A method, device and equipment for identifying a public resource type service

Abstract

The application provides a public resource type service identification method, device and equipment, and relates to the technical field of communication. The method comprises the following steps: obtaining a first original code stream from a first PCAP data packet; analyzing HTTP and HTTPS protocol data in the first original code stream to obtain a characteristic field corresponding to the first original code stream; if the characteristic field is located in a service rule table, it is determined that the first original code stream belongs to a public resource type service; wherein the service rule table comprises characteristic fields corresponding to multiple different public resource type services. The scheme of the application solves the problem that the prior art cannot distinguish between public resource type services and ordinary services.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, apparatus and equipment for identifying public resource services. Background Technology

[0002] Currently, the amount of data generated on the Internet is exploding, consuming huge amounts of server and network resources. Improving server resource utilization and optimizing network performance have become important research directions.

[0003] Public resource services that provide image and video resources to various Internet services are accessed frequently. Since image and video resources themselves require the transmission of large amounts of data, these services account for a large proportion of network traffic and have a significant impact on network and server performance.

[0004] Existing service identification methods cannot distinguish between public resource services and ordinary services, thus failing to better schedule and utilize the resources of public resource services, which is detrimental to network performance optimization. Summary of the Invention

[0005] The purpose of this invention is to provide a method, apparatus, and equipment for identifying public resource services, which solves the problem that existing service identification methods cannot distinguish between public service services and ordinary services, thus hindering network performance optimization.

[0006] To achieve the above objectives, embodiments of the present invention provide a method for identifying public resource-related services, including:

[0007] Obtain the first raw bitstream from the first PCAP data packet;

[0008] The HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol over SecureSocket Layer) protocol data in the first original bitstream are parsed to obtain the feature fields corresponding to the first original bitstream;

[0009] If the feature field is located in the business rule table, then the first original bitstream is determined to belong to the public resource category business; wherein, the business rule table includes feature fields corresponding to multiple different public resource categories business.

[0010] Optionally, the method for determining the business rule table includes:

[0011] Obtain a sample set of PCAP data packets;

[0012] Obtain the raw bitstream from each PCAP data packet sample to obtain a set of raw bitstream samples;

[0013] A first data table is obtained based on the set of original bitstream samples; wherein the first data table includes a feature field corresponding to each original bitstream; the label of each feature field is the service category to which the PCAP data packet sample corresponding to each original bitstream belongs;

[0014] Based on the first data table, a second data table is determined; wherein, the second data table includes multiple target feature fields; the target feature fields are the feature fields corresponding to the code streams belonging to public service business in the original code stream sample set;

[0015] Based on the bitstream length information corresponding to the target feature field, the target feature field in the second data table is classified into business categories to obtain the business rule table.

[0016] Optionally, the feature fields include: domain name and network device identifier; wherein the network device identifier includes IP address and port number.

[0017] Optionally, determining the second data table based on the first data table includes:

[0018] The feature fields in the first data table that correspond to at least two business categories are used as target feature fields;

[0019] The second data table is constructed based on the target feature fields.

[0020] Optionally, based on the bitstream length information corresponding to the target feature field, the target feature field in the second data table is classified into business categories to obtain the business rule table, including:

[0021] The bitstream length information corresponding to multiple target feature fields is used as input to a classification algorithm based on association rules to obtain the business classification result to which each bitstream length information belongs; wherein, the business classification result includes: public resource business and other public business;

[0022] The service classification result to which each bitstream length information belongs is used as the service classification result of the target feature field corresponding to the bitstream length information;

[0023] The target feature field that belongs to the public resource category of the business classification result is used as the feature field in the business rule table.

[0024] Optionally, the bitstream length information corresponding to each of the target feature fields includes:

[0025] The length of the original bitstream corresponding to the target feature field;

[0026] The lengths of the N preceding and following bitstreams of the original bitstream corresponding to the target feature field; N is a positive integer.

