Traffic identification method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a traffic identification method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring target traffic to be identified; identifying the target traffic through a hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set comprises hotspot rules meeting a preset traffic hit condition in an application identification engine; if the first identification result is that a target hotspot rule in the hotspot rule set is hit, outputting an application identification result corresponding to the target hotspot rule; and if the first identification result is that the hotspot rule set is not hit, identifying the target traffic through the application identification engine, and outputting a second identification result. By adopting the method, the application identification efficiency can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a traffic identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Application identification is a mechanism that classifies traffic according to the application / protocol characteristics in the traffic. Through application identification technology, various applications in the traffic can be accurately identified, so that the traffic can be finely controlled.

[0003] In the related art, technicians need to pre-establish a feature library, which contains traffic matching rules. After receiving network traffic, the network traffic is matched with the matching rules, and the application type corresponding to the network traffic is determined by the matching rules hit by the network traffic.

[0004] However, with continuous accumulation, the feature library for application identification will become larger and larger, and the number of rules may even reach tens of thousands, resulting in low efficiency of application identification. Summary of the invention

[0005] Based on this, it is necessary to provide a traffic identification method, device, computer equipment, computer-readable storage medium and computer program product that can improve application identification efficiency in response to the above technical problems.

[0006] In a first aspect, the present application provides a traffic identification method, the method comprising:

[0007] Obtain the target traffic to be identified;

[0008] The target traffic is identified by a hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in an application identification engine that meet preset traffic hit conditions;

[0009] If the first recognition result hits a target hotspot rule in the hotspot rule set, outputting an application recognition result corresponding to the target hotspot rule;

[0010] If the first identification result is a miss in the hotspot rule set, the target traffic is identified by the application identification engine to output a second identification result.

[0011] In one embodiment, each hotspot rule in the hotspot rule set has a heat value; and the method further includes:

[0012] Based on the first recognition result and / or the second recognition result, updating the hotspot rules in the hotspot rule set and / or the heat value of each of the hotspot rules;

[0013] Regenerate the hotspot engine based on the updated hotspot rule set.

[0014] In one embodiment, updating the heat value of each of the hotspot rules in the hotspot rule set based on the first recognition result and / or the second recognition result includes:

[0015] If the first recognition result is a hit on a target hotspot rule in the hotspot rule set, then based on a preset heat value increase strategy, the heat value of the target hotspot rule is increased, and based on a preset heat value decrease strategy, the heat values ​​of other hotspot rules in the hotspot rule set except the target hotspot rule are decreased;

[0016] If the first recognition result is a miss in the hotspot rule set, the heat values ​​of all hotspot rules in the hotspot rule set are reduced based on a preset heat value reduction strategy.

[0017] In one embodiment, updating the heat value of each of the hotspot rules in the hotspot rule set based on the first recognition result and / or the second recognition result includes:

[0018] If the second recognition result hits the target matching rule corresponding to the application recognition engine, the target matching rule is added as a hotspot rule to the hotspot rule set, and the preset heat value is used as the heat value of the newly added heat rule.

[0019] In one embodiment, before regenerating the hotspot engine based on the updated hotspot rule set, the method further includes:

[0020] In the hotspot rule set, if there is a hotspot rule whose heat value is less than or equal to a preset threshold, the hotspot rule whose heat value is less than or equal to the preset threshold is deleted from the hotspot rule set, and the first state flag corresponding to the hotspot rule set is increased by 1; and / or,

[0021] After the target matching rule is added to the hotspot rule set, the first state flag corresponding to the hotspot rule set is increased by 1.

[0022] In one embodiment, regenerating the hotspot engine based on the updated hotspot rule set includes:

[0023] Obtain a second state identifier corresponding to the hotspot engine;

[0024] If the first state identifier is inconsistent with the second state identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

[0025] In a second aspect, the present application provides a flow identification device, the device comprising:

[0026] An acquisition module, used to acquire target traffic to be identified;

[0027] A determination module, used to identify the target traffic through a hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in an application identification engine that meet preset traffic hit conditions;

[0028] A first output module, configured to output an application identification result corresponding to the target hotspot rule if the first identification result hits a target hotspot rule in the hotspot rule set;

[0029] The second output module is used to identify the target traffic through the application identification engine and output a second identification result if the first identification result does not hit the hotspot rule set.

