Traffic identification method and related apparatus

Abstract

The embodiment of the application discloses a flow identification method and related device, which is applied to a collector, the collector comprises a crawler module and virtual private network (VPN) software, and the method comprises the following steps: starting the VPN software according to a received VPN software starting command; accessing a website through the crawler module, listening to access flow, and generating listening flow; determining a source port number of the VPN software through a process name of the VPN software; and identifying flow generated by the VPN software according to the source port number based on the listening flow, and labeling the flow generated by the VPN software as VPN flow.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of VPN, and in particular, to a traffic identification method and related device. BACKGROUND

[0002] A virtual private network (VPN) is defined as a temporary, secure connection established through a public network (usually the Internet), and is a secure and stable tunnel through a chaotic public network, and is a technology of a dedicated data communication network. In practice, it is often necessary to collect VPN traffic. The existing scheme is to collect VPN traffic through a gateway, and to distinguish VPN traffic and non-VPN traffic based on IP addresses.

[0003] However, the existing scheme is to collect VPN traffic based on IP addresses, and due to the complex network environment in the physical machine, the distinction between VPN traffic and non-VPN traffic is not so accurate, and the VPN traffic cannot be accurately identified and collected, which brings great inconvenience to users. SUMMARY

[0004] Embodiments of the present application provide a traffic identification method and related device.

[0005] A traffic identification method applied to a collector, the collector comprising a crawler module and a virtual private network (VPN) software, the method comprising:

[0006] starting the VPN software according to a received VPN software starting command;

[0007] accessing a website through the crawler module, listening to access traffic, and generating listening traffic;

[0008] determining a source port number of the VPN software through a process name of the VPN software;

[0009] identifying traffic generated by the VPN software according to the source port number based on the listening traffic, and tagging the traffic generated by the VPN software with a VPN traffic label.

[0010] Optionally, the accessing a website through the crawler module, listening to access traffic, and generating listening traffic comprises:

[0011] accessing a website through the crawler module, and filtering the access traffic according to prior characteristics of a protocol of the VPN software to obtain the listening traffic.

[0012] Optionally, the determining a source port number of the VPN software through a process name of the VPN software comprises:

[0013] determine the source port number of the VPN software through the process name of the VPN software every preset polling time interval.

[0014] Optionally, the determining the source port number of the VPN software through the process name of the VPN software every preset polling time interval comprises:

[0015] determine the source port number of the VPN software through the process name of the VPN software every preset polling time interval, and record the opening timestamp and the closing timestamp of the port corresponding to the source port number;

[0016] generate a port record file according to the source port number, the opening timestamp and the closing timestamp;

[0017] Correspondingly, the identifying the VPN software generated traffic according to the source port number based on the monitored traffic and tagging the VPN software generated traffic with a VPN traffic label comprises:

[0018] filter the monitored traffic based on the port record file to obtain the VPN software generated traffic, and tag the VPN software generated traffic with a VPN traffic label.

[0019] Optionally, the collector is an isolated component deployed in a physical host.

[0020] The collector is multiple, and each collector is deployed with at least one VPN software, and each collector only runs one VPN software in a selected time interval.

[0021] Optionally, the number of collectors is multiple, and each collector is deployed in a different geographical area.

[0022] A traffic identification device applied to a collector, the collector comprising a crawler module and a virtual private network (VPN) software, comprising:

[0023] a starting unit configured to start the VPN software according to a received VPN software starting command;

[0024] a monitoring unit configured to access a website through the crawler module and monitor the access traffic to generate monitored traffic;

[0025] a determining unit configured to determine the source port number of the VPN software through the process name of the VPN software;

[0026] an identifying unit configured to identify the VPN software generated traffic according to the source port number based on the monitored traffic and tag the VPN software generated traffic with a VPN traffic label.

[0027] A flow identification device, comprising:

[0028] Central processing unit, memory, and input / output interfaces;

[0029] The memory is either a short-term storage memory or a persistent storage memory;

[0030] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the aforementioned method.

[0031] A traffic identification device cluster includes the traffic identification devices as described above, and is deployed in different geographical areas.

[0032] A computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the methods described above.

