Analysis method of IDC bearer application

Abstract

The invention discloses an analysis method for an IDC bearer application. The method comprises the following steps: constructing a mapping relation between an IDC-CR equipment interface and an IDC machine room according to an interface address and an interface descriptor of IDC-CR equipment; analyzing the Flow flow of a lower interface of the IDC-CR equipment, and determining an address space under the interface of the IDC-CR equipment and an AS number associated with the address; performing correlation analysis on the interface address space of the IDC-CR equipment and the IDC address reported by the client to determine the address space of the client in the IDC machine room; and determining the application carried by the client address space according to the application associated with the response address in the DNS log, thereby determining the application carried by the IDC machine room. According to the method, the application information of the IDC machine room is dynamically analyzed in combination with the client address information, the Flow flow and the DNS log, so that the analysis accuracy of the application carried by the IDC machine room is improved, and the uncertainty caused by the dynamic change of the application is avoided.

Description

Technical Field

[0001] The present invention relates to the field of IDC bearer application analysis, and in particular to an IDC bearer application analysis method. Background Art

[0002] IDC high-bandwidth customers rent the cabinets and bandwidth of the operator's IDC to complete the construction of the CDN network. Through the traffic scheduling strategy in the CDN network, traffic can be scheduled nationwide. Since the IDC address information reported by each customer is incomplete, it is impossible to accurately locate the application to each IDC computer room; in addition, through CNAME technology, each IDC address can carry multiple applications; and the customer's own address access method is more flexible; given the flexible and changeable use of IDC addresses, it is very difficult to judge the application information carried by IDC. Existing technologies generally report applications through manufacturers or through IDCISP for application analysis, but the data of IDCISP is massive, which brings great difficulties to application analysis and increases the cost of application analysis. Summary of the invention

[0003] In order to solve the above problems existing in the prior art, the present invention provides an analysis method for IDC-borne applications, which dynamically analyzes and determines the application information of the IDC computer room according to customer address information and the Flow traffic of the IDC edge device, thereby improving the accuracy of the IDC computer room application analysis and avoiding the uncertainty caused by dynamic changes in applications.

[0004] To achieve the above purpose, the present invention adopts the following technical solutions:

[0005] In one embodiment of the present invention, a method for analyzing an IDC bearer application is proposed, the method comprising:

[0006] Construct a mapping relationship between the IDC-CR device interface and the IDC room based on the interface address and interface descriptor of the IDC-CR device;

[0007] Analyze the flow of the downstream interface of the IDC-CR device to determine the address space of the interface of the IDC-CR device and the AS number associated with the address;

[0008] Correlate and analyze the interface address space of the IDC-CR device and the IDC address reported by the customer to determine the customer's address space in the IDC room;

[0009] Based on the application associated with the response address in the DNS log, determine the application carried by the customer address space, and thus determine the application carried by the IDC computer room.

[0010] Furthermore, the subnet where the interface addresses of the IDC-CR device and the IDC computer room device are located is calculated. If the subnets are the same, it is considered that the IDC-CR device is interconnected with the IDC computer room. If there is more than one IDC computer room interconnected with the IDC-CR device, the IDC computer room to which the IDC-CR device interface is connected is determined through the interface descriptor of the IDC-CR device.

[0011] Furthermore, a signature of the IDC room name is constructed according to the province, city and IDC room name, and the IDC room to which the IDC-CR device interface is connected is determined by analyzing the similarity between the interface descriptor of the IDC-CR device and the signature of the IDC room name.

[0012] Furthermore, the incoming flow of the downstream interface of the IDC-CR device is collected, and the source address and source AS of the flow are aggregated to obtain the address space under the interface of the IDC-CR device and the AS associated with the address; if the IDC-CR device has no AS set, the AS is obtained through BGP routing calculation, thereby determining the address space under the interface of the IDC-CR device and the AS associated with the address.

