Application identification method and device, equipment, storage medium and computer program product

Abstract

The invention discloses an application identification method, device and equipment, a storage medium and a computer program product. The method comprises the steps of obtaining a priority corresponding to each feature of an application in a message based on a random forest feature extractor; performing feature recognition rule matching on each feature applied in the message in sequence according to the priority to obtain a target feature recognition rule; and determining the application type of the message through a feature library and the target feature recognition rule. According to the method and the device, the importance degree of each feature applied in the message for judging the application type of the message is determined based on the random forest feature extractor, and then the important features are identified preferentially, so that the application type of the message is determined, the application identification efficiency is improved, and even if corresponding fields of a plurality of application features are the same, the application identification efficiency is improved. And the application type of the message can be accurately determined, so that the technical problem of relatively low efficiency and accuracy of application identification in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an application identification method, device, equipment, storage medium and computer program product. Background Art

[0002] With the explosive growth of application scale and traffic, many applications maliciously occupy network resources, causing varying degrees of network congestion. Therefore, users urgently need to control network applications that maliciously occupy network resources.

[0003] In the related technologies, the most basic technology of business perception technology, feature recognition technology, is used to identify applications by matching feature codes in data packets, and implement refined QoS (Quality of Service) policy control based on the application recognition results, thereby reducing the malicious occupation of network resources by network applications. Different applications usually use different protocols, and different application protocols have their own characteristics, which may be specific ports, specific strings or specific bit sequences. The characteristics that can identify the protocol are called feature codes.

[0004] However, feature recognition technology generally requires traversal and recognition of multiple features, such as protocols, quintuples, DSCP (Differentiated Services Code Point), DNS (Domain Name System) domain names, etc., in a pre-set order. This recognition technology is not only inefficient, but also has low recognition accuracy when the corresponding fields of multiple application features are the same. Summary of the invention

[0005] The present invention provides an application identification method, device, equipment, storage medium and computer program product, which can solve the technical problem of low efficiency and accuracy of application identification in the prior art.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides an application identification method, the method comprising:

[0008] Based on the random forest feature extractor, the priority corresponding to each feature used in the message is obtained;

[0009] According to the priority, feature recognition rules are matched on each feature applied in the message in turn to obtain a target feature recognition rule;

[0010] The application type of the message is determined through the feature library and the target feature recognition rule.

[0011] In a second aspect, an embodiment of the present invention provides an application identification device, the device comprising:

[0012] An information acquisition module is configured to obtain a priority corresponding to each feature applied in the message based on a random forest feature extractor;

[0013] A feature matching module is configured to match feature recognition rules for each feature applied in the message in turn according to the priority to obtain a target feature recognition rule;

[0014] The application identification module is configured to determine the application type of the message through the feature library and the target feature identification rule.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: a memory, a processor; the processor is used to read and execute a computer program stored in the memory to implement the steps of the aforementioned application identification method.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions, when executed, implement the steps of the aforementioned application identification method.

[0017] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the aforementioned application identification method.

[0018] The beneficial effects brought by the technical solution provided by the embodiment of the present invention include:

[0019] Based on the random forest feature extractor, the priority corresponding to each feature of the application in the message is obtained; according to the priority, the feature recognition rule is matched for each feature of the application in the message in turn to obtain the target feature recognition rule; through the feature library and the target feature recognition rule, the application type of the message is determined. Through the present invention, the importance of each feature of the application in the message for judging the application type of the message is determined based on the random forest feature extractor, and then the important features are preferentially identified, so as to determine the application type of the message, improve the efficiency of application identification, and even if the corresponding fields of multiple application features are the same, the application type of the message can be accurately determined, solving the technical problems of low efficiency and accuracy of application identification existing in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A schematic diagram of a flow chart of a first embodiment of an application identification method of the present invention;

[0022] Figure 2 A schematic diagram of the operation logic of a random forest feature extractor in one embodiment of the present invention;

[0023] Figure 3 A schematic diagram of a part of a feature library in an embodiment of the present invention;

[0024] Figure 4 A schematic diagram of the training and convergence process of a random forest model in one embodiment of the present invention;

[0025] Figure 5 Identify sequence diagrams for application of the present invention;

[0026] Figure 6 A schematic diagram of the first packet identification and feature identification process in one embodiment of the present invention;

[0027] Figure 7 A schematic diagram of a flow chart of a second embodiment of an application identification method of the present invention;

[0028] Figure 8 A schematic diagram of functional modules of an embodiment of an application identification device of the present invention;

[0029] Fig. 9 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0032] In a first aspect, an embodiment of the present invention provides an application identification method.

