Application identification blocking method

Abstract

The invention discloses an application identification blocking method, which comprises the following steps of: acquiring a session data packet of an application program between a client and a server, extracting application features including basic features, domain name features and content features according to quintuple information, and constructing an application feature library corresponding to the application program; the application feature library is built in a network forwarding device, and when a client establishes a new session, the network forwarding device extracts features of a session data packet passing through, compares the features with the application feature library to perform application identification, and determines an application program to which the new session belongs; and performing disposition including blocking, QoS (Quality of Service) and auditing on the new session according to user presetting. According to the method and the device, accurate identification of the application program can be realized, and a user can conveniently perform corresponding processing on the application program.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic management, and in particular to an application identification and blocking method. Background Art

[0002] In the field of network traffic management and security, accurately identifying applications (APPs) in the network is crucial to maintaining network security, optimizing network performance, and enforcing compliance policies. Traditional application identification methods mainly rely on manual analysis of network traffic packets, a process that consumes a lot of human resources. Professionals must deeply analyze the characteristics of data packets, including but not limited to port numbers, protocol types, packet structures, etc., to establish application identification rules. However, this method has some limitations.

[0003] First, as applications are constantly updated and upgraded, the original identification rules may no longer apply, and professionals are required to re-analyze the traffic characteristics of the new version. This process is not only time-consuming and labor-intensive, but also increases maintenance costs. Second, it is difficult for traditional identification methods to accurately filter specific applications without affecting other applications. Since many applications may use the same port or protocol, or have similarities in data packet structure, misjudgment may occur when filtering is implemented, affecting the normal use of the network.

[0004] Moreover, existing apps usually use many third-party services, such as location services, third-party login services, message push services, third-party advertising, etc. A specific third-party service is used in various apps. For example, the WeChat login service is provided by a certain company, and this function is integrated into a large number of apps. If the network traffic generated by these third-party services is used as an identification feature, it will lead to application identification errors. What is even more difficult to deal with is that multiple apps developed by the same company have serious overlapping features because they use various services of the company. It is often difficult to accurately identify multiple apps developed by the same company. Summary of the invention

[0005] In view of the above problems in the prior art, the present invention provides an application identification blocking method, which forms an application identification feature library in an automated manner and determines byte features as application identification features to facilitate accurate application identification.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0007] An application identification and blocking method comprises the following steps:

[0008] S100, obtaining a session data packet of an application between a client and a server, extracting application features including basic features, domain name features, and content features according to the five-tuple information, and constructing an application feature library corresponding to the application;

[0009] S200, the application feature library is built into the network forwarding device. When the client establishes a new session, the network forwarding device extracts the features of the session data packets passing through, compares them with the application feature library to perform application identification, and determines the application program to which the new session belongs;

[0010] S300: Based on the user's pre-settings, the new session is processed including blocking, QoS, and auditing.

[0011] Specifically, in step S100, the basic features include the session protocol, the protocol port number, the payload length of the first message with payload content sent by the client, and the payload length of the first message with payload content responded by the server;

[0012] The domain name feature is the domain name of the server, including the top-level domain name and subdomain name of the server;

[0013] The content feature comes from the payload content of the session and is configured to have a maximum length of 8 bytes. For HTTP protocol sessions, the content of the 0th byte and the 5th to 11th bytes in the HTTP request packet are selected to form an eight-byte content feature. For other protocols including TCP and UDP protocols, the content of the first four bytes of the payload in the first request message with payload content sent by the client to the server and the content of the first four bytes of the payload in the first response message with payload content sent by the server to the client are selected to form an eight-byte content feature.

[0014] Specifically, the method for processing the domain name feature includes:

[0015] For multiple servers with similar numbers that provide similar services, the domain name features are merged by ignoring the number in the last segment of the server domain name;

[0016] For multiple server domains that are used in only one application and contain the same top-level domain name, merge the domain name characteristics by ignoring the subdomains and retaining the top-level domain name;

[0017] For the domain name features generated by an application that calls a third-party function, the domain name features corresponding to the application are optimized and purified by eliminating the domain name features generated by the third-party function itself.

