QUIC protocol data restoring and processing method, device, medium and product

Abstract

The embodiment of the invention relates to the technical field of image processing, and discloses a QUIC protocol data restoring and processing method and device, a medium and a product. The method comprises the following steps: acquiring QUIC flow in a network in real time; carrying out deep analysis on the acquired QUIC flow, and restoring QUIC protocol data; performing feature extraction on the QUIC protocol data by using a pre-trained feature extraction model to obtain protocol features; and screening the protocol features according to a preset screening rule to obtain target protocol data meeting the preset screening rule. By adopting the scheme, the accuracy and efficiency of QUIC protocol analysis can be improved, the requirement of real-time feature extraction can be met, and network monitoring and management tasks can be better completed through an effective filtering and screening mechanism.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, device, medium and product for restoring and processing QUIC protocol data. Background Art

[0002] In recent years, with the rapid development of Internet technology, the QUIC protocol has been widely used in various network services due to its high efficiency and reliability. However, the encryption and encapsulation characteristics of the QUIC protocol make network monitoring and management complicated. At present, there are some analysis tools for the QUIC protocol on the market, but they are inefficient when processing large amounts of data, and have limited capabilities for restoring and extracting features of the protocol. Therefore, how to solve the problems of low processing efficiency, inaccurate feature extraction, and inability to effectively filter and screen in QUIC protocol analysis technology is an important issue of concern in this field.

[0003] Compared with the existing technology, this technology mainly solves the following problems: improving the accuracy and efficiency of QUIC protocol restoration, realizing real-time feature extraction, and providing an effective filtering mechanism to better support network monitoring and management tasks. Summary of the invention

[0004] One purpose of the present application is to provide a method, device, medium and product for restoring and processing QUIC protocol data, at least to solve the problems of low processing efficiency, inaccurate feature extraction and ineffective filtering and screening in QUIC protocol parsing. The present application collects QUIC traffic in the network in real time; performs in-depth analysis on the collected QUIC traffic to restore QUIC protocol data; uses a pre-trained feature extraction model to extract features from the QUIC protocol data to obtain protocol features; and filters the protocol features according to preset filtering rules to obtain target protocol data that meets the preset filtering rules. By adopting this solution, the accuracy and efficiency of QUIC protocol parsing can be improved to meet the needs of real-time feature extraction, and through an effective filtering and screening mechanism, network monitoring and management tasks can be better completed.

[0005] To achieve the above objectives, some embodiments of the present application provide the following aspects:

[0006] In a first aspect, some embodiments of the present application further provide a method for restoring and processing QUIC protocol data, including:

[0007] Collect QUIC traffic in the network in real time;

[0008] Performing in-depth analysis on the collected QUIC traffic to restore QUIC protocol data;

[0009] Extract features from the QUIC protocol data using a pre-trained feature extraction model to obtain protocol features;

[0010] The protocol features are screened according to preset screening rules to obtain target protocol data that meets the preset screening rules.

[0011] In a second aspect, some embodiments of the present application further provide an electronic device, comprising: one or more processors; and a memory storing computer program instructions, wherein the computer program instructions, when executed, cause the processor to perform the steps of the method described above.

[0012] In a third aspect, some embodiments of the present application further provide a computer-readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method as described above.

[0013] In a fourth aspect, some embodiments of the present application further provide a computer program product, comprising a computer program / instruction, which implements the steps of the method described above when executed by a processor.

[0014] Compared with the related art, the solution provided in the embodiment of the present application collects QUIC traffic in the network in real time; performs in-depth analysis on the collected QUIC traffic to restore QUIC protocol data; uses a pre-trained feature extraction model to extract features from the QUIC protocol data to obtain protocol features; and filters the protocol features according to preset filtering rules to obtain target protocol data that meets the preset filtering rules. By adopting this solution, the accuracy and efficiency of QUIC protocol analysis can be improved, the needs of real-time feature extraction can be met, and network monitoring and management tasks can be better completed through an effective filtering and screening mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0016] Figure 1 An exemplary flow chart of a method for restoring and processing QUIC protocol data according to some embodiments of the present application;

[0017] Figure 2 An exemplary flow chart of a training process of a feature extraction model provided according to some embodiments of the present application;

[0018] Figure 3An exemplary structural diagram of the electronic device is disclosed. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] First embodiment

[0021] The first embodiment of the present application relates to a method for restoring and processing QUIC protocol data. Figure 1 As shown, the method may include the following steps:

[0022] Step S101, collecting QUIC traffic in the network in real time;

[0023] QUIC (Quick UDP Internet Connections) traffic refers to network traffic transmitted based on the QUIC protocol. The QUIC protocol is built on top of UDP, avoiding processes such as TCP three-way handshake and slow start, thereby reducing the time to establish a connection and achieving lower latency. It also supports fast connection migration. When the user's network environment changes, such as switching from Wi-Fi to mobile data, QUIC can quickly restore the connection and reduce interruption time. QUIC allows multiple data streams to be transmitted simultaneously on the same connection, avoiding the head-of-line blocking problem in TCP. This means that even if a data stream is lost, other data streams will not be affected, thereby improving overall transmission efficiency. Multiplexing also allows servers to manage connections more efficiently and reduce resource consumption. QUIC encrypts at the transport layer, providing better security. It uses modern encryption algorithms and key exchange mechanisms to ensure that data is not stolen or tampered with during transmission. Encryption also makes it difficult for network intermediate devices (such as routers, firewalls, etc.) to perform deep packet inspection on QUIC traffic, increasing the privacy of network communications. The QUIC protocol is a flexible protocol that can be easily extended and customized. Developers can add new functions and features based on specific application requirements without affecting the existing protocol implementation. For example, QUIC performance can be optimized by adding new encryption algorithms, compression algorithms, or flow control mechanisms.

[0024] In this embodiment, optionally, real-time collection of QUIC traffic in the network includes:

[0025] Use Ethernet aggregation and splitter to collect QUIC traffic in the network in real time.

[0026] Ethernet aggregation and splitter is a network device that is mainly used to aggregate, split and monitor network traffic. It can be connected to key nodes in the network, such as switches and routers, to copy and distribute the network traffic passing through for real-time monitoring and analysis.

[0027] For the collection of QUIC traffic, Ethernet aggregation and splitter has the following advantages:

[0028] High performance: Able to handle high-speed network traffic, ensuring that important QUIC packets are not lost.

[0029] Real-time: QUIC traffic in the network can be collected in real time, providing timely data support for subsequent analysis and processing.

[0030] Flexibility: You can configure it as needed to collect traffic from specific network interfaces, IP address ranges, or protocol types.

[0031] The process of collecting QUIC traffic includes: connection deployment, connecting the Ethernet aggregation and tapping to the appropriate location in the network, and ensuring that the target QUIC traffic can be captured. Usually, you can choose to connect to the mirror port of the core switch or router to obtain all the network traffic passing through.

[0032] Configure the traffic diversion strategy, set the traffic diversion strategy of the Ethernet aggregation splitter according to the needs, and specify the characteristics of the QUIC traffic to be collected. For example, you can set the traffic diversion based on conditions such as IP address, port number, protocol type, etc.

[0033] Data Collection,Once the configuration is complete, the Ethernet aggregation and splitter begins to collect QUIC traffic that complies with the splitting policy in real time and copies it to the specified output port or storage device.

[0034] Data transmission,The collected QUIC traffic can be transmitted to the analysis device or storage system through the network connection for further processing and analysis.

[0035] In network performance monitoring, by collecting QUIC traffic in real time, the performance indicators of QUIC applications in the network can be monitored, such as latency, throughput, packet loss rate, etc. This helps network administrators to promptly discover and solve network performance problems and optimize network configuration.

[0036] In security analysis scenarios, real-time collection of QUIC traffic can provide an important data source for security analysis. Security analysts can detect potential security threats, such as malware propagation, network attacks, etc., and take corresponding protective measures.

[0037] In the application optimization scenario, for application developers who provide QUIC services, collecting QUIC traffic can help them understand user behavior and application performance, so as to optimize and improve them. For example, they can adjust server configuration and optimize protocol parameters based on traffic analysis results.

[0038] The benefit of this solution is that the Ethernet aggregation and splitter can be used to collect QUIC traffic in the network in real time, which can provide important data support for network management, security analysis and application optimization.

[0039] Step S102, deeply analyzing the collected QUIC traffic to restore QUIC protocol data;

[0040] In this solution, since QUIC traffic is encrypted data, deep parsing is required to restore QUIC protocol data. During the parsing process, you can use the currently mature tools, or you can develop a data specifically for QUIC traffic parsing based on the characteristics of QUIC protocol data.