[0033] In one embodiment, referring to Figure 1, Figure 1 FIG. 1 is a flow chart of the first embodiment of the application identification method of the present invention. Figure 1 As shown, the application identification method includes:

[0034] Step S10, obtaining the priority corresponding to each feature applied in the message based on the random forest feature extractor;

[0035] In this embodiment, since different applications usually use different protocols, and the characteristics of the protocol are not only reflected in a single message, the characteristics of some protocol messages are distributed in multiple messages, it is necessary to collect each feature of the application in multiple messages.

[0036] Random Forest is a parallel ensemble learning algorithm in machine learning. The basic learner of RF is the decision tree, and multiple trees form a forest. The "randomness" lies in the random selection of features. RF can perform classification or regression tasks, and when performing classification, it can sort and extract features from best to worst.

[0037] Therefore, the priority corresponding to each feature applied in the message can be obtained through the random forest feature extractor, that is, the importance of each feature applied in the message for judging the application type of the message can be determined, so as to give priority to identifying important features, thereby determining the application type of the message and improving the efficiency of application identification.

[0038] Specifically, refer to Figure 2 , Figure 2 FIG. 1 is a schematic diagram of the operation logic of a random forest feature extractor in one embodiment of the present invention. Figure 2 As shown in the figure, using the underlying logic of the decision tree, the base learner of the random forest algorithm, each feature of the application in the message is sip, dip, sport, dport, dscp and domai as an example, where the output label corresponding to the feature sip and feature dscp is 1, and the output label corresponding to other feature values ​​is 0. Therefore, it can be understood that the existence of sip and dscp has a positive effect on judging whether the message is an application, while the existence of other features has a negative effect or invalid features on judging whether it is an application. Then calculate the importance of each feature through OOB error, and then sort them to get the priority corresponding to each feature of the application in the message, that is, the higher the importance of the feature, the higher the priority. Among them, the output label of 0 is considered to have no value, and the output label of 1 is considered to have a value.

[0039] Step S20, matching feature recognition rules for each feature applied in the message in turn according to the priority to obtain a target feature recognition rule;

[0040] In this embodiment, taking each feature applied in the message as sip, dip, sport, dport, dscp and domai as an example, if the priorities corresponding to each feature applied in the message obtained in step S10 are sip, dscp, dip, sport, dport and domai from high to low, the feature sip with the highest priority is first matched with the feature identification rule. The feature identification rule includes: protocol identification rule, protocol + port information identification rule, five-tuple + DSCP code value identification rule and DNS identification rule, that is, the feature sip with the highest priority is first matched with the protocol identification rule, protocol + port information identification rule, five-tuple + DSCP code value identification rule and DNS identification rule. Since the feature SIP (Session Initialization Protocol) with the highest priority is a multimedia communication protocol formulated by IETF (Internet Engineering Task Force), the feature sip with the highest priority is matched with the protocol identification rule, that is, the target feature identification rule is the protocol identification rule.

[0041] Optionally, in one embodiment, the feature identification rules include: protocol identification rules, protocol+port information identification rules, quintuple+DSCP code value identification rules and DNS identification rules.

[0042] In this embodiment, the protocol identification rule is to identify the protocol using a protocol linear table based on the protocol information carried in the message.

[0043] The protocol + port information identification rule generates corresponding protocol port table entries based on the IP address, protocol, and port information carried in the message.

[0044] The five-tuple + DSCP code value identification rule is to identify the application through advanced ACL rules based on the five-tuple + DSCP information defined by the user. The five-tuple refers to the source and destination IP addresses, protocol type, and source and destination port numbers of the application message.

[0045] The DNS identification rule is that the PC initiates a DNS request to the network side through the AR router, and then the DNS server sends a DNS response message to the AR. The AR parses the domain name and IP address information in the response message, searches for APP information in the feature library based on the domain name, associates the APP information with the IP address, and generates a table entry. Finally, the AR router sends the DNS response message back to the PC. Subsequent messages from the PC accessing the domain name can directly identify the application.

[0046] Step S30, determining the application type of the message through the feature library and the target feature recognition rule.

