Service flow determination method and device, equipment and storage medium

Abstract

The invention discloses a service traffic determination method and apparatus, a device and a storage medium. The method comprises the steps of obtaining a traffic message of a cloud private network; determining a cloud private network connection scene of the cloud private network according to the data format of the flow message; according to the cloud private network connection scene, performing data rewriting on the traffic message to obtain a target internet protocol address of the traffic message; and determining a service corresponding to the target Internet protocol address as a target service. Based on this, the data format of the traffic message is rewritten in different cloud private network connection scenes to obtain the destination Internet protocol address of the traffic message so as to determine the corresponding target service, so that the service corresponding to the traffic in the cloud private network cannot be determined due to the fact that the Internet protocol address cannot be accurately identified in the existing cloud private network. Flow service identification and further processing in the cloud private network are realized.

Description

Technical Field

[0001] The present application belongs to the field of business flow identification, and in particular, relates to a business flow determination method, device, equipment, and storage medium. Background Art

[0002] Cloud dedicated line services are widely used based on cloud networks. Cloud dedicated lines provide private network connections of physical dedicated lines. The network links are exclusive to users and there is no risk of data leakage. They meet the high-level network connection needs of finance, government and enterprises.

[0003] In the application process, in order to ensure the security of the execution of services in the cloud dedicated line, it is necessary to monitor and protect the cloud dedicated line services, that is, to monitor and protect the traffic of the cloud dedicated line services. However, the existing network traffic analysis technology distinguishes the executed services based on the IP address (Internet Protocol Address), but due to the VPN (Virtual Private Network) or MPLS (Multi-Protocol Label Switching) encapsulated traffic with the same IP address in the cloud dedicated network, the existing network analysis technology cannot accurately obtain the detailed information of the cloud network services in the cloud dedicated network traffic for further detailed analysis and protection.

[0004] Therefore, in the prior art, it is impossible to obtain the address information of the traffic in the cloud private network, and thus it is impossible to determine the execution business corresponding to the traffic. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, device, and storage medium for determining business traffic, which determines the execution business corresponding to the traffic by acquiring address information in the traffic.

[0006] According to a first aspect of the present application, an embodiment of the present application provides a method for determining service flow, which may include:

[0007] Obtain traffic packets of the cloud private network;

[0008] Determine the cloud-private network connection scenario based on the data format of the traffic message;

[0009] According to the cloud private network connection scenario, the traffic message is rewritten to obtain the destination Internet Protocol address of the traffic message;

[0010] The service corresponding to the destination Internet Protocol address is determined as the target service.

[0011] Optionally, determining the message type of the traffic message in the cloud private network according to the data format of the traffic message may include:

[0012] When the communication interface address exists in the traffic message, the cloud private network connection scenario is determined to be a cloud private network edge access scenario;

[0013] When there are communication protocol label messages in the traffic messages, it is determined that the cloud private network connection scenario is an intra-cloud private network communication scenario.

[0014] Optionally, the cloud private network connection scenario is a cloud private network edge access scenario;

[0015] According to the cloud private network connection scenario, the traffic message is rewritten to obtain the destination Internet Protocol address, which may include:

[0016] Obtaining the first address message information in the traffic message;

[0017] Extracting a first hardware address from the first address message information;

[0018] Data is rewritten on the first hardware address to obtain a destination Internet Protocol address.

[0019] Optionally, rewriting the first hardware address to obtain a destination Internet Protocol address includes:

[0020] Decomposing the first hardware address into a plurality of first address character segments;

[0021] Rewrite the data of each first address character segment respectively to obtain a second address character segment;

[0022] Each second address segment is combined to generate a destination Internet Protocol address.

[0023] Optionally, the cloud private network connection scenario is a cloud private network intra-domain communication scenario;

[0024] According to the cloud private network connection scenario, the traffic message is rewritten to obtain the destination Internet Protocol address, which may include:

[0025] Parse the communication protocol label message to obtain the header label message;

[0026] The initial message Internet Protocol address in the header label message is rewritten to obtain the destination Internet Protocol address.

