Data packet identification method, device, equipment and medium based on voice communication

Abstract

The present invention provides a data packet identification method, device, equipment and medium based on voice communication, which relates to the field of communication technology, including: receiving a data packet to be identified, determining the protocol version used based on the value of the protocol version field of the data packet; if the protocol version used is the IP protocol version, determining whether it is a valid data packet based on the payload length of the data packet; if it is a valid data packet, determining the type of the bearer protocol used based on the value of the bearer protocol field of the data packet; if the type of the bearer protocol used is the target protocol type, it is an IP packet; if the protocol version used by the data packet is not the IP protocol version, or it is an invalid data packet, or the type of the bearer protocol used is not the target protocol type, it is a non-IP packet. When receiving communication data for analysis and processing, the present invention can determine the communication transmission mechanism adopted by the two communicating parties without relying on the context interaction between the two communicating parties, thereby improving the efficiency of communication data analysis and processing.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device, equipment and medium for identifying data packets based on voice communication. Background Art

[0002] The current mainstream mobile communication systems are Long Term Evolution (LTE) and New Radio (NR), both of which use the Internet Protocol (IP) to transmit voice, which is called Voice over Long-Term Evolution (VoLTE) or Voice over New Radio (VoNR). In voice transmission, voice data can use Robust Header Compression (ROHC) to reduce the transmission overhead caused by the IP header; it can also be directly transmitted using IP without ROHC header compression, thereby reducing implementation complexity.

[0003] During mobile communication, the two parties can negotiate through signaling to determine whether voice transmission uses ROHC header compression or direct IP transmission. The two parties can determine the communication transmission mechanism based on the negotiation results.

[0004] However, in some scenarios, the communicating parties may not receive the negotiation signaling, resulting in the problem that when receiving the communication data for analysis and processing, it is impossible to determine the communication transmission mechanism adopted by the communicating parties. Summary of the invention

[0005] The present invention provides a data packet identification method, device, equipment and medium based on voice communication, which is used to solve the defect in the prior art that the communication party may not receive the negotiation signaling, resulting in the inability to determine the communication transmission mechanism adopted by the communication parties when receiving the communication data for analysis and processing. When receiving the communication data for analysis and processing, only the information carried in the data packet to be identified is used to perform IP packet detection and identification, without relying on the contextual interaction information between the communication parties, so as to determine the communication transmission mechanism adopted by the communication parties, thereby improving the analysis and processing efficiency of the communication data.

[0006] The present invention provides a data packet identification method based on voice communication, comprising:

[0007] Receive a data packet to be identified, and determine a protocol version used by the data packet to be identified based on a value of a protocol version field of the data packet to be identified;

[0008] If the protocol version used by the data packet to be identified is the IP protocol version, determining whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified;

[0009] If the data packet to be identified is a valid data packet, determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified;

[0010] If the bearer protocol type used by the data packet to be identified is the target protocol type, determining that the data packet to be identified is an IP packet;

[0011] If the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, then it is determined that the data packet to be identified is a non-IP packet.

[0012] According to a data packet identification method based on voice communication provided by the present invention, the IP protocol version includes an IPV4 protocol version and an IPV6 protocol version; the protocol version used by the data packet to be identified is determined based on the value of the protocol version field of the data packet to be identified, including:

[0013] Extract the high four bits of the first byte of the data packet to be identified to obtain the protocol version field of the data packet to be identified;

[0014] If the value of the protocol version field is 4, it is determined that the protocol version used by the data packet to be identified is the IPV4 protocol version;

[0015] If the value of the protocol version field is 6, it is determined that the protocol version used by the data packet to be identified is the IPV6 protocol version.

[0016] According to a data packet identification method based on voice communication provided by the present invention, if the protocol version used by the data packet to be identified is the IP protocol version, then based on the payload length of the data packet to be identified, determining whether the data packet to be identified is a valid data packet includes:

[0017] If the protocol version used by the data packet to be identified is the IPV4 protocol version, then based on the total length and header length of the data packet to be identified, the payload length of the data packet to be identified is calculated;

[0018] If the protocol version used by the data packet to be identified is the IPV6 protocol version, determining the payload length of the data packet to be identified based on the value of the payload length field of the data packet to be identified;

[0019] If the payload length of the data packet to be identified is greater than the minimum payload length threshold, the data packet to be identified is determined to be a valid data packet.

[0020] According to a data packet identification method based on voice communication provided by the present invention, the payload length of the data packet to be identified is calculated based on the total length and header length of the data packet to be identified, including:

[0021] Extracting the lower four bits of the first byte of the data packet to be identified to obtain the header length field of the data packet to be identified;

[0022] Determining the header length of the data packet to be identified based on the value of the header length field;

[0023] The difference between the total length and the header length of the data packet to be identified is calculated to obtain the payload length of the data packet to be identified.

[0024] According to a data packet identification method based on voice communication provided by the present invention, the determining the payload length of the data packet to be identified based on the value of the payload length field of the data packet to be identified includes:

[0025] Extracting the fourth byte data and the fifth byte data of the data packet to be identified, and obtaining the payload length field of the data packet to be identified;

[0026] Based on the value of the payload length field, the payload length of the data packet to be identified is determined.

