Data message label verification method and system

Abstract

The present disclosure relates to a method, system, electronic device and computer-readable medium for verifying labels of data packets. The method includes: obtaining traffic data, wherein the traffic data is 5G traffic data; when the message in the traffic data is a signaling message, generating an association table entry based on the signaling message; when the message in the traffic data is a data message, adding a label to the data message based on the association table entry; generating a deep message detection rule based on the association table entry; and verifying the data message with the label added based on the deep message detection rule. The method, system, electronic device and computer-readable medium for verifying labels of data packets involved in the present application can quickly and accurately determine whether the labeling data of a large number of users is correct, improve the efficiency of the test work, and can also significantly reduce the errors caused by the manual inspection process of the test personnel.

Description

Technical Field

[0001] The present disclosure relates to the field of computer information processing, and in particular, to a method, system, electronic device and computer-readable medium for verifying a label of a data message. Background Art

[0002] 5G is a new generation of mobile communication technology. With the rapid development and widespread application of 5G technology, a large amount of user data and signaling traffic is generated when users use 5G to access the Internet. The development of 5G has also brought a series of changes and challenges to traditional equipment. If the security management and control in the 5G network cannot keep up with the rapid development of 5G, information security and network security issues will arise in the network, which will affect the security and stability of the country and society. In order to ensure the security of user Internet data, it is necessary to manage and analyze user data traffic.

[0003] By attaching the user address and other information of each Internet user in the existing network as a label to the user's data flow, the user's Internet flow can be better managed and analyzed. This method of attaching user information to Internet flow is called labeling. With millions of users and a large amount of Internet flow in the existing network, it is necessary to ensure that each Internet data flow can be labeled with the correct label belonging to each user.

[0004] The testing of marking equipment is mainly carried out through manual comparison. Through debugging, the label of the current data flow is checked, and the label information is compared with the information in the associated table one by one to verify whether the qualified equipment has been correctly marked. This method consumes a lot of manpower, material resources and time.

[0005] Therefore, a new data message label verification method, system, electronic device and computer-readable medium are needed.

[0006] The above information disclosed in the Background section is only for enhancement of understanding of the background of the present application and therefore it may contain information that does not constitute the prior art that is already known to a person of ordinary skill in the art. Summary of the invention

[0007] In view of this, the present application provides a data message label verification method, system, electronic device and computer-readable medium, which can quickly and accurately determine whether the marking data of a large number of users is correct, improve the testing efficiency, and significantly reduce the errors caused by the manual inspection process of testers.

[0008] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0009] According to one aspect of the present application, a method for verifying a label of a data packet is proposed, the method comprising: obtaining traffic data, wherein the traffic data is 5G traffic data; when a message in the traffic data is a signaling message, generating an association table entry based on the signaling message; when a message in the traffic data is a data packet, adding a label to the data packet based on the association table entry; generating a deep packet detection rule based on the association table entry; and verifying the data packet with the label added based on the deep packet detection rule.

[0010] In an exemplary embodiment of the present application, acquiring flow data includes: acquiring the flow data through a logic board of a marking device.

[0011] In an exemplary embodiment of the present application, generating an association table entry based on the signaling message includes: forwarding the signaling message to a service board for processing to generate the association table entry.

[0012] In an exemplary embodiment of the present application, the signaling message is forwarded to the service board for processing to generate the association table entry, including: the service board decodes the signaling message to generate decoded data; associates and synthesizes the decoded data to generate the association table entry; and sends the association table entry to the logic board.

[0013] In an exemplary embodiment of the present application, adding a label to the data message based on the associated table entry includes: matching the data message with multiple table entry data in the associated table entry; when the match is consistent, marking the table entry data as a label of the data message.

[0014] In an exemplary embodiment of the present application, generating a deep packet inspection rule based on the association table entry includes: converting the association table entry into a spreadsheet file; and generating the deep packet inspection rule based on the spreadsheet file.