[0027] Optionally, rewriting the initial message Internet Protocol address in the header label message to obtain the destination Internet Protocol address may include:

[0028] Remove the top-level label message from the header label message to obtain the bottom-level label message;

[0029] Obtaining the initial message Internet Protocol address in the underlying label message;

[0030] Adding a placeholder character to the initial message Internet Protocol address to obtain the target message Internet Protocol address;

[0031] Decomposing the target message Internet Protocol address into a plurality of third address character segments;

[0032] Rewrite the data of each third address character segment respectively to obtain a fourth address character segment;

[0033] Each fourth address segment is combined to generate a destination Internet Protocol address.

[0034] Optionally, after determining that the service corresponding to the destination Internet Protocol address is the target service, the method may further include:

[0035] Send the traffic message to the execution program corresponding to the target business.

[0036] According to a second aspect of the present application, an embodiment of the present application provides a device for determining service flow, and the device for determining service flow may include:

[0037] The acquisition module is used to obtain the traffic messages of the cloud private network;

[0038] A first determination module, configured to determine a message type of the flow message in the cloud private network according to a data format of the flow message;

[0039] A data rewriting module, used to rewrite the data of the traffic message according to the cloud private network connection scenario to obtain a destination Internet Protocol address;

[0040] The second determination module is used to determine that the service corresponding to the destination Internet Protocol address is the target service.

[0041] According to a third aspect of the present application, a device for determining service flow is provided, the device comprising: a processor and a memory storing computer program instructions;

[0042] When the processor executes the computer program instructions, the method for determining the service flow of any one of the first aspects is implemented.

[0043] According to the fourth aspect of the present application, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method for determining the business flow of any one of the first aspects is implemented.

[0044] According to the fifth aspect of the present application, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by the processor of an electronic device, the electronic device executes the method for determining the business traffic of any one of the first aspects.

[0045] The method, device, equipment, and storage medium for determining the service traffic of the embodiments of the present application obtain traffic messages, and determine the cloud private network connection scenario of the cloud private network where the traffic message is located according to the data format of the traffic message, thereby rewriting the data of the traffic message according to the data in different cloud private network connection scenarios, thereby obtaining the destination Internet Protocol address of the traffic message, and thus determining the target service corresponding to the traffic message according to the destination Internet Protocol address. Based on this, by rewriting the data format of the traffic message in different cloud private network connection scenarios, the destination Internet Protocol address is obtained to determine the corresponding target service, which realizes the identification of traffic service in the cloud private network compared to the inability to accurately identify the Internet Protocol address in the existing cloud private network, which leads to the inability to determine the service corresponding to the traffic in the cloud private network. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 is a flow chart of a method for determining service flow according to an exemplary embodiment;

[0048] Figure 2 It is a schematic diagram of message transmission in a cloud network according to a method for determining service flow rate shown in an exemplary embodiment;

[0049] Figure 3 is a structural block diagram of a device for determining service flow according to an exemplary embodiment;

[0050] Figure 4 The figure is a schematic diagram of the hardware structure of a device for determining service flow according to an exemplary embodiment. DETAILED DESCRIPTION

[0051] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0052] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-otherwise inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0053] As described in the background technology section, the traffic with the same IP address encapsulated by VPN (Virtual Private Network) or MPLS (Multi-Protocol Label Switching) in the existing cloud private network cannot be accurately obtained through existing network analysis technology to obtain detailed cloud network business information in the cloud private network traffic for further detailed analysis and protection.

[0054] In order to solve the problems of the prior art, the present application rewrites the data format of the traffic message in different cloud private network connection scenarios to obtain its destination Internet Protocol address to determine the corresponding target service. Compared with the existing cloud private network that cannot accurately identify the Internet Protocol address and thus cannot determine the service corresponding to the traffic in the cloud private network, this application realizes the identification of traffic services in the cloud private network.

[0055] Based on this, the present application provides a method, device, equipment, and storage medium for determining service flow. The following first introduces the method for determining service flow provided in the embodiments of the present application.