[0013] Furthermore, the address space under the IDC-CR device interface is analyzed to determine the ownership of the address under the IDC-CR device interface; if the AS associated with the address under the IDC-CR device interface is the customer AS, the address is considered to be the customer BGP address; the remaining addresses under the IDC-CR device interface are intersected with the IDC address reported by the customer to determine the customer to which the address under the IDC-CR device interface belongs, thereby determining the address space of the IDC computer room connected to the IDC-CR device interface and the address space of the customer in the IDC computer room.

[0014] Furthermore, if the address under the IDC-CR device interface has no owner, the address under the IDC-CR device interface is determined to belong to the customer based on the CNAME of the DNS response; if the DNS response address has no associated CNAME, the address under the IDC-CR device interface is determined to belong to the customer based on the application associated with the DNS response address.

[0015] Furthermore, by analyzing the DNS log, the IDC-CR device is determined according to the city where the DNS response address is located; the application of the DNS response address and the address space under the IDC-CR device interface are correlated and analyzed to determine the application carried by the IDC computer room connected to the address under the IDC-CR device interface.

[0016] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned IDC bearer application analysis method is designed.

[0017] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing the analysis method of the IDC-bearing application.

[0018] Beneficial effects:

[0019] The present invention combines customer address information, Flow traffic and DNS logs to dynamically analyze application information of the IDC computer room, thereby improving the accuracy of the analysis of applications carried by the IDC computer room and avoiding the uncertainty caused by dynamic changes in applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a schematic flow chart of an analysis method for IDC bearer application of the present invention;

[0021] Figure 2 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0022] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and design the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0023] Those skilled in the art will appreciate that the embodiments of the present invention may be designed as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be specifically designed in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0024] According to an implementation manner of the present invention, a method for analyzing IDC-borne applications is proposed, which constructs a mapping relationship between the IDC-CR device interface and the IDC computer room according to the interface address and interface descriptor of the IDC-CR device; analyzes the flow of the downstream interface of the IDC-CR device to determine the address space under the IDC-CR device interface and the AS number associated with the address; associates and analyzes the interface address space of the IDC-CR device with the IDC address reported by the customer to determine the address space of the customer in the IDC computer room; determines the application carried by the customer address space according to the application associated with the response address in the DNS log, thereby determining the application carried by the IDC computer room.

[0025] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0026] Figure 1 FIG. 1 is a flow chart of the analysis method of the IDC bearer application of the present invention. Figure 1 As shown, the method includes:

[0027] S1. Construct a mapping relationship between the IDC-CR device interface and the IDC room according to the interface address and interface descriptor of the IDC-CR device;

[0028] Calculate the subnet where the interface addresses of the IDC-CR device and the IDC room device are located. If the subnets are the same, it is considered that the IDC-CR device and the IDC room are interconnected. If there is more than one IDC room interconnected with the IDC-CR device, determine the IDC room to which the IDC-CR device interface is connected through the interface descriptor of the IDC-CR device.

[0029] The signature of the IDC computer room name is constructed according to the province, city and IDC computer room name. The IDC computer room to which the IDC-CR device interface is connected is determined by analyzing the similarity between the interface descriptor of the IDC-CR device and the signature of the IDC computer room name.

[0030] Specifically, all IDC-CR devices and IDC computer rooms are grouped according to cities and prefectures, and the subnet of the IDC-CR device interface is determined by calculating the interface address and interface mask of the IDC-CR device; then the interface subnet of the IDC computer room is calculated, and if the subnets are the same, it is considered that the interface of the IDC-CR device is connected to the IDC computer room with the same subnet; if multiple IDC computer rooms are connected to the interface of the IDC-CR device, the connected IDC computer room is uniquely determined according to the interface descriptor of the IDC-CR device.

