A service feature recognition method, device, recognition equipment and readable storage medium

Abstract

The application provides a service feature recognition method and device, a recognition equipment and a readable storage medium, and relates to the technical field of communication. The method comprises the following steps: obtaining a first message corresponding to a measured application, wherein the first message is obtained by performing stress testing on the measured application; performing message analysis on the first message to obtain message analysis data; performing service feature recognition processing on the message analysis data based on a machine learning algorithm to obtain the service feature of the measured application. The scheme of the application solves the problem that the existing feature discovery method is prone to missing service characteristics.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a service feature identification method, apparatus, identification device, and readable storage medium. Background Technology

[0002] With the rapid development of the mobile internet, network application services are becoming increasingly diversified, and network structures are becoming more complex. Identifying and classifying services using Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and proprietary protocols presents challenges; therefore, service feature discovery is particularly important.

[0003] To improve the service identification rate of network traffic, a customized Deep Packet Inspection (DPI) protocol analysis feature format specification was developed. This specification identifies packets based on port number, packet length, the relationship between bytes and data length within the packet, byte operators, string operators, single-byte comparison operations, custom operations, Internet Protocol (IP) operators, and arbitrary positional operators. Existing technologies typically employ manual analysis, using Wireshark to examine the binary protocol characteristics within captured packets and then formatting them into a feature format suitable for the DPI system.

[0004] However, manual analysis has certain limitations. Its feature search is usually limited to the first few bytes of the message, making it difficult to perform a global search. This can easily lead to the omission of business features, making it difficult to meet the needs of the complex business types and massive amounts of data in the current Internet. Summary of the Invention

[0005] The purpose of this invention is to provide a business feature identification method, apparatus, identification device, and readable storage medium, which solves the problem that existing feature discovery methods are prone to missing business features.

[0006] To achieve the above objectives, embodiments of the present invention provide a business feature identification method, comprising:

[0007] Obtain the first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test;

[0008] The first message is parsed to obtain message parsing data;

[0009] Based on machine learning algorithms, the message parsing data is processed to identify business features, thereby obtaining the business features of the application under test.

[0010] Optionally, the message parsing data includes at least one payload data item;

[0011] The process of performing business feature identification processing on the parsed message data based on machine learning algorithms to obtain the business features of the application under test includes:

[0012] Based on the pre-configured information, feature analysis is performed on the parsed message data to obtain the expression of the service feature;

[0013] Based on machine learning algorithms, substring analysis is performed on the load data, and expressions with arbitrary position operator operations are generated according to feature specifications.

[0014] Based on machine learning algorithms, association rule analysis is performed on the message parsing data, the expression of the business features, and the expression of the arbitrary position operator operation to obtain the business features of the application under test.

[0015] Optionally, the pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio;

[0016] The step of performing feature analysis on the message parsing data based on pre-configured information to obtain the expression of the service feature includes:

[0017] The payload data is divided into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length;

[0018] Based on the support threshold and / or the positional entropy ratio, at least one subbyte is selected from the initial set to form a first target set; and,

[0019] Based on the preset length value, at least one subbyte is selected from the initial set to form a second target set;

[0020] Based on a multi-pattern matching algorithm, the load data, the first target set, and the second target set are matched to obtain the position information of at least one target subbyte. The target subbyte is a subbyte that belongs to the union of the first target set and the second target set and appears in each load data.

[0021] Based on the position information of the target subbyte, an expression for the business feature is generated according to the feature specification.

[0022] Optionally, the expression for the service feature includes: an expression for byte operators, and / or an expression for the relationship between bytes and payload length in the message.

[0023] Optionally, based on the support threshold and the positional entropy ratio, at least one subbyte is selected from the initial set to form a first target set, including:

[0024] From the initial set, subbytes with support greater than or equal to the support threshold are selected to form the first set;

[0025] Based on the load data, determine the position entropy corresponding to each subbyte in the first set, wherein the position entropy is determined according to the position of the subbyte in the load data;

[0026] According to the order of position entropy from smallest to largest, the first N sub-bytes are selected from the first set to form the first target set, where N is a positive integer determined based on the total number of elements in the first set and the proportion of position entropy.

[0027] Optionally, N is equal to the integer part of the product of the total number of elements in the first set and the proportion of the positional entropy.

[0028] Optionally, determining the position entropy corresponding to each subbyte in the first set based on the load data includes:

[0029] According to the formula: Determine the position entropy corresponding to the first subbyte in the first set;

[0030] Where H is the position entropy corresponding to the first sub-byte, index is the set of positions of sub-bytes in the payload data, and p(x i ) represents the probability of the first subbyte appearing at the i-th position.

[0031] Optionally, the message parsing data may further include the payload data length;

[0032] The step of selecting at least one subbyte from the initial set according to the preset length value to form a second target set includes:

[0033] Based on the preset length value, at least one subbyte that differs from the length of the load data by the preset length value is selected from the load data to form a second target set.

[0034] Optionally, the message parsing data may further include: the server's Internet Protocol (IP) address and port number;

[0035] The method, based on machine learning algorithms, performs association rule analysis on the parsed message data, the expressions of the business features, and the expressions of arbitrary position operator operations to obtain the business features of the application under test, including:

[0036] Using the server IP address, the port number, the expression operated on by the operator at any position, and the business category as frequent items, an association rule algorithm is used to identify the association rules between the business features and the business categories;

[0037] The leader of the association rule is determined as the business characteristic of the application under test.

