Data packet aggregation method, device and electronic device

Abstract

The present application discloses a data packet aggregation method, device, and electronic device. The method includes: obtaining a data stream to be processed, wherein the data stream consists of N data packets, where N is an integer greater than 1; obtaining the acquisition time of each data packet and the number of bytes of each data packet; determining a four-dimensional correlation vector of each data packet based on the acquisition time, the number of bytes, and the transmission direction of each data packet, wherein the four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets; and dividing the N data packets into at least one data packet set based on the four-dimensional correlation vector. The present application solves the technical problem of poor data packet set division quality in the prior art when dividing multiple data packets into at least one data packet set.

Description

Technical Field

[0001] The present application relates to the fields of data processing and information security, and more specifically, to a method, device, and electronic device for aggregating data packets. Background Art

[0002] In the field of information security, by analyzing data streams, we can determine whether the device sending the data stream has abnormal behavior, thereby achieving the purpose of information security detection. Therefore, how to analyze data streams efficiently and accurately is the key to improving the quality and efficiency of information security detection.

[0003] To more efficiently analyze data streams, multiple packets in a data stream are typically grouped into at least one packet set for analysis. However, existing techniques for grouping multiple packets into at least one packet set simply use the time at which the packets were acquired. For example, packets acquired within a minute are grouped into a single packet set. This approach ignores the correlations between other characteristic dimensions between packets, resulting in poor packet set segmentation quality.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present application provide a data packet aggregation method, device, and electronic device to at least solve the technical problem of poor data packet set division quality that exists in the prior art when dividing multiple data packets into at least one data packet set.

[0006] According to one aspect of an embodiment of the present application, a method for aggregating data packets is provided, including: obtaining a data stream to be processed, wherein the data stream consists of N data packets, and N is an integer greater than 1; obtaining the acquisition time of each data packet and the number of bytes of each data packet; determining a four-dimensional correlation vector of each data packet based on the acquisition time, the number of bytes, and the transmission direction of each data packet, wherein the four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets; and dividing the N data packets into at least one data packet set based on the four-dimensional correlation vector.

[0007] Furthermore, the data packet aggregation method also includes: determining the acquisition time of the previous data packet of each data packet as the first time according to the arrangement order of the N data packets in the data stream; determining the acquisition time of the next data packet of each data packet as the second time; and determining the four-dimensional correlation vector of each data packet according to the first time, the second time, the number of bytes of each data packet and the transmission direction of each data packet.

[0008] Furthermore, the data packet aggregation method also includes: when the data packet is the first data packet among N data packets, determining the first time corresponding to the first data packet as the acquisition time of the first data packet; when the data packet is the last data packet among N data packets, determining the second time corresponding to the last data packet as the acquisition time of the last data packet.

[0009] Furthermore, the data packet aggregation method also includes: determining the acquisition time of each data packet as the target time; calculating the absolute value of the difference between the target time and the first time to obtain the first interval duration; calculating the absolute value of the difference between the target time and the second time to obtain the second interval duration; determining the four-dimensional correlation vector of each data packet based on the first interval duration, the second interval duration, the number of bytes of each data packet and the transmission direction of each data packet.

[0010] Furthermore, the data packet aggregation method also includes: after determining the four-dimensional correlation vector of each data packet based on the acquisition time, the number of bytes and the transmission direction of each data packet, determining the target data packet from N data packets, wherein the target data packet is any data packet among the N data packets except the last data packet; determining the four-dimensional correlation vector corresponding to the target data packet as the first vector to be processed; determining the four-dimensional correlation vector corresponding to the data packet following the target data packet as the second vector to be processed; determining the target angle cosine value of the target data packet based on the first vector to be processed and the second vector to be processed; and constructing a correlation vector field based on the target angle cosine value and the four-dimensional correlation vector of each data packet, wherein the correlation vector field is used to characterize the degree of correlation between the N data packets.

[0011] Furthermore, the data packet aggregation method also includes: step 1, starting from the first data packet in the data stream, determining S data packets according to the arrangement order of the N data packets in the data stream; step 2, detecting whether the S data packets meet the preset conditions, and when the S data packets meet the preset conditions, grouping the S data packets into a data packet set, wherein S is an integer greater than 1 and S is less than or equal to N, and the preset conditions are used to characterize the degree of association between the data packets in the data packet set; step 3, removing the S data packets that form the data packet set in step 2 from the data stream to obtain a new data stream; step 4, updating the data stream based on the new data stream, and repeating the process of steps 1 to 3 until all N data packets are divided into the data packet set.

[0012] Furthermore, the data packet aggregation method also includes: step 1, determining the four-dimensional correlation vector corresponding to the first data packet as the first vector; step 2, starting from the second data packet, in order of arrangement, determining the four-dimensional correlation vectors corresponding to S-1 data packets as the second vector, and obtaining S-1 second vectors, wherein S is an integer greater than or equal to 2, and S is less than or equal to N; step 3, summing the first vector and the S-1 second vectors to obtain a first target vector; step 4, determining the four-dimensional correlation vector corresponding to the S+1th data packet as the third vector; step 5, summing the first target vector and the third vector to obtain a second target vector; step 6, determining whether the S data packets meet a preset condition based on the first vector, the first target vector, and the second target vector, wherein the S data packets include the first data packet and the S-1 data packets; step 7, when the S data packets do not meet the preset condition, adding 1 to S to obtain an updated S, and then looping through the process of steps 2 to 7 until the S data packets meet the preset condition, and then the S data packets are combined into a data packet set.

[0013] Furthermore, the data packet aggregation method also includes: calculating the cosine value of the angle between the first target vector and the first vector to obtain the first cosine value of the angle; calculating the cosine value of the angle between the second target vector and the first vector to obtain the second cosine value of the angle; when the first cosine value of the angle and the second cosine value of the angle are opposite numbers, determining that S data packets meet the preset conditions.