[0031] S2. Analyze the flow of the downstream interface of the IDC-CR device to determine the address space under the interface of the IDC-CR device and the AS number associated with the address;

[0032] Collect the incoming flow traffic of the downstream interface of the IDC-CR device. The flow traffic contains information such as the source address, destination address, and source AS. Aggregate the source address and source AS of the flow to obtain the address space under the interface of the IDC-CR device and the AS associated with the address. If the IDC-CR device does not have an AS set, obtain the AS through BGP routing calculation, thereby determining the address space under the interface of the IDC-CR device and the AS associated with the address.

[0033] S3. Correlate and analyze the interface address space of the IDC-CR device and the IDC address reported by the customer to determine the address space of the customer in the IDC room;

[0034] Analyze the address space under the IDC-CR device interface to determine the ownership of the address under the IDC-CR device interface; if the AS associated with the address under the IDC-CR device interface is the customer AS, the address is considered to be a customer BGP address, that is, the address belongs to the customer to which the AS belongs; perform an intersection calculation on the remaining addresses under the IDC-CR device interface and the IDC address reported by the customer to determine the customer to which the address under the IDC-CR device interface belongs, thereby determining the address space of the IDC room connected to the IDC-CR device interface and the customer's address space in the IDC room.

[0035] Address attribution includes the city, IDC room, and customer to which the address belongs.

[0036] If the address under the IDC-CR device interface has no owner, the address under the IDC-CR device interface is determined to belong to the customer based on the CNAME of the DNS response; if the DNS response address has no associated CNAME, the address under the IDC-CR device interface is determined to belong to the customer based on the application associated with the DNS response address.

[0037] S4. Determine the application carried by the customer address space based on the application associated with the response address in the DNS log, thereby determining the application carried by the IDC room;

[0038] By analyzing the DNS logs, the IDC-CR device can be identified based on the city where the DNS response address is located. The application of the DNS response address and the address space under the IDC-CR device interface can be correlated and analyzed to determine the application carried by the IDC computer room connected to the address under the IDC-CR device interface.

[0039] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0040] In order to explain the above-mentioned IDC bearer application analysis method more clearly, a specific embodiment is described below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0041] Example:

[0042] The implementation steps are as follows:

[0043] S1. Construct a mapping relationship between the IDC-CR device interface and the IDC room according to the interface address and interface descriptor of the IDC-CR device;

[0044] Calculate the subnet where the interface addresses of the IDC-CR device and the IDC room device are located. If the subnets are the same, it is considered that the IDC-CR device and the IDC room are interconnected. If there is more than one IDC room interconnected with the IDC-CR device, determine the IDC room to which the IDC-CR device interface is connected through the interface descriptor of the IDC-CR device.

[0045] The signature of the IDC computer room name is constructed according to the province, city and IDC computer room name. The IDC computer room to which the IDC-CR device interface is connected is determined by analyzing the similarity between the interface descriptor of the IDC-CR device and the signature of the IDC computer room name.

[0046] During specific implementation, the interface descriptor configurations of different provinces may be different, and the characteristic fields of the interface descriptor can be set according to the rules of each province.

[0047] Specifically, all IDC-CR devices and IDC computer rooms are grouped according to cities and prefectures, and the subnet of the IDC-CR device interface is determined by calculating the interface address and interface mask of the IDC-CR device; then the interface subnet of the IDC computer room is calculated, and if the subnets are the same, it is considered that the interface of the IDC-CR device is connected to the IDC computer room with the same subnet; if multiple IDC computer rooms are connected to the interface of the IDC-CR device, the connected IDC computer room is uniquely determined according to the interface descriptor of the IDC-CR device.

[0048] In specific implementation, IDC-CR (IDC-CR refers to the core router of IDC, which is connected to the backbone network and metropolitan area network through IDC-CR) devices in some cities are interconnected with multiple IDC computer rooms. Taking Hangzhou as an example, there are multiple IDC computer rooms, and each IDC computer room is generally connected to the backbone network through two IDC-CR devices.

