SD-WAN traffic identification method, system, and device based on DPI technology

Abstract

The present invention relates to the field of data processing technology, specifically to a SD-WAN traffic identification method, system, and device based on DPI technology, including a data access unit, a data screening unit, a data processing unit, a log generation unit, a data transmission unit, a data receiving unit, a deep packet inspection unit, a protocol matching unit, a data deletion unit, an SD-WAN control unit, and a cloud server unit. The present invention applies deep packet inspection technology to a software-defined wide area network. In the process of traffic identification, the data part of the data packet of the traffic data is searched for protocols that do not match the specifications, viruses, spam, intrusions, etc., to ensure the security of the internal data of the traffic while realizing the function of accurate identification of the traffic, improve the stability of the system when in use, and at the same time, denoise the graphic data in the data stream to ensure the accuracy of data identification and processing.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and specifically to a SD-WAN traffic identification method, system, and device based on DPI technology. Background Art

[0002] With the development of the times and the continuous changes in the network environment, network security has gradually been taken seriously. The use of SD-WAN can identify traffic data and ensure network security. SD-WAN, or software-defined wide area network, is a service formed by applying SDN technology to wide area network scenarios. This service is used to connect enterprise networks, data centers, Internet applications and cloud services over a wide geographical range.

[0003] However, security supervision of the industrial Internet through SD-WAN alone cannot fully and effectively identify and supervise the data in the traffic, and there are certain security drawbacks.

[0004] To this end, an SD-WAN traffic identification method, system and device based on DPI technology are proposed. Summary of the invention

[0005] The purpose of the present invention is to provide a SD-WAN traffic identification method, system, and device based on DPI technology to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] The SD-WAN traffic identification system based on DPI technology includes a data access unit, a data screening unit, a data processing unit, a log generation unit, a data transmission unit, a data receiving unit, a deep packet inspection unit, a protocol matching unit, a data deletion unit, an SD-WAN control unit and a cloud server unit. The data access unit receives external data, and performs image denoising on the received image information through a denoising algorithm set in the data access unit, and screens the traffic through the data screening unit. The screened traffic is identified by the data processing unit, and the log generation unit generates data log information. Then the data is compressed by the data processing unit in turn, and finally the processed data is directly transmitted to the SD-WAN control unit through the data transmission unit.

[0008] Preferably, the denoising algorithm is specifically:

[0009]

[0010] Where |Vu(x)| is the gradient mean of pixel x, 0(x,y) is the gradient direction angle of pixel x, y, u(x) is the neighborhood grayscale average of pixel x, σv, σ0, η1, η2 are threshold control parameters.

[0011] Preferably, the data receiving unit is used to receive the data generated by the data processing unit, and then match it through the protocol matching unit, transmit the successfully matched data packet to the deep packet inspection unit for inspection, and send the inspection result and the data packet to the data deletion unit, delete the harmful data in the data deletion unit, and transmit the data after the information is deleted to the SD-WAN control unit.

[0012] Preferably, the output end of the data access unit is connected to the input end of the data screening unit, the output end of the data screening unit is connected to the input end of the data processing unit, the output end of the data processing unit is connected to the input ends of the log generation unit and the data transmission unit, the output end of the data transmission unit is connected to the input end of the SD-WAN control unit, the output end of the SD-WAN control unit is connected to the input end of the data receiving unit, the output end of the data receiving unit is connected to the output end of the deep packet inspection unit, the output end of the deep packet inspection unit is connected to the input end of the protocol matching unit, the output end of the protocol matching unit is connected to the input end of the data deletion unit, the output end of the data deletion unit is connected to the input end of the SD-WAN control unit, and the output end of the SD-WAN control unit is connected to the input end of the cloud service unit.

[0013] Preferably, the data screening unit comprises a noise filtering module and a protocol identification module, the noise filtering module is used to filter noise traffic, and the protocol identification module is used to screen out traffic that complies with the protocol.

[0014] Preferably, the data processing unit includes a data compression module and a data classification module, and the data compression module and the data classification module will compress the data after classification.

[0015] The SD-WAN traffic identification method based on DPI technology is applicable to the above-mentioned SD-WAN traffic identification system based on DPI technology, and specifically includes the following steps:

[0016] S1. The data access unit receives external data, filters the traffic through the data screening unit, and identifies the filtered data traffic through the data processing unit;

[0017] S2. The processed data is directly transmitted to the SD-WAN control unit through the data transmission unit, and the SD-WAN control unit transmits the data to the data receiving unit;

[0018] S3, the data receiving unit is used to parse the data generated by the data processing unit, match it through the protocol matching unit, delete the data that fails to match, and transmit the data packets that successfully match to the deep packet inspection unit;

[0019] S4. The deep packet inspection unit adopts a deep packet inspection algorithm to determine whether the content of the data transmitted by the protocol matching unit contains information in the threat feature library of the deep packet inspection unit, and sends the detection result and the data packet to the data deletion unit, in which the data packet containing the threat is deleted and the data not containing the threat is transmitted to the SD-WAN control unit.