[0047] In this embodiment, since the feature library refers to an XML file of the correspondence between features and application types, and the correspondence between features and application types is many-to-one, after determining the target feature recognition rule, each feature corresponding to the target feature recognition rule is used as the target feature, and the application type corresponding to each target feature is searched in the feature library. In theory, the application type corresponding to each target feature is the same application type, and the application type is the application type of the message.

[0048] Optionally, in one embodiment, step S30 includes:

[0049] Taking each feature corresponding to the target feature recognition rule as the target feature;

[0050] Searching a feature library based on each of the target features to obtain an application type corresponding to each of the target features, wherein the corresponding relationship between the features in the feature library and the application types is many-to-one;

[0051] If the application types corresponding to each of the target features are the same, the application type corresponding to any one of the target features is used as the application type of the message.

[0052] In this embodiment, the various features required by the target feature recognition rule are the various features corresponding to the target feature recognition rule. The feature library refers to an XML file of the correspondence between features and application types, and the correspondence between features and application types is many-to-one.

[0053] Take the feature identification rule of the highest priority feature sip matching as an example as the protocol identification rule. Figure 3 , Figure 3 FIG. 1 is a schematic diagram of a partial feature library in one embodiment of the present invention. Figure 3 As shown, the feature corresponding to the protocol identification rule is the protocol information carried in the message, that is, the feature sip. Through the feature sip=13.1.1.1 applied in the message, it can be found from the feature database that the application type corresponding to the feature sip=13.1.1.1 is bit_Torrent.

[0054] In another embodiment, if the target feature identification rule is a protocol + port information identification rule, the features corresponding to the protocol + port information identification rule are the IP address, protocol and port information carried in the message, that is, the target feature is the IP address, protocol and port information carried in the message. The application type corresponding to the IP address, protocol and port information in the feature library is searched. If the application types corresponding to the IP address, protocol and port information are the same, the application type corresponding to any target feature is used as the application type of the message. When the corresponding fields of application type 1 and application type 2 are the same, for example, the port matching of protocol + port identification is the same, the application types corresponding to the IP address, protocol and port information will be different, that is, it is impossible to determine whether the application type corresponding to the IP address, protocol and port information is application type 1 or application type 2. At this time, the feature with the second priority is used as the feature with the highest priority, and the feature identification rule matching is performed again to obtain the target feature identification rule. The step of determining the application type of the message through the feature library and the target feature identification rule can accurately determine the application type of the message, avoiding the situation that when the corresponding fields of multiple application features are the same, it cannot be accurately identified.

[0055] In this embodiment, the priority corresponding to each feature of the application in the message is obtained based on the random forest feature extractor; according to the priority, the feature recognition rule is matched for each feature of the application in the message in turn to obtain the target feature recognition rule; the application type of the message is determined through the feature library and the target feature recognition rule. Through this embodiment, the importance of each feature of the application in the message for judging the application type of the message is determined based on the random forest feature extractor, and then the important features are identified first, so as to determine the application type of the message, improve the efficiency of application identification, and even if the corresponding fields of multiple application features are the same, the application type of the message can be accurately determined, solving the technical problems of low efficiency and accuracy of application identification existing in the related art.

[0056] Optionally, in one embodiment, referring to Figure 7 , Figure 7 FIG. 2 is a flow chart of the second embodiment of the application identification method of the present invention. Figure 7 As shown, before step S10, it includes:

[0057] Step S001, when a random forest enable signal is received, the random forest model is trained and converged based on a data set to obtain a random forest feature extractor, wherein the data set includes each feature applied in the message and an output label corresponding to each feature.

[0058] In this embodiment, refer to Figure 4 , Figure 4 FIG. 1 is a schematic diagram of the training and convergence process of a random forest model in one embodiment of the present invention. Figure 4As shown, the original data set is a two-dimensional array of the mapping of the feature library, rows are output labels corresponding to the features, columns are features, including quintuples, DSCP, DNS domain names, protocols, ports, triples, etc.

[0059] Random sampling: Randomness is reflected in two aspects: random data set: sampling with replacement is adopted; random features: each feature does not necessarily have a value;

[0060] Dataset: The dataset accounts for 75% of the original dataset, and the remaining 25% is the validation set. When training the random forest model based on the dataset, a dataset is used to train the random forest model. The dataset usually consists of multiple records, each of which contains the input features and the output label corresponding to the features (0: not an application, 1: an application). The purpose of training is to establish a black box system that can accurately predict new datasets by learning the patterns and rules in the dataset. During the training process, there are generally loss functions and model performance indicators to evaluate whether the current black box system has successfully learned, which is the convergence process.