[0038] Optionally, after obtaining the business characteristics of the application under test, the method further includes at least one of the following:

[0039] Output the business features according to the preset format;

[0040] Store the aforementioned business characteristics.

[0041] To achieve the above objectives, embodiments of the present invention provide a business feature recognition device, comprising:

[0042] The message acquisition module is used to acquire the first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test.

[0043] The message parsing module is used to parse the first message and obtain message parsing data;

[0044] The feature recognition module is used to perform business feature recognition processing on the message parsing data based on machine learning algorithms to obtain the business features of the application under test.

[0045] Optionally, the message parsing data includes at least one payload data item;

[0046] The feature recognition module includes:

[0047] The feature analysis submodule is used to perform feature analysis on the message parsing data according to pre-configured information to obtain the expression of the service feature;

[0048] The substring analysis submodule is used to perform substring analysis on the load data based on machine learning algorithms, and generate expressions with arbitrary position operator operations according to feature specifications;

[0049] The rule analysis submodule is used to perform association rule analysis on the message parsing data, the expression of the business features, and the expression of the arbitrary position operator operation based on machine learning algorithms, so as to obtain the business features of the application under test.

[0050] Optionally, the pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio;

[0051] The feature analysis submodule includes:

[0052] The first analysis unit is used to divide the payload data into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length;

[0053] The second analysis unit is configured to select at least one subbyte from the initial set based on the support threshold and / or the position entropy ratio, to form a first target set; and

[0054] The third analysis unit is used to select at least one subbyte from the initial set according to the preset length value to form a second target set;

[0055] The fourth analysis unit is used to perform matching processing on the load data, the first target set, and the second target set based on a multi-pattern matching algorithm to obtain the position information of at least one target subbyte. The target subbyte is: a subbyte that belongs to the union of the first target set and the second target set and appears in each load data.

[0056] The fifth analysis unit is used to generate an expression for the business feature according to the feature specification based on the position information of the target subbyte.

[0057] Optionally, the expression for the service feature includes: an expression for byte operators, and / or an expression for the relationship between bytes and payload length in the message.

[0058] Optionally, the second analysis unit includes:

[0059] The first analysis subunit is used to filter out subbytes with support greater than or equal to the support threshold from the initial set to form the first set;

[0060] The second analysis subunit is used to determine the position entropy corresponding to each subbyte in the first set based on the load data, wherein the position entropy is determined according to the position of the subbyte in the load data;

[0061] The third analysis subunit is used to select the top N sub-bytes from the first set according to the order of position entropy from smallest to largest, forming the first target set, where N is a positive integer determined based on the total number of elements in the first set and the proportion of position entropy.

[0062] Optionally, N is equal to the integer part of the product of the total number of elements in the first set and the proportion of the positional entropy.

[0063] Optionally, the second analysis subunit includes:

[0064] The fourth analysis subunit is used to analyze the formula: Determine the position entropy corresponding to the first subbyte in the first set;

[0065] Where H is the position entropy corresponding to the first sub-byte, index is the set of positions of sub-bytes in the payload data, and p(x i ) represents the probability of the first subbyte appearing at the i-th position.

[0066] Optionally, the message parsing data may further include the payload data length;

[0067] The third analysis unit includes:

[0068] The fifth analysis subunit is used to filter out at least one subbyte from the load data whose length differs from the preset length value, based on the preset length value, to form a second target set.

[0069] Optionally, the message parsing data may further include: the server's Internet Protocol (IP) address and port number;

[0070] The rule analysis submodule includes:

[0071] The sixth analysis unit is used to identify the association rules between the business features and the business categories by using the server IP address, the port number, the expression operated on by the operator at any position, and the business category as frequent items, through an association rule algorithm.

[0072] The seventh analysis unit is used to determine the precursor of the association rule as the business feature of the application under test.

[0073] Optionally, the device further includes:

[0074] The output module is used to output the business features according to a preset format;

[0075] A storage module is used to store the aforementioned business features.

[0076] To achieve the above objectives, embodiments of the present invention provide an identification device, including a processor and a transceiver, wherein the processor is used for:

[0077] Obtain the first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test;

[0078] The first message is parsed to obtain message parsing data;

[0079] Based on machine learning algorithms, the message parsing data is processed to identify business features, thereby obtaining the business features of the application under test.

[0080] Optionally, the message parsing data includes at least one payload data item;

[0081] When the processor performs business feature recognition processing on the parsed message data based on machine learning algorithms to obtain the business features of the application under test, it is specifically used for:

[0082] Based on the pre-configured information, feature analysis is performed on the parsed message data to obtain the expression of the service feature;

[0083] Based on machine learning algorithms, substring analysis is performed on the load data, and expressions with arbitrary position operator operations are generated according to feature specifications.

[0084] Based on machine learning algorithms, association rule analysis is performed on the message parsing data, the expression of the business features, and the expression of the arbitrary position operator operation to obtain the business features of the application under test.

[0085] Optionally, the pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio;

[0086] When the processor performs feature analysis on the message parsing data according to the pre-configured information to obtain the expression of the service feature, it is specifically used for:

[0087] The payload data is divided into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length;

[0088] Based on the support threshold and / or the positional entropy ratio, at least one subbyte is selected from the initial set to form a first target set; and,

[0089] Based on the preset length value, at least one subbyte is selected from the initial set to form a second target set;

[0090] Based on a multi-pattern matching algorithm, the load data, the first target set, and the second target set are matched to obtain the position information of at least one target subbyte. The target subbyte is a subbyte that belongs to the union of the first target set and the second target set and appears in each load data.