[0015] In an exemplary embodiment of the present application, generating the deep packet inspection rule based on the electronic spreadsheet file includes: filling the data in the electronic spreadsheet document into a predetermined position in the deep packet inspection rule to generate the deep packet inspection rule.

[0016] In an exemplary embodiment of the present application, the data packet with the label added is verified based on the deep packet detection rule, including: the diversion device obtains the data packet with the label added; the data packet is matched with the deep packet detection rule; the data packet with a match is correctly labeled; the data packet with a mismatch is incorrectly labeled.

[0017] In an exemplary embodiment of the present application, it also includes: generating a target association table entry, the target association table entry containing a single table entry data; generating a target deep message detection rule based on the target association table entry; performing traffic filtering on the data message with the label added based on the target application message detection rule to extract the target data message.

[0018] According to one aspect of the present application, a label verification system for data packets is proposed, and the device includes: a labeling device, used to obtain traffic data, wherein the traffic data is 5G traffic data; when the message in the traffic data is a signaling message, generating an association table entry based on the signaling message; when the message in the traffic data is a data message, adding a label to the data message based on the association table entry; a server, used to generate a deep message detection rule based on the association table entry; and a diversion device, used to verify the data message with the label added based on the deep message detection rule.

[0019] According to one aspect of the present application, an electronic device is proposed, which includes: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method as described above.

[0020] According to one aspect of the present application, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0021] According to the data message label verification method, system, electronic device and computer-readable medium of the present application, by acquiring traffic data, the traffic data is 5G traffic data; when the message in the traffic data is a signaling message, generating an association table entry based on the signaling message; when the message in the traffic data is a data message, adding a label to the data message based on the association table entry; generating a deep message detection rule based on the association table entry; and verifying the data message with the label based on the deep message detection rule can quickly and accurately determine whether the labeling data of a large number of users is correct, thereby improving the test work efficiency and significantly reducing the errors caused by the manual inspection process of the test personnel.

[0022] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and other objects, features and advantages of the present application will become more apparent by describing in detail the exemplary embodiments thereof with reference to the accompanying drawings. The accompanying drawings described below are only some embodiments of the present application, and it is clear to a person skilled in the art that other accompanying drawings can be obtained from these accompanying drawings without creative effort.

[0024] Figure 1 The figure is a schematic diagram of a data message label verification system according to an exemplary embodiment.

[0025] Figure 2 The present invention is a flowchart of a method for verifying a label of a data message according to an exemplary embodiment.

[0026] Figure 3 The figure is a flow chart of a method for verifying a label of a data message according to another exemplary embodiment.

[0027] Figure 4 It is a schematic diagram of a method for verifying a label of a data message according to another exemplary embodiment.

[0028] Figure 5 It is a schematic diagram of a method for verifying a label of a data message according to another exemplary embodiment.

[0029] Figure 6 It is a block diagram of an electronic device according to an exemplary embodiment.

[0030] Figure 7 It is a block diagram of a computer-readable medium according to an exemplary embodiment. DETAILED DESCRIPTION

[0031] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this application will be comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0032] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, systems, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0034] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0035] It should be understood that although the terms first, second, third, etc. may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another component. Therefore, the first component discussed below can be referred to as the second component without departing from the teachings of the concepts of the present application. As used herein, the term "and / or" includes any one of the associated listed items and all combinations of one or more.

[0036] Those skilled in the art will appreciate that the drawings are merely schematic diagrams of example embodiments, and the modules or processes in the drawings are not necessarily necessary for implementing the present application, and therefore cannot be used to limit the scope of protection of the present application.

[0037] The technical abbreviations involved in this application are explained as follows:

[0038] Data message: data traffic collected by the 5G user plane interface. The main interfaces are N3, N6, and N9.

[0039] Signaling message: traffic collected by the 5G core network interface. The different interfaces here mainly include N1, N2, N4, N5, N7, N8, N10, N11, N12, N14, N15, N22 and other interfaces.

