Traffic mirroring system, policy updating method and related apparatus, storage medium

Abstract

The embodiment of the application discloses a traffic mirroring system, a policy updating method and related devices and a storage medium. The traffic mirroring system comprises a policy module, at least one deep packet inspection (DPI) device and a traffic receiving module. Each DPI device in the at least one DPI device is configured to mirror traffic matched by a mirroring policy to the traffic receiving module. The at least one DPI device comprises a first DPI device configured to extract traffic features corresponding to the first mirroring policy when the first type of traffic is matched by the first mirroring policy, and report the traffic features to the policy module. The policy module is configured to update the first mirroring policy by using the traffic features, and distribute the updated first mirroring policy to each DPI device, or at least to the DPI device of the second type of traffic.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of communication, and in particular, to a traffic mirroring system, a policy updating method, related devices, and a storage medium. BACKGROUND

[0002] Deep packet inspection (DPI) devices are used to enhance the processing capability of 4-7 layer protocols, and can parse and identify high layer information according to predefined means, and intervene in data flow as needed. The DPI device mainly has five logical functions: service identification, filtering distribution, log, statistics, and flow control, wherein the service identification is the basis for implementing all functions.

[0003] Currently, the DPI device can use the traffic passing through the mirroring policy device to perform traffic mirroring. However, there are often cases where the uplink traffic and the downlink traffic of a piece of traffic pass through different DPI devices, that is, asymmetric traffic. If the feature of the mirroring policy only appears in the single-side traffic, the DPI device cannot mirror the complete traffic. SUMMARY

[0004] Embodiments of the present application provide a traffic mirroring system, a policy updating method, related devices, and a storage medium. By extracting traffic features and updating and issuing real-time policies of a policy module, complete traffic mirroring in the case of asymmetric traffic can be achieved.

[0005] The technical solution of the embodiments of the present application is implemented as follows:

[0006] The embodiments of the present application provide a traffic mirroring system, which includes a policy module, at least one deep packet inspection (DPI) device, and a traffic receiving module.

[0007] Each DPI device in the at least one DPI device is configured to mirror traffic matched by a mirroring policy to the traffic receiving module.

[0008] The at least one DPI device includes a first DPI device, which is configured to extract traffic features corresponding to a first mirroring policy when the first DPI device matches the first type of traffic using the first mirroring policy, and report the traffic features to the policy module. The first type of traffic is uplink traffic or downlink traffic, and the first mirroring policy only supports matching the first type of traffic.

[0009] The policy module is configured to update the first mirroring policy by using the traffic feature, and to distribute the updated first mirroring policy to each DPI device, or at least to the DPI device of the second type of traffic; wherein the second type of traffic is a unidirectional traffic different from the first type of traffic, and the updated first mirroring policy supports matching the first type of traffic and the second type of traffic.

[0010] In the system, the traffic feature includes one or more of the five-tuple information.

[0011] The policy module is configured to combine one or more of the five-tuple information with the first mirroring policy to obtain the updated first mirroring policy.

[0012] In the system, the policy module is further configured to receive at least one mirroring policy distributed by an upper system, and to distribute the at least one mirroring policy to the at least one DPI device.

[0013] The at least one mirroring policy includes the first mirroring policy.

[0014] In the system, the policy module is further configured to perform format unification on the at least one mirroring policy in a case where the at least one mirroring policy is derived from different upper systems.

[0015] In the system, the policy module is further configured to define a corresponding first identifier for each policy in the at least one mirroring policy, and to use the corresponding first identifier to count or distinguish the asymmetric mirroring traffic.

[0016] In the system, when the policy module updates the first mirroring policy by using the traffic feature, the policy module updates the first identifier corresponding to the first mirroring policy.

[0017] In the system, the policy module is further configured to classify the at least one mirroring policy, to distinguish a first type of mirroring policy and a second type of mirroring policy, and to refuse to receive the traffic feature corresponding to the second type of mirroring policy reported by any DPI.

