Feature library updating method and device, electronic equipment and storage medium

Abstract

The invention provides a feature library updating method and device, electronic equipment and a storage medium. The method comprises the following steps: performing traffic analysis on each network device accessed to an SDN controller, and determining a target network device whose unknown application traffic reaches a preset update condition; unknown application identification features are generated according to a global feature library and an equipment feature library set, the global feature library and an external public feature library keep synchronous, and the equipment feature library set is used for recording feature libraries of all network equipment accessing the SDN controller; and updating the feature library of the target network equipment by using the unknown application identification features. According to the method, full-automatic updating of the network equipment feature library is realized based on the SDN controller, and the application identification capability of the network equipment is effectively ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a feature library updating method, device, electronic device and storage medium. Background Art

[0002] Some application-based services need to know the application layer protocol to which the message belongs when processing the message, such as Quality of Service (QoS) and Application Specific Packet Filter (ASPF). Application layer protocol recognition (APR) can provide application recognition services for such services and can count the number and rate of messages of a certain application layer protocol received or sent on the interface.

[0003] Generally, the application identification and processing flow is as follows: configure the device feature library, and the application detection engine will load the feature library when the device is running; when traffic passes through the device, the engine will detect the message according to the loaded application identification feature; if the detection result is a match failure, the message will be released directly; if the detection result is a match success, the device will send the detection result to the application business module for processing; the application business will process the message accordingly according to the detection result, such as discarding, source blocking, redirecting, logging, etc.

[0004] Among them, the application detection function is crucial, which is responsible for matching the characteristics of all traffic passing through network devices. In order to fully improve the application identification capability, this requires that the application identification characteristics in the device feature library are rich enough and can be updated in time. However, the current commonly used solution for updating the device feature library based on the network management system has the disadvantages of relatively complex update process, reliance on manual operation, and delayed update. Summary of the invention

[0005] In order to overcome the problems existing in the related art, the present application provides a feature library updating method, device, electronic device and storage medium.

[0006] According to a first aspect of an embodiment of the present application, a method for updating a feature library is provided, the method being applied to an SDN controller, the method comprising:

[0007] Perform traffic analysis on each network device connected to the SDN controller to determine the target network device where the unknown application traffic meets the preset update conditions;

[0008] Generate unknown application identification features according to a global feature library and a device feature library set, wherein the global feature library is synchronized with an external public feature library, and the device feature library set is used to record feature libraries of all network devices connected to the SDN controller;

[0009] The feature library of the target network device is updated using the unknown application identification feature.

[0010] According to a second aspect of an embodiment of the present application, a feature library updating device is provided, the device being applied to an SDN controller, the device comprising:

[0011] A traffic analysis module is used to perform traffic analysis on each network device connected to the SDN controller to determine the target network device whose unknown application traffic meets the preset update conditions;

[0012] A feature generation module, used to generate unknown application identification features based on a global feature library and a device feature library set, wherein the global feature library is synchronized with an external public feature library, and the device feature library set is used to record feature libraries of all network devices connected to the SDN controller;

[0013] An updating module is used to update the feature library of the target network device using the unknown application identification feature.

[0014] According to a third aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the steps of the feature library updating method described above.

[0015] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the feature library updating method described above are implemented.

[0016] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0017] The embodiment of the present application uses the SDN controller to monitor the traffic of the network device in real time. After the traffic of the unknown application reaches certain conditions, the identification features of the unknown application are automatically generated, and the feature library of the network device is updated accordingly. In other words, the embodiment of the present application realizes the fully automatic update of the network device feature library based on the SDN controller, ensures the recognition ability of the network device to the application, and the feature library update process does not require administrator operation, monitors the device traffic in real time and updates the feature library, thereby avoiding the problem of untimely update of the feature library and lagging application recognition features.