[0014] According to another aspect of an embodiment of the present application, a data packet aggregation device is also provided, including: a first acquisition module, used to acquire a data stream to be processed, wherein the data stream consists of N data packets, and N is an integer greater than 1; a second acquisition module, used to acquire the acquisition time of each data packet and the number of bytes of each data packet; a determination module, used to determine the four-dimensional correlation vector of each data packet based on the acquisition time, the number of bytes and the transmission direction of each data packet, wherein the four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets; and a division module, used to divide the N data packets into at least one data packet set according to the four-dimensional correlation vector.

[0015] According to another aspect of an embodiment of the present application, an electronic device is also provided, which includes one or more processors; a storage device for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the above-mentioned method for determining abnormal software at runtime.

[0016] In this application, a four-dimensional correlation vector is determined for each data packet based on the acquisition time, number of bytes, and transmission direction of each data packet. After acquiring the data stream to be processed, the acquisition time and number of bytes of each data packet are obtained. Then, a four-dimensional correlation vector is determined for each data packet based on the acquisition time, number of bytes, and transmission direction of each data packet. Finally, N data packets are divided into at least one data packet set based on the four-dimensional correlation vector. The data stream consists of N data packets, where N is an integer greater than 1, and the four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets.

[0017] From the above content, it can be seen that the present application determines the four-dimensional correlation vector through the acquisition time, number of bytes and transmission direction of the data packet, and analyzes the correlation characteristics between the data packets from multiple dimensions. On this basis, compared with the existing technology, the present application divides N data packets into at least one data packet set according to the four-dimensional correlation vector, and can determine the correlation relationship between the data packets from more feature dimensions and divide the data packet sets, thereby improving the division quality of the data packet sets and ensuring that at least one data packet in each data packet set has a strong correlation.

[0018] It can be seen that the technical solution of the present application achieves the purpose of determining the correlation characteristics between data packets from multiple dimensions, thereby improving the quality of data packet division, and further solving the technical problem of poor data packet set division quality that exists in the prior art when dividing multiple data packets into at least one data packet set. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flowchart of an optional data packet aggregation method according to an embodiment of the present application;

[0021] Figure 2 is a schematic diagram of four characteristic dimensions of an optional data packet according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an optional correlation vector according to an embodiment of the present application;

[0023] Figure 4 is a flow chart of detecting whether S data packets meet preset conditions according to an embodiment of the present application;

[0024] Figure 5This is a schematic diagram of an optional data packet aggregation device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Example 1

[0028] According to an embodiment of the present application, an embodiment of a method for aggregating data packets is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 1 is a flow chart of an optional data packet aggregation method according to an embodiment of the present application, such as Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Obtain the data stream to be processed.

[0031] In step S101, the data stream consists of N data packets, where N is an integer greater than 1. Specifically, the data stream in the present application can be a DNS (Domain Name System) data stream in plain text, or it can be an encrypted DNS data stream, for example, a DNS data stream encrypted using DoH (DNS over HTTPS, a DNS resolution technology based on HTTPS). In addition, the above-mentioned data stream can also be a data stream based on other information transmission protocols.

[0032] Furthermore, a network security device can be used as the execution subject of the data packet aggregation method in the embodiments of this application. The network security device includes, but is not limited to, a firewall device and other security devices. The network security device can be connected to multiple terminal devices and obtain data streams to be processed from the multiple terminal devices. Terminal devices include, but are not limited to, desktop computers, industrial computers, servers, and other devices.

[0033] Step S102: Obtain the acquisition time of each data packet and the number of bytes of each data packet.

[0034] In step S102, after obtaining the data stream to be processed, the network security device obtains the byte count of each of the N data packets in the data stream. The byte counts of any two data packets may be the same or different. A data packet can be a request packet or a response packet.

[0035] In addition, each time the network security device acquires a data packet, it records the acquisition time of the data packet. For example, the network security device is connected to terminal device A and terminal device B. Terminal device A generates three data packets: Data packet 1, Data packet 2, and Data packet 3, and sends these three data packets to terminal device B. However, before terminal device B receives these three data packets, the network security device first acquires these three data packets. Then, after the network security device performs security checks on the three data packets and confirms that the data packets are normal, the network security device forwards the three data packets to terminal device B. When the network security device acquires the three data packets, it records the acquisition time of each data packet.

[0036] Step S103 : determining a four-dimensional correlation vector of each data packet according to the acquisition time, the number of bytes, and the transmission direction of each data packet.

[0037] In step S103, the four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets. Specifically, among the N data packets, the transmission direction of each data packet is the first direction or the second direction, wherein the first direction and the second direction are opposite directions. For example, when the first direction is forward, the second direction is reverse. In addition, based on the acquisition time of each data packet, the network security device will calculate the interval length between each data packet and the adjacent data packet in terms of acquisition time. Among them, since there are two adjacent data packets, there are also two interval lengths. On this basis, each data packet can be described from four characteristic dimensions, namely the number of bytes in the data packet, the transmission direction of the data packet, the interval length between the data packet and the previous data packet, and the interval length between the data packet and the next data packet. It should be noted that the interval length between the first data packet and the previous data packet can be defaulted to 0; the interval length between the last data packet and the next data packet can also be defaulted to 0.

[0038] Furthermore, the four-dimensional correlation vector is used to specifically describe the four characteristic dimensions of each data packet. The correlation between data packets can be determined through the four characteristic dimensions described by the four-dimensional correlation vector, for example, the similarity between two data packets in each characteristic dimension.

[0039] Step S104 : dividing the N data packets into at least one data packet set according to the four-dimensional correlation vector.

[0040] In step S104, because the four-dimensional correlation vector of each data packet represents at least the correlation characteristics between two adjacent data packets, the N data packets can be divided into at least one data packet set based on the four-dimensional correlation vector. Each data packet set contains at least one data packet, and different data packet sets do not contain the same data packet. For example, assume there are 10 data packets, where the first and second data packets are divided into the first data packet set, the third to seventh data packets are divided into the second data packet set, and the eighth to tenth data packets are divided into the third data packet set.