[0018] The first type of mirroring policy only supports matching the first type of traffic, and the second type of mirroring policy supports matching the first type of traffic and the second type of traffic.

[0019] Embodiments of the present application provide a policy updating method, applied to a first DPI device, and the method comprises the following steps.

[0020] The traffic feature corresponding to the first mirroring strategy is extracted when the first mirroring strategy is matched to the first type of traffic; wherein the first type of traffic is uplink traffic or downlink traffic, and the first mirroring strategy only supports matching the first type of traffic;

[0021] The traffic feature is reported to a policy module, so that the policy module updates the first mirroring strategy based on the traffic feature, and the updated first mirroring strategy supports matching the first type of traffic and a second type of traffic; wherein the second type of traffic is a unidirectional traffic different from the first type of traffic.

[0022] Embodiments of the present application provide a policy updating method, applied to a policy module, and the method comprises:

[0023] The traffic feature corresponding to the first mirroring strategy reported by a first DPI device is received; wherein the first mirroring strategy only supports matching a first type of traffic, and the first type of traffic is uplink traffic or downlink traffic;

[0024] The first mirroring strategy is updated by using the traffic feature, and the updated first mirroring strategy is distributed to each DPI device or at least a DPI device of a second type of traffic; wherein the second type of traffic is a unidirectional traffic different from the first type of traffic, and the updated first mirroring strategy supports matching the first type of traffic and the second type of traffic.

[0025] In the above method, the traffic feature comprises one or more items of five-tuple information, and the first mirroring strategy is updated by using the traffic feature, comprising:

[0026] One or more items of the five-tuple information are merged with the first mirroring strategy to obtain the updated first mirroring strategy.

[0027] In the above method, before the traffic feature corresponding to the first mirroring strategy reported by the first DPI device is received, the method further comprises:

[0028] At least one mirroring strategy distributed by an upper system is received, and the at least one mirroring strategy is distributed to the at least one DPI device;

[0029] The at least one mirroring strategy comprises the first mirroring strategy.

[0030] In the above method, after the at least one mirroring strategy distributed by the upper system is received, the method further comprises:

[0031] In the case that the at least one mirroring strategy is derived from different upper systems, the at least one mirroring strategy is uniformly formatted.

[0032] In the method, after receiving the at least one mirroring policy issued by the upper system, the method further comprises:

[0033] A corresponding first identifier is defined for each of the at least one mirroring policy, and the first identifier is used to count or distinguish the asymmetric mirroring traffic.

[0034] In the method, the first identifier is used to count or distinguish the asymmetric mirroring traffic, comprising:

[0035] When the first mirroring policy is updated according to the traffic characteristics, the first identifier corresponding to the first mirroring policy is updated.

[0036] In the method, after receiving the at least one mirroring policy issued by the upper system, the method further comprises:

[0037] The at least one mirroring policy is classified to distinguish a first type of mirroring policy and a second type of mirroring policy.

[0038] The second type of mirroring policy corresponding to the traffic characteristics reported by any DPI is rejected.

[0039] The first type of mirroring policy only supports matching the first type of traffic, and the second type of mirroring policy supports matching the first type of traffic and the second type of traffic.

[0040] Embodiments of the present application provide a first DPI device, comprising a first processor, a first memory and a first communication bus.

[0041] The first communication bus is used to realize the communication connection between the first processor and the first memory.

[0042] The first processor is used to execute one or more computer programs stored in the first memory to apply a policy updating method to the first DPI device.

[0043] Embodiments of the present application provide a policy module, comprising a second processor, a second memory and a second communication bus.

[0044] The second communication bus is used to realize the communication connection between the second processor and the second memory.

[0045] The second processor is used to execute one or more computer programs stored in the second memory to realize a policy updating method applied to the policy module.

[0046] The embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed to realize the policy updating method.

