Service type determination method of network traffic, electronic equipment and readable storage medium

Abstract

The invention discloses a network flow service type determination method, electronic equipment and a readable storage medium, and the method comprises the steps: obtaining a QUIC migration flow, and determining a first recognition feature corresponding to the QUIC migration flow; matching from a metadata object to obtain a negotiation service type corresponding to the first identification feature; the metadata object is generated based on a second identification feature and a negotiation service type corresponding to a QUIC negotiation flow corresponding to the QUIC migration flow; and taking the negotiation service type as a migration service type corresponding to the QUIC migration flow. According to the method and the device, the migration service type corresponding to the QUIC migration flow can be determined after connection migration.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a method for determining the service type of network traffic, an electronic device, and a readable storage medium. Background Art

[0002] Most of the services on the Internet are carried by HTTP (HyperText Transfer Protocol). With the update and iteration of HTTP, the connection migration function was introduced in the underlying protocol QUIC (Quick UDP Internet Connections) of HTTP / 3. Among them, the network traffic of HTTP includes the QUIC negotiation flow in the handshake negotiation phase between the terminal device and the server before the connection migration, and the QUIC migration flow after the connection migration. It should be noted that detecting HTTP network traffic and accurately identifying the service type is one of the most important capabilities of the DPI (Deep Packet Inspection) system. Through this service type, operators can perform traffic billing, QoS (Quality of Service) assurance, and generate service statistics reports.

[0003] In actual applications, the service type includes the negotiated service type before connection migration and the migrated service type after connection migration. Before connection migration, the DPI system can determine the negotiated service type through the SNI (Server Name Indication) in the ClientHello message in the QUIC negotiation stream. However, after the connection migration occurs, since there will be no handshake negotiation between the terminal device and the server again, the DPI system cannot obtain SNI from the QUIC migration stream, resulting in the inability to determine the migration service type corresponding to the QUIC migration stream.

[0004] Therefore, in practical applications, a solution is needed that can accurately determine the migration service type corresponding to the QUIC migration flow after the connection is migrated. Summary of the invention

[0005] The main purpose of the present application is to provide a method for determining the service type of network traffic, an electronic device and a readable storage medium, aiming to solve the technical problem that after the connection is migrated, it is impossible to determine the migration service type corresponding to the QUIC migration flow.

[0006] To achieve the above object, the present application provides a method for determining the service type of network traffic, the method for determining the service type of network traffic comprising the following steps:

[0007] Obtain a QUIC migration flow, and determine a first identification feature corresponding to the QUIC migration flow;

[0008] Matching and obtaining a negotiation service type corresponding to the first identification feature from a metadata object; the metadata object is generated based on a second identification feature and a negotiation service type corresponding to the QUIC negotiation flow corresponding to the QUIC migration flow;

[0009] The negotiated service type is used as the migration service type corresponding to the QUIC migration flow.

[0010] Exemplarily, the first identification feature is a migration CID triplet, and the migration CID triplet includes at least a migration CID; and determining the first identification feature corresponding to the QUIC migration flow includes:

[0011] Determining the migration CID based on the QUIC migration flow;

[0012] generating the migration CID triplet based on the migration CID;

[0013] The metadata object is a negotiation CID triplet object, the second identification feature is a negotiation CID triplet, and the matching from the metadata object to obtain the negotiation service type corresponding to the first identification feature includes:

[0014] A negotiation service type corresponding to the negotiation CID triplet that is the same as the migration CID triplet is matched and obtained from the negotiation CID triplet object.

[0015] Exemplarily, the determining the migration CID based on the QUIC migration flow includes:

[0016] Obtaining a migration quad from the QUIC migration stream;

[0017] Determine, from the negotiation quadruple object corresponding to the QUIC negotiation stream, a negotiation value corresponding to the negotiation quadruple that is the same as the migration quadruple; the negotiation value is the negotiation length of the negotiation CID corresponding to the QUIC negotiation stream; the negotiation length is the same as the migration length of the migration CID;

[0018] Based on the migration length, extract the migration CID from a first message in the QUIC migration flow.

[0019] Exemplarily, before generating the migration CID triplet based on the migration CID, the method includes:

[0020] Determining whether the migration CID is legal;

[0021] If yes, the step of generating the migration CID triplet based on the migration CID is performed.

[0022] Exemplarily, the determining the migration CID based on the QUIC migration flow includes:

[0023] Obtain multiple second messages in the QUIC migration flow;

[0024] Extracting the longest common prefix code stream from the multiple second messages;

[0025] The migration CID is determined based on the longest common prefix code stream.

[0026] Exemplarily, the first identification feature is a migration network address triplet, and determining the first identification feature corresponding to the QUIC migration flow includes:

[0027] Obtain a migration quintuple from the QUIC migration stream;

[0028] Extracting the first part of the content from the migration quintuple as the migration network address triplet; the first part of the content does not change before and after the connection migration;

[0029] The metadata object is a negotiated network address triplet object, the second identification feature is a negotiated network address triplet, and the negotiation service type corresponding to the first identification feature is obtained by matching from the metadata object, including:

[0030] A negotiation service type corresponding to the negotiation network address triplet that is the same as the migration network address triplet is matched and obtained from the negotiation network address triplet object.

[0031] Exemplarily, the method for determining the service type of network traffic further includes:

[0032] Putting the identification result information corresponding to the migration service type into the extension field of the tunnel header of the third message;

[0033] The third message is sent to the external system.

[0034] Exemplarily, to achieve the above purpose, the present application also provides a method for determining the service type of network traffic, the method for determining the service type of network traffic comprising the following steps:

[0035] Get the QUIC negotiation stream;

[0036] Determine a second identification feature corresponding to the QUIC negotiation flow, and determine a negotiation service type corresponding to the QUIC negotiation flow;

[0037] A metadata object is generated based on the second identification feature and the negotiated service type; the metadata object is used to determine the migration service type corresponding to the QUIC migration flow corresponding to the QUIC negotiation flow.

[0038] Exemplarily, the second identification feature is a negotiation CID triplet, and the negotiation CID triplet includes at least a negotiation CID; and determining the second identification feature corresponding to the QUIC negotiation flow includes:

[0039] Obtain the negotiation CID from the QUIC negotiation stream;

[0040] generating the negotiation CID triplet based on the negotiation CID;

[0041] The metadata object is a negotiation CID triplet object, and the generating of the metadata object based on the second identification feature and the negotiation service type includes:

[0042] The negotiated CID triplet object is generated based on the negotiated CID triplet and the negotiated service type; the migration CID triplet is used to match the negotiated service type corresponding to the negotiated CID triplet that is the same as the migration CID triplet from the negotiated CID triplet object.

[0043] Exemplarily, the method for determining the service type of network traffic further includes:

[0044] Obtaining a negotiation quadruple and a negotiation length of the negotiation CID from the QUIC negotiation stream;

[0045] A negotiation quadruple object is generated based on the negotiation length and the negotiation quadruple; the negotiation quadruple object is used to extract a migration CID from a first message in the QUIC migration flow; and the migration CID is used to generate the migration CID triplet.

[0046] Exemplarily, the second identification feature is a negotiation network address triplet, and determining the second identification feature corresponding to the QUIC negotiation stream includes:

[0047] Obtain a negotiation quintuple from the QUIC negotiation stream;

[0048] Extracting the second part of the content from the negotiation quintuple as the negotiation network address triplet; the second part of the content does not change before and after the connection migration;

[0049] The metadata object is a negotiated network address triplet object, and the step of generating the metadata object based on the second identification feature and the negotiated service type includes:

[0050] The negotiated network address triplet object is generated based on the negotiated network address triplet and the negotiated service type.

