PCDN user management method and device and computer equipment

Abstract

The invention discloses a PCDN user management method and device and computer equipment. The method comprises the following steps: identifying a suspected PCDN user from a plurality of to-be-identified users; the traffic of the suspected PCDN user is drained to a preset tunnel router, a characteristic value corresponding to the traffic of the suspected PCDN user is acquired, and the characteristic value is used for representing the traffic characteristic of the user; matching the characteristic value corresponding to the traffic of the suspected PCDN user with a characteristic value in a preset PCDN user characteristic library by adopting a preset tunnel router, and determining that the suspected PCDN user is a PCDN user under the condition that the characteristic value corresponding to the traffic of the suspected PCDN user is matched with the characteristic value in the preset PCDN user characteristic library; and processing the flow of the PCDN user according to a predetermined processing strategy. The technical problem of low PCDN disposal efficiency caused by manual identification and disposal is solved.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method, apparatus and computer device for managing PCDN users. Background Art

[0002] With the rapid development of Internet technology, network traffic management and network security control have become increasingly complex. In this context, PCDN (Partial Content Delivery Network) is a special application mode, and its traffic characteristics are significantly different from the conventional network usage mode, especially in terms of uplink traffic. PCDN users often generate uplink data transmission far beyond the normal range, which not only occupies a large amount of network bandwidth resources, but also may cause network congestion, reduce network service quality, and even pose a potential threat to network security. When network operators face PCDN problems, the traditional processing method mainly relies on manual analysis and manual intervention, which is inefficient and has a long response time. When the fixed network AAA (Authentication, Authorization, Accounting) system identifies a suspected PCDN user, it often lacks an automated and efficient information feedback and disposal mechanism.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus and computer device for managing PCDN users, so as to at least solve the technical problem of low efficiency of PCDN handling due to manual identification and handling.

[0005] According to one aspect of an embodiment of the present application, a method for managing PCDN users is provided, comprising: identifying a suspected PCDN user from a plurality of users to be identified; directing traffic of the suspected PCDN user to a preset tunnel router, and obtaining a feature value corresponding to the traffic of the suspected PCDN user, the feature value being used to represent traffic characteristics of the user; matching the feature value corresponding to the traffic of the suspected PCDN user with a feature value in a preset PCDN user feature library using the preset tunnel router, wherein, when the feature value corresponding to the traffic of the suspected PCDN user matches the feature value in the preset PCDN user feature library, confirming that the suspected PCDN user is a PCDN user; and processing the traffic of the PCDN user according to a predetermined processing strategy.

[0006] Optionally, the traffic of the suspected PCDN user is directed to the preset tunnel router, including: kicking the suspected PCDN user offline; when the suspected PCDN user re-accesses, performing VPDN authentication on the suspected PCDN user to establish a tunnel between the suspected PCDN user and the tunnel router; and obtaining traffic data of the suspected PCDN user through the tunnel.

[0007] Optionally, comparing the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library includes: obtaining the characteristic value corresponding to the traffic of the suspected PCDN user, the characteristic value corresponding to the traffic of the suspected PCDN user including at least one of the following: the MAC address device type of the suspected PCDN user, the destination address of the suspected PCDN user, the divergence degree from the source address to the destination address of the suspected PCDN user, and the destination address proportion of the upstream traffic of the suspected PCDN user; evaluating the similarity between the characteristic value corresponding to the traffic of the suspected PCDN user and the characteristic value in the preset PCDN user characteristic library, and when the similarity is higher than a first threshold, determining that the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library.

[0008] Optionally, processing the traffic of the PCDN user according to a predetermined processing strategy includes: issuing a preset domain name to the PCDN user, the preset domain name is used to direct the traffic of the PCDN user to a preset environment; in the preset environment, performing traffic restriction processing on each session of the PCDN user.