[0018] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0020] Figure 1 A first flow chart of a feature library updating method provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of a method for updating a feature library provided in an embodiment of the present application;

[0022] Figure 3 A second flow chart of a feature library updating method provided in an embodiment of the present application;

[0023] Figure 4 A third flow chart of a feature library updating method provided in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of the structure of a feature library updating device provided in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0027] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0028] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".

[0029] Next, the embodiments of the present application are described in detail.

[0030] The present application embodiment provides a method for updating a feature library, which is applied to an SDN controller, such as Figure 1 As shown, the method may include the following steps:

[0031] Step 110: Perform traffic analysis on each network device connected to the SDN controller to determine the target network device whose unknown application traffic meets the preset update condition;

[0032] Step 120: Generate unknown application identification features according to a global feature library and a device feature library set, wherein the global feature library is synchronized with an external public feature library, and the device feature library set is used to record feature libraries of all network devices connected to the SDN controller;

[0033] Step 130: Update the feature library of the target network device using the unknown application identification feature.

[0034] Software-defined Networking (SDN) technology is widely used in various fields and in various user actual networks. As the brain of the network, the SDN controller is responsible for controlling and arranging the delivery of various network operation and maintenance services. The embodiment of the present application implements a feature library update method based on the SDN controller, wherein the feature library refers to a resource library in a network device used to identify the application layer traffic passing through the network device. The feature library includes a series of application identification features. The applications running on different network devices may be different, so the application identification features contained in the feature libraries of different network devices may be different.

[0035] like Figure 2As shown, the embodiment of the present application newly establishes a global feature library and a device feature library set in the SDN controller, wherein the global feature library is synchronized with an external public feature library, and the public feature library refers to a series of application identification features officially published on the website. The embodiment of the present application periodically obtains the latest application identification features from the public feature library of the website through HTTP and synchronizes them to the global feature library; the device feature library set is the feature library of all network devices queried by the SDN controller, and the SDN controller can specifically obtain the feature library of each network device through subscription or active query.

[0036] like Figure 2 As shown, the embodiment of the present application also newly sets up a traffic analysis module in the SDN controller, and the traffic analysis module performs traffic monitoring and statistical analysis on each network device connected to the SDN device through the data stream Net Stream technology. Taking IPv4 packets as an example, the traffic analysis module defines the flow according to the destination IP address, source IP address, destination port number, source port number, protocol number, service type (Type of Service, ToS), input interface or output interface of the packet, where the packets with the same five-tuple (destination IP address, source IP address, destination port number, source port number, protocol number) are considered to belong to the same application data flow.

[0037] In an embodiment of the present application, the traffic analysis module performs traffic analysis on each network device connected to the SDN controller. Specifically, the traffic analysis module collects the traffic of each network device, and matches the quintuple of the collected traffic with the application identification feature in the feature library of the network device. The content of the application identification feature includes but is not limited to the quintuple. If the quintuple contained in any application identification feature in the feature library is the same as the quintuple of the traffic, it indicates that it is known application traffic, and the match is considered successful, and the known application traffic information <device ID, application number, time, quintuple, traffic value> is recorded; otherwise, the match is considered failed, and the unknown application traffic information <device ID, time, quintuple, traffic value> is recorded.

[0038] As a specific implementation method, the application identification feature includes a quintuple, and may also include feature description information, feature code, application number, etc.

[0039] In the embodiment of the present application, the SDN controller supports the configuration of preset update conditions, which can be specifically configured as a preset duration T (minutes) and a preset value N (%), that is, within the recent T time, if a certain unknown application traffic reaches N% or more of the total traffic of known applications of the device, it is considered that the preset update condition is met and the feature library of the network device needs to be updated. Therefore, the embodiment of the present application specifically determines the target network device whose unknown application traffic reaches the preset update condition in the following manner: determine the target network device whose ratio of unknown application traffic to all known application traffic exceeds the preset value within the preset duration.

