Method and device for carrying out traffic analysis by adopting virtual router

Abstract

The invention relates to a method and device for carrying out traffic analysis by adopting a virtual router, and the method comprises the steps: newly adding a plug-in node in the virtual router, the plug-in node comprises the function of the virtual router and comprises the path pointing information for calling a target detection library, and the target detection library is used for recognizing the traffic of an application layer; after the virtual router receives a data stream, calling a data processing function in the target detection library through path pointing information in the plug-in node; and performing statistical analysis on the data stream through the data processing function. According to the invention, the virtual router has a traffic analysis function.

Description

Technical Field

[0001] The present application relates to the technical field of traffic analysis, and in particular to a method and device for performing traffic analysis using a virtual router. Background Art

[0002] In recent years, with the popularization and development of the Internet, many new network protocols and applications have emerged. In particular, the popularity of P2P applications has occupied a large amount of network bandwidth, even caused network congestion, and greatly reduced network performance. People have realized the need to monitor and control the traffic in the network. Whether it is traffic control or traffic detection, traffic identification is the most basic premise.

[0003] The traffic identification methods widely used at present mainly include port identification method, traffic behavior feature identification technology and datagram deep scanning method, but there is no method using VPP (Vector Packet Processing, virtual router) for traffic identification and statistics. Therefore, VPP itself does not have the function of application layer traffic identification and statistics. Summary of the invention

[0004] The present application provides a method and device for traffic analysis using a virtual router, so as to provide a new method for traffic identification and statistics.

[0005] In a first aspect, the present application provides a method for performing traffic analysis using a virtual router, the method comprising:

[0006] Adding a plug-in node in the virtual router, wherein the plug-in node includes the function of the virtual router and includes path pointing information for calling a target detection library, wherein the target detection library is used to identify application layer traffic;

[0007] After the virtual router receives the data stream, the data processing function in the target detection library is called through the path pointing information in the plug-in node;

[0008] The data stream is statistically analyzed by the data processing function.

[0009] Optionally, before calling the data processing function in the target detection library through the path pointing information in the plug-in node, the method further includes:

[0010] Inserting the static library and third-party information in the target detection library into the plug-in node;

[0011] Compiling the plug-in node according to the header file directory of the plug-in node itself, the static library and the third-party information;

[0012] The path pointing information pointing to the static library is determined according to the compiled plug-in node.

[0013] Optionally, inserting the static library in the target detection library into the plug-in node comprises:

[0014] Find and delete the data flow packet receiving mode of the static library in the target detection library, wherein the packet receiving mode in the target detection library is incompatible with the packet receiving mode in the virtual router;

[0015] The static library after deleting the packet receiving mode is inserted into the plug-in node.

[0016] Optionally, performing statistical analysis on the data stream by using the data processing function includes:

[0017] Sending a read instruction to each processing sub-thread in the first type of thread through the virtual router, so that the processing sub-thread changes from an analysis state to a release state after receiving the read instruction, wherein the release state is used to indicate that the processing sub-thread only releases data traffic but does not perform traffic analysis;

[0018] After the virtual router detects that the traffic analysis flag of the processing sub-thread is changed from the analysis state to the release state, reading the analysis result of the traffic according to the processing sub-thread of the second type of thread;

[0019] After reading the analysis result, the flow analysis flag of the processing sub-thread in the first type of thread is notified to change from the release state to the analysis state, so that the processing sub-thread continues to perform flow analysis.

[0020] Optionally, after sending the read instruction to each processing sub-thread in the first type of thread through the virtual router, the method further includes:

[0021] The pointer of the address information of the data stream to be read and the data packet length are transmitted to the processing sub-threads in the first type of threads through the virtual router, so that each processing sub-thread reads the data stream with the data packet length from the corresponding address information through the pointer and performs statistical analysis.

[0022] Optionally, performing traffic analysis by processing the sub-thread includes:

[0023] Classifying the IP addresses and port numbers in the data stream by the processing subthread to identify the device or user generating the specific traffic;

[0024] Identifying and counting the application layer protocol in the data flow through the processing subthread to identify the traffic generated by the specific application, wherein the application layer protocol includes a request method and a response status code;

[0025] The processing subthread counts the data packet size, traffic rate, the type and number of protocols used by each IP address, the type and number of protocols used by each port, and the total traffic volume of each protocol in the data flow to determine the traffic characteristics.