[0009] Optionally, after processing the traffic of the PCDN user according to a predetermined processing strategy, the method further includes: when the amount of reduction in the uplink traffic of the PCDN user is greater than a preset amount threshold, determining that the PCDN user is effectively controlled, and marking the destination link that disappears after the traffic of the PCDN user is processed; when the uplink traffic of the PCDN user is not reduced, determining that the PCDN user marks the PCDN user as an observation period user; when the uplink traffic of the observation period user does not decrease, determining that the observation period user is a whitelist user, and determining the characteristics of the whitelist user as whitelist characteristics.

[0010] Optionally, the method for comparing the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library also includes: capturing the characteristic value of the suspected PCDN user in multiple ways, wherein the multiple ways at least include: obtaining the divergence score of the suspected PCDN user, obtaining the server to which the suspected PCDN user belongs, and classifying the protocol of the suspected PCDN user; comparing the captured characteristic value with the historical characteristic value of the PCDN user, and processing the traffic of the suspected PCDN user according to a predetermined processing strategy when the historical characteristic value is matched.

[0011] According to another aspect of an embodiment of the present application, a management device for PCDN users is provided, comprising: an identification module, used to identify a suspected PCDN user from a plurality of users to be identified; a traction module, used to direct the traffic of the suspected PCDN user to a preset tunnel router, and obtain a feature value corresponding to the traffic of the suspected PCDN user, the feature value being used to represent the traffic feature of the user; a matching module, used to match the feature value corresponding to the traffic of the suspected PCDN user with a feature value in a preset PCDN user feature library using the preset tunnel router, wherein when the feature value corresponding to the traffic of the suspected PCDN user matches the feature value in the preset PCDN user feature library, the suspected PCDN user is confirmed to be a PCDN user; and a processing module, used to process the traffic of the PCDN user according to a predetermined processing strategy.

[0012] According to another aspect of the embodiment of the present application, there is also provided: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned PCDN user management method.

[0013] According to another aspect of the embodiments of the present application, a computer program product is provided, including: computer instructions, where the computer instructions are executed by a processor to implement the above-mentioned PCDN user management method.

[0014] In the embodiment of the present application, a suspected PCDN user is identified from a plurality of users to be identified; the traffic of the suspected PCDN user is directed to a preset tunnel router, and a characteristic value corresponding to the traffic of the suspected PCDN user is obtained, where the characteristic value is used to represent the traffic characteristics of the user; the characteristic value corresponding to the traffic of the suspected PCDN user is matched with the characteristic value in a preset PCDN user characteristic library by the preset tunnel router, wherein the suspected PCDN user is confirmed to be a PCDN user when the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library; the traffic of the PCDN user is processed according to a predetermined processing strategy, by directing the suspected PCDN user to a preset tunnel router for identification, and processing the traffic of the PCDN user by a predetermined processing strategy, thereby achieving the purpose of automatic feedback in the identification and disposal of the PCDN, thereby solving the technical problem of low efficiency of PCDN disposal due to manual identification and disposal. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0016] Figure 1 It is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for risk data identification provided in an embodiment of the present application;

[0017] Figure 2 is a schematic diagram of a PCDN user management method process according to an embodiment of the present application;

[0018] Figure 3 It is a schematic diagram of a prevention and control method process based on tunnel PCDN according to an embodiment of the present application;

[0019] Figure 4 It is a schematic diagram of a process of outputting a user characteristic value when a fault reporting user and a tunnel router belong to the same AS number according to an embodiment of the present application;

[0020] Figure 5 It is a schematic diagram of a process of outputting a user characteristic value when a fault reporting user and a tunnel router do not belong to the same AS number according to an embodiment of the present application;

[0021] Figure 6 It is a schematic diagram of a NAT4 construction process according to an embodiment of the present application;

[0022] Figure 7 is a schematic diagram of a feature value processing flow according to an embodiment of the present application;

[0023] Figure 8 It is a structural diagram of a PCDN user management device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In order to facilitate those skilled in the art to better understand the embodiments of the present application, some technical terms or nouns involved in the embodiments of the present application are explained as follows:

[0027] VPDN: VPDN stands for Virtual Private Dialup Networks, which refers to accessing the Internet through dial-up access. By packaging and encrypting network data, private data is transmitted on the public network to achieve the security level of a private network, thereby using the architecture of the Public Switched Telephone Network (PSTN) to build a private network for enterprises and institutions.