[0041] Alternatively, in existing technologies, DNS is a commonly used information transmission protocol. While its plaintext transmission mechanism facilitates security checks and audits by security devices such as firewalls, it also poses serious privacy and security issues. To address the information security issues inherent in the plaintext DNS transmission mechanism, DoH technology can be used to encrypt DNS request and response packets, thereby preventing third-party applications from eavesdropping on and tampering with plaintext DNS packets.

[0042] However, as the use of DoH technology continues to expand, DoH-based tunnel attacks are becoming more frequent. DoH tunnel attacks are essentially DNS tunnel attacks encapsulated with HTTPS.

[0043] It's important to note that in actual network communications, various firewalls monitor outbound connections. If any anomalies are detected, they block the communication. The data originator then encapsulates the data packet according to the packet type or port allowed by the firewall, then passes through the firewall to communicate with the data recipient. Once the encapsulated data packet reaches the recipient, it deconstructs the packet and sends it to the appropriate server. This technique is called tunneling.

[0044] When criminals engage in information intrusion, they will use legal protocols such as DNS and ICMP to build hidden tunnels to cover up illegal information transmitted by the server. This type of information security attack is called a tunnel attack. The above-mentioned DoH tunnel attack is a tunnel attack carried out by combining DoH technology with the DNS protocol.

[0045] It should also be noted that in existing technologies, DNS tunneling attack detection is usually based on domain name information. However, the successful implementation of this detection technology is premised on the fact that the DNS data stream is unencrypted and in plain text. Therefore, any third-party application can obtain domain name information by analyzing the DNS data stream. On this basis, when the DNS data stream is encrypted using DoH technology, the content of the DNS request and DNS response is no longer visible. Therefore, the existing DNS tunneling attack detection technology based on domain name information cannot be applied to the process of DoH tunneling attack detection.

[0046] In order to detect DoH tunnel attacks, it is necessary to perform a time-series analysis of the encrypted HTTPS data stream in the time dimension to lay a technical foundation for further detection. The time-series analysis must first effectively aggregate the data packets in the encrypted data stream. However, in the existing technology, when dividing multiple encrypted data packets into data packet sets, the division is simply based on the acquisition time of the data packets. For example, data packets acquired within 1 minute are grouped into a data set. This method ignores the correlation between other characteristic dimensions between data packets, resulting in poor quality of data packet set division.

[0047] In this application, the four-dimensional correlation vector is determined by the acquisition time, number of bytes and transmission direction of the data packet, and the correlation characteristics between the data packets are analyzed from multiple dimensions. On this basis, this application divides N data packets into at least one data packet set according to the four-dimensional correlation vector. It not only determines the correlation relationship between the data packets from more feature dimensions and improves the division quality of the data packet set, but also achieves the purpose of aggregating and analyzing the data packets without resolving the domain name information when the data stream is an encrypted data stream, thereby laying a data foundation for subsequent DoH tunnel attack behavior detection.

[0048] In an optional embodiment, in order to determine the four-dimensional correlation vector of each data packet, the network security device will determine the acquisition time of the previous data packet of each data packet as the first time based on the arrangement order of the N data packets in the data stream, and will also determine the acquisition time of the next data packet of each data packet as the second time. Finally, the network security device determines the four-dimensional correlation vector of each data packet based on the first time, the second time, the number of bytes of each data packet, and the transmission direction of each data packet.

[0049] It should be noted that since the first data packet does not have a previous data packet, and the last data packet does not have a subsequent data packet, when the data packet is the first of N data packets, the network security device determines the first time corresponding to the first data packet as the acquisition time of the first data packet. When the data packet is the last of N data packets, the network security device determines the second time corresponding to the last data packet as the acquisition time of the last data packet.

[0050] Specifically, in order to more clearly describe the technical solutions in the embodiments of the present application, the data flow to be processed can be recorded as Flow = {P1, P2, ..., P I ,…P N}, I∈[1,N], where P I For the Ith data packet.

[0051] Among them, the calculation data packet P I The formula for the four-dimensional correlation vector is as follows:

[0052] α2intertime(P I-1 , P I ), α3intertime(P I , P I+1 ), direction(P I ))

[0053] Wherein, α1∈[0.001, 0.01], α2∈[0.1, 0.8], α3∈[0.1, 0.8]; size() is the number of bytes in the data packet; intertime() is the absolute value of the difference between the acquisition time of two data packets; direction() is the direction of the data packet, which is 1 if the transmission direction of the data packet is the first direction, and -1 if the transmission direction of the data packet is the second direction; when I=1, intertime(P I-1 , P I ) is recorded as 0; when I=N, intertime(P I , P I+1 ) is recorded as 0.

[0054] Specifically, the above intertime (P I-1 , P I ) is the first interval length, the above intertime(P I , P I+1 ) is the second interval duration. In order to obtain the first interval duration and the second interval duration, the network security device first determines the acquisition time of each data packet as the target time, and then calculates the absolute value of the difference between the target time and the first time to obtain the first interval duration, and calculates the absolute value of the difference between the target time and the second time to obtain the second interval duration. Finally, the four-dimensional correlation vector of each data packet is determined according to the first interval duration, the second interval duration, the number of bytes of each data packet, and the transmission direction of each data packet.

[0055] Optionally, since the target time of the first data packet and the first time are both the acquisition time of the first data packet, the first interval duration of the first data packet is 0, that is, when I=1, intertime(P I-1 , P I ) is recorded as 0. At the same time, since the target time of the last data packet and the second duration are both the acquisition time of the last data packet, the second interval duration of the last data packet is 0, that is, when I=N, intertime(P I , P I+1 ) is recorded as 0.

[0056] In addition, the first interval duration, second interval duration, number of bytes and transmission direction corresponding to each data packet are four characteristic dimensions corresponding to each data packet, and a four-dimensional correlation vector corresponding to each data packet can be constructed through these four characteristic dimensions.

