Session direction identification method and device, electronic equipment and storage medium

Abstract

The invention provides a session direction identification method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining messages transmitted by two pieces of equipment after the two pieces of equipment establish a session connection; when it is detected that the first destination IP information and the first destination port information exist in the information cache table, determining a device corresponding to the first destination IP information as a message receiver and a device corresponding to the first source IP information of the first message as a message sender; when it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, detecting whether a session performed by the two devices is a TCP session according to the first protocol type information of the first message; and when it is detected that the session performed by the two devices is the TCP session, determining a message receiver and a message sender in the two devices according to the acquired protocol type information of the first N messages. According to the invention, the session direction between two pieces of equipment can be quickly and accurately identified.

Description

Technical Field

[0001] This application relates to the field of communication testing, and particularly to a method, apparatus, electronic device, and storage medium for session direction recognition. Background Art

[0002] A session is a process with a start, intermediate interaction, and end, and it can occur between different devices, applications, or users. For example, in online chatting, the entire process from a user opening a chat window to start communicating with the other party to closing the window to end the communication is a session. In computer science and the field of communication, a session refers to a series of related information exchange processes between two or more participants to complete a specific task or for interaction. In network communication, it is the data exchange process between two nodes through network protocols. For example, the connection and data transmission between a client and a server through protocols such as HTTP and TCP, like a user accessing a website through a browser, and the entire process from sending a request to receiving a response constitutes a network session.

[0003] Session management refers to a series of processes for creating, maintaining, tracking, and controlling sessions in fields such as computer systems and network communication. And the session direction in session management refers to the data transmission flow direction during network communication interaction, or more popularly speaking, it is the direction from the client to the server to initiate a session. The recognition of the session direction can better identify and manage the session state, identify the device attributes at both ends where the session is established, etc. For example, a computer (source IP: 192.168.1.100, source port: 5000) sends a request to a server (destination IP: 10.0.0.1, destination port: 80), then the session direction is from this computer to the server.

[0004] In related technologies, session direction recognition is usually based on IP addresses and port numbers: at the network layer and transport layer, the source IP address and source port number identify the message sender, and the destination IP address and destination port number identify the message receiver. However, since the transmission of messages is carried out between two devices mutually, directly recognizing the session direction based on IP addresses and port numbers has low accuracy and low recognition efficiency. Summary of the Invention

[0005] In view of this, this application provides a method, apparatus, electronic device, and storage medium for session direction recognition, which can achieve fast and accurate recognition of the session direction between two devices.

[0006] The first aspect of the embodiment of the present application provides a session direction recognition method, including: after establishing a session connection between two devices, obtaining packets transmitted between the two devices, where each packet carries source IP information, source port information, destination IP information, destination port information, and protocol type information; detecting whether the first destination IP information and the first destination port information of the first obtained packet exist in the information cache table, where the information cache table stores historical destination ID information of multiple servers and at least one historical destination port information corresponding to each historical destination ID information; in the case where it is detected that the first destination IP information and the first destination port information exist in the information cache table, determining the device corresponding to the first destination IP information as the packet receiver, and the device corresponding to the first source IP information of the first packet as the packet sender; in the case where it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, detecting whether the session between the two devices is a TCP session according to the first protocol type information of the first packet; in the case where it is detected that the session between the two devices is a TCP session, determining the packet receiver and the packet sender among the two devices according to the protocol type information of the first N obtained packets, where N is an integer greater than 1.

[0007] Compared with the related art, the embodiments of the present application have at least the following advantages: By establishing an information cache table, since the information cache table stores the historical destination ID information of multiple servers and at least one historical destination port information corresponding to each historical destination ID information, therefore, when it is detected that the first destination IP information and the first destination port information exist in the information cache table, it indicates that the first message is sent from the client to the server, that is, it can be determined that the device corresponding to the first destination IP information is the message receiver, and the device corresponding to the first source IP information is the message sender. On the one hand, the above method can quickly detect the message sender and the message receiver based on the information carried by the first message and the information cache table, improving the efficiency of session direction recognition; on the other hand, the information stored in the information cache table is all historical data during the session of historical devices, improving the accuracy of session direction recognition. When it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, since each message carries protocol type information, it is possible to detect whether the session between the two devices is a TCP session through the first protocol type information of the first message, and when the session between the two devices is a TCP session, determine the message receiver and the message sender based on the protocol type information of the first N messages obtained, which can determine the message receiver and the message sender through the characteristics of the TCP session when the message receiver and the message sender cannot be determined based on the first destination IP information and the first destination port information, thereby improving the reliability of the session direction recognition method and ensuring that the session direction recognition method provided by the present application can accurately detect the session direction in different scenarios.