[0041] In this embodiment, optionally, the collected QUIC traffic is deeply parsed to restore the QUIC protocol data, including:

[0042] Obtain basic characteristics of the QUIC protocol;

[0043] The DPI technology is combined with the characteristics of the QUIC protocol to perform in-depth analysis of the QUIC traffic and restore the QUIC protocol data.

[0044] This solution can use improved DPI technology, combined with the characteristics of the QUIC protocol, to deeply analyze the collected traffic and restore the complete protocol data.

[0045] Recovering the Quick UDP Internet Connections (QUIC) protocol using deep packet inspection (DPI) techniques is a challenging but important task.

[0046] The QUIC protocol is a multiplexed, low-latency transport protocol based on UDP. The QUIC protocol is encrypted at the transport layer, making it difficult for traditional identification methods based on port numbers and packet features to work. Multiple data streams can be transmitted simultaneously on the same QUIC connection, increasing the complexity of identification and restoration. As a result, DPI devices cannot directly read the contents of the data packet, making it difficult to determine the application type and user behavior. Multiplexing makes the correlation of data packets more complex, making it difficult to accurately restore a complete application session. The process of DPI technology restoring QUIC protocol data includes feature recognition. Although the QUIC protocol is encrypted, QUIC packets can still be identified by some external features. For example, the header of a QUIC packet may contain specific flags or version numbers, which can be used to preliminarily determine whether the packet is a QUIC protocol. In addition, the QUIC connection establishment process also has some specific packet exchange patterns, which can be further confirmed by identifying these patterns. Behavioral analysis, inferring whether it is a QUIC protocol by analyzing the behavioral patterns of network traffic. For example, QUIC connections usually have lower latency and higher throughput. The presence of a QUIC connection can be determined by monitoring indicators such as latency and throughput of network traffic. At the same time, the multiplexing characteristics of the QUIC protocol may cause multiple related packet flows in the network traffic. The correlation of the packet flows can be analyzed to infer whether it is the QUIC protocol. Protocol cracking, in some cases, can attempt to crack the QUIC protocol to obtain the content of the packet. This requires in-depth research on the encryption mechanism of the QUIC protocol and the use of corresponding cracking tools and techniques. In the network management scenario, for enterprises and organizations, using DPI technology to restore the QUIC protocol can help them better manage network traffic and ensure the performance and security of critical business applications. For example, QUIC traffic for non-critical applications can be identified and restricted to avoid network congestion. In the field of network security, restoring the QUIC protocol can help detect and prevent potential security threats. For example, malware or network attacks can be identified through the QUIC protocol, and corresponding protective measures can be taken in time. Under regulatory compliance requirements, for some industries that need to comply with regulations and regulatory requirements, such as finance, telecommunications, etc., restoring the QUIC protocol can help ensure that network communications comply with relevant regulations and standards.

[0047] This solution uses DPI technology to restore the QUIC protocol, which can help better manage and protect network communications.

[0048] Step S103, extracting features from the QUIC protocol data using a pre-trained feature extraction model to obtain protocol features;

[0049] In this solution, after obtaining the QUIC protocol data, feature extraction can be performed on the QUIC protocol data to obtain protocol features. Machine learning algorithms are used to extract features from the restored protocol data, including but not limited to connection features, transmission features, behavior features, etc., to provide a basis for subsequent analysis and screening.

[0050] In this embodiment, optionally, the protocol characteristics include at least one of connection characteristics, transmission characteristics and behavior characteristics.

[0051] Feature extraction of QUIC protocol data to obtain connection features, transmission features, and behavior features can provide valuable information for network management, security analysis, and performance optimization.

[0052] Connection characteristics can include:

[0053] Connection establishment time, which records the time it takes for a QUIC connection to be fully established from the beginning. A shorter connection establishment time generally means a better user experience and lower latency.

[0054] Connection duration, which indicates the survival time of a QUIC connection. Long connections may be related to specific application scenarios (such as video streaming), while short connections may be related to one-time requests (such as web page loading).

[0055] The connection initiator and responder IP addresses determine the two ends of the connection, which helps analyze the source and destination of network traffic and identify specific users or servers.

[0056] Connection port number, QUIC uses a custom port number or shares port numbers with other protocols. The port number can provide clues about the application type.

[0057] Encryption parameters, including the encryption algorithm used, key exchange method, etc. Encryption characteristics are crucial for security analysis and can help detect potential encryption vulnerabilities or malicious encryption behaviors.