[0027] According to a data packet identification method based on voice communication provided by the present invention, the method of determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified includes:

[0028] If the protocol version used by the data packet to be identified is the IPV4 protocol version, extract the ninth byte data of the data packet to be identified to obtain the bearer protocol field of the data packet to be identified;

[0029] If the protocol version used by the data packet to be identified is the IPV6 protocol version, extracting the sixth byte data of the data packet to be identified to obtain the bearer protocol field of the data packet to be identified;

[0030] Based on the value of the bearer protocol field of the data packet to be identified, the bearer protocol type used by the data packet to be identified is determined.

[0031] The present invention also provides a data packet identification device based on voice communication, comprising:

[0032] A protocol version determination module, configured to receive a data packet to be identified, and determine a protocol version used by the data packet to be identified based on a value of a protocol version field of the data packet to be identified;

[0033] A payload length determination module, configured to determine whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified if the protocol version used by the data packet to be identified is an IP protocol version;

[0034] A bearer protocol determining module, configured to determine the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified if the data packet to be identified is a valid data packet;

[0035] An IP packet determination module, configured to determine that the data packet to be identified is an IP packet if the bearer protocol type used by the data packet to be identified is a target protocol type;

[0036] A non-IP packet determination module is used to determine that the data packet to be identified is a non-IP packet if the protocol version used by the data packet to be identified is not an IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not a target protocol type.

[0037] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for identifying data packets based on voice communication as described above is implemented.

[0038] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for identifying a data packet based on voice communication as described in any one of the above is implemented.

[0039] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned methods for identifying data packets based on voice communication.

[0040] The data packet identification method, device, equipment and medium based on voice communication provided by the present invention detect whether the data packet to be identified meets the IP packet characteristics through the protocol version used by the data packet to be identified, the payload length of the data packet to be identified and the bearer protocol used by the data packet to be identified, so as to determine whether the data packet to be identified is an IP packet. In the case where no communication negotiation signaling is received during voice communication, when receiving communication data for analysis and processing, only the information carried in the data packet to be identified is used to perform IP packet detection and identification to determine the communication transmission mechanism adopted by the communicating parties, without relying on the contextual interaction information of the communicating parties, thereby improving the efficiency of determining the communication transmission mechanism, and further improving the efficiency of communication data analysis and processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 This is one of the flow charts of the method for identifying data packets based on voice communication provided by an embodiment of the present invention.

[0043] Figure 2 This is the second flow chart of the method for identifying data packets based on voice communication provided by an embodiment of the present invention.

[0044] Figure 3 It is a structural diagram of a data packet identification device based on voice communication provided by an embodiment of the present invention.

[0045] Figure 4 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] In the description of the present invention, the terms "include", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0048] Combine the following Figure 1-Figure 4 The present invention describes a method, device, equipment and medium for identifying data packets based on voice communication provided by an embodiment of the present invention.

[0049] It should be noted that all actions of acquiring signals, information or data in the present invention are performed in compliance with the corresponding data protection laws and policies of the country where the device is located and with the authorization given by the owner of the corresponding device.

[0050] During mobile communication, the two parties can negotiate through signaling to determine whether voice transmission uses ROHC header compression packets or directly uses IP packets for transmission. The two parties can determine the communication transmission mechanism based on the negotiation results.

[0051] However, in some scenarios, for example, the communication quality between the communicating parties is very poor, and the communication receiving party may not receive the negotiation signaling, resulting in the problem that the communication transmission mechanism adopted by the communicating parties cannot be determined when the communication data is received for analysis and processing; for example, in a non-cooperative reception scenario, the communicating third party can only passively receive the communication data of both parties, or even can only receive the communication data of one party under most conditions, and cannot fully receive the negotiation signaling of both parties, resulting in the problem that the communicating third party cannot determine the communication transmission mechanism adopted by the communicating parties when receiving the data of both parties for analysis and processing.

[0052] Therefore, the embodiment of the present invention can detect and identify the received data packets using only the information carried in the data packets to be identified, without relying on the contextual interaction between the two communicating parties, when no communication negotiation signaling is received, thereby determining the communication transmission mechanism adopted by the two communicating parties. It should be noted that when the third party in communication performs data packet identification through the method provided by the present invention, it is based on necessary investigation activities permitted by law, or under the premise of complying with the corresponding data protection laws and policies of the country where it is located, and with the authorization given by the owner of the corresponding device.

[0053] It should also be noted that the non-cooperative receiving scenario in the present invention may refer to a necessary investigation scenario based on legal permission, or a scenario that complies with the corresponding data protection laws and policies of the country where the person is located. For example, in an emergency communication scenario, that is, when an emergency such as a natural disaster occurs, relevant personnel may need to receive communication signals from different sources through communication equipment (i.e., a third party in communication) to obtain location information or other data and conduct rescue.

[0054] Figure 1 This is one of the flow charts of the method for identifying a data packet based on voice communication provided by an embodiment of the present invention. Figure 1 The embodiment of the present invention provides a method for identifying a data packet based on voice communication, and the method may specifically include the following steps:

[0055] Step 101: Receive a data packet to be identified, and determine a protocol version used by the data packet to be identified based on a value of a protocol version field of the data packet to be identified.

