A processing method, device and processing equipment for application flow feature identification strategy

Abstract

The present application provides a processing method, device and processing equipment for an application traffic feature identification strategy, which is used to improve the construction system of the application traffic feature identification strategy, so as to ensure that the application traffic can be accurately identified and achieve accurate content identification effects. The method includes: obtaining the application traffic to be identified; filtering the application traffic to be identified into a single stream sample packet, and attempting to extract application traffic features to form a target application traffic feature identification strategy that is initially adapted to the application traffic to be identified; in a single-packet single-rule test, testing whether the application traffic features of a single stream sample packet can be successfully identified; in a single-packet multiple-rule test, testing whether the application traffic features of a single stream sample packet can be successfully identified, and also testing whether the target application traffic feature identification strategy conflicts with different application traffic feature identification strategies; adding the target application traffic feature identification strategy to different application traffic feature identification strategies.

Description

Technical Field

[0001] The present application relates to the field of traffic analysis, and specifically to a processing method, device and processing equipment for applying a traffic feature identification strategy. Background Art

[0002] In the process of traffic analysis during application maintenance, the corresponding application traffic can be classified according to the content through pre-configured identification rules as needed.

[0003] The recognition rules can be manually configured or summarized through autonomous learning or search.

[0004] When studying the existing application traffic content identification rules, the inventors of the present application discovered a common problem in data processing, namely, the identification rules may have a problem of limited recognition accuracy. Obviously, how to discover this problem cannot be maintained solely by manual inspection. Summary of the invention

[0005] The present application provides a method, device and processing equipment for processing an application traffic feature identification strategy, which is used to improve the construction system of the application traffic feature identification strategy, thereby ensuring that the application traffic can be accurately characterized and an accurate content identification effect can be achieved.

[0006] In a first aspect, the present application provides a method for processing an application traffic feature identification strategy, the method comprising:

[0007] Acquire the application traffic to be identified in the application traffic of the target application, for which the corresponding application traffic characteristics have not been successfully identified;

[0008] Filter the application traffic to be identified into a single stream sample packet, and try to extract the application traffic characteristics of the single stream sample packet to form a target application traffic characteristic identification strategy for preliminary adaptation of the application traffic to be identified;

[0009] In the single-packet single-rule test, the target application traffic identification strategy is loaded and the application traffic feature identification of a single flow sample packet is performed to test whether the application traffic feature of the single flow sample packet can be successfully identified. If not, continue to improve the target application traffic feature identification strategy;

[0010] In the single-packet multi-rule test, the target application traffic feature identification strategy and the existing different application traffic feature identification strategies are loaded to test whether the application traffic features of a single flow sample packet can be successfully identified. At the same time, it is also tested whether the target application traffic feature identification strategy conflicts with the different application traffic feature identification strategies. If not, the target application traffic feature identification strategy will continue to be improved.

[0011] The target application traffic feature identification strategy tested by both the single-packet single-rule test and the single-packet multiple-rule test is added to the different application traffic feature identification strategies.

[0012] In combination with the first aspect of the present application, in a first possible implementation of the first aspect of the present application, after adding the target application traffic feature identification strategy tested by both the single-packet single-rule test and the single-packet multiple-rule test to the different application traffic feature identification strategies, the method further includes:

[0013] In the multi-packet multi-rule test, different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0014] In combination with the first possible implementation of the first aspect of the present application, in the second possible implementation of the first aspect of the present application, in the multi-packet multi-rule test, different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified, including:

[0015] Obtain pure flow sample packets of application traffic of the same application;

[0016] Load different application traffic feature identification strategies to test whether different application traffic features of pure flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy;

[0017] In combination with the second possible implementation of the first aspect of the present application, in a third possible implementation of the first aspect of the present application, obtaining a pure flow sample packet of application traffic of the same application includes:

[0018] Load different application traffic feature identification strategies to identify the application traffic features of different application traffic;

[0019] Different application traffic is divided according to the application traffic feature identification results to obtain pure flow sample packets.

[0020] In combination with the first possible implementation of the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, in a multi-packet multi-rule test, different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified, including:

[0021] Obtain the filtered and existing different single flow sample packets;

[0022] Load different application traffic feature identification strategies to test whether different application traffic features of different single flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0023] In combination with the first possible implementation of the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, the method further includes:

[0024] The test results of the periodically executed multi-packet multi-rule test are pushed to the user equipment (UE).

