An application method and device for multi-package identification, equipment and storage medium

Abstract

The present disclosure provides an application method, device and equipment for multi-packet identification and a storage medium. The method comprises: determining an application layer protocol message feature matched with a feature of a first data packet from a preset feature library as a to-be-matched feature; if it is determined that a feature of a second data packet is successfully matched with the to-be-matched feature, obtaining a first operation result through a preset operation; if it is determined that a feature of a third data packet is successfully matched with the to-be-matched feature, obtaining a second operation result through the preset operation; and if it is determined that the first operation result and the second operation result satisfy a preset condition, determining an application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by a data packet transmitted between a target client and a target server. The present disclosure identifies the application layer protocol based on the feature relationship between at least three continuous data packets in the same transmission direction, realizes effective analysis of the protocol, and thus improves the identification accuracy.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, and particularly relates to an application method and device for multi-packet identification, equipment and a storage medium. BACKGROUND

[0002] With the rapid development of the Internet, the application of the Internet has undergone tremendous changes, from the initial web browsing, email downloading, to the current game, video, mobile Internet, and colorful applications have become the mainstream of the Internet. In the face of the ever-increasing applications, how to accurately control the application traffic is the biggest problem faced by network administrators, and the prerequisite for control is to accurately identify the protocols used by various applications in the network.

[0003] In the related art, the protocol used by the application program is usually determined based on single-packet identification, for example, the single-packet identification is realized by using the DPI (deep packet inspection) technology. Based on the current related technology, for protocols without obvious characteristics, effective analysis may not be achieved, and there is a problem of low identification accuracy. SUMMARY

[0004] To solve the above technical problems, the embodiments of the present disclosure provide an application method for multi-packet identification, which identifies the application layer protocol based on the feature relationship between at least three consecutive data packets in the same transmission direction, realizes effective analysis of the protocol, and thus improves the identification accuracy.

[0005] In a first aspect, the present disclosure provides an application method for multi-packet identification, and the method comprises:

[0006] determining an application layer protocol message feature matching the data format feature of the first data packet from a preset feature library as a matching feature, wherein the first data packet is a data packet carrying application layer data transmitted between a target client and a target server, and the preset feature library stores a corresponding relationship between an application layer protocol and an application layer protocol message feature;

[0007] If it is determined that the data format feature of the second data packet matches the matching feature, performing a preset operation on the byte value of the byte position corresponding to the matching feature in the first data packet and the byte value of the byte position in the second data packet, to obtain a first operation result, wherein the second data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the second data packet is the next data packet adjacent to the first data packet in the same transmission direction;

[0008] if it is determined that the data format feature of the third data packet matches the to-be-matched feature, performing the preset operation on the byte value of the byte position in the third data packet and the byte value of the byte position in the fourth data packet to obtain a third operation result, wherein the third data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the third data packet is an adjacent next data packet in the same transmission direction as the second data packet;

[0009] if it is determined that the preset condition is met between the first operation result and the second operation result, determining the application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by the data packet transmitted between the target client and the target server.

[0010] In an optional implementation, the method further includes:

[0011] if it is determined that the preset condition is not met between the first operation result and the second operation result, determining whether the current data packet matching number is greater than a preset matching number threshold;

[0012] if it is determined that the current data packet matching number is not greater than the preset matching number threshold, matching the data format feature of the fourth data packet with the to-be-matched feature, wherein the fourth data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the fourth data packet is an adjacent next data packet in the same transmission direction as the third data packet;

[0013] if it is determined that the data format feature of the fourth data packet matches the to-be-matched feature, performing the preset operation on the byte value of the byte position in the third data packet and the byte value of the byte position in the fourth data packet to obtain a third operation result;

[0014] if it is determined that the preset condition is met between the second operation result and the third operation result, determining the application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by the data packet transmitted between the target client and the target server.

[0015] In an optional implementation, the preset operation includes one of a difference operation, a summation operation, and a multiplication operation.

[0016] In an optional implementation, the preset condition includes one of the first operation result being equal to the second operation result and the first operation result and the second operation result meeting a preset rule.

[0017] In an alternative implementation, the preset feature library further stores a correspondence between the application layer protocol and the application program, and the method further comprises:

[0018] Based on the correspondence between the application layer protocol and the application program in the preset feature library, the application program corresponding to the application layer protocol relied on by the data packet transmitted between the target client and the target server is determined as the target application program.

[0019] In an alternative implementation, the preset feature library further stores a correspondence between the application layer protocol, the application layer protocol message feature and the byte position, and the determination of the application layer protocol message feature matching the data format feature of the first data packet from the preset feature library as the matching feature comprises:

[0020] The application layer data carried by the first data packet is acquired.

[0021] The application layer data carried by the first data packet is parsed according to the byte position corresponding to the first application layer protocol, and the data format feature of the first data packet is obtained.

[0022] If it is determined that the data format feature of the first data packet matches the application layer protocol message feature corresponding to the first application layer protocol successfully, the application layer protocol message feature corresponding to the byte position corresponding to the first application layer protocol is determined as the matching feature.

[0023] In an alternative implementation, the application layer protocol comprises a real-time transport protocol (RTP).