[0018] Specifically, the method for processing the content feature includes:

[0019] S121, establishing a temporary feature table according to the extracted content features;

[0020] S122, deduplicating content features, and deleting content features with identical byte features that appear in session data packets of multiple applications;

[0021] S123, identifying content features with completely identical byte features in the same application as duplicate features, merging the duplicate features, and marking the number of occurrences of all content features;

[0022] S124, determining whether the number of occurrences of a content feature in the temporary feature table reaches a set threshold, if so, moving the content feature whose number of occurrences reaches the set threshold to the formal feature table, and proceeding to the next step for the remaining content features, if not, directly proceeding to the next step;

[0023] S125, identifying content features with the same partial byte features in the same application as similar features, merging the similar features by algorithm, and marking the number of occurrences of the same similar feature;

[0024] S126, determining whether the number of occurrences of similar features in the temporary feature table reaches a set threshold, if so, moving the similar features whose number of occurrences reaches the set threshold to the formal feature table, and proceeding to the next step for the remaining content features, if not, directly proceeding to the next step;

[0025] S127: Detect the number of content features remaining in the temporary feature table and the number of occurrences of each content feature. If the number of these content features is greater than a set threshold and the number of occurrences of each content feature is less than the set threshold, the corresponding content feature is considered to be a fuzzy feature.

[0026] Specifically, the set threshold corresponding to the number of occurrences of the content feature in step S124 includes a first threshold and a second threshold, the first threshold being a set ratio of the total number of occurrences of all content features in the current temporary feature table; the second threshold being calculated as follows: under the condition that no content feature in the current temporary feature table satisfies the first threshold, the difference between the ratio of the highest number of occurrences to the total number of occurrences and the ratio of the second highest number of occurrences to the total number of occurrences;

[0027] When determining the relationship between the number of occurrences and the set threshold, the relationship between the number of occurrences and the first threshold is determined first. If the relationship is not satisfied, the relationship between the number of occurrences and the second threshold is determined.

[0028] Specifically, the process of algorithmically merging similar features in step S125 includes:

[0029] Traverse each content feature in the current temporary feature table, try to remove certain byte features of the content feature one by one to form a new feature, compare this new feature with other content features one by one, determine whether the new feature can cover other content features of the same application and does not contain features of other applications, merge the content features that can be covered as similar features, and calculate the total number of content features that can be covered as the number of occurrences of the merged similar features.

[0030] Specifically, the process in which the network forwarding device extracts the features of the session data packets passing through in step S200 and compares the features with the application feature library to perform application identification includes:

[0031] S211, determine whether the extracted features contain domain name features, if so, proceed to the next step, otherwise jump to step S213;

[0032] S212, query whether the domain name feature in the extracted feature matches the domain name feature in the application feature library, if so, return the result of application identification, otherwise proceed to the next step;

[0033] S213: Perform content recognition on the extracted features to determine whether they match the content features in the application feature library. If so, return the result of application recognition; otherwise, return the result that application did not recognize.

[0034] Specifically, when performing content identification in step S213, the content features in the application feature library are matched one by one, and it is first determined whether the basic features in the extracted features are matched. If so, it is then determined whether the content features in the extracted features are matched.

[0035] Specifically, after the domain name feature or content feature is judged to be a hit, the application is also identified through the fuzzy features in the application feature library, including: starting a timer associated with the application, designing a timer cycle, matching the content features in the extracted features with the fuzzy features in the application feature library, and determining the type of the application feature based on the hit structure of the fuzzy features.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] (1) The present invention ingeniously utilizes the byte portion of the application protocol data packet that is customized by the developer as the content feature to construct an application identification feature library and automatically determine the byte feature as the application identification feature, which facilitates the formation of the application identification feature library and the formation of the application identification feature, thereby better realizing application identification. The present invention is ingenious in design, novel in conception, and convenient in implementation, and is suitable for application in application identification of network devices.