[0025] In combination with the first aspect of the present application or the first possible implementation of the first aspect, in a sixth possible implementation of the first aspect of the present application, different rule tests are all tested with a 100% success recognition rate.

[0026] In a second aspect, the present application provides a processing device for applying a traffic feature identification strategy, the device comprising:

[0027] An acquisition unit, used for acquiring the application traffic to be identified in the application traffic of the target application whose corresponding application traffic features have not been successfully identified;

[0028] A preliminary construction unit is used to filter the application traffic to be identified into a single stream sample packet, and try to extract the application traffic characteristics of the single stream sample packet to form a target application traffic characteristic identification strategy for preliminary adaptation of the application traffic to be identified;

[0029] The first test unit is used to load the target application traffic identification strategy and perform application traffic feature identification on a single stream sample packet in a single packet single rule test to test whether the application traffic feature of the single stream sample packet can be successfully identified. If not, continue to improve the target application traffic feature identification strategy;

[0030] The second test unit is used to load the target application traffic feature identification strategy and the existing different application traffic feature identification strategies in the single-packet multi-rule test to test whether the application traffic features of a single stream sample packet can be successfully identified. At the same time, it also tests whether the target application traffic feature identification strategy conflicts with the different application traffic feature identification strategies. If not, continue to improve the target application traffic feature identification strategy;

[0031] The adding unit is used to add the target application traffic feature identification strategy that has passed both the single-packet single-rule test and the single-packet multiple-rule test to different application traffic feature identification strategies.

[0032] In conjunction with the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the apparatus further includes a third testing unit, which is used to:

[0033] In the multi-packet multi-rule test, different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0034] In conjunction with the first possible implementation of the second aspect of the present application, in the second possible implementation of the second aspect of the present application, the third test unit is specifically used to:

[0035] Obtain pure flow sample packets of application traffic of the same application;

[0036] Load different application traffic feature identification strategies to test whether different application traffic features of pure flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy;

[0037] In conjunction with the second possible implementation of the second aspect of the present application, in a third possible implementation of the second aspect of the present application, the third test unit is specifically used to:

[0038] Load different application traffic feature identification strategies to identify the application traffic features of different application traffic;

[0039] Different application traffic is divided according to the application traffic feature identification results to obtain pure flow sample packets.

[0040] In combination with the first possible implementation of the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the third test unit is specifically used to:

[0041] Obtain the filtered and existing different single flow sample packets;

[0042] Load different application traffic feature identification strategies to test whether different application traffic features of different single flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0043] In combination with the first possible implementation of the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, the device further includes a pushing unit, which is used to:

[0044] The test results of the periodically executed multi-packet multi-rule test are pushed to the UE.

[0045] In combination with the second aspect of the present application or the first possible implementation of the second aspect, in a sixth possible implementation of the second aspect of the present application, different rule tests are all tested with a 100% success recognition rate.

[0046] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0048] From the above content, it can be concluded that the present application has the following beneficial effects:

[0049] In response to the demand for feature identification of application traffic, when the application traffic to be identified with the corresponding application traffic features is not successfully identified in the application traffic of the target application, the present application filters it into a single stream sample packet and attempts to extract the application traffic features of the single stream sample packet to form a target application traffic feature identification strategy that is initially adapted to the application traffic to be identified. Then, on the one hand, the target application traffic feature identification strategy is tested and improved in the single-packet single-rule test, and on the other hand, the target application traffic feature identification strategy is tested and improved in the single-packet multiple-rule test. In this way, an accurate target application traffic feature identification strategy that matches the application traffic to be identified can be obtained, which provides an effective supplement to the strategies in different application traffic feature identification strategies and improves the construction system of the application traffic feature identification strategy. In this way, it can be ensured that the application traffic features can be accurately identified to achieve accurate content identification effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 A flowchart of a method for processing a traffic feature identification strategy applied in this application;

[0052] Figure 2 A schematic diagram of the structure of a processing device for applying a traffic feature identification strategy in this application;

[0053] Figure 3 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0055] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0056] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0057] Before introducing the processing method of the application traffic feature identification strategy provided by this application, the background content involved in this application is first introduced.

[0058] The processing method, device and computer-readable storage medium of the application traffic feature identification strategy provided in this application can be applied to processing equipment to improve the construction system of the application traffic feature identification strategy, thereby ensuring that the application traffic can be accurately characterized and accurate content identification effect can be achieved.

