Method and system for detecting service identification capability of DPI system

Abstract

The present invention provides a method and system for detecting the service identification capability of a DPI system, the detection method comprising: sending a service identification detection request to a DPI system to request the DPI system to perform service identification on the service flow of an Internet service to be detected contained in the service identification detection request; receiving a service identification detection response sent by the DPI system, the service identification detection response containing the service identification result of the DPI system on the service flow; and evaluating the service identification capability of the DPI system according to the service identification result. The present invention can detect the service identification capability of a DPI system, so as to achieve the purpose of driving various manufacturers in the existing network to improve the service identification capability of the DPI system, and further ensuring the value of upper-layer applications based on the DPI system.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network technology, and in particular to a method and system for detecting the service identification capability of a DPI system. Background Art

[0002] All provinces have built DPI (Deep Packet Inspection) systems, and some provinces have multiple DPI systems from different manufacturers. The service recognition rate of DPI systems on data traffic varies from province to province and from manufacturer to manufacturer. For example, Jiangxi is about 85% and Shaanxi is about 95%.

[0003] At present, the way to collect the business recognition accuracy of the DPI system in each province is that the group issues a work order and each province reports it. The statistical caliber and evaluation method of the DPI system are not unified.

[0004] The data output by the DPI system is the input of the upper-level application, and the business identification capability of the DPI system directly affects the results and value of the upper-level application system. Summary of the invention

[0005] The embodiments of the present invention provide a method and system for detecting the service identification capability of a DPI system, which are used to solve the problem that the existing network lacks effective means to detect the service identification capability of the DPI system.

[0006] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0007] In a first aspect, an embodiment of the present invention provides a method for detecting a service identification capability of a DPI system, including:

[0008] Sending a service identification detection request to the DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request;

[0009] Receiving a service identification detection response sent by the DPI system, wherein the service identification detection response includes a service identification result of the DPI system on the service traffic;

[0010] The service identification capability of the DPI system is evaluated according to the service identification result.

[0011] Optionally, before sending the service identification detection request to the DPI system, the following steps are also included:

[0012] Dial-up test of Internet services;

[0013] Capturing the business traffic of the Internet business;

[0014] The business type of the business traffic is marked and saved in a detection library.

[0015] Optionally, evaluating the service identification capability of the DPI system according to the service identification result includes:

[0016] If the service identification result includes the service type of the service flow identified by the DPI system, comparing the service type identified by the DPI system with the service of the service flow stored in the detection library;

[0017] The service identification capability of the DPI system is evaluated based on the comparison results.

[0018] Optionally, after receiving the service identification detection response sent by the DPI system, the method further includes:

[0019] If the service identification result indicates that the service type of the service flow is not identified, the unidentified service flow and relevant information of the DPI system are saved in a sample library.

[0020] Optionally, a service identification detection request is sent to the DPI system based on the SDTP protocol, and a service identification detection response sent by the DPI system is received.

[0021] Optionally, the service identification detection request further includes at least one of the following:

[0022] A field for indicating the number of packets of the traffic to be detected;

[0023] A field used to indicate a transmission protocol, where the transmission protocol is one of the Transmission Control Protocol TCP, the User Datagram Protocol UDP, and the Stream Control Transmission Protocol SCTP.

[0024] Optionally, the service identification detection response includes:

[0025] A field for indicating whether the service type of the service flow is identified; and

[0026] A field used to indicate the service type of the identified service traffic.

[0027] Optionally, the business type includes at least one of the following:

[0028] The business or application category to which the business traffic belongs;

[0029] The service or application subcategory to which the service traffic belongs;

[0030] The service or application subcategory to which the service traffic belongs.

[0031] In a second aspect, an embodiment of the present invention provides a system for detecting service identification capability of a DPI system, including:

[0032] A detection module is used to send a service identification detection request to a DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request; receive a service identification detection response sent by the DPI system, wherein the service identification detection response includes the service identification result of the DPI system on the service traffic; and, based on the service identification result, evaluate the service identification capability of the DPI system.

[0033] Optionally, the detection system further includes:

[0034] Detection library;

[0035] The dialing test module is used for dialing test of Internet services; capturing the service flow of the Internet services; marking the service type of the service flow and saving it in the detection library.