[0056] It should be noted that the execution subject of the data packet identification method based on voice communication provided in the embodiment of the present invention may be an electronic device, a component in an electronic device, an integrated circuit or a chip. The electronic device may be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device may be a mobile phone, a tablet computer, a laptop computer, a PDA, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc., and the non-mobile electronic device may be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present invention.

[0057] During the voice communication process, a communication data packet may be received. The embodiment of the present invention can detect whether the received communication data packet meets the IP packet characteristics, thereby identifying whether the communication data packet is an IP packet. If the communication data packet is an IP packet, it can be explained that the two communicating parties directly use the IP packet for data transmission; if the communication data packet is not an IP packet, it can be further identified whether the communication data packet is a ROHC compressed packet, and whether the two communicating parties use the ROHC header compressed packet for data transmission, so that when receiving the communication data for analysis and processing, the communication transmission mechanism used by the two communicating parties can be determined.

[0058] In an embodiment of the present invention, the protocol version, payload length and bearer protocol used by the data packet to be identified can be obtained to detect whether the data packet to be identified meets the characteristics of an IP packet, so as to determine whether the data packet to be identified is an IP packet.

[0059] The IP protocol can have multiple protocol versions, and the protocol version field in the IP packet header can indicate which version the data packet uses. In an embodiment of the present invention, the value of the protocol version field of the data packet to be identified can be extracted to determine the protocol version used by the data packet to be identified, and to determine whether the protocol version used by the data packet to be identified is the IP protocol version, so as to preliminarily determine whether the data packet to be identified meets the IP packet characteristics based on the protocol version.

[0060] Step 102: If the protocol version used by the data packet to be identified is the IP protocol version, then based on the payload length of the data packet to be identified, determine whether the data packet to be identified is a valid data packet.

[0061] The payload length may refer to the length of the effective load actually carried in the data packet, and the effective load may refer to the data portion of the communication transmission. The payload length of the IP packet carrying complete effective data is usually not too short. In the voice communication process, the embodiment of the present invention determines whether the data packet to be identified is a valid data packet by the payload length, and can filter out data packets that are too small, which is conducive to avoiding resource waste and improving data analysis efficiency.

[0062] In an embodiment of the present invention, if the protocol version used by the data packet to be identified is the IP protocol version, it can be said that the protocol version of the data packet to be identified conforms to the characteristics of the IP packet, and based on the payload length of the data packet to be identified, it is further determined whether the data packet to be identified is a valid data packet, so as to retain the valid data packets and filter out the invalid data packets.

[0063] Specifically, if the payload length of the data packet to be identified is greater than the minimum payload length threshold value, it can be said that the data packet to be identified is a valid data packet, and the payload length of the data packet to be identified meets the characteristics of the IP packet; if the payload length of the data packet to be identified is less than or equal to the minimum payload length threshold value, it can be said that the data packet to be identified is an invalid data packet, the payload length of the data packet to be identified does not meet the characteristics of the IP packet, and the data packet is discarded.

[0064] In some embodiments, if the protocol version used by the data packet to be identified is not the IP protocol version, it can be determined that the data packet to be identified does not meet the characteristics of the IP packet, and the data packet to be identified is a non-IP packet, that is, the communicating parties do not directly use IP packets for voice data transmission.

[0065] Step 103: If the data packet to be identified is a valid data packet, the bearer protocol type used by the data packet to be identified is determined based on the value of the bearer protocol field of the data packet to be identified.

[0066] The bearer protocol may refer to an upper layer transport protocol, and the bearer protocol field in the data packet may be used to indicate a specific upper layer transport protocol type used by the data carried by the data packet.

[0067] In an embodiment of the present invention, if the data packet to be identified is a valid data packet, the value of the bearer protocol field of the data packet to be identified can be extracted to determine the bearer protocol type used by the data packet to be identified, and it can be judged whether the bearer protocol type used by the data packet to be identified is the target protocol type, so as to further judge whether the data packet to be identified meets the IP packet characteristics based on the bearer protocol.

[0068] The target protocol type may refer to the types of upper layer transport protocols running on the IP layer. Specifically, if the bearer protocol type used by the data packet to be identified is the target protocol type, it can be said that the bearer protocol of the data packet to be identified meets the IP packet characteristics; if the bearer protocol type used by the data packet to be identified is not the target protocol type, it can be said that the bearer protocol of the data packet to be identified does not meet the IP packet characteristics.

[0069] Optionally, the value of the target protocol type may include 50, 6, 17, 58, 59, 60, 41, 42, 43, 44, etc.

[0070] The protocol type value of 50 indicates the Encapsulating Security Payload (ESP), which is a security protocol that can be used to provide confidentiality and data integrity.

[0071] The protocol type value of 6 indicates the Transmission Control Protocol (TCP), which can provide reliable, connection-oriented services.

[0072] The protocol type value of 17 indicates the User Datagram Protocol (UDP), which can provide connectionless services and is suitable for real-time applications or scenarios that are sensitive to delay but do not require integrity.

[0073] The protocol type value 58 indicates Internet Control Message Protocol Version 6 (ICMPv6), which is used for control messages and error reports of IPv6.

[0074] The protocol type value 59 can indicate No Next Header, which means there is no next header and is usually used for IPv6 extension headers.

[0075] The protocol type value of 60 can indicate Experimental and Reserved for Future Use, which can be reserved for experimental protocols and protocols that may be used in the future.