[0057] Optional, Figure 2 A schematic diagram of the four characteristic dimensions of a data packet is shown, such as Figure 2As shown, a data stream includes 7 data packets from P1 to P7, among which the transmission direction of the three data packets P3, P4 and P5 is the first direction (the dotted line indicates that the transmission direction is the first direction), and the transmission direction of the remaining four data packets is the second direction. Figure 2 Also shown is the byte size (P2) of the P2 data packet and the interval duration (P3, P4) between the P3 and P4 data packets. This interval duration is both the second interval duration of the P3 data packet and the first interval duration of the P4 data packet.

[0058] In an optional embodiment, after determining the four-dimensional correlation vector of each data packet based on the acquisition time, number of bytes, and transmission direction of each data packet, the network security device determines a target data packet from N data packets, wherein the target data packet is any data packet among the N data packets except the last data packet. Then, the network security device determines the four-dimensional correlation vector corresponding to the target data packet as the first vector to be processed, and determines the four-dimensional correlation vector corresponding to the data packet following the target data packet as the second vector to be processed. Finally, the network security device determines the target angle cosine value of the target data packet based on the first vector to be processed and the second vector to be processed, and constructs a correlation vector field based on the target angle cosine value and the four-dimensional correlation vector of each data packet, wherein the correlation vector field is used to characterize the degree of correlation between the N data packets.

[0059] Optionally, the above correlation vector field can be represented by F. Specifically, the calculation formula of the correlation vector field is as follows:

[0060]

[0061] Optionally, the formula for calculating the cosine of the target angle is as follows:

[0062]

[0063] in, It is used to represent the first vector to be processed above, Used to represent the second vector to be processed mentioned above.

[0064] Optional, Figure 3 A schematic diagram of a correlation vector is shown, where Figure 3 In the above example, the fourth characteristic dimension direction (i.e., transmission direction) is ignored. Figure 3 As shown, the horizontal axis is α1size(P I ), the vertical axis is α2intertime(P I-1 , P I ), for and The arc cosine of the cosine of the angle , Figure 3 Also shown α3intertime(P I , P I+1 ).

[0065] In an optional embodiment, the network security device may divide N data packets into at least one data packet set through the following four steps.

[0066] Step 1: Starting from the first data packet in the data stream, determine S data packets according to the order in which N data packets are arranged in the data stream.

[0067] Step 2: Detect whether the S data packets meet a preset condition, and if the S data packets meet the preset condition, group the S data packets into a data packet set, where S is an integer greater than 1 and S is less than or equal to N, and the preset condition is used to characterize the degree of association between the data packets in the data packet set;

[0068] Step 3: remove the S data packets constituting the data packet set in step 2 from the data stream to obtain a new data stream;

[0069] Step 4: Update the data stream based on the new data stream, and repeat the process from step 1 to step 3 until all N data packets are divided into the data packet set.

[0070] in, Figure 4 A flow chart of detecting whether S data packets meet preset conditions according to an embodiment of the present application is shown. Figure 4 As shown, when detecting whether S data packets meet the preset conditions, the following steps are included:

[0071] Step 1: Determine the four-dimensional correlation vector corresponding to the first data packet as the first vector;

[0072] Step 2: Starting from the second data packet, in the order of arrangement, determine the four-dimensional correlation vectors corresponding to S-1 data packets as second vectors, and obtain S-1 second vectors, where S is an integer greater than or equal to 2, and S is less than or equal to N;

[0073] Step 3, summing the first vector and S-1 second vectors to obtain a first target vector;

[0074] Step 4: Determine the four-dimensional correlation vector corresponding to the S+1th data packet as the third vector;

[0075] Step 5, summing the target vector and the third vector to obtain a second target vector;

[0076] Step 6: determining whether S data packets meet a preset condition based on the first vector, the first target vector, and the second target vector, wherein the S data packets include the first data packet and S-1 data packets;

[0077] Step 7: When S data packets do not meet the preset conditions, add 1 to S to obtain an updated S, and then loop through steps 2 to 7 until S data packets meet the preset conditions, and then group the S data packets into a data packet set.

[0078] Optionally, the above-mentioned preset condition is the following formula:

[0079]

[0080] in, is the first vector, that is, the four-dimensional correlation vector corresponding to the first data packet in the data stream, is the first target vector, that is, the vector sum of the first vector and S-1 second vectors. is the second target vector, that is, the vector sum of the third vector and the first target vector.

[0081] Specifically, the network security device first calculates the cosine value of the angle between the first target vector and the first vector to obtain the first cosine value of the angle, and simultaneously calculates the cosine value of the angle between the second target vector and the first vector to obtain the second cosine value of the angle. Finally, when the first cosine value of the angle and the second cosine value of the angle are opposite numbers, the network security device determines that S data packets meet the preset conditions.

[0082] Among them, the formula representing the preset conditions This is the cosine value of the first angle mentioned above, This is the cosine value of the second angle mentioned above.

[0083] To illustrate the above solution more clearly, please refer to the following three steps:

[0084] Step A1: Starting from the first data packet P1, calculate the vector sum of the four-dimensional correlation vectors of the subsequent (s-1) consecutive data packets and the four-dimensional correlation vector of the data packet P1. And calculate the vector sum and The cosine of the angle

[0085] Step A2, the value of s starts from 2 and gradually increases by 1. When the condition is met for the first time When these s data packets {P1, ..., P s} as an aggregate;

[0086] Step A3: take the s+1th data packet P s+1 As the starting point, repeat steps A1 and A2 until you reach P N The aggregation of all N data packets is completed. This process can be understood as the process of steps 3 and 4 above.

[0087] From the above content, it can be seen that the present application determines the four-dimensional correlation vector through the acquisition time, number of bytes and transmission direction of the data packet, and analyzes the correlation characteristics between the data packets from multiple dimensions. On this basis, compared with the existing technology, the present application divides N data packets into at least one data packet set according to the four-dimensional correlation vector, and can determine the correlation relationship between the data packets from more feature dimensions and divide the data packet sets, thereby improving the division quality of the data packet sets and ensuring that at least one data packet in each data packet set has a strong correlation.