[0059] The processing method of the application traffic feature identification strategy mentioned in this application can be executed by a processing device for the application traffic feature identification strategy, or a server, physical host or UE and other different types of processing devices that integrate the processing device for the application traffic feature identification strategy. Among them, the processing device for the application traffic feature identification strategy can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, tablet computer, laptop computer, desktop computer or personal digital assistant (PDA), and the processing device can be set in the form of a device cluster.

[0060] It can be understood that the application traffic feature identification and processing involved in this application is carried out for the application. Therefore, the processing device can specifically be the background device of the application operator, such as the background server and other devices, which monitor the traffic of the applications operated by the application operator within the application operator so as to better respond to and adjust the application operation strategy for the identified application traffic.

[0061] Of course, the processing device can also be a device external to the application operator, so that the traffic of the application that needs to be evaluated can be monitored outside the application operator, or the application operator can be cooperated with to provide the application operator with traffic monitoring services for its applications.

[0062] Next, we will introduce the processing method of the application traffic feature identification strategy provided by this application.

[0063] First, see Figure 1 , Figure 1 A flow chart of a method for processing an application traffic feature identification strategy of the present application is shown. The method for processing an application traffic feature identification strategy provided by the present application may specifically include the following steps S101 to S105:

[0064] Step S101, obtaining the application traffic to be identified in the application traffic of the target application for which the corresponding application traffic characteristics have not been successfully identified;

[0065] It is understandable that this application assumes that there are existing application traffic feature identification strategies (identification rules), and the data processing performed in this application is carried out with the idea of ​​improving the policy library.

[0066] Based on the goal of improving the policy library, it is necessary to use the application traffic for which the existing application traffic feature identification policy fails to successfully identify the application traffic feature as a trigger to update the relevant application traffic feature identification policy.

[0067] Among them, for the application traffic whose application traffic characteristics cannot be successfully identified by the existing application traffic characteristic identification strategy, it is recorded as application traffic to be identified.

[0068] It should be noted that the existing application traffic feature identification strategy referred to here can be either a strategy configured in the prior art or a strategy configured based on the present application. The present application starts from the situation where an application traffic to be identified fails to be successfully identified, and describes a specific solution.

[0069] In specific applications, the application traffic itself has its own specific traffic data format according to the application environment of the target application, such as the Packet Capture (PCAP) format. PCAP is a datagram storage format, or a file format, and its specific data is stored in a specific format.

[0070] As for the target application, it is obvious that it can be any type of application with network services, so it will generate corresponding application traffic during the user's use. As for the operator of the application, it can analyze whether there are abnormalities or certain needs in the application environment based on the application traffic actually generated by the user during the operation of the application, so as to achieve better application operation results based on the analysis of application traffic.

[0071] Step S102, filtering the application traffic to be identified into a single stream sample packet, and attempting to extract the application traffic characteristics of the single stream sample packet to form a target application traffic characteristic identification strategy for preliminary adaptation of the application traffic to be identified;

[0072] When obtaining the current application traffic to be identified, or obtaining the application traffic to be identified in real time, it obviously means that the existing application traffic feature identification strategy cannot effectively identify its application traffic features. It is necessary to configure a new application traffic feature identification strategy to improve and supplement the strategy at the overall level.

[0073] In this regard, the present application can first filter the application traffic to be identified into a single flow sample packet, so as to perform feature extraction of application traffic with a smaller granularity.

[0074] This single stream sample packet, taking the PCAP format as an example, can be understood as a PCAP file with only one stream, having the same five-tuple, namely, source IP, source port, destination IP, destination port and transport layer protocol. The PCAP file can divide the stream according to the five-tuple.

[0075] After obtaining a single flow sample packet, the application traffic characteristics can be initially extracted. This is a preliminary attempt to process the application traffic characteristics. According to the engine's syntax, rules are written and a mapping relationship between the characteristic rules and the single flow sample packet is established. In the processing here, an identification strategy (characteristic rule) is obviously uniquely associated with a single flow sample packet, while a single flow sample packet may be associated with multiple identification strategies (characteristic rules) because for new application traffic that cannot be successfully identified, there may be different potential identification strategies in actual situations.

[0076] After the appropriate application traffic features are extracted, a preliminary adapted target application traffic feature identification strategy can be summarized. Obviously, the target application traffic feature identification strategy is aimed at the feature identification of the application traffic to be identified.