[0051] Exemplarily, to achieve the above-mentioned purpose, the present application also provides an electronic device, comprising: a memory, a processor, and a network traffic business type determination program stored in the memory and executable on the processor, wherein the network traffic business type determination program is configured to implement the steps of the network traffic business type determination method as described above.

[0052] Exemplarily, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a program for determining the business type of network traffic is stored, and when the program for determining the business type of network traffic is executed by a processor, the steps of the method for determining the business type of network traffic as described above are implemented.

[0053] The embodiment of the present application obtains the QUIC migration flow and determines the first identification feature corresponding to the QUIC migration flow; matches the negotiation service type corresponding to the first identification feature from the metadata object; the metadata object is generated based on the second identification feature and the negotiation service type corresponding to the QUIC negotiation flow corresponding to the QUIC migration flow; and finally the negotiation service type is used as the migration service type corresponding to the QUIC migration flow. Since the migration service type corresponding to the QUIC negotiation flow is determined by the negotiation service type corresponding to the QUIC negotiation flow through the same identification feature, the migration service type corresponding to the QUIC migration flow can be determined after the connection is migrated. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a schematic diagram of the evolution of the HTTP and QUIC protocols involved in the embodiments of the present application;

[0055] Figure 2 A schematic diagram of a flow chart of a first embodiment of a method for determining a service type of network traffic of the present application;

[0056] Figure 3 A schematic diagram of message decoding involved in the first embodiment of the method for determining the service type of network traffic of the present application;

[0057] Figure 4 A schematic diagram of a process for generating a negotiation CID triplet object involved in the first embodiment of the method for determining the service type of network traffic of the present application;

[0058] Figure 5 A schematic diagram of a process for generating a negotiation quad-tuple object according to a first embodiment of a method for determining a service type of network traffic of the present application;

[0059] Figure 6A schematic diagram of the composition of a message involved in the first embodiment of the method for determining the service type of network traffic of the present application;

[0060] Figure 7 A schematic diagram of a flow chart of a second embodiment of a method for determining a service type of network traffic of the present application;

[0061] Figure 8 Schematic diagram of the identification process of three identification methods in the second embodiment of the method for determining the service type of network traffic of the present application;

[0062] Fig. 9 A schematic diagram of the migration process of a connection migration in a non-cross-network migration situation involved in the second embodiment of the method for determining the service type of network traffic of the present application;

[0063] Fig.10 A schematic diagram of a process of rapid association identification involved in the second embodiment of the method for determining the service type of network traffic of the present application;

[0064] Fig.11 A schematic diagram of detecting a migration CID in an uplink message according to a second embodiment of a method for determining a service type of network traffic of the present application;

[0065] Fig.12 A schematic diagram of a process of strong correlation identification involved in the second embodiment of the method for determining the service type of network traffic of the present application;

[0066] Fig.13 A schematic diagram of a process of weak correlation identification involved in the second embodiment of the method for determining the service type of network traffic of the present application;

[0067] Fig.14 A schematic diagram of the results recorded in the negotiation network address triplet object involved in the second embodiment of the method for determining the service type of network traffic of the present application;

[0068] Fig.15 A schematic diagram of the interaction between the DPI system and the external system involved in the second embodiment of the method for determining the service type of network traffic of the present application;

[0069] Fig.16 This is a schematic diagram of the structure of the hardware operating environment involved in the embodiment of the present application.

[0070] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0071] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0072] In order to better understand the embodiments of the present application, the embodiments of the present application are briefly described below:

[0073] Reference Figure 1 , Figure 1 Schematic diagram of the evolution of HTTP and QUIC protocols involved in the embodiments of this application. Since 1990, HTTP has evolved from HTTP / 0.9, HTTP / 1.0, HTTP / 1.1, HTTP / 2 to QUIC-based HTTP / 3 in 2022. Specifically, from TCP (Transmission Control Protocol)-based transmission to UDP (User Datagram Protocol)-based transmission, from TLS (Transport Layer Security)-based encryption to QUIC-based encryption, the form of HTTP network traffic has become more and more complex, making it increasingly difficult for the DPI system to identify HTTP network traffic.

[0074] It should be noted that since QUIC introduced the connection migration function, support for connection migration has appeared in newer QUIC implementations. Some large Internet companies (such as Google, Meta, etc.) already have network traffic based on QUIC connection migration in their important businesses (business types include Youtube, Google Play, Instagram, etc.).

[0075] For HTTP / 3 services based on connectionless migration, the DPI system can usually accurately identify the service type by detecting the SNI of the initial ClientHello message in the handshake negotiation phase. For example, if the DPI system detects that the SNI contains ".youtube.com" or ".googlevideo.com", the related QUIC negotiation stream will be identified as Youtube.

[0076] For HTTP / 3 services based on connection migration, the QUIC migration flow after the connection migration is a completely new form for the DPI system. The DPI system in actual applications cannot identify it, and the identification result is usually "UnknownUDP", which means it is identified as an unknown service type.

[0077] In actual applications, through research, it is found that the negotiation service type corresponding to the QUIC negotiation stream and the migration service type corresponding to the QUIC migration stream are actually the same service type. If the migration service type cannot be directly determined through the QUIC migration stream, the connection between the QUIC migration stream and the QUIC negotiation stream can be used to obtain the negotiation service type. After that, the negotiation service type is used as the migration service type, thereby indirectly determining the migration service type. Therefore, after the connection is migrated, the problem of how to determine the migration service type corresponding to the QUIC migration stream can be transformed into the problem of how to determine the migration service type corresponding to the QUIC migration stream through the connection between the QUIC migration stream and the QUIC negotiation stream.

[0078] In order to determine the connection between the QUIC migration flow and the QUIC negotiation flow, it is found through research that there is the same identification feature between the QUIC negotiation flow and the QUIC migration flow, that is, the identification feature is the connection between the QUIC migration flow and the QUIC negotiation flow, and the negotiation service type corresponding to the QUIC negotiation flow corresponding to the QUIC migration flow can be determined through the identification feature, thereby obtaining the migration service type. Specifically, the process of determining the migration service type corresponding to the QUIC migration flow through the identification feature includes: obtaining the QUIC migration flow, and determining the first identification feature corresponding to the QUIC migration flow; from the metadata object, matching and obtaining the negotiation service type corresponding to the first identification feature; the metadata object is generated based on the second identification feature and the negotiation service type corresponding to the QUIC negotiation flow corresponding to the QUIC migration flow; finally, the negotiation service type is used as the migration service type corresponding to the QUIC migration flow.

[0079] Since the same identification feature is used, the negotiation service type corresponding to the QUIC negotiation stream determines the migration service type corresponding to the QUIC migration stream corresponding to the QUIC negotiation stream, thereby being able to determine the migration service type corresponding to the QUIC migration stream after the connection migration.

[0080] It should be noted that the DPI system is deployed on electronic devices, which include but are not limited to various gateways or routing products, independent DPI devices, network traffic analysis devices, and service experience sensitive detection devices. The embodiments of the present application include a first embodiment and a second embodiment, wherein the first embodiment relates to the processing stage of the DPI system for the QUIC migration flow, and the second embodiment relates to the processing stage of the DPI system for the QUIC negotiation flow.