[0088] Example 2

[0089] According to an embodiment of the present application, there is also provided an embodiment of a data packet aggregation device, wherein: Figure 5 is a schematic diagram of an optional data packet aggregation device according to an embodiment of the present application, such as Figure 5 As shown, the apparatus includes: a first acquisition module 501, configured to acquire a data stream to be processed, wherein the data stream consists of N data packets, and N is an integer greater than 1.

[0090] Optionally, the data packet aggregation device may be provided in a network security device, which may serve as the execution subject of the data packet aggregation method described in Example 1. Network security devices include, but are not limited to, firewall devices and other security devices. The network security device may be connected to multiple terminal devices and obtain data streams to be processed from the multiple terminal devices. Terminal devices include, but are not limited to, desktop computers, industrial computers, servers, and other devices.

[0091] In addition, the data stream in this application can be a DNS data stream in plain text, or it can be an encrypted DNS (Domain Name System) data stream, for example, a DNS data stream encrypted via the DoH (DNS over HTTPS) protocol. In addition, the above data stream can also be a data stream based on other information transmission protocols.

[0092] The data packet aggregation device further includes: a second acquisition module 502, configured to acquire the acquisition time of each data packet and the number of bytes of each data packet.

[0093] Optionally, after obtaining the data stream to be processed, the network security device obtains the byte count of each of the N data packets in the data stream, wherein the byte counts of any two data packets may be the same or different. A data packet can be a request packet or a response packet.

[0094] In addition, the network security device records the acquisition time of each data packet it receives. For example, the network security device is connected to terminal device A and terminal device B. Terminal device A generates three data packets, Data Packet 1, Data Packet 2, and Data Packet 3, and sends them to terminal device B. However, before terminal device B receives these three data packets, they are first acquired by the network security device. After the network security device performs security checks on the three data packets and confirms that they are normal, the network security device forwards the three data packets to terminal device B. When the network security device acquires the three data packets, it records the acquisition time of each data packet.

[0095] The data packet aggregation device also includes: a determination module 503, which is used to determine the four-dimensional correlation vector of each data packet based on the acquisition time, the number of bytes and the transmission direction of each data packet, wherein the four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets.

[0096] Optionally, a four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets. Specifically, among N data packets, the transmission direction of each data packet is the first direction or the second direction, wherein the first direction and the second direction are opposite directions. For example, when the first direction is forward, the second direction is reverse. In addition, based on the acquisition time of each data packet, the network security device will calculate the interval length between each data packet and the adjacent data packet in terms of acquisition time. Among them, since there are two adjacent data packets, there are also two interval lengths. On this basis, each data packet can be described from four characteristic dimensions, namely the number of bytes in the data packet, the transmission direction of the data packet, the interval length between the data packet and the previous data packet, and the interval length between the data packet and the next data packet. It should be noted that the interval length between the first data packet and the previous data packet can be defaulted to 0; the interval length between the last data packet and the next data packet can also be defaulted to 0.

[0097] Furthermore, the four-dimensional correlation vector specifically describes the four characteristic dimensions of each data packet. The correlation between data packets can be determined through the four characteristic dimensions described by the four-dimensional correlation vector, for example, the similarity between two data packets in each characteristic dimension.

[0098] The data packet aggregation device further includes: a division module 504, configured to divide the N data packets into at least one data packet set according to the four-dimensional correlation vector.

[0099] Optionally, because the four-dimensional correlation vector of each data packet represents at least the correlation characteristics between two adjacent data packets, the N data packets can be divided into at least one data packet set based on the four-dimensional correlation vector. Each data packet set contains at least one data packet, and different data packet sets do not contain the same data packet. For example, assume there are 10 data packets, where the first and second data packets are divided into the first data packet set, the third to seventh data packets are divided into the second data packet set, and the eighth to tenth data packets are divided into the third data packet set.

[0100] Furthermore, in existing technologies, DNS is a commonly used information transmission protocol. While its plaintext transmission mechanism facilitates security checks and audits by security devices such as firewalls, it also leads to serious privacy and security issues. To address the information security issues inherent in plaintext DNS transmission, DoH technology can be used to encrypt DNS request and response packets, preventing third-party applications from eavesdropping on and tampering with plaintext DNS packets.

[0101] However, as the use of DoH technology continues to expand, DoH-based tunnel attacks are becoming more frequent. DoH tunnel attacks are essentially DNS tunnel attacks encapsulated with HTTPS.

[0102] It's important to note that in actual network communications, various firewalls monitor outbound connections. If any anomalies are detected, they block the communication. The data originator then encapsulates the data packet according to the packet type or port allowed by the firewall, then passes through the firewall to communicate with the data recipient. Once the encapsulated data packet reaches the recipient, it deconstructs the packet and sends it to the appropriate server. This technique is called tunneling.

[0103] When criminals engage in information intrusion, they will use legal protocols such as DNS and ICMP to build hidden tunnels to cover up illegal information transmitted by the server. This type of information security attack is called a tunnel attack. The above-mentioned DoH tunnel attack is a tunnel attack carried out by combining DoH technology with the DNS protocol.

[0104] It should be noted that in existing technologies, DNS tunneling attacks are usually detected based on domain name information. However, the successful implementation of this detection technology is based on the premise that the DNS data stream is unencrypted and in plain text. Therefore, any third-party application can obtain domain name information by analyzing the DNS data stream. On this basis, when the DNS data stream is encrypted using DoH technology, the content of the DNS request and DNS response is no longer visible. Therefore, the existing DNS tunneling attack detection technology based on domain name information cannot be applied to the process of DoH tunneling attack detection.

[0105] In order to detect DoH tunnel attacks, it is necessary to perform a time-series analysis of the encrypted HTTPS data stream in the time dimension to lay a technical foundation for further detection. The time-series analysis must first effectively aggregate the data packets in the encrypted data stream. However, in the existing technology, when dividing multiple encrypted data packets into data packet sets, the division is simply based on the acquisition time of the data packets. For example, data packets acquired within 1 minute are grouped into a data set. This method ignores the correlation between other characteristic dimensions between data packets, resulting in poor quality of data packet set division.