[0077] Subsequently, the initially adapted target application traffic feature identification strategy may be further verified and improved to form an application traffic feature identification strategy that can be put into practical use. For details, please refer to the following steps S103 and S104.

[0078] Step S103, in the single-packet single-rule test, the target application traffic identification strategy is loaded and the application traffic feature identification of the single flow sample packet is performed to test whether the application traffic feature of the single flow sample packet can be successfully identified. If not, the target application traffic feature identification strategy is further improved;

[0079] It can be understood that in the process of verifying and improving the target application traffic feature identification strategy, this application may involve two aspects of testing, one is a single-packet single-rule test, and the other is a single-packet multiple-rule test.

[0080] It should be understood that there is no special limiting relationship between the execution timing of these two aspects of the test. The present application uses the order of first executing the single-packet single-rule test and then executing the single-packet multiple-rule test as an example. Of course, in actual applications, you can also execute the single-packet multiple-rule test first and then the single-packet single-rule test, or execute the single-packet single-rule test and the single-packet multiple-rule test at the same time. When improving the target application traffic feature identification strategy based on the rule test return, you can either improve the strategy and then directly re-invest in the current rule test, or you can improve the strategy and then return to the previous rule test and go through the test process of the two aspects of the rule test again.

[0081] In the single-packet single-rule test, only a single flow sample packet and its adapted target application traffic feature identification strategy are involved. After the adapted target application traffic feature identification strategy is initially established based on the single flow sample packet, it is possible to verify whether effective application traffic feature identification can be achieved for the single flow sample packet based on the target application traffic characteristics.

[0082] Obviously, if it can be successfully identified, it can pass the single-packet single-rule test. Otherwise, if it is not successfully identified, it means that the current target application traffic feature identification strategy needs to be improved and its specific feature identification rule content needs to be modified until the single flow sample packet can be successfully identified and the single-packet single-rule test can be passed.

[0083] Among them, when loading the target application traffic feature identification strategy, if there is a loading abnormality, it obviously means that there is an abnormality in the data of the target application traffic feature identification strategy itself, such as a rule language problem, then it can be directly returned for improvement.

[0084] In addition, there may be a special situation. If it is determined that the single stream sample packet itself is abnormal, it is necessary to replace the single stream sample packet, or optimize the engine so that the engine supports parsing special stream sample packets so that the single stream sample packet can be processed normally.

[0085] Step S104, in the single-packet multi-rule test, the target application traffic feature identification strategy and the existing different application traffic feature identification strategies are loaded to test whether the application traffic features of a single stream sample packet can be successfully identified. At the same time, it is also tested whether the target application traffic feature identification strategy conflicts with the different application traffic feature identification strategies. If not, the target application traffic feature identification strategy is further improved.

[0086] On the other hand, in the single-packet multi-rule test, in addition to the single flow sample packet and its adapted target application traffic feature identification strategy, other existing application traffic feature identification strategies may also be involved. These existing strategies are recorded as different application traffic feature identification strategies, that is, the target application traffic feature identification strategy will be added to the strategy group after passing the subsequent test.

[0087] In the single-packet multiple-rule test, the policy is also loaded to check whether the policy can effectively identify a single flow sample packet.

[0088] It is understandable that, ideally, only the target application traffic feature identification strategy should be able to effectively identify the current single stream sample packet, while other existing application traffic feature identification strategies cannot effectively identify it.

[0089] The purpose of performing single-packet multi-rule testing is to take into account the possibility that there may be conflicts between the target application traffic feature identification policy and the existing application traffic feature identification policy. In this way, by loading the target application traffic feature identification policy and other existing application traffic feature identification policies to identify and process the current single flow sample packet, the effectiveness and conflicts of these policies can be tested.

[0090] If an anomaly occurs during the test, it is obviously necessary to further optimize and improve the target application traffic feature identification strategy to avoid the recurrence of the anomaly.

[0091] In specific applications, there may be the following situations:

[0092] If the successfully identified strategy is the target application traffic feature identification strategy adapted by the current single flow sample packet, the test passes;

[0093] If the successfully identified policy is not the target application traffic feature identification policy adapted by the current single flow sample packet, but the successfully identified policy and the current single flow sample packet belong to the same application, it means that the successfully identified policy and the target application traffic feature identification policy adapted by the current single flow sample packet have an inclusion relationship. The features involved in the redundant policies can be merged as appropriate, which helps to reduce the number of rules and improve the engine matching speed.