[0038] (2) The present invention uses repeated feature merging and similar feature merging in sequence, effectively reducing the number of content features and better determining the byte features in the content features used for application identification, thereby effectively improving the accuracy of application identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of the overall process of an embodiment of the present invention.

[0040] Figure 2 The figure is a flow chart of constructing a content feature table in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The present invention is further described below in conjunction with the accompanying drawings and examples. The embodiments of the present invention include but are not limited to the following examples.

[0042] Example

[0043] like Figure 1 to Figure 2 As shown, the application identifies the blocking method, including the following steps:

[0044] S100, obtaining a session data packet of an application between a client and a server, extracting application features including basic features, domain name features, and content features according to the five-tuple information, and constructing an application feature library corresponding to the application;

[0045] S200, the application feature library is built into the network forwarding device. When the client establishes a new session, the network forwarding device extracts the features of the session data packets passing through, compares them with the application feature library to perform application identification, and determines the application program to which the new session belongs;

[0046] S300: Based on the user's pre-settings, the new session is processed including blocking, QoS, and auditing.

[0047] The process of the present invention is carried out in units of sessions, and feature extraction is performed on session data packets. A session is a temporary, interactive information exchange between a client and a server; a session is established at a certain point in time and ends at a later point in time. The five-tuple information includes a determined source IP, source port, destination IP, destination port, and protocol.

[0048] Specifically, in step S100, the basic features include the session protocol, the protocol port number, the payload length of the first message with payload content sent by the client, and the payload length of the first message with payload content responded by the server.

[0049] The domain name feature is the domain name of the server, including the top-level domain name and subdomain name of the server. The domain name feature is first extracted from the high-level protocol of the session (for example, for HTTP protocol, the domain name is extracted from the HOST parameter, and for protocols using TLS, the domain name is extracted from the Server Name). If the high-level protocol does not contain the domain name feature, it is extracted from the DNS protocol. As a clear feature of the session, the domain name feature has a higher priority than the content feature.

[0050] The content feature comes from the payload content of the session, which is configured to have a maximum length of 8 bytes. For HTTP protocol sessions, the content of the 0th byte and the 5th to 11th bytes in the HTTP request packet are selected to form an eight-byte content feature. For other protocols including TCP and UDP protocols, the first four bytes of the payload in the first request message with payload content sent by the client to the server and the first four bytes of the payload in the first response message with payload content sent by the server to the client are selected to form an eight-byte content feature. The use of these contents in each application is customized by the application developer and cannot be known by the user. In actual use, the specific number of bytes selected can be adjusted accordingly based on the size of the number of applications to be identified. For example, when the size of the number of applications to be identified increases, the number of bytes selected increases accordingly.

[0051] The timing of application identification is usually to determine the application to which the session belongs as early as possible in a new session. Depending on the protocol, the timing of identification is slightly different. For HTTP / TLS / QUIC protocols, identification is performed only once when the client sends the first payload message; for TCP / UDP protocols, identification is performed once when the client sends the first payload message, and again when the server responds.

[0052] In terms of application feature collection, conventional application network traffic capture methods are generally used. Usually, an Android phone with root privileges can capture all network packets of the system under root privileges, and all network session quintuples established by the application package name can be viewed through the netstat command. The operation steps are: turn on packet capture on the phone, open the APP, use various functions provided by the APP, exit the APP, and stop packet capture. Save the captured network data packets and the network session quintuple information generated by the application. The advantage is that the package name of the application can be captured, and the network traffic information generated by the application can be accurately obtained without being affected by irrelevant applications.

[0053] Specifically, the method for processing the domain name feature includes:

[0054] For multiple servers that provide similar services and have similar numbers, the domain name features are merged by ignoring the digital number in the last segment of the server domain name; popular apps have huge traffic, and service providers will provide a large number of servers to support the operation of the apps. These servers usually have similar domain names, such as p1.meituan.com and p3.meituan.com. For multiple servers that provide similar services, it is natural to number them. These numbers increase the number of domain names identified by the application. In order to reduce the number of such meaningless features, the number in the last segment of the domain name (that is, the first segment) is ignored, that is, the above two domain names are considered to be p.meituan.com, so as to reduce the total number of domain names and increase the robustness of the algorithm.