[0033] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0034] The VPN software is launched according to the startup command. Then, a web crawler module randomly accesses multiple websites and monitors the access traffic to generate monitoring traffic. The source port number of the VPN software is determined by its process name. Finally, based on the monitoring traffic, the traffic generated by the VPN software is identified by its source port number and tagged with VPN traffic. By accurately identifying and collecting VPN traffic through the source port number, the efficiency and accuracy of VPN traffic identification are greatly improved, providing users with a better experience. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of an embodiment of the traffic identification method of this application;

[0036] Figure 2 This is a diagram illustrating the overall architecture of this application;

[0037] Figure 3 This is a schematic diagram of the data collector structure in this application;

[0038] Figure 4 This is a schematic diagram of the model training part of this application;

[0039] Figure 5 This is a schematic diagram of another embodiment of the traffic identification method of this application;

[0040] Figure 6 An embodiment diagram is updated for the model of this application;

[0041] Figure 7Another schematic diagram of the updated model of this application;

[0042] Figure 8 This is a schematic diagram of an embodiment of the traffic identification device of this application;

[0043] Figure 9 This is a schematic diagram of another embodiment of the traffic identification device of this application. Detailed Implementation

[0044] This application provides a traffic identification method and related apparatus.

[0045] Existing solutions distinguish between VPN and non-VPN traffic through gateways, thereby identifying VPN traffic. However, these solutions rely on IP addresses, which, due to the complexity of the network environment on physical machines, cannot accurately identify VPN traffic. To address this issue, this application provides a traffic identification method and related apparatus to identify VPN traffic based on the source port number of the VPN software, thus providing users with a better experience.

[0046] The traffic identification method and device of this application are described below. Please refer to... Figure 1 One embodiment of the traffic identification method of this application is applied to a data collector, which includes a crawler module and virtual private network (VPN) software. The method includes:

[0047] 101. Start the VPN software according to the received VPN software startup command;

[0048] The VPN software is launched upon receiving the startup command. Specifically, the collector receives the VPN software startup command and starts the specified VPN software and VPN protocol according to the parameters in the command. The VPN software can be started automatically based on either an absolute or relative path; the specific method is not limited here. Modification of the VPN protocol requires adaptation for different VPN software. For VPN software with plaintext protocol configuration files, the file can be directly modified to change the protocol. For VPN software with encrypted protocol configuration files, keyboard and mouse operations can be simulated to modify the protocol. Additionally, after the VPN software starts, port listening, traffic monitoring, and website crawling will also begin simultaneously.

[0049] 102. Access the website through the crawler module, monitor the access traffic, and generate monitoring traffic;

[0050] After the crawler module is started, the website is accessed by the crawler module, and the access traffic is listened to to generate the listening traffic. Among them, the tool (selenium+chromedriver) can be used to randomly access each website to generate access traffic. At the same time, the access traffic is listened to to obtain the listening traffic, and the listening traffic exists in the form of a PCAP file. Specifically, the prior characteristics of the protocol of the VPN software can be used for listening to obtain the listening traffic, for example, some protocols only have TCP flow, and some protocols have port number 443. The prior characteristics can be converted into Berkeley packet filter (BPF, berkeley packet filter) statements to listen to obtain less traffic.

[0051] 103. Determine the source port number of the VPN software through the process name of the VPN software;

[0052] The source port number of the VPN software is determined through the process name of the VPN software. Specifically, the corresponding process identification (PID, process identification) is found through the process name of the VPN software, and then the source port number applied by the process is found by using the process identification. The opening timestamp and closing timestamp of the port can be recorded based on a preset polling time period, wherein the polling time period can have multiple segments, each of which can be the same or different, for example, set as a per-second polling mode. Finally, a JSON format file including the source port number and the timestamp list corresponding to the source port number can be obtained.

[0053] 104. Based on the listening traffic, the traffic generated by the VPN software is identified according to the source port number, and the traffic generated by the VPN software is labeled with a VPN traffic label.