[0028] PCDN: (Partial Content Delivery Network) is a technology used to accelerate network transmission by distributing content to multiple edge nodes.

[0029] NAT4: Symmetric NAT, symmetric NAT, symmetric NAT has the restricted characteristics of port restricted cone, each time the internal address requests a specific external address, it may be bound to a new port number. That is, the port numbers mapped to different external addresses may be different.

[0030] With the development of tunnels, building an internal Layer 2 tunnel based on the WAN has become a popular means of implementing business construction across the WAN. In this way, we can divert the identified PCDN users from the tunnel for centralized processing, and use NAT4 technology to automatically issue policies to achieve a complete automatic information chain from discovery to disposal, and from disposal to evaluation, greatly improving the disposal efficiency of PCDN.

[0031] The PCDN user management method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a method for managing PCDN users. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0032] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to a method for managing a PCDN user in an embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned method for managing a PCDN user. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0036] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0037] In the above operating environment, an embodiment of the present application provides an embodiment of a method for managing PCDN users. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] Figure 2 is a flow chart of a method for managing PCDN users according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0039] Step S202, identifying suspected PCDN users from a plurality of users to be identified;

[0040] In step S202, there are multiple ways to identify suspected partial content distribution network PCDN users from multiple users to be identified. One optional way is to determine users whose weekly upward peak value is much larger than the weekly downward peak value among the multiple users to be identified as suspected PCDN users.

[0041] It can be understood that far greater than means that the difference between the weekly upward peak and the weekly downward peak is greater than the preset threshold, and week is a preset period, which can be set according to the actual scenario, for example: one week.

[0042] It should be noted that the IP addresses and MAC addresses of suspected PCDN users can be collected through the fixed network AAA system.

[0043] Step S204, directing the traffic of the suspected PCDN user to a preset tunnel router, and obtaining a characteristic value corresponding to the traffic of the suspected PCDN user, where the characteristic value is used to represent the traffic characteristics of the user;

[0044] Step S206, using a preset tunnel router to match the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library, wherein, when the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library, the suspected PCDN user is confirmed to be a PCDN user.

[0045] In step S206, if the feature value in the preset PCDN user feature library is matched, the PCDN processing queue is directly entered for PCDN processing. If the feature value in the preset PCDN user feature library is not matched, the PCDN suspected processing queue is entered for PCDN processing plus PCDN feature recognition.

[0046] Through the above steps, suspected PCDN users are directed to the preset tunnel router for identification, and the traffic of PCDN users is processed using a predetermined processing strategy, thereby achieving the purpose of automatic feedback in the identification and disposal of PCDN, thereby solving the technical problem of low efficiency of PCDN disposal due to manual identification and disposal.

[0047] The following further introduces the PCDN user management method in steps S202 to S206 of the embodiment of the present application.

[0048] In step S204, the specific steps of pulling the traffic of the suspected PCDN user to the preset tunnel router include: kicking the suspected PCDN user offline; when the suspected PCDN user re-accesses, performing VPDN authentication on the suspected PCDN user to establish a tunnel between the suspected PCDN user and the tunnel router; and obtaining traffic data of the suspected PCDN user through the tunnel.

[0049] In an optional method, the user is kicked offline, and when the user dials in again, VPN authentication is started, and the user dials in to form an L2TP tunnel and enter the tunnel router. At this time, the tunnel router captures the upstream and downstream traffic based on the user IP address transmitted by the fixed network AAA, including the IPv4 address, and the user recovers to the network state when suspected PCDN.