[0030] In one embodiment, each hotspot rule in the hotspot rule set has a heat value; and the apparatus further comprises:

[0031] An updating module, used for updating the hotspot rules in the hotspot rule set and / or the heat value of each of the hotspot rules based on the first recognition result and / or the second recognition result;

[0032] The generation module is used to regenerate the hotspot engine based on the updated hotspot rule set.

[0033] In one embodiment, the update module is specifically used to:

[0034] If the first recognition result is a hit on a target hotspot rule in the hotspot rule set, then based on a preset heat value increase strategy, the heat value of the target hotspot rule is increased, and based on a preset heat value decrease strategy, the heat values ​​of other hotspot rules in the hotspot rule set except the target hotspot rule are decreased;

[0035] If the first recognition result is a miss in the hotspot rule set, the heat values ​​of all hotspot rules in the hotspot rule set are reduced based on a preset heat value reduction strategy.

[0036] In one embodiment, the update module is specifically used to:

[0037] If the second recognition result hits the target matching rule corresponding to the application recognition engine, the target matching rule is added as a hotspot rule to the hotspot rule set, and the preset heat value is used as the heat value of the newly added heat rule.

[0038] In one embodiment, the device further comprises:

[0039] A first adding module is used to delete the hotspot rule whose heat value is less than or equal to the preset threshold from the hotspot rule set when there is a hotspot rule whose heat value is less than or equal to the preset threshold in the hotspot rule set, and add 1 to the first state identifier corresponding to the hotspot rule set; and / or,

[0040] The second adding module is used to add 1 to the first state identifier corresponding to the hotspot rule set after adding the target matching rule to the hotspot rule set.

[0041] In one embodiment, the generating module is specifically used for:

[0042] Obtain a second state identifier corresponding to the hotspot engine;

[0043] If the first state identifier is inconsistent with the second state identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

[0044] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0045] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0046] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0047] The above-mentioned traffic identification method, device, computer equipment, computer-readable storage medium and computer program product can obtain the target traffic to be identified, identify the target traffic through the hotspot engine, and obtain a first identification result; wherein, the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set contains hotspot rules that meet the preset traffic hit conditions. If the first identification result is a hit on the target hotspot rule in the hotspot rule set, the application identification result corresponding to the target hotspot rule is output; if the first identification result is a miss on the hotspot rule set, the target traffic is identified through the application identification engine, and a second identification result is output. In this solution, the hotspot engine is constructed based on the hotspot rules in the application identification engine that meet the preset traffic hit conditions. Therefore, the hotspot engine has a higher matching degree with the application in the current traffic, and the subsequent traffic has a greater probability of hitting the hotspot engine. In this solution, the traffic is first identified through the hotspot engine, and the identification result is output if it is hit. If it is not hit, it is identified through the traditional application identification engine. Therefore, the number of times traffic enters the original engine can be effectively reduced. Since the number of rules in the hotspot engine is much smaller than that in the original engine, the rule scale of the hotspot engine is smaller, which can effectively improve the efficiency of application identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0049] FIG1 is a schematic diagram of a flow chart of a flow identification method in an embodiment;

[0050] FIG2 is a schematic flow diagram of a hotspot engine update step in one embodiment;

[0051] FIG3 is a flow chart of an example of a flow identification method in another embodiment;

[0052] FIG4 is a structural block diagram of a flow identification method and device in one embodiment;

[0053] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] An embodiment of the present application provides a traffic identification method, which is applied to a network device in this embodiment. The network device may be a terminal device. It is understandable that the method may also be applied to a server, or to a system including a terminal device and a server, and may be implemented through interaction between the terminal device and the server.

[0056] The following will describe in detail the traffic identification method provided by the present application in combination with a specific implementation method. As shown in FIG1 , the method includes the following steps:

[0057] Step 102, obtaining the target traffic to be identified.

[0058] In the embodiment of the present application, the network device can receive the traffic transmitted in the network, that is, the target traffic to be identified. The network device can determine whether there is a hotspot engine currently, if so, execute step 104, if not, identify the target traffic through a traditional application identification engine.

[0059] Step 104, identify the target traffic through the hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules that meet preset traffic hit conditions.

[0060] In the embodiment of the present application, when there is a hotspot engine, the network device can input the target traffic into the hotspot engine to obtain a first recognition result. The hotspot engine is an engine built based on a hotspot rule set, and the hotspot rule set includes hotspot rules that meet preset traffic hit conditions.