[0026] Optionally, the analysis result includes a commonly used address information analysis result and a data feature information analysis result, wherein the commonly used address information analysis result is used to indicate a unique address of a main generator of traffic.

[0027] In a second aspect, the present application provides a device for performing traffic analysis using a virtual router, the device comprising:

[0028] A new module is used to add a plug-in node in the virtual router, wherein the plug-in node includes the function of the virtual router and includes path pointing information for calling a target detection library, and the target detection library is used to identify application layer traffic;

[0029] A calling module, configured to call a data processing function in the target detection library through the path pointing information in the plug-in node after the virtual router receives the data stream;

[0030] An analysis module is used to perform statistical analysis on the data flow through the data processing function.

[0031] In a third aspect, the present application provides an electronic device comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; and at least one memory connected to the at least one bus.

[0032] In a fourth aspect, the present application further provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the method for performing traffic analysis using a virtual router as described in any one of the above items of the present application.

[0033] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: traffic analysis is achieved by adding a new plug-in node in the virtual router. The plug-in node not only includes the basic functions of the virtual router, but also integrates the ability to call an external target detection library to identify application layer traffic. When the virtual router receives a data stream, it calls the data processing function in the target detection library through the plug-in node to perform statistical analysis on these. The plug-in node provided by the present application integrates the original functions of the virtual router and the traffic identification function, so that the virtual router has the function of traffic analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0036] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0037] Figure 1 A flow chart of a method for performing traffic analysis using a virtual router provided in an embodiment of the present application;

[0038] Figure 2 A flowchart showing the analysis results provided in the embodiment of the present application;

[0039] Figure 3 A flowchart of analyzing data flow provided by an embodiment of the present application;

[0040] Figure 4 A schematic diagram of the structure of a device for flow analysis using a virtual router provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0043] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0044] The present application provides a method for traffic analysis using a virtual router, which can be applied to a terminal or a server. The present application is explained by taking the application to a terminal as an example. Figure 1 As shown, the method includes:

[0045] Step 101: Add a plug-in node in the virtual router, wherein the plug-in node includes the function of the virtual router and includes path pointing information for calling a target detection library, and the target detection library is used to identify application layer traffic.

[0046] Step 102: After the virtual router receives the data stream, the data processing function in the target detection library is called through the path pointing information in the plug-in node.

[0047] Step 103: Perform statistical analysis on the data stream through a data processing function.

[0048] This application adds a plug-in node in the virtual router vpp, and uses the official method, such as the script make-plugin.sh, to write the code of the virtual router into the plug-in node, so that the plug-in node includes the function of the virtual router. The plug-in node can be an appid plug-in or other forms of plug-in. This application does not limit the plug-in type.

[0049] Since the virtual router itself does not have the function of identifying and counting application layer traffic, it can be combined with a target detection library that can identify application layer traffic to assist the virtual router. Since there is no association between the virtual router and the target detection library, the present application can use a combination of plug-in nodes and target detection libraries to jointly perform application layer traffic identification and statistics.

[0050] In the embodiment of the present application, the target detection library for identifying application layer traffic is specifically nDPI. nDPI is developed from openDPI. DPI (Deep Packet Inspection) is a deep packet inspection system. There are more and more types of network traffic now, some of which are used maliciously, such as p2p occupying bandwidth or malicious network applications. Since malicious applications may use random ports, it is necessary to perform in-depth analysis of the message. nDPI is more powerful than DPI in terms of function. Both are deep packet analysis libraries based on LGPL3.0 open source implemented in C. The core library of nDPI is used to process data packets to extract basic information, and the parser is implemented in a plug-in manner to parse the protocol category of message detection.

[0051] The plug-in node not only contains the functions of the virtual router, but also contains the path pointing information for calling the target detection library. After the virtual router receives the data flow, the plug-in node calls the data processing function in the target detection library to perform specific analysis and processing on the data flow to obtain the analysis results of the data flow.

[0052] After the data analysis is completed, the virtual router will provide an interface or interface to allow users to obtain these analysis results. This may be a management interface, API interface or command line tool, etc. Users can view the statistical analysis results of data flows through these interfaces.