[0094] If the successfully identified policy is not the target application traffic feature identification policy adapted by the current single flow sample packet, and the successfully identified policy and the current single flow sample packet do not belong to the same application, it means that the successfully identified policy and the target application traffic feature identification policy adapted by the current single flow sample packet are weak rules and cannot effectively distinguish applications, and need to be strengthened or deleted.

[0095] Step S105, adding the target application traffic feature identification strategy that has passed both the single-packet single-rule test and the single-packet multiple-rule test to the different application traffic feature identification strategies.

[0096] It is easy to understand that when the target application traffic feature identification strategy passes the above single-packet single-rule test and single-packet multiple-rule test, the current target application traffic feature identification strategy can be considered to be an effective identification strategy that can be put into practical use. Therefore, it can be added to the strategy group, that is, the other existing different application traffic feature identification strategies mentioned above, to achieve the improvement and expansion of the strategy group.

[0097] From the above content, it can be seen that in response to the demand for feature identification of application traffic, when the application traffic to be identified with the corresponding application traffic features is not successfully identified in the application traffic of the target application, the present application filters it into a single stream sample packet, and attempts to extract the application traffic features of the single stream sample packet to form a target application traffic feature identification strategy that is initially adapted to the application traffic to be identified. After that, on the one hand, the target application traffic feature identification strategy is tested and improved in the single-packet single-rule test, and on the other hand, the target application traffic feature identification strategy is tested and improved in the single-packet multiple-rule test. In this way, an accurate target application traffic feature identification strategy that matches the application traffic to be identified can be obtained, which provides an effective supplement to the strategies in different application traffic feature identification strategies and improves the construction system of the application traffic feature identification strategy. In this way, it can be ensured that the application traffic can be accurately feature identified to achieve accurate content identification effects.

[0098] Furthermore, for the construction of the above target application traffic feature identification strategy, it can be seen that it is constructed based on the application traffic to be identified that has not been successfully identified at present. After the target application traffic feature identification strategy is added to the policy group and put into actual use, it may also involve policy maintenance processing, so as to enable the policies in the policy group to remain highly targeted to different application traffic.

[0099] Correspondingly, as a practical implementation method, after adding the target application traffic feature identification strategy tested by both the single-packet single-rule test and the single-packet multiple-rule test to the different application traffic feature identification strategies, the method of the present application may also include:

[0100] In the multi-packet multi-rule test, different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0101] It can be understood that the multi-packet multi-rule test is aimed at application scenarios of continuous monitoring and continuous maintenance. It updates and maintains different application traffic feature identification strategies (including target application traffic identification strategies constructed in different periods) from an overall level.

[0102] The multi-packet multi-rule test may involve different network traffic or single flow sample packets, as well as different application traffic feature identification strategies. It maintains sensitivity to the original identifiable application traffic features by testing whether the original network traffic or single flow sample packets can be successfully identified.

[0103] It should be understood that in actual use, if there is application traffic that cannot be successfully identified by the policy group, the policy group can be supplemented and improved through the construction and processing of the previous target application traffic feature identification strategy.

[0104] The multi-packet and multi-rule test here is not to test the application traffic that cannot be successfully identified by the policy group, but to ensure that the existing identification strategy maintains a high sensitivity to the originally targeted and adapted application traffic characteristics, to avoid identification anomalies caused by anomalies in data use and loading.

[0105] In this way, in the test process here, specifically, it is tested whether different application traffic characteristics (known) can be successfully identified to achieve the test purpose. When application traffic characteristics cannot be successfully identified, the originally adapted application traffic characteristic identification strategy itself can be improved, or the conflict relationship between different strategies can be improved, or the application environment and other external conditions that the application traffic characteristic identification strategy can involve can be improved, until the long-term monitoring requirements of multi-packet and multi-test can be met.

[0106] In the process of testing whether different application traffic characteristics (known) can be successfully identified, the previous application traffic can be used specifically, wherein these application traffic can specifically be application traffic with determined application traffic characteristics, rather than original application traffic.

[0107] The multi-package multi-rule test may be performed periodically, for example, every day, to maintain high sensitivity of the policy group with a 24-hour test interval.

[0108] Among them, as another practical implementation method, different application traffic feature identification strategies are loaded here to test whether different application traffic features can be successfully identified, and the following contents may be specifically included:

[0109] Obtain pure flow sample packets of application traffic of the same application;

[0110] Load different application traffic feature identification strategies to test whether different application traffic features of pure flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0111] It can be understood that for the original application traffic, the present application can process it and separate all the traffic identified as the same application and save them as pure flow sample packets of the same application. The reason for separating the pure flow sample packets is to avoid the situation where the miscellaneous traffic in the original sample may interfere with the test results.