[0076] The protocol type value 41 indicates IPv6-in-IPv4, which is a protocol used to encapsulate IPv6 packets in IPv4.

[0077] The protocol type value of 42 indicates IPv6 Routing Header, which is used for the IPv6 routing header and supports routing of specific paths in IPv6.

[0078] The protocol type value of 43 indicates the IPv6 Fragment Header, which is used to fragment IPv6 packets to ensure that data can be transmitted between different network MTUs.

[0079] The protocol type value of 44 can represent the IPv6 Authentication Header, which is used to provide authentication and data integrity in IPv6.

[0080] Step 104: If the bearer protocol type used by the data packet to be identified is the target protocol type, it is determined that the data packet to be identified is an IP packet.

[0081] In the embodiment of the present invention, after it is determined that the protocol version used by the data packet to be identified is the IP protocol version, the data packet to be identified is a valid data packet, and the bearer protocol type used by the data packet to be identified is the target protocol type, it can be said that the data packet to be identified meets the IP packet characteristics and the data packet to be identified is an IP packet. Therefore, during the voice transmission process, the communicating parties directly use IP packets for data transmission instead of ROHC header compression packets for data transmission, so that the communication transmission mechanism used by the communicating parties can be determined when receiving communication data for analysis and processing.

[0082] Step 105, if the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, then determine that the data packet to be identified is a non-IP packet.

[0083] In the embodiment of the present invention, in the process of determining whether the data packet to be identified is an IP packet based on the protocol version, payload length and bearer protocol, if it is determined that the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, it can be explained that the data packet to be identified does not meet the characteristics of the IP packet and is a non-IP packet. Therefore, in the process of voice transmission, the communicating parties do not directly use IP packets for data transmission. It is possible to further identify whether the communication data packet is a ROHC compressed packet and determine whether the communicating parties use ROHC header compressed packets for data transmission, so that when receiving the communication data for analysis and processing, the communication transmission mechanism adopted by the communicating parties can be determined.

[0084] It should be noted that the above-mentioned detection of whether the data packet to be identified meets the IP packet characteristics through the protocol version, payload length and bearer protocol is only an example of the present invention. In actual applications, other characteristics of the data packet can also be combined to perform multi-dimensional detection and identification on whether the data packet meets the IP packet characteristics, thereby improving the recognition accuracy of the IP packet and improving the detection and identification efficiency and accuracy of the communication transmission mechanism adopted by the communicating parties.

[0085] The embodiment of the present invention detects whether the data packet to be identified meets the IP packet characteristics through the protocol version used by the data packet to be identified, the payload length of the data packet to be identified and the bearer protocol used by the data packet to be identified, so as to determine whether the data packet to be identified is an IP packet. In the case where no communication negotiation signaling is received during voice communication, when receiving communication data for analysis and processing, only the information carried in the data packet to be identified is used to perform IP packet detection and identification to determine the communication transmission mechanism adopted by the communicating parties, without relying on the contextual interaction information of the communicating parties, thereby improving the efficiency of determining the communication transmission mechanism, and further improving the efficiency of communication data analysis and processing.

[0086] Based on any of the above embodiments, the IP protocol version includes an IPV4 protocol version and an IPV6 protocol version; the determining the protocol version used by the data packet to be identified based on the value of the protocol version field of the data packet to be identified may specifically include:

[0087] Step S11, extracting the high four bits of the first byte of the data packet to be identified to obtain the protocol version field of the data packet to be identified;

[0088] Step S12, if the value of the protocol version field is 4, it is determined that the protocol version used by the data packet to be identified is the IPV4 protocol version;

[0089] Step S13: If the value of the protocol version field is 6, it is determined that the protocol version used by the data packet to be identified is the IPV6 protocol version.

[0090] In an IP packet, the first byte high four bits of data can be used to represent the IP protocol version. In an embodiment of the present invention, the first byte high four bits of data of the data packet to be identified, i.e., the protocol version field of the data packet to be identified, can be extracted, thereby determining the protocol version used by the data packet to be identified based on the value of the protocol version field.

[0091] If the high four bits of the first byte are 0100, that is, the value of the protocol version field is 4, it can be said that the protocol version used by the data packet to be identified is the IPV4 protocol version; if the high four bits of the first byte are 0110, that is, the value of the protocol version field is 6, it can be said that the protocol version used by the data packet to be identified is the IPV6 protocol version.

[0092] If the protocol version field value of the data packet to be identified is neither 4 nor 6, it can be explained that the version protocol used by the data packet to be identified is not the IP version protocol, and the data packet to be identified is not an IP packet.

[0093] The embodiment of the present invention can determine whether the protocol version used by the data packet to be identified is the IPV4 protocol version or the IPV6 protocol version by extracting the high four bits of the first byte, thereby determining whether the protocol version used by the data packet to be identified conforms to the IP packet characteristics. It does not need to rely on the context interaction between the communicating parties, which is beneficial for determining the communication transmission mechanism adopted by the communicating parties when receiving communication data for analysis and processing.

[0094] Based on any of the above embodiments, if the protocol version used by the data packet to be identified is the IP protocol version, determining whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified may specifically include:

[0095] Step S21, if the protocol version used by the data packet to be identified is the IPV4 protocol version, then based on the total length and header length of the data packet to be identified, the payload length of the data packet to be identified is calculated;

[0096] Step S22, if the protocol version used by the data packet to be identified is the IPV6 protocol version, determining the payload length of the data packet to be identified based on the value of the payload length field of the data packet to be identified;

[0097] Step S23: If the payload length of the data packet to be identified is greater than the minimum payload length threshold, the data packet to be identified is determined to be a valid data packet.