[0106] In this application, the four-dimensional correlation vector is determined by the acquisition time, number of bytes and transmission direction of the data packet, and the correlation characteristics between the data packets are analyzed from multiple dimensions. On this basis, this application divides N data packets into at least one data packet set according to the four-dimensional correlation vector. It not only determines the correlation relationship between the data packets from more feature dimensions and improves the division quality of the data packet set, but also achieves the purpose of aggregating and analyzing the data packets without resolving the domain name information when the data stream is an encrypted data stream, thereby laying a data foundation for subsequent DoH tunnel attack behavior detection.

[0107] It should be noted that the above-mentioned first acquisition module 501, second acquisition module 502, determination module 503 and division module 504 correspond to steps S101 to S104 in the above-mentioned embodiment 1. The examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0108] From the above content, it can be seen that the present application determines the four-dimensional correlation vector through the acquisition time, number of bytes and transmission direction of the data packet, analyzes the correlation characteristics between the data packets from multiple dimensions, and then divides the N data packets into at least one data packet set according to the four-dimensional correlation vector, that is, divides the data sets according to the deeper level of correlation relationship of the data packets. Compared with the prior art, the present application determines the correlation relationship between the data packets from more feature dimensions, thereby improving the division quality of the data packet set, and further ensuring that at least one data packet in each data packet set has a strong correlation.

[0109] It can be seen that the technical solution of the present application achieves the purpose of determining the correlation characteristics between data packets from multiple dimensions, thereby improving the quality of data packet division, and further solving the technical problem of poor data packet set division quality that exists in the prior art when dividing multiple data packets into at least one data packet set.

[0110] Optionally, the determination module further includes: a first determination unit, a second determination unit, and a third determination unit. The first determination unit is configured to determine, based on the order of arrangement of the N data packets in the data stream, the acquisition time of the preceding data packet of each data packet as a first time; the second determination unit is configured to determine, based on the order of arrangement of the N data packets in the data stream, the acquisition time of the succeeding data packet of each data packet as a second time; and the third determination unit is configured to determine, based on the first time, the second time, the number of bytes of each data packet, and the transmission direction of each data packet, a four-dimensional correlation vector of each data packet.

[0111] Optionally, the first determination unit further includes: a first determination submodule, configured to, when the data packet is the first data packet among the N data packets, determine the first time corresponding to the first data packet as the acquisition time of the first data packet.

[0112] Optionally, the second determining unit further includes: a second determining submodule, configured to, when the data packet is the last data packet among the N data packets, determine the second time corresponding to the last data packet as the acquisition time of the last data packet.

[0113] Optionally, the third determination unit further includes: a third determination submodule, a first calculation submodule, a second calculation submodule, and a fourth determination submodule. The third determination submodule is configured to determine that the acquisition time of each data packet is the target time; the first calculation submodule is configured to calculate the absolute value of the difference between the target time and the first time to obtain a first interval duration; the second calculation submodule is configured to calculate the absolute value of the difference between the target time and the second time to obtain a second interval duration; and the fourth determination submodule is configured to determine the four-dimensional correlation vector of each data packet based on the first interval duration, the second interval duration, the number of bytes of each data packet, and the transmission direction of each data packet.

[0114] It should be noted that since the first data packet does not have a previous data packet, and the last data packet does not have a subsequent data packet, when the data packet is the first of N data packets, the network security device determines the first time corresponding to the first data packet as the acquisition time of the first data packet. When the data packet is the last of N data packets, the network security device determines the second time corresponding to the last data packet as the acquisition time of the last data packet.

[0115] Specifically, in order to more clearly describe the technical solutions in the embodiments of the present application, the data flow to be processed can be recorded as Flow = {P1, P2, ..., P I ,…P N}, I∈[1,N], where P I For the Ith data packet.

[0116] Among them, the calculation data packet P I The formula for the four-dimensional correlation vector is as follows:

[0117]

[0118] Wherein, α1∈[0.001, 0.01], α2∈[0.1, 0.8], α3∈[0.1, 0.8]; size() is the number of bytes in the data packet; intertime() is the absolute value of the difference between the acquisition time of two data packets; direction() is the direction of the data packet, which is 1 if the transmission direction of the data packet is the first direction, and -1 if the transmission direction of the data packet is the second direction; when I=1, intertime(P I-1 , P I ) is recorded as 0; when I=N, intertime(P I , P I+1 ) is recorded as 0.

[0119] Optional, Figure 2A schematic diagram of the four characteristic dimensions of a data packet is shown, such as Figure 2 As shown, a data stream includes seven data packets from P1 to P7, wherein the transmission direction of the three data packets P3, P4, and P5 is the first direction, and the transmission direction of the remaining four data packets is the second direction. Figure 2 Also shown is the byte size (P2) of the P2 data packet and the interval duration (P3, P4) between the P3 and P4 data packets. This interval duration is both the second interval duration of the P3 data packet and the first interval duration of the P4 data packet.

[0120] Optionally, the data packet aggregation device further includes: a first determination module, a second determination module, a third determination module, a fourth determination module, and a construction module. The first determination module is configured to determine a target data packet from the N data packets, wherein the target data packet is any data packet except the last data packet among the N data packets; the second determination module is configured to determine the four-dimensional correlation vector corresponding to the target data packet as the first vector to be processed; the third determination module is configured to determine the four-dimensional correlation vector corresponding to the next data packet after the target data packet as the second vector to be processed; the fourth determination module is configured to determine the target angle cosine value of the target data packet based on the first vector to be processed and the second vector to be processed; and the construction module is configured to construct a correlation vector field based on the target angle cosine value and the four-dimensional correlation vector of each data packet, wherein the correlation vector field is configured to characterize the degree of correlation between the N data packets.