[0055] For multiple server domains that are used in only one application and contain the same top-level domain name, merging domain name features by ignoring subdomains and retaining the top-level domain name can help reduce the number of domain name features; for example: merging three domain names a.corp.com, b.corp.com, and c.corp.com into corp.com.

[0056] For the domain name features generated by the application that calls the third-party function, the domain name features corresponding to the application are optimized and purified by eliminating the domain name features generated by the third-party function itself. The optimization and purification process is as follows:

[0057] First, a table is manually created to classify the application package names into organizations, as shown in Table 1.

[0058] Application Name App package name (from Android phone) Organization Name WeChat com.tencent.mm Tencent Mobile QQ com.tencent.mobileqq Tencent Taobao com.taobao.taobao Alibaba

[0059] Table 1 Application name and organization correspondence table

[0060] This table is usually only added when an application is added for the first time. Since the package name can be obtained by capturing the package, the organization to which the application belongs is also easy to obtain, so this table can be easily maintained.

[0061] In the process of capturing packets for collecting application features, all network traffic generated by the application represented by the package name can be extracted, that is, an association between the package name and the network session is established.

[0062] The captured network messages are usually in pcap format, and the network session information is shown in Table 2.

[0063] Package Name protocol Source IP Source Port Target IP Destination Port com.taobao.taobao TLS 192.168.0.5 37523 49.223.124.56 443 com.tencent.mm TCP 192.168.0.5 52523 221.27.53.211 9000

[0064] Table 2 Network session information table

[0065] The captured network traffic generated by the application contains domain name information, such as DNS, HTTP, and HTTPS protocol traffic. By writing code to extract this domain name information, you can get the domain name characteristics of the application.

[0066] Since a top-level domain name (e.g., taobao.com, qq.com) can only belong to one company, if the top-level domain name (including its subdomains) is mainly used in a company's products, it must belong to this company. Based on this idea, it is necessary to extract the top-level domain name from the domain name features, analyze the ratio of the top-level domain name in each company's APP (in a company's application, the number of sessions using the top-level domain name divided by the total number of sessions), and when a top-level domain name appears in multiple company APPs, sort its appearance ratio in each company APP. When the ratio with the highest appearance ratio exceeds the sum of other ratios, it is determined that the top-level domain name belongs to the company. If the requirements are not met, it is considered that the domain name has no definite owner, and the features of the domain name and its subdomains cannot be used as identification features for the application. After determining the domain name owner, remove the features that do not belong to the application developer from the domain name features, that is, the features when the third-party interface called by the application is not used, to reduce the possibility of feature overlap.

[0067] When blocking the traffic of a certain application, it is not desirable to affect other applications. For example, a certain game uses WeChat login. When the characteristics of the game are obtained, its characteristics must include the characteristics of the WeChat login function. Using this feature to block the game may also cause the WeChat login function to be unavailable in other applications. Although the aforementioned domain name processing method can solve some of these problems, it is still necessary to further remove the characteristics of third-party functions in such applications. This method proposes to capture packets for various login methods separately, form multiple sets of data sets for the same application, and obtain an "intersection" between these data sets as the characteristics of the application. Specifically: a. Find the intersection of the domain name characteristics of the application, that is, retain the domain names that appear in the data packets captured under various login methods, and remove the domain names that only appear in some data sets; b. Find the intersection of the content characteristics of the application, that is, retain the data packets with exactly the same eight bytes in the data packets captured under various login methods.

[0068] Specifically, the method for processing the content feature includes:

[0069] S121. Create a temporary feature table based on the extracted content features.

[0070] S122: De-duplicate content features, and delete content features with exactly the same byte features that appear in session data packets of multiple applications.