[0091] Based on the position information of the target subbyte, an expression for the business feature is generated according to the feature specification.

[0092] Optionally, the expression for the service feature includes: an expression for byte operators, and / or an expression for the relationship between bytes and payload length in the message.

[0093] Optionally, when the processor selects at least one subbyte from the initial set to form a first target set based on the support threshold and the position entropy ratio, it specifically performs the following:

[0094] From the initial set, subbytes with support greater than or equal to the support threshold are selected to form the first set;

[0095] Based on the load data, determine the position entropy corresponding to each subbyte in the first set, wherein the position entropy is determined according to the position of the subbyte in the load data;

[0096] According to the order of position entropy from smallest to largest, the first N sub-bytes are selected from the first set to form the first target set, where N is a positive integer determined based on the total number of elements in the first set and the proportion of position entropy.

[0097] Optionally, N is equal to the integer part of the product of the total number of elements in the first set and the proportion of the positional entropy.

[0098] Optionally, the processor determines the position entropy corresponding to each subbyte in the first set based on the load data, including:

[0099] According to the formula: Determine the position entropy corresponding to the first subbyte in the first set;

[0100] Where H is the position entropy corresponding to the first sub-byte, index is the set of positions of sub-bytes in the payload data, and p(x i ) represents the probability of the first subbyte appearing at the i-th position.

[0101] Optionally, the message parsing data may further include the payload data length;

[0102] The processor selects at least one subbyte from the initial set according to the preset length value to form a second target set, including:

[0103] Based on the preset length value, at least one subbyte that differs from the length of the load data by the preset length value is selected from the load data to form a second target set.

[0104] Optionally, the message parsing data may further include: the server's Internet Protocol (IP) address and port number;

[0105] The processor, based on a machine learning algorithm, performs association rule analysis on the parsed message data, the expression of the service features, and the expression of arbitrary position operator operations to obtain the service features of the application under test, including:

[0106] Using the server IP address, the port number, the expression operated on by the operator at any position, and the business category as frequent items, an association rule algorithm is used to identify the association rules between the business features and the business categories;

[0107] The leader of the association rule is determined as the business characteristic of the application under test.

[0108] Optionally, the processor is further configured to:

[0109] Output the business features according to the preset format;

[0110] Store the aforementioned business characteristics.

[0111] To achieve the above objectives, embodiments of the present invention provide an identification device, including a transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; when the processor executes the program or instructions, it implements the service feature identification method described above.

[0112] To achieve the above objectives, embodiments of the present invention provide a readable storage medium storing a program or instructions thereon, which, when executed by a processor, implement the steps in the business feature identification method described above.

[0113] The beneficial effects of the above-described technical solution of the present invention are as follows:

[0114] The method of this invention parses the first message obtained during testing to obtain message parsing data. Then, based on machine learning algorithms, it performs business feature identification processing on the message parsing data to obtain the business features of the application under test. This allows for automated business feature identification of the service under test, enabling rapid and efficient full-text analysis of the message. Compared to the manual analysis of partial bytes in existing technologies, this method not only improves business identification efficiency but also expands the analysis coverage, thus avoiding the problem of missing business characteristics. Attached Figure Description

[0115] Figure 1 This is a flowchart of the business feature recognition method according to an embodiment of the present invention;

[0116] Figure 2 This is a structural diagram of the business feature recognition device according to an embodiment of the present invention;

[0117] Figure 3 This is a structural diagram of the identification device according to an embodiment of the present invention;

[0118] Figure 4 This is a structural diagram of an identification device according to another embodiment of the present invention. Detailed Implementation

[0119] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0120] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the invention. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0121] In various embodiments of the present invention, it should be understood that the sequence number of each process described below does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0122] In addition, the terms "system" and "network" are often used interchangeably in this article.

[0123] In the embodiments provided in this application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0124] like Figure 1 As shown, an embodiment of the present invention provides a business feature identification method, comprising:

[0125] Step 101: Obtain the first message corresponding to the application under test. The first message is obtained by dialing the application under test.

[0126] Step 102: Parse the first message to obtain message parsing data.

[0127] In this step, the message parsing process performed on the first message may specifically include at least one of the following: process characteristic analysis software package (Packet Capture, PCAP) parsing, tunnel layer parsing such as GPRS Tunneling Protocol (GTP), Virtual Local Area Network (VLAN), and VXLAN, Enternet parsing, IP parsing, TCP parsing, UDP parsing, etc., and may also include UDP fragmentation and reassembly, TCP out-of-order processing, retransmission processing, segmentation and reassembly, etc.

[0128] The message parsing data obtained through message parsing may specifically include at least one of the following: the server IP address, port number, payload data, and payload data length in the protocol.

[0129] Step 103: Based on machine learning algorithms, perform business feature recognition processing on the message parsing data to obtain the business features of the application under test.

[0130] In this step, business feature analysis can be performed based on machine learning algorithms. Compared with the existing technology that focuses on analyzing the first few bytes of the message, the present invention can achieve automated analysis, which can cover the entire message, help to discover hidden business features, and improve analysis efficiency.

[0131] Here, the business characteristics of the application under test can specifically be the characteristics of its proprietary protocols, or characteristics of other protocols, such as TCP and UDP. Through the above steps, rapid and efficient analysis of binary protocols can be achieved, improving the efficiency of binary protocol feature discovery. This approach is more suitable for handling rapidly iterating internet services and has strong practicality.