[0027] To achieve the above objectives, embodiments of the present invention provide an identification device for public resource-related services, comprising:

[0028] The first acquisition module is used to acquire the first raw bitstream from the first PCAP data packet;

[0029] The second acquisition module is used to parse the HTTP and HTTPS protocol data in the first original code stream to obtain the feature fields corresponding to the first original code stream;

[0030] The first processing module is configured to determine that the first original bitstream belongs to a public resource category service if the feature field is located in the business rule table; wherein the business rule table includes feature fields corresponding to multiple different public resource category services.

[0031] To achieve the above objectives, embodiments of the present invention provide a device for identifying public resource services, comprising: a transceiver and a processor; wherein the processor is configured to obtain a first raw bitstream from a first PCAP data packet; parse the HTTP and HTTPS protocol data in the first raw bitstream to obtain a feature field corresponding to the first raw bitstream; if the feature field is located in a service rule table, then the first raw bitstream is determined to belong to a public resource service; wherein the service rule table includes multiple feature fields corresponding to different public resource services.

[0032] To achieve the above objectives, embodiments of the present invention provide a device for identifying public resource services, including a transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; when the processor executes the program or instructions, it implements the public resource service identification method as described above.

[0033] To achieve the above objectives, embodiments of the present invention provide a readable storage medium storing a program or instructions thereon, which, when executed by a processor, implement the steps in the public resource service identification method described above.

[0034] The beneficial effects of the above-described technical solution of the present invention are as follows:

[0035] The method of this invention obtains a first raw bitstream from a first PCAP data packet; parses the HTTP and HTTPS protocol data in the first raw bitstream to obtain feature fields corresponding to the first raw bitstream; and determines that the first raw bitstream belongs to a public resource service when the feature fields are located in a business rule table; wherein the business rule table includes feature fields corresponding to multiple different public resource services. This enables the differentiation between public resource services and ordinary services, facilitating better scheduling and utilization of resources in public resource services, and contributing to optimized network performance and improved resource utilization. Attached Figure Description

[0036] Figure 1 This is a flowchart illustrating a method for identifying public resource-related services according to an embodiment of the present invention.

[0037] Figure 2 A flowchart illustrating a method for identifying public resource-type services according to another embodiment of the present invention;

[0038] Figure 3 This is a structural diagram of the identification device for public resource-related services according to an embodiment of the present invention;

[0039] Figure 4 This is a structural diagram of the identification device for public resource services according to an embodiment of the present invention;

[0040] Figure 5 This is a structural diagram of a public resource service identification device according to another embodiment of the present invention. Detailed Implementation

[0041] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0042] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the invention. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0043] In various embodiments of the present invention, it should be understood that the sequence number of each process described below does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0044] In addition, the terms "system" and "network" are often used interchangeably in this article.

[0045] In the embodiments provided in this application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0046] like Figure 1 As shown in the figure, an embodiment of the present invention provides a method for identifying public resource-related services, which includes the following steps:

[0047] Step 101: Obtain the first raw bitstream from the first PCAP data packet.

[0048] It should be noted that the PCAP file is a commonly used datagram storage format, consisting of a PCAP file header and multiple PCAP data packets.

[0049] For example, as one implementation method, the binary raw bitstream in the PCAP data packet can be analyzed and obtained through deep packet inspection (DPI) technology.

[0050] Step 102: Parse the HTTP and HTTPS protocol data in the first original bitstream to obtain the feature fields corresponding to the first original bitstream.

[0051] Specifically, the feature fields include: domain name and network device identifier; wherein, the network device identifier includes IP address and port number (PORT). That is, the feature field includes a tuple of domain name and IP:PORT.

[0052] Among them, IP address and port number are used to identify the address of a communication entity in the network, that is, IP address and port number can be used as network device identifier; domain name can uniquely identify the website and filing entity to which traffic data belongs, that is, the business category.

[0053] Example of a feature field: [weixin.qq.com,183.195.236.151:443]; where weixin.qq.com is the domain name, 183.195.236.151 is the IP address, and 443 is the port number.

[0054] Example 2 of the feature field: [wx.qq.com,183.192.199.220:443]]; where wx.qq.com is the domain name, 183.192.199.220 is the IP address, and 443 is the port number.