[0112] It can be understood that the pure flow sample package involved here can be either a ready-made flow sample package (pre-processed) or a flow sample package obtained by real-time processing.

[0113] The processing contents of the pre-processing and the real-time processing may be the same. Taking the real-time processing as an example, as another exemplary implementation, the process of obtaining the pure flow sample packets of the application traffic of the same application may include:

[0114] Load different application traffic feature identification strategies to identify the application traffic features of different application traffic;

[0115] Different application traffic is divided according to the application traffic feature identification results to obtain pure flow sample packets.

[0116] It can be understood that after the policy group successfully identifies different application traffic, it can extract pure flow sample packets belonging to the same application based on the identified application features for use in multi-packet multi-rule testing.

[0117] It is understandable that if a pure flow sample packet cannot be successfully identified, it may be caused by the following two situations:

[0118] 1. The pure flow sample packet is not pure, that is, the traffic of other applications was previously regarded as this application. At this time, the wrong application traffic feature identification strategy can be eliminated.

[0119] 2. The application traffic feature identification policy that outputs a successful identification result is misidentified, which is not a truly matched application traffic feature identification policy. At this time, you can adjust the policy priority, strengthen or delete the misidentified application traffic feature identification policy. The specific handling method can also be decided by the staff after analysis.

[0120] In addition, in addition to performing multi-packet multi-rule testing based on pure flow sample packets of the same application, as another exemplary implementation method, multi-packet multi-rule testing can also be performed using a single flow sample packet that could not be successfully identified in previous different stages.

[0121] Specifically, the process of loading different application traffic feature identification strategies to test whether different application traffic features can be successfully identified may also include:

[0122] Obtain the filtered and existing different single flow sample packets;

[0123] Load different application traffic feature identification strategies to test whether different application traffic features of different single flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0124] It can be understood that what is targeted here is the application traffic that could not be successfully identified before, and the existing single flow sample packet obtained by filtering is used as the specific identification object. It can be understood as a hybrid version of the previous single-packet multi-rule test. It maintains different policies in the policy group from a holistic perspective, so that all policies remain highly sensitive and do not conflict.

[0125] For multi-package and multi-rule testing under the periodic execution mechanism, corresponding maintenance scenarios may also involve the push of test results. Correspondingly, the application method may also:

[0126] The test results of the periodically executed multi-packet multi-rule test are pushed to the UE.

[0127] It can be understood that the UE is a terminal device on the staff side, so after checking the pushed multi-package multi-test test results, the staff can learn about the application status of the policy group in the first place.

[0128] In addition, in order to further improve the test effect of the multi-package multi-test here, in actual operation, the requirement for passing the test can be specifically limited to 100% successful recognition rate, that is, the multi-package multi-test passes the test under the condition of 100% successful recognition rate.

[0129] Similarly, for the single-package single-rule test and / or single-package multiple-rule test mentioned above, this passing test requirement is also adopted.

[0130] In this way, the different rule tests involved in this application are all tested with a 100% successful recognition rate, thereby achieving the best policy building effect and policy maintenance effect in specific applications.

[0131] The above is an introduction to the processing method of the application traffic feature identification strategy provided by this application. In order to facilitate better implementation of the processing method of the application traffic feature identification strategy provided by this application, this application also provides a processing device for the application traffic feature identification strategy from the perspective of functional modules.

[0132] See also Figure 2 , Figure 2 This is a schematic diagram of a structure of a processing device for applying a traffic feature identification strategy in this application. In this application, the processing device 200 for applying a traffic feature identification strategy may specifically include the following structure:

[0133] An acquisition unit 201 is used to acquire the application traffic to be identified in the application traffic of the target application, for which the corresponding application traffic feature has not been successfully identified;

[0134] A preliminary construction unit 202 is used to filter the application traffic to be identified into a single stream sample packet, and try to extract the application traffic characteristics of the single stream sample packet to form a target application traffic characteristic identification strategy for preliminary adaptation of the application traffic to be identified;

[0135] The first test unit 203 is used to load the target application traffic identification strategy and perform application traffic feature identification on a single stream sample packet in a single packet single rule test to test whether the application traffic feature of the single stream sample packet can be successfully identified, and if not, continue to improve the target application traffic feature identification strategy;

[0136] The second test unit 204 is used to load the target application traffic feature identification strategy and the existing different application traffic feature identification strategies in the single-packet multi-rule test to test whether the application traffic feature of a single stream sample packet can be successfully identified, and also to test whether the target application traffic feature identification strategy conflicts with the different application traffic feature identification strategies. If not, continue to improve the target application traffic feature identification strategy;

[0137] The adding unit 205 is used to add the target application traffic feature identification strategy that has passed both the single-packet single-rule test and the single-packet multiple-rule test to the different application traffic feature identification strategies.