[0049] S2. Analyze the flow of the downstream interface of the IDC-CR device to determine the address space under the interface of the IDC-CR device and the AS number associated with the address;

[0050] Collect the incoming flow traffic of the downstream interface of the IDC-CR device, aggregate the source address and source AS of the flow, and obtain the address space under the interface of the IDC-CR device and the AS associated with the address; if the IDC-CR device does not have an AS set, obtain the AS through BGP routing calculation, thereby determining the address space under the interface of the IDC-CR device and the AS associated with the address.

[0051] In specific implementation, the AS associated with the address under the IDC-CR device interface can be determined through BGP routing calculation. The address accessed by the customer through BGP generally carries the customer's AS, and the remaining addresses carry the operator's AS.

[0052] S3. Correlate and analyze the interface address space of the IDC-CR device and the IDC address reported by the customer to determine the address space of the customer in the IDC room;

[0053] Analyze the address space under the IDC-CR device interface to determine the ownership of the address under the IDC-CR device interface; if the AS associated with the address under the IDC-CR device interface is the customer AS, the address is considered to be a customer BGP address, that is, the address belongs to the customer to which the AS belongs; perform an intersection calculation on the remaining addresses under the IDC-CR device interface and the IDC address reported by the customer to determine the customer to which the address under the IDC-CR device interface belongs, thereby determining the address space of the IDC room connected to the IDC-CR device interface and the customer's address space in the IDC room.

[0054] Generally, IDC head customers have their own AS numbers and publish routes externally through AS.

[0055] Specifically, the address under the IDC-CR device interface refers to the address in the address space of the interface. The address space under the interface is composed of multiple addresses. Different addresses belong to different customers and carry different applications.

[0056] Address attribution includes the city, IDC room, and customer to which the address belongs.

[0057] If the address under the IDC-CR device interface has no owner, the address under the IDC-CR device interface is determined to belong to the customer based on the CNAME of the DNS response; if the DNS response address has no associated CNAME, the address under the IDC-CR device interface is determined to belong to the customer based on the application associated with the DNS response address.

[0058] In specific implementation, the address space under the IDC-CR device interface is changing and needs to be dynamically learned based on the flow. The accuracy of the statically reported address is uncertain.

[0059] S4. Determine the application carried by the customer address space based on the application associated with the response address in the DNS log, thereby determining the application carried by the IDC room;

[0060] By analyzing the DNS logs, the IDC-CR device can be identified based on the city where the DNS response address is located. The application of the DNS response address and the address space under the IDC-CR device interface can be correlated and analyzed to determine the application carried by the IDC computer room connected to the address under the IDC-CR device interface.

[0061] In the specific implementation, the DNS log is analyzed to build the mapping relationship between the province, the response address (DNS A record and AAAA record), the domain name and the CNAME. The customer associated with the address under the IDC-CR device interface is determined by analyzing the application associated with the root domain name and the manufacturer information corresponding to the root domain name corresponding to the CNAME. If the DNS response address does not have a CNAME, the customer associated with the application is considered to be an address-associated customer.

[0062] In specific implementation, the DNS response address determines the city to which it belongs based on the local route, thereby determining its corresponding IDC-CR device.

[0063] Specifically, the DNS response address is associated with the customer address space for analysis. If the DNS response address is uniquely associated with an IDC computer room, it is considered that the DNS response address belongs to the IDC computer room, and the application associated with the DNS response address belongs to the IDC computer room. If the DNS response address is associated with multiple IDC computer rooms, the IDC computer room to which the DNS response address belongs is determined based on the city or prefecture associated with the DNS response address. Furthermore, based on the existence time of the Flow, the IDC computer room to which it is associated is uniquely determined. This determines the application information carried by the IDC computer room.