[0053] The present application realizes traffic analysis by adding a new plug-in node in the virtual router. The plug-in node not only includes the basic functions of the virtual router, but also integrates the ability to call an external target detection library to identify application layer traffic. When the virtual router receives a data stream, it calls the data processing function in the target detection library through the plug-in node to perform statistical analysis on these data streams. The plug-in node provided by the present application integrates the original functions of the virtual router and the traffic identification function, so that the virtual router has the function of traffic analysis.

[0054] As an optional implementation, before calling the data processing function in the target detection library through the path pointing information in the plug-in node, the method also includes: inserting the static library and third-party information in the target detection library into the plug-in node; compiling the plug-in node according to the header file directory, static library and third-party information of the plug-in node itself; and determining the path pointing information pointing to the static library based on the compiled plug-in node.

[0055] The static library is a binary file of the target detection library, which contains pre-compiled functional codes used to identify application layer traffic; third-party information may include library dependencies, configuration files, or other necessary resources. The terminal inserts the static library and third-party information into the plug-in node so that the plug-in node can find the function information to open the static library. Exemplarily, the third-party information is a third_party dependency library.

[0056] The plugin node's header file directory contains necessary header files (such as .h files) that define the prototypes of functions and data structures used in the plugin node.

[0057] The terminal compiles the plug-in node according to the header file directory, static library and third-party information of the plug-in node itself. The compilation process is the process of converting the source code of the plug-in node into executable instructions to ensure that the plug-in node can call the functions of the target detection library.

[0058] After compilation is complete, the executable code of the plug-in node will contain calls to functions in the static library. In order to ensure that the plug-in node can correctly load and use the static library, it is necessary to determine and record the path pointing information of the static library in the system.

[0059] This application compiles the plug-in node through the key content (static library and third-party information) in the target detection library and the header file directory of the plug-in node itself, ensuring that the source code of the plug-in node can be converted into executable instructions, and the plug-in node can also find the path information pointing to the static library based on the key content, thereby calling the interface of the static library and using the data processing function in the static library for traffic analysis.

[0060] When this application writes the target detection library data to the plug-in node, it is necessary to change the CMakeLists.txt file of the plug-in node. The CMakeLists.txt file is a configuration file of CMake (a cross-platform automated build system) and is used to instruct CMake how to compile and build software projects. Specifically, changing the CMakeLists.txt file is to add the following content to the CMakeLists.txt file:

[0061] set(CURRENT_PATH${CMAKE_CURRENT_SOURCE_DIR}), set the current path of the code;

[0062] LINK_LIBRARIES-L${CURRENT_PATH}-lnDPI, set nDPI static library;

[0063] include_directories(${CMAKE_CURRENT_SOURCE_DIR} / include), set the Include function declaration;

[0064] include_directories(${CMAKE_CURRENT_SOURCE_DIR} / lib / thir d_party / include, set the third_party dependency library.

[0065] As an optional implementation, inserting the static library in the target detection library into the plug-in node includes: searching and deleting the data stream packet receiving method of the static library in the target detection library, wherein the packet receiving method in the target detection library is incompatible with the packet receiving method in the virtual router; and inserting the static library after deleting the packet receiving method into the plug-in node.

[0066] There are two packet receiving methods in the target detection library, pcap_loop and dpdk. These two packet receiving methods are used to receive traffic data packets, but the virtual router itself also has a packet receiving method. Since this application integrates the static library of the target detection library and the common functions of the virtual router into the plug-in node, this will cause the packet receiving method of the target detection library to be incompatible with the packet receiving method of the virtual router, so it is necessary to remove the packet receiving method of one of them.

[0067] The terminal can delete the packet receiving method of the virtual router and retain the packet receiving method of the target detection library, or delete the packet receiving method of the target detection library and retain the packet receiving method of the virtual router. The embodiment of the present application preferably adopts the latter solution, because the ultimate goal is to integrate the application layer traffic identification and statistics functions in the virtual router. Retaining the packet receiving method of the virtual router will not affect other functions in the virtual router, ensuring that the original functions of the virtual router can be maximized. After the terminal deletes the packet receiving method of the static library in the target detection library, it inserts the static library into the plug-in node.