[0024] In a second aspect, the disclosure provides an application device for multi-packet identification, and the device comprises:

[0025] A first determination module is configured to determine an application layer protocol message feature matching a data format feature of a first data packet from a preset feature library as a matching feature, wherein the first data packet is a data packet carrying application layer data transmitted between a target client and a target server, and the preset feature library stores a correspondence between an application layer protocol and an application layer protocol message feature.

[0026] A first operation module is configured to perform a preset operation on byte values of a byte position corresponding to the matching feature in the first data packet and byte values of the byte position in a second data packet to obtain a first operation result if it is determined that the data format feature of the second data packet matches the matching feature successfully, wherein the second data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the second data packet is a next data packet adjacent to the first data packet in the same transmission direction.

[0027] a second operation module, configured to, if it is determined that the data format feature of the third data packet matches the to-be-matched feature successfully, perform the preset operation on the byte value of the byte position in the second data packet and the byte value of the byte position in the third data packet, to obtain a second operation result, wherein the third data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the third data packet is a next data packet in the same transmission direction as the second data packet;

[0028] a second determination module, configured to, if it is determined that the preset condition is met between the first operation result and the second operation result, determine the application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by the data packets transmitted between the target client and the target server.

[0029] In a third aspect, the present disclosure provides a computer readable storage medium, wherein the computer readable storage medium stores instructions, and when the instructions run on a terminal device, the terminal device implements the method described above.

[0030] In a fourth aspect, the present disclosure provides an application device for multi-packet identification, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and when the processor executes the computer program, the method described above is implemented.

[0031] Compared with the prior art, the technical scheme provided by the embodiments of the present disclosure has at least the following advantages:

[0032] The embodiments of the present disclosure provide an application method for multi-packet identification, determining an application layer protocol message feature matching the data format feature of the first data packet from a preset feature library as a to-be-matched feature, if it is determined that the data format feature of the second data packet matches the to-be-matched feature successfully, performing a preset operation on the byte value of the byte position corresponding to the to-be-matched feature in the first data packet and the byte value of the byte position in the second data packet, to obtain a first operation result, if it is determined that the data format feature of the third data packet matches the to-be-matched feature successfully, performing the preset operation on the byte value of the byte position in the second data packet and the byte value of the byte position in the third data packet, to obtain a second operation result, and if it is determined that the preset condition is met between the first operation result and the second operation result, determining the application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by the data packets transmitted between the target client and the target server. The embodiments of the present disclosure identify the application layer protocol based on the feature relationship between at least three consecutive data packets in the same transmission direction, realize effective analysis of the protocol, and thus improve the identification accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0033] The accompanying drawings, which are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure together with the specification.

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the accompanying drawings required by the embodiments or the prior art description will be briefly introduced. Obviously, those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0035] Figure 1 A flowchart of an application method of multi-packet identification provided by the embodiment of the present disclosure;

[0036] Figure 2 A flowchart of another application method of multi-packet identification provided by the embodiment of the present disclosure;

[0037] Figure 3 A structural schematic diagram of an application device of multi-packet identification provided by the embodiment of the present disclosure;

[0038] Figure 4 A structural schematic diagram of an application device of multi-packet identification provided by the embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the accompanying drawings required by the embodiments or the prior art description will be briefly introduced. Obviously, those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0040] In the following description, many specific details are set forth in order to provide a thorough understanding of the present disclosure, but the present disclosure can also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some of the embodiments of the present disclosure, not all the embodiments.

[0041] The embodiment of the present disclosure provides an application method of multi-packet identification, referring to Figure 1 A flowchart of an application method of multi-packet identification provided by the embodiment of the present disclosure, the method comprising:

[0042] S101: determining an application layer protocol message feature matched with the data format feature of the first data packet from a preset feature library as a to-be-matched feature.

[0043] Among them, the first data packet belongs to a data packet carrying application layer data transmitted between the target client and the target server, and the preset feature library stores the corresponding relationship between the application layer protocol and the application layer protocol message feature.

[0044] In the embodiments of the present disclosure, first, a connection between the target client and the target server is established, the connection is established based on a transport layer protocol, for example, the connection established between the target client and the target server can include a TCP (Transmission Control Protocol) connection, a UDP (User Datagram Protocol) connection, etc., when the connection is established between the target client and the target server, the target client and the target server can transmit a data packet carrying application layer data.

[0045] In the embodiments of the present disclosure, the transmission direction of the data packet carrying the application layer data can be from the target client to the target server or from the target server to the target client, the bytes in the application layer data of the data packet are analyzed, and the data format feature of the corresponding data packet can be obtained.

[0046] In the embodiments of the present disclosure, the preset feature library stores a plurality of preset rules, the preset rules include a corresponding relationship between an application layer protocol and an application layer protocol message feature, for example, rule 1 includes a corresponding relationship between protocol 1 and protocol message feature 1; rule 2 includes a corresponding relationship between protocol 2 and protocol message feature 2; and the like, wherein the application layer protocol can include an HTTP protocol (Hyper Text Transfer Protocol), an RTP protocol (Real-time Transport Protocol), etc.

[0047] In the embodiments of the present disclosure, after the connection between the target client and the target server is established, a first data packet carrying the application layer data transmitted between the target client and the target server is obtained, and the data format feature of the first data packet is matched with a plurality of preset rules stored in the preset feature library, the application layer protocol message feature matched with the data format feature of the first data packet is determined from the preset feature library as a to-be-matched feature. For example, assuming that the data format feature of the first data packet is feature a, the application layer protocol message feature matched with feature a is determined from the preset feature library as protocol message feature 1, and then protocol message feature 1 can be taken as the to-be-matched feature.