[0138] In an exemplary implementation, the apparatus further includes a third testing unit 206, configured to:

[0139] In the multi-packet multi-rule test, different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0140] In yet another exemplary implementation, the third testing unit 206 is specifically configured to:

[0141] Obtain pure flow sample packets of application traffic of the same application;

[0142] Load different application traffic feature identification strategies to test whether different application traffic features of pure flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy;

[0143] In yet another exemplary implementation, the third testing unit 206 is specifically configured to:

[0144] Load different application traffic feature identification strategies to identify the application traffic features of different application traffic;

[0145] Different application traffic is divided according to the application traffic feature identification results to obtain pure flow sample packets.

[0146] In yet another exemplary implementation, the third testing unit 206 is specifically configured to:

[0147] Obtain the filtered and existing different single flow sample packets;

[0148] Load different application traffic feature identification strategies to test whether different application traffic features of different single flow sample packets can be successfully identified. If not, continue to improve the corresponding application traffic feature identification strategy.

[0149] In yet another exemplary implementation, the device further includes a pushing unit 207, configured to:

[0150] The test results of the periodically executed multi-packet multi-rule test are pushed to the UE.

[0151] In yet another exemplary implementation, different rule tests all pass the test with a 100% successful recognition rate.

[0152] This application also provides a processing device from the perspective of hardware structure, see Figure 3 , Figure 3 301, a memory 302, and an input / output device 303. The processor 301 is used to execute the computer program stored in the memory 302 to implement the following Figure 1 The steps of the processing method for applying the traffic feature identification strategy in the corresponding embodiment; or, the processor 301 is used to execute the computer program stored in the memory 302 to implement the following Figure 2 Corresponding to the functions of each unit in the embodiment, the memory 302 is used to store the processor 301 executing the above Figure 1 The computer program required for the processing method of applying the traffic feature identification strategy in the corresponding embodiment.

[0153] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 302, and executed by the processor 301 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0154] The processing device may include, but is not limited to, a processor 301, a memory 302, and an input / output device 303. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 301, the memory 302, the input / output device 303, etc. are connected via a bus.

[0155] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0156] The memory 302 can be used to store computer programs and / or modules. The processor 301 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 302 and calling the data stored in the memory 302. The memory 302 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0157] When the processor 301 is used to execute the computer program stored in the memory 302, the following functions can be implemented:

[0158] Acquire the application traffic to be identified in the application traffic of the target application, for which the corresponding application traffic characteristics have not been successfully identified;

[0159] Filter the application traffic to be identified into a single stream sample packet, and try to extract the application traffic characteristics of the single stream sample packet to form a target application traffic characteristic identification strategy for preliminary adaptation of the application traffic to be identified;

[0160] In the single-packet single-rule test, the target application traffic identification strategy is loaded and the application traffic feature identification of a single flow sample packet is performed to test whether the application traffic feature of the single flow sample packet can be successfully identified. If not, continue to improve the target application traffic feature identification strategy;

[0161] In the single-packet multi-rule test, the target application traffic feature identification strategy and the existing different application traffic feature identification strategies are loaded to test whether the application traffic features of a single flow sample packet can be successfully identified. At the same time, it is also tested whether the target application traffic feature identification strategy conflicts with the different application traffic feature identification strategies. If not, the target application traffic feature identification strategy will continue to be improved.

[0162] The target application traffic feature identification strategy tested by both the single-packet single-rule test and the single-packet multiple-rule test is added to the different application traffic feature identification strategies.

[0163] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the processing device, processing equipment and corresponding units of the above-described application flow feature recognition strategy can refer to the following. Figure 1 The description of the processing method for applying the traffic feature identification strategy in the corresponding embodiment will not be repeated here in detail.