[0058] Transmission characteristics may include:

[0059] Packet size distribution, analyzes the size range and distribution of QUIC packets. Different applications may generate packets of different sizes. For example, video streaming usually contains larger packets, while text communication may have smaller packets.

[0060] Transfer rate, which measures the speed at which data is transferred over a QUIC connection. A high transfer rate may indicate a large file download or HD video streaming, while a low transfer rate may be related to network congestion or small data exchange.

[0061] Packet loss rate measures the proportion of packets lost during QUIC transmission. A high packet loss rate can affect application performance and may be a sign of network problems or malicious attacks.

[0062] Retransmission count, records the number of retransmissions of QUIC packets. Frequent retransmissions may indicate network instability or attack behavior.

[0063] Traffic direction determines the direction in which data flows on the QUIC connection, whether it is unidirectional or bidirectional. This is helpful for understanding the communication patterns of applications and identifying specific network behaviors.

[0064] Behavioral characteristics can include

[0065] Request patterns, analyzing the type and frequency of requests in a QUIC connection. For example, frequent small requests may be related to web browsing, while large continuous requests may be related to file downloads or video playback.

[0066] Response time, which measures the time from sending a request to receiving a response. Short response times generally indicate efficient servers and good network performance, while long response times can indicate network congestion or high server load.

[0067] Concurrent connections, determine the number of concurrent QUIC connections associated with a specific IP address or user. High concurrent connections may be associated with certain malicious behaviors (such as distributed denial of service attacks) or specific high-concurrency applications.

[0068] Connection pattern changes, monitoring the changes in the characteristics of QUIC connections at different times, such as changes from short connections to long connections, or sudden changes in transmission rates. These changes may indicate changes in application behavior or changes in network conditions.

[0069] By extracting the connection characteristics, transmission characteristics, and behavior characteristics of QUIC protocol data, this solution can provide an analysis basis for network traffic and application behavior for network management, security analysis, and application development, helping to optimize network performance, improve security, and enhance user experience.

[0070] In this embodiment, optionally, the protocol features are screened according to preset screening rules to obtain target protocol data that meets the preset screening rules, including:

[0071] According to at least one of the connection characteristics, transmission characteristics and behavior characteristics, compared with preset screening rules, identify whether the QUIC protocol data is abnormal behavior data; wherein the abnormal behavior data is one or more of abnormal traffic peak value, abnormal data packet size distribution and abnormal connection disconnection.

[0072] This solution, for abnormal behavior detection, can identify abnormal behaviors that do not conform to normal patterns by analyzing connection characteristics, transmission characteristics, and behavior characteristics. Abnormal behaviors may include sudden traffic peaks, abnormal packet size distribution, frequent connection disconnections, etc., which may be signs of security attacks or network failures.

[0073] Through such a setting, this solution can set corresponding screening conditions for the features that need to be detected for abnormal behavior, and obtain QUIC protocol data that meets the abnormal behavior after screening, which can be provided to developers for in-depth analysis, so as to achieve the purpose of data screening for developers.

[0074] Step S104, screening the protocol features according to preset screening rules to obtain target protocol data that meets the preset screening rules.

[0075] The preset screening rule may be a rule for screening one feature dimension or a rule for screening multiple feature dimensions. The target protocol data may be obtained by screening out the QUIC protocol data that meets the preset screening rule.

[0076] In this embodiment, optionally, the protocol features are screened according to preset screening rules to obtain target protocol data that meets the preset screening rules, including:

[0077] According to at least one of the connection characteristics, transmission characteristics and behavior characteristics, it is compared with the preset screening rules to identify whether the QUIC protocol data is the data of interest.

[0078] The data of interest may be determined based on one of the connection characteristics, transmission characteristics, and behavior characteristics, or may be determined based on multiple characteristics. For example, the data of interest may include data whose connection establishment time is within a certain time range, or the data of interest may include QUIC protocol data whose connection duration is more than 60 seconds and whose data packet size is more than 1MB.

[0079] Through such a setting, this solution can determine the data of interest to the developer based on the characteristics of one or more feature dimensions, and after screening the data of interest, it can perform reasonable analysis to improve the data processing efficiency of the developer.

[0080] The solution provided in this embodiment collects QUIC traffic in the network in real time; performs in-depth analysis on the collected QUIC traffic to restore QUIC protocol data; uses a pre-trained feature extraction model to extract features from the QUIC protocol data to obtain protocol features; and filters the protocol features according to preset filtering rules to obtain target protocol data that meets the preset filtering rules. By adopting this solution, the accuracy and efficiency of QUIC protocol analysis can be improved, the needs of real-time feature extraction can be met, and network monitoring and management tasks can be better completed through an effective filtering and screening mechanism.