[0047] The embodiment of the present application provides a flow mirroring system, a policy updating method and related devices and a storage medium. The flow mirroring system comprises a policy module, at least one deep packet inspection (DPI) device and a flow receiving module. Each of the at least one DPI device is configured to mirror flow matched by a mirroring policy to the flow receiving module. The at least one DPI device comprises a first DPI device configured to extract flow characteristics corresponding to the first mirroring policy when the first type flow is matched by the first mirroring policy, and report the flow characteristics to the policy module. The first type flow is uplink flow or downlink flow, and the first mirroring policy only supports matching the first type flow. The policy module is configured to update the first mirroring policy by using the flow characteristics, and distribute the updated first mirroring policy to each of the DPI devices, or at least to the DPI device of the second type flow. The second type flow is different from the first type flow, and the updated first mirroring policy supports matching the first type flow and the second type flow. The technical scheme provided by the embodiment of the present application can realize complete flow mirroring in the asymmetric flow condition by extracting flow characteristics and real-time policy updating and distribution of the policy module. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 A structure schematic diagram of a flow mirroring system provided by the embodiment of the present application is shown in the figure.

[0049] Figure 2 A scheme schematic diagram of flow mirroring provided by the embodiment of the present application is shown in the figure.

[0050] Figure 3 A flow schematic diagram of a policy updating method provided by the embodiment of the present application is shown in the figure. Figure 1

[0051] Figure 4 A flow schematic diagram of a policy updating method provided by the embodiment of the present application is shown in the figure. Figure 2

[0052] Figure 5 A structure schematic diagram of a first DPI device provided by the embodiment of the present application is shown in the figure.

[0053] Figure 6 A structure schematic diagram of a policy module provided by the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0054] ​​In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application.

[0055] The technical solutions of the present application and how the technical solutions solve the above technical problems will be described in detail below through embodiments and in combination with the accompanying drawings. The following embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments.

[0056] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0057] The embodiments of the present application provide a traffic mirroring system. Figure 1 As shown in the structural schematic diagram of the traffic mirroring system provided by the embodiments of the present application, Figure 1 In the embodiments of the present application, the traffic mirroring system comprises a policy module 10, at least one DPI device 20 and a traffic receiving module 30.

[0058] Each DPI device 20 in the at least one DPI device 20 is configured to mirror the traffic matched by the mirroring policy to the traffic receiving module 30.

[0059] The at least one DPI device 20 comprises a first DPI device configured to extract the traffic characteristics corresponding to the first mirroring policy when the first type of traffic is matched by the first mirroring policy, and report the traffic characteristics to the policy module 10; wherein the first type of traffic is uplink traffic or downlink traffic, and the first mirroring policy only supports matching the first type of traffic.

[0060] The policy module 10 is configured to update the first mirroring policy by using the traffic characteristics, and distribute the updated first mirroring policy to each DPI device 20, or at least to the DPI device 20 of the second type of traffic; wherein the second type of traffic is a unidirectional traffic different from the first type of traffic, and the updated first mirroring policy supports matching the first type of traffic and the second type of traffic.

[0061] It should be noted that in the embodiments of the present application, the number of DPI devices 20 in the traffic mirroring system can be one or more, and the specific number of DPI devices 20 can be set according to actual needs and application scenarios, which is not limited by the embodiments of the present application.

[0062] It should be noted that in the embodiments of the present application, each DPI device 20 can mirror the traffic matched by the mirror strategy to the traffic receiving module 30, wherein the mirror strategies used by each DPI device 20 can be the same or different, and the embodiments of the present application are not limited.

[0063] It should be noted that in the embodiments of the present application, the first DPI device can be any DPI device 20 in the traffic mirroring system, and the first mirror strategy only supports matching the first type of traffic, and the first type of traffic is uplink traffic or downlink traffic, that is, the first mirror strategy actually only supports matching a certain unidirectional traffic. For example, the first mirror strategy is a four-seven layer strategy, and the fields involved in these strategies often appear in uplink traffic, and downlink traffic generally has no matching features. Based on this, the first DPI device can match the uplink traffic by using the first mirror strategy when the uplink traffic passes, thereby mirroring the uplink traffic to the traffic receiving module 30. The specific first DPI device, first mirror strategy, and first type of traffic are not limited in the embodiments of the present application.

