Traffic identification method, device, equipment, storage medium and program product

Abstract

The present application relates to a method, device, equipment, storage medium and program product for identifying unknown traffic. The method comprises: first, obtaining a traffic log, matching the traffic log with a protocol library, and querying whether the protocol library stores the identifier of an application corresponding to the traffic log; if not, performing at least one information extraction process on the traffic log, each information extraction process extracts different types of feature information, and after each information extraction process, determining whether the feature information extracted by this information extraction process can match the application; if the extracted feature information matches the application, stopping the information extraction process, and storing the feature information and the identifier of the application matched with the feature information in the protocol library, and if the extracted feature information does not match the application, performing the next information extraction process. The present method can realize automatic identification of unknown traffic.

Description

Technical Field

[0001] The present application relates to the technical field of Internet application identification, and in particular to a traffic identification method, device, equipment, storage medium and program product. Background Art

[0002] Analyzing the traffic of Internet applications can realize functions such as refined business identification, business traffic flow analysis, business traffic proportion statistics, application layer denial of service attacks, and filtering of viruses and Trojans.

[0003] As Internet applications are frequently updated, new Internet applications are emerging rapidly, network data traffic is increasing day by day, and the complexity of traffic analysis is increasing accordingly. The traditional analysis process is to manually dial, capture packets, analyze and extract features for a certain application in a laboratory environment. However, manual analysis requires a lot of time and effort, and is relatively inefficient. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, equipment, storage medium and program product that can automatically identify unknown traffic in response to the above technical problems.

[0005] In the first aspect, the present application provides a method for identifying unknown traffic. The method includes: obtaining a traffic log; matching the traffic log with a protocol library, and querying whether there is an identifier of an application corresponding to the traffic log in the protocol library; if not, performing at least one information extraction process on the traffic log, and the type of feature information extracted by each information extraction process is different. After each information extraction process, determine whether the feature information extracted by this information extraction process can match the application; if so, stop the information extraction process, and store the feature information obtained by the last information extraction process and the identifier of the matched application in the protocol library; if not, perform the next information extraction process.

[0006] In one of the embodiments, the characteristic information includes at least one of: a plain text string, domain name registration information, official website title information, application package name, data encoding characteristics, traffic IP address, and traffic port number.

[0007] In the above embodiment, various characteristic information in the traffic log is obtained, and application programs are matched according to the various characteristic information, thereby improving the recognition rate of the traffic.

[0008] In one of the embodiments, the feature information includes a plaintext string, and determining whether the feature information extracted by this feature information extraction process can match the application includes: matching the plaintext string with a preset rule base, the preset rule base includes a plurality of sets of correspondences between plaintext strings and applications; if the plaintext string exists in the preset rule base, then determining the application corresponding to the plaintext string in the preset rule base as the application that matches the plaintext string.

[0009] In one of the embodiments, matching the plaintext string with a preset rule base includes: counting the number of hits of the plaintext string in the traffic log; and matching the plaintext string whose hit number is greater than a preset threshold with the preset rule base.

[0010] In the above embodiment, by extracting plaintext character strings, plaintext character strings with high access degrees and matched applications are added to the protocol library, thereby improving the efficiency of the protocol library matching search.

[0011] In one of the embodiments, the characteristic information includes the registration information of the domain name, and determining whether the characteristic information extracted by this characteristic information extraction process can match the application includes: if the registration information of the domain name can be obtained, then determining the website name in the registration information of the domain name as the application that matches the registration information of the domain name.

[0012] In the above embodiment, the matching application is determined by extracting the registration information of the domain name, and then the registration information of the domain name and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0013] In one of the embodiments, the feature information includes the title information of the official website, and determining whether the feature information extracted by this feature information extraction process can match the application includes: if the title information of the official website can be obtained, then determining the title information in the title information of the official website as the application that matches the title information of the official website.

[0014] In the above embodiment, the matching application is determined by extracting the title information of the official website, and then the title information of the official website and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0015] In one of the embodiments, the feature information includes an application package name, and determining whether the feature information extracted by this feature information extraction process can match the application includes: matching the application package name with a preset application store library, the preset application store library includes multiple sets of correspondences between application package names and application programs; if the application package name exists in the preset application store library, then determining the application corresponding to the application package name in the preset application store library as the application that matches the application package name.

[0016] In the above embodiment, the matching application program is determined by extracting the application package name, and then the application package name and the matched application program are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0017] In one of the embodiments, the feature information includes a data coding feature, and determining whether the feature information extracted by this feature information extraction process can match the application includes: decoding the data coding feature; if the data coding feature is decoded successfully, then determining the application after the data coding feature is decoded as the application that matches the data coding feature.

[0018] In the above embodiment, the matching application is determined by extracting the data encoding feature, and then the data encoding feature and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0019] In one of the embodiments, the characteristic information includes the traffic IP address, and determining whether the characteristic information extracted by this characteristic information extraction process can match the application includes: matching the traffic IP address with a preset DNS log, the preset DNS log is a correspondence table between IP addresses and domain names; if the traffic IP address exists in the preset DNS log, determining the application corresponding to the traffic IP address based on the domain name corresponding to the traffic IP address in the preset DNS log, and determining it as the application that matches the traffic IP address.

[0020] In the above embodiment, the matching application is determined by extracting the traffic IP address, and then the traffic IP address and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0021] In one of the embodiments, the characteristic information includes a traffic port number, and determining whether the characteristic information extracted by this characteristic information extraction process can match the application includes: determining the corresponding application based on the traffic port number; judging whether the data at the corresponding time of the traffic log is the corresponding application determined by the traffic port number; if so, determining the corresponding application determined by the traffic port number as the application that matches the traffic port number.