[0048] In the embodiments of the present disclosure, if there is no application layer protocol message feature matched with the data format feature of the first data packet based on the preset feature library, the identification for the first data packet is ended.

[0049] In an alternative embodiment, the preset feature library further stores a correspondence between the application layer protocol and the application layer protocol message feature and the byte position. The application layer protocol message feature matching the data format feature of the first data packet can be determined from the preset feature library according to steps A1-A3 as follows, as the to-be-matched feature.

[0050] Step A1: Obtain the application layer data carried by the first data packet.

[0051] In the embodiments of the present disclosure, after the connection between the target client and the target server is established, the first data packet carrying the application layer data transmitted between the target client and the target server is obtained, and then the application layer data carried by the first data packet is obtained, wherein the application layer data carried by the first data packet includes a plurality of bytes, for example, the application layer data carried by the first data packet is 20 bytes, etc.

[0052] Step A2: Analyze the application layer data carried by the first data packet according to the byte position corresponding to the first application layer protocol to obtain the data format feature of the first data packet.

[0053] In the embodiments of the present disclosure, the correspondence between the application layer protocol, the application layer protocol message feature and the byte position stored in the preset feature library can be as shown in Table (1) below.

[0054] Pre-set rules Application layer protocol Application layer protocol message characteristics Byte position ... Rule 1 Protocol 1 Protocol message characteristics 1 Byte position 1 ... Rule 2 Protocol 2 Protocol message characteristics 2 Byte position 2 ... Rule 3 Protocol 3 Protocol message characteristics 3 Byte position 3 ... ... ... ... ... ...

[0055] Table (1)

[0056] In the embodiments of the present disclosure, the application layer data carried by the first data packet is analyzed in sequence according to the preset rules in the preset feature library to obtain the data format feature of the first data packet. For example, taking the 5th, 6th and 7th byte positions corresponding to the byte position 1 of the protocol 1 as an example, the 5th, 6th and 7th bytes in the application layer data carried by the first data packet are analyzed according to the byte position (such as byte position 1) corresponding to the first application layer protocol (such as protocol 1) to obtain the data format feature (such as feature a) of the first data packet.

[0057] Step A3: If it is determined that the data format feature of the first data packet matches the application layer protocol message feature corresponding to the first application layer protocol successfully, the application layer protocol message feature corresponding to the byte position corresponding to the first application layer protocol is determined as the to-be-matched feature.

[0058] In the embodiments of the present disclosure, the data format feature (such as feature a) of the first data packet obtained in step A2 is matched with the application layer protocol message feature (protocol message feature 1) corresponding to the first application layer protocol (such as protocol 1), if the matching is successful, the application layer protocol message feature (protocol message feature 1) corresponding to the byte position (such as byte position 1) corresponding to the first application layer protocol (such as protocol 1) is determined as the to-be-matched feature.

[0059] In the embodiments of the present disclosure, if the matching fails, step A2 is continued to be executed, that is, the application layer data carried by the first data packet is parsed based on rule 2 in the preset feature library to obtain the data format feature of the first data packet, until the obtained data format feature of the first data packet is matched with a certain application layer protocol message feature in the preset feature library successfully, and then the application layer protocol message feature matched successfully is determined as the to-be-matched feature; or if it is determined that there is no application layer protocol message feature in the preset feature library that matches the data format feature (such as feature a) of the first data packet, the identification for the first data packet is ended.

[0060] Based on the above example, if the matching fails, step A2 is continued to be executed, that is, the byte corresponding to byte position 2 in the application layer data carried by the first data packet is parsed for byte position 2 corresponding to protocol 2 to obtain the data format feature (such as feature b) of the first data packet, and then the matching result between feature b and protocol message feature 2 is determined, until it is determined that the data format feature of the first data packet is matched with a certain application layer protocol message feature (such as protocol message feature 3) in the preset feature library successfully, then protocol message feature 3 is determined as the to-be-matched feature.

[0061] S102: If it is determined that the data format feature of the second data packet is matched with the to-be-matched feature successfully, a preset operation is performed on the byte value of the byte position corresponding to the to-be-matched feature in the first data packet and the byte value of the byte position in the second data packet to obtain a first operation result.

[0062] The second data packet belongs to a data packet carrying application layer data transmitted between the target client and the target server, and the second data packet is the next adjacent data packet in the same transmission direction as the first data packet.

[0063] In the embodiments of the present disclosure, first, the second data packet is acquired, wherein the second data packet is the next data packet carrying application layer data adjacent to the first data packet in the same transmission direction. Then, the byte corresponding to the byte position (e.g., byte position 3) of the to-be-matched feature (e.g., protocol message feature 3) in the application layer data carried by the second data packet is parsed to obtain the data format feature of the second data packet. The data format feature of the second data packet is matched with the to-be-matched feature (e.g., protocol message feature 3). If the matching is successful, a preset operation is performed on the byte value of the byte position in the first data packet and the byte value of the byte position in the second data packet. If the matching fails, the identification of the first data packet is ended.