[0054] Based on the listening traffic, the traffic generated by the VPN software is identified according to the source port number, and the traffic generated by the VPN software is labeled with a VPN traffic label. Specifically, the listening traffic is filtered according to the source port number and the corresponding timestamp data, and the traffic generated by the VPN software in the form of a PCAP file is filtered, and the traffic is labeled with the corresponding VPN traffic label. Among them, the label can be divided into a first-level label and a second-level label, the first-level label is used to indicate whether the traffic is VPN traffic, and the second-level label is used to represent other attributes of the traffic, such as the corresponding VPN software name, date or location, etc.

[0055] In the embodiment of the present application, the VPN software is started according to the VPN software start command, then the crawler module is used to randomly access multiple websites and listen to the access traffic to generate the listening traffic, the source port number of the VPN software is determined through the process name of the VPN software, and finally the traffic generated by the VPN software is identified according to the source port number based on the listening traffic, and the VPN traffic label is added to the traffic. The source port number of the VPN software is used to accurately identify the VPN traffic, accurately collect the VPN traffic, so that the efficiency and accuracy of the VPN traffic identification are greatly improved, and a better experience is provided for the user.

[0056] The traffic identification method of the present application will be described in detail below.

[0057] Please refer to Figure 2 The overall architecture of the present application mainly includes a data collection part and a model training part. The collector belongs to the data collection part, and the collector is arranged in a plurality of preselected regions. The local collector collects non-VPN traffic data and VPN traffic data regularly, and transmits the collected data to the model training part. The training server data model training part is used to train the optimal VPN software traffic identification model corresponding to each region by using the traffic of each region, and generate the required VPN software traffic identification model of different regions.

[0058] Please refer to Figure 3 The collector of the present application is also called a host computer, which includes a master control unit, a crawler unit Figure 3 The crawler unit is a general concept, which includes proxy software such as free gate, and a crawler module that can access the external network. The master control unit is used to control the other two units, as well as some basic operations such as traffic deletion and computer restart. The crawler unit is used to control the opening and closing of the VPN software and the switching of the VPN protocol, and also randomly accesses websites and listens to traffic. The uploading unit is mainly used to upload the traffic data with labels. The host computer can be a physical host computer, or a isolated component (such as a virtual machine or a container) deployed in a physical host computer. Each host computer can deploy one or more VPN software, and each collector only runs one VPN software in a selected time period. In the embodiment, the collector collects traffic in units of days.

[0059] Please refer to Figure 4 The model training part of the present application includes data download, data processing, failure detection and model construction. Specifically, the traffic collected by the collector is uploaded to a network disk or a cloud server, and the traffic is obtained from the network disk or the cloud server for feature extraction, pre-processing, failure detection of the model, and proportion sampling to train the qualified model if the model fails.

[0060] Please refer toFigure 5 Another embodiment of the traffic identification method of the present application includes:

[0061] 501, start the VPN software according to the received VPN software start command;

[0062] According to the received VPN software start command, the VPN software is started. Specifically, the collector receives the VPN software start command, and starts the specified VPN software and VPN protocol according to the parameters in the start command. The VPN software can be automatically started according to the absolute path or relative path of the VPN software, which is not limited here. For the modification of VPN protocol, it needs to be adapted according to different VPN software. For the VPN software whose protocol configuration file is in plaintext, the file can be directly modified to modify the protocol. For the VPN software whose protocol configuration file is in ciphertext, the protocol can be modified by simulating mouse operation. In addition, after the VPN software is started, the port listening, traffic monitoring and website crawler are started at the same time.

[0063] 502, access the website through the crawler module, and filter the access traffic according to the prior characteristics of the VPN software protocol to obtain the monitoring traffic;

[0064] After the crawler module is started, the website is accessed through the crawler module, and the access traffic is monitored to generate monitoring traffic. Among them, the tool (selenium+chromedriver) can be used to randomly access each website to generate access traffic. At the same time, the access traffic is monitored to obtain the monitoring traffic, and the monitoring traffic exists in the form of PCAP file. Specifically, the prior characteristics of the VPN software protocol can be used for monitoring to obtain the monitoring traffic, for example, some protocols only have TCP flow, and some protocols have port number 443. The prior characteristics can be converted into Berkeley packet filter (BPF, berkeley packet filter) statements to monitor to obtain less traffic.