[0050] In another alternative, such as Figure 3 , Figure 4 and Figure 5As shown, the user's real-time IP address and MAC address are collected through the fixed network AAA authentication system. The tunnel is started to attract users. A tunnel router is constructed, and a centralized PCDN processing point is set up. The PCDN processing point builds a tunnel router. The server has the LNS termination function, NAT proxy, port mirroring and packet capture functions, BGP establishment functions, etc. It is used for user tunnel access, address allocation, IP publishing, traffic traction, mirroring and packet capture analysis, and NAT4 construction. When the suspected user and the tunnel router belong to the same AS (Autonomous System) number, when the user reports an obstacle, the user's dialing method is modified first, and a Layer 2 tunnel from the user's upstream MSE to the tunnel router is constructed. The tunnel router allocates according to the user's original IP information. At the same time, the tunnel router publishes detailed routes and attracts user traffic with the upstream CR (Core Router) where it is located. The tunnel router also imports traffic to the planned mirror port, which is connected to the log server. The log server unpacks the traffic and adds the user's label to the database. When the user reporting the fault and the tunnel router do not belong to the same AS number, and the user still reports the fault, the user's dialing method is modified, and a Layer 2 tunnel is built from the user's upstream MSE to the tunnel router. The tunnel router allocates the traffic based on the user's original IP information. At the same time, the tunnel router publishes detailed routes, and the CR and the user's CR establish a Layer 3 tunnel such as a GRE channel. The user's CR measures the route to enter the tunnel, and the user's Internet traffic is pulled to the remote. The log server and the remote workstation are interconnected to provide output for the remote workstation to call the user's packet capture information. The remote workstation performs embedded packet capture analysis based on user information, desensitizes some user information, and provides integrated analysis tools for user faults to output user feature values.

[0051] In step S206, the specific process of comparing the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library is as follows: obtaining the characteristic value corresponding to the traffic of the suspected PCDN user, the characteristic value corresponding to the traffic of the suspected PCDN user includes at least one of the following: the MAC address device type of the suspected PCDN user, the destination address of the suspected PCDN user, the divergence degree from the source address to the destination address of the suspected PCDN user, and the destination address ratio of the uplink traffic of the suspected PCDN user; evaluating the similarity between the characteristic value corresponding to the traffic of the suspected PCDN user and the characteristic value in the preset PCDN user characteristic library, and when the similarity is higher than a first threshold, determining that the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library.

[0052] Specifically, a BGP relationship is established between the tunnel router and the upper-level router, and a 32-bit v4 host route is sent to the neighbor based on the IPv4 of the suspected PCDN user to form a route traction within the network. Then, the mirror of the upstream port is used to capture packets of a single user to the observation port. PCDN feature comparison is performed, including but not limited to: MAC address device type, destination address matching, and divergence from source address to destination address, and the proportion of destination addresses in upstream traffic, etc., to identify suspected PCDN users.

[0053] When the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the historical PCDN user characteristic library, the suspected PCDN user is confirmed to be a PCDN user. In the process of matching the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library, the PCDN needs to be identified and the characteristic value captured, as follows:

[0054] In the embodiment of the present application, multiple methods are used to capture feature values ​​of the suspected PCDN user, wherein the multiple methods at least include: obtaining a divergence score of the suspected PCDN user, obtaining a server to which the suspected PCDN user belongs, and classifying the protocol of the suspected PCDN user;

[0055] Specifically, Figure 6 As shown in the figure, PCDN users enter the packet capture analysis through traction. The traction process is as above. For the captured packets, the source address, destination address, traffic, and source MAC are constructed into a two-dimensional table. The analysis is formed with a preset time period. The divergence from the user as the source to the external service as the destination is calculated by the above two-dimensional table. The following is a complex algorithm formula:

[0056]

[0057] Where D is the divergence score, I is the number of different destination addresses, A(i) is the traffic score of the i-th destination address (between 0 and 1), S(i) is the repetition score of the i-th destination address (a measure of the repetition of the destination address, between 0 and 1), P(i) is the next cycle score of the i-th destination address (an assessment of the possible impact in the future, between 0 and 1), E(i) is the scalability score of the i-th destination address (the ability to derive other addresses, between 0 and 1), and α, β, γ, and δ are weight coefficients.