[0081] First embodiment

[0082] In the stage of processing the QUIC negotiation stream by the DPI system, the following steps are included: determining the QUIC negotiation stream; identifying the negotiation service type corresponding to the QUIC negotiation stream based on SNI; extracting the second identification feature corresponding to the QUIC negotiation stream; and recording the second identification feature and the negotiation service type for determining the migration service type.

[0083] Reference Figure 2 , Figure 2 This is a flow chart of the first embodiment of the method for determining the service type of network traffic of the present application.

[0084] The embodiment of the present application provides an embodiment of a method for determining the service type of network traffic. It should be noted that although a logical sequence is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here. The method for determining the service type of network traffic includes:

[0085] Step S210, obtain the QUIC negotiation stream.

[0086] The step of obtaining the QUIC negotiation stream involves determining the QUIC negotiation stream.

[0087] In the step of determining the QUIC negotiation flow, the DPI system checks the first message in each processed flow and determines the flow to which the message that meets the following inspection conditions belongs as the QUIC negotiation flow. Figure 3 , Figure 3 This is a schematic diagram of message decoding involved in the first embodiment of the method for determining the service type of network traffic of the present application. Check condition 1: The network layer protocol of the message is IPv4 or IPv6; Check condition 2: The transport layer protocol type of the message is UDP; Check condition 3: The direction of the message is the uplink direction, that is, it is sent from the user side (terminal) to the network side (server); Check condition 4: The UDP payload length of the message is greater than or equal to 1200 bytes, where the UDP payload is at least 1200 bytes as stipulated in the RFC 9000 protocol; Check condition 5: The message is decoded according to the QUIC protocol header, and the header format is the QUIC long header; Check condition 6: The message is decoded according to the QUIC protocol header, and the message type is the QUIC initial message; Check condition 7: The message is decoded according to the QUIC protocol header, and the correct QUIC version number can be obtained (for example: the version number of QUIC v1 is 0x00000001).

[0088] It should be noted that for flows that fail to pass the above inspection conditions, the DPI system considers that the flow is not a QUIC negotiation flow, and marks the flow, and no further processing is performed on subsequent messages of the flow to determine the service type; for flows that pass the above detection conditions, the DPI system enters the step of identifying the negotiation service type corresponding to the QUIC negotiation flow based on SNI.

[0089] Exemplarily, the DPI system manages flows in five-tuples. The five-tuple as a whole is a key, which is composed of five metadata in a fixed order, and a key uniquely determines the corresponding five-tuple context. The five metadata include: user IP (Internet Protocol) address, network IP address (IP address of the QUIC server), user port, network port, and transport layer protocol type (UDP or TCP).

[0090] Exemplarily, the quintuple is used to generate a quintuple object, which includes a key (the quintuple), a value (service type (obtained by the DPI system identifying the QUIC negotiation flow through SNI) and flow status information) and a correspondence between the key and the value.

[0091] Step S220, determine the second identification feature corresponding to the QUIC negotiation flow, and determine the negotiation service type corresponding to the QUIC negotiation flow.

[0092] The steps of determining the second identification feature corresponding to the QUIC negotiation stream and determining the negotiation service type corresponding to the QUIC negotiation stream include: identifying the negotiation service type corresponding to the QUIC negotiation stream based on SNI and extracting the second identification feature corresponding to the QUIC negotiation stream.

[0093] Step S230, generating a mapping relationship between a feature and a service type based on the second identification feature and the negotiated service type; the mapping relationship is used to determine the migration service type corresponding to the QUIC migration flow corresponding to the QUIC negotiation flow.

[0094] In the step of identifying the negotiation service type corresponding to the QUIC negotiation stream based on SNI, the DPI system decodes the message in the QUIC negotiation stream (generally the first message) according to the QUIC CRYPTO frame encoding rules and TLS 1.3 ClientHello message encoding rules. If the decoding fails, the DPI system marks the stream and no longer performs further processing related to determining the service type for subsequent messages of the stream; if the decoding is successful, the DPI system enters the step of extracting the second identification feature corresponding to the QUIC negotiation stream.

[0095] For the decoding process, the DPI system obtains the identification result of the QUIC negotiation stream by detecting the SNI in the ClientHello message.

[0096] For example, if the SNI is detected as "www.youtube.com" or "sn-i6b1kns2.googlevideo.com", that is, the SNI contains the characteristic string ".youtube.com" or ".googlevideo.com", the DPI system will identify the QUIC negotiation stream as Youtube.

[0097] For example, if the SNI is detected as "graph.facebook.com", that is, the SNI contains the characteristic string ".facebook.com", the DPI system will identify the QUIC negotiation flow as Facebook.

[0098] For unrecognizable SNI, the DPI system marks the stream, and no further processing is performed on the subsequent messages of the stream to determine the service type; only when the SNI is successfully identified, the DPI system enters the step of extracting the second identification feature corresponding to the QUIC negotiation stream. It can be understood that only the QUIC negotiation stream that the DPI system can identify is necessary to perform subsequent processing to determine the service type. For the QUIC negotiation stream that the DPI system cannot identify, there is no need to perform subsequent processing to determine the service type.

[0099] In the step of extracting the second identification feature corresponding to the QUIC negotiation stream, the second identification feature is a negotiation CID (Connection ID) triplet or a negotiation network address triplet.

[0100] In the case where the second identification feature is a negotiation CID triplet, the negotiation CID triplet includes at least a negotiation CID, and the other two metadata are a user IP address and a transport layer protocol type.

[0101] The above-mentioned determination of the second identification feature corresponding to the QUIC negotiation flow includes: obtaining the negotiation CID from the QUIC negotiation flow; generating the negotiation CID triplet based on the negotiation CID; the mapping relationship is a negotiation CID triplet object, and the mapping relationship between the feature and the service type generated based on the second identification feature and the negotiation service type includes: generating the negotiation CID triplet object based on the negotiation CID triplet and the negotiation service type; the migration CID triplet is used to match the negotiation service type corresponding to the negotiation CID triplet that is the same as the migration CID triplet from the negotiation CID triplet object.

[0102] Reference Figure 4 , Figure 4 This is a schematic diagram of the process of generating a negotiated CID triplet object involved in the first embodiment of the method for determining the service type of network traffic of the present application. Figure 4 The corresponding three triplets are generated by the five-tuple of each of the three QUIC negotiation streams. Among them, the five metadata included in the five-tuple are user IP address, network IP address, user port, network port and transport layer protocol type, and the triplet uses two of the metadata, namely user IP address and transport layer protocol type. It can be understood that for any negotiation CID triple object, it includes the negotiation CID triple and its corresponding record (i.e., negotiation service type). For example, negotiation CID triple object 1 includes negotiation CID triple 1 and its corresponding negotiation service type 1.

[0103] It should be noted that for the QUIC negotiation flow, after obtaining the negotiation CID, the DPI system simultaneously obtains the user IP address and transport layer protocol type from the message information of the QUIC negotiation flow, and uses the user IP address, transport layer protocol type and negotiation CID as a negotiation triplet to establish a negotiation CID triplet object.

[0104] It should be noted that before establishing a negotiation CID triplet object, the DPI system will query whether the negotiation CID triplet object already exists. If it does not exist, the DPI system will create a new negotiation CID triplet object and record the negotiation service type (such as Youtube) corresponding to the current QUIC negotiation flow into the negotiation CID triplet object; if it exists, the DPI system will update the original value in the negotiation CID triplet object with the current negotiation service type.