[0022] In the above embodiment, the matching application is determined by extracting the traffic port number, and then the traffic port number and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0023] In one of the embodiments, the characteristic information includes the traffic IP address, and determining whether the characteristic information extracted by this characteristic information extraction process can match the application also includes: matching the traffic IP address with a preset IP library, the preset IP library is a correspondence table of multiple groups of IP addresses and applications; if the traffic IP address exists in the preset IP library, then the application corresponding to the traffic IP address in the preset IP library is determined as the application that matches the traffic IP address.

[0024] In a second aspect, the present application also provides an unknown traffic identification device. The device includes:

[0025] Acquisition module, used to obtain traffic logs;

[0026] A query module matches the traffic log with the protocol library, and queries the protocol library to see whether there is an identifier of the application corresponding to the traffic log;

[0027] an extraction module, for performing at least one information extraction process on the traffic log if it does not exist, and each information extraction process extracts a different type of characteristic information, and after each information extraction process, determining whether the characteristic information extracted by this information extraction process can match the application;

[0028] The storage module is used to stop the information extraction process if yes, and store the feature information obtained from the last information extraction process and the identification of the matched application program in the protocol library; if no, perform the next information extraction process.

[0029] In one of the embodiments, the characteristic information includes at least one of: a plain text string, domain name registration information, official website title information, application package name, data encoding characteristics, traffic IP address, and traffic port number.

[0030] In one of the embodiments, the feature information includes a plaintext string, and the extraction module is specifically used to match the plaintext string with a preset rule base, which includes a correspondence between multiple groups of plaintext strings and applications; if the plaintext string exists in the preset rule base, the application corresponding to the plaintext string in the preset rule base is determined as the application that matches the plaintext string.

[0031] In one of the embodiments, the extraction module is specifically used to count the number of hits of the plaintext character string in the traffic log; and match the plaintext character string whose hit number is greater than a preset threshold with a preset rule base.

[0032] In one embodiment, the characteristic information includes domain name registration information, and the extraction module is specifically used to determine the website name in the domain name registration information as an application matching the domain name registration information if the domain name registration information can be obtained.

[0033] In one embodiment, the characteristic information includes title information of the official website, and the extraction module is specifically used to determine the title information in the title information of the official website as an application that matches the title information of the official website if the title information of the official website can be obtained.

[0034] In one of the embodiments, the characteristic information includes an application package name, and an extraction module is specifically used to match the application package name with a preset application store library, the preset application store library includes multiple sets of correspondences between application package names and application programs; if the application package name exists in the preset application store library, the application program corresponding to the application package name in the preset application store library is determined as the application program that matches the application package name.

[0035] In one of the embodiments, the feature information includes a data encoding feature, and the extraction module is specifically used to decode the data encoding feature; if the data encoding feature is decoded successfully, the application after the data encoding feature is decoded is determined as the application matching the data encoding feature.

[0036] In one of the embodiments, the characteristic information includes a traffic IP address, and an extraction module is specifically used to match the traffic IP address with a preset DNS log, and the preset DNS log is a correspondence table between IP addresses and domain names; if the traffic IP address exists in the preset DNS log, the application corresponding to the traffic IP address is determined based on the domain name corresponding to the traffic IP address in the preset DNS log, and is determined to be the application that matches the traffic IP address.

[0037] In one of the embodiments, the characteristic information includes a traffic port number, and an extraction module is specifically used to determine a corresponding application based on the traffic port number; determine whether the data at the corresponding time of the traffic log is the corresponding application determined by the traffic port number; if so, determine the corresponding application determined by the traffic port number as an application that matches the traffic port number.

[0038] In one of the embodiments, the characteristic information includes a traffic IP address, and an extraction module is specifically used to match the traffic IP address with a preset IP library, which is a correspondence table of multiple groups of IP addresses and applications; if the traffic IP address exists in the preset IP library, the application corresponding to the traffic IP address in the preset IP library is determined as the application that matches the traffic IP address.

[0039] In a third aspect, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned unknown traffic identification method when executing the computer program.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the above-mentioned unknown traffic identification method when executed by a processor.

[0041] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the above-mentioned unknown traffic identification method is implemented.

[0042] The above-mentioned unknown traffic identification method, device, equipment, storage medium and program product first obtain the traffic log, and match it with the protocol library according to the traffic log, and query whether the protocol library stores the identification of the application corresponding to the traffic log; if not, perform at least one information extraction process on the traffic log, each information extraction process extracts different types of feature information, and after each information extraction process, determine whether the feature information extracted by this information extraction process can match the application; if the extracted feature information matches the application, stop the information extraction process, and store the feature information and the identification of the application matched with the feature information in the protocol library, if the extracted feature information does not match the application, perform the next information extraction process. In this way, by obtaining the traffic log and extracting the feature information therein to match the application, if it matches, the protocol library is updated according to the feature information and the matched application identification, if it does not match successfully, continue to extract the next feature information, thereby realizing the automatic identification of unknown traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A schematic diagram of a flow chart of an unknown traffic identification method in one embodiment;

[0044] Figure 2 A schematic diagram of a process flow according to a plain text string matching step in another embodiment;

[0045] Figure 3 A schematic diagram of a process flow according to a plaintext string matching step in another embodiment;

[0046] Figure 4 is a schematic diagram of a flow chart of matching according to an application package name in another embodiment;

[0047] Figure 5 It is a schematic diagram of a flow chart of matching according to data encoding features in another embodiment;