[0098] The header of the IPV4 packet may include a total length field (excluding the payload length field), which may be used to record the total length of the data packet. In an embodiment of the present invention, if the protocol version used by the data packet to be identified is the IPV4 protocol version, the payload length of the data packet to be identified may be calculated based on the total length and header length of the data packet to be identified.

[0099] The header of the IPV6 packet may include a payload length field (excluding a total length field). In an embodiment of the present invention, if the protocol version used by the data packet to be identified is the IPV6 protocol version, the payload length of the data packet to be identified may be determined based on the value of the payload length field of the data packet to be identified.

[0100] In the embodiment of the present invention, after determining the payload length of the data packet to be identified, it can be determined whether the payload length of the data packet to be identified is greater than the minimum payload length threshold value. If the payload length of the data packet to be identified is greater than the minimum payload length threshold value, it can be explained that the data packet to be identified is a valid data packet, and the payload length of the data packet to be identified meets the IP packet characteristics; if the payload length of the data packet to be identified is less than or equal to the minimum payload length threshold value, it can be explained that the data packet to be identified is an invalid data packet, and the payload length of the data packet to be identified does not meet the IP packet characteristics, and the data packet is discarded.

[0101] Optionally, the minimum payload length threshold value may be set to 7. It should be noted that the minimum payload length threshold value may also be set to other values ​​according to actual needs, and the present invention does not impose any specific limitation thereto.

[0102] The embodiment of the present invention determines the corresponding payload length calculation method based on the characteristics of the protocol version used by the data packet to be identified, so as to judge whether the payload length of the data packet to be identified is greater than the minimum payload length threshold value, so as to detect whether the payload length of the data packet to be identified conforms to the IP packet characteristics. It does not need to rely on the context interaction between the communicating parties, which is conducive to determining the communication transmission mechanism adopted by the communicating parties when receiving communication data for analysis and processing.

[0103] Based on any of the above embodiments, the calculating the payload length of the data packet to be identified based on the total length and the header length of the data packet to be identified may specifically include:

[0104] Step S211, extracting the lower four bits of the first byte of the data packet to be identified to obtain the header length field of the data packet to be identified;

[0105] Step S212, determining the header length of the data packet to be identified based on the value of the header length field;

[0106] Step S213, performing a difference calculation on the total length and the header length of the data packet to be identified to obtain the payload length of the data packet to be identified.

[0107] In an IPV4 packet, the first byte low four bits of data can be used to represent the header length of the entire IP packet. In an embodiment of the present invention, the first byte low four bits of data of the data packet to be identified, i.e., the header length field of the data packet to be identified, can be extracted, so as to determine the header length of the data packet to be identified based on the value of the header length field; then, the difference between the total length of the data packet to be identified and the header length can be calculated to obtain the payload length of the data packet to be identified, and the payload length of the data packet to be identified can be compared with the minimum payload length threshold value, so as to detect whether the data packet to be identified is a valid data packet.

[0108] In some embodiments, the minimum total length threshold value can also be obtained by calculating the sum of the header length of the data packet to be identified and the minimum payload length threshold value, and the total length of the data packet to be identified is compared with the minimum total length threshold value. If the total length of the data packet to be identified is greater than the minimum total length threshold value, the data packet to be identified can be determined to be a valid data packet; if the total length of the data packet to be identified is less than or equal to the minimum total length threshold value, the data packet to be identified can be determined to be an invalid data packet.

[0109] The embodiment of the present invention extracts the lower four bits of the first byte of the data packet to be identified based on the characteristics of the IPV4 packet, determines the payload length, and judges whether the payload length of the data packet to be identified is greater than the minimum payload length threshold value, so as to detect whether the payload length of the data packet to be identified conforms to the IP packet characteristics. It does not need to rely on the context interaction between the communicating parties, which is conducive to determining the communication transmission mechanism adopted by the communicating parties when receiving communication data for analysis and processing.

[0110] Based on any of the above embodiments, determining the payload length of the data packet to be identified based on the value of the payload length field of the data packet to be identified may specifically include:

[0111] Step S221, extracting the fourth byte data and the fifth byte data of the data packet to be identified, and obtaining the payload length field of the data packet to be identified;

[0112] Step S222: Determine the payload length of the data packet to be identified based on the value of the payload length field.

[0113] In the IPV6 packet, the fourth byte and the fifth byte data can be used to represent the payload length of the entire IP packet. In the embodiment of the present invention, the fourth byte data and the fifth byte data of the data packet to be identified, i.e., the payload length field of the data packet to be identified, can be extracted, thereby determining the payload length of the data packet to be identified based on the value of the payload length field, and comparing the payload length of the data packet to be identified with the minimum payload length threshold value, thereby detecting whether the data packet to be identified is a valid data packet.