[0105] It should be noted that if Figure 4 Since the negotiation CIDs of different QUIC negotiation streams of the same user (i.e., the same user IP address) are usually not the same, the negotiation CID triplet object of each QUIC negotiation stream is usually different.

[0106] The above-mentioned method for determining the service type of network traffic also includes: obtaining a negotiation quadruple and a negotiation length of the negotiation CID from the QUIC negotiation stream; generating a negotiation quadruple object based on the negotiation length and the negotiation quadruple; the negotiation quadruple object is used to extract a migration CID from the first message in the QUIC migration stream; and the migration CID is used to generate the migration CID triplet.

[0107] It can be understood that since the DPI system cannot directly obtain the migration CID in the QUIC migration stream, it is possible to obtain the negotiation length, which is used by the DPI system to obtain the migration CID from the QUIC migration stream.

[0108] Reference Figure 5 , Figure 5 This is a flow chart of generating a negotiation quad-tuple object involved in the first embodiment of the method for determining the service type of network traffic of the present application. It should be noted that the DPI system obtains the negotiation quad-tuple from the first message of the QUIC negotiation flow to establish a negotiation quad-tuple object. The quad-tuple includes: user IP address, network IP address, network port and transport layer protocol type (UDP).

[0109] It should be noted that before establishing a negotiation quadruple object, the DPI system will query whether the negotiation quadruple object already exists; if not, the DPI system will create a new negotiation quadruple object and record the negotiation length in the negotiation quadruple object; if it exists, the DPI system will update the original value in the negotiation quadruple object with the negotiation length.

[0110] It should be noted that different QUIC negotiation streams (such as Figure 5 QUIC negotiation stream 1, QUIC negotiation stream 2, QUIC negotiation stream 3) may correspond to the same negotiation quadruple object or different negotiation quadruple objects.

[0111] The process of obtaining a negotiation CID from a QUIC negotiation stream and obtaining the negotiation length of the negotiation CID.

[0112] Reference Figure 6 , Figure 6 A schematic diagram of the composition of the message involved in the first embodiment of the method for determining the service type of network traffic in the present application. The DPI system can obtain the SCID (Source Connection ID) and the SCID length from the QUIC header of the TLS 1.3 ServerHello message (the message in the first message) of the QUIC negotiation stream. The DPI system can also obtain the SCID and SCID length from the QUIC header of the long header initial message (the first message) that appears for the first time in the QUIC negotiation stream (sent from the network side to the user side) in the downlink.

[0113] Among them, "long header" means that the QUIC header decoding header type is a long header, and "initial message" means that the QUIC header decoding message type is an initial message.

[0114] It should be noted that the ServerHello message is an encrypted message. Only after decryption can we know whether the first message contains the ServerHello message. In order to avoid the system performance loss caused by decryption, the DPI system in this embodiment does not decrypt the message in the first message, but only uses the encoding information in the QUIC message header to efficiently infer whether the first message contains the ServerHello message.

[0115] After obtaining the SCID and SCID length, the DPI system uses the content from the second byte of the SCID to the last byte of the SCID as the negotiation CID. For example, if the SCID is hexadecimal "594e8a6a5679f5a2", the negotiation CID obtained is hexadecimal "4e8a6a5679f5a2".

[0116] It should be noted that according to the SCID encoding format agreed upon in the QUIC RFC protocol, the first byte in the SCID is variable, so the DPI system starts from the second byte of the SCID.

[0117] It can be understood that the negotiation length of the negotiated CID is the length of the SCID minus 1. For example, if the SCID length is 8 bytes, the negotiation length is 7 bytes. Among them, the CID is allocated by the QUIC server, and different QUIC server manufacturers can customize different CID lengths. For example, the length range specified by the protocol RFC8999 is 0-255 bytes. The length range specified by the protocol RFC9000 is 0-20 bytes. The more common SCID length is 8 bytes.

[0118] Second embodiment

[0119] In the processing stage of the QUIC migration flow by the DPI system, the following steps are included: determining the QUIC migration flow; determining the first identification feature corresponding to the QUIC migration flow; and performing association identification based on the first identification feature.

[0120] Reference Figure 7 , Figure 7 This is a flow chart of a second embodiment of a method for determining the service type of network traffic of the present application.

[0121] The embodiment of the present application provides an embodiment of a method for determining the service type of network traffic. It should be noted that although a logical sequence is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here. The method for determining the service type of network traffic includes:

[0122] Step S710, obtain a QUIC migration flow, and determine a first identification feature corresponding to the QUIC migration flow.

[0123] Acquiring a QUIC migration stream involves determining the QUIC migration stream.

[0124] In the step of determining the QUIC migration flow, the DPI system checks the first message of each processed flow, and preliminarily determines that the flow to which the message that meets the following inspection conditions belongs may be a QUIC migration flow. Inspection condition 1: The network layer of the message is IPv4 or IPv6; Inspection condition 2: The transport layer of the message is UDP; Inspection condition 3: The direction of the message is the upstream direction, that is, it is sent from the user side (terminal) to the network side (server); Inspection condition 4: The message is decoded according to the QUIC protocol header, and the header format is a short header; Inspection condition 5: The UDP stream cannot be identified as a specific service type by the DPI system through feature word matching. It should be noted that the code stream of the QUIC migration flow is encrypted and does not contain content that can be matched by feature words.

[0125] It should be noted that for flows that fail to pass the above inspection conditions, the DPI system considers that the flow is not a QUIC migration flow, and marks the flow, and no further processing is performed on subsequent messages of the flow to determine the service type; for flows that pass the above detection conditions, the DPI system enters the step of determining the first identification feature corresponding to the QUIC migration flow.

[0126] Before performing association identification, it is necessary to determine the first identification feature corresponding to the QUIC migration flow, so as to perform association identification based on the first identification feature.

[0127] Among them, association identification includes fast association identification, strong association identification and weak association identification. For different association identifications, the first identification feature may be different. Among them, the first identification feature corresponding to the fast association identification and the strong association identification is the migration CID (Connection IDentifier, connection identifier) ​​triple, and the migration CID triple includes at least the migration CID; the first identification feature corresponding to the weak association identification is the migration network address triple.

[0128] Reference Figure 8 , Figure 8This is a schematic diagram of the identification process of the three identification methods in the second embodiment of the method for determining the service type of network traffic in the present application. The process is: determine the second identification feature through the quintuple 1 in the QUIC negotiation flow, and the second identification feature is a part of the three storage objects, namely, the negotiation quadruple object, the negotiation CID triple object and the negotiation network address triple object; then identify the two QUIC migration flows through the identification method and the second identification feature. The identification process is to identify the migration service type corresponding to the QUIC migration flow from the three storage objects through the first identification feature. It should be noted that when using fast association identification to identify the QUIC migration flow, it is necessary to generate the negotiation quadruple and the negotiation CID triple through the quintuple 1 of the QUIC negotiation flow; when using strong association identification, it is only necessary to generate the negotiation CID triple through the quintuple 1 of the QUIC negotiation flow; when using weak association identification, it is only necessary to generate the negotiation network address triple through the quintuple 1 of the QUIC negotiation flow.

[0129] Step S720, from the metadata object, match and obtain the negotiation service type corresponding to the first identification feature; the metadata object is generated based on the second identification feature and the negotiation service type corresponding to the QUIC negotiation flow corresponding to the QUIC migration flow; the negotiation service type is used as the migration service type corresponding to the QUIC migration flow.