[0048] Figure 6 A schematic diagram of a flow chart of matching according to traffic IP addresses in another embodiment;

[0049] Figure 7A schematic diagram of a flow chart of matching according to a flow port number in another embodiment;

[0050] Figure 8 A schematic diagram of a flow chart of matching according to traffic IP addresses in another embodiment;

[0051] Fig. 9 A flowchart of an unknown traffic identification method in another embodiment;

[0052] Fig.10 A schematic diagram of a flow chart of an unknown traffic identification method in another embodiment;

[0053] Fig.11 A schematic diagram of a flow chart of an unknown traffic identification method in another embodiment;

[0054] Fig.12 is a structural block diagram of an unknown flow identification device in one embodiment;

[0055] Fig.13 FIG. 4 is a diagram showing the internal structure of a server device in one embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] Traffic analysis of Internet applications can achieve refined business identification, business traffic flow analysis, business traffic proportion statistics, application layer denial of service attacks, virus and Trojan filtering, etc. With the frequent updates of Internet applications, new Internet applications are emerging rapidly, network data traffic data is increasing, and the complexity of traffic analysis is increasing. The traditional analysis process is to manually dial, capture packets, analyze and extract features for a certain application in a laboratory environment. However, manual analysis requires a lot of time and effort, and is relatively inefficient.

[0058] In view of this, an embodiment of the present application provides a method for identifying unknown traffic, which obtains traffic logs and extracts characteristic information therein to match applications. If a match is found, the protocol library is updated based on the characteristic information and the matched application identifier. If a match is not successful, the next characteristic information is extracted, thereby achieving automatic identification of unknown traffic.

[0059] In one embodiment, Figure 1As shown, a method for identifying unknown traffic is provided, and the method is applied to a server as an example for explanation. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. The method includes the following steps:

[0060] Step 101: The server obtains traffic logs.

[0061] Mirror the traffic to be analyzed to the server. The server can be deployed with a DPI (Deep Packet Inspection) device to monitor the traffic accessing the Internet. At the same time, enable the real-time packet capture function, refined log function and flow log function of the DPI device. After running for a period of time, obtain the DPI log, that is, the traffic log.

[0062] Step 102: The server matches the traffic log with the protocol library, and queries the protocol library to see whether there is an identifier of the application corresponding to the traffic log.

[0063] The protocol library contains the correspondence between multiple groups of traffic log features and application identifiers. The DPI device identifies the traffic by querying the protocol library, that is, identifying which application the traffic belongs to. The features of the traffic log can be the domain name, application package name, or IP address of the traffic. The protocol library is queried based on the traffic log to determine whether the protocol library stores the identifier of the application corresponding to the traffic log.

[0064] Step 103, if it does not exist, perform at least one information extraction process on the traffic log, and the type of feature information extracted by each information extraction process is different. After each information extraction process, determine whether the feature information extracted by this information extraction process can match the application.

[0065] If the identifier of the application corresponding to the traffic log is not found in the protocol library, that is, the traffic log cannot be matched to the application, that is, the traffic is unknown traffic, and then at least one information extraction process is performed on the traffic. At the same time, each information extraction process extracts different types of feature information. After each feature information extraction, the feature information can be the domain name of the traffic or the IP address of the traffic, etc., and a judgment is made based on the feature information extracted this time whether it can match the application.

[0066] Step 104: If yes, stop the information extraction process, and store the feature information obtained from the last information extraction process and the identification of the matched application program in the protocol library; if no, perform the next information extraction process.

[0067] If the extracted feature information matches the application, the feature information extraction process is stopped and rules are automatically generated, that is, the extracted feature information and the identification of the application matched by the feature information are stored in the protocol library. If the extracted feature information does not successfully match the application, the next feature information extraction is continued. In this way, the recognition rate of traffic can be improved by iteratively updating the protocol library.

[0068] In the above embodiment, first, the traffic log is obtained, and the traffic log is matched with the protocol library to query whether the protocol library stores the identification of the application corresponding to the traffic log; if not, at least one information extraction process is performed on the traffic log, and each information extraction process extracts different types of feature information, and after each information extraction process, it is determined whether the feature information extracted by this information extraction process can match the application; if the extracted feature information matches the application, the information extraction process is stopped, and the feature information and the identification of the application matched with the feature information are stored in the protocol library, and if the extracted feature information does not match the application, the next information extraction process is performed. In this way, the application is matched by obtaining the traffic log and extracting the feature information therein, and if it matches, the protocol library is updated according to the feature information and the matched application identification, and if the match is not successful, the next feature information extraction is continued, thereby realizing the automatic identification of unknown traffic.

[0069] In one embodiment, the characteristic information includes: at least one of a plain text string, domain name registration information, official website title information, application package name, data encoding characteristics, traffic IP address, and traffic port number.

[0070] Among them, by analyzing various types of logs, such as HTTP logs, HTTPS logs, DNS (Domain Name System) logs, flow logs, etc., the plaintext string features in the HTTP header field are extracted, including: Host (domain name), URI (Uniform Resource Identifier), Referer (website source), User-Agent (user agent), etc., and also includes extracting the domain name features of the SNI (Server Name Indication, SNI) field of HTTPS. The registration information of the domain name is the registration information of the domain name in the registration system, including the basic information of the domain name website. The title information of the official website is the title of the corresponding official website webpage. The application package name, for example (Application A, com.abcde.live, entertainment), the second field com.abcde.live is the application package name. Data encoding features can be features with various encodings in fields such as URI and User-Agent, such as the encoding features in URL (Uniform Resource Locator): %E8%85%BE%E8%AE%AF%E8%A7%86%E9%A2%91. The traffic IP address is the IP information in the traffic log. The traffic port number is the port number information in the traffic log.