[0064] In the embodiments of the present disclosure, based on the determination of the to-be-matched feature in S101, the byte value (e.g., byte value 1) of the byte position corresponding to the to-be-matched feature in the first data packet is acquired and stored. When it is determined that the data format feature of the second data packet matches the to-be-matched feature, the byte value (e.g., byte value 2) of the byte position corresponding to the to-be-matched feature in the second data packet is acquired and stored. Then, a preset operation is performed on the byte value 1 and the byte value 2 to obtain a first operation result, wherein the preset operation includes one of difference operation, summation operation, and multiplication operation. Specifically, assuming that the preset operation is difference operation, the first operation result can be the difference between the byte value 1 and the byte value 2; assuming that the preset operation is summation operation, the first operation result can be the sum of the byte value 1 and the byte value 2; and so on.

[0065] S103: If it is determined that the data format feature of the third data packet matches the to-be-matched feature, a preset operation is performed on the byte value of the byte position in the second data packet and the byte value of the byte position in the third data packet to obtain a second operation result.

[0066] The third data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the third data packet is the next data packet adjacent to the second data packet in the same transmission direction.

[0067] In the embodiments of the present disclosure, first, a third data packet is acquired, wherein the third data packet is a next data packet carrying application layer data adjacent to the second data packet in the same transmission direction. Then, for the byte position (e.g., byte position 3) corresponding to the to-be-matched feature (e.g., protocol message feature 3), the byte corresponding to the byte position 3 in the application layer data carried by the third data packet is parsed to obtain a data format feature of the third data packet. The data format feature of the third data packet is matched with the to-be-matched feature (e.g., protocol message feature 3). If the matching is successful, a preset operation is performed on the byte value of the byte position in the second data packet and the byte value of the byte position in the third data packet. If the matching fails, the identification for the first data packet is ended.

[0068] In the embodiments of the present disclosure, based on the byte value (e.g., byte value 2) of the byte position corresponding to the to-be-matched feature in the second data packet acquired in S102, when it is determined that the data format feature of the third data packet matches the to-be-matched feature successfully, the byte value (e.g., byte value 3) of the byte position corresponding to the to-be-matched feature in the third data packet is acquired and stored. Then, a preset operation is performed on the byte value 2 and the byte value 3 to obtain a second operation result. Specifically, assuming that the preset operation is a difference operation, the second operation result can be the difference between the byte value 2 and the byte value 3.

[0069] S104: If it is determined that the first operation result and the second operation result satisfy a preset condition, the application layer protocol corresponding to the to-be-matched feature is determined as an application layer protocol relied on by the data packets transmitted between the target client and the target server.

[0070] In the embodiments of the present disclosure, based on the first operation result obtained in S102 and the second operation result obtained in S103, if it is determined that the first operation result and the second operation result satisfy a preset condition, the application layer protocol corresponding to the to-be-matched feature is determined as an application layer protocol relied on by the data packets transmitted between the target client and the target server. For example, assuming that the to-be-matched feature determined based on S101 is protocol message feature 3, if it is determined that the first operation result and the second operation result satisfy a preset condition, it can be determined that the protocol 3 corresponding to the protocol message feature 3 is an application layer protocol relied on by the data packets transmitted between the target client and the target server.

[0071] In an optional implementation, the preset condition can include that the first operation result is equal to the second operation result, or the first operation result and the second operation result satisfy one of the preset rules, for example, the values of the first operation result and the second operation result are both 1; the second operation result is twice the first operation result; and the like.

[0072] In an alternative implementation, the preset feature library further stores a correspondence between the application layer protocol and the application program, and based on the correspondence between the application layer protocol and the application program in the preset feature library, the application program corresponding to the application layer protocol relied on by the data packet transmitted between the target client and the target server is determined as the target application program.

[0073] In the embodiments of the present disclosure, the preset feature library further stores a correspondence between the application layer protocol and the application program, and taking the above table (1) as an example, it is assumed that the preset feature library further stores a correspondence between protocol 1 and application program A, a correspondence between protocol 2 and application program B, a correspondence between protocol 3 and application program C, and the like. Based on the above S104, the application layer protocol (such as protocol 3) corresponding to the to-be-matched feature (such as protocol message feature 3) is determined as the application layer protocol relied on by the data packet transmitted between the target client and the target server, and then the application program C corresponding to the protocol 3 is determined as the target application program.

[0074] In the application method of multi-packet identification provided by the embodiments of the present disclosure, the application layer protocol message feature matched with the data format feature of the first data packet is determined from the preset feature library as a to-be-matched feature, if it is determined that the data format feature of the second data packet matches the to-be-matched feature successfully, then the preset operation is performed on the byte value of the byte position corresponding to the to-be-matched feature in the first data packet and the byte value of the byte position in the second data packet to obtain a first operation result, if it is determined that the data format feature of the third data packet matches the to-be-matched feature successfully, then the preset operation is performed on the byte value of the byte position in the second data packet and the byte value of the byte position in the third data packet to obtain a second operation result, and if it is determined that the preset condition is met between the first operation result and the second operation result, then the application layer protocol corresponding to the to-be-matched feature is determined as the application layer protocol relied on by the data packet transmitted between the target client and the target server. In the embodiments of the present disclosure, the application layer protocol is identified based on the feature relationship between at least three continuous data packets in the same transmission direction, and effective analysis of the protocol is realized, thereby improving the identification accuracy.