[0036] Optionally, the detection module is used to compare the business type identified by the DPI system with the business of the business traffic stored in the detection library if the business identification result includes the business type of the business traffic identified by the DPI system; and evaluate the business identification capability of the DPI system based on the comparison result.

[0037] Optionally, the detection system further includes:

[0038] Sample library;

[0039] The detection module is further configured to save the unidentified business traffic and related information of the DPI system into a sample library if the business identification result indicates that the business type of the business traffic is not identified.

[0040] Optionally, the detection module is used to send a service identification detection request to the DPI system based on the shared data transmission protocol SDTP protocol, and receive a service identification detection response sent by the DPI system.

[0041] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the method for detecting the service identification capability of the above-mentioned DPI system are implemented.

[0042] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for detecting the service identification capability of the above-mentioned DPI system are implemented.

[0043] In an embodiment of the present invention, a service identification detection request is sent to the DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request, and the service identification capability of the DPI system is evaluated based on the service identification result in the service identification detection response fed back by the DPI system. Therefore, according to the evaluation result, the existing network manufacturers can be driven to improve the service identification capability of the DPI system, thereby further ensuring the value of the upper-layer applications based on the DPI system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0045] Figure 1 A schematic diagram of the networking architecture between the DPI system, application system and telecommunication network;

[0046] Figure 2 A schematic diagram of a flow chart of a method for detecting the service identification capability of a DPI system according to an embodiment of the present invention;

[0047] Figure 3 It is a schematic diagram of the structure of the SDTP protocol stack;

[0048] Figure 4 A schematic diagram of the interaction process between a detection system for the service identification capability of a DPI system according to an embodiment of the present invention and a DPI system based on the SDTP protocol;

[0049] Figure 5 A schematic diagram of the format of a service identification detection request message according to an embodiment of the present invention;

[0050] Figure 6 A schematic diagram of the format of a service identification detection response request message according to an embodiment of the present invention;

[0051] Figure 7 A schematic diagram of the structure of a detection system for the service identification capability of a DPI system according to an embodiment of the present invention;

[0052] Figure 8 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Please refer to Figure 1 , Figure 1 Schematic diagram of the networking architecture between the DPI system, application system and telecommunication network.

[0055] The DPI (Deep Packet Inspection) system is the basic system for data collection and formatting in the existing network. The formatted data generated by the DPI system is called XDR (X Data Recording, a formatted data generated by DPI through the original bit stream), which is a concept evolved from CDR (Call Data Recording).

[0056] DPI is generally divided into home broadband DPI, mobile network DPI, etc. Mobile network DPI is generally divided into user plane DPI and signaling plane DPI according to different centralized procurement interfaces and domains. The present invention mainly targets the existing network scenarios of user plane DPI (i.e., corresponding to the S1-U interface of the 4G core network or the N3 interface of the 5G core network, etc.).

[0057] Service identification is the core function of user-side DPI. Currently, there are two main means of DPI service identification in the existing network: identification based on the rule base embedded in the DPI system and black-box service identification based on neural networks plugged into the DPI system. The results of DPI service identification will be stored in three fields in XDR: App Type, App Sub-type, and App Content. The interfaces supported by the DPI system by default include file-based SFTP (Secure File Transfer Protocol) / FTP (File Transfer Protocol) interfaces and real-time SDTP protocol interfaces.

[0058] To solve the problem that the existing network lacks effective means to detect the service identification ability of the DPI system. Figure 2 , an embodiment of the present invention provides a method for detecting the service identification capability of a DPI system, comprising:

[0059] Step 21: Sending a service identification detection request to the DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request;

[0060] Optionally, one or more service identification detection requests may be sent to the DPI system. Optionally, one service identification detection request may correspond to one Internet service, or multiple service identification detection requests may correspond to one Internet service, or multiple service identification detection requests may also correspond to one Internet service.

[0061] Step 22: receiving a service identification detection response sent by the DPI system, wherein the service identification detection response includes a service identification result of the DPI system on the service traffic;

[0062] Step 23: Evaluate the service identification capability of the DPI system according to the service identification result.

[0063] Optionally, a statistical analysis may be performed on a service identification result in at least one service identification detection response to obtain the service identification capability of the DPI system.