[0061] In one example, in the absence of a hotspot engine, the network device can establish a hotspot rule set. When the network device receives traffic, the network device can input the target traffic into the application identification engine, and copy and store the rules hit by the target traffic as hotspot rules in the hotspot rule set. At the same time, the heat value of the hotspot rule can be set to a preset heat value. When the number of hotspot rules contained in the hotspot rule set is greater than or equal to a preset threshold, the network device generates a hotspot engine based on the hotspot rule set, and sets the hotspot engine before the application identification engine, so that when the traffic is received, the traffic can be first identified by the hotspot engine.

[0062] Step 106: If the first recognition result hits the target hot spot rule in the hot spot rule set, the application recognition result corresponding to the target hot spot rule is output.

[0063] In an embodiment of the present application, if the first identification result hits a target hotspot rule in a hotspot rule set, the network device can determine the application identification result corresponding to the target hotspot rule and output the identification result, and can also update the heat value of the hotspot rule in the hotspot rule set based on a preset heat value update strategy.

[0064] Step 108: If the first identification result is a miss hotspot rule set, the target traffic is identified by applying the identification engine and a second identification result is output.

[0065] In the embodiment of the present application, if the first identification result is a miss in the hotspot rule set, the network device inputs the target traffic into the application identification engine for identification to obtain a second identification result. If the second identification result is a hit in the target rule in the application identification engine, the network device can determine the application identification result corresponding to the target rule and output the identification result; if the second identification result is a miss in the target rule in the application identification engine, the network device can output the identification result corresponding to the target traffic according to the configuration information.

[0066] In this solution, the hotspot engine is constructed based on the hotspot rules in the application identification engine that meet the preset traffic hit conditions. Therefore, the hotspot engine has a higher match with the application in the current traffic, and the probability of subsequent traffic hitting the hotspot engine is greater. This solution first uses the hotspot engine to identify traffic, and outputs the identification result if it hits. If it does not hit, it is identified through the traditional application identification engine. Therefore, it can effectively reduce the number of times traffic enters the original engine. Since the number of rules in the hotspot engine is much less than the number of rules in the original engine, the rule scale of the hotspot engine is smaller, which can effectively improve the efficiency of application identification.

[0067] Optionally, each hotspot rule in the hotspot rule set has a heat value; as shown in FIG2 , the method further includes:

[0068] Step 202: based on the first recognition result and / or the second recognition result, update the hotspot rules in the hotspot rule set and / or the heat value of each hotspot rule.

[0069] Step 204, regenerate the hotspot engine based on the updated hotspot rule set.

[0070] In an embodiment of the present application, the network device can update the hotspot rule set based on the first recognition result and / or the second recognition result, and a preset update strategy. Specifically, the hotspot rules included in the hotspot rule set can be updated, or the heat value of the hotspot rule can be updated, and the hotspot rules that meet the preset hit conditions are re-determined based on the updated heat value, thereby updating the hotspot rule set. The network device can regenerate the hotspot engine based on the updated hotspot rule set.

[0071] In this solution, the hotspot engine can be dynamically generated based on the application identification results of the current traffic. Therefore, the number of rules in the hotspot engine is not only less than the number of rules in the original engine, but also has a higher matching degree with the applications in the current traffic. The probability of subsequent traffic hitting the hotspot engine is very high, while the hotspot engine's rule scale is very small, and the number of times the traffic enters the original engine is reduced, thereby improving the efficiency of application identification. In addition, since the hotspot engine is dynamically generated based on the current traffic, it can adapt to different network environments and has a higher adaptability to the current network environment.

[0072] Optionally, based on the first identification result and / or the second identification result, the heat value of each hot spot rule in the hot spot rule set is updated, including: if the first identification result is a hit of the target hot spot rule in the hot spot rule set, then based on a preset heat value increase strategy, the heat value of the target hot spot rule is increased, and based on a preset heat value reduction strategy, the heat values ​​of other hot spot rules in the hot spot rule set except the target hot spot rule are reduced; if the first identification result is a miss of the hot spot rule set, then based on a preset heat value reduction strategy, the heat values ​​of all hot spot rules in the hot spot rule set are reduced.

[0073] In the embodiment of the present application, each hotspot rule has a heat value. When the hotspot rule is added to the hotspot rule set, the heat value of the hotspot rule is initialized to a preset heat value. Subsequently, the hotspot value of the hotspot rule is dynamically adjusted according to the traffic hit situation of the hotspot rule. Specifically, the hotspot value is positively correlated with the hit frequency of the hotspot rule.