[0040] Association table: A table item formed by combining the user's three-code information, location information, network slice, DNN information, and the IP+TEID assigned by the operator to the user. Each user has his or her own unique association table item.

[0041] Data marking: Append the user information in the association table to the end of the user's corresponding data message in the specified format.

[0042] DPI rule: A deep packet search method used by the device for packets, including fixed DPI rules and floating DPI rules. Different types of DPI rules can be selected according to different test methods.

[0043] Traffic diversion device: forwards the traffic passing through the device to different interfaces as required based on the configured rules.

[0044] The inventor of this application has discovered that the current method for 5G data message association tagging is that the device extracts the user's association table information from the received signaling message and sends it to the tagging device. The user's Internet data message is matched with the association table, and the user information on the association table is attached to the end of the data message and transferred out. The current tagged association table information can be viewed through debugging, and the debug information is used to compare each field with the message after the tag is transferred out to determine whether the tag field of the data message is attached correctly. This method of comparing fields to determine whether the tag content is correct is the most commonly used testing method.

[0045] In the current method, debug information can only be printed for a small number of users. If there are too many users, the debug information will be too much and cannot be printed out completely. The fields that need to be marked in the data message are long and each field needs to be compared, so it is difficult to check accurately manually. When a large number of marked data messages need to be checked, manual checking seriously affects the test efficiency. It is impossible to find data messages with specific labels from a large number of marked data.

[0046] In view of the technical defects in the prior art, the present application proposes a method for verifying the label of a data message. The method in the present application can quickly and accurately identify whether the content of the labeled data message is correct in the application scenario of a large number of users and high-speed message labeling, thereby improving the accuracy of the test results and improving the test efficiency.

[0047] Figure 1 The figure is a schematic diagram of a data message label verification system according to an exemplary embodiment.

[0048] like Figure 1 As shown, the system architecture 10 may include terminal devices 101, 102, 103, a network 104, a marking device 105, a server 106, and a shunt device 107. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the marking device 105, and between the marking device 105, the server 106, and the shunt device 107. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0049] The terminal devices 101, 102, 103 interact with the marking device 105 through the network 104 to receive or send traffic data, etc. Various communication client applications can be installed on the terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0050] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0051] The marking device 105 may be a marking device that provides marking services, for example, setting labels for traffic data generated by the terminal devices 101 , 102 , and 103 .

[0052] The server 106 can be a server that processes the information related to the data tags and can perform format conversion and other processing on the data tags.

[0053] The traffic distribution device 107 can match the traffic data with different rules, and distribute the data traffic to different interfaces for outgoing transfer according to the matching results.

[0054] The marking device 105 can, for example, obtain traffic data, where the traffic data is 5G traffic data; when the message in the traffic data is a signaling message, the marking device 105 can, for example, generate an association table entry based on the signaling message; when the message in the traffic data is a data message, the marking device 105 can, for example, add a label to the data message based on the association table entry; the server 106 can, for example, generate a deep packet detection rule based on the association table entry; the diversion device 107 can, for example, verify the data message with the label added based on the deep packet detection rule.

[0055] The marking device 105, server 106, and diversion device 107 can all be a physical server, or can be composed of multiple servers. It should be noted that the label verification method for the data message provided in the embodiment of the present application can be executed by the marking device 105, server 106, and diversion device 107.

[0056] According to the data message label verification system of the present application, by acquiring traffic data, the traffic data is 5G traffic data; when the message in the traffic data is a signaling message, an association table item is generated based on the signaling message; when the message in the traffic data is a data message, a label is added to the data message based on the association table item; a deep message detection rule is generated based on the association table item; and a method of verifying the data message with the label added based on the deep message detection rule can quickly and accurately determine whether the labeling data of a large number of users is correct, thereby improving the test work efficiency and significantly reducing the errors caused by the manual inspection process of the testers.

[0057] Figure 2 The flowchart of a method for verifying a label of a data message according to an exemplary embodiment is shown. The method 20 for verifying a label of a data message at least includes steps S202 to S210.