[0068] As an optional implementation, the data processing function includes two types of threads. The first type of threads is used to perform statistical analysis on the data flow and save the analysis results, and the second type of threads is used to access the analysis results according to user requests.

[0069] Generally speaking, traffic analysis and result viewing are placed in one thread. If the user wants to view the analysis results before the traffic analysis is completed, the traffic analysis needs to be interrupted, which reduces the efficiency of traffic analysis. In order to solve this technical problem, this application places traffic analysis and result output in two types of threads, that is, the core data packet function in the first type of thread is used to perform traffic analysis and stop traffic analysis, and the traffic analysis results are output to the terminal interface according to the print analysis information function print Results in the second type of thread. If the user wants to access the analysis results, the first type of thread is not affected, and the second type of thread retrieves and outputs the analysis results from the first type of thread. In this way, even if the user wants to access the analysis results midway, it will not affect the normal analysis of the traffic, thereby improving the efficiency of traffic analysis and the performance of the virtual router.

[0070] As an optional implementation, statistical analysis of data streams by data processing functions includes the following process: Figure 2 shown.

[0071] Step 201: Send a read instruction to each processing sub-thread in the first type of thread through a virtual router, so that the processing sub-thread changes from an analysis state to a release state after receiving the read instruction, wherein the release state is used to indicate that the processing sub-thread only releases data traffic but does not perform traffic analysis.

[0072] Step 202: after the virtual router detects that the traffic analysis flag of the processing sub-thread is changed from the analysis state to the release state, the analysis result of the traffic is read according to the processing sub-thread of the second type of thread.

[0073] Step 203: After reading the analysis result, the flow analysis flag of the processing sub-thread in the first type of thread is notified to change from the release state to the analysis state, so that the processing sub-thread continues to perform flow analysis.

[0074] In the prior art, traffic analysis results are stored in a data structure about thread resources. In the real environment, traffic basically always exists, which causes the data content of the traffic analysis results to change dynamically. Since the information stored in the data structure has an upper limit, when the data structure reaches the storage upper limit according to the LRU (Least recently used) algorithm, new data will replace old data. If the information you want to access happens to be released at this time, a null pointer problem may occur in the data structure of the traffic analysis results in another thread, and finally cause the program to crash. Generally, the above-mentioned resource competition is prevented by locking resources. Resource locking means that access to analysis results is not allowed during the traffic analysis process. The process of traffic identification itself consumes performance. At this time, if resource locking is used to solve the resource competition problem, the performance of the virtual router will be worse.

[0075] Based on the above situation that may cause poor system resource performance, the embodiment of the present application provides the following method. During the flow analysis of the data packet, if the read instruction of the virtual router is detected, the processing sub-thread in the first type of thread will change from the analysis state to the release state. This state transition is temporary and aims to reduce the burden on system resources. In the release state, the processing sub-thread only releases data traffic and does not perform traffic analysis. In this way, when the analysis results need to be output, the processing sub-thread can suspend its analysis work to avoid resource competition during data analysis and result output.

[0076] At this point, the analysis results will be output to the second type of thread, which is responsible for displaying the results. Once the virtual router reads the analysis results, it will notify each processing sub-thread in the first type of thread to change the traffic analysis flags of these threads from the release state back to the analysis state. This mechanism ensures the continuity of traffic analysis and the efficient operation of the system.

[0077] When performing statistical analysis, the processing sub-threads in the first type of thread need to accurately obtain the address information of the data stream to be analyzed. This process is initiated by the user, who selects a specific data stream for analysis. The virtual router then determines the address information of these data streams, which includes pointers and packet lengths. This information will be transmitted to the processing sub-threads. In this way, each processing sub-thread can directly access the data stream at the corresponding address through a pointer, and read and analyze it according to the specified packet length.

[0078] In the brief few seconds after the processing child thread changes to the release state, the few seconds of traffic loss will not have a significant impact on the subsequent traffic analysis, but it avoids resource locking and allows access to the analysis results during the traffic analysis process.

[0079] In addition, the access traffic and analysis result output of the present application are intermittent. After analyzing and outputting a part of the traffic, the next part of the traffic is analyzed and output. In this way, even if there is a storage upper limit for the data structure, it is only necessary to perform traffic analysis based on the latest data, and the previous traffic data is not concerned. This ensures that the pointer is not null when accessing the analysis result, and avoids the problem of null pointers in the data structure when accessing the analysis results of all the traffic in the prior art. The present application will not generate the problem of null pointers, and there is no need to lock resources. The impact of traffic identification on the performance of the virtual router is minimized through lock-free programming.