[0064] Specifically, for the addresses of major customers, especially anycast addresses, the same address may be dialed from different IDCs. It is necessary to determine the city to which it belongs based on the DNS response address combined with the BGP route to determine the IDC room to which it belongs. For the customer's anycast address, it is necessary to determine the city to which the address belongs based on the DNS attribution. The DNS in different provinces may see different sources of anycast addresses.

[0065] Based on the above invention concept, Figure 2 As shown, the present invention also proposes a computer device 100, including a memory 110, a processor 120, and a computer program 130 stored in the memory 110 and executable on the processor 120. When the processor 120 executes the computer program 130, the aforementioned IDC bearer application analysis method is designed.

[0066] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned IDC-bearing application analysis method.

[0067] The analysis method of IDC-borne applications proposed in the present invention combines customer address information, Flow traffic and DNS logs to dynamically analyze application information of the IDC computer room, thereby improving the accuracy of the analysis of IDC-borne applications and avoiding the uncertainty caused by dynamic changes in applications.

[0068] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0069] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for analyzing IDC bearer applications, characterized in that: The method includes: Construct a mapping relationship between the IDC-CR device interface and the IDC room based on the interface address and interface descriptor of the IDC-CR device; Analyze the flow of the downstream interface of the IDC-CR device to determine the address space of the interface of the IDC-CR device and the AS number associated with the address; Correlate and analyze the interface address space of the IDC-CR device and the IDC address reported by the customer to determine the customer's address space in the IDC room; Based on the application associated with the response address in the DNS log, determine the application carried by the customer address space, and thus determine the application carried by the IDC computer room.

2. The method for analyzing IDC bearer applications according to claim 1, characterized in that: Calculate the subnet where the interface addresses of the IDC-CR device and the IDC room device are located. If the subnets are the same, it is considered that the IDC-CR device and the IDC room are interconnected. If there is more than one IDC room interconnected with the IDC-CR device, determine the IDC room to which the IDC-CR device interface is connected through the interface descriptor of the IDC-CR device.

3. The method for analyzing IDC bearer applications according to claim 2, characterized in that: The signature of the IDC computer room name is constructed according to the province, city and IDC computer room name. The IDC computer room to which the IDC-CR device interface is connected is determined by analyzing the similarity between the interface descriptor of the IDC-CR device and the signature of the IDC computer room name.

4. The method for analyzing IDC bearer applications according to claim 1, characterized in that: Collect the incoming flow traffic of the downstream interface of the IDC-CR device, aggregate the source address and source AS of the flow, and obtain the address space under the interface of the IDC-CR device and the AS associated with the address; if the IDC-CR device does not have an AS set, obtain the AS through BGP routing calculation, thereby determining the address space under the interface of the IDC-CR device and the AS associated with the address.

5. The method for analyzing IDC bearer applications according to claim 1, characterized in that: Analyze the address space under the IDC-CR device interface to determine the ownership of the address under the IDC-CR device interface; if the AS associated with the address under the IDC-CR device interface is the customer AS, the address is considered to be the customer BGP address; perform an intersection calculation on the remaining addresses under the IDC-CR device interface and the IDC address reported by the customer to determine the customer to which the address under the IDC-CR device interface belongs, thereby determining the address space of the IDC room connected to the IDC-CR device interface and the customer's address space in the IDC room.

6. The method for analyzing IDC bearer applications according to claim 5, characterized in that: If the address under the IDC-CR device interface has no owner, the address under the IDC-CR device interface is determined to belong to the customer based on the CNAME of the DNS response; if the DNS response address has no associated CNAME, the address under the IDC-CR device interface is determined to belong to the customer based on the application associated with the DNS response address.

7. The method for analyzing IDC bearer applications according to claim 1, characterized in that: By analyzing the DNS logs, the IDC-CR device can be identified based on the city where the DNS response address is located. The application of the DNS response address and the address space under the IDC-CR device interface can be correlated and analyzed to determine the application carried by the IDC computer room connected to the address under the IDC-CR device interface.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 7.

Images