[0114] The embodiment of the present invention extracts the fourth byte data and the fifth byte data of the data packet to be identified based on the characteristics of the IPV6 packet, determines the payload length, and judges whether the payload length of the data packet to be identified is greater than the minimum payload length threshold value, so as to detect whether the payload length of the data packet to be identified conforms to the IP packet characteristics. It does not need to rely on the context interaction between the communicating parties, which is conducive to determining the communication transmission mechanism adopted by the communicating parties when receiving the communication data for analysis and processing.

[0115] Based on any of the above embodiments, determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified may specifically include:

[0116] Step S31, if the protocol version used by the data packet to be identified is the IPV4 protocol version, extract the ninth byte data of the data packet to be identified to obtain the bearer protocol field of the data packet to be identified;

[0117] Step S32, if the protocol version used by the data packet to be identified is the IPV6 protocol version, extract the sixth byte data of the data packet to be identified to obtain the bearer protocol field of the data packet to be identified;

[0118] Step S33: determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified.

[0119] In the IPV4 packet, the ninth byte data can be used to represent the bearer protocol type of the IPV4 packet. In an embodiment of the present invention, by extracting the ninth byte data of the packet to be identified whose protocol version is IPV4, i.e. the bearer protocol field, the bearer protocol type used by the packet to be identified can be determined.

[0120] In the IPV6 packet, the sixth byte data can be used to represent the bearer protocol type of the IPV6 packet. In an embodiment of the present invention, by extracting the sixth byte data of the packet to be identified whose protocol version is IPV6, i.e. the bearer protocol field, the bearer protocol type used by the packet to be identified can be determined.

[0121] The embodiment of the present invention extracts the ninth byte data based on the characteristics of the IPV4 packet and extracts the sixth byte data based on the characteristics of the IPV6 packet, thereby determining the bearer protocol type to judge whether the bearer protocol type of the data packet to be identified is the target protocol type, and to detect whether the bearer protocol type of the data packet to be identified conforms to the IP packet characteristics. It does not need to rely on the context interaction between the communicating parties, which is conducive to determining the communication transmission mechanism adopted by the communicating parties when receiving communication data for analysis and processing.

[0122] In order to solve the problem that the third party in communication cannot determine the transmission mechanism when receiving and analyzing the data of the communicating parties in a non-cooperative reception scenario, the data packet identification method based on voice communication provided in the embodiment of the present invention can detect and identify whether the received data packet is an IP packet or a ROHC packet without relying on the context interaction between the communicating parties, thereby determining the communication transmission mechanism of the communicating parties.

[0123] In the embodiment of the present invention, it is possible to identify whether a received data packet is an IP packet by detecting whether the received data packet meets the IP packet characteristics. If the received data packet meets the IP packet characteristics, it is an IP packet, not a non-IP packet such as a ROHC compressed packet.

[0124] Figure 2 FIG. 2 is a flow chart of a method for identifying a data packet based on voice communication provided by an embodiment of the present invention. Figure 2 After receiving the data packet to be identified, the protocol version field of the data packet to be identified can be extracted from the high 4 bits of the first byte to determine whether the protocol version field value of the data packet to be identified is equal to 4 or equal to 6. If the protocol version field value is neither 4 nor 6, it is determined that the data packet to be identified is a non-IP packet.

[0125] If the protocol version field value is 4, extract the IPv4 header length field from the lower 4 bits of the first byte, obtain the header length value in accordance with the IPv4 format, and determine whether the total length of the data packet is greater than the sum of the header length value and the minimum payload length threshold value (the default value is 7). If the total length of the data packet with the protocol version of IPv4 is greater than the sum of the header length value and the minimum payload length threshold value, it means that the data packet is a valid data packet, extract the bearer protocol type field from the 9th byte, and determine whether the bearer protocol type field is the target protocol type value (that is, whether it is a legal type value, the type value should be 50, 6, 17, 58, 59, 60, 41, 42, 43, 44). If the total length of the data packet with the protocol version of IPv4 is less than or equal to the sum of the header length value and the minimum payload length threshold value, the data packet is determined to be a non-IP packet.

[0126] If the protocol version field value is 6, the header length of the data packet is 40 bytes. The IPv6 payload length field is extracted from the fourth and fifth bytes, and the payload length value is obtained according to the IPv6 format. It is determined whether the payload length value is greater than the minimum payload length threshold value (the default value is 7). If the payload length value of the data packet with the protocol version of IPv6 is greater than the minimum payload length threshold value, it means that the data packet is a valid data packet. The bearer protocol type field is extracted from the sixth byte to determine whether the bearer protocol type field is the target protocol type value (that is, whether it is a legal type value, the type value should be 50, 6, 17, 58, 59, 60, 41, 42, 43, 44). If the payload length value of the data packet with the protocol version of IPv6 is less than or equal to the minimum payload length threshold value, the data packet is determined to be a non-IP packet.

[0127] If the bearer protocol type field of the data packet is the target protocol type value, the data packet is determined to be an IP packet. If the bearer protocol type field of the data packet is not the target protocol type value, the data packet is determined to be a non-IP packet.

[0128] In some embodiments, when receiving a data packet to be identified, the data packet to be identified can be first decrypted, and based on the protocol version, payload length, and bearer protocol information carried by the decrypted data packet to be identified, the data packet is detected to see whether it meets the IP packet characteristics, thereby determining whether the decryption is successful. During the decryption process, the decryption of the data packet to be identified can be achieved without the need for communication interaction with the communication party.