[0056] Figure 1 FIG. 1 is a flow chart showing a method for determining service flow provided by an embodiment of the present application. Figure 1 As shown, the method may include the following steps:

[0057] S101, obtaining traffic packets of the cloud private network;

[0058] S102, determining a cloud private network connection scenario of the cloud private network according to a data format of the traffic message;

[0059] S103, rewriting the data of the traffic message according to the cloud private network connection scenario to obtain the destination Internet Protocol address of the traffic message;

[0060] S104: Determine the service corresponding to the destination Internet Protocol address as the target service.

[0061] Based on the above embodiments, the present application obtains the traffic message, and determines the cloud private network connection scenario of the cloud private network where the traffic message is located according to the data format of the traffic message, thereby rewriting the data of the traffic message according to the data in different cloud private network connection scenarios, thereby obtaining the destination Internet Protocol address of the traffic message, and thus determining the target service corresponding to the traffic message according to the destination Internet Protocol address. Based on this, by rewriting the data format of the traffic message in different cloud private network connection scenarios, the destination Internet Protocol address is obtained to determine the corresponding target service. Compared with the existing cloud private network, which cannot accurately identify the Internet Protocol address and thus cannot determine the service corresponding to the traffic in the cloud private network, the traffic service identification in the cloud private network is realized.

[0062] In the above S101, the traffic message of the network connection channel in the cloud private network can be obtained by connecting the hardware probe to the network transmission channel of the cloud private network;

[0063] In the above S102, by analyzing the data format of the traffic message, the application scenario of the traffic message, that is, the cloud private network connection scenario of the cloud private network, is determined according to the data format.

[0064] As an example, the above S102 may include:

[0065] S1021, when the communication interface address exists in the traffic message, determining that the cloud private network connection scenario is a cloud private network edge access scenario;

[0066] S1022: When a communication protocol label message exists in the traffic message, determine that the cloud private network connection scenario is an intra-cloud private network communication scenario.

[0067] In the above S1021, since the traffic messages are analyzed, if there is a message about the communication interface address, it means that the traffic message is a traffic message in the cloud private network edge access scenario of the cloud private network.

[0068] As an example, the communication interface address may include: MAC address+VLAN address, wherein the VLAN address is mainly embodied in the form of a VLAN account (VLAN ID).

[0069] like Figure 2As shown in the figure, in the cloud private network, the traffic packets it forwards support ports that forward communications from multiple different VLANs, namely, aggregation links. Under the same aggregation link containing multiple VLANs, one VLAN corresponds to one service. According to the MAC+VLANID combination, the traffic executing different services can be traced back to different upstream network devices. Data frames on the aggregation link are all attached with special information for identifying which VLAN they belong to. When the data frame sent by A passes through the aggregation link from switch 1 to switch 2, a tag indicating that it belongs to the red VLAN is attached to the data frame.

[0070] After receiving the data frame, switch 2 checks the VLAN tag and finds that the data frame belongs to the red VLAN. Therefore, after removing the tag, the restored data frame is forwarded only to other ports belonging to the red VLAN as needed. At this time, forwarding means that after confirming the target MAC address and comparing it with the MAC address list, it is forwarded only to the port connected to the target MAC address. Only when the data frame is a broadcast frame, a multicast frame, or a frame with an unknown target, it will be forwarded to all ports belonging to the red VLAN.

[0071] If the traffic message contains a communication interface address that is a combination of MAC address + VLAN address, then the traffic message is used for the edge access scenario in the cloud private network. Therefore, the cloud private network connection scenario is also the cloud private network edge access scenario.

[0072] In the above S102, in the case of intra-domain communication scenario of the cloud private network, when the traffic message enters the MPLS layer, the LER (Label Edge Router) at the MPLS entrance pushes the MPLS label stack into the traffic message, so that the traffic message carries two layers of MPLS labels into the MPLS routing domain.

[0073] Therefore, if the traffic message contains an MPLS-related communication protocol label message, the traffic message is a message used for communication within the cloud private network domain, that is, the cloud private network connection scenario is a cloud private network domain communication scenario.

[0074] In the above S103, according to different cloud-specific network connection scenarios, the data formats of the traffic messages in different cloud-specific network connection scenarios are rewritten respectively, so as to obtain the destination Internet Protocol address of the traffic message.