[0058] It should be noted that the traffic score is used to indicate the size of the traffic, the repetition score is used to indicate the probability of destination address duplication, the next cycle score is used to indicate the degree of influence of the destination address on the network traffic in the next cycle, and the destination address scalability score is used to indicate the possibility evaluation indicator that the behavior of the destination address will be extended to other destination addresses.

[0059] This formula evaluates the quality and divergence of the destination address through multiple dimensions and takes into account the impact of thinking time, but the specific weight coefficients and evaluation criteria need to be further determined and calibrated according to actual conditions and needs. In this way, the average divergence of each destination address is calculated.

[0060] The protocol distribution of suspected PCDN users can be determined in the following ways:

[0061] We construct a set of protocol data points P with the center coordinates of (cx, cy).

[0062] We define a distance metric formula to determine the distance between a data point and the center of the circle:

[0063]

[0064] Where p(p x , p y ) represents the protocol data point, and d represents the distance between the data point and the center of the circle.

[0065] In the case of inner circle radius r1 and outer circle radius r2 (r2>r1), when d is not greater than r1, the data point belongs to the inner circle cluster. When d is between r1 and r2, the data point belongs to the middle ring cluster. When d is greater than r2, the data point does not belong to these two clusters. Based on the above method, the protocols can be divided into three categories.

[0066] User class attribute classification: According to the device type of the user's MAC, the MAC of the suspected user can be classified into categories, such as large enterprises, network companies, small enterprises, individual users and multi-address users. It can be determined whether the suspected PCDN user is a PCDN user based on the user type.

[0067] In another optional method, a two-dimensional table is used to calculate the home server with the user terminal as the destination address and the external server as the source address, and the external server to the user terminal is used as the destination traffic and multiple servers with the largest traffic and the most repetitions are determined as the servers to which the suspected PCDN user belongs based on the traffic size and the number of repetitions.

[0068] The traffic of the PCDN user is processed according to a predetermined processing strategy, including: issuing a preset domain name to the PCDN user, where the preset domain name is used to direct the traffic of the PCDN user to a preset environment; and performing traffic restriction processing on each session of the PCDN user in the preset environment.

[0069] After processing the traffic of the PCDN user according to a predetermined processing strategy, if the amount of reduction in the uplink traffic of the PCDN user is greater than a preset amount threshold, it is determined that the PCDN user is effectively controlled, and the destination link that disappears after the traffic of the PCDN user is processed is marked; if the uplink traffic of the PCDN user is not reduced, it is determined that the PCDN user is marked as an observation period user; if the uplink traffic of the observation period user does not decrease, it is determined that the observation period user is a whitelist user, and the feature of the whitelist user is determined as a whitelist feature. All feature values ​​of the PCDN user are added to the preset PCDN user feature library to obtain an adjusted feature library; for unmatched features in all feature values ​​that do not match the features in the preset PCDN user feature library, the feature weight is continuously increased until the feature weight is higher than a first weight threshold, and the unmatched feature is deleted from the adjusted feature library; the whitelist feature is added to the whitelist feature library, and the weight of the whitelist feature in the whitelist feature library is continuously increased until the weight of the whitelist feature is higher than a second weight threshold, and the whitelist feature is removed from the whitelist feature library. In the embodiment of the present application, a preset domain name is issued to a PCDN user, and the preset domain name is used to direct the traffic of the PCDN user to a preset environment; in the preset environment, traffic restriction processing is performed on each session of the PCDN user. When the amount of reduction in the uplink traffic of the PCDN user is greater than the preset amount threshold, it is determined that the PCDN user is effectively controlled, and the destination link that disappears after the traffic processing of the PCDN user is marked; when the uplink traffic of the PCDN user is not reduced, it is determined that the PCDN user marks the PCDN user as an observation period user; when the uplink traffic of the observation period user does not decrease, it is determined that the observation period user is a whitelist user, and the characteristics of the whitelist user are determined as whitelist characteristics.

