Protocol identification method and device, and storage medium

Abstract

The embodiment of the invention provides a protocol identification method and device and a storage medium, and belongs to the technical field of communication. The method comprises the following steps: receiving a signaling borne by a TCP (Transmission Control Protocol), extracting tetrad information of the signaling, and performing protocol identification on the signaling according to the tetrad information; if the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, performing protocol decoding on the signaling; and determining a protocol corresponding to the signaling as an HTTP / 2 protocol under the condition of successful decoding. According to the embodiment of the invention, for the signaling borne by the TCP through the unknown port, accurate identification can be realized, and the identification efficiency, comprehensiveness and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a protocol identification method, device and storage medium. Background Art

[0002] With the development of communication technology, the communication industry has ushered in a new era of 4G traffic explosion and accelerated 5G deployment. At the same time, operators are also facing challenges of higher network complexity and construction and operation and maintenance costs. The traditional operation system is large and complex, and the difficulty of network management has exceeded the ability of manual processing. In order to assist operators in the management and control of network data services, signaling monitoring methods are widely used in the network. Through real-time signaling monitoring, the key indicators of network data service operation can be grasped, so as to provide early warning and quickly locate and eliminate network risks, and improve user experience perception.

[0003] Both the 5G core network and the 5G new call core network adopt a service-oriented network architecture design, and each NF (Network Function) interacts with each other through HTTP / 2 (Hypertext Transfer Protocol Version 2). For the monitoring of HTTP / 2 signaling of these two types of networks, the first problem to be solved is how to identify HTTP / 2 signaling.

[0004] In the related art, HTTP / 2 signaling is usually identified through a well-known port identification method. Well-known ports 80 or 8080 are reserved for HTTP / 2 signaling interaction. If TCP (Transmission Control Protocol) carries signaling through port 80 or 8080, it can be determined that the signaling is HTTP / 2 signaling. However, NF can be configured to use non-well-known ports for business interaction, and HTTP / 2 signaling carried by TCP through non-well-known ports cannot be identified.

[0005] In view of this, how to identify whether the signaling carried by TCP belongs to the HTTP / 2 protocol type has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The main purpose of the embodiments of the present invention is to provide a protocol identification method, device and storage medium, aiming to solve the technical problem of how to identify whether the signaling carried by TCP belongs to the HTTP / 2 protocol type.

[0007] In a first aspect, an embodiment of the present invention provides a protocol identification method, including:

[0008] Receive signaling carried by TCP, extract quadruple information of the signaling, and perform protocol identification on the signaling according to the quadruple information;

[0009] If the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, performing protocol decoding on the signaling;

[0010] When the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol.

[0011] In a second aspect, an embodiment of the present invention further provides a protocol identification device, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of any one of the protocol identification methods provided in the specification of the present invention are implemented.

[0012] In a third aspect, an embodiment of the present invention further provides a storage medium for computer-readable storage, characterized in that the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any protocol identification method provided in the specification of the present invention.

[0013] The embodiment of the present invention provides a protocol identification method, device and storage medium. The protocol identification method receives signaling carried by TCP, extracts the four-tuple information of the signaling, and performs protocol identification on the signaling according to the four-tuple information; if the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is protocol decoded; if the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol. The present invention can preliminarily and quickly identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol based on the four-tuple information of the signaling. If the preliminary identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is further protocol decoded, and the decoding result is finally used to identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol. Through the above method, even if the signaling is carried by TCP through a non-well-known port, accurate identification can be achieved, which improves the efficiency, comprehensiveness and accuracy of identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1 A flowchart of a protocol identification method provided by an embodiment of the present invention;

[0016] Figure 2 A schematic diagram of the frame structure of the HTTP / 2 protocol involved in the protocol identification method provided in an embodiment of the present invention;

[0017] Figure 3a A schematic diagram of a deployment of a protocol identification device involved in the protocol identification method provided in an embodiment of the present invention;

[0018] Figure 3b Another schematic diagram of the deployment of a protocol identification device involved in the protocol identification method provided in an embodiment of the present invention;