[0071] In the above embodiment, various characteristic information in the traffic log is obtained, and application programs are matched according to the various characteristic information, thereby improving the recognition rate of the traffic.

[0072] In one embodiment, the characteristic information includes a plain text string, such as Figure 2 As shown, the steps of judging whether the plaintext string can match the application program according to the extracted plaintext string include:

[0073] Step 201: The server matches the plain text string with a preset rule base.

[0074] The preset rule base includes multiple sets of correspondences between plain text strings and applications. The plain text string is described by taking the Host domain name in the above text as an example. First, the domain name rules of the HTTP protocol type are extracted from the total protocol library accumulated in advance, and a preset rule base for matching domain names is generated, such as Figure 3 As shown, the steps of matching the plain text string with the preset rule base include:

[0075] Step 301: The server counts the number of hits of the plaintext character string in the traffic log.

[0076] The server extracts the domain name from the traffic log and counts the number of hits of the domain name. The number of hits reflects the number of times users visit the website domain name. A high number of hits indicates a high degree of website access.

[0077] Step 302: The server matches the plaintext character strings whose hit times are greater than a preset threshold with a preset rule base.

[0078] Among them, the preset threshold can be set, and the domain names with the number of hits greater than the preset threshold are matched with the preset rule library, that is, the domain names with high access are matched. The domain names with low access do not need to be matched and added to the protocol library, which can reduce the amount of data in the protocol library, thereby improving the efficiency of the protocol library matching search.

[0079] Step 202: If the plaintext character string exists in the preset rule base, the application corresponding to the plaintext character string in the preset rule base is determined as the application matching the plaintext character string.

[0080] If the domain name exists in the preset rule base, the application corresponding to the domain name in the preset rule base is determined as the application matching the domain name. Then other plaintext strings such as URI, Referer, User-Agent and SNI can be matched in the same way.

[0081] In the above embodiment, by extracting plaintext character strings, plaintext character strings with high access degrees and matched applications are added to the protocol library, thereby improving the efficiency of the protocol library matching search.

[0082] In an optional embodiment, if the above plain text string fails to successfully match an application, the feature information is extracted, and the feature information includes the domain name registration information. If the domain name registration information can be obtained, the website name in the domain name registration information is determined as the application that matches the domain name registration information.

[0083] Optionally, for traffic that fails to match the plaintext string of the application, a crawler script may be used to automatically crawl the domain name registration information. If the crawling of the domain name registration information is successful, the website name in the domain name registration information is determined to be the matching application.

[0084] In the above embodiment, the matching application is determined by extracting the registration information of the domain name, and then the registration information of the domain name and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0085] In one embodiment, if the registration information of the domain name cannot be crawled, it can also be judged based on the official website information. The characteristic information includes the title information of the official website. If the title information of the official website can be obtained, the title information in the title information of the official website is determined as an application that matches the title information of the official website.

[0086] Optionally, for traffic that fails to match an application, a crawler script can be used to automatically access the official website of the corresponding first-level domain name, and then parse the official website webpage to obtain the title information of the official website. If the title information of the official website is successfully obtained, the title information of the official website is determined to be a matching application.

[0087] In the above embodiment, the matching application is determined by extracting the title information of the official website, and then the title information of the official website and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0088] Optionally, if the above steps do not match the application, the application package name may be used for matching. The feature information includes the application package name. The step of determining whether the feature information extracted by the feature information extraction process can match the application is as follows: Figure 4 As shown, including:

[0089] Step 401: The server matches the application package name with a preset application store library.

[0090] The preset application store library includes multiple sets of correspondence between application package names and application programs, which can be crawled from the official websites of various application stores. The application package names extracted from the traffic logs are matched with the preset application store library.

[0091] Step 402: If the application package name exists in the preset application store library, the application corresponding to the application package name in the preset application store library is determined as the application matching the application package name.

[0092] If the application package name extracted from the traffic log is successfully matched in the preset application store library, the application corresponding to the application package name is determined as the matching application.

[0093] In the above embodiment, the matching application program is determined by extracting the application package name, and then the application package name and the matched application program are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0094] In the embodiment of the present application, if the above steps do not match the application, matching can also be performed based on the data encoding feature, the feature information includes the data encoding feature, and the step of determining whether the data encoding feature can match the application is as follows: Figure 5 As shown, including:

[0095] Step 501: The server decodes the data encoding feature.

[0096] Optionally, the URI, User-Agent and other fields in the traffic log may carry various encoding features. The various encoding features in the fields are extracted through a script and then decoded.

[0097] Step 502: If the data encoding feature is decoded successfully, the application program after the data encoding feature is decoded is determined as the application program matching the data encoding feature.

[0098] If the data encoding feature is decoded successfully, that is, the corresponding application name can be obtained after decoding, for example, there is a url encoding feature: %E8%85%BE%E8%AE%AF%E8%A7%86%E9%A2%91, which is a video application after decoding. The application obtained after decoding the data encoding feature is determined as the application matching the data encoding feature.

[0099] In the above embodiment, the matching application is determined by extracting the data encoding feature, and then the data encoding feature and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0100] In one embodiment, if the above steps do not match the application, a match can also be performed based on the traffic IP address, and the characteristic information includes the traffic IP address to determine whether the traffic IP address can match the application, such as Figure 6 As shown, including:

[0101] Step 601: The server matches the traffic IP address with a preset DNS log.