[0040] As a specific implementation method, the traffic analysis module periodically checks the applications that meet the conditions in the unknown traffic list according to the preset duration T (minutes) and preset value N (%). The process is as follows: first, the traffic size S of all known applications of the network device in the recent T time is calculated according to the first formula, and then the traffic size P of each unknown application on the network device in the recent T time is calculated in turn according to the second formula. Finally, the unknown application traffic threshold is checked. If (P / S)*100>=N, it is considered that the traffic has reached the threshold, and the unknown application traffic is large and needs to be identified, and the device dynamic feature library list needs to be updated. The first formula is as follows:

[0041]

[0042] Among them, S is the total traffic size of n known applications within time T, i is the known application number, j represents each time point of each application, and V(i,j) represents the traffic size of application number i at time j.

[0043] The second formula is as follows:

[0044]

[0045] Among them, P is the traffic of each unknown application in time T, j represents each time point of the unknown application, and V(j) represents the traffic size of the unknown application at time j.

[0046] After the above process, the target network device whose unknown application traffic meets the preset update condition can be determined, and then the unknown application identification feature is generated according to the global feature library and the device feature library set. In the process of generating unknown application identification features, in order to improve efficiency, the embodiment of the present application divides the types of application identification features into the following categories:

[0047] Predefined features: predefined application identification features, which cannot be modified or deleted;

[0048] Custom features: application identification features manually created by the administrator, which can be added or deleted by the administrator;

[0049] Dynamic features: The dynamic feature list function provided by network devices supports the features dynamically issued by the SDN controller based on traffic conditions.

[0050] Based on the above classification, when generating unknown application identification features, matching is performed in the following order: Figure 3 As shown:

[0051] Step 310, matching the unknown application's quintuple with the application identification features of the predefined features in the device feature library set; if the match is successful, proceed to step 350, otherwise proceed to step 320;

[0052] Step 320, matching the unknown application's quintuple with the application identification feature whose feature type is a custom feature in the device feature library set; if the match is successful, proceed to step 350, otherwise proceed to step 330;

[0053] Step 330, matching the unknown application's quintuple with the application identification features of the device feature library set whose feature type is dynamic features; if the match is successful, proceed to step 350, otherwise proceed to step 340;

[0054] Step 340: Match the unknown application's quintuple with the application identification features in the global feature library; if the match is successful, proceed to step 350;

[0055] Step 350: Use the matching result as an unknown application identification feature.

[0056] When the unknown application identification feature is used to update the feature library of the target network device, the embodiment of the present application takes into account that different devices have different resource limitations and different upper limits on the number of features they support. Therefore, the number of features and the upper limit on the number of features are first queried from the target network device, and then the feature library is updated according to the following process: Figure 4 As shown:

[0057] Step 410: When the number of features of the target network device is less than the upper limit of the number of features of the target network device, the unknown application identification feature is sent to the feature library of the target network device;

[0058] Step 420: When the number of features of the target network device is equal to the upper limit of the number of features of the target network device, determine the known application with the smallest traffic in the target network device, and use the unknown application identification feature to replace the application identification feature of the known application with the smallest traffic in the feature library of the target network device.

[0059] It can be seen from the above technical solutions that the embodiment of the present application provides a method for updating a feature library. The method is implemented based on an SDN controller and can monitor the traffic of network devices. When it is detected that the feature library version of a certain network device is outdated or the application recognition is low, the feature library of the network device is automatically updated through the SDN controller, thereby improving the application recognition capability of the network device. The method has at least the following advantages:

[0060] First, the SDN controller in this method can ensure the synchronization of the local global signature library with the external public signature library. Therefore, when updating the device signature library, the network device does not need to access the official signature library service, which reduces the network requirements of the entire system.

[0061] Second, the feature library update process is fully automated, without manual intervention, which reduces the administrator's operational difficulty and saves management costs;

[0062] Third, the method determines unknown applications and generates update content based on the business traffic of network devices in the recent period of time. The update method is very flexible and the update speed is very timely;

[0063] Fourth, the method also considers the upper limit of the number of feature libraries of different network devices during the update process to ensure the reliability of the update process.