[0064] In an embodiment of the present invention, a service identification detection request is sent to the DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request, and the service identification capability of the DPI system is evaluated based on the service identification result in the service identification detection response fed back by the DPI system. Therefore, according to the evaluation result, the existing network manufacturers can be driven to improve the service identification capability of the DPI system, thereby further ensuring the value of the upper-layer applications based on the DPI system.

[0065] In the embodiment of the present invention, optionally, before sending the service identification detection request to the DPI system, the method further includes:

[0066] Step 201: dialing and testing Internet services;

[0067] Optionally, various types of Internet services may be dialed, such as existing services, hot services, new services or task management. During the dialing test, the dialing test may be performed automatically according to a preset time, frequency and / or quantity (service flow quantity and / or service quantity).

[0068] Step 202: Capture the service traffic of the Internet service;

[0069] Step 203: Mark the service type of the service flow and save it in the detection library.

[0070] In the embodiment of the present invention, optionally, the service type includes at least one of the following:

[0071] The business or application category to which the business traffic belongs;

[0072] The service or application subcategory to which the service traffic belongs;

[0073] The service or application subcategory to which the service traffic belongs.

[0074] In an embodiment of the present invention, the captured business traffic is stored in a detection library, and the business traffic in the detection library can be used to detect the business identification capability of the DPI system, thereby eliminating the need to use real-time business traffic on the existing network and achieving offline detection.

[0075] In the embodiment of the present invention, optionally, evaluating the service identification capability of the DPI system according to the service identification result includes:

[0076] Step 231: If the service identification result includes the service type of the service flow identified by the DPI system, compare the service type identified by the DPI system with the service of the service flow stored in the detection library;

[0077] Step 232: Evaluate the service identification capability of the DPI system according to the comparison result.

[0078] In an embodiment of the present invention, the type of the dialed business traffic is saved. When the business identification capability of the DPI system is tested, the type of business traffic identified by the DPI system is compared with the type of business traffic that can be detected, so that the accuracy of the business identification of the DPI system can be conveniently and effectively evaluated.

[0079] In the embodiment of the present invention, optionally, after receiving the service identification detection response sent by the DPI system, the method further includes:

[0080] Step 24: If the service identification result indicates that the service type of the service traffic is not identified, the unidentified service traffic and relevant information of the DPI system are saved in a sample library.

[0081] In the embodiment of the present invention, the unidentified service traffic is stored in a sample library and can be opened to various manufacturers so that each manufacturer can improve the service identification capability of its own DPI system.

[0082] In the embodiment of the present invention, optionally, a service identification detection request is sent to a DPI system based on a Shared Data Transfer Protocol (SDTP), and a service identification detection response sent by the DPI system is received.

[0083] In the embodiment of the present invention, the action of detecting the service identification capability of the DPI system is implemented by enhancing the message type of the SDTP protocol (adding two types of messages, service identification detection request and service identification detection response).

[0084] Please refer to Figure 3 , Figure 3 The figure is a schematic diagram of the structure of the SDTP protocol stack. The SDTP protocol is called the real-time data sharing transmission protocol. The SDTP protocol stack is divided into three layers, namely the bearer layer, the transport layer and the application layer. Among them, the bearer layer is the IP protocol, which provides an end-to-end data transmission channel; the transport layer (TCP+SDTP) provides a general data transmission protocol for upper-layer applications; the application layer encapsulates various reference data, such as XDR data or original signaling code stream data.

[0085] The SDTP protocol is the transmission protocol currently supported by the DPI system. Therefore, by sending a service identification detection request to the DPI system based on the SDTP protocol and receiving a service identification detection response sent by the DPI system, the service identification capability of the DPI system can be detected without making any changes to the existing DPI system, with low cost.

[0086] Please refer to Figure 4 , Figure 4 The following is a schematic diagram of the interaction process between the detection system of the service identification capability of the DPI system according to an embodiment of the present invention and the DPI system based on the SDTP protocol. The interaction process includes:

[0087] 1): The detection system establishes a TCP connection with the DPI system;

[0088] 2): The detection system and the DPI system perform version negotiation through version negotiation request and version negotiation response, and the version is the version of the SDTP protocol;

[0089] The message types of version negotiation request and version negotiation response used during version negotiation are shown in Table 1:

[0090] Table 1 SDTP message types

[0091]

[0092]

[0093] 3): The detection system and the DPI system perform link authentication through link authentication request and link authentication response; the message types of link authentication request and link authentication response are shown in Table 1.