[0055] Step 103: If the feature field is located in the business rule table, then the first original code stream is determined to belong to the public resource category business; wherein, the business rule table includes feature fields corresponding to multiple different public resource categories business.

[0056] In this step, the business rule table is obtained based on a large number of collected PCAP packet samples, including feature fields corresponding to public resource-type services. Specifically, if the business rule table contains a feature field corresponding to the first original bitstream, then the first original bitstream is determined to belong to a public resource-type service; if the business rule table does not contain a feature field corresponding to the first original bitstream, then the first original bitstream is determined not to belong to a public resource-type service.

[0057] It should be noted that after identifying the original bitstream corresponding to public resource-type services, key optimizations can be made when allocating cached data to server nodes and when scheduling network resources during data transmission, in order to improve resource utilization and optimize network performance.

[0058] In one embodiment, the method for determining the business rule table mainly includes the following five steps:

[0059] Step 201: Obtain a set of PCAP data packet samples.

[0060] In this step, a large number of PCAP packets of different business types can be collected as samples through automated scripts, and the PCAP packets carry the original business tags.

[0061] Step 202: Obtain the raw bitstream from each PCAP data packet sample to obtain a set of raw bitstream samples.

[0062] In this step, PCAP data packet samples are parsed to obtain the raw bitstream, and finally, the raw bitstream sample set corresponding to the PCAP data packet sample set is obtained.

[0063] Step 203: Obtain a first data table based on the original bitstream sample set; wherein, the first data table includes a feature field corresponding to each original bitstream; the label of each feature field is the service category to which the PCAP data packet sample corresponding to each original bitstream belongs;

[0064] The feature fields include: domain name and network device identifier; wherein the network device identifier includes IP address and port number.

[0065] For example, parse the HTTP and HTTPS protocol data in the original bitstream to obtain the tuple information consisting of the domain name, IP address, and port corresponding to the original bitstream (this tuple information is the feature field), and use the business category corresponding to the PCAP data packet sample as the label of the tuple parsed from the PCAP data packet sample. Construct the first data table.

[0066] The index of the tuple is the business category, and the retrieved content is the tuple parsed from the PCAP data packet sample of that business category. For example, the tuple for the business category "WeChat" is:

[0067] [WeChat:[weixin.qq.com,183.195.236.151:443],[wx.qq.com,183.192.199.220:443]].

[0068] Step 204: Determine a second data table based on the first data table; wherein the second data table includes multiple target feature fields; the target feature fields are the feature fields corresponding to the code streams belonging to public service business in the original code stream sample set;

[0069] In this step, the second data table includes the feature fields corresponding to the original code stream of public service business.

[0070] In one embodiment, step 204 includes: taking the feature fields in the first data table that correspond to at least two business categories as target feature fields; and constructing the second data table based on the target feature fields.

[0071] For example, if [beacon.qq.com:183.194.189.111:443] exists in multiple business categories, it indicates that the original bitstream corresponding to the bitstream belongs to the public service category, and this is used as the target feature field for filtering. By analogy, multiple target feature fields can be obtained to construct the second data table.

[0072] Step 205: Based on the bitstream length information corresponding to the target feature field, classify the target feature field in the second data table into business categories to obtain the business rule table.

[0073] In this step, the bitstream length information corresponding to the target feature field can be obtained, a correspondence table between the bitstream length information and the target feature field can be constructed, and based on the correspondence table and the bitstream length information, the target feature field in the second data table can be classified into business categories to obtain the business rule table.

[0074] Because the length information of multiple consecutive bitstreams generated by accessing the same webpage link or clicking the same application control exhibits regularity, feature fields are typically contained within one or more of these bitstreams. Therefore, in one embodiment, the bitstream length information corresponding to each target feature field includes: the bitstream length of the original bitstream corresponding to the target feature field; and the bitstream lengths of the N bitstreams preceding and following the original bitstream corresponding to the target feature field; where N is a positive integer.