[0075] In an alternative implementation, if it is determined that the preset condition is not met between the first operation result and the second operation result, the next data packet adjacent to the third data packet in the same transmission direction can be continuously obtained, and then identification is performed based on the three data packets adjacent to the second data packet. The present disclosure further provides an application method of multi-packet identification, which is described with reference to Figure 2 The flowchart of another application method of multi-packet identification provided by the embodiments of the present disclosure is shown in FIG. 2, and the method comprises the following steps:

[0076] S201: determining an application layer protocol message feature matched with the data format feature of the first data packet from the preset feature library as a to-be-matched feature.

[0077] The first data packet belongs to a data packet carrying application layer data transmitted between the target client and the target server, and the preset feature library stores a corresponding relationship between an application layer protocol and an application layer protocol message feature.

[0078] In the embodiment of the present disclosure, after the connection between the target client and the target server is established, the first data packet carrying application layer data transmitted between the target client and the target server is obtained, and referring to the above table (1), it is assumed that the preset feature library also stores a corresponding relationship between a real-time transmission (RTP) protocol, an RTP protocol message feature (such as message feature r) and a byte position (such as a 4-byte position offset from the header), and the byte corresponding to the 4-byte position offset from the header in the application layer data carried by the first data packet is parsed for the byte position corresponding to the RTP protocol, to obtain the data format feature (such as feature a) of the first data packet, and if it is determined that feature a matches message feature r successfully, message feature r is taken as the to-be-matched feature.

[0079] S202: Determine whether the data format feature of the second data packet matches the to-be-matched feature successfully, if yes, execute S203; if no, end the identification.

[0080] The second data packet belongs to a data packet carrying application layer data transmitted between the target client and the target server, and the second data packet is the next adjacent data packet in the same transmission direction as the first data packet.

[0081] In the embodiment of the present disclosure, the same method as in S101 above is used, the byte corresponding to the 4-byte position offset from the header in the application layer data carried by the second data packet is parsed for the byte position corresponding to the RTP protocol, to obtain the data format feature (such as feature b) of the second data packet, and it is determined whether feature b matches the to-be-matched feature (such as message feature r) successfully, if the match is successful, S203 is executed; if the match fails, the identification for the first data packet is ended.

[0082] S203: Perform a difference operation on the byte value of the byte position corresponding to the to-be-matched feature in the first data packet and the byte value of the above-mentioned byte position in the second data packet, to obtain a first operation result.

[0083] In the embodiment of the present disclosure, based on the byte position (such as the 4-byte position offset from the header) corresponding to the to-be-matched feature, the byte value (such as byte value 1) corresponding to the 4-byte position offset from the header in the first data packet is obtained, and the byte value (such as byte value 2) corresponding to the 4-byte position offset from the header in the second data packet is obtained, and a difference operation is performed on byte value 1 and byte value 2, to obtain a first operation result, wherein the first operation result is the difference between byte value 1 and byte value 2.

[0084] S204: Determine whether the data format feature of the third data packet matches the to-be-matched feature successfully, if yes, execute S205; if no, end the identification.

[0085] The third data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the third data packet is the next data packet adjacent to the second data packet in the same transmission direction.

[0086] In the embodiment of the present disclosure, the same method as in S101 is used to analyze the byte corresponding to the 4-byte position offset from the header in the application layer data carried by the third data packet for the byte position corresponding to the RTP protocol, to obtain the data format feature (such as feature c) of the third data packet, and determine whether the feature c matches the to-be-matched feature (such as message feature r) successfully, if the match is successful, execute S205; if the match fails, end the identification for the first data packet.

[0087] S205: Perform difference operation on the byte value of the above-mentioned byte position in the second data packet and the byte value of the above-mentioned byte position in the third data packet to obtain a second operation result.

[0088] In the embodiment of the present disclosure, based on the byte position (such as the 4-byte position offset from the header) corresponding to the to-be-matched feature, the byte value (such as byte value 3) corresponding to the 4-byte position offset from the header in the third data packet is obtained, and difference operation is performed on byte value 2 and byte value 3 to obtain a second operation result, wherein the second operation result is the difference between byte value 2 and byte value 3.

[0089] S206: Determine whether the first operation result and the second operation result are equal, if not, execute S207; if yes, execute S211.

[0090] In the embodiment of the present disclosure, based on the first operation result obtained in S203 and the second operation result obtained in S205, it is determined whether the difference between byte value 1 and byte value 2 and the difference between byte value 2 and byte value 3 are equal, if it is determined that the first operation result and the second operation result are equal, execute S211; if it is determined that the first operation result and the second operation result are not equal, execute S207.

[0091] S207: Determine whether the current data packet matching number is greater than the preset matching number threshold, if not, execute S208; if yes, end the identification.

[0092] In the embodiments of the present disclosure, it is determined whether the corresponding number of times that the data format feature of the third data packet is matched with the to-be-matched feature is greater than a preset matching number threshold. The preset matching number threshold is the maximum matching number in the current identification. For example, the preset matching number threshold can be 5 times, 7 times, etc. The present disclosure does not make a specific limitation on the value of the preset matching number threshold.