[0019] Figure 4a A schematic diagram of the architecture of a protocol identification device involved in a protocol identification method provided in an embodiment of the present invention;

[0020] Figure 4b A schematic diagram of a flow chart of implementing protocol identification by a protocol identification device in a protocol identification method provided in an embodiment of the present invention;

[0021] Figure 5 A schematic diagram of a process of performing protocol decoding on signaling by a HEADER frame decoding module in a protocol identification method provided in an embodiment of the present invention;

[0022] Figure 6 An example diagram of an application scenario involved in the protocol identification method provided in an embodiment of the present invention;

[0023] Figure 7 A schematic block diagram of the structure of a protocol identification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0026] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0027] In the related art, for the identification of signaling carried by TCP through a non-well-known port, one way is that the client sends a message containing a 24-byte Magic string "PRI*HTTP / 2.0\r\n\r\nSM\r\n\r\n" to the server. If the first application layer message collected after the TCP handshake contains this string, then it can be identified that the application layer protocol carried by the current TCP connection is the HTTP / 2 protocol. However, signaling is received at any time. It is possible that the client has already sent the Magic string when the signaling is received, or the signaling carrying the Magic information is lost on the intermediate transmission device and the Magic string message cannot be collected, resulting in the inability to identify subsequent signaling on the TCP connection.

[0028] Another way is for the signaling monitoring operation and maintenance personnel to pre-configure the non-well-known port number used by each NF HTTP / 2, obtain the configuration file, and when TCP carries the signaling through the non-well-known port, match it in the configuration file. If the match is successful, it can be identified that the signaling corresponds to the HTTP / 2 protocol. However, this method also has its limitations. It is necessary to obtain the non-well-known port number used by the NF HTTP / 2 of the entire network, and when the NF configuration changes, it is also necessary to promptly notify the signaling monitoring operation and maintenance personnel to modify the configuration, which is almost impossible to achieve.

[0029] It can be seen that the existing identification method for signaling carried by TCP through non-well-known ports has low efficiency, comprehensiveness and accuracy.

[0030] To this end, an embodiment of the present invention provides a protocol identification method, device and storage medium. The protocol identification method can preliminarily and quickly identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol based on the four-tuple information of the signaling. If the preliminary identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is further protocol decoded, and the decoding result is finally used to identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol. In the above manner, even if the signaling is carried by TCP through a non-well-known port, accurate identification can be achieved, thereby improving the efficiency, comprehensiveness and accuracy of identification.

[0031] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0032] Please refer to Figure 1 , Figure 1 A flowchart of a protocol identification method provided by an embodiment of the present invention.

[0033] like Figure 1 As shown, the protocol identification method includes steps S101 to S103.

[0034] Step S101: Receive signaling carried by TCP, extract four-tuple information of the signaling, and perform protocol identification on the signaling according to the four-tuple information.

[0035] The protocol identification method can be applied to network operation and maintenance scenarios of the 5G core network and the 5G new call core network. In the network operation and maintenance scenario, the protocol identification method can be implemented by a protocol identification device, which can be a terminal device with data processing function such as a server.

[0036] When receiving signaling carried by TCP, the signaling monitoring system extracts the four-tuple information of the signaling, and performs protocol identification on the signaling based on the extracted four-tuple information, thereby preliminarily and quickly identifying whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0037] In some embodiments, the four-tuple information of the signaling includes a source IP address, a source port number, a destination IP address, and a destination port number.