[0070] Specifically, the characteristic values ​​of PCDN users are captured, and the characteristic values ​​of PCDN users are compared with historical characteristic values. When the characteristic values ​​of the whitelist are matched, they are immediately pulled out to restore user use; when the historical characteristic values ​​are matched, NAT4 is constructed for disposal. If the traffic decreases, it is an effective disposal, and the life cycle of the matched historical characteristic values ​​is reset, and other characteristic values ​​are added. If the disposal is invalid, this characteristic value is marked as NAT cannot be disposed, and further manual intervention is performed; when no disposal is matched, it enters the suspected PCDN disposal. Constructing NAT4 is symmetric NAT. Symmetric NAT maps all requests from the same intranet address and port to the same destination address and port to the same public network address and port. If the same intranet host uses the same intranet address and port to send a message to another destination address, a different mapping will be used. This is different from port-restricted NAT. Port-restricted NAT maps all requests to the same public network IP address and port, while symmetric NAT has different mappings for different requests.

[0071] This application scheme provides a tunnel PCDN-based prevention and control method, such as Figure 7 As shown, suspected PCDN users are found, identified, and feature values ​​are matched. If matched, they are determined to be PCDN users, processed, and feature values ​​of PCDN users are managed throughout their life cycle. Unmatched suspected PCDN users are processed using the NAT4 strategy, and feature values ​​of suspected PCDN users are evaluated. This is designed to improve the efficiency of automatic handling in PCDN. When fixed network AAA identifies PCDN users, automatic traction is implemented, and NAT4 strategy is deployed on one MSE. This forms an automatic control method for the entire process from discovery to traction, from traction to disposal, from disposal to feedback, and flexible restoration of users.

[0072] According to an embodiment of the present application, an embodiment of a PCDN user management device is also provided. Figure 8 Schematic diagram of a PCDN user management device provided according to an embodiment of the present application. Figure 8 As shown, the device comprises:

[0073] An identification module 80, configured to identify suspected PCDN users from a plurality of users to be identified;

[0074] A traction module 82 is used to guide the traffic of the suspected PCDN user to a preset tunnel router, and obtain a characteristic value corresponding to the traffic of the suspected PCDN user, where the characteristic value is used to represent the traffic characteristics of the user;

[0075] A matching module 84 is used to match the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library by using the preset tunnel router, wherein, when the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library, the suspected PCDN user is confirmed to be a PCDN user;

[0076] The processing module 86 is used to process the traffic of the PCDN user according to a predetermined processing strategy.

[0077] The traction module 82 includes: a traction submodule, which is used to kick the suspected PCDN user offline; when the suspected PCDN user reconnects, perform VPDN authentication on the suspected PCDN user to establish a tunnel between the suspected PCDN user and the tunnel router; and obtain traffic data of the suspected PCDN user through the tunnel.

[0078] The matching module 84 includes: a comparison submodule for comparing a characteristic value corresponding to the traffic of the suspected PCDN user with a characteristic value in a preset PCDN user characteristic library to obtain a characteristic value corresponding to the traffic of the suspected PCDN user, wherein the characteristic value corresponding to the traffic of the suspected PCDN user includes at least one of the following: a MAC address device type of the suspected PCDN user, a destination address of the suspected PCDN user, a divergence degree from a source address to a destination address of the suspected PCDN user, and a proportion of destination addresses of uplink traffic of the suspected PCDN user; and evaluating a similarity between the characteristic value corresponding to the traffic of the suspected PCDN user and the characteristic value in the preset PCDN user characteristic library, and determining, when the similarity is higher than a first threshold, that the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library.