[0130] The metadata object is one of the above-mentioned negotiated CID triplet object and negotiated network address triplet object. The second identification feature is the key of the metadata object, and the negotiated service type is the value of the metadata object. There is a corresponding relationship between the key and the value. That is, the metadata object exists in the form of a key-value pair, and the first identification feature is used as the key to match the corresponding value, thereby obtaining the migration service type.

[0131] The following describes the embodiments of the present application with respect to three association identification methods;

[0132] For fast association identification:

[0133] Fast association identification is a special case of strong association identification. Fast association identification is aimed at non-cross-network migration. In this case, according to the QUIC protocol (RFC 9000), although the uplink message of the QUIC migration flow contains the migration CID, it does not contain the migration length of the migration CID, so the specific migration CID is unknown. Therefore, fast association identification solves the problem of how to quickly determine the migration length to accurately obtain the migration CID and thus identify the QUIC migration flow.

[0134] Reference Fig. 9 , Fig. 9A schematic diagram of the migration process of connection migration in the non-cross-network migration situation involved in the second embodiment of the method for determining the service type of network traffic of the present application. Among them, for services based on the same QUIC connection, the QUIC client (deployed on the terminal device) first negotiates with the QUIC server through QUIC UDP stream 1 and transmits encrypted data to each other. After a period of time, the QUIC client performs connection migration and continues to transmit encrypted data to each other with the QUIC server through QUIC UDP stream 2.

[0135] Since QUIC UDP stream 1 contains SNI in the initial ClientHello message during the handshake negotiation phase, the DPI system can accurately identify QUIC UDP stream 1 based on the features in the SNI. However, since QUIC UDP stream 2 does not contain the initial ClientHello message during the handshake negotiation phase, all of which are encrypted data, the DPI system cannot identify QUIC UDP stream 2 using the SNI feature detection method.

[0136] The QUIC server can use the CID in the QUIC message to send the QUIC negotiation stream ( Fig. 9 QUIC UDP stream 1) and QUIC migration stream ( Fig. 9 This is because the QUIC server participates in the entire QUIC handshake negotiation process, and it has accurate information about parameters such as the CID in the QUIC connection, so it can accurately associate the QUIC migration stream with the QUIC negotiation stream. It can be understood that the negotiation CID in the QUIC negotiation stream and the migration CID in the QUIC migration stream in the same QUIC connection are the same.

[0137] It can be understood that, since the migration CID is the same as the negotiation CID, the migration length is the negotiation length.

[0138] The above-mentioned step of determining the first identification feature corresponding to the QUIC migration flow includes: determining the migration CID based on the QUIC migration flow; generating the migration CID triplet based on the migration CID; the metadata object is a negotiation CID triplet object, the second identification feature is a negotiation CID triplet, and matching and obtaining the negotiation service type corresponding to the first identification feature from the metadata object includes: matching and obtaining the negotiation service type corresponding to the negotiation CID triplet that is the same as the migration CID triplet from the negotiation CID triplet object.

[0139] Exemplarily, the above-mentioned determination of the migration CID based on the QUIC migration flow includes: obtaining a migration quadruple from the QUIC migration flow; determining a negotiation value corresponding to a negotiation quadruple that is identical to the migration quadruple from a negotiation quadruple object corresponding to the QUIC negotiation flow; the negotiation value is a negotiation length of the negotiation CID corresponding to the QUIC negotiation flow; the negotiation length is the same as the migration length of the migration CID; and based on the migration length, extracting the migration CID from the first message in the QUIC migration flow.

[0140] Reference Fig.10 , Fig.10 This is a flow chart of the rapid association identification involved in the second embodiment of the method for determining the service type of network traffic of the present application. The DPI system obtains the migration quad from the first message of the QUIC migration flow. The migration quad includes: user IP address, network IP address, network port, and transport layer protocol type (UDP).

[0141] It should be noted that the DPI system queries whether the negotiation quad object corresponding to the migration quad already exists. If it does, the DPI system obtains the negotiation length from the negotiation quad object and uses the negotiation length as the migration length; if it does not exist, the DPI system attempts to identify the QUIC migration flow through strong association identification or weak association identification.

[0142] It should be noted that the DPI system will check the UDP payload length of the first message of the QUIC migration flow. And determine whether the UDP payload length is greater than the migration length + 1. If so, the migration CID is obtained through the migration length; if not, the QUIC migration flow is tried to be identified through strong association identification or weak association identification.

[0143] When obtaining the migration CID through the migration length, the DPI system starts from the third byte of the UDP payload of the first message of the QUIC migration flow and obtains the migration CID from the UDP payload according to the obtained migration length. For example, the migration CID is "a3c715961737be".

[0144] It should be noted that according to the QUIC RFC protocol, this short header message starts with the DCID (Destination Connection ID) from the second byte of the UDP payload, and the DPI system takes the migration CID from the second byte of the DCID.

[0145] It should be noted that the DPI system uses the user IP address, transport layer protocol type, and migration CID as the migration CID triplet, that is, the migration CID triplet is generated through the migration CID. The DPI system queries whether the negotiation CID triplet object exists through the migration CID triplet. If it exists, the DPI system obtains the negotiation service type of the corresponding QUIC negotiation flow record from the negotiation CID triplet object as the migration service type of the QUIC migration flow, thereby completing the identification of the QUIC migration flow; if it does not exist, the DPI system attempts to identify the QUIC migration flow through weak association identification.

[0146] Exemplarily, before generating the migration CID triplet based on the migration CID, the method includes: determining whether the migration CID is legal; if so, executing the step of generating the migration CID triplet based on the migration CID.

[0147] It should be noted that before generating a migration CID triplet through the migration CID, the DPI system also checks whether the migration CID is legal. For a legal migration CID, subsequent processing is performed; if the migration CID is illegal, the DPI system considers that the flow is not a true QUIC migration flow, marks the flow, and does not further process the message of the flow.

[0148] In one embodiment, the DPI system determines whether the migration CID is legal by checking whether each byte value of the migration CID is different. If each byte value of the migration CID is different, the DPI system considers it legal; if the migration CID has the same byte value, the DPI system considers it illegal. For example, if the migration CID is hexadecimal "a3c715961737be", where the hexadecimal values ​​of each byte "a3", "c7", "15", "96", "17", "37", and "be" are different, the migration CID is considered legal.

[0149] In another embodiment, the DPI system determines whether the migration CID is legal by calculating the entropy value of the migration CID. The DPI system regards each byte value of the migration CID as a set of numbers, calculates the frequency and probability of each number appearing, and calculates the entropy value of the migration CID according to the Shannon entropy formula. If the entropy value is greater than or equal to the threshold preset by the DPI system, the DPI system considers the migration CID to be legal; if the entropy value is less than the threshold preset by the DPI system, the DPI system considers the migration CID to be illegal. Among them, the threshold can be set as needed, and this embodiment does not make a specific limitation.

[0150] Exemplarily, determining the migration CID based on the QUIC migration flow includes: acquiring multiple second messages in the QUIC migration flow; extracting the longest common prefix code stream from the multiple second messages; and determining the migration CID based on the longest common prefix code stream.

[0151] Reference Fig.11 , Fig.11 A schematic diagram of detecting a migration CID in an uplink message according to the second embodiment of the method for determining the service type of network traffic of the present application. For a QUIC migration flow, the DPI system continuously obtains the first N uplink messages of the QUIC migration flow and attempts to detect possible migration CIDs from these N uplink messages.