[0008] In a possible implementation manner, the determining the message receiver and the message sender in the two devices according to the protocol type information of the first N messages obtained includes: detecting whether there is a SYN message or a SYN-ACK message in the first N messages according to the protocol type information of the first N messages; when it is detected that there is the SYN message or the SYN-ACK message, execute a session direction determination strategy, and the session direction determination strategy includes: when it is detected that there is the SYN message, determining the device corresponding to the second destination IP information of the SYN message as the message receiver, and the device corresponding to the second source IP information of the SYN message as the message sender; when it is detected that there is the SYN-ACK message, determining the device corresponding to the third source IP information of the SYN-ACK message as the message sender, and the device corresponding to the third destination IP information of the SYN-ACK message as the message receiver.

[0009] In a possible implementation, obtaining the packets transmitted between the two devices includes: caching each of the packets transmitted between the two devices one by one; determining the packet receiver and the packet sender among the two devices according to the protocol type information of the first N packets obtained includes: determining the packet receiver and the packet sender among the two devices according to the protocol type information of the cached first N packets; the method further includes: in the case that no SYN packet or SYN-ACK packet exists in the first N packets, continuing to cache the remaining packets of the session between the two devices; detecting whether there is a SYN packet or a SYN-ACK packet in the remaining packets; in the case that a SYN packet or a SYN-ACK packet is detected, executing the session direction determination strategy.

[0010] In a possible implementation, the method further includes: in the case that the session between the two devices is not a TCP session, or in the case that no SYN packet or SYN-ACK packet exists in the remaining packets, determining the interaction characteristics of the packets; detecting whether the protocol of the session is an application layer protocol according to the interaction characteristics; in the case that the protocol of the session is the application layer protocol, identifying the packet receiver and the packet sender according to the interaction characteristics.

[0011] In a possible implementation, the method further includes: in the case that the protocol of the session is not the application layer protocol, detecting whether the first destination IP information exists in the information cache table, and whether the first destination port information is less than the first source port information of the first packet; in the case that the first destination IP information exists in the information cache table and the first destination port information is less than the first source port information, determining the device corresponding to the first destination IP information and the first destination port information as the packet receiver, and the device corresponding to the first source IP information and the first source port information as the packet sender.

[0012] In a possible implementation, the method further includes: when it is detected that the first destination IP information does not exist in the information cache table, or the first destination port information is greater than or equal to the first source port information, detecting whether the first destination port information is greater than a first preset threshold and whether the first source port information is less than a second preset threshold, where the first preset threshold is greater than the second preset threshold; when it is detected that the first destination port information is greater than the first preset threshold and the first source port information is less than the second preset threshold, determining that the device corresponding to the first destination IP information and the first destination port information is the message sender, and the device corresponding to the first source IP information and the first source port information is the message receiver.

[0013] In a possible implementation, the method further includes: when it is detected that the first destination port information is less than or equal to the first preset threshold, or the first source port information is greater than or equal to the second preset threshold, determining that the device corresponding to the first destination IP information and the first destination port information is the message receiver, and the device corresponding to the first source IP information and the first source port information is the message sender.

[0014] In a second aspect, an embodiment of the present application further provides a session direction recognition device, including: an acquisition module, a first detection module, a determination module, and a second detection module; the acquisition module is configured to acquire messages transmitted between two devices after the two devices establish a session connection, where each message carries source IP information, source port information, destination IP information, destination port information, and protocol type information; the first detection module is configured to detect whether the first destination IP information and the first destination port information of the first acquired message exist in the information cache table, where the information cache table stores multiple historical destination ID information and at least one historical destination port information corresponding to each historical destination ID information; the determination module is configured to, when the first detection module detects that the first destination IP information and the first destination port information exist in the information cache table, determine that the device corresponding to the first destination IP information is the message receiver, and the device corresponding to the first source IP information of the first message is the message sender; when the first detection module detects that the first destination IP information and the first destination port information do not exist in the information cache table, the second detection module is configured to detect whether the session between the two devices is a TCP session according to the first protocol type information of the first message; when the second detection module detects that the session between the two devices is a TCP session, the determination module is further configured to determine the message receiver and the message sender among the two devices according to the protocol type information of the first N acquired messages, where N is an integer greater than 1.