[0081] Second embodiment

[0082] The second embodiment of the present application relates to a method for restoring and processing QUIC protocol data. The above embodiment is specifically optimized as follows: the training process of the feature extraction model includes: obtaining a preset number of sample QUIC protocol data collected in advance; identifying sample features of the sample QUIC protocol data, and using the sample features as labels for sample annotation; inputting the sample QUIC protocol data with sample feature labels into the basic model, and performing supervised training on the basic model to obtain a model to be verified; using the test set data composed of the sample QUIC protocol data to verify the accuracy of the model to be verified, and when the accuracy meets the preset conditions, determining that the model to be verified has passed the verification to obtain a feature extraction model.

[0083] like Figure 2 As shown, the method may include the following steps:

[0084] Step S201, obtaining a preset number of sample QUIC protocol data collected in advance;

[0085] Among them, the preset number can be pre-collected, for example, 5000 or 10000 QUIC protocol data collected in advance, as sample QUIC protocol data.

[0086] Step S202, identifying sample features of the sample QUIC protocol data, and using the sample features as labels to mark the sample;

[0087] Here, the identification of sample features may be performed by manual identification or other identification means. The sample features may correspond to the features extracted by the subsequent feature extraction model, and reference may be made to the above embodiments.

[0088] The purpose of using sample features as labels for sample annotation is to obtain sample QUIC protocol data with annotated labels for use in subsequent model training.

[0089] Step S203, inputting the sample QUIC protocol data with the sample feature label into the basic model, performing supervised training on the basic model, and obtaining a model to be verified;

[0090] The basic model may have completed the setting of hyperparameters, while the parameters are to be gradually optimized during the training process. The sample QUIC protocol data with sample feature labels is input into the basic model, and the basic model is supervisedly trained to obtain a model to be verified.

[0091] Step S204, using the test set data consisting of sample QUIC protocol data to verify the accuracy of the model to be verified, and when the accuracy meets the preset conditions, determining that the model to be verified has passed the verification to obtain a feature extraction model.

[0092] After completing the training, a test data set can be constructed and used to verify the model to be verified. For example, the test data set may include 2000 QUIC protocol data that are different from the training samples. After using the model to be verified for feature extraction, it is found that the extracted features are completely matched with the features of the 2000 QUIC protocol data, or the accuracy rate is as high as 98% or more, then the test is determined to pass to obtain the feature extraction model.

[0093] Through such a setting, this solution can realize the rapid extraction of protocol features after restoring the QUIC protocol by combining machine learning algorithms; combined with an efficient filtering and screening mechanism, the restored protocol data can be screened according to preset rules or dynamic strategies to meet the needs of different application scenarios. It improves the accuracy and processing efficiency of QUIC protocol restoration, realizes real-time feature extraction, and provides a flexible and efficient filtering and screening mechanism, thereby effectively supporting the execution of network monitoring and management tasks.

[0094] In addition, some embodiments of the present application also provide an electronic device. The electronic device may be a digital computer in various forms, such as a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, etc. The electronic device may also be a mobile device in various forms, such as a personal digital processing, a cellular phone, a smart phone, a wearable device, and other similar computing devices.

[0095] The electronic device includes: one or more processors; and a memory storing computer program instructions, wherein when the computer program instructions are executed, the processor executes the steps of the method provided in any one or more of the above embodiments. Figure 3 An exemplary structural diagram of the electronic device is disclosed. Figure 3As shown, the electronic device includes: one or more processors 301, a memory 302, and an interface for connecting each component, including a high-speed interface and a low-speed interface. The various components are connected to each other using different buses and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some other embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Among them, the components shown in this article, their connections and relationships, and their functions are only used as examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0096] The electronic device may further include: an input device 303 and an output device 304. The processor 301, the memory 302, the input device 303 and the output device 304 may be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0097] The input device 303 can receive input digital or character information, and generate key signal input related to the user settings and function control of the electronic device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick and other input devices. The output device 304 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The display device may include, but is not limited to, a liquid crystal display (LCD), a light emitting diode (LED) display and a plasma display. In some embodiments, the display device may be a touch screen.