[0058] like Figure 2 As shown, in S202, traffic data is obtained, and the traffic data is 5G traffic data. The traffic data can be obtained through the logic board of the marking device.

[0059] In S204, when the message in the flow data is a signaling message, an association table entry is generated based on the signaling message. The signaling message may be forwarded to a service board of a marking device for processing to generate the association table entry.

[0060] More specifically, the service board decodes the signaling message to generate decoded data; associates and synthesizes the decoded data to generate the association table entry; and sends the association table entry to the logic board.

[0061] In S206, when the message in the traffic data is a data message, a label is added to the data message based on the association table entry. The data message is matched with multiple table item data in the association table entry; when the match is consistent, the table item data is used as a label for the data message.

[0062] In S208, a deep packet inspection rule is generated based on the association table entry. The association table entry is converted into a spreadsheet file; and the deep packet inspection rule is generated based on the spreadsheet file.

[0063] More specifically, the data in the electronic spreadsheet document may be filled into a predetermined position in the deep packet inspection rule to generate the deep packet inspection rule.

[0064] In S210, the data packet with the label is verified based on the deep packet inspection rule. The diversion device obtains the data packet with the label; matches the data packet with the deep packet inspection rule; the data packet with the matching result is correctly labeled; the data packet with the matching result is incorrectly labeled.

[0065] In one embodiment, a target association table item may be generated, the target association table item includes single item data; a target deep message detection rule is generated based on the target association table item; and the data message with the tag is filtered based on the target application message detection rule to extract the target data message. By configuring only one DPI rule, the traffic data of a specific user that meets this DPI rule can be found from a large amount of labeled data.

[0066] According to the label verification method of data packets of the present application, by obtaining traffic data, the traffic data is 5G traffic data; when the message in the traffic data is a signaling message, an association table item is generated based on the signaling message; when the message in the traffic data is a data message, a label is added to the data message based on the association table item; a deep message detection rule is generated based on the association table item; and the method of verifying the data message with the label added based on the deep message detection rule can quickly and accurately determine whether the labeling data of a large number of users is correct, thereby improving the test work efficiency and significantly reducing the errors caused by the manual inspection process of the testers.

[0067] Compared with the prior art, which manually checks whether the marking data in each data message is correct, the present invention significantly reduces the errors caused by the tester's manual inspection process. When the number of users reaches millions and the data flow is calculated in G, the tester will waste a lot of time manually checking whether the marking of each message is correct. Regardless of whether the tester uses the same byte length data flow or the existing network byte length data flow, by configuring the floating DPI rule, the present invention can quickly and accurately determine whether the marking data of a large number of users is correct, thereby improving the test work efficiency.

[0068] It should be clearly understood that the present application describes how to form and use specific examples, but the principles of the present application are not limited to any details of these examples. On the contrary, based on the teaching of the content disclosed in the present application, these principles can be applied to many other embodiments.

[0069] Figure 3 The figure is a flow chart of a method for verifying a label of a data message according to another exemplary embodiment. Figure 3 The process 30 shown is for Figure 2 Detailed description of the process shown.

[0070] like Figure 3 As shown, in S302, traffic data is obtained, and the traffic data is 5G traffic data. 5G messages of a large number of users pass through the logic board of the marking device, and the logic board determines whether the message belongs to a signaling message.

[0071] In S304, it is determined by the logic board whether the message is a data message.

[0072] In S306, the service board generates an association table entry based on the signaling message. If the message is a signaling message, it is forwarded to the CPU service board for decoding, association, and synthesis of association table entries.

[0073] The content of the association table generated by the business board has a fixed format. The specific information in the association table includes source IP+source TEID+destination IP+destination TEID+labeled content. The labeling content required in the data message labeling process is also arranged in a fixed format, but the content of each field in the labeling content of different users will be different. The labeling content format is as follows: Figure 4 shown.

[0074] In S308, the association table entry is converted into a deep packet inspection rule.