[0064] It can be understood that in the embodiments of the present application, the first mirror strategy can be specific fields, features, etc., and the first mirror strategy supports matching the first type of traffic, that is, the fields, features, etc. indicated by the first mirror strategy will appear in the first type of traffic.

[0065] In the embodiments of the present application, when the first DPI device matches the first type of traffic by using the first mirror strategy, the traffic features are extracted again. The traffic features include one or more of the five-tuple information, that is, the source Internet Protocol (IP), the destination IP, the source port, the destination port, and one or more of the protocol type, and the first DPI device reports it to the policy module 10. The policy module 10 is used to combine one or more of the five-tuple information with the first mirror strategy to obtain an updated first mirror strategy.

[0066] It can be understood that in the embodiments of the present application, the traffic features can include one or more of the five-tuple information, because the five-tuple information is a feature that does not need to be associated with uplink and downlink features, and the first DPI device reports it to the policy module 10. In this way, the policy module 10 updates the first mirror strategy, so that the updated first mirror strategy supports matching the first type of traffic and the second type of traffic, that is, bidirectional traffic. Of course, the traffic features can also be other features, which are not related to uplink and downlink features, and the embodiments of the present application are not limited.

[0067] It should be noted that in the embodiments of the present application, the updated first mirror image strategy supports matching the first type of traffic and the second type of traffic, wherein the second type of traffic is unidirectional traffic different from the first type of traffic, if the first type of traffic is uplink traffic, the second type of traffic is downlink traffic, if the first type of traffic is downlink traffic, the second type of traffic is uplink traffic.

[0068] It can be understood that in the embodiments of the present application, since the updated first mirror image strategy supports matching bidirectional traffic, based on this, the policy module 10 can distribute the updated first mirror image strategy to each DPI device 20 after updating the first mirror image strategy, to ensure complete traffic mirroring. Of course, considering the case that the uplink traffic and the downlink traffic of a piece of traffic pass through different DPI devices 20, i.e. the traffic is asymmetric, the first DPI device in the traffic mirroring system has realized the matching of the first type of traffic, therefore, the updated first mirror image strategy can also be distributed to at least the DPI device 20 that passes through the second type of traffic, i.e. all devices other than the DPI device 20 that only passes through the first type of traffic, to hit the corresponding second type of traffic, to ensure complete traffic mirroring.

[0069] The following is based on the scheme diagram of traffic mirroring shown in Figure 2 The related subjects involved in the present application are specifically described in combination with the above scheme.

[0070] In the embodiments of the present application, referring to Figure 2 The policy module 10 has the functions of policy receiving, policy backfilling, policy classification, policy distribution, etc.

[0071] In the embodiments of the present application, the policy module 10 is configured to receive at least one mirror image strategy distributed by an upper system, and distribute the at least one mirror image strategy to at least one DPI device 20; wherein the at least one mirror image strategy includes the above-mentioned first mirror image strategy.

[0072] In the embodiments of the present application, the policy module 10 is further configured to, in the case that the at least one mirror image strategy originates from different upper systems, unify the format of the at least one mirror image strategy.

[0073] It can be understood that in the embodiments of the present application, the policy module 10 can receive the traffic mirror image strategy distributed by the upper system, define / reuse the upper system strategy identifier, i.e. the policy identity identifier (Identity Document, ID) 1, for each mirror image strategy, to ensure uniqueness, and unify the strategy format for multiple upper systems, see Table 1 below:

[0074] Table 1

[0075]

[0076]

[0077] In the embodiments of the present application, referring to Figure 2 , and according to the foregoing content about the first DPI device reporting the traffic characteristics, the policy receiving function of the policy module 10 can not only receive the mirroring policy issued by the upper system, but also receive the traffic characteristics reported by the DPI device 20.