[0079] The comparison submodule includes: a first processing unit, configured to compare the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library; and further includes: capturing the characteristic value of the suspected PCDN user in a plurality of ways, wherein the plurality of ways at least include: obtaining the divergence score of the suspected PCDN user, obtaining the server to which the suspected PCDN user belongs, and classifying the protocol of the suspected PCDN user; comparing the captured characteristic value with the historical characteristic value of the PCDN user, and processing the traffic of the suspected PCDN user according to a predetermined processing strategy when the historical characteristic value is matched.

[0080] The processing module 86 includes: a second processing unit, which is used to send a preset domain name to the PCDN user, and the preset domain name is used to direct the traffic of the PCDN user to a preset environment; in the preset environment, traffic restriction processing is performed on each session of the PCDN user. In the case where the amount of reduction in the uplink traffic of the PCDN user is greater than the preset amount threshold, it is determined that the PCDN user is effectively controlled, and the destination link that disappears after the traffic processing of the PCDN user is marked; in the case where the uplink traffic of the PCDN user is not reduced, it is determined that the PCDN user marks the PCDN user as an observation period user; in the case where the uplink traffic of the observation period user does not decrease, it is determined that the observation period user is a whitelist user, and the characteristics of the whitelist user are determined as whitelist characteristics. All feature values ​​of the PCDN user are added to the preset PCDN user feature library to obtain an adjusted feature library; for unmatched features in all feature values ​​that do not match features in the preset PCDN user feature library, feature weights are continuously increased until the feature weight is higher than a first weight threshold, and then the unmatched features are deleted from the adjusted feature library; whitelist features are added to the whitelist feature library, and the weights of the whitelist features in the whitelist feature library are continuously increased until the weights of the whitelist features are higher than a second weight threshold, and then the whitelist features are removed from the whitelist feature library.

[0081] It can be understood that the whitelist feature is used to indicate that the user has the feature of not being a PCDN user.

[0082] It should be noted that each module in the above-mentioned PCDN user management device can be a program module (for example, a set of program instructions that implement a certain specific function) or a hardware module. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0083] It should be noted that the PCDN user management device provided in this embodiment can be used to execute Figure 2 A management method for a PCDN user is shown. Therefore, the relevant explanations and descriptions of the above-mentioned management method for PCDN users are also applicable to the embodiments of the present application and will not be repeated here.

[0084] The embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the PCDN user management method in each embodiment of the present application: identifying a suspected partial content distribution network PCDN user from a plurality of users to be identified; directing the traffic of the suspected PCDN user to a preset tunnel router, and obtaining a feature value corresponding to the traffic of the suspected PCDN user, the feature value being used to represent the traffic characteristics of the user; using the preset tunnel router to match the feature value corresponding to the traffic of the suspected PCDN user with the feature value in a preset PCDN user feature library, wherein, when the feature value corresponding to the traffic of the suspected PCDN user matches the feature value in the historical PCDN user feature library, the suspected PCDN user is confirmed to be a PCDN user; and processing the traffic of the PCDN user according to a predetermined processing strategy.

[0085] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0086] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0087] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0088] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0089] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0090] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0091] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for managing PCDN users, characterized in that: include: Identify a suspected PCDN user from multiple users to be identified; Directing the traffic of the suspected PCDN user to a preset tunnel router, and obtaining a characteristic value corresponding to the traffic of the suspected PCDN user, wherein the characteristic value is used to represent the traffic characteristics of the user; Using the preset tunnel router, matching the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in the preset PCDN user characteristic library, wherein, when the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library, confirming that the suspected PCDN user is a PCDN user; The traffic of the PCDN user is processed according to a predetermined processing strategy.

2. The method according to claim 1, characterized in that The traffic of the suspected PCDN user is directed to a preset tunnel router, including: Kick the suspected PCDN user offline; When the suspected PCDN user re-accesses, performing VPDN authentication on the suspected PCDN user to establish a tunnel between the suspected PCDN user and the tunnel router; The traffic data of the suspected PCDN user is obtained through the tunnel.