[0075] For DPI rules in general traffic diversion devices, the command line for issuing DPI rules has a fixed format. You can use the following fixed format to issue rules, as follows:

[0076] add fix-dpi ruleid rulegroupID save transmit statistics nocomplexxxxxxxxxxxxxxxxx ffffffffffffffff

[0077] in:

[0078] Ruleid: rule ID number, which can be modified according to your needs;

[0079] rulegroupID: rule group ID, the interface group ID to which the matching traffic is forwarded. This does not need to be modified.

[0080] Xxxxxxxxxxxxxxxx: The configured feature code. In the issued DPI rule, you only need to modify this part of the content to the content that needs to be marked;

[0081] Ffffffffffffffff: Signature code mask. Since all signature codes need to be matched, this configuration remains unchanged.

[0082] When there are data packets from millions of users, a large number of DPI rules must be issued to match the labeled data of different users. At this time, it is unrealistic to issue rules one by one using the command line. This application uses the following method to issue rules:

[0083] (1) Export the associated table items in the marking device to an Excel file. Each line in the file contains only one user's marking content. When there are a large number of user association tables, because each user's marking content is different, there will be many lines of user marking content in the Excel file.

[0084] (2) Complete the Excel spreadsheet document with all information of the DPI rule except the feature code according to the DPI rule command line format, copy the marking content from the associated table and add it to the feature code position of the DPI rule. After saving the document, import the document into the diversion device. The file imported into the diversion device can be converted into a .csv file format after application. The content of this format can convert each line of content into a corresponding data string and send it to the logic, so that the DPI rule is sent to the diversion device. Such an Excel document can be used multiple times, which is convenient for making corresponding modifications according to the modification of the marking content.

[0085] The DPI rule format in the Excel table is as follows Figure 5 As shown in Figure 5, in actual application scenarios, when configuring a DPI rule document, you only need to increment the ruleid in sequence and copy the marked content to the feature code position.

[0086] In S310, a tag is set for the data message. The business board sends the association table entry to the logic board to mark the data message. The logic board determines that the 5G message is a data message, and matches it with the association table entry sent by the business board to the logic board. After matching the association table, the marking content on the association table entry is attached to the end of the data message and forwarded from the interface of the marking device.

[0087] In S312, the data message with the label is sent to the diversion device.

[0088] In S314, the diversion device performs matching based on the deep packet inspection rule. The deep packet inspection (DPI) rule can use the signature code to match the payload on the message to perform traffic diversion. The DPI rule is configured on the diversion device, and the tag field of the tagged data message is matched through the specific signature code of the DPI rule.

[0089] In S316, the labeled data packet is forwarded to the traffic diversion device configured with the DPI rule through the interface, and the hit forwarding and miss forwarding functions of the DPI rule are used to distinguish whether the label of the labeled data packet is correct.

[0090] In S318, the data is correctly labeled, and the message transferred from the hit interface is a message with a correct label.

[0091] In S320, the data is incorrectly labeled. The message forwarded from the unmatched interface is an incorrectly labeled message.

[0092] By checking the content of the message transferred from the missed interface, you can directly find out which user's labeling data is wrong. This direct and efficient testing method can quickly locate the cause of the error and improve testing efficiency.

[0093] Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, the above functions defined by the above method provided in the present application are executed. The program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

[0094] In addition, it should be noted that the above figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0095] Figure 6 It is a block diagram of an electronic device according to an exemplary embodiment.

[0096] Refer to the following Figure 6 The electronic device 600 according to this embodiment of the present application is described. Figure 6 The electronic device 600 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0097] like Figure 6 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0098] The storage unit stores a program code, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps described in this specification according to various exemplary embodiments of the present application. For example, the processing unit 610 can perform the following steps: Figure 2 , Figure 3 Follow the steps shown in .