[0098] To provide interaction with a user, the electronic device may be a computer. The computer has: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the user can provide input to the computer. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0099] In the embodiments of the present application, a computer program / instruction is stored on a computer-readable medium, and when the computer program / instruction is executed by a processor, the steps of the method provided by any one or more of the above embodiments are implemented. The computer-readable medium may be included in the electronic device described in the above embodiments; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more computer-readable instructions.

[0100] The memory 302 can be used as a non-transient computer-readable storage medium, which can be used to store non-transient software programs, non-transient computer executable programs and modules. The processor 301 executes various functional applications and data processing of the server by running the non-transient software programs, instructions and modules stored in the memory 302, so as to implement the program instructions / modules corresponding to the method provided by any one or more of the above embodiments in the embodiments of the present application.

[0101] The memory 302 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 302 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage devices. In some embodiments, the memory 302 may optionally include a memory remotely arranged relative to the processor 301, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0102] It should be noted that the computer-readable medium described in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0103] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0104] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0105] In the above-described embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. For example, it can be implemented by using an application specific integrated circuit (ASIC), a general-purpose computer or any other similar hardware device. In certain embodiments, the software program of the present application can be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including relevant data structures) can be stored in a computer-readable recording medium, for example, a RAM memory, a magnetic or optical drive or a floppy disk and similar devices. In addition, some steps or functions of the present application can be implemented by hardware, for example, as a circuit that cooperates with a processor to perform each step or function.

[0106] The computer program product provided in the embodiment of the present application includes one or more computer programs / instructions, and when the computer program / instructions are executed by the processor, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0107] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0108] The scope of the present application is defined by the appended claims rather than the above description, and it is intended that all changes that fall within the meaning and scope of the equivalent elements of the claims are included in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim may also be implemented by one unit or device through software or hardware. The words "first", "second", etc. are only used to distinguish the description, and do not indicate any particular order, nor can they be understood as indicating or implying relative importance.

[0109] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily mention changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims, and the above embodiments should be regarded as exemplary and non-restrictive.

Claims

1. A method for restoring and processing QUIC protocol data, characterized in that: include: Collect QUIC traffic in the network in real time; Performing in-depth analysis on the collected QUIC traffic to restore QUIC protocol data; Extract features from the QUIC protocol data using a pre-trained feature extraction model to obtain protocol features; The protocol features are screened according to preset screening rules to obtain target protocol data that meets the preset screening rules.

2. The method according to claim 1, characterized in that Perform in-depth analysis on the collected QUIC traffic and restore QUIC protocol data, including: Obtain the basic characteristics of the QUIC protocol; The DPI technology is combined with the characteristics of the QUIC protocol to perform in-depth analysis of the QUIC traffic and restore the QUIC protocol data.

3. The method according to claim 1, characterized in that: The protocol characteristics include at least one of connection characteristics, transmission characteristics and behavior characteristics.

4. The method according to claim 3, characterized in that The protocol features are screened according to preset screening rules to obtain target protocol data that meets the preset screening rules, including: According to at least one of the connection characteristics, transmission characteristics and behavior characteristics, compared with preset screening rules, identify whether the QUIC protocol data is abnormal behavior data; wherein the abnormal behavior data is one or more of abnormal traffic peak value, abnormal data packet size distribution and abnormal connection disconnection.

5. The method according to claim 3, characterized in that: The protocol features are screened according to preset screening rules to obtain target protocol data that meets the preset screening rules, including: According to at least one of the connection characteristics, transmission characteristics and behavior characteristics, it is compared with the preset screening rules to identify whether the QUIC protocol data is the data of interest.

6. The method according to claim 1, characterized in that The training process of the feature extraction model includes: Obtain a preset number of sample QUIC protocol data collected in advance; Identify sample features of the sample QUIC protocol data, and use the sample features as labels to annotate the sample; Inputting sample QUIC protocol data with sample feature labels into a basic model, performing supervised training on the basic model, and obtaining a model to be verified; The accuracy of the model to be verified is verified using a test set data consisting of sample QUIC protocol data. When the accuracy meets a preset condition, it is determined that the model to be verified passes the verification to obtain a feature extraction model.

7. The method according to claim 1, characterized in that Real-time collection of QUIC traffic in the network, including: The Ethernet convergence and splitter is used to collect QU IC traffic in the network in real time.

8. An electronic device, characterized in that: The electronic device comprises: one or more processors; and A memory storing computer program instructions, which, when executed, cause the processor to perform the steps of the method as claimed in any one of claims 1 to 7.

9. A computer readable medium having a computer program / instructions stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images