[0075] For example, for the target feature field: [beacon.qq.com:183.194.189.111:443], let N be 3, that is, the bitstream length information corresponding to the target feature field includes: the bitstream lengths of the three bitstreams before and after the original bitstream corresponding to the target feature field, as follows:

[0076] The string "1151:11054:852:11092:1208:1206:19928" represents the length of the original bitstream corresponding to the target feature field. "11092" represents the length of the first three bits of the original bitstream corresponding to the target feature field, and "1208:1206:19928" represents the length of the last three bits of the original bitstream corresponding to the target feature field. Therefore, the correspondence between the original bitstream tuples and the bitstream length information is as follows:

[0077] ["beacon.qq.com:183.194.189.111:443":1151:11054:852:11092:1208:1206:19928"].

[0078] It should be noted that since the target feature field is a feature field corresponding to at least two business categories, there are at least two original bitstreams corresponding to the target feature field, and there are also at least two bitstream length information corresponding to the target feature field. Each bitstream length information includes the bitstream length of the N bitstreams before and after the original bitstream.

[0079] For example, if the target feature field corresponds to business category 1, business category 2, and business category 3, where business category 1 corresponds to original bitstream 1, business category 2 corresponds to original bitstream 2, and business category 3 corresponds to original bitstream 3, then the bitstream length information corresponding to the target feature field includes: the bitstream length information corresponding to original bitstream 1, the bitstream length information corresponding to original bitstream 2, and the bitstream length information corresponding to original bitstream 3.

[0080] In one embodiment, step 205 includes:

[0081] The bitstream length information corresponding to multiple target feature fields is used as input to a classification algorithm based on association rules to obtain the business classification result to which each bitstream length information belongs; wherein, the business classification result includes: public resource business and other public business;

[0082] The service classification result to which each bitstream length information belongs is used as the service classification result of the target feature field corresponding to the bitstream length information;

[0083] The target feature field that belongs to the public resource category of the business classification result is used as the feature field in the business rule table.

[0084] Other public services refer to public service services other than public resource services.

[0085] Here, each bitstream length information corresponds one-to-one with each target feature field, and each bitstream length information includes the bitstream length information corresponding to at least two original bitstreams. It should be noted that although the bitstream length information of multiple original bitstreams corresponding to the target feature field may differ, they all conform to the same regularity. Therefore, the final service classification result is: the service classification result to which the bitstream length information of all original bitstreams corresponding to the target feature field belongs.

[0086] In this embodiment, when classifying the bitstream length information corresponding to the target feature field using a classification algorithm based on association rules, it is based on predefined samples of public resource services. The algorithm mines multiple bitstream length information appearing in the samples and classifies the bitstream length corresponding to the target feature field based on the mined bitstream length information. Since public resource services are significantly more numerous and account for a larger proportion than other types of public service services, and the bitstream length information of all original bitstreams of public resource services conforms to the same regularity, the algorithm tends to identify all such services during model training, thus accurately classifying the bitstream length information of all bitstreams corresponding to the target feature field. Furthermore, the service classification result to which the bitstream length information corresponding to the target feature field belongs is used as the service classification result of the target feature field corresponding to the bitstream length information, thus obtaining the target feature field belonging to the public resource service category.

[0087] like Figure 3 As shown, an identification device 300 for public resource services according to an embodiment of the present invention includes:

[0088] The first acquisition module 301 is used to acquire the first raw bitstream from the first PCAP data packet;

[0089] The second acquisition module 302 is used to parse the HTTP and HTTPS protocol data in the first original code stream to obtain the feature fields corresponding to the first original code stream;

[0090] The first processing module 303 is used to determine that the first original code stream belongs to a public resource service if the feature field is located in the business rule table; wherein the business rule table includes feature fields corresponding to multiple different public resource services.