[0015] In a third aspect, an embodiment of the present application further provides an electronic device, which includes a processor and a memory. The memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the session direction recognition method as described in the first aspect.

[0016] In a fourth aspect, an embodiment of the present application further provides a storage medium. The computer-readable storage medium stores computer instructions. When the computer instructions run on an electronic device, the electronic device is caused to execute the session direction recognition method as described in the first aspect.

[0017] The technical effects obtained in the above second aspect, third aspect, and fourth aspect are similar to those obtained by the corresponding technical means in the first aspect, and will not be elaborated here. Description of the Drawings

[0018] Figure 1 It is a flowchart of steps of a session direction recognition method provided by an embodiment of the present application.

[0019] Figure 2 It is an application scenario diagram of session direction recognition provided by an embodiment of the present application.

[0020] Figure 3 It is another flowchart of steps of a session direction recognition method provided by an embodiment of the present application.

[0021] Figure 4 It is yet another flowchart of steps of a session direction recognition method provided by an embodiment of the present application.

[0022] Figure 5 It is still another flowchart of steps of a session direction recognition method provided by an embodiment of the present application.

[0023] Figure 6 It is a functional module diagram of a session direction recognition device provided by an embodiment of the present application.

[0024] Figure 7 It is a schematic structural diagram of an electronic device provided by an embodiment of the present application. Detailed Embodiments

[0025] In order to more clearly understand the above objects, features, and advantages of the present application, the present application will be described in detail below with reference to the drawings and specific embodiments. It should be noted that, without conflict, the embodiments of the present application and the features in the embodiments can be combined with each other.

[0026] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application. The described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which this application belongs. The terms used in the specification of this application are only for the purpose of describing specific embodiments, and are not intended to limit this application.

[0028] Furthermore, it should be noted that in this text, the term "comprising", "including" or any other variation thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the existence of additional identical elements in the process, method, article or device comprising such element.

[0029] In this application, "at least one" means one or more, and "a plurality" means two or more than two. "And / or" describes the relationship between associated objects and indicates that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. The terms "first", "second", "third", "fourth", etc. (if any) in the specification, claims and drawings of this application are used to distinguish similar objects, rather than to describe a specific order or sequence.

[0030] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Rather, the use of words such as "exemplary" or "for example" is intended to present relevant concepts in a specific manner.

[0031] For ease of understanding, some explanations of concepts related to the embodiments of this application are given by way of example for reference.

[0032] TCP (Transmission Control Protocol): A connection-oriented, secure and reliable transport layer communication protocol based on byte streams. When establishing a TCP connection, the party that opens a socket and listens is called the server, and the party that opens a socket and actively initiates the connection is called the client. The process of establishing a connection requires three data transmissions, which is called the three-way handshake: The first handshake: The client enters the SYN-SENT state and then sends a SYN packet. The seq value in the packet is a random value generated according to time. The second handshake: After receiving the SYN packet, the server enters the SYN-RCVD state and then returns a SYN-ACK packet. Its seq value is the random value of the server, and the ack value is the seq of the received SYN packet plus one. The third handshake: After receiving the SYN-ACK packet from the server, the client enters the ESTABLISHED state, indicating that the connection has been established, and then sends an ACK packet to the server.

[0033] Application layer protocols: Define how application program processes running on different end systems communicate with each other by passing messages. Application layer protocols include: Domain Name System (DNS): A network service used to map network device names to IP addresses; Simple Mail Transfer Protocol (SMTP): Used to implement the function of email transmission; Hyper Text Transfer Protocol (HTTP): Used to implement WWW services; Simple Network Management Protocol (SNMP): Used to manage and monitor network devices; Telnet: Used to implement the function of remote login. It can be understood that application layer protocols also include other protocols, which are not listed one by one here.