[0071] S123. Content features with exactly the same byte features in the same application are identified as duplicate features, the duplicate features are merged, and the number of occurrences of all content features is marked.

[0072] S124, determine whether there is a content feature in the temporary feature table whose number of occurrences reaches the set threshold. If so, move the content features whose number of occurrences reaches the set threshold to the formal feature table, and proceed to the next step for the remaining content features. If not, proceed directly to the next step.

[0073] The set threshold corresponding to the number of occurrences of the content feature includes a first threshold and a second threshold, the first threshold being a set ratio of the total number of occurrences of all content features in the current temporary feature table; the second threshold being calculated as follows: under the condition that no content feature in the current temporary feature table satisfies the first threshold, the difference between the ratio of the highest number of occurrences to the total number of occurrences and the ratio of the second highest number of occurrences to the total number of occurrences;

[0074] When determining the relationship between the number of occurrences and the set threshold, the relationship between the number of occurrences and the first threshold is determined first. If the relationship is not satisfied, the relationship between the number of occurrences and the second threshold is determined.

[0075] S125. Content features with the same partial byte features in the same application are identified as similar features, the similar features are merged by algorithm, and the number of occurrences of the same similar feature is marked.

[0076] The process of algorithmically merging similar features includes:

[0077] Traverse each content feature in the current temporary feature table, try to remove certain byte features of the content feature one by one to form a new feature, compare this new feature with other content features one by one, determine whether the new feature can cover other content features of the same application and does not contain features of other applications, merge the content features that can be covered as similar features, and calculate the total number of content features that can be covered as the number of occurrences of the merged similar features.

[0078] Tables 3 to 5 show the process of algorithm merging similar features.

[0079] A. Select the first to N-1 content features respectively, remove one byte feature of the eight-byte features in turn, that is, the case where the "selection mask" is FE, FD, FB, F7, EF, DF, BF, 7F, and become seven-byte features. Compare them with other content features with larger codes, and calculate the number of features that are exactly the same as the seven-byte features. Table 1 shows the original data in the temporary feature table.

[0080] It can be seen from Table 3 that after removing any byte feature from the 1st to 3rd content features, the remaining byte features cannot overlap with the corresponding byte features of other content features and cannot be merged at this time; after removing the 8th byte feature from the 4th content feature, it can match the 5th and 6th content features, that is, merge the 5th and 6th content features with the 4th content feature, and change the "selection mask" of the 4th content feature to FE.

[0081] Thereafter, the content of the temporary feature table is changed to that shown in Table 4.

[0082]

[0083] Table 3 Some original data of temporary feature table

[0084]

[0085] Table 4 Update data of temporary feature table

[0086] B. Further remove more byte features, for example, remove the content of two byte features and transform the content features into a combination of six byte features, that is, the "selection mask" is: FC, FA, F9, F6, F5, F3, E7, EB, ED, EE, CF, AF, 9F, 6F... etc., which are not listed here one by one. If the selected byte feature is exactly the same as other content features, merge the features. Repeat this logic until only one byte feature is selected.

[0087] Among them, when the "selection mask" in the selection of four byte features is B1 (that is, binary: 10110001, the byte corresponding to the bit of 1 is selected), the first content feature is completely matched with the four-byte features of the second and third contents, and the first, second and third content features are merged, and the final temporary feature table is shown in Table 5.

[0088] When merging content features with fewer occurrences, features with more occurrences will no longer be merged to maintain feature accuracy. The method is that after each round of attempts, the features that have been merged are sorted by the number of occurrences. For features with a number of occurrences greater than 30% of the total number of occurrences in the feature table, they are moved from the table to the formal feature table and no longer participate in the next round of merging attempts. If there are no features that exceed 30%, the first percentage is subtracted from the second percentage. If it is greater than 20%, it is also moved to the formal feature table.