[0075] Specifically, in one embodiment, when the cloud private network connection scenario is a cloud private network edge access scenario, the above S103 may include:

[0076] S1031, obtaining first address message information in the traffic message;

[0077] S1032, extracting a first hardware address from the first address message information;

[0078] S1033, rewrite the data of the first hardware address to obtain a destination Internet Protocol address.

[0079] In the above S1031, first address message information related to the communication address is extracted from the traffic message, wherein the first address message information may include a MAC address+VLAN address.

[0080] In the above S1032, a first hardware address related to the traffic message execution service, ie, a MAC address, is extracted from the first address message information.

[0081] In the above S1033, the format of the data carried out by the first hardware address is rewritten and converted, so as to obtain the destination Internet Protocol address that can be read in the traffic message.

[0082] Specifically, the method of rewriting data of the first hardware address may include:

[0083] Decomposing the first hardware address into a plurality of first address character segments;

[0084] Rewrite the data of each first address character segment respectively to obtain a second address character segment;

[0085] Each second address segment is combined to generate a destination Internet Protocol address.

[0086] The first hardware address is divided into a plurality of character segments to obtain a first address character segment.

[0087] For example, the MAC address information in the traffic packet is identified as: 01-01-11-12-13-14, and it is split into 11, 12, 13, 14.

[0088] Data is rewritten for each first character segment respectively, wherein the rewriting method may include format replacement, sequence replacement, etc., so as to obtain the second address character segment corresponding to each first address character segment.

[0089] For example, A=11, B=12, C=13, D=14.

[0090] Each second address character segment is then combined according to the preset communication protocol requirements to generate a destination Internet Protocol address.

[0091] For example, fill in the above information in the IPv4 address format of ABCD to obtain the destination Internet Protocol address 11.12.13.14.

[0092] Specifically, in another embodiment, when the cloud private network connection scenario is a cloud private network intra-domain communication scenario, the above S103 may further include:

[0093] S1035, parsing the communication protocol label message to obtain a header label message;

[0094] S1036, rewrite the data of the initial message Internet Protocol address in the header label message to obtain the destination Internet Protocol address.

[0095] When the cloud private network connection scenario is a communication scenario within the cloud private network domain, the communication protocol label message is an MPLS label information message, and the MPLS label information message is removed to obtain a header label message.

[0096] Then, the data of the initial message Internet Protocol address in the header label message is rewritten to obtain the destination Internet Protocol address.

[0097] Specifically, the rewriting methods may include:

[0098] Remove the top-level label message from the header label message to obtain the bottom-level label message;

[0099] Obtaining the initial message Internet Protocol address in the underlying label message;

[0100] Adding a placeholder character to the initial message Internet Protocol address to obtain the target message Internet Protocol address;

[0101] Decomposing the target message Internet Protocol address into a plurality of third address character segments;

[0102] Rewrite the data of each third address character segment respectively to obtain a fourth address character segment;

[0103] Each fourth address character segment is combined to generate the destination Internet Protocol address of the traffic message.

[0104] The header label of the MPLS label stack includes two layers. The bottom label is allocated by the BGP protocol, and the top label is allocated by the bottom network IGP protocol. Since the cloud network aggregation device is the penultimate hop LSR of any path in the MPLS VPN (Virtual Private Network) routing domain, after the MPLS VPN message enters the cloud network aggregation device, the top IGP label message will be popped out, and only the bottom VPN label message will be left in the label stack. The MPLS layer service identification module parses the MPLS header label information in the MPLSVPN message and obtains the corresponding VPN bottom label message.

[0105] The initial message Internet Protocol address is extracted from the VPN bottom label message.

[0106] Since the number of characters in the initial message Internet Protocol address is relatively small, in order to better determine the decomposition of the initial message Internet Protocol address, it is necessary to add padding characters to the initial message Internet Protocol address to obtain the target message Internet Protocol address.

[0107] For example, it is identified that the label value in the Internet Protocol address of the initial message is: 48175, and the value is padded with zeros in front to: 048175.

[0108] The target message Internet Protocol address supplemented with the padding characters is split to obtain multiple third address character segments.

[0109] For example, 048175 is recorded as fields 04, 81, and 75 respectively.