[0093] In the embodiments of the present disclosure, assuming that the corresponding number of times that the data format feature of the third data packet is matched with the to-be-matched feature is the 3rd time, and taking the preset matching number threshold of 5 times as an example, it can be determined that the current data packet matching number is not greater than the preset matching number threshold, and S208 is performed. Assuming that the corresponding number of times that the data format feature of the third data packet is matched with the to-be-matched feature is the 6th time, and taking the preset matching number threshold of 5 times as an example, it can be determined that the current data packet matching number is greater than the preset matching number threshold, and the identification for the first data packet is ended.

[0094] S208: It is determined whether the data format feature of the fourth data packet is matched with the to-be-matched feature successfully. If yes, S209 is performed. If no, the identification is ended.

[0095] The fourth data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the fourth data packet is the next adjacent data packet in the same transmission direction as the third data packet.

[0096] In the embodiments of the present disclosure, based on S207 described above, if it is determined that the current data packet matching number is not greater than the preset matching number threshold, the byte at the 4-byte position offset from the header in the application layer data carried by the fourth data packet is parsed based on the byte position corresponding to the RTP protocol, and the data format feature (such as feature d) of the fourth data packet is obtained. It is determined whether the feature d is matched with the to-be-matched feature (such as message feature r) successfully. If matched successfully, S209 is performed. If failed, the identification for the first data packet is ended.

[0097] S209: A difference value operation is performed on the byte value of the above-mentioned byte position in the third data packet and the byte value of the above-mentioned byte position in the fourth data packet, and a third operation result is obtained.

[0098] In the embodiments of the present disclosure, based on the byte position (such as the 4-byte position offset from the header) corresponding to the to-be-matched feature, the byte value (such as byte value 4) at the 4-byte position offset from the header in the fourth data packet is obtained. A difference value operation is performed on the byte value 3 and the byte value 4, and a third operation result is obtained. The third operation result is the difference value between the byte value 3 and the byte value 4.

[0099] S210: determine whether the second operation result is equal to the third operation result, if yes, execute S211; if no, execute S207.

[0100] In the embodiment of the present disclosure, based on the second operation result obtained in S205 and the third operation result obtained in S209, it is determined whether the difference between byte value 2 and byte value 3 and the difference between byte value 3 and byte value 4 are equal, if it is determined that the second operation result is equal to the third operation result, S211 is executed; if it is determined that the second operation result is not equal to the third operation result, S207 is continued to be executed to determine whether the current data packet matching number is greater than the preset matching number threshold, until it is determined that the adjacent operation results are equal, or until it is determined that the current data packet matching number is greater than the preset matching number threshold, the identification for the first data packet is ended.

[0101] S211: determine the application layer protocol corresponding to the to-be-matched feature as the application layer protocol relied on by the data packet transmitted between the target client and the target server.

[0102] In the embodiment of the present disclosure, the application layer protocol (such as the RTP protocol) corresponding to the to-be-matched feature (such as the message feature r) is determined as the application layer protocol relied on by the data packet transmitted between the target client and the target server. Further, based on the correspondence between the application layer protocols and the application programs stored in the preset feature library, the application program corresponding to the application layer protocol (such as the RTP protocol) relied on by the data packet transmitted between the target client and the target server is determined as the target application program.

[0103] In the application method of the multi-packet identification provided by the embodiment of the present disclosure, the application layer protocol message feature matched with the data format feature of the first data packet is determined from the preset feature library as the to-be-matched feature, if it is determined that the data format feature of the second data packet is successfully matched with the to-be-matched feature, the preset operation is performed on the byte value of the byte position in the first data packet and the byte value of the byte position in the second data packet to obtain a first operation result, if it is determined that the data format feature of the third data packet is successfully matched with the to-be-matched feature, the preset operation is performed on the byte value of the byte position in the second data packet and the byte value of the byte position in the third data packet to obtain a second operation result, if it is determined that the first operation result and the second operation result satisfy the preset condition, the application layer protocol corresponding to the to-be-matched feature is determined as the application layer protocol relied on by the data packet transmitted between the target client and the target server. In the embodiment of the present disclosure, the application layer protocol is identified based on the feature relationship between at least three continuous data packets in the same transmission direction, which realizes effective analysis of the protocol and improves the identification accuracy.

[0104] In addition, by accurately identifying the RTP protocol, the transmission flow in the network can be effectively monitored, so that the network flow is optimized, and the service quality of the back-end line and the online experience of the user are improved.

[0105] Based on the above method embodiment, the disclosure also provides an application device for multi-packet identification, which is described with reference to Figure 3 A structural diagram of an application device for multi-packet identification is provided for the embodiment of the disclosure, and the device comprises:

[0106] The first determining module 301 is configured to determine an application layer protocol message feature matched with the data format feature of the first data packet from a preset feature library as a to-be-matched feature, wherein the first data packet is a data packet carrying application layer data transmitted between a target client and a target server, and the preset feature library stores a corresponding relationship between an application layer protocol and an application layer protocol message feature;

[0107] The first operation module 302 is configured to perform a preset operation on a byte value at a byte position corresponding to the to-be-matched feature in the first data packet and a byte value at the byte position in the second data packet to obtain a first operation result, if it is determined that the data format feature of the second data packet is successfully matched with the to-be-matched feature, wherein the second data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the second data packet is a next data packet in the same transmission direction as the first data packet;

[0108] The second operation module 303 is configured to perform the preset operation on the byte value at the byte position in the second data packet and a byte value at the byte position in the third data packet to obtain a second operation result, if it is determined that the data format feature of the third data packet is successfully matched with the to-be-matched feature, wherein the third data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the third data packet is a next data packet in the same transmission direction as the second data packet;

[0109] The second determining module 304 is configured to determine, as an application layer protocol relied on by the data packets transmitted between the target client and the target server, an application layer protocol corresponding to the to-be-matched feature, if it is determined that a preset condition is met between the first operation result and the second operation result.