[0089]

[0090] Table 5 Updated data after multiple merging

[0091] If after selecting only one-byte features, there are still a large number of features that cannot be merged, and the number of occurrences of each feature is very small, this may be due to the application using data encryption or compression. In this case, you can choose to use only the port range and length range features and ignore the content features. This method regards features that do not select content features and only select one-byte content as fuzzy features. Fuzzy features usually cannot be used alone, but can be used in conjunction with other settings.

[0092] After the content features are merged, the protocol port range (maximum and minimum values ​​of the protocol port), the client sent message length range (maximum and minimum values), and the server sent message length range (maximum and minimum values) of the merged features are recorded at the same time and used as application identification features together with the content features.

[0093] S126. Determine whether the number of similar features in the temporary feature table reaches the set threshold. If so, move the similar features whose number of appearances reaches the set threshold to the formal feature table, and proceed to the next step for the remaining content features. If not, proceed directly to the next step; the set threshold is the same as in step S30.

[0094] S127: Detect the number of content features remaining in the temporary feature table and the number of occurrences of each content feature. If the number of these content features is greater than a set threshold and the number of occurrences of each content feature is less than the set threshold, the corresponding content feature is considered to be a fuzzy feature.

[0095] Specifically, the process in which the network forwarding device extracts the features of the session data packets passing through in step S200 and compares the features with the application feature library to perform application identification includes:

[0096] During the process of extracting session features: When the network forwarding device finds that the client has established a new session, it extracts the feature data required by this method from the first few messages of the session. Since the features include features sent by the client to the server and features in the opposite direction, when features in one direction are obtained, the recognition algorithm needs to be called once, and when features of both parties are obtained, the recognition algorithm needs to be called again.

[0097] According to the characteristics of different protocols, the gateway needs to use corresponding methods to extract features:

[0098] HTTP protocol: This protocol is built on top of the TCP protocol. When an intranet host accesses an Internet website, it first needs to perform a TCP three-way handshake with the server, and then use the HTTP protocol to send a request. When the message is forwarded by the gateway, the gateway extracts the HTTP protocol features from the message. That is, the contents of bytes 0, 5, 6, 7, 8, 9, 10, and 11 in the payload part, and the contents of the host field in the HTTP header are used as domain name features. If the host field does not exist, the gateway needs to query the domain name in the DNS resolution cache using the target IP address as described above. The HTTP session only calls the recognition algorithm once.

[0099] HTTPS / TLS protocol: This protocol is built on top of the TCP protocol. When an intranet user accesses an Internet website, they first need to perform a TCP three-way handshake with the server, and then the client sends a Client Hello message. When the message is forwarded by the gateway, the gateway extracts the server name field in the TLS protocol as the domain name feature. The TLS session only calls the identification algorithm once.

[0100] TCP protocol: When an intranet user visits an Internet website, they first need to perform a TCP three-way handshake with the server, and then one of the client or server sends a request and the other responds. When the gateway forwards the session message, when one party sends the first message with a payload greater than 0, it extracts features and calls the recognition algorithm to obtain the result of whether to block it. TCP sessions are usually bidirectional traffic, and the recognition algorithm is called twice for one session.

[0101] UDP protocol: UDP sessions are determined by five-tuples. When the gateway forwards a UDP message, it uses the five-tuple to determine whether the session is a new session. The gateway extracts the features of the first message containing the payload content of the session and calls the recognition algorithm once. When the server responds to the first message containing the payload content, it extracts the content features again and calls the recognition algorithm once.

[0102] QUIC: This protocol is built on top of the UDP protocol, and the communication security technology uses the TLS protocol. Therefore, similar to HTTPS / TLS, the gateway extracts the server name field from the Client Hello sent by the client as the domain name feature and calls the recognition algorithm.

[0103] S211, determine whether the extracted features contain domain name features, if so, proceed to the next step, otherwise jump to step S213;

[0104] S212, query whether the domain name feature in the extracted feature matches the domain name feature in the application feature library, if so, return the result of application identification, otherwise proceed to the next step;

[0105] S213: Perform content recognition on the extracted features to determine whether they match the content features in the application feature library. If so, return the result of application recognition; otherwise, return the result that application did not recognize.