[0080] In the prior art, the analysis results can be output only after the traffic analysis of all data packets is completed. For example, if there are 100 data packets, the final analysis results can only be obtained after the analysis of these 100 data packets is completed. This will inevitably lead to the problem of poor performance of the virtual router. The present application first analyzes the traffic of some data packets, then suspends the traffic analysis and outputs the analysis results, and then continues to analyze the traffic of the remaining data packets and outputs the analysis results. In this way, the entire data flow is analyzed. For example, 10 data packets are first analyzed to output the traffic analysis results of the 10 data packets, and then the other 10 data packets are analyzed to output the traffic analysis results of the 10 data packets. In this way, all 100 data packets are analyzed and completed.

[0081] The process of analyzing data flow is as follows Figure 3 As shown, the following steps are included:

[0082] Step 301: The vpp command line notifies the vpp worker thread that the traffic analysis result is about to be read and the current pause flag is set.

[0083] Step 302: The vpp command line reads the thread preparation state of the worker thread.

[0084] Step 303: Determine whether the thread preparation state is completed, that is, determine whether the current pause flag is set successfully. If not, return to step 302; if successfully, execute step 304.

[0085] Step 304: The worker thread suspends traffic analysis and uses another thread to output traffic analysis results.

[0086] Step 305: After the output is completed, the current pause flag is cancelled and the traffic analysis continues.

[0087] Among them, traffic analysis by processing sub-threads includes three situations:

[0088] 1. Classify the IP addresses and port numbers in the data stream through the processing sub-threads to identify the device or user that generates specific traffic.

[0089] 2. Identify and count the application layer protocols in the data stream by processing the sub-threads to identify the traffic generated by the specific application, where the application layer protocol includes the request method and the response status code.

[0090] 3. Determine traffic characteristics by processing the sub-thread data flow to collect data packet size, traffic rate, the type and number of protocols used by each IP address, the type and number of protocols used by each port, and the total traffic volume of each protocol.

[0091] Specifically, HTTP and HTTPS are the most commonly used protocols on the Internet. Almost all websites and applications use these two protocols for data transmission. Therefore, by analyzing the traffic of these protocols, a lot of useful information can be obtained. HTTP and HTTPS protocol packets usually have specific characteristics, such as request methods, response status codes, etc. By analyzing these characteristics, the traffic generated by specific applications can be further identified.

[0092] At the network level, traffic can be initially classified by IP address and port number. IP address and port number can help quickly identify which devices or users are generating specific traffic. HTTP and HTTPS protocols usually run on fixed ports (HTTP / 80, HTTPS / 443). By analyzing the traffic of these ports, the source of the traffic can be further refined.

[0093] The size of each data packet can be counted by time to generate a traffic distribution map to help identify the transmission mode of large-volume data packets and detect whether there are abnormally large data packets, which may indicate file transfer, data leakage or other abnormal behavior; the traffic rate of each protocol in different time periods can be counted to understand the frequency of use of different protocols, such as detecting whether there is a sudden increase in traffic rate, which may indicate a DDoS (Distributed Denial of Service Attack) attack or other high-bandwidth occupation activities; the types and number of protocols used by each IP address can be counted to understand the communication mode of different IP addresses, such as detecting whether there is an abnormal increase in traffic at a certain IP address, which may indicate a DDoS attack or other malicious activities; the types and number of protocols used by each port can be counted to understand the communication mode of different ports, such as detecting whether there is an abnormal increase in traffic at a certain port, which may indicate malware communication or other security issues; the total traffic volume of each protocol can be counted, and the proportion of each protocol in the total traffic volume can be calculated to understand the main types of communication in the network, such as detecting whether unknown or uncommon protocols appear, which may indicate malicious activities or configuration errors.

[0094] Among them, the analysis results include the analysis results of commonly used address information and data feature information. Commonly used address information is the interface point where traffic frequently appears, which can reflect which entities (such as specific devices, user groups or organizations) are the main generators of traffic. The analysis results of data feature information include but are not limited to traffic distribution maps, protocol proportions, abnormal traffic detection, etc.