3. The method according to claim 1, characterized in that Comparing the characteristic value corresponding to the traffic of the suspected PCDN user with the characteristic value in a preset PCDN user characteristic library includes: Acquire a characteristic value corresponding to the traffic of the suspected PCDN user, where the characteristic value corresponding to the traffic of the suspected PCDN user includes at least one of the following: a MAC address device type of the suspected PCDN user, a destination address of the suspected PCDN user, a divergence degree from a source address to a destination address of the suspected PCDN user, and a proportion of destination addresses of uplink traffic of the suspected PCDN user; Evaluate the similarity between the characteristic value corresponding to the traffic of the suspected PCDN user and the characteristic value in the preset PCDN user characteristic library, and when the similarity is higher than a first threshold, determine that the characteristic value corresponding to the traffic of the suspected PCDN user matches the characteristic value in the preset PCDN user characteristic library.

4. The method according to claim 3, characterized in that Processing the traffic of the PCDN user according to a predetermined processing strategy includes: Sending a preset domain name to the PCDN user, where the preset domain name is used to direct the traffic of the PCDN user to a preset environment; In the preset environment, flow restriction processing is performed on each session of the PCDN user.

5. The method according to claim 4, characterized in that After processing the traffic of the PCDN user according to a predetermined processing strategy, the method further includes: When the amount of reduction in the uplink traffic of the PCDN user is greater than a preset amount threshold, determining that the PCDN user is effectively controlled, and marking a destination link that disappears after the traffic of the PCDN user is processed; In a case where the uplink traffic of the PCDN user does not decrease, determining the PCDN user and marking the PCDN user as an observation period user; In a case where the uplink traffic of the user in the observation period does not decrease, the user in the observation period is determined to be a whitelist user, and the feature of the whitelist user is determined as a whitelist feature.

6. The method according to claim 5, characterized in that After processing the traffic of the PCDN user according to a predetermined processing strategy, the method further includes: Adding all feature values ​​of the PCDN user to the preset PCDN user feature library to obtain an adjusted feature library; For unmatched features among all feature values ​​that do not match features in the preset PCDN user feature library, continuously increase feature weights until the feature weights are higher than a first weight threshold, and then delete the unmatched features from the adjusted feature library; The whitelist feature is added to a whitelist feature library, and the weight of the whitelist feature in the whitelist feature library is continuously increased until the weight of the whitelist feature is higher than a second weight threshold, and then the whitelist feature is removed from the whitelist feature library.

7. The method according to claim 3, characterized in that The method further comprises: Capturing feature values ​​of the suspected PCDN user in a variety of ways, wherein the various ways at least include: acquiring a divergence score of the suspected PCDN user, acquiring a server to which the suspected PCDN user belongs, and classifying protocols of the suspected PCDN user; The captured feature value is compared with the historical feature value of the PCDN user. When the historical feature value matches, the traffic of the suspected PCDN user is processed according to a predetermined processing strategy.

8. A PCDN user management device, characterized in that: An identification module, used to identify a suspected PCDN user from multiple users to be identified; A traction module, used to guide the traffic of the suspected PCDN user to a preset tunnel router, and obtain a characteristic value corresponding to the traffic of the suspected PCDN user, wherein the characteristic value is used to represent the traffic characteristics of the user; a matching module, configured to match, by using the preset tunnel router, a feature value corresponding to the traffic of the suspected PCDN user with a feature value in a preset PCDN user feature library, wherein, when the feature value corresponding to the traffic of the suspected PCDN user matches the feature value in the preset PCDN user feature library, confirming that the suspected PCDN user is a PCDN user; The processing module is used to process the traffic of the PCDN user according to a predetermined processing strategy.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory, and is used to execute the PCDN user management method according to any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the PCDN user management method according to any one of claims 1 to 7 is implemented.

Images