[0106] Specifically, when performing content identification in step S213, the content features in the application feature library are matched one by one. First, it is determined whether the basic features in the extracted features are hit, that is, the port range, the length range of the message sent by the client, and the length range of the message sent by the server are satisfied (some protocols only look at the features when the client sends, and do not need the features of the message sent by the server, such as HTTP and HTTPS protocols). If so, it is determined whether the content features in the extracted features are hit. When the number of bytes selected by the content feature is less than or equal to 1 (its value can be adjusted according to the situation during implementation), the feature is a "fuzzy feature", and such a feature can only be used in a time window after the corresponding application clear feature is hit.

[0107] Specifically, after the domain name feature or content feature is judged to be a hit, the application is also identified through the fuzzy features in the application feature library, including: starting a timer associated with the application, designing a timer period, usually 1 to 60 seconds, and different durations can be selected for different applications, matching the content features in the extracted features with the fuzzy features in the application feature library, and determining the type of the application feature based on the hit structure of the fuzzy features. The reason is that the fuzzy feature library has less matching information. In order to reduce the occurrence of mismatches, it is necessary to indicate that the user is using the application when the clear features of the application are hit, and at the same time open a time window for the fuzzy feature. Within this time window, the fuzzy feature can be used to block the application session.

[0108] The constructed domain name feature library is shown in Table 7:

[0109] domain name Application apidns.kwd.inkuai.com quick worker apitrain.meituan.com Meituan / Dianping apiv.douyucdn.cn Betta app.adjust.cn Awakening of Nations

[0110] Table 7 Domain name feature table

[0111] The constructed content feature table is shown in Table 8:

[0112]

[0113] Table 8 Content characteristics table

[0114] The port range, the length of the message sent by the client (if any), and the length range of the message sent by the server (if any) are mandatory matching contents. The session must first meet these requirements. The "Content 8-byte feature selection mask" is an 8-bit binary number. When a bit is 1, it means that a byte in the 8-byte content feature corresponding to the bit is selected. The selected content will be matched with the corresponding content in the session. If all the above rules are matched, the feature is hit.

[0115] Through the above process, the present invention can greatly reduce the manpower investment. Manual work only needs to complete traffic capture, and after a series of feature processing, automatically generate application features and generate a report on the feature validity, thereby realizing the identification and processing of the application, and facilitating users to block the corresponding application according to the identification results.

[0116] The above embodiments are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any changes made by adopting the design principles of the present invention and performing non-creative work on this basis should fall within the protection scope of the present invention.

Claims

1. An application identification and blocking method, characterized in that: The following steps are involved: S100, obtaining a session data packet of an application between a client and a server, extracting application features including basic features, domain name features, and content features according to the five-tuple information, and constructing an application feature library corresponding to the application; S200, the application feature library is built into the network forwarding device. When the client establishes a new session, the network forwarding device extracts the features of the session data packets passing through, compares them with the application feature library to perform application identification, and determines the application program to which the new session belongs; S300: Based on the user's pre-settings, the new session is processed including blocking, QoS, and auditing.

2. The application identification and blocking method according to claim 1, characterized in that: In step S100, the basic features include the session protocol, the protocol port number, the payload length of the first message with payload content sent by the client, and the payload length of the first message with payload content responded by the server; The domain name feature is the domain name of the server, including the top-level domain name and subdomain name of the server; The content feature comes from the payload content of the session and is configured to have a maximum length of 8 bytes. For HTTP protocol sessions, the content of the 0th byte and the 5th to 11th bytes in the HTTP request packet are selected to form an eight-byte content feature. For other protocols including TCP and UDP protocols, the content of the first four bytes of the payload in the first request message with payload content sent by the client to the server and the content of the first four bytes of the payload in the first response message with payload content sent by the server to the client are selected to form an eight-byte content feature.