[0094] 4): The detection system sends a service identification detection request to the DPI system, wherein the service identification detection request includes the service flow of the Internet service to be detected, and the DPI system feeds back a service identification detection response to the detection system, wherein the service identification detection response includes the service identification result of the DPI system on the service flow;

[0095] In an embodiment of the present invention, the detection system may send one or more service identification detection requests to the DPI system. Optionally, one service identification detection request may correspond to one Internet service, or multiple service identification detection requests may correspond to one Internet service, or multiple service identification detection requests may also correspond to one Internet service.

[0096] In the embodiment of the present invention, optionally, the service identification detection request includes at least one of the following in addition to the service traffic to be detected:

[0097] A field for indicating the number of packets of the traffic to be detected;

[0098] A field used to indicate a transmission protocol, where the transmission protocol is one of the Transmission Control Protocol TCP, the User Datagram Protocol UDP, and the Stream Control Transmission Protocol SCTP.

[0099] In an embodiment of the present invention, optionally, the service identification detection request further includes a message type field, and the message type is 0x0009. The message type is used to indicate that the message is a service identification detection request so that the DPI system can identify it. Of course, in some other embodiments of the present invention, other characters can also be used to indicate the message type, not limited to 0x0009.

[0100] Please refer to Figure 5 , Figure 5This is a format diagram of a service identification detection request message of an embodiment of the present invention, the message includes a message header (MessageHeader) and a message body (MessageBody), wherein the message header includes the following fields: total message length (TotalLength), message type (MessageType), sequence identifier (SequenceId) and TotalContents, and the message body includes the following fields: transmission protocol, the number of packets of the service flow to be detected (Package number) and data load (Load), the data load is used to carry the service flow to be detected. Among them, the transmission protocol can be TCP, UDP or SCTP, the number of bytes is 1, and the type is an unsigned integer (Unsigned Integer), for example, 1 represents TCP, 2 represents UDP, and 3 represents SCTP. The number of bytes occupied by the number of packets of the service flow to be detected is 1, and the type is an unsigned integer (Unsigned Integer). The number of bytes of the data load can be indefinite.

[0101] In the embodiment of the present invention, optionally, the service identification detection response includes:

[0102] A) a field for indicating whether the service type of the service flow is identified;

[0103] For example, if the service type of the service traffic is identified, this field may be 1; if the service type of the service traffic is not identified, this field may be 0.

[0104] B) A field for indicating the service type of the identified service traffic.

[0105] In the embodiment of the present invention, optionally, the service type includes at least one of the following:

[0106] The business or application category to which the business traffic belongs;

[0107] The service or application subcategory to which the service traffic belongs;

[0108] The service or application subcategory to which the service traffic belongs.

[0109] In an embodiment of the present invention, optionally, the service identification detection response further includes a message type field, and the message type is 0x8009. The message type is used to indicate that the message is a service identification detection response so that the detection system can recognize it. Of course, in some other embodiments of the present invention, other characters can also be used to indicate the message type, not limited to 0x8009.

[0110] Please refer to Figure 6 , Figure 6This is a format diagram of a service identification detection response message of an embodiment of the present invention, the message includes a message header (MessageHeader) and a message body (MessageBody), wherein the message header includes the following fields: total message length (TotalLength), message type (MessageType), sequence identifier (SequenceId) and TotalContents, and the message body includes the following fields: identification result (Result), the service or application category (App Type) to which the service traffic belongs, the service or application subcategory (App Sub-type) to which the service traffic belongs, and the service or application subcategory subdivision (App Content) to which the service traffic belongs; wherein the identification result is used to indicate whether the service type of the service traffic is identified. The byte number is 1, and the type is an unsigned integer (Unsigned Integer), for example, 0 indicates that the service type of the service traffic is not identified (i.e., identification fails), and 1 indicates that the service type of the service traffic is identified (i.e., identification is successful). The number of bytes occupied by the major business or application category to which the business traffic belongs is 2, and the type is an unsigned integer (Unsigned Integer), for example, to identify that the major business or application category to which the business traffic belongs is instant messaging; the number of bytes occupied by the minor business or application category to which the business traffic belongs is 2, and the type is an unsigned integer (Unsigned Integer), for example, to identify that the minor business or application category to which the business traffic belongs is WeChat; the number of bytes occupied by the subdivision of the business or application subcategory to which the business traffic belongs is 2, and the type is an unsigned integer (Unsigned Integer), for example, to identify that the minor business or application category to which the business traffic belongs is WeChat red envelope.