[0102] The preset DNS log is a correspondence table between IP addresses and domain names. The preset DNS log is searched according to the traffic IP address extracted from the traffic log.

[0103] Step 602: If the traffic IP address exists in the preset DNS log, the application corresponding to the traffic IP address is determined according to the domain name corresponding to the traffic IP address in the preset DNS log, and is determined to be the application matching the traffic IP address.

[0104] If the traffic IP address exists in the preset DNS log, the domain name corresponding to the traffic IP address is obtained according to the preset DNS log, and then the domain name corresponding to the traffic IP address is searched in the domain name database to obtain the application corresponding to the traffic IP address, and the application is determined as the application that matches the traffic IP address.

[0105] In the above embodiment, the matching application is determined by extracting the traffic IP address, and then the traffic IP address and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0106] In an embodiment of the present application, if the above steps do not match the application, a match can also be performed based on the traffic port number, where the characteristic information includes the traffic port number, to determine whether the traffic port number can match the application, such as Figure 7 As shown, the steps include:

[0107] Step 701: The server determines the corresponding application program according to the traffic port number.

[0108] Get the traffic port number in the traffic log and determine the application to which it belongs based on the traffic port number. For example, an FTP server has two ports, a data port 20 and a control port 21. If the port number is 20 or 21, the application to which the traffic belongs is determined to be the FTP application.

[0109] Step 702: The server determines whether the data of the corresponding time in the traffic log is the corresponding application program determined by the traffic port number.

[0110] The data packet corresponding to the time of the traffic log is obtained to confirm whether the data packet belongs to the application determined by the port number.

[0111] Step 703: If yes, the corresponding application determined by the traffic port number is determined as the application matching the traffic port number.

[0112] If it is confirmed that the data packet belongs to the application determined according to the port number, it is determined that the application is the application that matches the traffic port number.

[0113] In the above embodiment, the matching application is determined by extracting the traffic port number, and then the traffic port number and the matched application are added to the protocol library, thereby improving the recognition rate of the protocol library.

[0114] In one embodiment, if the above steps do not match the application, a match can also be performed based on the traffic IP address, and the characteristic information includes the traffic IP address to determine whether the IP address can match the application, such as Figure 8 As shown, it also includes:

[0115] Step 801: The server matches the traffic IP address with a preset IP library.

[0116] The preset IP library is a correspondence table between multiple groups of IP addresses and applications. The preset IP library is a correspondence table between IP addresses and applications collected and extracted based on data from existing networks or laboratory data. The traffic IP addresses extracted from the traffic log are searched in the preset IP library.

[0117] Step 802: If the traffic IP address exists in the preset IP library, the application corresponding to the traffic IP address in the preset IP library is determined as the application matching the traffic IP address.

[0118] If the traffic IP address is found in the preset IP library, it is determined that the application corresponding to the traffic IP address in the preset IP library is the application matching the traffic IP address.

[0119] In the examples of this application, please refer to Fig. 9 , which shows a matching flow chart of the unknown traffic identification method provided by the embodiment of the present application. Perform at least one feature information extraction process on the traffic log. After each feature information extraction process, determine whether the feature information extracted by this feature information extraction process can match the application. If the application is matched, stop the feature information extraction process, automatically generate rules and store them in the protocol library. If not, perform the next feature information extraction process.

[0120] In one embodiment, due to the large amount of traffic in the existing network, the unknown traffic identification method can be first applied to the laboratory environment for analysis, and the protocol library can be iteratively generated until the recognition rate meets the requirements. The generated protocol library is then deployed to the server that needs to be analyzed in the existing network. Please refer to Fig.10 , the specific process is as follows:

[0121] Step 1001, mirror the traffic at the exit of the laboratory environment to a server deployed with a DPI device to monitor the Internet traffic accessed by the laboratory environment.

[0122] Step 1002, enable the packet capture function, refined log function and flow log function of the DPI device.

[0123] Step 1003, obtain the laboratory environment traffic log, perform feature information extraction processing, and iteratively update the protocol library according to the application matched with the feature information.

[0124] Step 1004: When the traffic identification result reaches the expected effect, the updated protocol library is deployed to the existing network DPI device.

[0125] Step 1005, obtain the current network traffic log, perform feature information extraction processing, and update the protocol library according to the application matched with the feature information.

[0126] Step 1006, iterative operation until the existing network traffic identification result reaches the expected effect.

[0127] In the above embodiment, the laboratory environment has a single flow compared to the live network environment, which is convenient for analysis. Verification through the laboratory environment also ensures the reliability of the unknown flow identification method. The verified method is applied to the live network environment, reducing the risk of operating live network equipment to users. At the same time, the updated protocol library can be directly applied to the live network environment.

[0128] In an optional embodiment, when the unknown traffic identification method is applied in a laboratory environment, if the above-mentioned multiple feature extraction methods fail to match the application, the application corresponding to the traffic can be determined by determining the user using the traffic. The specific steps are: Fig.11 As shown, including:

[0129] Step 1101, obtain unknown traffic, and count the server IP addresses of the same application ID in the unknown traffic.

[0130] Step 1102, filter the server IP address that appears most frequently among the above server IP addresses for analysis, obtain the data packet corresponding to the server IP at the corresponding time, extract the characteristic information to determine whether the application to which it belongs can be determined.

[0131] Step 1103: If yes, then generate a rule update protocol library based on the extracted feature information and the corresponding application identifier. If it cannot be determined, proceed to the next step.

[0132] Step 1104, determine the user IP corresponding to the server IP address, determine the application to which the unknown traffic belongs based on the user, and generate a rule to update the protocol library.