[0132] It is understood that after the business characteristics of the application under test are obtained through the business characteristic identification method of the present invention, the business type, business traffic size, etc. of the application under test can be analyzed based on the business characteristics of the application under test. The business type of the users of the application under test can also be analyzed so as to make more accurate recommendations to users.

[0133] In this embodiment, by parsing the first message obtained during the test, message parsing data can be obtained. Then, based on machine learning algorithms, business feature identification processing can be performed on the message parsing data to obtain the business features of the application under test. This allows for automated business feature identification of the service under test, enabling rapid and efficient full-text analysis of the message. Compared to the manual analysis of partial bytes in existing technologies, this not only improves business identification efficiency but also expands the analysis coverage, thus avoiding the problem of missing business characteristics.

[0134] Optionally, the message parsing data includes at least one payload data.

[0135] As an optional embodiment, step 103 may specifically include the following steps:

[0136] Step 1031: Based on the pre-configuration information, perform feature analysis on the message parsing data to obtain the expression of the service feature.

[0137] Here, the pre-configuration information is the information configured for executing the business feature recognition method of the present invention, which may include the feature vectors and related parameters required for analysis. The purpose of configuring the feature vectors is to determine which data needs to be used for business feature recognition. For example, one or more of the following can be used for business feature recognition: server IP address, port number, load data, and load data length in the protocol. The related parameters may specifically include at least one of the following: subbyte length, preset length value support threshold, and position entropy ratio, etc.

[0138] Step 1032: Based on machine learning algorithms, perform substring analysis on the load data and generate expressions for arbitrary positional operator operations according to feature specifications.

[0139] For example, the format of an expression that operates on any position can be: {x|10|taobao.com}, which means that the string "tao bao.com" of length 10 appears in any position.

[0140] Step 1033: Based on machine learning algorithms, perform association rule analysis on the message parsing data, the expression of the business features, and the expression of the arbitrary position operator operation to obtain the business features of the application under test.

[0141] In this embodiment, expressions representing business characteristics can be obtained by analyzing message parsing data, and expressions for arbitrary positional operator operations can be obtained by analyzing load data through substring analysis algorithms. Then, association rule analysis can be performed on the obtained expressions and message parsing data to obtain the business characteristics of the application under test, thus realizing automated analysis of business characteristics.

[0142] Optionally, the pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio.

[0143] It should be noted that the support threshold here is a pre-configured value, and the location entropy ratio is a pre-configured proportion.

[0144] As an optional embodiment, step 1031 may specifically include the following steps:

[0145] (1) The payload data is divided into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length.

[0146] (2) Based on the support threshold and / or the position entropy ratio, at least one subbyte is selected from the initial set to form a first target set; and based on the preset length value, at least one subbyte is selected from the initial set to form a second target set.

[0147] The purpose of filtering the first target set and the second target set from the initial set in this step is to obtain the subbytes representing the business characteristics, so as to further analyze and determine the expression of the business characteristics based on the subbytes in the first target set and the second target set.

[0148] (3) Based on the multi-pattern matching algorithm, the load data, the first target set and the second target set are matched to obtain the position information of at least one target subbyte. The target subbyte is: a subbyte that belongs to the union of the first target set and the second target set and appears in each load data.

[0149] (4) Based on the position information of the target subbyte, generate an expression for the service feature according to the feature specification. The expression for the service feature may include: expressions for byte operators, and / or expressions relating the length of bytes and payload in the message.

[0150] For example, the format of the byte operator expression can be: {b|0|0x10}, {o|1|[0x12,0x23]}, and the format of the expression relating the length of bytes and payload in the message can be: {d|1|0x0203}.

[0151] By following the steps above, we can obtain expressions for business characteristics, which can be used to represent business characteristics.

[0152] As an optional embodiment, at least one subbyte is selected from the initial set based on the support threshold and the positional entropy ratio to form a first target set, including:

[0153] (1) From the initial set, select the subbytes whose support is greater than or equal to the support threshold to form the first set.

[0154] It should be noted that support represents the frequency with which the preceding and following items appear simultaneously in a dataset. Specifically, support refers to the frequency with which any two sub-bytes appear simultaneously in the initial set. If the frequency is greater than the support threshold, the two sub-bytes corresponding to that frequency are selected.

[0155] (2) Based on the load data, determine the position entropy corresponding to each subbyte in the first set, wherein the position entropy is determined according to the position of the subbyte in the load data;

[0156] (3) Select the first N sub-bytes from the first set in ascending order of position entropy to form the first target set, where N is a positive integer determined by the total number of elements in the first set and the position entropy ratio.

[0157] Typically, in the bitstream of the same service, subbytes that appear frequently and are in relatively fixed positions can represent the characteristics of that service or that proprietary protocol.

[0158] Understandably, subbytes with higher support are more likely to be considered business features; conversely, subbytes with lower positional entropy tend to appear in more fixed positions within the message, further increasing their likelihood of being considered business features. Therefore, a support threshold can be used to filter out frequently occurring subbytes, while a positional entropy percentage can be used to filter out subbytes with more fixed positions. By configuring support thresholds and positional entropy percentages to filter subbytes, the number of subbytes to be analyzed subsequently can be reduced, decreasing computational complexity.

[0159] In this embodiment, subbytes that meet the conditions can be selected from the initial set to form a first target set based on the pre-configured support threshold and position entropy ratio. This is to obtain some subbytes that can represent business features, so as to further analyze and determine the expression of business features based on the subbytes in the first target set.

[0160] In one alternative implementation, N is equal to the integer part of the product of the total number of elements in the first set and the percentage of the positional entropy.