[0065] 503, determine the source port number of the VPN software every preset polling time period through the process name of the VPN software, and record the opening timestamp and closing timestamp of the port corresponding to the source port number;

[0066] The source port number of the VPN software is determined through the process name of the VPN software. Specifically, the corresponding process identification (PID, process identification) is found through the process name of the VPN software, and then the source port number applied by the process is found by using the process identification. The opening timestamp and closing timestamp of the port can also be recorded based on the preset polling time period, wherein the polling time period can have multiple segments, each of which can be the same or different, for example, set to every second polling mode.

[0067] 504、generating a port record file according to the source port number, the open timestamp and the close timestamp;

[0068] A port record file is generated according to the source port number, the open timestamp and the close timestamp. Specifically, after the polling is completed, a port record file in JSON format is generated, taking the source port number as the key name and taking the open timestamp and the close timestamp as the key values. It can be understood that the port record file can also be in other forms, as long as it includes the source port number and the corresponding open timestamp and close timestamp, and the specific form is not limited here.

[0069] 505、based on the port record file, filtering the monitored traffic to obtain the traffic generated by the VPN software, and labeling the traffic generated by the VPN software with a VPN traffic label;

[0070] The traffic generated by the VPN software is identified based on the port record file, and the traffic generated by the VPN software is labeled with a VPN traffic label. Specifically, the monitored traffic is filtered according to the source port number and the corresponding timestamp data, and the traffic generated by the VPN software in the PCAP format file is filtered and labeled with the corresponding VPN traffic label. The label includes a first-level label and a second-level label. The first-level label is used to indicate whether the traffic is VPN traffic, and the second-level label is used to indicate other attributes of the traffic, such as the corresponding VPN software name, date or location, etc.

[0071] 506、based on the traffic generated by the VPN software, training or updating a VPN software traffic identification model;

[0072] After obtaining the traffic generated by the VPN software, it can be uploaded to the cloud server, so that a VPN software traffic identification model suitable for a preselected region is trained or updated through the cloud server, or the traffic generated by the VPN software can be first extracted for features, and the PCAP format file is converted into a csv file and then uploaded to the cloud server. Subsequently, the model is trained or updated directly using the traffic features. Further, the traffic features in the first time window can be used for model training, and subsequent new current VPN traffic features can be used to determine whether to update the current VPN software traffic identification model.

[0073] Specifically, after downloading the new current VPN traffic feature, the current VPN traffic feature is used to perform invalidity detection on the locally saved latest current VPN software traffic identification model. Whether the model is invalid is determined according to preset evaluation indexes, such as whether the false positive rate is higher than 90%, if the model is not invalid, the model is continuously used, if the model is invalid, the model is marked as invalid, and the identification result is saved to a log. Then, whether there is a model marked as invalid in the detection log is checked, and whether there is a situation that the traffic feature has met the date number of the time window but the corresponding model has not been trained is checked, and the model needed to be trained is added to a training list. For each model needed to be trained, the traffic features of different dates within the required range are sampled according to the corresponding time window, traffic feature and related information according to a preset proportion. After sampling, a data set is constructed, the model is trained by using the data set within a preset parameter range, and each parameter information is saved. The VPN software traffic identification model after training is judged, if each index is too poor, such as the detection rate is less than 95%, the parameter range of training and the flow proportion of different dates are adjusted, the training of the model is re-arranged, and the training is completed until the training is completed. After the training is completed, the VPN software traffic identification model is uploaded to a cloud server.

[0074] Two specific ways of updating the VPN software traffic identification model are provided below.

[0075] 1. Please refer to Figure 6 , t represents a time window and corresponding range traffic feature, and d represents a day's traffic feature. The first model model1 is trained by using the traffic feature of the first time window t1. In ①, ② and ③, model1 is the latest current model. In ①, the latest traffic feature is d1, model1 is detected by using d1, the detection rate and the false positive rate of model1 to d1 are greater than a preset threshold, and model1 is still the latest model. In ②, the latest traffic feature is d2, model1 is detected by using d2, the detection rate and the false positive rate of model1 to d2 are still greater than the preset threshold, and model1 is still the latest model. In ③, di is the latest traffic feature, model1 is detected by using di, the detection rate and the false positive rate of model1 to di are less than the preset threshold, and model1 is not the latest model from ④. Then, in ④, the time window is slid, the latest time window t2 including di is used to train the latest model model2. In ⑤, the latest traffic feature is new d1, the latest model is model2, and the above process is repeated, which is not described herein.