[0133] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0134] Based on the same inventive concept, the embodiment of the present application also provides an unknown flow identification device for implementing the unknown flow identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more unknown flow identification device embodiments provided below can refer to the limitations of the unknown flow identification method above, and will not be repeated here.

[0135] In one embodiment, Fig.12 As shown, an unknown traffic identification device 1200 is provided, comprising: an acquisition module 1201, a query module 1202, an extraction module 1203 and a storage module 1204, wherein:

[0136] The acquisition module 1201 is used to acquire traffic logs;

[0137] The query module 1202 matches the traffic log with the protocol library, and queries the protocol library to see whether there is an identification of the application corresponding to the traffic log;

[0138] The extraction module 1203 is used to perform at least one information extraction process on the traffic log if it does not exist, and each information extraction process extracts different types of characteristic information. After each information extraction process, determine whether the characteristic information extracted by this information extraction process can match the application;

[0139] The storage module 1204 is used to stop the information extraction process if yes, and store the feature information obtained from the last information extraction process and the identification of the matched application program in the protocol library; if no, perform the next information extraction process.

[0140] In an embodiment of the present application, the characteristic information includes: at least one of a plain text string, domain name registration information, official website title information, application package name, data encoding characteristics, traffic IP address, and traffic port number.

[0141] In an embodiment of the present application, the feature information includes a plaintext string, and the extraction module 1203 is specifically used to match the plaintext string with a preset rule base, which includes a correspondence between multiple groups of plaintext strings and applications; if the plaintext string exists in the preset rule base, the application corresponding to the plaintext string in the preset rule base is determined as the application that matches the plaintext string.

[0142] In the embodiment of the present application, the extraction module 1203 is specifically used to count the number of hits of the plaintext character string in the traffic log; and match the plaintext character string whose hit number is greater than a preset threshold with a preset rule base.

[0143] In an embodiment of the present application, the characteristic information includes the registration information of the domain name. The extraction module 1203 is specifically used to determine the website name in the registration information of the domain name as an application that matches the registration information of the domain name if the registration information of the domain name can be obtained.

[0144] In an embodiment of the present application, the characteristic information includes the title information of the official website. The extraction module 1203 is specifically used to determine the title information in the title information of the official website as an application that matches the title information of the official website if the title information of the official website can be obtained.

[0145] In an embodiment of the present application, the characteristic information includes an application package name, and the extraction module 1203 is specifically used to match the application package name with a preset application store library, which includes multiple sets of correspondences between application package names and application programs; if the application package name exists in the preset application store library, the application corresponding to the application package name in the preset application store library is determined as the application that matches the application package name.

[0146] In an embodiment of the present application, the feature information includes a data coding feature, and the extraction module 1203 is specifically used to decode the data coding feature; if the data coding feature is decoded successfully, the application after the data coding feature is decoded is determined as an application matching the data coding feature.

[0147] In an embodiment of the present application, the characteristic information includes the traffic IP address, and the extraction module 1203 is specifically used to match the traffic IP address with a preset DNS log, which is a correspondence table between IP addresses and domain names; if the traffic IP address exists in the preset DNS log, the application corresponding to the traffic IP address is determined based on the domain name corresponding to the traffic IP address in the preset DNS log, and is determined to be the application that matches the traffic IP address.

[0148] In an embodiment of the present application, the characteristic information includes a traffic port number, and the extraction module 1203 is specifically used to determine the corresponding application based on the traffic port number; determine whether the data at the corresponding time of the traffic log is the corresponding application determined by the traffic port number; if so, determine the corresponding application determined by the traffic port number as the application that matches the traffic port number.

[0149] In an embodiment of the present application, the characteristic information includes a traffic IP address, and the extraction module 1203 is specifically used to match the traffic IP address with a preset IP library, which is a correspondence table of multiple groups of IP addresses and applications; if the traffic IP address exists in the preset IP library, the application corresponding to the traffic IP address in the preset IP library is determined as the application that matches the traffic IP address.

[0150] Each module in the above unknown traffic identification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0151] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.13 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store unknown traffic data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an unknown traffic identification method is implemented.

[0152] Those skilled in the art will understand that Fig.13 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0153] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0154] Obtain traffic logs; match the traffic logs with the protocol library, and query whether there is an identifier of the application corresponding to the traffic log in the protocol library; if not, perform at least one information extraction process on the traffic log, and the type of feature information extracted by each information extraction process is different. After each information extraction process, determine whether the feature information extracted by this information extraction process can match the application; if so, stop the information extraction process, and store the feature information obtained by the last information extraction process and the identifier of the matched application in the protocol library. If not, perform the next information extraction process.

[0155] In one embodiment, when the processor executes the computer program, the following steps are also implemented: matching the plaintext string with a preset rule base, the preset rule base including a plurality of sets of correspondences between plaintext strings and applications; if the plaintext string exists in the preset rule base, determining the application corresponding to the plaintext string in the preset rule base as the application matching the plaintext string.

[0156] In one embodiment, when the processor executes the computer program, the following steps are also implemented: counting the number of hits of the plaintext character string in the traffic log; matching the plaintext character string whose hit number is greater than a preset threshold with a preset rule base.

[0157] In one embodiment, when the processor executes the computer program, the following steps are also implemented: if the domain name registration information can be obtained, the website name in the domain name registration information is determined as an application that matches the domain name registration information.

[0158] In one embodiment, when the processor executes the computer program, the following steps are also implemented: if the title information of the official website can be obtained, the title information in the title information of the official website is determined as an application that matches the title information of the official website.