[0061] Reference Figure 5 , Figure 5 The present invention is applied to identify the sequence diagram. Figure 5 As shown, when the random forest enable signal is received, the random forest model is trained and converged based on the data set to obtain a random forest feature extractor. The training and convergence of the random forest model is a one-time preprocessing, and the training and convergence process is only required when the random forest enable signal is received for the first time. The random forest feature extractor can sort the features by weight, so that higher priority features can be extracted. Specifically: the importance of feature i is calculated through the OOB (Out-Of-Bag) error.

[0062]

[0063] Where N is the total number of features, n i is the number of decision trees where feature i is sampled, e ij is the prediction error of feature i in the jth decision tree. The smaller the value of oob_error, the more important feature i is.

[0064] In another embodiment, if the random forest configuration enable signal is not received, the application type of the message is determined directly through the general application identification process, that is, the first packet identification and feature identification process.

[0065] Optionally, in one embodiment, continue to refer to Figure 7 , after the step of matching the feature identification rule for each feature applied in the message in sequence according to the priority, comprising:

[0066] Step S40: If each feature of the application in the message cannot match the feature recognition rule, the application type of the message is determined through first packet recognition and feature recognition.

[0067] In this embodiment, continue to refer to Figure 5 , if the feature recognition rule is matched for each feature applied in the message in turn according to the priority corresponding to each feature applied in the message, and the target feature recognition rule is obtained, that is, the feature hits the application recognition rule, then the application type of the message is determined through the feature library and the target feature recognition rule. If each feature applied in the message cannot match the feature recognition rule, that is, the feature hits the application recognition rule and fails, then the application type of the message is determined through the general process of application recognition, that is, the first packet recognition and feature recognition process. This process in this embodiment is an improved general process for message application recognition.

[0068] Specifically, refer to Figure 6 , Figure 6 FIG. 1 is a schematic diagram of the first packet identification and feature identification process in one embodiment of the present invention. Figure 6 As shown in the figure, SAC (Smart Application Control) refers to the use of application identification technology to quickly and accurately identify the application to which the message belongs, so as to facilitate the subsequent formulation of intelligent routing, QoS, application experience optimization, security policies, etc. based on the application.

[0069] There are two implementation methods for SAC application identification:

[0070] First Packet Identification (FPI) is a function that identifies the corresponding application by matching the first packet of a flow.

[0071] Feature recognition, also known as SA (Service Awareness) application recognition, is a function that requires matching multiple traffic packets to identify the corresponding application.

[0072] In the general process of application identification, the first packet identification is performed first. If the message hits the first packet identification table, the FPI identification result is obtained and feature identification is no longer performed. After obtaining the FPI identification result, it is determined whether the application type of the message is the expected target application type. If the application type of the message is not the expected target application type, the message is discarded; if the application type of the message is the expected target application type, the message is forwarded at Layer 3. First packet identification includes the device identifying a specific application from the first message of a flow, through protocol identification, through five-tuple + DSCP identification, through DNS domain name identification, and through protocol + port information identification. Among them, the five-tuple refers to the source IP address, destination IP address, protocol type, source port number, and destination port number of the application message.

[0073] If the message does not hit the first packet identification table, the message is subjected to feature identification, that is, through triplet + keyword identification, to obtain the feature identification result. After obtaining the feature identification result, the message is forwarded at three layers. Among them, the triplet refers to the server address, protocol type and port number; the keyword refers to the feature of the data packet or data stream corresponding to the application, which can uniquely identify the application.

[0074] In a second aspect, an embodiment of the present invention further provides an application identification device.

[0075] In one embodiment, referring to Figure 8 , Figure 8 FIG. 1 is a schematic diagram of the functional modules of an embodiment of an application identification device of the present invention. Figure 8 As shown, the application identification device includes:

[0076] The information acquisition module 10 is configured to obtain the priority corresponding to each feature applied in the message based on the random forest feature extractor;

[0077] The feature matching module 20 is configured to match the feature recognition rule for each feature applied in the message in turn according to the priority to obtain a target feature recognition rule;

[0078] The application identification module 30 is configured to determine the application type of the message through the feature library and the target feature identification rule.

[0079] Optionally, in one embodiment, the application identification device further includes a model training module configured to:

[0080] When a random forest enable signal is received, the random forest model is trained and converged based on a data set to obtain a random forest feature extractor, wherein the data set includes each feature applied in the message and an output label corresponding to each feature.