[0076] 2. Please refer to Figure 7, t represents a time window and corresponding range of traffic characteristics, and training period represents a training period. The first traffic characteristics of the first time window t1 are used to train the first model model1. Then, every training period, the time window is automatically shifted to cover the latest traffic characteristics, forming the second time window t2, using the traffic characteristics in t2 to train model2, then every training period to form the third time window t3, training model3, then t4 and model4, and so on. Here, no longer.

[0077] 507, using the trained VPN software traffic identification model to identify VPN traffic.

[0078] After training the model of each region respectively according to the geographical area, the target geographical area information is sent to the cloud server to receive the corresponding VPN software traffic identification model sent by the cloud server, and then the traffic of the corresponding region based on the VPN software traffic identification model The target geographical area information is received to identify the traffic sent by the VPN software. The traffic is collected in advance in a plurality of preselected regions to train a plurality of corresponding regional VPN software traffic identification models, and then based on the geographical area information, the cloud server sends the corresponding regional VPN software traffic identification model, which can be used to identify the VPN software traffic.

[0079] In this embodiment, the VPN software is started according to the VPN software start command, then the crawler module randomly accesses a plurality of websites, and listens to the access traffic to generate the listening traffic, the source port number of the VPN software is determined through the process name of the VPN software, and finally the traffic generated by the VPN software is identified based on the port record file, and the traffic is labeled with the VPN traffic label. The source port number of the VPN software is used to accurately identify the VPN traffic, accurately collect the VPN traffic, so that the efficiency and accuracy of the VPN traffic identification are greatly improved, and in addition, the traffic generated by the VPN software can be labeled with the corresponding first label and second label, so that the user can understand the specific situation of the traffic. Compared with manual labeling, the present application also has the beneficial effects of high accuracy, basically no dirty data, reduces labor cost, and can also simultaneously capture absolute pure traffic of different VPN software, realizes parallel collection of multiple traffic, supports continuous collection, makes the change of traffic in time keep synchronization, and brings better experience to the user.

[0080] The traffic identification device of the present application will be described below. Please refer to Figure 8 An embodiment of the traffic identification device of the present application is applied to a collector, which includes a crawler module and a virtual private network (VPN) software, comprising:

[0081] The starting unit 801 is configured to start the VPN software according to the received VPN software starting command.

[0082] The monitoring unit 802 is configured to access websites through the crawler module, monitor the access traffic, and generate monitored traffic.

[0083] The determining unit 803 is configured to determine the source port number of the VPN software through the process name of the VPN software.

[0084] The identifying unit 804 is configured to identify the traffic generated by the VPN software according to the source port number based on the monitored traffic, and label the traffic generated by the VPN software as VPN traffic.

[0085] In the embodiment, the starting unit 801 starts the VPN software according to the VPN software starting command, then the monitoring unit 802 randomly accesses multiple websites through the crawler module, monitors the access traffic to generate monitored traffic, the determining unit 803 determines the source port number of the VPN software through the process name of the VPN software, and finally the identifying unit 804 identifies the traffic generated by the VPN software according to the source port number based on the monitored traffic, and labels the traffic as VPN traffic. The source port number of the VPN software is used to accurately identify the VPN traffic, accurately collect the VPN traffic, so that the efficiency and accuracy of the VPN traffic identification are greatly improved, and a better experience is provided for users.

[0086] The functions and processes performed by each unit of the traffic identification device in the embodiment are similar to the functions and processes performed by the traffic identification device in the foregoing Figures 1 to 7 , and will not be described here.

[0087] Figure 9 is a structure diagram of a traffic identification device provided by the embodiment, and the traffic identification device 900 can include one or more central processing units (CPU) 901 and a memory 905. The memory 905 stores one or more application programs or data.