[0152] Specifically, the DPI system starts from the second byte of the UDP payload of each of the first N uplink messages of the QUIC migration flow, and based on the basic LCP (Longest Common Prefix) algorithm in the field of string processing, obtains their longest common prefix code stream as the detected DCID. Afterwards, the DPI system starts from the second byte of the detected DCID to the end of the detected DCID as the detected migration CID.

[0153] Fig.11 The figure includes the first 9 uplink messages of a QUIC migration flow. Assuming that each line is the UDP payload part of an uplink message of the QUIC migration flow, the common prefix part of the code stream starting from the second byte of each UDP payload shown in the box is the DCID obtained by detection; and the second byte of the DCID is used as the migration CID obtained by detection.

[0154] It should be noted that strong correlation identification is aimed at cross-network migration, for example, the QUIC connection migrates from the wired WiFi network of operator one to the mobile cellular network of operator two. It should be noted that the DPI system deployed in the latter network can only observe the QUIC migration flow, and it cannot observe the QUIC negotiation flow in the former network. Therefore, strong correlation identification solves the problem of how to identify such isolated QUIC migration flows.

[0155] Reference Fig.12 , Fig.12This is a flow chart of the strong correlation identification involved in the second embodiment of the method for determining the service type of network traffic in the present application. The DPI system checks whether the migration CID obtained by the detection is legal through the above-mentioned legality check method. If it is legal, subsequent processing is performed; if it is illegal, the DPI system considers that the flow is not a true QUIC migration flow, marks the flow, and does not further process the message of the flow. The specific implementation method of subsequently generating the migration CID triplet through the migration CID is basically the same as the specific implementation method in the above-mentioned fast correlation identification, and will not be repeated here.

[0156] Exemplarily, the first identification feature is a migration network address triplet, and determining the first identification feature corresponding to the QUIC migration flow includes: obtaining a migration quintuple from the QUIC migration flow; extracting a first part of the content from the migration quintuple as the migration network address triplet; the first part of the content does not change before and after the connection migration; the metadata object is a negotiated network address triplet object, and the second identification feature is the negotiated network address triplet, and matching the negotiated service type corresponding to the first identification feature from the metadata object includes: matching the negotiated service type corresponding to the negotiated network address triplet that is the same as the migration network address triplet from the negotiated network address triplet object.

[0157] Reference Fig.13 , Fig.13 A flowchart of weak association identification involved in the second embodiment of the method for determining the service type of network traffic in the present application. The DPI system uses the network IP address, network port, and transport layer protocol type as the migration network address triplet, and queries whether the negotiation network address triplet object corresponding to the migration network address triplet exists. If it exists, the DPI system obtains the negotiation service type of the corresponding QUIC negotiation flow record from the negotiation network address triplet object, and uses the negotiation service type as the migration service type of the QUIC migration flow, thereby completing the identification of the QUIC migration flow.

[0158] Reference Fig.14 , Fig.14 A schematic diagram of the results recorded in the negotiated network address triplet object involved in the second embodiment of the method for determining the service type of network traffic of the present application. It should be noted that in the case where a plurality of different negotiated service types are recorded in the negotiated network address triplet object, the DPI system can assign a corresponding migration service type to the QUIC migration flow based on the relationship between the plurality of negotiated service types.

[0159] like Fig.14 The multiple different negotiation service types recorded in the negotiation network address triplet object include the following four situations:

[0160] Case A: If only one negotiated service type is recorded in the negotiated network address triplet object, the DPI system directly uses the negotiated service type as the migration service type of the QUIC migration flow to complete the identification of the QUIC migration flow.

[0161] Case B: The negotiated network address triplet object records multiple different negotiated service types, and there is an inclusion relationship between them. Then, the DPI system uses the most generalized negotiated service type in the inclusion relationship as the migration service type of the QUIC migration flow based on the inclusion relationship information of the preset negotiated service types. Fig.14 , the negotiated network address triplet object records three different negotiated service types, negotiated service type 1 is Google, negotiated service type 2 is Google Play, and negotiated service type 3 is Gmail. The system presets the known information that "Google includes Google Play and Gmail". The DPI system selects negotiated service type 1 and considers that the migration service type of the QUIC migration flow is Google.

[0162] Case C: The negotiation network address triplet object records multiple negotiation service types, and there is a non-inclusion relationship between them. However, based on the inclusion relationship information of the preset negotiation service types, the DPI system knows that these negotiation service types all belong to another generalized negotiation service type. In this case, the system selects the generalized negotiation service type as the migration service type of the QUIC migration flow. Fig.14 , the negotiated network address triplet object records three different negotiated service types, negotiated service type 1 is Google Drive, negotiated service type 2 is Google Play, and negotiated service type 3 is Gmail. There is a non-inclusion relationship between these three negotiated service types, but the DPI system presets the known information that "Google includes Google Drive, Google Play, and Gmail", so the DPI system considers that the migration service type of the QUIC migration flow is Google.

[0163] Case D: Multiple negotiated service types are recorded in the negotiated network address triplet object, and there is a non-inclusion relationship between them. The DPI system knows that these negotiated service types do not belong to a generalized negotiated service type based on the inclusion relationship information of the preset negotiated service types. In this case, the DPI system believes that the QUIC migration flow cannot be identified as a specific service type, but the DPI system can identify the QUIC migration flow as "QUIC". It should be noted that the QUIC migration flow is a pure encrypted code flow without DPI features. If it is not identified as "QUIC", the DPI system usually cannot identify the QUIC migration flow, and the identification result is usually set to "Unknown UDP". Therefore, although the QUIC migration flow cannot be specifically identified due to the conflict of multiple negotiated service types, the result of identifying the flow as "QUIC" is still better than "Unknown UDP".

[0164] Exemplarily, the method for determining the service type of network traffic further includes: placing the identification result information corresponding to the migration service type into an extension field of the tunnel header of a third message; and sending the third message to an external system.

[0165] Reference Fig.15 , Fig.15 This is a schematic diagram of the interaction between the DPI system and the external system involved in the second embodiment of the method for determining the service type of network traffic of the present application.

[0166] After the identification of the QUIC migration flow is completed through the association identification method in the aforementioned steps and the migration service type of the QUIC migration flow is successfully obtained, the DPI system can put the identification result information of the QUIC migration flow into the extension field of the tunnel header of the third message. So that after forwarding the third message to the external system, the external system can directly obtain the migration service type of the QUIC migration flow from the extension field of the tunnel header, thereby reducing the repeated identification of the QUIC migration flow by the external system and other related processing, so as to improve the performance of the external system.

[0167] It should be noted that the identification result information of the QUIC migration flow placed in the extended field of the third message tunnel header includes but is not limited to: whether the flow to which the third message belongs is a QUIC migration flow, the DPI identification result of the flow to which the third message belongs, whether the identification result of the third message is accurate, and the QUIC CID length of the third message (ie, the migration length).

[0168] Whether the stream to which the third message belongs is a QUIC migration stream. After reading the identification result information, the external system can know whether the third message and the stream to which it belongs are QUIC migration streams.

[0169] DPI identification result of the flow to which the third message belongs. After the external system reads the identification result information, it can obtain the specific DPI identification result of the third message and the flow to which it belongs, such as "Google", "Youtube", "QUIC", etc. Exemplarily, the DPI identification result can be in the form of a numerical AppID agreed with the external system, for example, the AppID of "Google" is 2, the AppID of "Youtube" is 3, and the AppID of "QUIC" is 1.