[0091] Optionally, the device 300 further includes:

[0092] The third acquisition module is used to acquire a set of PCAP data packet samples;

[0093] The fourth acquisition module is used to acquire the raw bitstream from each PCAP data packet sample to obtain a set of raw bitstream samples;

[0094] The fifth acquisition module is used to acquire a first data table based on the original bitstream sample set; wherein the first data table includes a feature field corresponding to each original bitstream; the label of each feature field is the service category to which the PCAP data packet sample corresponding to each original bitstream belongs;

[0095] The second processing module is used to determine a second data table based on the first data table; wherein the second data table includes multiple target feature fields; the target feature fields are the feature fields corresponding to the code streams belonging to public service business in the original code stream sample set;

[0096] The third processing module is used to classify the target feature fields in the second data table into business categories based on the bitstream length information corresponding to the target feature fields, thereby obtaining the business rule table.

[0097] Optionally, the feature fields include: domain name and network device identifier; wherein the network device identifier includes IP address and port number.

[0098] Optionally, the second processing module includes:

[0099] The first processing unit is used to take the feature fields in the first data table that correspond to at least two business categories as target feature fields;

[0100] The second processing unit is used to construct the second data table based on the target feature fields.

[0101] Optionally, the third processing module includes:

[0102] The third processing unit is used to take the bitstream length information corresponding to multiple target feature fields as input to a classification algorithm based on association rules to obtain the business classification result to which each bitstream length information belongs; wherein, the business classification result includes: public resource business and other public business;

[0103] The fourth processing unit is used to take the service classification result of each bitstream length information as the service classification result of the target feature field corresponding to the bitstream length information;

[0104] The fifth processing unit is used to take the target feature field of the business classification result belonging to the public resource category as the feature field of the business rule table.

[0105] Optionally, the bitstream length information corresponding to each of the target feature fields includes:

[0106] The length of the original bitstream corresponding to the target feature field;

[0107] The lengths of the N preceding and following bitstreams of the original bitstream corresponding to the target feature field; N is a positive integer.

[0108] The public resource service identification device in this embodiment obtains a first raw bitstream from a first PCAP data packet; parses the HTTP and HTTPS protocol data in the first raw bitstream to obtain feature fields corresponding to the first raw bitstream; if the feature fields are located in a service rule table, then the first raw bitstream is determined to belong to a public resource service; wherein, the service rule table includes multiple feature fields corresponding to different public resource services. This enables the differentiation between public resource services and ordinary services, facilitating better scheduling and utilization of resources for public resource services and contributing to network performance optimization.

[0109] like Figure 4 As shown, an identification device 400 for public resource services according to an embodiment of the present invention includes a processor 410 and a transceiver 420, wherein...

[0110] The processor is used to obtain a first raw bitstream from a first PCAP data packet; parse the HTTP and HTTPS protocol data in the first raw bitstream to obtain the feature fields corresponding to the first raw bitstream; if the feature fields are located in a business rule table, then the first raw bitstream is determined to belong to a public resource category business; wherein, the business rule table includes feature fields corresponding to multiple different public resource category businesses.

[0111] The transceiver 420 is used to receive and send data under the control of the processor 410.

[0112] Optionally, the processor 410 is further configured to perform the following steps:

[0113] Obtain a sample set of PCAP data packets;

[0114] Obtain the raw bitstream from each PCAP data packet sample to obtain a set of raw bitstream samples;

[0115] A first data table is obtained based on the set of original bitstream samples; wherein the first data table includes a feature field corresponding to each original bitstream; the label of each feature field is the service category to which the PCAP data packet sample corresponding to each original bitstream belongs;

[0116] Based on the first data table, a second data table is determined; wherein, the second data table includes multiple target feature fields; the target feature fields are the feature fields corresponding to the code streams belonging to public service business in the original code stream sample set;

[0117] Based on the bitstream length information corresponding to the target feature field, the target feature field in the second data table is classified into business categories to obtain the business rule table.

[0118] Optionally, the feature fields include: domain name and network device identifier; wherein the network device identifier includes IP address and port number.

[0119] Optionally, the processor 410 is also specifically used in the following steps:

[0120] The feature fields in the first data table that correspond to at least two business categories are used as target feature fields;

[0121] The second data table is constructed based on the target feature fields.