[0078] In the embodiments of the present application, in combination with the foregoing content about the first DPI device reporting the traffic characteristics, the policy module 10 can receive the information of the five-tuple or any combination thereof returned by the first DPI device for the policy ID 1. For example, when the policy ID 1 = 15, the first DPI device returns the partial five-tuple information or any combination thereof of ID 1 = 15 to the policy module 10 after matching to the uplink traffic by using the first mirroring policy, and the specific returned information is shown in Table 2:

[0079] Table 2

[0080] Policy ID 1 Policy ID 2 Source IP Destination IP Source Port Destination Port Protocol Type 15 Fillable X1 X2 X3 X4 X5

[0081] Among them, X1-X5 must be at least one, and can be combined in any way.

[0082] In the embodiments of the present application, referring to Figure 2 , the policy module 10 also has a policy backfill function, that is, the policy module 10 merges / backfills the policies with the same policy ID 1 according to the traffic characteristics received by the policy module 10, so as to realize the mirroring policy update, that is, the specific implementation manner of updating the first mirroring policy by using the traffic characteristics.

[0083] It should be noted that, in the embodiments of the present application, in order to better ensure the uniqueness of the policy or distinguish / statistics the asymmetric mirroring traffic, the policy module 10 is also used to define the corresponding first identifier for each policy in at least one mirroring policy, and to use the corresponding first identifier to distinguish or statistics the asymmetric mirroring traffic, in combination with the foregoing content about the first DPI device reporting the traffic characteristics, the policy module 10 is used to update the first identifier corresponding to the first mirroring policy when updating the first mirroring policy by using the traffic characteristics. Specifically, the first identifier is the policy ID 2 in Table 1 and Table 2, the policy ID 2 can be encoded, and the ID 2 is updated each time the merging / backfilling is performed, so as to ensure the global uniqueness.

[0084] In the embodiments of the present application, referring to Figure 2The policy module 10 further has a policy classification function for classifying at least one mirror policy, distinguishing a first type of mirror policy from a second type of mirror policy, and rejecting any traffic feature corresponding to the second type of mirror policy reported by the DPI. The first type of mirror policy only supports matching the first type of traffic, and the second type of mirror policy supports matching the first type of traffic and the second type of traffic. The first mirror policy is the first type of mirror policy, and the updated first mirror policy is the second type of mirror policy.

[0085] For example, in the embodiments of the present application, the first type of mirror policy can be a four-seven layer policy, such as a specific SNI (HTTPS protocol), Host, URI, User-Agent, Refer field, etc. Such features often appear in uplink traffic, and there are generally no matching features in downlink traffic, including the following categories: URI, Content-Type, Host, x-online-host, Referer, User-Agent, Pragma, X-Requested-With, c_version, X-Umeng-Sdk, Client-Agent, appname, DPUName, actionlocation, Cookie, Q-UA, X-Session-Type, Server, bundle, etc. The second type of mirror policy can be a three-layer policy: such as five-tuple, five-tuple combination, TCP protocol, UDP protocol, etc. without the need for uplink and downlink feature association.

[0086] It should be noted that in the embodiments of the present application, the policy classification function is optional, i.e., the policy module 10 can have this function or not have this function, and the embodiments of the present application do not limit it.

[0087] In the embodiments of the present application, referring to Figure 2 The policy module 10 further has a policy classification function for classifying at least one mirror policy, distinguishing a first type of mirror policy from a second type of mirror policy, and rejecting any traffic feature corresponding to the second type of mirror policy reported by the DPI. The first type of mirror policy only supports matching the first type of traffic, and the second type of mirror policy supports matching the first type of traffic and the second type of traffic. The first mirror policy is the first type of mirror policy, and the updated first mirror policy is the second type of mirror policy.

[0088] In the embodiments of the present application, referring to Figure 2 The traffic receiving module 30 receives the traffic mirrored by each DPI device 20.