[0170] Whether the identification result of the third message is accurate. After the external system reads the identification result information, it can know whether the DPI identification result of the third message and its flow is accurate. For the DPI identification results obtained by the fast association identification method and the strong association identification method, the DPI system sets the extended information to be accurate; for the DPI identification results obtained by the weak association identification method, the extended information is set to be inaccurate.

[0171] For the QUIC CID length of the third message. After reading the identification result information, the external system can extract the migration CID according to the QUIC CID length, and associate the QUIC negotiation stream with the migration CID, so as to unify the QUIC migration stream and its corresponding QUIC negotiation stream.

[0172] In one embodiment, taking the PGW (PDN GateWay) network element of the core network in the 3GPP (3rd Generation Partnership Project) 4G network as an example, the PGW network element is used as the host network element of the DPI system, and the third message is transmitted between the PGW network element and the wireless access network eNodeB network element through the GTPU (GPRS Tunneling Protocol) tunnel. The DPI system encapsulates the identification result information of the QUIC migration flow of the third message in the GTPU Private Extension extension field, so that the eNodeB network element directly obtains the identification result information in the third message from the extension field, which greatly reduces the processing burden of the eNodeB network element for corresponding identification and detection of the third message.

[0173] In another embodiment, taking the core network UPF (User Plane Function) network element in the 3GPP 5G network as an example, the UPF network element is used as the host network element of the DPI system, and the third message is transmitted between the UPF network element and the wireless access network gNodeB network element through the GTPU tunnel. The DPI system encapsulates the identification result information of the QUIC migration flow of the third message in the GTPU Private Extension extension field, so that the gNodeB network element directly obtains the identification result information of the third message from the extension field, which greatly reduces the processing burden of the gNodeB network element for corresponding identification and detection of the third message.

[0174] In addition, the present application also provides a device for determining a service type of network traffic, the device for determining a service type of network traffic comprising:

[0175] An acquisition module, configured to acquire a QUIC migration flow and determine a first identification feature corresponding to the QUIC migration flow;

[0176] A matching module, used to match and obtain the negotiation service type corresponding to the first identification feature from the metadata object; the metadata object is generated based on the second identification feature and the negotiation service type corresponding to the QUIC negotiation flow corresponding to the QUIC migration flow; and the negotiation service type is used as the migration service type corresponding to the QUIC migration flow.

[0177] Exemplarily, the first identification feature is a migration CID triplet, and the migration CID triplet includes at least a migration CID; and the acquisition module is specifically configured to:

[0178] Determining the migration CID based on the QUIC migration flow;

[0179] generating the migration CID triplet based on the migration CID;

[0180] The metadata object is a negotiation CID triplet object, the second identification feature is a negotiation CID triplet, and the matching from the metadata object to obtain the negotiation service type corresponding to the first identification feature includes:

[0181] A negotiation service type corresponding to the negotiation CID triplet that is the same as the migration CID triplet is matched and obtained from the negotiation CID triplet object.

[0182] Exemplarily, the acquisition module is further used for:

[0183] Obtaining a migration quad from the QUIC migration stream;

[0184] Determine, from the negotiation quadruple object corresponding to the QUIC negotiation stream, a negotiation value corresponding to the negotiation quadruple that is the same as the migration quadruple; the negotiation value is the negotiation length of the negotiation CID corresponding to the QUIC negotiation stream; the negotiation length is the same as the migration length of the migration CID;

[0185] Based on the migration length, extract the migration CID from a first message in the QUIC migration flow.

[0186] Exemplarily, the acquisition module is further used for:

[0187] Determining whether the migration CID is legal;

[0188] If yes, the step of generating the migration CID triplet based on the migration CID is performed.

[0189] Exemplarily, the acquisition module is further used for:

[0190] Obtain multiple second messages in the QUIC migration flow;

[0191] Extracting the longest common prefix code stream from the multiple second messages;

[0192] The migration CID is determined based on the longest common prefix code stream.

[0193] Exemplarily, the first identification feature is a migration network address triplet, and the acquisition module is further used to:

[0194] Obtain a migration quintuple from the QUIC migration stream;

[0195] Extracting the first part of the content from the migration quintuple as the migration network address triplet; the first part of the content does not change before and after the connection migration;

[0196] The metadata object is a negotiated network address triplet object, the second identification feature is a negotiated network address triplet, and the negotiation service type corresponding to the first identification feature is obtained by matching from the metadata object, including:

[0197] A negotiation service type corresponding to the negotiation network address triplet that is the same as the migration network address triplet is matched and obtained from the negotiation network address triplet object.

[0198] Exemplarily, the network traffic service type determination device further includes:

[0199] An inserting module, used for inserting the identification result information corresponding to the migration service type into the extension field of the tunnel header of the third message;

[0200] A sending module is used to send the third message to an external system.

[0201] The specific implementation of the device for determining the service type of network traffic in the present application is basically the same as the first embodiment of the method for determining the service type of network traffic described above, and will not be described in detail here.

[0202] In addition, the present application also provides a device for determining a service type of network traffic, the device for determining a service type of network traffic comprising:

[0203] A first acquisition module, used to acquire a QUIC negotiation stream;

[0204] A determination module, configured to determine a second identification feature corresponding to the QUIC negotiation flow, and determine a negotiation service type corresponding to the QUIC negotiation flow;

[0205] The first generation module is used to generate a metadata object based on the second identification feature and the negotiated service type; the metadata object is used to determine the migration service type corresponding to the QUIC migration flow corresponding to the QUIC negotiation flow.

[0206] Exemplarily, the second identification feature is a negotiation CID triplet, and the negotiation CID triplet includes at least a negotiation CID; and the determination module is specifically configured to:

[0207] Obtain the negotiation CID from the QUIC negotiation stream;

[0208] generating the negotiation CID triplet based on the negotiation CID;

[0209] The metadata object is a negotiation CID triplet object, and the generating of the metadata object based on the second identification feature and the negotiation service type includes:

[0210] The negotiated CID triplet object is generated based on the negotiated CID triplet and the negotiated service type; the migration CID triplet is used to match the negotiated service type corresponding to the negotiated CID triplet that is the same as the migration CID triplet from the negotiated CID triplet object.

[0211] Exemplarily, the network traffic service type determination device further includes:

[0212] A second acquisition module is used to obtain a negotiation quadruple and a negotiation length of the negotiation CID from the QUIC negotiation stream;

[0213] The second generation module is used to generate a negotiation quadruple object based on the negotiation length and the negotiation quadruple; the negotiation quadruple object is used to extract the migration CID from the first message in the QUIC migration flow; the migration CID is used to generate the migration CID triplet.

[0214] Exemplarily, the second identification feature is a negotiated network address triplet, and the determination module is specifically configured to:

[0215] Obtain a negotiation quintuple from the QUIC negotiation stream;

[0216] Extracting the second part of the content from the negotiation quintuple as the negotiation network address triplet; the second part of the content does not change before and after the connection migration;

[0217] The metadata object is a negotiated network address triplet object, and the step of generating the metadata object based on the second identification feature and the negotiated service type includes:

[0218] The negotiated network address triplet object is generated based on the negotiated network address triplet and the negotiated service type.

[0219] The specific implementation of the device for determining the service type of network traffic in the present application is basically the same as the second embodiment of the method for determining the service type of network traffic described above, and will not be described in detail here.