[0159] In one embodiment, when the processor executes the computer program, the following steps are also implemented: matching the application package name with a preset application store library, the preset application store library including multiple sets of correspondences between application package names and application programs; if the application package name exists in the preset application store library, then determining the application corresponding to the application package name in the preset application store library as the application that matches the application package name.

[0160] In one embodiment, when the processor executes the computer program, the following steps are also implemented: decoding the data encoding feature; if the data encoding feature is decoded successfully, determining the application after the data encoding feature is decoded as the application matching the data encoding feature.

[0161] In one embodiment, when the processor executes the computer program, the following steps are also implemented: matching the traffic IP address with a preset DNS log, where the preset DNS log is a correspondence table between IP addresses and domain names; if the traffic IP address exists in the preset DNS log, determining the application corresponding to the traffic IP address based on the domain name corresponding to the traffic IP address in the preset DNS log, and determining it as the application that matches the traffic IP address.

[0162] In one embodiment, when the processor executes the computer program, the following steps are also implemented: determining the corresponding application according to the traffic port number; judging whether the data at the corresponding time of the traffic log is the corresponding application determined by the traffic port number; if so, determining the corresponding application determined by the traffic port number as the application that matches the traffic port number.

[0163] In one embodiment, when the processor executes the computer program, the following steps are also implemented: matching the traffic IP address with a preset IP library, the preset IP library being a correspondence table of multiple groups of IP addresses and applications; if the traffic IP address exists in the preset IP library, then determining the application corresponding to the traffic IP address in the preset IP library as the application matching the traffic IP address.

[0164] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0165] Obtain traffic logs; match the traffic logs with the protocol library, and query whether there is an identifier of the application corresponding to the traffic log in the protocol library; if not, perform at least one information extraction process on the traffic log, and the type of feature information extracted by each information extraction process is different. After each information extraction process, determine whether the feature information extracted by this information extraction process can match the application; if so, stop the information extraction process, and store the feature information obtained by the last information extraction process and the identifier of the matched application in the protocol library. If not, perform the next information extraction process.

[0166] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the plaintext string with a preset rule base, the preset rule base including a plurality of sets of correspondences between plaintext strings and applications; if the plaintext string exists in the preset rule base, determining the application corresponding to the plaintext string in the preset rule base as the application matching the plaintext string.

[0167] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: counting the number of hits of the plaintext character string in the traffic log; matching the plaintext character string whose hit number is greater than a preset threshold with a preset rule base.

[0168] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if the domain name registration information can be obtained, the website name in the domain name registration information is determined as an application that matches the domain name registration information.

[0169] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if the title information of the official website can be obtained, the title information in the title information of the official website is determined as an application that matches the title information of the official website.

[0170] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the application package name with a preset application store library, the preset application store library including multiple sets of correspondences between application package names and application programs; if the application package name exists in the preset application store library, then determining the application program corresponding to the application package name in the preset application store library as the application program that matches the application package name.

[0171] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: decoding the data encoding feature; if the data encoding feature is decoded successfully, determining the application after the data encoding feature is decoded as the application matching the data encoding feature.

[0172] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the traffic IP address with a preset DNS log, which is a correspondence table between IP addresses and domain names; if the traffic IP address exists in the preset DNS log, determining the application corresponding to the traffic IP address based on the domain name corresponding to the traffic IP address in the preset DNS log, and determining it as the application that matches the traffic IP address.

[0173] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the corresponding application based on the traffic port number; determining whether the data at the corresponding time in the traffic log is the corresponding application determined by the traffic port number; if so, determining the corresponding application determined by the traffic port number as the application that matches the traffic port number.

[0174] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the traffic IP address with a preset IP library, the preset IP library being a correspondence table of multiple groups of IP addresses and applications; if the traffic IP address exists in the preset IP library, then determining the application corresponding to the traffic IP address in the preset IP library as the application matching the traffic IP address.

[0175] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0176] Obtain traffic logs; match the traffic logs with the protocol library, and query whether there is an identifier of the application corresponding to the traffic log in the protocol library; if not, perform at least one information extraction process on the traffic log, and the type of feature information extracted by each information extraction process is different. After each information extraction process, determine whether the feature information extracted by this information extraction process can match the application; if so, stop the information extraction process, and store the feature information obtained by the last information extraction process and the identifier of the matched application in the protocol library. If not, perform the next information extraction process.

[0177] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the plaintext string with a preset rule base, the preset rule base including a plurality of sets of correspondences between plaintext strings and applications; if the plaintext string exists in the preset rule base, determining the application corresponding to the plaintext string in the preset rule base as the application matching the plaintext string.

[0178] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: counting the number of hits of the plaintext character string in the traffic log; matching the plaintext character string whose hit number is greater than a preset threshold with a preset rule base.

[0179] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if the domain name registration information can be obtained, the website name in the domain name registration information is determined as an application that matches the domain name registration information.

[0180] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if the title information of the official website can be obtained, the title information in the title information of the official website is determined as an application that matches the title information of the official website.

[0181] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the application package name with a preset application store library, the preset application store library including multiple sets of correspondences between application package names and application programs; if the application package name exists in the preset application store library, then determining the application program corresponding to the application package name in the preset application store library as the application program that matches the application package name.

[0182] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: decoding the data encoding feature; if the data encoding feature is decoded successfully, determining the application after the data encoding feature is decoded as the application matching the data encoding feature.