[0064] Based on the same inventive concept, the present application also provides a feature library updating device, which is applied to an SDN controller, such as Figure 5 As shown, the device comprises:

[0065] Traffic analysis module 510, used to perform traffic analysis on each network device connected to the SDN controller, and determine the target network device whose unknown application traffic meets the preset update condition;

[0066] A feature generation module 520 is used to generate unknown application identification features according to a global feature library and a device feature library set, wherein the global feature library is synchronized with an external public feature library, and the device feature library set is used to record feature libraries of all network devices connected to the SDN controller;

[0067] The updating module 530 is used to update the feature library of the target network device using the unknown application identification feature.

[0068] As a specific implementation, the device further includes:

[0069] The feature library synchronization module 540 is used to periodically obtain an external public feature library through HTTP and update the global feature library according to the public feature library.

[0070] As a specific implementation, the device further includes:

[0071] The device feature collection module 550 is used to obtain the feature library of all network devices connected to the SDN controller through subscription or active query, and update the device feature library set according to the feature library of all network devices.

[0072] As a specific implementation, the traffic analysis module 510 specifically determines the target network device whose unknown application traffic meets the preset update condition in the following manner:

[0073] Determine the target network device for which the ratio of unknown application traffic to all known application traffic within a preset time period exceeds a preset value.

[0074] As a specific implementation, the feature generation module 520 specifically includes:

[0075] A first matching unit, configured to match the five-tuple of the unknown application with the application identification feature whose feature type is a predefined feature in the device feature library set;

[0076] A first output unit, configured to use the matching result as an unknown application identification feature if the matching is successful;

[0077] The second matching unit is used to match the quintuple of the unknown application with the application identification feature whose feature type is a custom feature in the device feature library set if the matching fails;

[0078] A second output unit, configured to use the matching result as an unknown application identification feature if the matching is successful;

[0079] A third matching unit is used to match the quintuple of the unknown application with the application identification feature whose feature type is a dynamic feature in the device feature library set if the matching fails;

[0080] A third output unit is used to use the matching result as an unknown application identification feature if the matching is successful;

[0081] a fourth matching unit, configured to match the quintuple of the unknown application with the application identification features in the global feature library if the matching fails;

[0082] The fourth output unit is used to use the matching result as the unknown application identification feature if the matching is successful.

[0083] As a specific implementation, the updating module 530 specifically includes:

[0084] A first updating unit, configured to send the unknown application identification feature to a feature library of the target network device when the number of features of the target network device is less than an upper limit of the number of features of the target network device;

[0085] The second updating unit is used to replace the application identification feature with the smallest flow in the feature library of the target network device with the unknown application identification feature when the feature number of the target network device is equal to the upper limit of the feature number of the target network device.

[0086] The present application also provides an electronic device, such as Figure 6 As shown, it includes a processor 601 and a machine-readable storage medium 602, wherein the machine-readable storage medium 602 stores machine-executable instructions that can be executed by the processor 601, and the processor 601 is prompted by the machine-executable instructions to implement the steps of any of the above-mentioned feature library updating methods.

[0087] The machine-readable storage medium may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the machine-readable storage medium may also be at least one storage device located away from the processor.

[0088] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0089] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned feature library updating methods are implemented.

[0090] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A feature library updating method, It is characterized in that The method is applied to an SDN controller, and the method includes: Perform traffic analysis on each network device connected to the SDN controller to determine the target network device where the unknown application traffic meets the preset update conditions; Generate unknown application identification features according to a global feature library and a device feature library set, wherein the global feature library is synchronized with an external public feature library, and the device feature library set is used to record feature libraries of all network devices connected to the SDN controller; The feature library of the target network device is updated using the unknown application identification feature.

