination IP, source port, destination port, first message arrival time, last message arrival time, own QQ internal ID, group ID of the group call, QQ internal ID list of other participants in the group call, number of messages, and total number of UDP payload bytes.

[0124] 2) Personal call module processing flow:

[0125] When personal call data arrives, first check whether the data is reasonable. If unreasonable data members appear, all the collected data will be discarded and no subsequent operations will be continued; if the verified data is reasonable, the subsequent operations will be carried out;

[0126] Personal call data includes the internal ID of the user's QQ account and the internal ID of the other party's QQ account. These two IDs are used to build a unique association key between the two parties of the call, and a hash table is created to associate the information of the two parties of the one-to-one call.

[0127] Query the hash table with the key constructed in step b. If the key is found, update the data and update the time (the basis for subsequent timeout judgment). If it does not exist, add a new hash table member with the key and update the data.

[0128] The timeout thread periodically queries whether the difference between the last active time of the hash table member and the current time exceeds the preset timeout time. If it exceeds, it determines that the timeout has occurred and outputs the hash member information to the log. If it does not exceed, no operation is performed.

[0129] 3) Group call module processing flow:

[0130] When group call data arrives, first check whether the data is reasonable. If unreasonable data members appear, all the collected data will be discarded and no subsequent operations will be continued; if the verified data is reasonable, then proceed with the subsequent operations;

[0131] Query the group hash table through the group ID carried by the group call participants. If the group ID exists, update the group member information. If not, add a new group member using the group ID as the key.

[0132] Collect as much group member information as possible and add it to the corresponding group table. Update the group activity timestamp every time a group member is collected.

[0133] The timeout thread periodically queries whether the difference between the last active time of the group hash table member and the current time exceeds the preset timeout time. If it exceeds, it is judged as a timeout and the group hash member information is output to the log. If it does not exceed, no operation is performed.

[0134] 4) The output QQ instant call related log data is stored in the database for front-end filtering and query.

[0135] The above disclosures are only several preferred embodiments of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for identifying instant call services based on relationship analysis, characterized in that: include: 1) Access network data streams using parsing programs; 2) When the parsing program identifies an instant messaging data message, the session in which the message is located is identified as an instant messaging data message; 3) Extract key data based on the characteristics of instant messaging data messages using a parsing program; 4) Using the parsing program to send the key data extracted in step 3) to the aggregation program; 5) using the aggregation program to receive the key data sent by the analysis program to determine whether it is an individual call or a group call; If it is a personal call, it will enter the personal call processing module; if it is a group call, it will enter the group call processing module; The analysis procedure includes: The network data traffic is connected, and the parsing program takes out the data from the network card and starts parsing; According to the Ethernet data encapsulation format, the data is parsed from the link layer, network layer and transport layer to the transport layer in sequence, and five-tuple information is extracted from the parsed data. A hash session mapping table, i.e., a session flow table, is established based on the five-tuple information. Using the five-tuple as a key, query whether the key exists in the session flow table. If so, determine whether the session flow is successfully identified as an instant call protocol. If not, create a new flow table session using the five-tuple information as a key. The "determining whether the session is successfully identified as an instant call protocol" includes: Weakly identify the instant messaging data according to the UDP payload; the step of "weakly identifying the instant messaging data according to the UDP payload" includes: Define three characteristic messages: characteristic message 1, characteristic message 2 and characteristic message 3; Characteristic message 1 means: the binary value of the first byte of the UDP payload is 0x28, and the binary value of the last byte is 0x29; Characteristic message 2 means: the binary value of the first byte of the UDP payload is 0x5d; Characteristic message 3 means: the binary value of the first byte of the UDP payload is 0x02, and the binary value of the last byte is 0x03; Only UDP packets with port number 8000 are allowed to perform weak identification of instant messaging protocols; Determine whether the UDP payload of the data message meets one of the above three characteristic messages. If so, it is successfully weakly identified as instant messaging data, and the message and the session it is in are marked as instant messaging data. If not, the weak identification fails and is discarded; Strongly identify data that is weakly identified as instant messaging; the “strongly identify data that is weakly identified as instant messaging” includes: Define three characteristic messages: characteristic message A, characteristic message B and characteristic message C; Characteristic message A means: the binary value of the first byte of the UDP payload is 0x28, and the payload content contains the string "android" or "ios" or "apple"; Characteristic message B means: the binary value of the first byte of the message payload is 0x02; Characteristic message C means: the binary value of the first byte of the message payload is 0x5d; Strong identification of personal call types and group call types; the strong identification of personal call types includes: Type 1: the message in the session has only "characteristic message B"; Type 2: "characteristic message A" arrives first in the session, and "characteristic message C" appears later; any of the above two types is determined to be personal call session data; the strong identification of group call types includes: "characteristic message A" arrives first in the session, and "characteristic message B" appears later, that is, the session is determined to be group call data; When judging whether the session is successfully identified as an instant call protocol, if so, the instant call parsing module is entered; if not, the protocol identification module is entered; when a new flow table session is created with the five-tuple information as the key, the protocol identification module is directly entered; after entering the protocol identification module, it is judged again whether it is successfully identified as a technical call protocol; if so, the instant call parsing module is entered; the instant call parsing module is used for strong identification, and the data with successful strong identification will extract key information; After entering the instant call analysis module, key information is extracted and sent to the aggregation program; The "personal call processing module" process includes: Check whether the data is reasonable. If so, build a key using the personal ID and the other party's ID. If not, discard the data. Check if the key exists in the personal call hash table; if it does, update the data information corresponding to the key and output the log record after waiting for a timeout; if it does not exist, add data with the key; The "group call processing module" process includes: Check whether the data is reasonable. If so, construct a key using the group ID. If not, discard the data. Check whether the key exists in the group call hash table; if it exists, update the data information corresponding to the key and output the log record after waiting for a timeout; if it does not exist, add data with the key.

Images