[0020] Preferably, the SD-WAN traffic identification device based on DPI technology includes:

[0021] At least one processor is communicatively connected to at least one processor, and the memory stores instructions executable by at least one processor, and the instructions are executed by at least one processor so that the at least one processor can execute the method for using the SD-WAN traffic identification system based on the DPI technology as described in any one of claims 1-5.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] By applying deep packet inspection technology to software-defined wide area networks, during the process of traffic identification, the data part of the data packet of the traffic data is searched for protocols that do not match the specifications, viruses, spam, intrusions, etc., while achieving the function of accurate traffic identification, ensuring the security of the internal data of the traffic, improving the stability of the system during use, and at the same time denoising the graphic data in the data stream to ensure the accuracy of data identification and processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a structural block diagram of the SD-WAN traffic identification system based on DPI technology of the present invention;

[0025] Figure 2 It is a structural block diagram of a data screening unit of the present invention;

[0026] Figure 3 It is a structural block diagram of the data processing unit of the present invention.

[0027] In the figure: 1. Data access unit; 2. Data screening unit; 3. Data processing unit; 4. Log generation unit; 5. Data transmission unit; 6. Data receiving unit; 7. Deep packet inspection unit; 8. Protocol matching unit; 9. Data deletion unit; 10. SD-WAN control unit; 11. Cloud server unit; 12. Noise filtering module; 13. Protocol identification module; 14. Data compression module; 15. Data classification module. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as limiting the present invention.

[0030] In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined. In addition, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0031] See also Figures 1 to 3 The present invention provides a SD-WAN traffic identification method, system, and device based on DPI technology. The technical solution is as follows:

[0032] The SD-WAN traffic identification system based on DPI technology includes a data access unit 1, a data screening unit 2, a data processing unit 3, a log generation unit 4, a data transmission unit 5, a data receiving unit 6, a deep packet inspection unit 7, a protocol matching unit 8, a data deletion unit 9, an SD-WAN control unit 10 and a cloud server unit 11. The output end of the data access unit 1 is connected to the input end of the data screening unit 2, the output end of the data screening unit 2 is connected to the input end of the data processing unit 3, and the output ends of the data processing unit 3 are connected to the input ends of the log generation unit 4 and the data transmission unit 5. The output end of the data transmission unit 5 is connected to the input end of the SD-WAN control unit 10, the output end of the SD-WAN control unit 10 is connected to the input end of the data receiving unit 6, the output end of the data receiving unit 6 is connected to the output end of the deep packet inspection unit 7, the output end of the deep packet inspection unit 7 is connected to the input end of the protocol matching unit 8, the output end of the protocol matching unit 8 is connected to the input end of the data deletion unit 9, the output end of the data deletion unit 9 is connected to the input end of the SD-WAN control unit 10, and the output end of the SD-WAN control unit 10 is connected to the input end of the cloud service unit.

[0033] As an embodiment of the present invention, refer to Figure 1 The data access unit 1 receives external data, and performs image denoising on the received image information through the denoising algorithm set in the data access unit 1, filters the traffic through the data screening unit 2, and the screened traffic is identified by the data processing unit 3. The log generation unit 4 generates data log information, and then the data is compressed by the data processing unit 3 in turn, and finally the processed data is directly transmitted to the SD-WAN control unit 10 through the data transmission unit 5. The data receiving unit 6 is used to receive the data generated by the data processing unit 3, and then match it through the protocol matching unit 8, and transmit the successfully matched data packet to the deep packet inspection unit 7 for detection, and send the detection result and the data packet to the data deletion unit 9, delete the harmful data in the data deletion unit 9, and transmit the data after the information is deleted to the SD-WAN control unit 10. The SD-WAN control unit 10 can transmit traffic data and work instructions.

[0034] As an embodiment of the present invention, refer to Figure 1 , the denoising algorithm is as follows:

[0035]

[0036] Where |Vu(x)| is the gradient mean of pixel x, 0(x,y) is the gradient direction angle of pixel x, y, u(x) is the neighborhood grayscale average of pixel x, σv, σ0, η1, η2 are threshold control parameters.

[0037] As an embodiment of the present invention, refer to Figure 2 and Figure 3 The data screening unit 2 includes a noise filtering module 12 and a protocol identification module 13. The noise filtering module 12 is used to filter noise traffic, and the protocol identification module 13 is used to filter out traffic that complies with the protocol. The data processing unit 3 includes a data compression module 14 and a data classification module 15. The data compression module 14 and the data classification module 15 will compress the data after classification.