[0089] It should be noted that in the embodiments of the present application, the traffic receiving module 30 can be separately arranged, arranged together with a DPI device 20, arranged together with all DPI devices 20, arranged together with the policy module 10, and can also belong to other systems. Among them, if the traffic receiving module 30, the policy module 10 and each DPI device 20 are arranged together, each unidirectional traffic needs to be mirrored to the traffic receiving module 30 of all DPI devices 20 respectively.

[0090] The embodiments of the present application provide a policy updating method applied to a first DPI device. Figure 3 The embodiments of the present application provide a policy updating method applied to a first DPI device. Figure 1 As shown in Figure 3 , the method applied to the first DPI device mainly includes the following steps:

[0091] S101, when a first mirror policy is matched to a first type of traffic, extracting a traffic feature corresponding to the first mirror policy; wherein the first type of traffic is uplink traffic or downlink traffic, and the first mirror policy only supports matching the first type of traffic;

[0092] S102, reporting the traffic feature to the policy module, so that the policy module updates the first mirror policy based on the traffic feature, so that the updated first mirror policy supports matching the first type of traffic and a second type of traffic; wherein the second type of traffic is different from the first type of traffic.

[0093] It should be noted that in the embodiments of the present application, the steps performed by the first DPI device, and the related first mirror policy, first type of traffic, traffic feature, updated first mirror policy, and second type of traffic are consistent with the above-mentioned content in the traffic mirroring system, and will not be repeated here.

[0094] The embodiments of the present application provide a policy updating method applied to a policy module 10. Figure 4 The embodiments of the present application provide a policy updating method applied to a first DPI device. Figure 2 As shown in Figure 4 , the method applied to the policy module mainly includes the following steps:

[0095] S201, receiving a traffic feature corresponding to a first mirror policy reported by a first DPI device; wherein the first mirror policy only supports matching a first type of traffic, and the first type of traffic is uplink traffic or downlink traffic;

[0096] S202, updating the first mirror strategy by using the traffic feature, and delivering the updated first mirror strategy to each DPI device, or at least to the DPI device of the second type of traffic; wherein the second type of traffic is a unidirectional traffic different from the first type of traffic, and the updated first mirror strategy supports matching the first type of traffic and the second type of traffic.

[0097] In an embodiment of the present application, the traffic feature includes one or more of the five-tuple information, and the policy module 10 updates the first mirror strategy by using the traffic feature, including: merging one or more of the five-tuple information with the first mirror strategy to obtain the updated first mirror strategy.

[0098] In an embodiment of the present application, before the policy module receives the traffic feature corresponding to the first mirror strategy reported by the first DPI device, the policy module can further perform the following steps: receiving at least one mirror strategy delivered by an upper system, and delivering the at least one mirror strategy to at least one DPI device 20; wherein the at least one mirror strategy includes the first mirror strategy.

[0099] In an embodiment of the present application, after the policy module receives the at least one mirror strategy delivered by the upper system, the policy module can further perform the following steps: in the case that the at least one mirror strategy originates from different upper systems, performing format unification on the at least one mirror strategy.

[0100] In an embodiment of the present application, after the policy module receives the at least one mirror strategy delivered by the upper system, the policy module can further perform the following steps: defining a corresponding first identifier for each strategy in the at least one mirror strategy, and using the corresponding first identifier to count or distinguish the asymmetric mirror traffic.

[0101] In an embodiment of the present application, the policy module uses the corresponding first identifier to count or distinguish the asymmetric mirror traffic, including: when updating the first mirror strategy by using the traffic feature, updating the first identifier corresponding to the first mirror strategy.

[0102] In an embodiment of the present application, after the policy module receives the at least one mirror strategy delivered by the upper system, the policy module can further perform the following steps: classifying the at least one mirror strategy to distinguish a first type of mirror strategy and a second type of mirror strategy; and rejecting to receive the traffic feature corresponding to the second type of mirror strategy reported by any DPI; wherein the first type of mirror strategy only supports matching the first type of traffic, and the second type of mirror strategy supports matching the first type of traffic and the second type of traffic.