3. The application identification and blocking method according to claim 2, characterized in that: The method for processing the domain name feature includes: For multiple servers with similar numbers that provide similar services, the domain name features are merged by ignoring the number in the last segment of the server domain name; For multiple server domains that are used in only one application and contain the same top-level domain name, merge the domain name characteristics by ignoring the subdomains and retaining the top-level domain name; For the domain name features generated by an application that calls a third-party function, the domain name features corresponding to the application are optimized and purified by eliminating the domain name features generated by the third-party function itself.

4. The application identification and blocking method according to claim 3, characterized in that: The method for processing the content feature includes: S121, establishing a temporary feature table according to the extracted content features; S122, deduplicating content features, and deleting content features with identical byte features that appear in session data packets of multiple applications; S123, identifying content features with completely identical byte features in the same application as duplicate features, merging the duplicate features, and marking the number of occurrences of all content features; S124, determining whether the number of occurrences of a content feature in the temporary feature table reaches a set threshold, if so, moving the content feature whose number of occurrences reaches the set threshold to the formal feature table, and proceeding to the next step for the remaining content features, if not, directly proceeding to the next step; S125, identifying content features with the same partial byte features in the same application as similar features, merging the similar features by algorithm, and marking the number of occurrences of the same similar feature; S126, determining whether the number of occurrences of similar features in the temporary feature table reaches a set threshold, if so, moving the similar features whose number of occurrences reaches the set threshold to the formal feature table, and proceeding to the next step for the remaining content features, if not, directly proceeding to the next step; S127: Detect the number of content features remaining in the temporary feature table and the number of occurrences of each content feature. If the number of these content features is greater than a set threshold and the number of occurrences of each content feature is less than the set threshold, the corresponding content feature is considered to be a fuzzy feature.

5. The application identification and blocking method according to claim 4, characterized in that: The set threshold corresponding to the number of occurrences of the content feature in step S124 includes a first threshold and a second threshold, wherein the first threshold is a set ratio of the total number of occurrences of all content features in the current temporary feature table; the second threshold is calculated as follows: under the condition that no content feature in the current temporary feature table satisfies the first threshold, the difference between the ratio of the highest number of occurrences to the total number of occurrences and the ratio of the second highest number of occurrences to the total number of occurrences; When determining the relationship between the number of occurrences and the set threshold, the relationship between the number of occurrences and the first threshold is determined first, and if not satisfied, the relationship between the number of occurrences and the second threshold is determined.

6. The application identification and blocking method according to claim 5, characterized in that: The process of algorithmically merging similar features in step S125 includes: Traverse each content feature in the current temporary feature table, try to remove certain byte features of the content feature one by one to form a new feature, compare this new feature with other content features one by one, determine whether the new feature can cover other content features of the same application and does not contain features of other applications, merge the content features that can be covered as similar features, and calculate the total number of content features that can be covered as the number of occurrences of the merged similar features.

7. The application identification and blocking method according to any one of claims 1 to 6, characterized in that: The process in step S200 where the network forwarding device extracts features of the passing session data packets and compares them with the application feature library to perform application identification includes: S211, determine whether the extracted features contain domain name features, if so, proceed to the next step, otherwise jump to step S213; S212, query whether the domain name feature in the extracted feature matches the domain name feature in the application feature library, if so, return the result of application identification, otherwise proceed to the next step; S213: Perform content recognition on the extracted features to determine whether they match the content features in the application feature library. If so, return the result of application recognition; otherwise, return the result that application did not recognize.

8. The application identification and blocking method according to claim 7, characterized in that: When performing content recognition in step S213, the content features in the application feature library are matched one by one, and it is first determined whether the basic features in the extracted features are matched. If so, it is then determined whether the content features in the extracted features are matched.

9. The application identification and blocking method according to claim 7, characterized in that: After the domain name feature or content feature is judged to be a hit, the application is also identified through the fuzzy features in the application feature library, including: starting a timer associated with the application, designing a timer cycle, matching the content features in the extracted features with the fuzzy features in the application feature library, and determining the type of the application feature based on the hit structure of the fuzzy features.

Images