[0110] In an optional embodiment, the device further comprises:

[0111] The third determining module is configured to determine whether the number of times of matching the current data packet is greater than a preset matching number threshold, if it is determined that the preset condition is not met between the first operation result and the second operation result.

[0112] The matching module is configured to match the data format feature of a fourth data packet with the to-be-matched feature if it is determined that the number of times of matching the current data packet is not greater than the preset threshold of the number of times of matching, wherein the fourth data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the fourth data packet is a next data packet adjacent to the third data packet in the same transmission direction.

[0113] The third operation module is configured to perform the preset operation on the byte value of the byte position in the third data packet and the byte value of the byte position in the fourth data packet to obtain a third operation result if it is determined that the data format feature of the fourth data packet matches the to-be-matched feature successfully.

[0114] The fourth determination module is configured to determine the application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by the data packet transmitted between the target client and the target server if it is determined that the preset condition is met between the second operation result and the third operation result.

[0115] In an optional implementation, the preset operation includes one of a difference operation, a summation operation, and a multiplication operation.

[0116] In an optional implementation, the preset condition includes one of the first operation result being equal to the second operation result and the first operation result and the second operation result meeting a preset rule.

[0117] In an optional implementation, the preset feature library further stores a corresponding relationship between an application layer protocol and an application program, and the apparatus further includes:

[0118] The fifth determination module is configured to determine, based on the corresponding relationship between the application layer protocol and the application program in the preset feature library, an application program corresponding to the application layer protocol relied on by the data packet transmitted between the target client and the target server as a target application program.

[0119] In an optional implementation, the preset feature library further stores a corresponding relationship between an application layer protocol, an application layer protocol message feature, and a byte position, and the first determination module 301 includes:

[0120] The acquisition sub-module is configured to acquire the application layer data carried by the first data packet.

[0121] The analysis sub-module is configured to analyze the application layer data carried by the first data packet to obtain the data format feature of the first data packet for the byte position corresponding to the first application layer protocol.

[0122] determining sub-module, configured to determine, if it is determined that the data format feature of the first data packet matches the application layer protocol message feature corresponding to the first application layer protocol, the application layer protocol message feature corresponding to the byte position of the first application layer protocol as the to-be-matched feature.

[0123] In an optional implementation, the application layer protocol includes a real-time transport protocol (RTP).

[0124] According to the application method provided in the embodiments of the present disclosure, the application layer protocol message feature that matches the data format feature of the first data packet is determined from the preset feature library as the to-be-matched feature, if it is determined that the data format feature of the second data packet matches the to-be-matched feature, a preset operation is performed on the byte value of the byte position in the first data packet and the byte value of the byte position in the second data packet to obtain a first operation result, if it is determined that the data format feature of the third data packet matches the to-be-matched feature, a preset operation is performed on the byte value of the byte position in the second data packet and the byte value of the byte position in the third data packet to obtain a second operation result, and if it is determined that the first operation result and the second operation result satisfy a preset condition, the to-be-matched feature is determined as the application layer protocol on which the data packets transmitted between the target client and the target server depend. According to the embodiments of the present disclosure, the application layer protocol is identified based on the feature relationship between at least three continuous data packets in the same transmission direction, and effective analysis on the protocol is realized, thereby improving the identification accuracy.

[0125] In addition to the method and device described above, the embodiments of the present disclosure further provide a computer-readable storage medium, which stores instructions. When the instructions run on a terminal device, the terminal device implements the application method of multiple packet identification according to the embodiments of the present disclosure.

[0126] In addition, the embodiments of the present disclosure further provide a multiple packet identification application device, as shown in Figure 4 application device can include:

[0127] a processor 401, a memory 402, an input device 403 and an output device 404. The number of processors 401 in the multiple packet identification application device can be one or more, Figure 4 In some embodiments of the present disclosure, the processor 401, the memory 402, the input device 403 and the output device 404 can be connected through a bus or other means, wherein, Figure 4 In some embodiments of the present disclosure, the processor 401, the memory 402, the input device 403 and the output device 404 can be connected through a bus or other means, wherein,

[0128] The memory 402 can be used to store software programs and modules, and the processor 401 can execute various functional applications and data processing of the multi-package identification application device by running the software programs and modules stored in the memory 402. The memory 402 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by at least one function, and the like. In addition, the memory 402 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. The input device 403 can be used to receive input digital or character information, and to generate signal input related to user settings and function control of the multi-package identification application device.

[0129] In particular in the present embodiment, the processor 401 can load the executable file corresponding to the process of one or more than one application program into the memory 402 according to the following instructions, and run the application program stored in the memory 402 by the processor 401, so as to realize the various functions of the multi-package identification application device as described above.