[0103] It should be noted that, in an embodiment of the present application, the steps performed by the policy module are consistent with the content described in the above traffic mirroring system, and will not be described here.

[0104] The embodiment of the present application provides a first DPI device, Figure 5 A structural schematic diagram of a first DPI device provided by the embodiment of the present application is shown in the figure. Figure 5 The first DPI device comprises a first processor 301, a first memory 302 and a first communication bus 303.

[0105] The first communication bus 303 is used for realizing the communication connection between the first processor 301 and the first memory 302.

[0106] The first processor 301 is used for executing one or more computer programs stored in the first memory 302, so as to realize the policy updating method applied to the first DPI device.

[0107] The embodiment of the present application provides a policy module, Figure 6 A structural schematic diagram of a policy module provided by the embodiment of the present application is shown in the figure. Figure 6 The policy module comprises a second processor 401, a second memory 402 and a second communication bus 403.

[0108] The second communication bus 403 is used for realizing the communication connection between the second processor 401 and the second memory 402.

[0109] The second processor 401 is used for executing one or more computer programs stored in the second memory 402, so as to realize the policy updating method applied to the policy module.

[0110] The embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed to realize the above-mentioned policy updating method. The computer readable storage medium can be a volatile memory (volatile memory), such as random access memory (Random-Access Memory, RAM); or non-volatile memory (non-volatile memory), such as read-only memory (Read-Only Memory, ROM), flash memory (flash memory), hard disk (Hard Disk Drive, HDD) or solid state disk (Solid-State Drive, SSD); it can also be a device including one or any combination of the above-mentioned memories, such as mobile phone, computer, tablet device, personal digital assistant, etc.

[0111] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0112] This application is described with reference to schematic and / or block diagrams of implementations of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the schematic and / or block diagrams can be implemented by computer program instructions, and combinations of blocks in the schematic and / or block diagrams can be implemented. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the schematic and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0113] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the implementation flow diagram. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0114] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0115] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A traffic mirroring system, characterized in that, include: A strategy module, at least one deep packet inspection (DPI) device, and a traffic receiving module; Each of the at least one DPI device is used to mirror the traffic matched using the mirroring strategy to the traffic receiving module; The at least one DPI device includes a first DPI device, which is used to extract traffic features corresponding to the first mirroring strategy when the first type of traffic is matched using the first mirroring strategy, and report the traffic features to the strategy module; wherein, the first type of traffic is uplink traffic or downlink traffic, and the first mirroring strategy only supports matching the first type of traffic. The strategy module is used to update the first mirroring strategy using the traffic characteristics, and to distribute the updated first mirroring strategy to each DPI device, or at least to DPI devices that have passed through the second type of traffic; wherein the second type of traffic is unidirectional traffic that is different from the first type of traffic, and the updated first mirroring strategy supports matching the first type of traffic and the second type of traffic.

2. The system according to claim 1, characterized in that, The traffic characteristics include one or more of the five-tuple information; The strategy module is used to merge one or more of the five-tuple information with the first mirroring strategy to obtain the updated first mirroring strategy.

3. The system according to claim 1, characterized in that, The policy module is also used to receive at least one mirroring policy from the upper layer system and send the at least one mirroring policy to the at least one DPI device; The at least one mirroring strategy includes the first mirroring strategy.

4. The system according to claim 3, characterized in that, The strategy module is also used to unify the format of the at least one mirror strategy when the at least one mirror strategy originates from different upper-layer systems.

5. The system according to claim 3, characterized in that, The strategy module is further configured to define a corresponding first identifier for each strategy in the at least one mirroring strategy, and use the corresponding first identifier to count or distinguish asymmetric mirroring traffic.

6. The system according to claim 5, characterized in that, The strategy module is used to update the first identifier corresponding to the first mirroring strategy when updating the first mirroring strategy using the traffic characteristics.