[0161] Optionally, determining the position entropy corresponding to each subbyte in the first set based on the load data includes:

[0162] According to the formula: Determine the position entropy corresponding to the first subbyte in the first set; where H is the position entropy corresponding to the first subbyte, index is the set of positions of subbytes in the payload data, and p(x i ) represents the probability of the first subbyte appearing at the i-th position.

[0163] Optionally, the message parsing data may also include the payload data length.

[0164] As an optional embodiment, the step of selecting at least one subbyte from the initial set according to the preset length value to form a second target set includes: selecting at least one subbyte from the load data whose length differs from the preset length value from the load data according to the preset length value to form a second target set.

[0165] In this embodiment, by using a pre-configured preset length value, a subset of subbytes that meet the conditions can be selected from the initial set, which can reduce the number of subbytes to be analyzed subsequently and reduce computational complexity.

[0166] Optionally, the message parsing data may further include: the server's Internet Protocol (IP) address and port number.

[0167] As an optional embodiment, the step of performing association rule analysis on the message parsing data, the expression of the business characteristics, and the expression of arbitrary position operator operations based on machine learning algorithms to obtain the business characteristics of the application under test includes:

[0168] Using the server IP address, the port number, the expression operated on by the operator at any position, and the business category as frequent items, an association rule algorithm is used to identify the association rules between the business features and the business categories; the precursor of the association rule is determined as the business feature of the application under test.

[0169] In this embodiment, association rule algorithms can be used to discover association rules between the business features and business categories of the application under test. Then, the successor of each association rule can be selected as the association rule for the business category, and the predecessor of the selected association rule can be used as the business feature. Based on the successor, it can be determined which rules are business feature rules. Wherein, if the predecessor contains multiple expressions, the multiple expressions are related by AND.

[0170] Optionally, after obtaining the business characteristics of the application under test, the method further includes at least one of the following:

[0171] (1) Output the business features according to the preset format.

[0172] It should be noted that the output business features here may be in the form of, but are not limited to, proto.dat documents that conform to the DPI protocol analysis feature format specification.

[0173] Understandably, business characteristics can also be output as business identification rules in a prescribed format to improve business identification capabilities.

[0174] (2) Store the business features.

[0175] It is understood that, in the process of implementing the business feature identification method provided in the embodiments of the present invention, other data may also be stored, such as message parsing data, various data generated when performing each step in the business feature identification process, and system data, etc., but this is not a limitation.

[0176] The service feature identification method in this embodiment parses the first message obtained during testing to obtain message parsing data. Then, based on machine learning algorithms, it performs service feature identification processing on the message parsing data to obtain the service features of the application under test. This allows for automated service feature identification of the service under test, enabling rapid and efficient full-text analysis of the message. Compared to the manual analysis of partial bytes in existing technologies, this method not only improves service identification efficiency but also expands the analysis coverage, thus avoiding the problem of missing service characteristics.

[0177] like Figure 2 As shown, a business feature recognition device according to an embodiment of the present invention includes:

[0178] The message acquisition module 210 is used to acquire a first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test.

[0179] The message parsing module 220 is used to parse the first message and obtain message parsing data;

[0180] The feature recognition module 230 is used to perform business feature recognition processing on the message parsing data based on machine learning algorithms to obtain the business features of the application under test.

[0181] In this embodiment, by parsing the first message obtained during the test, message parsing data can be obtained. Then, based on machine learning algorithms, business feature identification processing can be performed on the message parsing data to obtain the business features of the application under test. This allows for automated business feature identification of the service under test, enabling rapid and efficient full-text analysis of the message. Compared to the manual analysis of partial bytes in existing technologies, this not only improves business identification efficiency but also expands the analysis coverage, thus avoiding the problem of missing business characteristics.

[0182] Optionally, the message parsing data includes at least one payload data item;

[0183] The feature recognition module 230 includes:

[0184] The feature analysis submodule is used to perform feature analysis on the message parsing data according to pre-configured information to obtain the expression of the service feature;

[0185] The substring analysis submodule is used to perform substring analysis on the load data based on machine learning algorithms, and generate expressions with arbitrary position operator operations according to feature specifications;

[0186] The rule analysis submodule is used to perform association rule analysis on the message parsing data, the expression of the business features, and the expression of the arbitrary position operator operation based on machine learning algorithms, so as to obtain the business features of the application under test.

[0187] Optionally, the pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio;

[0188] The feature analysis submodule includes:

[0189] The first analysis unit is used to divide the payload data into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length;

[0190] The second analysis unit is configured to select at least one subbyte from the initial set based on the support threshold and / or the position entropy ratio, to form a first target set; and

[0191] The third analysis unit is used to select at least one subbyte from the initial set according to the preset length value to form a second target set;

[0192] The fourth analysis unit is used to perform matching processing on the load data, the first target set, and the second target set based on a multi-pattern matching algorithm to obtain the position information of at least one target subbyte. The target subbyte is: a subbyte that belongs to the union of the first target set and the second target set and appears in each load data.

[0193] The fifth analysis unit is used to generate an expression for the business feature according to the feature specification based on the position information of the target subbyte.

[0194] Optionally, the expression for the service feature includes: an expression for byte operators, and / or an expression for the relationship between bytes and payload length in the message.