[0129] Specifically, all saved user key identifier (KI) parameters can be tried through the received authentication request message. If the authentication is successful, the relevant message keys Knasenc, Knasinc, Krrcenc, Krrcinc, and Kupenc of the communication can be generated.

[0130] For the received Radio Resource Control (RRC) message and Non-Access Stratum (NAS) message, if the first decryption or decryption fails, the decryption algorithm, count value, and bearerid parameter are traversed to determine whether the decryption is successful by comparing the calculated integrity protection value Media Access Control Address (MAC); if it is not the first decryption, the parameters of the previous successful decryption are used for decryption.

[0131] For the received user plane data message, the algorithm for successful decryption of RRC messages and NAS messages can be used to traverse the count value and bearerid parameters to try to decrypt, and determine whether the decryption is successful based on whether the decryption result data meets the IP packet characteristics.

[0132] In some embodiments, after determining that the data packet to be identified is an IP packet, it is possible to further detect whether the IP packet is an AMR voice data packet based on the information carried by the IP packet, so that the AMR voice content can be transmitted, restored and played without relying on the context information of the two communicating parties. Specifically, the data content of the IP packet can be matched based on the voice data format characteristics of Adaptive Multi-Rate (AMR) voice coding. For data content that does not conform to the AMR voice data format characteristics, it is determined that the AMR voice detection and recognition fails, otherwise it is determined that the AMR voice detection and recognition is successful. Specifically, the encoding rate value (Call Management Record (CMR)) field and the encoding format or frame type (Format Type or Frame Type, FT) field of the call type (Table of Contents, TOC) can be extracted from the IP packet according to the AMR format to determine whether it is a normal range value in the AMR-NB (Adaptive Multi-Rate Narrowband) and AMR-WB (Adaptive Multi-Rate Wideband) formats. If it does not conform to the normal range value, it is not AMR voice data; if it conforms to the normal range value, it is AMR voice data.

[0133] Since each AMR voice frame is 20ms long, the voice data content length can be calculated based on the voice coding rate. If the received voice data content length is not equal to the voice data content length calculated based on the coding rate, it is not AMR voice data; if they are equal, it is AMR voice data.

[0134] The following is a description of a data packet identification device based on voice communication provided by the present invention. The data packet identification device based on voice communication described below and the data packet identification method based on voice communication described above can be referred to each other.

[0135] Figure 3 1 is a schematic diagram of the structure of a data packet identification device based on voice communication provided by an embodiment of the present invention. Figure 3 The embodiment of the present invention provides a data packet identification device based on voice communication, and the device may specifically include the following modules:

[0136] The protocol version determination module 310 is used to receive a data packet to be identified, and determine the protocol version used by the data packet to be identified based on the value of the protocol version field of the data packet to be identified;

[0137] A payload length determination module 320, configured to determine whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified if the protocol version used by the data packet to be identified is the IP protocol version;

[0138] A bearer protocol determination module 330, configured to determine the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified if the data packet to be identified is a valid data packet;

[0139] An IP packet determination module 340, configured to determine that the data packet to be identified is an IP packet if the bearer protocol type used by the data packet to be identified is a target protocol type;

[0140] The non-IP packet determination module 350 is used to determine that the data packet to be identified is a non-IP packet if the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type.

[0141] The embodiment of the present invention detects whether the data packet to be identified meets the IP packet characteristics through the protocol version used by the data packet to be identified, the payload length of the data packet to be identified and the bearer protocol used by the data packet to be identified, so as to determine whether the data packet to be identified is an IP packet. In the case where no communication negotiation signaling is received during voice communication, when receiving communication data for analysis and processing, only the information carried in the data packet to be identified is used to perform IP packet detection and identification to determine the communication transmission mechanism adopted by the communicating parties, without relying on the contextual interaction information of the communicating parties, thereby improving the efficiency of determining the communication transmission mechanism, and further improving the efficiency of communication data analysis and processing.

[0142] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4As shown, the electronic device may include: a processor (processor) 410 , a communication interface (Communications Interface) 420 , a memory (memory) 430 and a communication bus 440 , wherein the processor 410 , the communication interface 420 , and the memory 430 communicate with each other through the communication bus 440 . The processor 410 can call the logic instructions in the memory 430 to execute a data packet identification method based on voice communication, which includes: receiving a data packet to be identified, and determining the protocol version used by the data packet to be identified based on the value of the protocol version field of the data packet to be identified; if the protocol version used by the data packet to be identified is the IP protocol version, then determining whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified; if the data packet to be identified is a valid data packet, then determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified; if the bearer protocol type used by the data packet to be identified is the target protocol type, then determining that the data packet to be identified is an IP packet; if the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, then determining that the data packet to be identified is a non-IP packet.

[0143] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0144] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data packet identification method based on voice communication provided by the above methods, the method including: receiving a data packet to be identified, and determining the protocol version used by the data packet to be identified based on the value of the protocol version field of the data packet to be identified; if the protocol version used by the data packet to be identified is the IP protocol version, then determining whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified; if the data packet to be identified is a valid data packet, then determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified; if the bearer protocol type used by the data packet to be identified is the target protocol type, then determining that the data packet to be identified is an IP packet; if the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, then determining that the data packet to be identified is a non-IP packet.