[0122] Optionally, the processor 410 is also specifically used in the following steps:

[0123] The bitstream length information corresponding to multiple target feature fields is used as input to a classification algorithm based on association rules to obtain the business classification result to which each bitstream length information belongs; wherein, the business classification result includes: public resource business and other public business;

[0124] The service classification result to which each bitstream length information belongs is used as the service classification result of the target feature field corresponding to the bitstream length information;

[0125] The target feature field that belongs to the public resource category of the business classification result is used as the feature field in the business rule table.

[0126] Optionally, the bitstream length information corresponding to each of the target feature fields includes:

[0127] The length of the original bitstream corresponding to the target feature field;

[0128] The lengths of the N preceding and following bitstreams of the original bitstream corresponding to the target feature field; N is a positive integer.

[0129] The public resource service identification device in this embodiment obtains a first raw bitstream from a first PCAP data packet; and parses the HTTP and HTTPS protocol data in the first raw bitstream to obtain the feature fields corresponding to the first raw bitstream; if the feature fields are located in a service rule table, then the first raw bitstream is determined to belong to a public resource service; wherein, the service rule table includes multiple feature fields corresponding to different public resource services. This enables the differentiation between public resource services and ordinary services, facilitating better scheduling and utilization of resources for public resource services and contributing to network performance optimization.

[0130] Another embodiment of the present invention provides an identification device for public resource-related services, such as... Figure 5 As shown, it includes a transceiver 510, a processor 500, a memory 520, and a program or instructions stored in the memory 520 and executable on the processor 500; when the processor 500 executes the program or instructions, it implements the above-mentioned identification method applied to public resource services.

[0131] The transceiver 510 is used to receive and send data under the control of the processor 500.

[0132] Among them, Figure 5 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 500 and memory represented by memory 520 together. The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. Transceiver 510 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, user interface 530 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0133] The processor 500 is responsible for managing the bus architecture and general processing, while the memory 520 can store the data used by the processor 500 when performing operations.

[0134] This invention provides a readable storage medium storing a program or instructions. When executed by a processor, the program or instructions implement the steps in the public resource service identification method described above, achieving the same technical effect. To avoid repetition, further details are omitted here. The computer-readable storage medium may include read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0135] It should be further noted that the terminals described in this specification include, but are not limited to, smartphones, tablets, etc., and many of the functional components described are referred to as modules in order to emphasize the independence of their implementation.

[0136] In this embodiment of the invention, the module can be implemented in software so that it can be executed by various types of processors. For example, an identified executable code module may include one or more physical or logical blocks of computer instructions, which may be constructed as objects, procedures, or functions. Nevertheless, the executable code of the identified module does not need to be physically located together, but may include different instructions stored in different bits, which, when logically combined, constitute the module and achieve the module's intended purpose.

[0137] In practice, an executable code module can be a single instruction or many instructions, and can even be distributed across multiple different code segments, different programs, and across multiple memory devices. Similarly, operational data can be identified within the module and can be implemented in any suitable form and organized within any suitable type of data structure. This operational data can be collected as a single dataset or distributed across different locations (including different storage devices), and can exist, at least in part, solely as electronic signals within the system or network.

[0138] When a module can be implemented using software, considering the current level of hardware technology, modules that can be implemented in software can be implemented using hardware circuits by those skilled in the art to achieve the corresponding functions, without considering cost. These hardware circuits include conventional very-large-scale integrated circuits (VLSI) or gate arrays, as well as existing semiconductors such as logic chips and transistors, or other discrete components. Modules can also be implemented using programmable hardware devices, such as field-programmable gate arrays, programmable array logic, and programmable logic devices.

[0139] The exemplary embodiments described above are with reference to the accompanying drawings. Many different forms and embodiments are feasible without departing from the spirit and teachings of the invention. Therefore, the invention should not be construed as limiting the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention complete and convey the scope of the invention to those skilled in the art. In these drawings, component dimensions and relative dimensions may be exaggerated for clarity. The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. As used herein, unless clearly indicated otherwise, the singular forms “a,” “an,” and “the” are intended to include all such forms. It will be further understood that the terms “comprising” and / or “including”, when used in this specification, indicate the presence of the stated features, integers, steps, operations, components, and / or elements, but do not exclude the presence or addition of one or more other features, integers, steps, operations, components, and / or groups thereof. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of the range and any subranges in between.