[0195] Optionally, the second analysis unit includes:

[0196] The first analysis subunit is used to filter out subbytes with support greater than or equal to the support threshold from the initial set to form the first set;

[0197] The second analysis subunit is used to determine the position entropy corresponding to each subbyte in the first set based on the load data, wherein the position entropy is determined according to the position of the subbyte in the load data;

[0198] The third analysis subunit is used to select the top N sub-bytes from the first set according to the order of position entropy from smallest to largest, forming the first target set, where N is a positive integer determined based on the total number of elements in the first set and the proportion of position entropy.

[0199] Optionally, N is equal to the integer part of the product of the total number of elements in the first set and the proportion of the positional entropy.

[0200] Optionally, the second analysis subunit includes:

[0201] The fourth analysis subunit is used to analyze the formula: Determine the position entropy corresponding to the first subbyte in the first set;

[0202] Where H is the position entropy corresponding to the first sub-byte, index is the set of positions of sub-bytes in the payload data, and p(x i ) represents the probability of the first subbyte appearing at the i-th position.

[0203] Optionally, the message parsing data may further include the payload data length;

[0204] The third analysis unit includes:

[0205] The fifth analysis subunit is used to filter out at least one subbyte from the load data whose length differs from the preset length value, based on the preset length value, to form a second target set.

[0206] Optionally, the message parsing data may further include: the server's Internet Protocol (IP) address and port number;

[0207] The rule analysis submodule includes:

[0208] The sixth analysis unit is used to identify the association rules between the business features and the business categories by using the server IP address, the port number, the expression operated on by the operator at any position, and the business category as frequent items, through an association rule algorithm.

[0209] The seventh analysis unit is used to determine the precursor of the association rule as the business feature of the application under test.

[0210] Optionally, the device further includes:

[0211] The output module is used to output the business features according to a preset format;

[0212] A storage module is used to store the aforementioned business features.

[0213] It should be noted that the business feature recognition device provided in this embodiment of the invention can implement all the method steps implemented in the above-mentioned business feature recognition method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0214] like Figure 3 As shown, an identification device 300 according to an embodiment of the present invention includes a processor 310 and a transceiver 320, wherein the processor 310 is used for:

[0215] Obtain the first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test;

[0216] The first message is parsed to obtain message parsing data;

[0217] Based on machine learning algorithms, the message parsing data is processed to identify business features, thereby obtaining the business features of the application under test.

[0218] In this embodiment, by parsing the first message obtained during the test, message parsing data can be obtained. Then, based on machine learning algorithms, business feature identification processing can be performed on the message parsing data to obtain the business features of the application under test. This allows for automated business feature identification of the service under test, enabling rapid and efficient full-text analysis of the message. Compared to the manual analysis of partial bytes in existing technologies, this not only improves business identification efficiency but also expands the analysis coverage, thus avoiding the problem of missing business characteristics.

[0219] Optionally, the message parsing data includes at least one payload data item;

[0220] When the processor 310 performs business feature recognition processing on the message parsing data based on machine learning algorithms to obtain the business features of the application under test, it is specifically used for:

[0221] Based on the pre-configured information, feature analysis is performed on the parsed message data to obtain the expression of the service feature;

[0222] Based on machine learning algorithms, substring analysis is performed on the load data, and expressions with arbitrary position operator operations are generated according to feature specifications.

[0223] Based on machine learning algorithms, association rule analysis is performed on the message parsing data, the expression of the business features, and the expression of the arbitrary position operator operation to obtain the business features of the application under test.

[0224] Optionally, the pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio;

[0225] When the processor 310 performs feature analysis on the message parsing data according to the pre-configured information to obtain the expression of the service feature, it is specifically used for:

[0226] The payload data is divided into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length;

[0227] Based on the support threshold and / or the positional entropy ratio, at least one subbyte is selected from the initial set to form a first target set; and,

[0228] Based on the preset length value, at least one subbyte is selected from the initial set to form a second target set;

[0229] Based on a multi-pattern matching algorithm, the load data, the first target set, and the second target set are matched to obtain the position information of at least one target subbyte. The target subbyte is a subbyte that belongs to the union of the first target set and the second target set and appears in each load data.

[0230] Based on the position information of the target subbyte, an expression for the business feature is generated according to the feature specification.

[0231] Optionally, the expression for the service feature includes: an expression for byte operators, and / or an expression for the relationship between bytes and payload length in the message.

[0232] Optionally, when the processor 310 selects at least one subbyte from the initial set to form a first target set based on the support threshold and the position entropy ratio, it specifically performs the following:

[0233] From the initial set, subbytes with support greater than or equal to the support threshold are selected to form the first set;

[0234] Based on the load data, determine the position entropy corresponding to each subbyte in the first set, wherein the position entropy is determined according to the position of the subbyte in the load data;

[0235] According to the order of position entropy from smallest to largest, the first N sub-bytes are selected from the first set to form the first target set, where N is a positive integer determined based on the total number of elements in the first set and the proportion of position entropy.

[0236] Optionally, N is equal to the integer part of the product of the total number of elements in the first set and the proportion of the positional entropy.

[0237] Optionally, the processor 310 determines the position entropy corresponding to each subbyte in the first set based on the load data, including:

[0238] According to the formula: Determine the position entropy corresponding to the first subbyte in the first set;

[0239] Where H is the position entropy corresponding to the first sub-byte, index is the set of positions of sub-bytes in the payload data, and p(x i ) represents the probability of the first subbyte appearing at the i-th position.

[0240] Optionally, the message parsing data may further include the payload data length;

[0241] The processor 310 selects at least one subbyte from the initial set according to the preset length value to form a second target set, including:

[0242] Based on the preset length value, at least one subbyte that differs from the length of the load data by the preset length value is selected from the load data to form a second target set.