7. The system according to claim 3, characterized in that, The strategy module is also used to classify the at least one mirroring strategy, distinguish between a first type of mirroring strategy and a second type of mirroring strategy, and refuse to receive traffic features corresponding to the second type of mirroring strategy reported by any DPI. The first type of mirroring policy only supports matching the first type of traffic, while the second type of mirroring policy supports matching both the first type of traffic and the second type of traffic.

8. A strategy update method, characterized in that, Applied to a first DPI device, the method includes: When the first type of traffic is matched using the first mirroring strategy, the traffic features corresponding to the first mirroring strategy are extracted; wherein, the first type of traffic is uplink traffic or downlink traffic, and the first mirroring strategy only supports matching the first type of traffic; The traffic characteristics are reported to the policy module so that the policy module can update the first mirroring policy based on the traffic characteristics, so that the updated first mirroring policy can support matching the first type of traffic and the second type of traffic; wherein, the second type of traffic is unidirectional traffic that is different from the first type of traffic.

9. A strategy update method, characterized in that, Applied to the strategy module, the method includes: Receive traffic characteristics corresponding to the first mirroring policy reported by the first DPI device; wherein, the first mirroring policy only supports matching the first type of traffic, which is either uplink traffic or downlink traffic; The first mirroring policy is updated using the traffic characteristics, and the updated first mirroring policy is distributed to each DPI device, or at least to DPI devices that have passed through the second type of traffic; wherein the second type of traffic is unidirectional traffic that is different from the first type of traffic, and the updated first mirroring policy supports matching the first type of traffic and the second type of traffic.

10. The method according to claim 9, characterized in that, The traffic features include one or more of the five-tuple information, and updating the first mirroring policy using the traffic features includes: One or more of the five-tuple information are combined with the first mirroring strategy to obtain the updated first mirroring strategy.

11. The method according to claim 9, characterized in that, Before receiving the traffic characteristics corresponding to the first mirroring policy reported by the first DPI device, the method further includes: Receive at least one mirroring policy from the upper-layer system and send the at least one mirroring policy to the at least one DPI device; The at least one mirroring strategy includes the first mirroring strategy.

12. The method according to claim 11, characterized in that, After receiving at least one mirroring policy from the upper-layer system, the method further includes: When the at least one mirroring strategy originates from different upper-layer systems, the format of the at least one mirroring strategy is unified.

13. The method according to claim 11, characterized in that, After receiving at least one mirroring policy from the upper-layer system, the method further includes: Define a first identifier for each strategy in the at least one mirroring strategy, and use the corresponding first identifier to count or distinguish asymmetric mirroring traffic.

14. The method according to claim 13, characterized in that, The step of using the corresponding first identifier to count or distinguish asymmetric mirrored traffic includes: When updating the first mirroring policy using the traffic characteristics, the first identifier corresponding to the first mirroring policy is updated.

15. The method according to claim 11, characterized in that, After receiving at least one mirroring policy from the upper-layer system, the method further includes: The at least one mirroring strategy is classified to distinguish between a first type of mirroring strategy and a second type of mirroring strategy; Refuse to receive traffic characteristics corresponding to the second type of mirroring policy reported by any DPI; The first type of mirroring policy only supports matching the first type of traffic, while the second type of mirroring policy supports matching both the first type of traffic and the second type of traffic.

16. A first DPI device, characterized in that, include: A first processor, a first memory, and a first communication bus; The first communication bus is used to establish a communication connection between the first processor and the first memory; The first processor is configured to execute one or more computer programs stored in the first memory to implement the policy update method of claim 8.

17. A strategy module, characterized in that, include: A second processor, a second memory, and a second communication bus; The second communication bus is used to establish a communication connection between the second processor and the second memory; The second processor is configured to execute one or more computer programs stored in the second memory to implement the policy update method according to any one of claims 9-15.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the policy update method as described in any one of claims 8-15.

Images