[0164] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0165] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the processing method for applying the traffic feature identification strategy in the corresponding embodiment, the specific operations can be referred to as follows Figure 1 The description of the processing method for applying the traffic feature identification strategy in the corresponding embodiment will not be repeated here.

[0166] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0167] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the processing method for applying the traffic feature identification strategy in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by applying the processing method of the traffic feature identification strategy in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0168] The above is a detailed introduction to the processing method, device, processing equipment and computer-readable storage medium of the application traffic feature identification strategy provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A processing method for applying a traffic feature identification strategy, characterized in that: The method comprises: Acquire the application traffic to be identified in the application traffic of the target application, for which the corresponding application traffic characteristics have not been successfully identified; Filtering the application traffic to be identified into a single stream sample packet, and attempting to extract application traffic features of the single stream sample packet to form a target application traffic feature identification strategy for preliminary adaptation of the application traffic to be identified; In the single-packet single-rule test, the target application traffic identification strategy is loaded and the application traffic feature identification is performed on the single stream sample packet to test whether the application traffic feature of the single stream sample packet can be successfully identified. If not, the target application traffic feature identification strategy is further improved; In the single-packet multi-rule test, the target application traffic feature identification strategy and the existing different application traffic feature identification strategies are loaded to test whether the application traffic features of the single stream sample packet can be successfully identified. At the same time, it is also tested whether the target application traffic feature identification strategy conflicts with the different application traffic feature identification strategies. If not, the target application traffic feature identification strategy is further improved. The target application traffic feature identification strategy that passes both the single-packet single-rule test and the single-packet multiple-rule test is added to the different application traffic feature identification strategies.

2. The method according to claim 1, characterized in that After adding the target application traffic feature identification strategy that has passed both the single-packet single-rule test and the single-packet multiple-rule test to the different application traffic feature identification strategies, the method further includes: In the multi-packet multi-rule test, the different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified. If not, the corresponding application traffic feature identification strategies are further improved.

3. The method according to claim 2, characterized in that In the multi-packet multi-rule test, the different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified, including: Obtain pure flow sample packets of application traffic of the same application; The different application traffic feature identification strategies are loaded to test whether the different application traffic features of the pure flow sample packets can be successfully identified. If not, the corresponding application traffic feature identification strategies are continued to be improved.

4. The method according to claim 3, characterized in that: The obtaining of a pure flow sample packet of application traffic of the same application includes: Loading the different application traffic feature identification strategies to identify the application traffic features of the different application traffic; The different application flows are divided according to the application flow feature identification result to obtain the pure flow sample packet.

5. The method according to claim 2, characterized in that: In the multi-packet multi-rule test, the different application traffic feature identification strategies are loaded to test whether different application traffic features can be successfully identified, including: Obtain the filtered and existing different single flow sample packets; The different application traffic feature identification strategies are loaded to test whether different application traffic features of different single flow sample packets can be successfully identified. If not, the corresponding application traffic feature identification strategies are continued to be improved.

6. The method according to claim 2, characterized in that The method further comprises: The test result of the multi-packet multi-rule test performed periodically is pushed to the user equipment UE.

7. The method according to claim 1 or 2, characterized in that: Different rule tests are all passed with a 100% successful recognition rate.

8. A processing device for applying a traffic feature recognition strategy, characterized in that: The device comprises: An acquisition unit, used for acquiring the application traffic to be identified in the application traffic of the target application whose corresponding application traffic features have not been successfully identified; A preliminary construction unit, used for filtering the application traffic to be identified into a single stream sample packet, and attempting to extract the application traffic characteristics of the single stream sample packet, so as to form a target application traffic characteristic identification strategy for preliminary adaptation of the application traffic to be identified; The first test unit is used to load the target application traffic identification strategy and perform application traffic feature identification on the single stream sample packet in a single packet single rule test to test whether the application traffic feature of the single stream sample packet can be successfully identified, and if not, continue to improve the target application traffic feature identification strategy; The second test unit is used to load the target application traffic feature identification strategy and the existing different application traffic feature identification strategies in the single-packet multi-rule test to test whether the application traffic feature of the single stream sample packet can be successfully identified, and also test whether the target application traffic feature identification strategy conflicts with the different application traffic feature identification strategies. If not, continue to improve the target application traffic feature identification strategy; The adding unit is used to add the target application traffic feature identification strategy that has passed both the single-packet single-rule test and the single-packet multiple-rule test to the different application traffic feature identification strategies.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images