[0145] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the data packet identification method based on voice communication provided by the above-mentioned methods, the method comprising: receiving a data packet to be identified, and determining the protocol version used by the data packet to be identified based on the value of the protocol version field of the data packet to be identified; if the protocol version used by the data packet to be identified is the IP protocol version, determining whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified; if the data packet to be identified is a valid data packet, determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified; if the bearer protocol type used by the data packet to be identified is the target protocol type, determining that the data packet to be identified is an IP packet; if the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, determining that the data packet to be identified is a non-IP packet.

[0146] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0147] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0148] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data packet identification method based on voice communication, characterized in that: include: Receive a data packet to be identified, and determine a protocol version used by the data packet to be identified based on a value of a protocol version field of the data packet to be identified; If the protocol version used by the data packet to be identified is the IP protocol version, determining whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified; If the data packet to be identified is a valid data packet, determining the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified; If the bearer protocol type used by the data packet to be identified is the target protocol type, determining that the data packet to be identified is an IP packet, so as to determine that the communicating parties use IP packets for data transmission during voice transmission when no communication negotiation signaling is received; If the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, then the data packet to be identified is determined to be a non-IP packet, so as to determine that the communicating parties use non-IP packets for data transmission during voice transmission when no communication negotiation signaling is received.

2. The method for identifying data packets based on voice communication according to claim 1, characterized in that: The IP protocol version includes an IPV4 protocol version and an IPV6 protocol version; the determining the protocol version used by the data packet to be identified based on the value of the protocol version field of the data packet to be identified includes: Extract the high four bits of the first byte of the data packet to be identified to obtain the protocol version field of the data packet to be identified; If the value of the protocol version field is 4, it is determined that the protocol version used by the data packet to be identified is the IPV4 protocol version; If the value of the protocol version field is 6, it is determined that the protocol version used by the data packet to be identified is the IPV6 protocol version.

3. The method for identifying data packets based on voice communication according to claim 1, characterized in that: If the protocol version used by the data packet to be identified is the IP protocol version, determining whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified includes: If the protocol version used by the data packet to be identified is the IPV4 protocol version, then based on the total length and header length of the data packet to be identified, the payload length of the data packet to be identified is calculated; If the protocol version used by the data packet to be identified is the IPV6 protocol version, determining the payload length of the data packet to be identified based on the value of the payload length field of the data packet to be identified; If the payload length of the data packet to be identified is greater than the minimum payload length threshold, the data packet to be identified is determined to be a valid data packet.

4. The method for identifying data packets based on voice communication according to claim 3, characterized in that: The step of calculating the payload length of the data packet to be identified based on the total length and the header length of the data packet to be identified includes: Extracting the lower four bits of the first byte of the data packet to be identified to obtain the header length field of the data packet to be identified; Determining the header length of the data packet to be identified based on the value of the header length field; The difference between the total length and the header length of the data packet to be identified is calculated to obtain the payload length of the data packet to be identified.

5. The method for identifying data packets based on voice communication according to claim 3, characterized in that: The step of determining the payload length of the data packet to be identified based on the value of the payload length field of the data packet to be identified includes: Extracting the fourth byte data and the fifth byte data of the data packet to be identified, and obtaining the payload length field of the data packet to be identified; Based on the value of the payload length field, the payload length of the data packet to be identified is determined.

6. The method for identifying data packets based on voice communication according to claim 1, characterized in that: The determining, based on the value of the bearer protocol field of the data packet to be identified, the bearer protocol type used by the data packet to be identified includes: If the protocol version used by the data packet to be identified is the IPV4 protocol version, extract the ninth byte data of the data packet to be identified to obtain the bearer protocol field of the data packet to be identified; If the protocol version used by the data packet to be identified is the IPV6 protocol version, extracting the sixth byte data of the data packet to be identified to obtain the bearer protocol field of the data packet to be identified; Based on the value of the bearer protocol field of the data packet to be identified, the bearer protocol type used by the data packet to be identified is determined.

7. A data packet identification device based on voice communication, characterized in that: include: A protocol version determination module, configured to receive a data packet to be identified, and determine a protocol version used by the data packet to be identified based on a value of a protocol version field of the data packet to be identified; A payload length determination module, configured to determine whether the data packet to be identified is a valid data packet based on the payload length of the data packet to be identified if the protocol version used by the data packet to be identified is an IP protocol version; A bearer protocol determining module, configured to determine the bearer protocol type used by the data packet to be identified based on the value of the bearer protocol field of the data packet to be identified if the data packet to be identified is a valid data packet; An IP packet determination module, configured to determine that the data packet to be identified is an IP packet if the bearer protocol type used by the data packet to be identified is a target protocol type, so as to determine that the communicating parties use IP packets for data transmission during voice transmission when no communication negotiation signaling is received; The non-IP packet determination module is used to determine that the data packet to be identified is a non-IP packet if the protocol version used by the data packet to be identified is not the IP protocol version, or the data packet to be identified is an invalid data packet, or the bearer protocol type used by the data packet to be identified is not the target protocol type, so as to determine that the communicating parties use non-IP packets for data transmission during voice transmission when no communication negotiation signaling is received.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for identifying data packets based on voice communication according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying data packets based on voice communication as claimed in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for identifying data packets based on voice communication as claimed in any one of claims 1 to 6 is implemented.

Images