[0038] In some embodiments, the protocol of the signaling is identified based on the four-tuple information, which can be to compare the four-tuple information with a pre-stored protocol type database to determine whether there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database; if there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol; if there is no pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, it is impossible to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0039] In order to simplify the protocol identification process and improve the efficiency of protocol identification, a pre-stored protocol type database can be pre-built. The pre-stored protocol type data stores the four-tuple information (defined as pre-stored four-tuple information) corresponding to the HTTP / 2 signaling carried by TCP through a non-well-known port that has been historically identified. Specifically, since HTTP / 2 is a long connection, after the connection is established, signaling with a protocol type of HTTP / 2 can be transmitted multiple times. For a connection established by TCP using a non-well-known port, if a signaling on its connection is identified as belonging to the HTTP / 2 protocol, then subsequent signaling on its connection must also be a signaling with a protocol type of HTTP / 2. Therefore, the four-tuple information corresponding to the HTTP / 2 signaling carried by TCP through a non-well-known port that has been historically identified can be recorded, its application layer protocol type can be marked as HTTP / 2, and then stored to obtain a pre-stored protocol type database.

[0040] In this way, when the signaling monitoring system receives signaling carried by TCP, it can extract the four-tuple information of the signaling, compare the extracted four-tuple information with the pre-stored protocol type database, and then find out whether there is pre-stored four-tuple information consistent with the extracted four-tuple information in the pre-stored protocol type database.

[0041] If pre-stored four-tuple information consistent with the extracted four-tuple information is found in the pre-stored protocol type database, it is determined that the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0042] If the pre-stored four-tuple information consistent with the extracted four-tuple information cannot be found in the pre-stored protocol type database, considering the limitations of the pre-stored protocol type database, it cannot be determined whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, and the protocol identification fails.

[0043] In this way, based on the four-tuple information of the signaling and the pre-stored protocol type database, it is possible to preliminarily and quickly identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, thereby improving the efficiency of protocol identification.

[0044] Step S102: If the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is subjected to protocol decoding;

[0045] After the signaling is identified according to the four-tuple information of the signaling, if it is still not certain whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, in order to improve the accuracy of protocol identification, the signaling is further decoded.

[0046] In some embodiments, protocol decoding of the signaling may be performed by parsing the protocol characteristics of the signaling to determine whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol; if the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, it is determined that the decoding is successful.

[0047] Since RFC7540 defines the HTTP / 2 protocol specification, it can be known that the HTTP / 2 protocol has specific characteristics. In this way, the protocol characteristics of the signaling can be parsed to determine whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol. If the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, it is determined that the decoding is successful. If the characteristics of the signaling do not conform to the characteristics of the HTTP / 2 protocol, it is determined that the decoding fails.

[0048] In some embodiments, determining whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol may be performed by decoding the frame structure corresponding to the signaling to determine whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol; if the frame structure conforms to the frame structure of the HTTP / 2 protocol, decoding the header field corresponding to the signaling; if the number of decoded header field fields meets a preset number, determining that the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol.

[0049] The specific features of the HTTP / 2 protocol include that the HTTP / 2 protocol has a specific frame structure (also known as a frame format). Based on RFC7540, it can be seen that the HTTP / 2 protocol consists of multiple types of frames. Figure 2 , Figure 2 This is a schematic diagram of the frame structure of the HTTP / 2 protocol. Figure 2 As shown, the frame header length of the HTTP / 2 protocol is 9 (24+8+8+1+31=72bit) bytes; the frame type is indicated by Type. It should be noted that, in the application scenario of the embodiment of the invention, the signaling monitoring system processes HEADER frames of Type=1 and DATA frames of Type=0; the frame payload (Frame Payload) length is indicated by the Length field.

[0050] The payload of the HEADER frame is encoded using HPACK, which is a compression encoding technology for HEADER frames and includes 8 encoding methods. The header field of the HEADER frame transmission selects one of the 8 encoding methods according to the rules for encoding, and each encoding method implies the encoding type and encoding length.

[0051] Therefore, the frame structure of the signaling can be decoded according to the frame structure of the HTTP / 2 protocol to determine whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol.

[0052] In some embodiments, determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol may be to determine whether the frame header length corresponding to the signaling satisfies a first preset length; if the frame header length satisfies the first preset length, determining whether the type of the frame corresponding to the signaling belongs to the preset frame type; if the frame type belongs to the preset frame type, determining whether the payload length of the frame corresponding to the signaling satisfies a second preset length; if the payload length of the frame satisfies the second preset length, determining whether the sum of the frame header length and the frame payload length satisfies a third preset length; if the sum of the frame header length and the frame payload length satisfies the third preset length, determining that the frame structure meets the preset conditions.