[0074] If the first identification result is a hit on the target hotspot rule in the hotspot rule set, the network device can increase the heat value of the target hotspot rule based on a preset heat value increase strategy. For example, the network device can obtain the current heat value of the target hotspot rule, and then increase the heat value of the target hotspot rule based on a preset increase value or a preset increase ratio, such as adding 1 to the heat value of the target hotspot rule. At the same time, the network device can reduce the heat values ​​of other hotspot rules in the hotspot rule set except the target hotspot rule based on a preset heat value reduction strategy. For example, the network device can obtain the current heat value of the target hotspot rule, and then reduce the heat value of the target hotspot rule based on a preset reduction value or a preset reduction ratio, such as reducing the heat value of the target hotspot rule by 1. In addition, if the first identification result is a miss on the hotspot rule set, the network device reduces the heat values ​​of all hotspot rules in the hotspot rule set based on a preset heat value reduction strategy. The specific reduction method can be the same as the above method.

[0075] In this solution, by updating the heat value of the heat rule, the freshness of the hotspot engine can be maintained, and the hotspot engine can be prevented from being overly redundant, thus ensuring the high efficiency of the hotspot engine. Specifically, for hotspot rules with high hit frequencies, the heat value of the hotspot rule can be increased, the aging time of the hotspot rule can be delayed, and the hit rate can be improved; for hotspot rules with low hit frequencies, the heat value of the hotspot rule can be reduced, and the aging progress of the hotspot rule can be accelerated, thereby preventing the hotspot engine from being overly redundant.

[0076] Optionally, based on the first recognition result and / or the second recognition result, the heat value of each hotspot rule in the hotspot rule set is updated, including: if the second recognition result is a target matching rule corresponding to the hit application recognition engine, the target matching rule is added as a hotspot rule to the hotspot rule set, and the preset heat value is used as the heat value of the newly added heat rule.

[0077] In an embodiment of the present application, if the second identification result is a target matching rule corresponding to a hit application identification engine, the network device can add the target matching rule as a hotspot rule to the hotspot rule set, and initialize the heat value of the newly added heat rule to a preset heat value.

[0078] In this solution, when the traffic does not hit the hotspot engine, the rules in the application identification engine that the traffic hits can be obtained and added to the hotspot rule set, thereby dynamically adjusting the hotspot rules contained in the hotspot rule set, so that the hotspot engine is dynamically generated according to the current traffic and dynamically adjusted as the network environment changes, making it more adaptable to the current network environment.

[0079] Optionally, before regenerating the hotspot engine based on the updated hotspot rule set, it also includes: in the hotspot rule set, if there is a hotspot rule whose heat value is less than or equal to a preset threshold, deleting the hotspot rule whose heat value is less than or equal to the preset threshold from the hotspot rule set, and adding 1 to the first state identifier corresponding to the hotspot rule set; and / or, after adding the target matching rule to the hotspot rule set, adding 1 to the first state identifier corresponding to the hotspot rule set.

[0080] In an embodiment of the present application, after the network device completes the update of the heat, it can determine whether there is a hotspot rule with a heat value less than or equal to a preset threshold in the hotspot rule set. If so, the hotspot rule with a heat value less than or equal to the preset threshold is deleted from the hotspot rule set, and the first state identifier corresponding to the hotspot rule set is increased by 1. The first state identifier is used to record the update status of the hotspot rule set. In addition, after the network device adds the target matching rule to the hotspot rule set, it can also increase the first state identifier corresponding to the hotspot rule set by 1.

[0081] This solution can record the number of times the hotspot rule set is updated by updating the first state identifier, which is convenient for updating the hotspot engine.

[0082] Optionally, regenerating the hotspot engine based on the updated hotspot rule set includes: obtaining a second state identifier corresponding to the hotspot engine; if the first state identifier is inconsistent with the second state identifier, regenerating the hotspot engine based on the updated hotspot rule set.

[0083] In an embodiment of the present application, the first state identifier and the second state identifier can be two different variables. The first state identifier is used to record the update status of the hotspot rule set. Whenever a hotspot rule in the hotspot rule set is added or deleted, the first state identifier is updated. For example, the first state identifier can be used to characterize the number of updates of the hotspot rule set. The second state identifier is used to record the update status of the hotspot engine. Whenever the hotspot engine is updated, the second state identifier is updated, and the second state identifier can be updated according to the first state identifier.