[0088] The memory 905 can be volatile storage or persistent storage. The programs stored in the memory 905 can include one or more modules, and each module can include a series of instruction operations in the traffic identification device. Further, the central processing unit 901 can be configured to communicate with the memory 905 and execute a series of instruction operations in the memory 905 on the traffic identification device 900.

[0089] The traffic identification apparatus 900 can also include one or more power supplies 902, one or more wired or wireless network interfaces 903, one or more input / output interfaces 904, and / or one or more operating systems, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0090] The central processing unit 901 can perform the operations of the traffic identification apparatus in the embodiments described above, which will not be described in detail here. Figures 1 to 7 The central processing unit 901 can perform the operations of the traffic identification apparatus in the embodiments described above, which will not be described in detail here.

[0091] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, apparatuses and units described above can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0092] In several embodiments provided in the present application, it should be understood that the disclosed systems, apparatuses and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, units or components, which can be electrical, mechanical or other forms.

[0093] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e. can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0094] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0095] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, read-only memory), a random access memory (RAM, random access memory), a magnetic disk or an optical disk, and various media that can store program codes.

Claims

1. A traffic flow identification method, characterized in that, Applied to a data collector, the data collector including a crawler module and virtual private network (VPN) software, the method includes: The VPN software is launched according to the received VPN software launch command; The crawler module accesses the website and monitors the access traffic to generate monitoring traffic. The source port number of the VPN software is determined by the process name of the VPN software. Based on the monitored traffic, the traffic generated by the VPN software is identified according to the source port number, and the traffic generated by the VPN software is tagged with VPN traffic. The step of determining the source port number of the VPN software through its process name includes: By using the process name of the VPN software and polling at preset intervals, the corresponding process identification number is determined, and then the source port number of the VPN software is found based on the process identification number.

2. The traffic identification method according to claim 1, characterized in that, The process of accessing the website through the crawler module and monitoring the access traffic to generate monitoring traffic includes: The web crawler module accesses the website, and the access traffic is filtered according to the prior characteristics of the VPN software protocol to obtain the monitoring traffic.

3. The traffic identification method according to claim 1, characterized in that, The process of determining the source port number of the VPN software by using the process name of the VPN software at preset polling intervals includes: By using the process name of the VPN software and polling at preset intervals, the source port number of the VPN software is determined, and the opening and closing timestamps of the port corresponding to the source port number are recorded. Generate a port record file based on the source port number, the start timestamp, and the stop timestamp; Accordingly, the step of identifying the traffic generated by the VPN software based on the monitored traffic and the source port number, and tagging the traffic generated by the VPN software with VPN traffic tags, includes: Based on the port log file, the monitored traffic is filtered to obtain the traffic generated by the VPN software, and the traffic generated by the VPN software is tagged with VPN traffic.

4. The traffic identification method according to claim 1, characterized in that, The collector is an isolated component deployed in a physical host; There are multiple collectors, and each collector deploys at least one VPN software. During the selected time period, each collector runs only one VPN software.

5. The traffic flow identification method according to any one of claims 1 to 4, characterized in that, The number of collectors is multiple, and they are deployed in different geographical areas.

6. A flow rate identification device, characterized in that, Applied to a data collector, the data collector includes a crawler module and virtual private network (VPN) software, including: The startup unit is used to start the VPN software according to the received VPN software startup command; The monitoring unit is used to access the website through the crawler module, monitor the access traffic, and generate monitoring traffic. The determining unit is used to determine the source port number of the VPN software based on the process name of the VPN software; The identification unit is used to identify the traffic generated by the VPN software based on the monitored traffic and the source port number, and to tag the traffic generated by the VPN software with a VPN traffic label. The step of determining the source port number of the VPN software through its process name includes: By using the process name of the VPN software and polling at preset intervals, the corresponding process identification number is determined, and then the source port number of the VPN software is found based on the process identification number.

7. A flow rate identification device, characterized in that, include: Central processing unit, memory, and input / output interfaces; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 5.

8. A traffic flow identification device cluster, characterized in that, It includes the traffic identification device as described in claim 6 or 7, and is deployed in different geographical areas.

9. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 5.

Images