[0053] That is, first, according to the frame header format of the HTTP / 2 protocol, decode the frame header length corresponding to the signaling, and determine whether the frame header length corresponding to the signaling is greater than or equal to 9 (defined as the first preset length). If the frame header length corresponding to the signaling is less than 9, it is not a complete HTTP / 2 frame header, the protocol decoding of the signaling fails, and it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol.

[0054] If the length of the frame header corresponding to the signaling is greater than or equal to 9, decode the frame type (Type) corresponding to the signaling to determine whether the frame type corresponding to the signaling belongs to the HEADER frame (defined as the preset frame type). If the frame type corresponding to the signaling does not belong to the HEADER frame (that is, the Type corresponding to the signaling is not equal to 1), it means that the decoding of the HEADER frame of the signaling has failed, and it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol.

[0055] If the frame type corresponding to the signaling is a HEADER frame, it must have a payload, and the frame header Length field must be greater than 0. Therefore, the payload length of the frame corresponding to the signaling is further decoded to determine whether the payload length of the frame corresponding to the signaling is greater than 0 (defined as the second preset length). If the payload length of the frame corresponding to the signaling is 0 (that is, the frame header Length field corresponding to the signaling is 0), it is determined that the frame corresponding to the signaling does not belong to a HEADER frame, indicating that the decoding of the signaling HEADER frame has failed, and it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol.

[0056] If the payload length of the frame corresponding to the signaling is greater than 0, it is further determined whether the sum of the frame header length corresponding to the signaling and the frame payload length is less than or equal to the length of the TCP Payload (defined as the third preset length). If the sum of the frame header length corresponding to the signaling and the frame payload length is greater than the length of the TCP Payload, it means that the frame corresponding to the signaling is not a complete HEADER frame, and it is determined that the decoding of the HEADER frame of the signaling fails, and it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol.

[0057] If the sum of the frame header length corresponding to the signaling and the frame payload length is less than or equal to the length of the TCP Payload, it means that the frame corresponding to the signaling is a complete HEADER frame. It can be preliminarily determined that the HEADER frame decoding of the signaling is successful. At this time, it can be determined that the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol.

[0058] In order to improve the recognition accuracy, the header field corresponding to the signaling is further decoded according to the HPACK encoding method. It should be noted that only when more than 3 header fields are decoded can it be reliable, so it is judged whether the number of header fields corresponding to the signaling is greater than 3 (defined as a preset number). If the number of header fields corresponding to the signaling is greater than 3, it is finally determined that the HEADER frame of the signaling is decoded successfully, and it is determined that the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0059] Through the above method, the rigor of signaling decoding is improved, thereby improving the accuracy of protocol identification.

[0060] Step S103: When the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol.

[0061] In the case of successful decoding, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol. In this way, when the quadruple information of the signaling fails to identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the protocol decoding of the signaling is further realized, and finally the decoding determines whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, thereby improving the comprehensiveness and accuracy of the identification.

[0062] In some embodiments, after determining the protocol corresponding to the signaling as the HTTP / 2 protocol, the protocol type of the four-tuple information of the signaling can also be marked as the HTTP / 2 protocol, and the marked four-tuple information can be stored in a pre-stored protocol type database to expand the pre-stored protocol type database and provide convenience for subsequent protocol identification.

[0063] In some embodiments, when decoding fails, it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol, and the signaling is discarded.

[0064] The protocol identification method provided above receives signaling carried by TCP, extracts the four-tuple information of the signaling, and performs protocol identification on the signaling according to the four-tuple information; if the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is protocol decoded; if the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol. The present invention can preliminarily and quickly identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol based on the four-tuple information of the signaling. If the preliminary identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is further protocol decoded, and the decoding result is finally used to identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol. Through the above method, even if the signaling is carried by TCP through a non-well-known port, accurate identification can be achieved, which improves the efficiency, comprehensiveness and accuracy of identification.