[0084] Specifically, the network device can obtain the second state identifier corresponding to the hotspot engine, and then determine whether the first state identifier is consistent with the second state identifier. If they are inconsistent, it means that the current hotspot rule set has been updated. The network device can obtain the current hotspot rule set (i.e., the updated hotspot rule set) and the current first state identifier. Then, the network device updates the second state identifier to the obtained first state identifier, and at the same time, regenerates the hotspot engine based on the updated hotspot rule set. If the two are consistent, there is no need to update the hotspot engine.

[0085] In this solution, in addition to the message processing process, an independent hotspot engine maintenance process is added to periodically check whether the hotspot engine needs to be updated. If it needs to be updated, a new hotspot engine is generated to replace the old hotspot engine. This can avoid the process of generating the hotspot engine affecting the efficiency of message processing and ensure the timely update of the hotspot engine. At the same time, the hotspot engine can be asynchronously updated through the first state identifier and the second state identifier. For example, if the hotspot rule set is updated during the update of the hotspot engine, it can be recorded and identified through the first state identifier, so that the hotspot engine can be further updated to ensure that the updated content is not missed.

[0086] As shown in FIG3 , the embodiment of the present application provides a method for updating a hotspot engine, comprising the following steps:

[0087] Step 301, obtaining target traffic to be identified.

[0088] Step 302, determine whether there is a hotspot engine.

[0089] If yes, execute step 303; otherwise, execute step 306.

[0090] Step 303: Identify the target traffic through the hotspot engine.

[0091] Among them, the hotspot engine is built based on a hotspot rule set, and the hotspot rule set contains hotspot rules that meet preset traffic hit conditions.

[0092] If the target hotspot rule in the hotspot rule set is hit, step 304 is executed; if the hotspot rule set is not hit, step 305 is executed.

[0093] Step 304, based on a preset heat value increase strategy, increase the heat value of the target hotspot rule, and based on a preset heat value decrease strategy, decrease the heat values ​​of other hotspot rules in the hotspot rule set except the target hotspot rule.

[0094] Step 305: based on a preset heat value reduction strategy, reduce the heat values ​​of all hot spot rules in the hot spot rule set.

[0095] Step 306: Identify the target traffic through the application identification engine.

[0096] If the target matching rule corresponding to the application identification engine is hit, step 308 is executed; if the target matching rule corresponding to the application identification engine is not hit, step 312 is executed.

[0097] Step 307: Add the target matching rule as a hotspot rule to the hotspot rule set, use the preset heat value as the heat value of the target matching rule, and increase the first state flag corresponding to the hotspot rule set by 1.

[0098] Step 308, if there is a hotspot rule with a heat value less than or equal to the preset threshold in the hotspot rule set, the hotspot rule with a heat value less than or equal to the preset threshold is deleted from the hotspot rule set, and the first state flag corresponding to the hotspot rule set is increased by 1.

[0099] Step 309, obtaining the second state identifier corresponding to the hotspot engine.

[0100] Step 310, determining whether the first state identifier is consistent with the second state identifier.

[0101] If not, execute step 311 ; otherwise, execute step 312 .

[0102] Step 311, regenerate the hotspot engine based on the updated hotspot rule set.

[0103] Step 312, end the process.

[0104] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0105] Based on the same inventive concept, the embodiment of the present application also provides a flow identification device for implementing the flow identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more flow identification device embodiments provided below can refer to the limitations on the flow identification method above, and will not be repeated here.

[0106] In an exemplary embodiment, as shown in FIG. 4 , a flow identification device is provided, the device comprising: an acquisition module 410, a determination module 420, a first output module 430 and a second output module 440, wherein:

[0107] An acquisition module 410 is used to acquire target traffic to be identified;

[0108] A determination module 420 is used to identify the target traffic through a hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in the application identification engine that meet preset traffic hit conditions;

[0109] A first output module 430 is configured to output an application identification result corresponding to the target hotspot rule if the first identification result hits a target hotspot rule in the hotspot rule set;

[0110] The second output module 440 is used to identify the target traffic through the application identification engine and output a second identification result if the first identification result does not hit the hotspot rule set.

[0111] In one embodiment, each hotspot rule in the hotspot rule set has a heat value; and the apparatus further comprises:

[0112] An updating module, used for updating the hotspot rules in the hotspot rule set and / or the heat value of each of the hotspot rules based on the first recognition result and / or the second recognition result;

[0113] The generation module is used to regenerate the hotspot engine based on the updated hotspot rule set.