[0099] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0100] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0101] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0102] The electronic device 600 may also communicate with one or more external devices 600' (e.g., keyboards, pointing devices, Bluetooth devices, etc.) to enable a user to communicate with the electronic device 600, and / or any device (e.g., routers, modems, etc.) that the electronic device 600 can communicate with one or more other computing devices. Such communication may be performed via an input / output (I / O) interface 650. In addition, the electronic device 600 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 660. The network adapter 660 may communicate with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0103] Through the above description of the implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by combining software with necessary hardware. Figure 7 As shown, the technical solution according to the implementation mode of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the implementation mode of the present application.

[0104] The software product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0105] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0106] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0107] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by a device, the computer-readable medium implements the following functions: obtaining traffic data, wherein the traffic data is 5G traffic data; when the message in the traffic data is a signaling message, generating an association table entry based on the signaling message; when the message in the traffic data is a data message, adding a label to the data message based on the association table entry; generating a deep message detection rule based on the association table entry; and verifying the data message with the label added based on the deep message detection rule.

[0108] Those skilled in the art will appreciate that the above modules can be distributed in the device according to the description of the embodiment, or can be changed accordingly and only used in one or more devices different from the embodiment. The modules of the above embodiments can be combined into one module, or further divided into multiple sub-modules.

[0109] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiment of the present application.

[0110] The exemplary embodiments of the present application are specifically shown and described above. It should be understood that the present application is not limited to the detailed structures, configurations or implementations described herein; on the contrary, the present application is intended to cover various modifications and equivalent configurations included in the spirit and scope of the appended claims.

Claims

1. A method for verifying a label of a data message, characterized in that: include: Obtaining traffic data, where the traffic data is 5G traffic data; When the message in the traffic data is a signaling message, generating an association table entry based on the signaling message; When the message in the traffic data is a data message, adding a label to the data message based on the association table entry; Forwarding the signaling message to the service board, the service board decodes the signaling message to generate decoded data; Associating and synthesizing the decoded data to generate the association table entry; Sending the association table entries to a logic board, thereby converting the association table entries into a spreadsheet file, and generating deep packet inspection rules based on the spreadsheet file; The data packets with the labels added are verified based on the deep packet detection rules, including: the diversion device obtains the data packets with the labels added; the data packets are matched with the deep packet detection rules; the data packets with matching hits are correctly labeled; and the data packets with no matching hits are incorrectly labeled.

2. The method according to claim 1, characterized in that Get traffic data, including: The flow data is obtained through the logic board of the marking device.

3. The method according to claim 1, characterized in that Adding a label to the data message based on the association table entry includes: Matching the data message with multiple table entry data in the association table entry; When the match is consistent, the table entry data is used as a label of the data message for marking.

4. The method according to claim 1, characterized in that Generating the deep packet inspection rule based on the electronic spreadsheet file includes: The data in the electronic spreadsheet document is filled into a predetermined position in a deep packet inspection rule to generate the deep packet inspection rule.

5. The method according to claim 1, characterized in that Also includes: Generate a target association table entry, wherein the target association table entry includes single table entry data; Generate a target deep packet detection rule based on the target association table entry; Based on the target application message detection rule, the data message with the label is subjected to flow filtering to extract the target data message.

6. A data message label verification system, characterized in that: include: A marking device, used for obtaining traffic data, wherein the traffic data is 5G traffic data; When the message in the traffic data is a signaling message, generating an association table entry based on the signaling message; When the message in the traffic data is a data message, adding a label to the data message based on the association table entry; The server is used to forward the signaling message to the service board, and the service board decodes the signaling message to generate decoding data; Associating and synthesizing the decoded data to generate the association table entry; Sending the association table entries to a logic board, thereby converting the association table entries into a spreadsheet file, and generating deep packet inspection rules based on the spreadsheet file; The diversion device is used to verify the data packet with the label added based on the deep packet detection rule, including: the diversion device obtains the data packet with the label added; matches the data packet with the deep packet detection rule; the data packet with a match is correctly labeled; and the data packet with a mismatch is incorrectly labeled.

Images