[0121] Optionally, the above correlation vector field can be represented by F. Specifically, the calculation formula of the correlation vector field is as follows:

[0122]

[0123] Optionally, the formula for calculating the cosine of the target angle is as follows:

[0124]

[0125] in, It can be regarded as the first vector to be processed. It can be regarded as the second vector to be processed.

[0126] Optional, Figure 3 A schematic diagram of a correlation vector is shown, where Figure 3 In the above example, the fourth characteristic dimension direction (i.e., transmission direction) is ignored. Figure 3 As shown, the horizontal axis is α1size(P I ), the vertical axis is α2intertime(P I-1 , P I ), for and The arc cosine of the cosine of the angle , Figure 3 Also shown α3intertime(P I , P I+1 ).

[0127] Optionally, the above-mentioned division module further includes: a first execution module, a second execution module, a third execution module, and a fourth execution module. Among them, the first execution module is used to execute step 1, starting from the first data packet in the data stream, and determining S data packets according to the arrangement order of the N data packets in the data stream; the second execution module is used to execute step 2, detect whether the S data packets meet the preset conditions, and when the S data packets meet the preset conditions, group the S data packets into a data packet set, wherein S is an integer greater than 1 and S is less than or equal to N, and the preset conditions are used to characterize the degree of association between the data packets in the data packet set; the third execution module is used to execute step 3, remove the S data packets that form the data packet set in step 2 from the data stream to obtain a new data stream; the fourth execution module is used to execute step 4, update the data stream based on the new data stream, and repeat the process of steps 1 to 3 until all the N data packets are divided into data packet sets.

[0128] Optionally, the second execution module further includes: a first execution submodule, a second execution submodule, a third execution submodule, a fourth execution submodule, a fifth execution submodule, a sixth execution submodule, and a seventh execution submodule. The first execution submodule is used to execute step 1 to determine that the four-dimensional correlation vector corresponding to the first data packet is the first vector; the second execution submodule is used to execute step 2, according to the arrangement order, starting from the second data packet, determine that the four-dimensional correlation vectors corresponding to S-1 data packets are the second vectors, and obtain S-1 second vectors, wherein S is an integer greater than or equal to 2, and S is less than or equal to N; the third execution submodule is used to execute step 3, sum the first vector and S-1 second vectors to obtain the first target vector; the fourth execution submodule is used to execute step 4 to determine that the four-dimensional correlation vector corresponding to the S+1th data packet is the third vector; the fifth execution submodule is used to execute step 5, and determine that the four-dimensional correlation vector corresponding to the S+1th data packet is the third vector; a row submodule, configured to execute step 5, summing the first target vector and the third vector to obtain a second target vector; a sixth execution submodule, configured to execute step 6, determining whether S data packets meet the preset condition based on the first vector, the first target vector, and the second target vector, wherein the S data packets include the first data packet and S-1 data packets; and a seventh execution submodule, configured to execute step 7, if the S data packets do not meet the preset condition, adding 1 to S to obtain an updated S, and then looping through steps 2 to 7 until the S data packets meet the preset condition, whereupon the S data packets are combined into a data packet set.

[0129] Optionally, the sixth execution submodule further includes: a first calculation subunit, a second calculation subunit, and a first determination subunit. The first calculation subunit is configured to calculate the cosine value of the angle between the first target vector and the first vector to obtain a first cosine value of the angle; the second calculation subunit is configured to calculate the cosine value of the angle between the second target vector and the first vector to obtain a second cosine value of the angle; and the first determination subunit is configured to determine that the S data packets meet the preset condition when the first cosine value of the angle and the second cosine value of the angle are opposite numbers.

[0130] Optionally, the above-mentioned preset condition is the following formula:

[0131]

[0132] in, is the first vector, that is, the four-dimensional correlation vector corresponding to the first data packet in the data stream, is the first target vector, that is, the vector sum of the first vector and S-1 second vectors. is the second target vector, that is, the vector sum of the third vector and the first target vector.

[0133] Specifically, the network security device first calculates the cosine value of the angle between the first target vector and the first vector to obtain the first cosine value of the angle, and simultaneously calculates the cosine value of the angle between the second target vector and the first vector to obtain the second cosine value of the angle. Finally, when the first cosine value of the angle and the second cosine value of the angle are opposite numbers, the network security device determines that S data packets meet the preset conditions.

[0134] Among them, the formula representing the preset conditions This is the cosine value of the first angle mentioned above, This is the cosine value of the second angle mentioned above.

[0135] To illustrate the above solution more clearly, please refer to the following three steps:

[0136] Step A1: Starting from the first data packet P1, calculate the vector sum of the four-dimensional correlation vectors of the subsequent (s-1) consecutive data packets and the four-dimensional correlation vector of the data packet P1. And calculate the vector sum and The cosine of the angle

[0137] Step A2, the value of s starts from 2 and gradually increases by 1. When the condition is met for the first time When these s data packets {P1, ..., P s} as an aggregate;

[0138] Step A3: take the s+1th data packet P s+1 As the starting point, repeat steps A1 and A2 until you reach P N The aggregation of all N data packets is completed. This process can be understood as the process of steps 3 and 4 above.

[0139] From the above content, it can be seen that the present application determines the four-dimensional correlation vector through the acquisition time, number of bytes and transmission direction of the data packet, analyzes the correlation characteristics between the data packets from multiple dimensions, and then divides the N data packets into at least one data packet set according to the four-dimensional correlation vector, that is, divides the data sets according to the deeper level of correlation relationship of the data packets. Compared with the prior art, the present application determines the correlation relationship between the data packets from more feature dimensions, especially the correlation relationship between data packets that are far apart, so that when the data packets are aggregated according to the four-dimensional correlation vector, the division quality of the data packet set can be improved, avoiding the problem of poor data packet set division quality when the prior art divides multiple data packets into at least one data packet set.

[0140] Example 3

[0141] According to an embodiment of the present application, an electronic device is also provided, which includes one or more processors; a storage device for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the function of running the programs, wherein the programs are configured to execute the above-mentioned data packet aggregation method at runtime.