[0081] Optionally, in one embodiment, the feature identification rules include: protocol identification rules, protocol+port information identification rules, quintuple+dscp encoding value identification rules and DNS identification rules.

[0082] Optionally, in one embodiment, the application identification module 30 is further configured to:

[0083] If each feature of the application in the message cannot match the feature recognition rule, the application type of the message is determined through first packet recognition and feature recognition.

[0084] Optionally, in one embodiment, the application identification module 30 is further configured to:

[0085] Taking each feature corresponding to the target feature recognition rule as the target feature;

[0086] Searching a feature library based on each of the target features to obtain an application type corresponding to each of the target features, wherein the corresponding relationship between the features in the feature library and the application types is many-to-one;

[0087] If the application types corresponding to each of the target features are the same, the application type corresponding to any one of the target features is used as the application type of the message.

[0088] Among them, the functional implementation of each module in the above-mentioned application identification device corresponds to each step in the above-mentioned application identification method embodiment, and its functions and implementation processes are no longer repeated here.

[0089] In a third aspect, an embodiment of the present invention further provides an electronic device, whose structure is as follows: Fig. 9 As shown, it includes: a memory and a processor, wherein the processor is used to read and execute a computer program stored in the memory to implement the aforementioned application identification method.

[0090] In a fourth aspect, an embodiment of the present invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions implement the aforementioned application identification method when executed.

[0091] In a fifth aspect, an embodiment of the present invention provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the various processes of the above-mentioned application identification method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0092] Finally, it should be noted that: in some processes described in the embodiments of the present invention, multiple operations or steps appearing in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present invention or may be executed in parallel, and the sequence number of the operation is only used to distinguish between different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0093] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An application identification method, characterized in that: The method comprises: Based on the random forest feature extractor, the priority corresponding to each feature used in the message is obtained; According to the priority, feature recognition rules are matched on each feature applied in the message in turn to obtain a target feature recognition rule; The application type of the message is determined through the feature library and the target feature recognition rule.

2. The application identification method according to claim 1, characterized in that: Before the step of obtaining the priority corresponding to each feature applied in the message based on the random forest feature extractor, the method includes: When a random forest enable signal is received, the random forest model is trained and converged based on a data set to obtain a random forest feature extractor, wherein the data set includes each feature applied in the message and an output label corresponding to each feature.

3. The application identification method according to claim 1, characterized in that: The feature identification rules include: protocol identification rules, protocol+port information identification rules, quintuple+dscp encoding value identification rules and DNS identification rules.

4. The application identification method according to claim 1 or 3, characterized in that: After the step of matching the feature identification rule for each feature applied in the message in sequence according to the priority, the method further includes: If each feature of the application in the message cannot match the feature recognition rule, the application type of the message is determined through first packet recognition and feature recognition.

5. The application identification method according to claim 1, characterized in that: The step of determining the application type of the message through the feature library and the target feature recognition rule includes: Taking each feature corresponding to the target feature recognition rule as the target feature; Searching a feature library based on each of the target features to obtain an application type corresponding to each of the target features, wherein the corresponding relationship between the features in the feature library and the application types is many-to-one; If the application types corresponding to each of the target features are the same, the application type corresponding to any one of the target features is used as the application type of the message.

6. An application identification device, characterized in that: The device comprises: An information acquisition module is configured to obtain a priority corresponding to each feature applied in the message based on a random forest feature extractor; A feature matching module is configured to match feature recognition rules for each feature applied in the message in turn according to the priority to obtain a target feature recognition rule; The application identification module is configured to determine the application type of the message through the feature library and the target feature identification rule.

7. The application identification device according to claim 6, characterized in that: The application identification module is configured to: Taking each feature corresponding to the target feature recognition rule as the target feature; Searching a feature library based on each of the target features to obtain an application type corresponding to each of the target features, wherein the corresponding relationship between the features in the feature library and the application types is many-to-one; If the application types corresponding to each of the target features are the same, the application type corresponding to any one of the target features is used as the application type of the message.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the application identification method as described in any one of claims 1 to 5 are implemented.

9. An electronic device, characterized in that: include: Memory and processor; The processor is used to read and execute the computer program stored in the memory to implement the steps of the application identification method as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed, the steps of the application identification method according to any one of claims 1 to 5 are implemented.

Images