[0243] Optionally, the message parsing data may further include: the server's Internet Protocol (IP) address and port number;

[0244] The processor 310 performs association rule analysis on the message parsing data, the expression of the service features, and the expression of arbitrary position operator operations based on machine learning algorithms to obtain the service features of the application under test, including:

[0245] Using the server IP address, the port number, the expression operated on by the operator at any position, and the business category as frequent items, an association rule algorithm is used to identify the association rules between the business features and the business categories;

[0246] The leader of the association rule is determined as the business characteristic of the application under test.

[0247] Optionally, the processor 310 is further configured to:

[0248] Output the business features according to the preset format;

[0249] Store the aforementioned business characteristics.

[0250] It should be noted that the identification device provided in this embodiment of the invention can implement all the method steps implemented in the above-mentioned business feature identification method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0251] Another embodiment of the present invention provides an identification device, such as... Figure 4 As shown, it includes a transceiver 410, a processor 400, a memory 420, and a program or instructions stored in the memory 420 and executable on the processor 400; when the processor 400 executes the program or instructions, it implements the above-mentioned service feature identification method.

[0252] The transceiver 410 is used to receive and send data under the control of the processor 400.

[0253] Among them, Figure 4 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 400 and memory represented by memory 420 together. The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. Transceiver 410 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different identification devices, the user interface 430 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0254] The processor 400 is responsible for managing the bus architecture and general processing, while the memory 420 can store the data used by the processor 400 when performing operations.

[0255] This invention provides a readable storage medium storing a program or instructions. When executed by a processor, the program or instructions implement the steps in the business feature identification method described above and achieve the same technical effect. To avoid repetition, further details are omitted here. The computer-readable storage medium may include read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0256] It should be further noted that the terminals described in this specification include, but are not limited to, smartphones, tablets, etc., and many of the functional components described are referred to as modules in order to emphasize the independence of their implementation.

[0257] In this embodiment of the invention, the module can be implemented in software so that it can be executed by various types of processors. For example, an identified executable code module may include one or more physical or logical blocks of computer instructions, which may be constructed as objects, procedures, or functions. Nevertheless, the executable code of the identified module does not need to be physically located together, but may include different instructions stored in different bits, which, when logically combined, constitute the module and achieve the module's intended purpose.

[0258] In practice, an executable code module can be a single instruction or many instructions, and can even be distributed across multiple different code segments, different programs, and across multiple memory devices. Similarly, operational data can be identified within the module and can be implemented in any suitable form and organized within any suitable type of data structure. This operational data can be collected as a single dataset or distributed across different locations (including different storage devices), and can exist, at least in part, solely as electronic signals within the system or network.

[0259] When a module can be implemented using software, considering the current level of hardware technology, modules that can be implemented in software can be implemented using hardware circuits by those skilled in the art to achieve the corresponding functions, without considering cost. These hardware circuits include conventional very-large-scale integrated circuits (VLSI) or gate arrays, as well as existing semiconductors such as logic chips and transistors, or other discrete components. Modules can also be implemented using programmable hardware devices, such as field-programmable gate arrays, programmable array logic, and programmable logic devices.

[0260] The exemplary embodiments described above are with reference to the accompanying drawings. Many different forms and embodiments are feasible without departing from the spirit and teachings of the invention. Therefore, the invention should not be construed as limiting the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention complete and convey the scope of the invention to those skilled in the art. In these drawings, component dimensions and relative dimensions may be exaggerated for clarity. The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. As used herein, unless clearly indicated otherwise, the singular forms “a,” “an,” and “the” are intended to include all such forms. It will be further understood that the terms “comprising” and / or “including”, when used in this specification, indicate the presence of the stated features, integers, steps, operations, components, and / or elements, but do not exclude the presence or addition of one or more other features, integers, steps, operations, components, and / or groups thereof. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of the range and any subranges in between.

[0261] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A business feature recognition method, characterized in that, include: Obtain the first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test; The first message is parsed to obtain message parsing data; Based on machine learning algorithms, the message parsing data is processed to identify business features, thereby obtaining the business features of the application under test. The message parsing data includes at least one payload data item; The process of performing business feature identification processing on the parsed message data based on machine learning algorithms to obtain the business features of the application under test includes: Based on the pre-configured information, feature analysis is performed on the parsed message data to obtain the expression of the service feature; Based on machine learning algorithms, substring analysis is performed on the load data, and expressions with arbitrary position operator operations are generated according to feature specifications. Based on machine learning algorithms, association rule analysis is performed on the message parsing data, the expression of the business features, and the expression of the operation of operators at arbitrary positions to obtain the business features of the application under test. The pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio; The step of performing feature analysis on the message parsing data based on pre-configured information to obtain the expression of the service feature includes: The payload data is divided into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length; Based on the support threshold and / or the positional entropy ratio, at least one subbyte is selected from the initial set to form a first target set; and, Based on the preset length value, at least one subbyte is selected from the initial set to form a second target set; Based on a multi-pattern matching algorithm, the load data, the first target set, and the second target set are matched to obtain the position information of at least one target subbyte. The target subbyte is a subbyte that belongs to the union of the first target set and the second target set and appears in each load data. Based on the position information of the target subbyte, an expression for the business feature is generated according to the feature specification.

2. The method according to claim 1, characterized in that, The expressions for the business characteristics include: expressions for byte operators, and / or expressions relating the length of bytes and payload in the message.