[0110] Data is rewritten for each third character segment respectively, wherein the rewriting method may include format replacement, sequence replacement, etc., so as to obtain a fourth address character segment corresponding to each third address character segment.

[0111] For example, A=04, B=81, C=75.

[0112] Since the traffic message is transmitted within the cloud private network domain, there is a fixed Internet Protocol address character in the domain. Therefore, after the fourth address character segment is split, the final destination Internet Protocol address is generated based on the combination of the fixed Internet Protocol address character and the fourth address character segment.

[0113] For example, fill in the format of 10.ABC to get the destination Internet Protocol address 10.04.81.75, where 10 is the fixed Internet Protocol address character.

[0114] In the above S104, after the destination IP address is determined, the target service corresponding to the destination IP address can be determined according to the correspondence between the service and the IP address. In addition, if there is an error in the traffic message, a corresponding solution can be implemented in time for the target service.

[0115] As an example, by predefining the correspondence between Internet Protocol addresses and services in the probe's traffic parsing module, the probe's traffic parsing module can query the predefined correspondence based on the destination Internet Protocol address after obtaining the destination Internet Protocol address, thereby identifying the service to which the traffic message belongs.

[0116] In one embodiment, in order to execute the target service, a method for determining service traffic provided by one embodiment of the present application may further include, after the above S104:

[0117] S201, sending the traffic message to the execution program corresponding to the target service.

[0118] By sending the traffic message to the execution program corresponding to the target service, the execution program can execute the corresponding target service according to the traffic message, thereby completing the execution of the target service.

[0119] It should be noted that in addition to the above-mentioned cloud private network edge access scenario and the cloud private network edge access scenario to confirm the destination Internet Protocol address of the traffic message and determine the target business scenario, it is also used in the following scenarios to analyze and protect the traffic when monitoring the traffic message. The specific solutions are as follows:

[0120] (1) Analyze and organize the data collected by the probe according to the business dimensions (including different scenarios, such as cloud private network edge access scenario and cloud private network MPLS domain detection scenario), and display functions such as traffic statistics, delay jitter analysis, packet loss analysis, protocol type analysis, service response delay analysis, and retransmission rate analysis of cloud private line services according to business needs, so as to realize service quality monitoring in the cloud private line dimension.

[0121] (2) In a specific cloud-private network MPLS domain detection scenario, a traffic cleaning module can be loaded to clean attack traffic in the cloud-to-cloud interconnection scenario.

[0122] (3) In specific scenarios, the traffic detection device identifies and matches the traffic based on the abnormal traffic identification threshold and related feature library. It determines whether the business traffic has abnormal attack behavior by checking whether the message meets the characteristics or the attack sending rate reaches the threshold. If there is abnormal attack behavior, an alarm is sent to the security management center to trigger cleaning. After the abnormal traffic enters the cleaning center, the cleaning device cleans the abnormal traffic according to the preset security policy, identifies the attack message and discards it. The remaining normal business traffic messages continue to go through the forwarding process and are transferred back to the cloud private network.

[0123] It should be noted that the application scenarios described in the above-mentioned embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Ordinary technicians in this field can know that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems; and new embodiments of the present application can be combined with each other, and new solutions formed by the combination of various embodiments are all within the protection scope of the present application.

[0124] Based on the same inventive concept, the present application also provides a device 300 for determining service flow. Figure 3 To explain in detail, the service flow determination device 300 may include:

[0125] The acquisition module 310 is used to acquire the traffic message of the cloud private network;

[0126] A first determination module 320 is used to determine the message type of the traffic message in the cloud private network according to the data format of the traffic message;

[0127] The data rewriting module 320 is used to rewrite the data of the traffic message according to the cloud private network connection scenario to obtain the destination Internet Protocol address;

[0128] The second determination module 340 is used to determine that the service corresponding to the destination Internet Protocol address is the target service.