2. The method according to claim 1, It is characterized in that The method further comprises: The external public feature library is periodically obtained through HTTP, and the global feature library is updated based on the public feature library.

3. The method according to claim 1, It is characterized in that The method further comprises: Obtain the feature library of all network devices connected to the SDN controller by subscription or active query, and update the device feature library set according to the feature library of all network devices.

4. The method according to claim 1, It is characterized in that Determine the target network devices whose unknown application traffic meets the preset update conditions, including: Determine the target network device for which the ratio of unknown application traffic to all known application traffic within a preset time period exceeds a preset value.

5. The method according to claim 1, It is characterized in that Generate unknown application identification features based on the global feature library and device feature library, including: Match the unknown application's quintuple with the application identification features of the predefined features in the device feature library set; If the match is successful, the match result is used as the unknown application identification feature; If the match fails, the unknown application's quintuple is matched with the application identification features of the device feature library set whose feature type is a custom feature; If the match is successful, the match result is used as the unknown application identification feature; If the match fails, the unknown application's quintuple is matched with the application identification features of the dynamic feature type in the device feature library set; If the match is successful, the match result is used as the unknown application identification feature; If the match fails, the unknown application's quintuple is matched with the application identification features in the global feature library; If the match is successful, the match result is used as the unknown application identification feature.

6. The method according to any one of claims 1 to 5, It is characterized in that Updating the feature library of the target network device by using the unknown application identification feature specifically includes: When the number of features of the target network device is less than the upper limit of the number of features of the target network device, sending the unknown application identification feature to the feature library of the target network device; When the number of features of the target network device is equal to the upper limit of the number of features of the target network device, the unknown application identification feature is used to replace the application identification feature with the smallest flow in the feature library of the target network device.

7. A feature library updating device, It is characterized in that The device is applied to an SDN controller, and the device includes: A traffic analysis module is used to perform traffic analysis on each network device connected to the SDN controller to determine the target network device whose unknown application traffic meets the preset update conditions; A feature generation module, used to generate unknown application identification features based on a global feature library and a device feature library set, wherein the global feature library is synchronized with an external public feature library, and the device feature library set is used to record feature libraries of all network devices connected to the SDN controller; An updating module is used to update the feature library of the target network device using the unknown application identification feature.

8. The device according to claim 7, It is characterized in that The traffic analysis module specifically determines the target network device where the unknown application traffic reaches the preset update condition by: Determine the target network device for which the ratio of unknown application traffic to all known application traffic within a preset time period exceeds a preset value.

9. The device according to claim 7, It is characterized in that The feature generation module specifically includes: A first matching unit, configured to match the five-tuple of the unknown application with the application identification feature whose feature type is a predefined feature in the device feature library set; A first output unit, configured to use the matching result as an unknown application identification feature if the matching is successful; A second matching unit is used to match the unknown application's quintuple with an application identification feature whose feature type is a custom feature in a device feature library set if the matching fails; A second output unit, configured to use the matching result as an unknown application identification feature if the matching is successful; A third matching unit is used to match the quintuple of the unknown application with the application identification feature whose feature type is a dynamic feature in the device feature library set if the matching fails; A third output unit is used to use the matching result as an unknown application identification feature if the matching is successful; a fourth matching unit, configured to match the quintuple of the unknown application with the application identification features in the global feature library if the matching fails; The fourth output unit is used to use the matching result as the unknown application identification feature if the matching is successful.

10. The device according to any one of claims 7 to 9, It is characterized in that The update module specifically includes: A first updating unit, configured to send the unknown application identification feature to a feature library of the target network device when the number of features of the target network device is less than an upper limit of the number of features of the target network device; The second updating unit is used to replace the application identification feature with the smallest flow in the feature library of the target network device with the unknown application identification feature when the feature number of the target network device is equal to the upper limit of the feature number of the target network device.

11. An electronic device, It is characterized in that The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described in any one of claims 1 to 6.

12. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 6 are implemented.

Images