[0065] In some embodiments, in order to facilitate the signaling monitoring system to perform protocol identification, a protocol identification device may be deployed for the signaling monitoring system, so that the protocol identification of the signaling is realized through the protocol identification device. For example, a protocol identification device may be built into the signaling monitoring system, such as Figure 3a As shown; the protocol identification device can also be placed in front of the signaling monitoring system, such as Figure 3b Regardless of the deployment method, the signaling monitoring system must first identify the protocol of the signaling, and only when it is identified that the protocol corresponding to the signaling belongs to the HTTP / 2 protocol can the subsequent XDR synthesis processing be performed.

[0066] In some embodiments, Figure 4a As shown, Figure 4a This is a schematic diagram of the architecture of a protocol identification device. The protocol identification device may include functional modules such as a protocol identification main module, a data storage module, and a HEADER frame decoding module.

[0067] Please continue reading Figure 4b , Figure 4bThe present invention is a flow chart of the signaling monitoring system realizing protocol identification through the above-mentioned functional modules of the protocol identification device. Specifically, ① when the signaling monitoring system receives the signaling carried by TCP, it first extracts the four-tuple information of the signaling through the protocol identification main module of the protocol identification device; ② then, through the data storage module of the protocol identification device, it queries whether there is pre-stored four-tuple information matching the four-tuple information of the signaling in the pre-stored protocol type database. If the query is successful, the message of successful query is returned to the protocol identification main module, and the protocol identification main module determines the protocol corresponding to the signaling as the HTTP / 2 protocol. If the query fails, the message of failed query is returned to the protocol identification main module; ③ then, through the HEADER frame decoding module of the protocol identification device, the signaling is decoded according to the format of the HEADER frame of HTTP / 2; ④ the decoding result is returned to the protocol identification main module; ⑤ when the protocol identification main module confirms that the decoding is successful, the protocol type of the four-tuple information of the signaling is marked as the HTTP / 2 protocol through the data storage module, and the marked four-tuple information is stored in the pre-stored protocol type database; ⑥ the protocol identification main module determines the protocol corresponding to the signaling as the HTTP / 2 protocol.

[0068] In this way, the signaling monitoring system performs preliminary protocol identification on the signaling carried by TCP through the above-mentioned functional module of the protocol identification device, and when the preliminary identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is further protocol decoded, and finally it is determined through the decoding whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, thereby achieving efficient, comprehensive and accurate identification of the signaling.

[0069] In some embodiments, see Figure 5 , Figure 5The present invention is a flowchart of protocol decoding of signaling through a HEADER frame decoding module. Specifically, firstly, decode the frame header length corresponding to the signaling to determine whether the frame header length corresponding to the signaling is greater than or equal to 9. If the frame header length corresponding to the signaling is less than 9, the HEADER frame decoding fails; if the frame header length corresponding to the signaling is greater than or equal to 9, then decode the frame type corresponding to the signaling to determine whether the frame type corresponding to the signaling is a HEADER frame. If the frame type corresponding to the signaling is not a HEADER frame, the HEADER frame decoding fails; if the frame type corresponding to the signaling is a HEADER frame, then decode the payload length of the frame corresponding to the signaling to determine whether the payload length of the frame corresponding to the signaling is greater than 0. If the payload length of the frame corresponding to the signaling is 0, the HEADER frame decoding fails; if the payload length of the frame corresponding to the signaling is greater than 0, continue to determine whether the sum of the frame header length corresponding to the signaling and the payload length of the frame is less than or equal to the length of the TCP Payload. If the sum of the frame header length corresponding to the signaling and the payload length of the frame is greater than the length of the TCP Payload, the HEADER frame decoding fails; if the sum of the frame header length corresponding to the signaling and the payload length of the frame is less than or equal to the TCP Payload, The length of the Payload is further decoded according to the HPACK encoding method, and when more than three header fields are decoded, the HEADER frame is decoded successfully, and it can be determined that the protocol corresponding to the signaling belongs to the HTTP / 2 protocol. Through the above method, the rigor and correctness of the protocol decoding are improved, thereby improving the accuracy of signaling recognition.