[0183] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the traffic IP address with a preset DNS log, which is a correspondence table between IP addresses and domain names; if the traffic IP address exists in the preset DNS log, determining the application corresponding to the traffic IP address based on the domain name corresponding to the traffic IP address in the preset DNS log, and determining it as the application that matches the traffic IP address.

[0184] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the corresponding application based on the traffic port number; determining whether the data at the corresponding time in the traffic log is the corresponding application determined by the traffic port number; if so, determining the corresponding application determined by the traffic port number as the application that matches the traffic port number.

[0185] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the traffic IP address with a preset IP library, the preset IP library being a correspondence table of multiple groups of IP addresses and applications; if the traffic IP address exists in the preset IP library, then determining the application corresponding to the traffic IP address in the preset IP library as the application matching the traffic IP address.

[0186] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0187] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0188] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0189] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A flow identification method, characterized in that: The method comprises: Get traffic logs; Matching the traffic log with the protocol library, querying whether there is an identifier of the application corresponding to the traffic log in the protocol library; If not, perform at least one information extraction process on the traffic log, and each information extraction process extracts a different type of feature information. After each information extraction process, determine whether the feature information extracted by this information extraction process can match the application; If yes, stop the information extraction process, and store the feature information obtained from the last information extraction process and the identification of the matched application program in the protocol library; if no, perform the next information extraction process; The feature information includes a plain text string, and determining whether the feature information extracted by the current information extraction process can match the application program includes: Matching the plaintext string with a preset rule base, the preset rule base including a correspondence between multiple groups of plaintext strings and application programs; If the plaintext string exists in the preset rule base, determining the application corresponding to the plaintext string in the preset rule base as the application matching the plaintext string; The matching of the plaintext character string with a preset rule base includes: Counting the number of hits of the plaintext string in the traffic log; The plaintext character string whose hit times are greater than a preset threshold is matched with the preset rule base.

2. The method according to claim 1, characterized in that The characteristic information includes: at least one of the plaintext character string, domain name registration information, official website title information, application package name, data encoding characteristics, traffic IP address and traffic port number.

3. The method according to claim 2, characterized in that The characteristic information includes the registration information of the domain name and the title information of the official website. The determining whether the characteristic information extracted by the current information extraction process can match the application program includes: If the record information of the domain name can be obtained, the website name in the record information of the domain name is determined as the application matching the record information of the domain name; If the title information of the official website can be obtained, the title information in the title information of the official website is determined as an application that matches the title information of the official website.

4. The method according to claim 2, characterized in that: The characteristic information includes the application package name, and determining whether the characteristic information extracted by the current information extraction process can match the application program includes: Matching the application package name with a preset application store library, the preset application store library including a plurality of sets of correspondences between application package names and application programs; If the application package name exists in the preset application store library, determining the application corresponding to the application package name in the preset application store library as the application matching the application package name; The feature information includes the data encoding feature, and the determining whether the feature information extracted by the current information extraction process can match the application program includes: Decoding the data encoding feature; If the data encoding feature is decoded successfully, the application after the data encoding feature is decoded is determined as the application matching the data encoding feature.

5. The method according to claim 2, characterized in that: The characteristic information includes the traffic IP address, and determining whether the characteristic information extracted by the current information extraction process can match the application program includes: Matching the traffic IP address with a preset DNS log, wherein the preset DNS log is a correspondence table between IP addresses and domain names; If the traffic IP address exists in the preset DNS log, the application corresponding to the traffic IP address is determined according to the domain name corresponding to the traffic IP address in the preset DNS log, and is determined to be the application matching the traffic IP address; The characteristic information includes the traffic port number, and determining whether the characteristic information extracted by the current information extraction process can match the application program includes: Determine the corresponding application according to the traffic port number; Determine whether the data of the traffic log corresponding to the time is the corresponding application determined by the traffic port number; If yes, then determining the corresponding application determined by the traffic port number as the application matching the traffic port number; The determining whether the feature information extracted by the current information extraction process can match the application program also includes: Matching the traffic IP address with a preset IP library, wherein the preset IP library is a correspondence table between multiple groups of IP addresses and application programs; If the traffic IP address exists in the preset IP library, the application corresponding to the traffic IP address in the preset IP library is determined as the application matching the traffic IP address.

6. An unknown traffic identification device, characterized in that: The device comprises: Acquisition module, used to obtain traffic logs; A query module, matching the traffic log with the protocol library, and querying whether there is an identifier of an application corresponding to the traffic log in the protocol library; an extraction module, configured to perform at least one information extraction process on the traffic log if the information does not exist, and each information extraction process extracts a different type of characteristic information, and after each information extraction process, determine whether the characteristic information extracted by the current information extraction process can match the application; A storage module, for stopping the information extraction process if yes, and storing the feature information obtained by the last information extraction process and the identification of the matched application program in the protocol library; if no, performing the next information extraction process; The characteristic information includes a plaintext string, and the extraction module is specifically used to match the plaintext string with a preset rule base, wherein the preset rule base includes a correspondence between multiple groups of plaintext strings and applications; if the plaintext string exists in the preset rule base, the application corresponding to the plaintext string in the preset rule base is determined as the application matching the plaintext string; the number of hits of the plaintext string in the traffic log is counted; and the plaintext string whose hit number is greater than a preset threshold is matched with the preset rule base.

7. The device according to claim 6, characterized in that The characteristic information includes the registration information of the domain name and the title information of the official website. The extraction module is specifically used to, if the registration information of the domain name can be obtained, determine the website name in the registration information of the domain name as the application that matches the registration information of the domain name; if the title information of the official website can be obtained, determine the title information in the title information of the official website as the application that matches the title information of the official website.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images