[0140] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for identifying public resource-related services, characterized in that, include: Obtain the first raw bitstream from the first PCAP data packet; The HTTP and HTTPS protocol data in the first original code stream are parsed to obtain the feature fields corresponding to the first original code stream. If the feature field is located in the business rule table, then the first original bitstream is determined to belong to the public resource category business; wherein, the business rule table includes multiple feature fields corresponding to different public resource categories business, and the feature fields include: domain name and network device identifier; wherein, the network device identifier includes IP address and port number.

2. The method for identifying public resource-related services according to claim 1, characterized in that, The methods for determining the business rule table include: Obtain a sample set of PCAP data packets; Obtain the raw bitstream from each PCAP data packet sample to obtain a set of raw bitstream samples; A first data table is obtained based on the set of original bitstream samples; wherein the first data table includes a feature field corresponding to each original bitstream; the label of each feature field is the service category to which the PCAP data packet sample corresponding to each original bitstream belongs; Based on the first data table, a second data table is determined; wherein, the second data table includes multiple target feature fields; the target feature fields are the feature fields corresponding to the code streams belonging to public service business in the original code stream sample set; Based on the bitstream length information corresponding to the target feature field, the target feature field in the second data table is classified into business categories to obtain the business rule table.

3. The method for identifying public resource-related services according to claim 2, characterized in that, Based on the first data table, a second data table is determined, including: The feature fields in the first data table that correspond to at least two business functions are used as target feature fields; The second data table is constructed based on the target feature fields.

4. The method for identifying public resource-related services according to claim 2, characterized in that, Based on the bitstream length information corresponding to the target feature fields, the target feature fields in the second data table are classified into business categories to obtain the business rule table, including: The bitstream length information corresponding to multiple target feature fields is used as input to a classification algorithm based on association rules to obtain the business classification result to which each bitstream length information belongs; wherein, the business classification result includes: public resource business and other public business; The service classification result to which each bitstream length information belongs is used as the service classification result of the target feature field corresponding to the bitstream length information; The target feature field that belongs to the public resource category of the business classification result is used as the feature field in the business rule table.

5. The method for identifying public resource-related services according to claim 2, characterized in that, The bitstream length information corresponding to each of the target feature fields includes: The length of the original bitstream corresponding to the target feature field; The lengths of the N preceding and following bitstreams of the original bitstream corresponding to the target feature field; N is a positive integer.

6. A device for identifying public resource-related services, characterized in that, include: The first acquisition module is used to acquire the first raw bitstream from the first PCAP data packet; The second acquisition module is used to parse the HTTP and HTTPS protocol data in the first original code stream to obtain the feature fields corresponding to the first original code stream; The first processing module is configured to determine that the first original bitstream belongs to a public resource service if the feature field is located in the business rule table; wherein the business rule table includes multiple feature fields corresponding to different public resource services, and the feature fields include: domain name and network device identifier; wherein the network device identifier includes IP address and port number.

7. An identification device for public resource-related services, characterized in that, include: Transceiver and processor; The processor is used to obtain a first raw bitstream from a first PCAP data packet; Parse the HTTP and HTTPS protocol data in the first original bitstream to obtain the feature fields corresponding to the first original bitstream; If the feature field is located in the business rule table, then the first original bitstream is determined to belong to the public resource category business; wherein, the business rule table includes multiple feature fields corresponding to different public resource categories business, and the feature fields include: domain name and network device identifier; wherein, the network device identifier includes IP address and port number.

8. An identification device for public resource-related services, comprising: A transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; characterized in that, when the processor executes the program or instructions, it implements the identification method for public resource services as described in any one of claims 1-5.

9. A readable storage medium having a program or instructions stored thereon, characterized in that, When the program or instructions are executed by the processor, they implement the steps in the method for identifying public resource-type services as described in any one of claims 1-5.

Images