[0070] For a better understanding of the above embodiments, please refer to Figure 6 , Figure 6 This is an example diagram of an application scenario for protocol identification. The example application scenarios are as follows:

[0071] In the network operation and maintenance scenarios of the 5G core network and the 5G new call core network, when the signaling monitoring system receives signaling carried by TCP, it first performs well-known port identification to determine whether the signaling is carried by TCP through the well-known port 80 or 8080. If not, it means that the signaling is carried by TCP through a non-well-known port; then the four-tuple information of the signaling is extracted, and the pre-stored protocol type database is queried to see whether there is pre-stored four-tuple information matching the four-tuple information of the signaling. If the query is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol. If the query fails, the signaling is decoded. If the decoding is successful, the protocol corresponding to the signaling is finally determined to be the HTTP / 2 protocol, thereby realizing accurate identification of signaling carried by non-well-known ports and improving the efficiency, comprehensiveness and accuracy of identification.

[0072] See also Figure 7 , Figure 7A schematic block diagram of the structure of a protocol identification device provided by an embodiment of the present invention.

[0073] like Figure 7 As shown, the protocol identification device 300 includes a processor 301 and a memory 302, and the processor 301 and the memory 302 are connected via a bus 303, such as an I2C (Inter-integrated Circuit) bus.

[0074] Specifically, the processor 301 is used to provide computing and control capabilities to support the operation of the entire protocol identification device. The processor 301 can be a central processing unit (CPU), and the processor 301 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0075] Specifically, the memory 302 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0076] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a partial structure related to the embodiment of the present invention, and does not constitute a limitation on the protocol identification device to which the embodiment of the present invention is applied. The specific server may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0077] The processor is used to run a computer program stored in a memory, and implement any one of the protocol identification methods provided by the embodiments of the present invention when executing the computer program.

[0078] In one embodiment, the processor is used to run a computer program stored in the memory, and implements the following steps when executing the computer program:

[0079] Receive signaling carried by TCP, extract quadruple information of the signaling, and perform protocol identification on the signaling according to the quadruple information;

[0080] If the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, performing protocol decoding on the signaling;

[0081] When the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol.

[0082] In one embodiment, when the processor implements the protocol identification of the signaling according to the quadruple information, it is used to implement:

[0083] Compare the four-tuple information with a pre-stored protocol type database to determine whether there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database;

[0084] If there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, determining the protocol corresponding to the signaling as the HTTP / 2 protocol;

[0085] If there is no pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, it is not possible to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0086] In one embodiment, when implementing the protocol decoding of the signaling, the processor is used to implement:

[0087] Parsing the protocol characteristics of the signaling, and determining whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol;

[0088] If the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, it is determined that the decoding is successful.

[0089] In one embodiment, when the processor implements the parsing of the protocol features of the signaling and determining whether the protocol features of the signaling conform to features of the HTTP / 2 protocol, it is configured to implement:

[0090] Decoding the frame structure corresponding to the signaling, and determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol;

[0091] If the frame structure conforms to the frame structure of the HTTP / 2 protocol, decoding the header field corresponding to the signaling;

[0092] If the number of decoded header field fields meets the preset number, it is determined that the protocol characteristics of the signaling meet the characteristics of the HTTP / 2 protocol.

[0093] In one embodiment, when the processor implements the step of determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol, the processor is further configured to implement:

[0094] Determining whether the frame header length corresponding to the signaling meets a first preset length;

[0095] If the frame header length satisfies a first preset length, determining whether the type of the frame corresponding to the signaling belongs to a preset frame type;

[0096] If the type of the frame belongs to the preset frame type, determining whether the payload length of the frame corresponding to the signaling satisfies a second preset length;

[0097] If the payload length of the frame satisfies the second preset length, determining whether the sum of the frame header length and the payload length of the frame satisfies the third preset length;

[0098] If the sum of the frame header length and the frame payload length meets a third preset length, it is determined that the frame structure complies with the frame structure of the HTTP / 2 protocol.