[0111] 5): The detection system and the DPI system perform link detection through link detection request and link detection response. The message types of link detection request and link detection response are shown in Table 1.

[0112] 6): The detection system and the DPI system perform link detection through data verification request and data verification response. The message types of data verification request and data verification response are shown in Table 1.

[0113] 7): The detection system and the DPI system perform link detection through link release request and link release response. The message types of link release request and link release response are shown in Table 1.

[0114] 8): The detection system and the DPI system disconnect the TCP connection.

[0115] Please refer to Figure 7 The embodiment of the present invention further provides a detection system for the service identification capability of a DPI system, comprising:

[0116] A detection module is used to send a service identification detection request to a DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request; receive a service identification detection response sent by the DPI system, wherein the service identification detection response includes the service identification result of the DPI system on the service traffic; and, based on the service identification result, evaluate the service identification capability of the DPI system.

[0117] That is, the detection module is responsible for interacting with the DPI system, managing detection tasks, and generating evaluation results.

[0118] In an embodiment of the present invention, a service identification detection request is sent to the DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request, and the service identification capability of the DPI system is evaluated based on the service identification result in the service identification detection response fed back by the DPI system. Therefore, according to the evaluation result, the existing network manufacturers can be driven to improve the service identification capability of the DPI system, thereby further ensuring the value of the upper-layer applications based on the DPI system.

[0119] In the embodiment of the present invention, it is optional, please refer to Figure 7 , the detection system further comprises:

[0120] Detection library;

[0121] The dialing test module is used for dialing test of Internet services; capturing the service flow of the Internet services; marking the service type of the service flow and saving it in the detection library.

[0122] That is, the dial test module is responsible for the management of dial test tasks, the execution of dial test logic, and the traffic capture of dial test services.

[0123] The data in the detection library can be indexed and continuously updated according to business type (major categories, minor categories, sub-category breakdown, etc.), popularity and / or time dimension (the newer the data, the higher the value).

[0124] In an embodiment of the present invention, optionally, the detection module is used to compare the service type identified by the DPI system with the service of the service traffic stored in the detection library if the service identification result includes the service type of the service traffic identified by the DPI system; and evaluate the service identification capability of the DPI system based on the comparison result.

[0125] Optionally, the detection system may further include: a detection library management module, which is used to manage the detection library 72.

[0126] In the embodiment of the present invention, it is optional, please refer to Figure 7, the detection system further comprises:

[0127] Sample library;

[0128] The detection module is further configured to save the unidentified business traffic and related information of the DPI system into a sample library if the business identification result indicates that the business type of the business traffic is not identified.

[0129] The data in the sample library can be understood as a subset of the data in the detection library, but it is necessary to record the correlation information with each different DPI system, so it should be an independent and redundant data set in practice.

[0130] Optionally, the detection system may further include: a sample library management module, configured to manage the sample library 75 .

[0131] In the embodiment of the present invention, optionally, the detection module is used to send a service identification detection request to the DPI system based on the SDTP protocol, and receive a service identification detection response sent by the DPI system.

[0132] The process of interaction between the detection module and the DPI system is described in the above method embodiment.

[0133] Please refer to Figure 8 The embodiment of the present invention further provides an electronic device 80, including a processor 81, a memory 82, and a computer program stored in the memory 82 and executable on the processor 81. When the computer program is executed by the processor 81, each process of the embodiment of the detection method for the service identification capability of the above-mentioned DPI system is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0134] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned DPI system service identification capability detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0135] The above embodiments of the present invention have the following advantages:

[0136] A solution for service identification detection and evaluation of the DPI system is proposed, which is currently lacking in the existing DPI system.

[0137] Reuse SDTP as the bearer protocol, add SDTP message types, and implement offline service identification capability detection;

[0138] It is more convenient to implement sampling detection according to different services and different time periods, and comprehensively evaluate the accuracy of service identification of the existing network DPI system;

[0139] It can be used for auxiliary detection of DPI upgrade of existing networks. Before and after the upgrade, a fixed set of detection sets is used to perform service identification detection and compare the upgrade effect.