[0142] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0143] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0144] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0145] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0146] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0147] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0148] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data packet aggregation method, characterized in that: include: Obtaining a data stream to be processed, wherein the data stream consists of N data packets, where N is an integer greater than 1; Obtaining the acquisition time of each data packet and the number of bytes of each data packet; Determining a four-dimensional correlation vector of each data packet according to the acquisition time, the number of bytes, and the transmission direction of each data packet, wherein the four-dimensional correlation vector is used to characterize correlation characteristics between two adjacent data packets; Dividing the N data packets into at least one data packet set according to the four-dimensional correlation vector; Among them, the four-dimensional correlation vector of each data packet is determined according to the acquisition time, the number of bytes and the transmission direction of each data packet, including: determining the acquisition time of the previous data packet of each data packet as the first time according to the arrangement order of the N data packets in the data stream; determining the acquisition time of the next data packet of each data packet as the second time; and determining the four-dimensional correlation vector of each data packet according to the first time, the second time, the number of bytes of each data packet and the transmission direction of each data packet.

2. The method according to claim 1, characterized in that The method further comprises: When the data packet is the first data packet among the N data packets, determining a first time corresponding to the first data packet as an acquisition time of the first data packet; When the data packet is the last data packet among the N data packets, the second time corresponding to the last data packet is determined as the acquisition time of the last data packet.

3. The method according to claim 2, characterized in that Determining a four-dimensional correlation vector of each data packet according to the first time, the second time, the number of bytes of each data packet, and the transmission direction of each data packet includes: Determining the acquisition time of each data packet as the target time; Calculating the absolute value of the difference between the target time and the first time to obtain a first interval duration; Calculating the absolute value of the difference between the target time and the second time to obtain a second interval duration; The four-dimensional correlation vector of each data packet is determined according to the first interval duration, the second interval duration, the number of bytes of each data packet, and the transmission direction of each data packet.

4. The method according to claim 1, wherein After determining the four-dimensional correlation vector of each data packet according to the acquisition time, the number of bytes, and the transmission direction of each data packet, the method further includes: Determining a target data packet from the N data packets, wherein the target data packet is any data packet except the last data packet among the N data packets; Determining the four-dimensional correlation vector corresponding to the target data packet as a first vector to be processed; determining a four-dimensional correlation degree vector corresponding to a subsequent data packet of the target data packet as a second vector to be processed; determining a target angle cosine value of the target data packet according to the first to-be-processed vector and the second to-be-processed vector; A correlation vector field is constructed according to the target angle cosine value and the four-dimensional correlation vector of each data packet, wherein the correlation vector field is used to represent the correlation degree between the N data packets.

5. The method according to claim 1, wherein Dividing the N data packets into at least one data packet set according to the four-dimensional correlation vector includes: Step 1: Starting from the first data packet in the data stream, determine S data packets according to the arrangement order of the N data packets in the data stream; Step 2: detecting whether the S data packets meet a preset condition, and if the S data packets meet the preset condition, grouping the S data packets into a data packet set, where S is an integer greater than 1 and S is less than or equal to N, and the preset condition is used to characterize the degree of association between the data packets in the data packet set; Step 3: remove the S data packets constituting the data packet set in step 2 from the data stream to obtain a new data stream; Step 4: Update the data flow based on the new data flow, and repeat the process of steps 1 to 3 until all the N data packets are divided into data packet sets.

6. The method according to claim 5, characterized in that Detecting whether the S data packets meet the preset condition, and if the S data packets meet the preset condition, grouping the S data packets into a data packet set, including: Step 1: determining that the four-dimensional correlation vector corresponding to the first data packet is a first vector; Step 2: starting from the second data packet, according to the arrangement order, determine the four-dimensional correlation vectors corresponding to S-1 data packets as second vectors, and obtain S-1 second vectors, where S is an integer greater than or equal to 2, and S is less than or equal to N; Step 3, summing the first vector and S-1 second vectors to obtain a first target vector; Step 4: Determine the four-dimensional correlation vector corresponding to the S+1th data packet as the third vector; Step 5: summing the first target vector and the third vector to obtain a second target vector; Step 6: determining whether S data packets meet the preset condition based on the first vector, the first target vector, and the second target vector, wherein the S data packets include the first data packet and S-1 data packets; Step 7: When S data packets do not meet the preset conditions, add 1 to S to obtain an updated S, and then loop through the process from step 2 to step 7 until S data packets meet the preset conditions, and then group the S data packets into a data packet set.

7. The method according to claim 6, characterized in that Determining whether the S data packets meet the preset condition according to the first vector, the first target vector, and the second target vector includes: Calculating a cosine value of an angle between the first target vector and the first vector to obtain a first cosine value of the angle; Calculating a cosine value of an angle between the second target vector and the first vector to obtain a second cosine value of the angle; When the cosine value of the first angle and the cosine value of the second angle are opposite numbers, it is determined that the S data packets meet the preset condition.

8. A data packet aggregation device, characterized in that: include: A first acquisition module is configured to acquire a data stream to be processed, wherein the data stream consists of N data packets, where N is an integer greater than 1; A second acquisition module is used to acquire the acquisition time of each data packet and the number of bytes of each data packet; a determination module, configured to determine a four-dimensional correlation vector of each data packet according to the acquisition time, the number of bytes, and the transmission direction of each data packet, wherein the four-dimensional correlation vector is used to characterize the correlation characteristics between two adjacent data packets; a division module, configured to divide the N data packets into at least one data packet set according to the four-dimensional correlation vector; Wherein, the determination module includes: a first determination unit, used to determine the acquisition time of the previous data packet of each data packet as the first time according to the arrangement order of the N data packets in the data stream; a second determination unit, used to determine the acquisition time of the next data packet of each data packet as the second time; a third determination unit, used to determine the four-dimensional correlation vector of each data packet according to the first time, the second time, the number of bytes of each data packet and the transmission direction of each data packet.

9. An electronic device, characterized in that: The electronic device includes one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the data packet aggregation method described in any one of claims 1-7 when running.

Images