[0129] In the device 300 for determining the service traffic provided in this embodiment, the acquisition module 310 acquires the traffic message, and the first determination module 320 determines the cloud private network connection scenario of the cloud private network where the traffic message is located according to the data format of the traffic message. The data rewriting module 320 can rewrite the data of the traffic message according to the data in different cloud private network connection scenarios, thereby obtaining the destination Internet Protocol address of the traffic message, and the second determination module 340 can determine the target service corresponding to the traffic message according to the destination Internet Protocol address. Based on this, by rewriting the data format of the traffic message in different cloud private network connection scenarios, the destination Internet Protocol address is obtained to determine the corresponding target service. Compared with the inability to accurately identify the Internet Protocol address in the existing cloud private network, which leads to the inability to determine the service corresponding to the traffic in the cloud private network, the traffic service identification in the cloud private network is realized.

[0130] Optionally, the first determining module 320 may include:

[0131] A first determination unit is used to determine that the cloud private network connection scenario is a cloud private network edge access scenario when a communication interface address exists in the traffic message;

[0132] The second determination unit is used to determine that the cloud private network connection scenario is an intra-cloud private network communication scenario when a communication protocol label message exists in the traffic message.

[0133] Optionally, the cloud private network connection scenario is a cloud private network edge access scenario;

[0134] The data rewriting module 320 may include:

[0135] A first acquisition unit, used to acquire first address message information in the traffic message;

[0136] A first extraction unit, configured to extract a first hardware address from the first address message information;

[0137] The first data rewriting unit is used to rewrite the data of the first hardware address to obtain a destination Internet Protocol address.

[0138] Optionally, the first data rewriting unit may include:

[0139] A first decomposition subunit, used for decomposing the first hardware address into a plurality of first address character segments;

[0140] A first data rewriting subunit is used to rewrite the data of each first address character segment to obtain a second address character segment;

[0141] The first combining subunit is used to combine each second address character segment to generate a destination Internet Protocol address.

[0142] Optionally, the cloud private network connection scenario is a cloud private network intra-domain communication scenario;

[0143] The data rewriting module 320 may include:

[0144] A parsing unit, used for parsing the communication protocol label message to obtain a header label message;

[0145] The second data rewriting unit is used to rewrite the data of the initial message Internet Protocol address in the header label message to obtain the destination Internet Protocol address.

[0146] Optionally, the second data rewriting unit may include:

[0147] The removal subunit is used to remove the top-level label message in the header label message to obtain the bottom-level label message;

[0148] A first acquisition word unit is used to obtain an initial message Internet Protocol address in the bottom label message;

[0149] An adding subunit, used for adding a place-filling character to the initial message Internet Protocol address to obtain a target message Internet Protocol address;

[0150] A decomposition subunit, used for decomposing the target message Internet Protocol address into a plurality of third address character segments;

[0151] The second data rewriting subunit is used to rewrite the data of each third address character segment respectively to obtain a fourth address character segment;

[0152] A combining subunit is used to combine each fourth address character segment to generate a destination Internet Protocol address.

[0153] Optionally, the service flow determination device 300 may include:

[0154] The sending module is used to send the traffic message to the execution program corresponding to the target business.

[0155] The service flow determination device 300 provided in the embodiment of the present application can achieve Figure 3 The various processes implemented by the method embodiment can achieve the same technical effect, and to avoid repetition, they will not be described here.

[0156] Figure 4 A schematic diagram of the hardware structure of a device for determining business traffic provided in an embodiment of the present application is shown.

[0157] The device for determining service flow may include a processor 401 and a memory 402 storing computer program instructions.

[0158] Specifically, the processor 401 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0159] Memory 402 may include a large capacity memory for data or instructions. By way of example and not limitation, memory 402 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, memory 402 may include a removable or non-removable (or fixed) medium. In appropriate cases, memory 402 may be inside or outside of an integrated gateway disaster recovery device. In a specific embodiment, memory 402 is a non-volatile solid-state memory.

[0160] In certain embodiments, the memory 402 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, typically, the memory 402 includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors 401), it is operable to perform the operations described with reference to the method according to an aspect of the present application.

[0161] The processor 401 implements any one of the service flow determination methods in the above embodiments by reading and executing computer program instructions stored in the memory 402 .

[0162] In one example, the service flow determination device may further include a communication interface 403 and a bus 403. As shown in the figure, the processor 401, the memory 402, and the communication interface 403 are connected through the bus 403 and communicate with each other.