[0220] In addition, the present application also provides an electronic device. Fig.16 As shown, Fig.16 It is a structural diagram of the hardware operating environment involved in the embodiment of the present application.

[0221] like Fig.16 As shown, the electronic device may include a processor 1601, a communication interface 1602, a memory 1603 and a communication bus 1604, wherein the processor 1601, the communication interface 1602 and the memory 1603 communicate with each other via the communication bus 1604, and the memory 1603 is used to store computer programs; the processor 1601 is used to implement the steps of the method for determining the business type of network traffic when executing the program stored in the memory 1603.

[0222] The communication bus 1604 mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus 1604 can be divided into an address bus, a data bus, and a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0223] The communication interface 1602 is used for communication between the above electronic device and other devices.

[0224] The memory 1603 may include a random access memory (Random Access Memory, RMD), and may also include a non-volatile memory (Non-Volatile Memory, NM), such as at least one disk memory. Optionally, the memory 1603 may also be at least one storage device located away from the aforementioned processor 1601.

[0225] The above-mentioned processor 1601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware component objects.

[0226] The specific implementation of the electronic device of the present application is basically the same as the embodiments of the method for determining the service type of network traffic described above, and will not be repeated here.

[0227] In addition, an embodiment of the present application also proposes a computer-readable storage medium, on which a program for determining the business type of network traffic is stored. When the program for determining the business type of network traffic is executed by a processor, the steps of the method for determining the business type of network traffic as described above are implemented.

[0228] The specific implementation of the computer-readable storage medium of the present application is basically the same as the various embodiments of the method for determining the service type of network traffic described above, and will not be repeated here.

[0229] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0230] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0231] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0232] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for determining the service type of network traffic, characterized in that: The method for determining the service type of network traffic comprises the following steps: Obtain a QUIC migration flow, and determine a first identification feature corresponding to the QUIC migration flow; Matching and obtaining a negotiation service type corresponding to the first identification feature from a metadata object; the metadata object is generated based on a second identification feature and a negotiation service type corresponding to the QUIC negotiation flow corresponding to the QUIC migration flow; The negotiated service type is used as the migration service type corresponding to the QUIC migration flow.

2. The method for determining the service type of network traffic according to claim 1, characterized in that: The first identification feature is a migration CID triplet, and the migration CID triplet includes at least a migration CID; and determining the first identification feature corresponding to the QUIC migration flow includes: Determining the migration CID based on the QUIC migration flow; generating the migration CID triplet based on the migration CID; The metadata object is a negotiation CID triplet object, the second identification feature is a negotiation CID triplet, and the matching from the metadata object to obtain the negotiation service type corresponding to the first identification feature includes: A negotiation service type corresponding to the negotiation CID triplet that is the same as the migration CID triplet is matched and obtained from the negotiation CID triplet object.

3. The method for determining the service type of network traffic according to claim 2, characterized in that: The determining the migration CID based on the QUIC migration flow includes: Obtaining a migration quad from the QUIC migration stream; Determine, from the negotiation quadruple object corresponding to the QUIC negotiation stream, a negotiation value corresponding to the negotiation quadruple that is the same as the migration quadruple; the negotiation value is the negotiation length of the negotiation CID corresponding to the QUIC negotiation stream; the negotiation length is the same as the migration length of the migration CID; Based on the migration length, extract the migration CID from the first message in the QUIC migration flow.

4. The method for determining the service type of network traffic according to claim 2, characterized in that: Before generating the migration CID triplet based on the migration CID, the method includes: Determining whether the migration CID is legal; If yes, the step of generating the migration CID triplet based on the migration CID is performed.

5. The method for determining the service type of network traffic according to claim 2, characterized in that: The determining the migration CID based on the QUIC migration flow includes: Obtain multiple second messages in the QUIC migration flow; Extracting the longest common prefix code stream from the multiple second messages; The migration CID is determined based on the longest common prefix code stream.

6. The method for determining the service type of network traffic according to claim 1, characterized in that: The first identification feature is a migration network address triplet, and determining the first identification feature corresponding to the QUIC migration flow includes: Obtain a migration quintuple from the QUIC migration stream; Extracting the first part of the content from the migration quintuple as the migration network address triplet; the first part of the content does not change before and after the connection migration; The metadata object is a negotiated network address triplet object, the second identification feature is a negotiated network address triplet, and the negotiation service type corresponding to the first identification feature is obtained by matching from the metadata object, including: A negotiation service type corresponding to the negotiation network address triplet that is the same as the migration network address triplet is matched and obtained from the negotiation network address triplet object.

7. The method for determining the service type of network traffic according to claim 1, characterized in that: The method for determining the service type of network traffic also includes: Putting the identification result information corresponding to the migration service type into the extension field of the tunnel header of the third message; The third message is sent to the external system.

8. A method for determining the service type of network traffic, characterized in that: The method for determining the service type of network traffic comprises the following steps: Get the QUIC negotiation stream; Determine a second identification feature corresponding to the QUIC negotiation flow, and determine a negotiation service type corresponding to the QUIC negotiation flow; A metadata object is generated based on the second identification feature and the negotiated service type; the metadata object is used to determine the migration service type corresponding to the QUIC migration flow corresponding to the QUIC negotiation flow.

9. The method for determining the service type of network traffic according to claim 8, characterized in that: The second identification feature is a negotiation CID triplet, and the negotiation CID triplet at least includes a negotiation CID; The determining a second identification feature corresponding to the QUIC negotiation stream includes: Obtain the negotiation CID from the QUIC negotiation stream; generating the negotiation CID triplet based on the negotiation CID; The metadata object is a negotiation CID triplet object, and the generating of the metadata object based on the second identification feature and the negotiation service type includes: The negotiated CID triplet object is generated based on the negotiated CID triplet and the negotiated service type; the migration CID triplet is used to match the negotiated service type corresponding to the negotiated CID triplet that is the same as the migration CID triplet from the negotiated CID triplet object.

10. The method for determining the service type of network traffic according to claim 9, characterized in that: The method for determining the service type of network traffic also includes: Obtaining a negotiation quadruple and a negotiation length of the negotiation CID from the QUIC negotiation stream; A negotiation quadruple object is generated based on the negotiation length and the negotiation quadruple; the negotiation quadruple object is used to extract a migration CID from a first message in the QUIC migration flow; and the migration CID is used to generate the migration CID triplet.

11. The method for determining the service type of network traffic according to claim 8, characterized in that: The second identification feature is a negotiation network address triplet, and determining the second identification feature corresponding to the QUIC negotiation stream includes: Obtain a negotiation quintuple from the QUIC negotiation stream; Extracting the second part of the content from the negotiation quintuple as the negotiation network address triplet; the second part of the content does not change before and after the connection migration; The metadata object is a negotiated network address triplet object, and the step of generating the metadata object based on the second identification feature and the negotiated service type includes: The negotiated network address triplet object is generated based on the negotiated network address triplet and the negotiated service type.

12. An electronic device, characterized in that: The electronic device comprises: a memory, a processor, and a program for determining the business type of network traffic stored in the memory and executable on the processor, wherein the program for determining the business type of network traffic is configured to implement the steps of a method for determining the business type of network traffic as described in any one of claims 1 to 11.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program for determining the service type of network traffic, and when the program for determining the service type of network traffic is executed by a processor, the steps of the method for determining the service type of network traffic according to any one of claims 1 to 11 are implemented.

Images