[0130] It should be noted that in this document, relational terms such as "first" and "second", and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the element.

[0131] The above description is merely one specific implementation of the present disclosure, enabling those skilled in the art to understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to these embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of application of multi-packet recognition, characterized in that, The method comprises: determining, from a preset feature library, an application layer protocol message feature matching a data format feature of a first data packet as a to-be-matched feature, wherein the first data packet is a data packet carrying application layer data transmitted between a target client and a target server, and the preset feature library stores a corresponding relationship between an application layer protocol and an application layer protocol message feature; if it is determined that a data format feature of a second data packet matches the to-be-matched feature successfully, performing a preset operation on a byte value at a byte position corresponding to the to-be-matched feature in the first data packet and a byte value at the byte position in the second data packet to obtain a first operation result, wherein the second data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the second data packet is an adjacent next data packet in a same transmission direction as the first data packet; if it is determined that a data format feature of a third data packet matches the to-be-matched feature successfully, performing the preset operation on the byte value at the byte position in the second data packet and a byte value at the byte position in the third data packet to obtain a second operation result, wherein the third data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the third data packet is an adjacent next data packet in the same transmission direction as the second data packet; if it is determined that the first operation result and the second operation result satisfy a preset condition, determining an application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by data packets transmitted between the target client and the target server.

2. The method of claim 1, wherein, The method further comprises: if it is determined that the first operation result and the second operation result do not satisfy the preset condition, determining whether a current data packet matching number is greater than a preset matching number threshold; if it is determined that the current data packet matching number is not greater than the preset matching number threshold, matching a data format feature of a fourth data packet with the to-be-matched feature, wherein the fourth data packet is a data packet carrying application layer data transmitted between the target client and the target server, and the fourth data packet is an adjacent next data packet in the same transmission direction as the third data packet; if it is determined that the data format feature of the fourth data packet matches the to-be-matched feature successfully, performing the preset operation on the byte value at the byte position in the third data packet and a byte value at the byte position in the fourth data packet to obtain a third operation result; if it is determined that the second operation result and the third operation result satisfy the preset condition, determining the application layer protocol corresponding to the to-be-matched feature as the application layer protocol relied on by the data packets transmitted between the target client and the target server.

3. The method of claim 1, wherein, The preset operation comprises one of a difference operation, a summation operation, and a multiplication operation.

4. The method of claim 1, wherein, The preset condition comprises one of the first operation result being equal to the second operation result and the first operation result and the second operation result satisfying a preset rule.

5. The method according to claim 1 or 2, characterized in that, The preset feature library also stores a correspondence between the application layer protocol and the application program, and the method further includes: Based on the correspondence between the application layer protocol and the application program in the preset feature library, an application program corresponding to an application layer protocol relied on by the target client and the target server in transmitting the data packet is determined as a target application program.

6. The method of claim 1, wherein, The preset feature library also stores a correspondence between the application layer protocol, the application layer protocol message feature and the byte position, and the application layer protocol message feature matched with the data format feature of the first data packet is determined from the preset feature library as a to-be-matched feature, including: Obtaining the application layer data carried by the first data packet; Parses the application layer data carried by the first data packet according to the byte position corresponding to the first application layer protocol to obtain the data format feature of the first data packet; If it is determined that the data format feature of the first data packet matches the application layer protocol message feature corresponding to the first application layer protocol, the application layer protocol message feature corresponding to the byte position corresponding to the first application layer protocol is determined as the to-be-matched feature.

7. The method of claim 1, wherein, The application layer protocol includes a real-time transmission (RTP) protocol.

8. An application device for multi-packet identification, characterized in that: The device includes: A first determination module configured to determine, from a preset feature library, an application layer protocol message feature matched with a data format feature of a first data packet as a to-be-matched feature, wherein the first data packet is a data packet carrying an application layer data transmitted between a target client and a target server, and the preset feature library stores a correspondence between an application layer protocol and an application layer protocol message feature; A first operation module configured to, if it is determined that a data format feature of a second data packet matches the to-be-matched feature, perform a preset operation on byte values of a byte position corresponding to the to-be-matched feature in the first data packet and byte values of the byte position in the second data packet to obtain a first operation result, wherein the second data packet is a data packet carrying an application layer data transmitted between the target client and the target server, and the second data packet is a next data packet in a same transmission direction as the first data packet; A second operation module configured to, if it is determined that a data format feature of a third data packet matches the to-be-matched feature, perform the preset operation on the byte values of the byte position in the second data packet and byte values of the byte position in the third data packet to obtain a second operation result, wherein the third data packet is a data packet carrying an application layer data transmitted between the target client and the target server, and the third data packet is a next data packet in the same transmission direction as the second data packet; A second determination module configured to, if it is determined that a preset condition is met between the first operation result and the second operation result, determine an application layer protocol corresponding to the to-be-matched feature as an application layer protocol relied on by the target client and the target server in transmitting the data packet.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores instructions, and when the instructions run on the terminal device, the terminal device implements the method in claims 1-7.

10. An application device of multi-package identification, characterized by, Comprise: A memory, a processor, and a computer program stored on the memory and capable of running on the processor, and when the processor executes the computer program, the method in claims 1-7 is implemented.

Images