[0034] Please refer to Figure 1 , Figure 1 This is the flowchart of the steps of an embodiment of the session direction recognition method of the present application. According to different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted. The session direction recognition method of the present application can be applied to a session direction recognition device, but is not limited thereto. The embodiments of the present application do not limit this.

[0035] The specific process of this embodiment is as Figure 1 shown, and includes the following steps: Step 101, after establishing a session connection between two devices, obtain the packets transmitted between the two devices. Each packet carries source IP information, source port information, destination IP information, destination port information, and protocol type information.

[0036] Specifically, the source IP information is the source IP address, that is, the IP address of the computer that sends the data packet, used to identify the source of the data packet. The source port information is the source port number, that is, the port number used by the computer that sends the data packet, used to identify from which application the data packet is sent; the destination IP information is the destination IP address, that is, the IP address of the computer that receives the data packet, used to determine the destination of the data packet; the destination port information is the destination port number, that is, the port number used by the computer that receives the data packet, used to identify which application the data packet should be handed to for processing; the protocol type information includes the transport protocol, that is, the protocol used when sending the data packet, such as TCP, UDP, etc.

[0037] In some embodiments, after establishing a session connection between two devices, cache each of the packets transmitted between the two devices one by one. Specifically, during the process of packet transmission between the two devices, the session direction identification device caches the packets one by one according to the chronological order of packet sending.

[0038] Step 102, detect whether the first destination IP information and the first destination port information of the first obtained packet exist in the information cache table; if it is detected that the first destination IP information and the first destination port information exist in the information cache table, execute Step 103; otherwise, execute Step 104.

[0039] Specifically, the information cache table stores the historical destination ID information of multiple servers, and at least one historical destination port information corresponding to each historical destination ID information.

[0040] It can be understood that the information cache table in this embodiment is the server identification cache table. The server identification cache table stores the historical destination ID information and historical destination port information corresponding to the historically confirmed packet receivers, that is, the historical IP address and historical port number of the server. It should be noted that the IP address of one server can correspond to multiple port numbers.

[0041] Step 103, determine that the device corresponding to the first destination IP information is the packet receiver, and the device corresponding to the first source IP information of the first packet is the packet sender.

[0042] Step 104: Detect whether the session between the two devices is a TCP session according to the first protocol type information of the first message. When it is detected that the session between the two devices is a TCP session, determine the message receiver and message sender among the two devices according to the protocol type information of the obtained first N messages.

[0043] For the sake of easy understanding, the following specifically describes how the present application realizes session direction recognition: Figure 2 Please refer to which is the application scenario diagram of session direction recognition provided by the embodiment of the present application. The internal network device establishes a session connection with the external network device through the core switch. The session direction recognition device is communicatively connected to the core switch and is used to obtain the messages transmitted between the internal network device and the external network device during the session. Figure 2

[0044] How to detect whether the session between the two devices is a TCP session according to the first protocol type information, and how to determine the message receiver and message sender among the two devices according to the protocol type information of the first N messages are described in detail in the subsequent embodiments. To avoid repetition, they will not be elaborated here.

[0045] Compared with the related art, the embodiment of the present application has at least the following advantages: By establishing an information cache table, since the information cache table stores the historical destination ID information of multiple servers and at least one historical destination port information corresponding to each historical destination ID information, when it is detected that the first destination IP information and the first destination port information exist in the information cache table, it indicates that the first message is sent from the client to the server, that is, it can be determined that the device corresponding to the first destination IP information is the message receiver, and the device corresponding to the first source IP information is the message sender. On the one hand, the above method can quickly detect the message sender and message receiver based on the information carried by the first message and the information cache table, improving the efficiency of session direction recognition; on the other hand, the information stored in the information cache table is all historical data during the session of historical devices, improving the accuracy of session direction recognition. When it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, since each message carries protocol type information, it can be detected whether the session between the two devices is a TCP session according to the first protocol type information of the first message. When the session between the two devices is a TCP session, the message receiver and message sender are determined based on the protocol type information of the obtained first N messages. When the message receiver and message sender cannot be determined based on the first destination IP information and the first destination port information, the message receiver and message sender can be determined through the characteristics of the TCP session, thereby improving the reliability of the session direction recognition method and ensuring that the session direction recognition method provided by the present application can accurately detect the session direction in different scenarios.​

[0046] Please refer to Figure 3 , Figure 3 which is a flowchart of the steps of an embodiment of the session direction recognition method of this application. According to different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted. This session direction recognition method can be applied to the aforementioned session direction recognition device, but is not limited thereto, and the embodiments of this application do not limit this.