[0114] In one embodiment, the update module is specifically used to:

[0115] If the first recognition result is a hit on a target hotspot rule in the hotspot rule set, then based on a preset heat value increase strategy, the heat value of the target hotspot rule is increased, and based on a preset heat value decrease strategy, the heat values ​​of other hotspot rules in the hotspot rule set except the target hotspot rule are decreased;

[0116] If the first recognition result is a miss in the hotspot rule set, the heat values ​​of all hotspot rules in the hotspot rule set are reduced based on a preset heat value reduction strategy.

[0117] In one embodiment, the update module is specifically used to:

[0118] If the second recognition result hits the target matching rule corresponding to the application recognition engine, the target matching rule is added as a hotspot rule to the hotspot rule set, and the preset heat value is used as the heat value of the newly added heat rule.

[0119] In one embodiment, the device further comprises:

[0120] A first adding module is used to delete the hotspot rule whose heat value is less than or equal to the preset threshold from the hotspot rule set when there is a hotspot rule whose heat value is less than or equal to the preset threshold in the hotspot rule set, and add 1 to the first state identifier corresponding to the hotspot rule set; and / or,

[0121] The second adding module is used to add 1 to the first state identifier corresponding to the hotspot rule set after adding the target matching rule to the hotspot rule set.

[0122] In one embodiment, the generating module is specifically used for:

[0123] Obtain a second state identifier corresponding to the hotspot engine;

[0124] If the first state identifier is inconsistent with the second state identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

[0125] Each module in the above-mentioned traffic identification device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0126] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a traffic identification method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0127] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0128] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned traffic identification method when executing the computer program.

[0129] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned traffic identification method are implemented.

[0130] In one embodiment, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned traffic identification method are implemented.

[0131] It should be noted that the user information (including but not limited to user device identification, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0132] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0134] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A flow identification method, characterized in that: The method comprises: Obtain the target traffic to be identified; The target traffic is identified by a hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in an application identification engine that meet preset traffic hit conditions; If the first recognition result hits a target hotspot rule in the hotspot rule set, outputting an application recognition result corresponding to the target hotspot rule; If the first identification result is a miss in the hotspot rule set, the target traffic is identified by the application identification engine to output a second identification result.

2. The method according to claim 1, characterized in that Each hotspot rule in the hotspot rule set has a heat value; the method further includes: Based on the first recognition result and / or the second recognition result, updating the hotspot rules in the hotspot rule set and / or the heat value of each of the hotspot rules; Regenerate the hotspot engine based on the updated hotspot rule set.

3. The method according to claim 2, characterized in that The updating of the heat value of each of the hotspot rules in the hotspot rule set based on the first recognition result and / or the second recognition result includes: If the first recognition result is a hit on a target hotspot rule in the hotspot rule set, then based on a preset heat value increase strategy, the heat value of the target hotspot rule is increased, and based on a preset heat value decrease strategy, the heat values ​​of other hotspot rules in the hotspot rule set except the target hotspot rule are decreased; If the first recognition result is a miss in the hotspot rule set, the heat values ​​of all hotspot rules in the hotspot rule set are reduced based on a preset heat value reduction strategy.

4. The method according to claim 2, characterized in that: The updating of the heat value of each of the hotspot rules in the hotspot rule set based on the first recognition result and / or the second recognition result includes: If the second recognition result hits the target matching rule corresponding to the application recognition engine, the target matching rule is added as a hotspot rule to the hotspot rule set, and the preset heat value is used as the heat value of the newly added heat rule.

5. The method according to claim 3 or 4, characterized in that: Before regenerating the hotspot engine based on the updated hotspot rule set, the method further includes: In the hotspot rule set, if there is a hotspot rule whose heat value is less than or equal to a preset threshold, the hotspot rule whose heat value is less than or equal to the preset threshold is deleted from the hotspot rule set, and the first state flag corresponding to the hotspot rule set is increased by 1; and / or, After the target matching rule is added to the hotspot rule set, the first state flag corresponding to the hotspot rule set is increased by 1.

6. The method according to claim 5, characterized in that The regenerating the hotspot engine based on the updated hotspot rule set includes: Obtain a second state identifier corresponding to the hotspot engine; If the first state identifier is inconsistent with the second state identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

7. A flow identification device, characterized in that: The device comprises: An acquisition module, used to acquire target traffic to be identified; A determination module, used to identify the target traffic through a hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in an application identification engine that meet preset traffic hit conditions; A first output module, configured to output an application identification result corresponding to the target hotspot rule if the first identification result hits a target hotspot rule in the hotspot rule set; The second output module is used to identify the target traffic through the application identification engine and output a second identification result if the first identification result does not hit the hotspot rule set.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images