[0095] In addition, in the source code of the target detection library in the prior art, the plug-in node cannot use the traffic data packet directly after receiving it. It is necessary to apply for memory through malloc (memory allocation, dynamic memory allocation) and copy the data packet to the applied memory space. Data copying consumes the performance of the virtual router very much. In order to solve this problem, this application performs a simple optimization on the nDPI_process_packet function. In addition to passing in the data packet, the nDPI_process_packet function also needs to pass in the packet pointer of the data packet. In this way, the data packet can be directly obtained from the address of the data packet pointed to by the packet pointer, eliminating the step of data copying and improving the performance of the virtual router. In addition to passing in the packet pointer, the data packet length can also be passed in. The data packet length is assigned to the variable declared in the structure pcap_pkthdr.

[0096] As an optional implementation, in the process of using a plug-in node to perform traffic analysis on a data packet, the method also includes: during the initialization process of a virtual router, calling a gettimeofday function to obtain a coordination time; in a suricata plug-in of the virtual router, obtaining a system time through a DPDK function interface rte_get_tsc_cycles(); determining a constant value based on a difference between the coordination time and the system time; in the process of using a target appid plug-in to perform traffic analysis on a data packet, obtaining the system time in real time; and determining the real-time coordination time based on a sum of the constant value and the real-time system time.

[0097] Real-time coordinated time can help accurately record the arrival time of each data packet, thereby ensuring the time accuracy of the data flow. By using coordinated time, data can be sorted and filtered more effectively, thereby improving the efficiency of data processing. For example, you can quickly find the traffic peak within a certain time period, or identify abnormal traffic. Real-time coordinated time can also help correlate data from different sources. For example, you can correlate the traffic information of the network layer and the traffic information of the application layer to better understand the behavior pattern of the entire network. By correlating data from different sources, you can perform more in-depth data analysis. For example, you can analyze the user's behavior pattern or predict future network traffic trends.

[0098] The data structure "pcap_pkthdr" corresponding to the packet needs to be assigned the coordinated time UTC (Coordinated Universal Time). In the source code, the coordinated time is generally obtained by calling gettimeofday, but the gettimeofday function is called by the system, and frequent calls consume a lot of performance. In order to solve this problem, this application uses the system time to determine the coordinated time, which specifically includes the following steps.

[0099] Step 1. During the initialization of the virtual router, call the gettimeofday function to obtain UTC.

[0100] Step 2. Get the system time through the DPDK function interface rte_get_tsc_cycles().

[0101] Step 3: Determine a constant value based on the difference between the coordinated time and the system time.

[0102] Constant value = UTC_time - System_time.

[0103] Step 4. Get the system time in real time: real-time System_time.

[0104] Step 5. Real-time UTC_time = real-time System_time + constant value.

[0105] When the application determines the coordination time by using the system time and the constant value, there is no need to frequently call the gettimeofday function, thereby improving the performance of the virtual router. In addition, the constant value itself is obtained based on the difference between UTC_time and System_time, and the formula of step 5 obtained based on the formula of step 3 is also reasonable, and the obtained coordination time is accurate.

[0106] Based on the same technical concept, the present application provides a device for flow analysis using a virtual router, such as Figure 4 As shown, the device comprises:

[0107] A new module 401 is used to add a plug-in node in the virtual router, wherein the plug-in node includes the function of the virtual router and includes path pointing information for calling a target detection library, and the target detection library is used to identify application layer traffic;

[0108] A calling module 402 is used to call a data processing function in a target detection library through path pointing information in a plug-in node after the virtual router receives the data stream;

[0109] The analysis module 403 is used to perform statistical analysis on the data flow through a data processing function.

[0110] Optionally, the device is also used for:

[0111] Insert the static library and third-party information in the target detection library into the plugin node;

[0112] Compile the plug-in node according to its header file directory, static library and third-party information;

[0113] Determine the path pointing to the static library based on the compiled plug-in node.

[0114] Optionally, the device is also used for:

[0115] Find and delete the data stream packet receiving method of the static library in the target detection library, where the packet receiving method in the target detection library is incompatible with the packet receiving method in the virtual router;

[0116] Insert the static library after deleting the packet receiving method into the plug-in node.