3. The method according to claim 1, characterized in that, Based on the support threshold and the positional entropy ratio, at least one subbyte is selected from the initial set to form a first target set, including: From the initial set, subbytes with support greater than or equal to the support threshold are selected to form the first set; Based on the load data, determine the position entropy corresponding to each subbyte in the first set, wherein the position entropy is determined according to the position of the subbyte in the load data; According to the order of position entropy from smallest to largest, the first N sub-bytes are selected from the first set to form the first target set, where N is a positive integer determined based on the total number of elements in the first set and the proportion of position entropy.

4. The method according to claim 3, characterized in that, N is equal to the integer part of the product of the total number of elements in the first set and the percentage of the positional entropy.

5. The method according to claim 3, characterized in that, The step of determining the position entropy corresponding to each subbyte in the first set based on the load data includes: According to the formula: Determine the position entropy corresponding to the first subbyte in the first set; Where H is the position entropy corresponding to the first sub-byte, and index is the set of positions of sub-bytes in the payload data. Let be the probability of the first subbyte appearing at the i-th position.

6. The method according to claim 1, characterized in that, The message parsing data also includes the payload data length; The step of selecting at least one subbyte from the initial set according to the preset length value to form a second target set includes: Based on the preset length value, at least one subbyte that differs from the length of the load data by the preset length value is selected from the load data to form a second target set.

7. The method according to claim 1, characterized in that, The message parsing data also includes: the server's Internet Protocol (IP) address and port number; The method, based on machine learning algorithms, performs association rule analysis on the parsed message data, the expressions of the business features, and the expressions of arbitrary position operator operations to obtain the business features of the application under test, including: Using the server IP address, the port number, the expression operated on by the operator at any position, and the business category as frequent items, an association rule algorithm is used to identify the association rules between the business features and the business categories; The leader of the association rule is determined as the business characteristic of the application under test.

8. The method according to claim 1, characterized in that, After obtaining the business characteristics of the application under test, the method further includes at least one of the following: Output the business features according to the preset format; Store the aforementioned business characteristics.

9. A business feature recognition device, characterized in that, include: The message acquisition module is used to acquire the first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test. The message parsing module is used to parse the first message and obtain message parsing data; The feature recognition module is used to perform business feature recognition processing on the message parsing data based on machine learning algorithms to obtain the business features of the application under test. The message parsing data includes at least one payload data item; The feature recognition module includes: The feature analysis submodule is used to perform feature analysis on the message parsing data according to pre-configured information to obtain the expression of the service feature; The substring analysis submodule is used to perform substring analysis on the load data based on machine learning algorithms and generate expressions with arbitrary position operator operations according to feature specifications. The rule analysis submodule is used to perform association rule analysis on the message parsing data, the expression of the business features, and the expression of the operator operation at any position based on machine learning algorithms, so as to obtain the business features of the application under test. The pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio; The feature analysis submodule includes: The first analysis unit is used to divide the payload data into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length; The second analysis unit is configured to select at least one subbyte from the initial set based on the support threshold and / or the position entropy ratio, to form a first target set; and The third analysis unit is used to select at least one subbyte from the initial set according to the preset length value to form a second target set; The fourth analysis unit is used to perform matching processing on the load data, the first target set, and the second target set based on a multi-pattern matching algorithm to obtain the position information of at least one target subbyte. The target subbyte is: a subbyte that belongs to the union of the first target set and the second target set and appears in each load data. The fifth analysis unit is used to generate an expression for the business feature according to the feature specification based on the position information of the target subbyte.

10. An identification device, characterized in that, include: Transceiver and processor; The processor is used for: Obtain the first message corresponding to the application under test, wherein the first message is obtained by dialing the application under test; The first message is parsed to obtain message parsing data; Based on machine learning algorithms, the message parsing data is processed to identify business features, thereby obtaining the business features of the application under test. The message parsing data includes at least one payload data item; When the processor performs business feature recognition processing on the parsed message data based on machine learning algorithms to obtain the business features of the application under test, it is specifically used for: Based on the pre-configured information, feature analysis is performed on the parsed message data to obtain the expression of the service feature; Based on machine learning algorithms, substring analysis is performed on the load data, and expressions with arbitrary position operator operations are generated according to feature specifications. Based on machine learning algorithms, association rule analysis is performed on the message parsing data, the expression of the business features, and the expression of the operation of operators at arbitrary positions to obtain the business features of the application under test. The pre-configuration information includes: subbyte length, preset length value, and target parameters, wherein the target parameters include at least one of support threshold and position entropy ratio; When the processor performs feature analysis on the message parsing data according to the pre-configured information to obtain the expression of the service feature, it is specifically used for: The payload data is divided into at least one subbyte according to the subbyte length to form an initial set, wherein the length of the subbyte in the initial set is equal to the subbyte length; Based on the support threshold and / or the positional entropy ratio, at least one subbyte is selected from the initial set to form a first target set; and, Based on the preset length value, at least one subbyte is selected from the initial set to form a second target set; Based on a multi-pattern matching algorithm, the load data, the first target set, and the second target set are matched to obtain the position information of at least one target subbyte. The target subbyte is a subbyte that belongs to the union of the first target set and the second target set and appears in each load data. Based on the position information of the target subbyte, an expression for the business feature is generated according to the feature specification.

11. An identification device, comprising: A transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; characterized in that, when the processor executes the program or instructions, it implements the service feature identification method as described in any one of claims 1-8.

12. A readable storage medium having a program or instructions stored thereon, characterized in that, When the program or instructions are executed by the processor, they implement the steps in the business feature recognition method as described in any one of claims 1-8.

Images