[0163] The communication interface 403 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0164] Bus 403 includes hardware, software or both, and the parts of the determining device of the traffic flow are coupled to each other. For example, but not limitation, bus 403 may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, wireless bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral control interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 403 may include one or more buses 403. Although the present application embodiment describes and shows a specific bus 403, the present application considers any suitable bus 403 or interconnection.

[0165] The service flow determination device can execute the service flow determination method in the embodiment of the present application based on the service flow determination device 400, thereby realizing the combination of Figure 1 Describes a method for determining service flow.

[0166] In addition, in combination with the method for determining the service flow in the above embodiments, the embodiments of the present application may provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the methods for determining the service flow in the above embodiments is implemented.

[0167] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed, implements any one of the methods for determining service traffic in the above embodiments.

[0168] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0169] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0170] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0171] Aspects of the present disclosure are described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable traffic flow determination device to produce a machine so that these instructions executed by the processor of the computer or other programmable traffic flow determination device enable the implementation of the functions / actions specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0172] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for determining service flow, characterized in that: The method comprises: Obtain traffic packets of the cloud private network; Determining a cloud private network connection scenario of the cloud private network according to a data format of the traffic message; According to the cloud private network connection scenario, rewrite the data of the traffic message to obtain the destination Internet Protocol address of the traffic message; The service corresponding to the destination Internet Protocol address is determined as the target service.

2. The method according to claim 1, characterized in that The determining, according to the data format of the traffic message, the message type of the traffic message in the cloud private network includes: When the communication interface address exists in the traffic message, determining that the cloud private network connection scenario is a cloud private network edge access scenario; When a communication protocol label message exists in the traffic message, it is determined that the cloud private network connection scenario is an intra-cloud private network communication scenario.

3. The method according to claim 2, characterized in that The cloud private network connection scenario is the cloud private network edge access scenario; The step of rewriting the traffic message according to the cloud private network connection scenario to obtain a destination Internet Protocol address includes: Obtaining first address message information in the traffic message; Extracting a first hardware address from the first address message information; The first hardware address is rewritten to obtain a destination Internet Protocol address.

4. The method according to claim 3, characterized in that The step of rewriting the data of the first hardware address to obtain a destination Internet Protocol address includes: Decomposing the first hardware address into a plurality of first address character segments; Rewrite the data of each first address character segment respectively to obtain a second address character segment; Each of the second address character segments is combined to generate the destination Internet Protocol address.

5. The method according to claim 2, characterized in that The cloud private network connection scenario is a communication scenario within the cloud private network domain; The step of rewriting the traffic message according to the cloud private network connection scenario to obtain a destination Internet Protocol address includes: Parsing the communication protocol label message to obtain a header label message; The initial message Internet Protocol address in the header label message is rewritten to obtain a destination Internet Protocol address.

6. The method according to claim 5, characterized in that The step of rewriting the initial message Internet Protocol address in the header label message to obtain the destination Internet Protocol address includes: Remove the top-level label message from the header label message to obtain the bottom-level label message; Obtaining the initial message Internet Protocol address in the bottom label message; Adding a place-filling character to the initial message Internet Protocol address to obtain a target message Internet Protocol address; Decomposing the target message Internet Protocol address into a plurality of third address character segments; Rewrite the data of each third address character segment respectively to obtain a fourth address character segment; Each of the fourth address character segments is combined to generate the destination Internet Protocol address.

7. The method according to claim 1, characterized in that After determining that the service corresponding to the destination Internet Protocol address is the target service, the method further includes: The traffic message is sent to the execution program corresponding to the target service.

8. A device for determining service flow, characterized in that: The device comprises: The acquisition module is used to obtain the traffic messages of the cloud private network; A first determination module, configured to determine a message type of the flow message in the cloud private network according to a data format of the flow message; A data rewriting module, used to rewrite the data of the traffic message according to the cloud private network connection scenario to obtain a destination Internet Protocol address; The second determination module is used to determine that the service corresponding to the destination Internet Protocol address is the target service.

9. A device for determining service flow, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method according to any one of claims 1 to 7.

Images