[0117] Optionally, the analysis module 403 is used to:

[0118] Sending a read instruction to each processing sub-thread in the first type of thread through a virtual router, so that the processing sub-thread changes from an analysis state to a release state after receiving the read instruction, wherein the release state is used to indicate that the processing sub-thread only releases data traffic but does not perform traffic analysis;

[0119] After the virtual router detects that the traffic analysis flag of the processing sub-thread is changed from the analysis state to the release state, the analysis result of the traffic is read according to the processing sub-thread of the second type of thread;

[0120] After the analysis result is read, the flow analysis flag of the processing sub-thread in the first type of thread is notified to change from the release state to the analysis state, so that the processing sub-thread continues to perform flow analysis.

[0121] Optionally, the device is also used for:

[0122] The pointer of the address information of the data stream to be read and the data packet length are transmitted to the processing subthreads in the first type of thread through the virtual router, so that each processing subthread reads the data stream with the data packet length from the corresponding address information through the pointer and performs statistical analysis.

[0123] Optionally, the device is also used for:

[0124] Classify IP addresses and port numbers in data streams through processing subthreads to identify devices or users that generate specific traffic;

[0125] By processing the sub-thread, the application layer protocol in the data stream is identified and counted to identify the traffic generated by the specific application, wherein the application layer protocol includes the request method and the response status code;

[0126] Traffic characteristics are determined by processing the data packet size, traffic rate, type and number of protocols used by each IP address, type and number of protocols used by each port, and total traffic volume of each protocol in the data flow through the processing sub-thread.

[0127] Optionally, the analysis result includes a common address information analysis result and a data feature information analysis result, wherein the common address information analysis result is used to indicate a unique address of a main generator of traffic.

[0128] like Figure 5 As shown, an embodiment of the present application provides an electronic device, including a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0129] The memory 503 is used to store computer programs.

[0130] In one embodiment of the present application, the processor 501 is used to execute the program stored in the memory 503 to implement the method for performing traffic analysis using a virtual router provided by any of the aforementioned method embodiments, including:

[0131] Add a plug-in node in the virtual router, where the plug-in node contains the functions of the virtual router and contains the path pointing information for calling the target detection library, which is used to identify application layer traffic;

[0132] After the virtual router receives the data stream, it calls the data processing function in the target detection library through the path pointing information in the plug-in node;

[0133] Perform statistical analysis on data streams through data processing functions.

[0134] Optionally, before calling the data processing function in the target detection library through the path pointing information in the plug-in node, the method further includes:

[0135] Insert the static library and third-party information in the target detection library into the plugin node;

[0136] Compile the plug-in node according to its header file directory, static library and third-party information;

[0137] Determine the path pointing to the static library based on the compiled plug-in node.

[0138] Optionally, inserting a static library from the object detection library into the plugin node includes:

[0139] Find and delete the data stream packet receiving method of the static library in the target detection library, where the packet receiving method in the target detection library is incompatible with the packet receiving method in the virtual router;

[0140] Insert the static library after deleting the packet receiving method into the plug-in node.

[0141] Optionally, performing statistical analysis on the data stream through the data processing function includes:

[0142] Sending a read instruction to each processing sub-thread in the first type of thread through a virtual router, so that the processing sub-thread changes from an analysis state to a release state after receiving the read instruction, wherein the release state is used to indicate that the processing sub-thread only releases data traffic but does not perform traffic analysis;

[0143] After the virtual router detects that the traffic analysis flag of the processing sub-thread is changed from the analysis state to the release state, the analysis result of the traffic is read according to the processing sub-thread of the second type of thread;

[0144] After the analysis result is read, the flow analysis flag of the processing sub-thread in the first type of thread is notified to change from the release state to the analysis state, so that the processing sub-thread continues to perform flow analysis.

[0145] Optionally, after sending the read instruction to each processing sub-thread in the first type of thread through the virtual router, the method further includes:

[0146] The pointer of the address information of the data stream to be read and the data packet length are transmitted to the processing subthreads in the first type of thread through the virtual router, so that each processing subthread reads the data stream with the data packet length from the corresponding address information through the pointer and performs statistical analysis.