[0038] The SD-WAN traffic identification method based on DPI technology is applicable to the above-mentioned SD-WAN traffic identification system based on DPI technology, and specifically includes the following steps:

[0039] S1, the data access unit 1 receives external data, and filters the traffic through the data screening unit 2, and the filtered data traffic is identified by the data processing unit 3;

[0040] S2. The processed data is directly transmitted to the SD-WAN control unit 10 through the data transmission unit 5, and the SD-WAN control unit 10 transmits the data to the data receiving unit 6;

[0041] S3, the data receiving unit 6 is used to parse the data generated by the data processing unit 3, match it through the protocol matching unit 8, delete the data that fails to match, and transmit the data packets that successfully match to the deep packet inspection unit 7;

[0042] S4. The deep packet inspection unit 7 uses a deep packet inspection algorithm to determine whether the content of the data transmitted by the protocol matching unit 8 contains the information in the threat feature library of the deep packet inspection unit 7, and sends the detection result and the data packet to the data deletion unit 9, in which the data packet containing the threat is deleted and the data not containing the threat is transmitted to the SD-WAN control unit 10.

[0043] SD-WAN traffic identification devices based on DPI technology include:

[0044] At least one processor is communicatively connected to a memory of at least one processor, the memory stores instructions executable by at least one processor, and the instructions are executed by at least one processor so that at least one processor can execute a method for using a SD-WAN traffic identification system based on DPI technology as claimed in any one of claims 1 to 5.

[0045] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. SD-WAN traffic identification system based on DPI technology, characterized by: It includes a data access unit (1), a data screening unit (2), a data processing unit (3), a log generation unit (4), a data transmission unit (5), a data receiving unit (6), a deep packet inspection unit (7), a protocol matching unit (8), a data deletion unit (9), an SD-WAN control unit (10) and a cloud server unit (11); The data access unit (1) receives external data, performs image denoising on the received image information through a denoising algorithm set in the data access unit (1), screens the traffic through the data screening unit (2), identifies the screened traffic through the data processing unit (3), generates data log information through the log generation unit (4), and then compresses the data through the data processing unit (3) in turn, and finally transmits the processed data directly to the SD-WAN control unit (10) through the data transmission unit (5); The data receiving unit (6) is used to receive the data generated by the data processing unit (3), then match the data through the protocol matching unit (8), transmit the successfully matched data packet to the deep packet inspection unit (7) for inspection, and send the inspection result and the data packet to the data deletion unit (9), delete the harmful data in the data deletion unit (9), and transmit the data after the information is deleted to the SD-WAN control unit (10); The output end of the data access unit (1) is connected to the input end of the data screening unit (2), the output end of the data screening unit (2) is connected to the input end of the data processing unit (3), the output end of the data processing unit (3) is connected to the input end of the log generation unit (4) and the data transmission unit (5), the output end of the data transmission unit (5) is connected to the input end of the SD-WAN control unit (10), the output end of the SD-WAN control unit (10) is connected to the input end of the data receiving unit (6), the output end of the data receiving unit (6) is connected to the output end of the deep packet inspection unit (7), the output end of the deep packet inspection unit (7) is connected to the input end of the protocol matching unit (8), the output end of the protocol matching unit (8) is connected to the input end of the data deletion unit (9), the output end of the data deletion unit (9) is connected to the input end of the SD-WAN control unit (10), and the output end of the SD-WAN control unit (10) is connected to the input end of the cloud server unit (11); The data screening unit (2) comprises a noise filtering module (12) and a protocol identification module (13), wherein the noise filtering module (12) is used to filter noise traffic, and the protocol identification module (13) is used to screen out traffic that complies with the protocol; The data processing unit (3) comprises a data compression module (14) and a data classification module (15), and the data compression module (14) and the data classification module (15) classify the data and then compress it; The SD-WAN traffic identification method based on DPI technology specifically includes the following steps: S1, the data access unit (1) receives external data, and filters the data flow through the data screening unit (2), and the filtered data flow is identified through the data processing unit (3); S2, directly transmitting the processed data to the SD-WAN control unit (10) through the data transmission unit (5), and the SD-WAN control unit (10) transmits the data to the data receiving unit (6); S3, the data receiving unit (6) is used to parse the data generated by the data processing unit (3), match it through the protocol matching unit (8), delete the data that fails to match, and transmit the data packets that successfully match to the deep packet inspection unit (7); S4. The deep packet inspection unit (7) uses a deep packet inspection algorithm to determine whether the content of the data transmitted by the protocol matching unit (8) contains information in the threat feature library, and sends the detection result and the data packet to the data deletion unit (9). The data deletion unit (9) deletes the data packet containing the threat and transmits the data not containing the threat to the SD-WAN control unit (10).

2. SD-WAN traffic identification devices based on DPI technology, including: At least one processor is communicatively connected to at least one processor, and the memory stores instructions that can be executed by at least one processor. The instructions are executed by at least one processor so that the at least one processor can execute the method for using the SD-WAN traffic identification system based on DPI technology as described in claim 1.

Images