[0140] The DPI performance loss is extremely small, and the DPI system does not need to cache and encapsulate the traffic, because the detection system has already extracted the business traffic (and processed the disorder, retransmission, etc.), and the DPI system can directly identify and return the identification results.

[0141] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0142] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0143] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A method for detecting the service identification capability of a deep packet inspection (DPI) system, characterized in that: include: Sending a service identification detection request to the DPI system to request the DPI system to perform service identification on the service traffic of the Internet service to be detected contained in the service identification detection request; Receiving a service identification detection response sent by the DPI system, wherein the service identification detection response includes a service identification result of the DPI system on the service traffic; According to the service identification result, evaluating the service identification capability of the DPI system; Sending a service identification detection request to the DPI system based on the shared data transmission protocol SDTP protocol, and receiving a service identification detection response sent by the DPI system; The service identification detection request further includes at least one of the following: A field for indicating the number of packets of the traffic to be detected; A field for indicating a transport protocol, wherein the transport protocol is one of the transmission control protocol TCP, the user datagram protocol UDP, and the stream control transmission protocol SCTP; The service identification detection response includes: A field for indicating whether the service type of the service flow is identified; and A field for indicating the service type of the identified service flow; The business type includes at least one of the following: The business or application category to which the business traffic belongs; The service or application subcategory to which the service traffic belongs; The service or application subcategory to which the service traffic belongs.

2. The method according to claim 1, characterized in that: Before sending a service identification detection request to the DPI system, the following steps are also included: Dial-up test of Internet services; Capturing the business traffic of the Internet business; The business type of the business traffic is marked and stored in a detection library.

3. The method according to claim 2, characterized in that According to the service identification result, evaluating the service identification capability of the DPI system includes: If the service identification result includes the service type of the service flow identified by the DPI system, comparing the service type identified by the DPI system with the service of the service flow stored in the detection library; The service identification capability of the DPI system is evaluated based on the comparison results.

4. The method according to claim 1, characterized in that: After receiving the service identification detection response sent by the DPI system, the method further includes: If the service identification result indicates that the service type of the service traffic is not identified, the unidentified service traffic and relevant information of the DPI system are saved in a sample library.

5. A detection system for the service identification capability of a DPI system, characterized in that: include: A detection module, configured to send a service identification detection request to a DPI system to request the DPI system to perform service identification on the service flow of the Internet service to be detected contained in the service identification detection request; receive a service identification detection response sent by the DPI system, wherein the service identification detection response includes a service identification result of the DPI system on the service flow; and, based on the service identification result, evaluate the service identification capability of the DPI system; The detection module is used to send a service identification detection request to the DPI system based on the shared data transmission protocol SDTP protocol, and receive a service identification detection response sent by the DPI system; The service identification detection request further includes at least one of the following: A field for indicating the number of packets of the traffic to be detected; A field for indicating a transport protocol, wherein the transport protocol is one of the transmission control protocol TCP, the user datagram protocol UDP, and the stream control transmission protocol SCTP; The service identification detection response includes: A field for indicating whether the service type of the service flow is identified; and A field for indicating the service type of the identified service flow; The business type includes at least one of the following: The business or application category to which the business traffic belongs; The service or application subcategory to which the service traffic belongs; The service or application subcategory to which the service traffic belongs.

6. The system according to claim 5, characterized in that Also includes: Detection library; A dialing test module, used for dialing test of Internet services and capturing the service flow of the Internet services; The business type of the business traffic is marked and saved in a detection library.

7. The system according to claim 6, characterized in that The detection module is used to compare the service type identified by the DPI system with the service of the service traffic stored in the detection library if the service identification result includes the service type of the service traffic identified by the DPI system; and evaluate the service identification capability of the DPI system based on the comparison result.

8. The system according to claim 5, characterized in that Also includes: Sample library; The detection module is further configured to save the unidentified business traffic and related information of the DPI system into a sample library if the business identification result indicates that the business type of the business traffic is not identified.

9. An electronic device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the method for detecting the service identification capability of the DPI system as described in any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for detecting the service identification capability of the DPI system according to any one of claims 1 to 4 are implemented.

Images