[0147] Optionally, performing traffic analysis by processing the sub-thread includes:

[0148] Classify IP addresses and port numbers in data streams through processing subthreads to identify devices or users that generate specific traffic;

[0149] By processing the sub-thread, the application layer protocol in the data stream is identified and counted to identify the traffic generated by the specific application, wherein the application layer protocol includes the request method and the response status code;

[0150] Traffic characteristics are determined by processing the data packet size, traffic rate, type and number of protocols used by each IP address, type and number of protocols used by each port, and total traffic volume of each protocol in the data flow through the processing sub-thread.

[0151] Optionally, the analysis result includes a common address information analysis result and a data feature information analysis result, wherein the common address information analysis result is used to indicate a unique address of a main generator of traffic.

[0152] The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for performing traffic analysis using a virtual router as provided in any of the aforementioned method embodiments are implemented.

[0153] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0155] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0156] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for traffic analysis using a virtual router, characterized in that: The method comprises: Adding a plug-in node in the virtual router, wherein the plug-in node includes the function of the virtual router and includes path pointing information for calling a target detection library, wherein the target detection library is used to identify application layer traffic; After the virtual router receives the data stream, the data processing function in the target detection library is called through the path pointing information in the plug-in node; The data stream is statistically analyzed by the data processing function.

2. The method according to claim 1, characterized in that Before calling the data processing function in the target detection library through the path pointing information in the plug-in node, the method further includes: Inserting the static library and third-party information in the target detection library into the plug-in node; Compiling the plug-in node according to the header file directory of the plug-in node itself, the static library and the third-party information; The path pointing information pointing to the static library is determined according to the compiled plug-in node.

3. The method according to claim 2, characterized in that Inserting the static library in the target detection library into the plug-in node includes: Find and delete the data flow packet receiving mode of the static library in the target detection library, wherein the packet receiving mode in the target detection library is incompatible with the packet receiving mode in the virtual router; Insert the static library after deleting the packet receiving mode into the plug-in node.

4. The method according to claim 1, characterized in that: Performing statistical analysis on the data stream by using the data processing function includes: Sending a read instruction to each processing sub-thread in the first type of thread through the virtual router, so that the processing sub-thread changes from an analysis state to a release state after receiving the read instruction, wherein the release state is used to indicate that the processing sub-thread only releases data traffic but does not perform traffic analysis; After the virtual router detects that the traffic analysis flag of the processing sub-thread is changed from the analysis state to the release state, reading the analysis result of the traffic according to the processing sub-thread of the second type of thread; After reading the analysis result, the flow analysis flag of the processing sub-thread in the first type of thread is notified to change from the release state to the analysis state, so that the processing sub-thread continues to perform flow analysis.

5. The method according to claim 4, characterized in that After sending the read instruction to each processing sub-thread in the first type of thread through the virtual router, the method further includes: The pointer of the address information of the data stream to be read and the data packet length are transmitted to the processing sub-threads in the first type of threads through the virtual router, so that each processing sub-thread reads the data stream with the data packet length from the corresponding address information through the pointer and performs statistical analysis.

6. The method according to claim 4, characterized in that Traffic analysis by processing subthreads includes: Classifying the IP addresses and port numbers in the data stream by the processing subthread to identify the device or user generating the specific traffic; Identifying and counting the application layer protocol in the data flow through the processing subthread to identify the traffic generated by the specific application, wherein the application layer protocol includes a request method and a response status code; The processing subthread counts the data packet size, traffic rate, the type and number of protocols used by each IP address, the type and number of protocols used by each port, and the total traffic volume of each protocol in the data flow to determine the traffic characteristics.

7. The method according to claim 4, characterized in that The analysis result includes a common address information analysis result and a data feature information analysis result, wherein the common address information analysis result is used to indicate a unique address of a main generator of traffic.

8. A device for traffic analysis using a virtual router, characterized in that: The device comprises: A new module is used to add a plug-in node in the virtual router, wherein the plug-in node includes the function of the virtual router and includes path pointing information for calling a target detection library, and the target detection library is used to identify application layer traffic; A calling module, configured to call a data processing function in the target detection library through the path pointing information in the plug-in node after the virtual router receives the data stream; An analysis module is used to perform statistical analysis on the data flow through the data processing function.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-7 when executing a program stored in a memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images