[0099] In one embodiment, after the processor implements the step of determining that the protocol corresponding to the signaling is the HTTP / 2 protocol when the decoding is successful, it is further configured to implement:

[0100] The protocol type of the four-tuple information is marked as HTTP / 2 protocol, and the marked four-tuple information is stored in the pre-stored protocol type database.

[0101] In one embodiment, after implementing the protocol decoding of the signaling, the processor is further configured to implement:

[0102] In the case where the decoding fails, it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol, and the signaling is discarded.

[0103] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the protocol identification device described above can refer to the corresponding process in the aforementioned protocol identification method embodiment, and will not be repeated here.

[0104] An embodiment of the present invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any protocol identification method provided in the description of the embodiment of the present invention.

[0105] The storage medium may be an internal storage unit of the protocol identification device described in the foregoing embodiment, such as a hard disk or memory of the protocol identification device. The storage medium may also be an external storage device of the protocol identification device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the protocol identification device.

[0106] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0107] It should be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0108] The serial numbers of the embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. The above description is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A protocol identification method, characterized in that: include: Receive signaling carried by TCP, extract quadruple information of the signaling, and perform protocol identification on the signaling according to the quadruple information; If the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, performing protocol decoding on the signaling; When the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol.

2. The protocol identification method according to claim 1, characterized in that: The performing protocol identification on the signaling according to the four-tuple information includes: Compare the four-tuple information with a pre-stored protocol type database to determine whether there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database; If there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, determining the protocol corresponding to the signaling as the HTTP / 2 protocol; If there is no pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, it is not possible to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

3. The protocol identification method according to claim 1, characterized in that: The performing protocol decoding on the signaling includes: Parsing the protocol characteristics of the signaling, and determining whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol; If the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, it is determined that the decoding is successful.

4. The protocol identification method according to claim 3, characterized in that: The parsing of the protocol features of the signaling to determine whether the protocol features of the signaling conform to features of the HTTP / 2 protocol includes: Decoding the frame structure corresponding to the signaling, and determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol; If the frame structure conforms to the frame structure of the HTTP / 2 protocol, decoding the header field corresponding to the signaling; If the number of decoded header field fields meets the preset number, it is determined that the protocol characteristics of the signaling meet the characteristics of the HTTP / 2 protocol.

5. The protocol identification method according to claim 4, characterized in that: The determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol includes: Determining whether the frame header length corresponding to the signaling meets a first preset length; If the frame header length satisfies a first preset length, determining whether the type of the frame corresponding to the signaling belongs to a preset frame type; If the type of the frame belongs to the preset frame type, determining whether the payload length of the frame corresponding to the signaling satisfies a second preset length; If the payload length of the frame satisfies the second preset length, determining whether the sum of the frame header length and the payload length of the frame satisfies the third preset length; If the sum of the frame header length and the frame payload length meets a third preset length, it is determined that the frame structure complies with the frame structure of the HTTP / 2 protocol.

6. The protocol identification method according to claim 2, characterized in that: In the case where the decoding is successful, after determining that the protocol corresponding to the signaling is the HTTP / 2 protocol, the method includes: The protocol type of the four-tuple information is marked as HTTP / 2 protocol, and the marked four-tuple information is stored in the pre-stored protocol type database.

7. The protocol identification method according to claim 1, characterized in that: The four-tuple information includes a source IP address, a source port number, a destination IP address and a destination port number.

8. The protocol identification method according to claim 1, characterized in that: After the signaling is subjected to protocol decoding, the method further comprises: In the case where the decoding fails, it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol, and the signaling is discarded.

9. A protocol identification device, characterized in that: The protocol identification device includes a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of the protocol identification method according to any one of claims 1 to 8 are implemented.

10. A storage medium for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the protocol identification method described in any one of claims 1 to 8.

Images