[0047] This embodiment is a specific description of the foregoing embodiment, mainly explaining: how to detect whether the session between two devices is a TCP session according to the first protocol type information, and how to determine the message receiver and message sender in the two devices according to the protocol type information of the first N messages. In this way, the applicable scenarios of the session direction recognition method can be expanded, thereby further improving the reliability of the session direction recognition method.

[0048] The specific process of this embodiment is as Figure 3 shown, and includes the following steps: Step 201, after the session connection between the two devices is established, cache each message transmitted between the two devices one by one.

[0049] Step 202, detect whether the first destination IP information and the first destination port information of the first message obtained exist in the information cache table; if it is detected that the first destination IP information and the first destination port information exist in the information cache table, execute Step 203; otherwise, execute Step 204.

[0050] Step 203, determine the device corresponding to the first destination IP information as the message receiver, and the device corresponding to the first source IP information of the first message as the message sender.

[0051] Steps 201 to 203 of this embodiment are similar to Steps 101 to 103 of the foregoing embodiment. To avoid repetition, they will not be elaborated here.

[0052] Step 204, if it is detected according to the first protocol type information that the session between the two devices is a TCP session, detect whether there is a SYN message or a SYN-ACK message in the first N messages according to the protocol type information of the cached first N messages. If it is detected that there is a SYN message or a SYN-ACK message, execute Step 205; otherwise, execute Step 206.

[0053] Specifically, N is an integer greater than 1.

[0054] In some embodiments, according to the transport protocol of the first 3 cached messages, detect whether there is a SYN message or a SYN-ACK message in the first 3 messages.

[0055] Step 205: Execute the session direction determination policy, which includes: when detecting the existence of a SYN packet, determining the device corresponding to the second destination IP information of the SYN packet as the packet receiver, and the device corresponding to the second source IP information of the SYN packet as the packet sender; when detecting the existence of a SYN-ACK packet, determining the device corresponding to the third destination IP information of the SYN-ACK packet as the packet sender, and the device corresponding to the third source IP information of the SYN-ACK packet as the packet receiver.

[0056] Step 206: Continue to cache the remaining packets for the session between the two devices.

[0057] Step 207: Detect whether there is a SYN packet or a SYN-ACK packet in the remaining packets; and when detecting the existence of a SYN packet or a SYN-ACK packet, execute the session direction determination policy.

[0058] In some embodiments, after detecting a SYN packet or a SYN-ACK packet in the remaining packets, store the destination IP information and destination port information corresponding to the determined packet receiver in the information cache table. In this way, when the same two devices conduct a session in the same session direction next time, the packet sender and the packet receiver can be quickly and accurately determined according to the detection method in step 202, thereby further improving the efficiency of session direction recognition.

[0059] Compared with the related art, the embodiments of the present application have at least the following advantages: By establishing an information cache table, since the information cache table stores the historical destination ID information of multiple servers and at least one historical destination port information corresponding to each historical destination ID information, therefore, when it is detected that the first destination IP information and the first destination port information exist in the information cache table, it indicates that the first message is sent from the client to the server, that is, it can be determined that the device corresponding to the first destination IP information is the message receiver, and the device corresponding to the first source IP information is the message sender. On the one hand, the above method can quickly detect the message sender and the message receiver based on the information carried by the first message and the information cache table, improving the efficiency of session direction recognition; on the other hand, the information stored in the information cache table is all historical data when historical devices conduct sessions, improving the accuracy of session direction recognition. When it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, since each message carries protocol type information, it is possible to detect whether the session between the two devices is a TCP session through the first protocol type information of the first message, and when the session between the two devices is a TCP session, determine the message receiver and the message sender based on the protocol type information of the first N messages obtained, which can determine the message receiver and the message sender through the characteristics of the TCP session when the message receiver and the message sender cannot be determined based on the first destination IP information and the first destination port information, thereby improving the reliability of the session direction recognition method and ensuring that the session direction recognition method provided by the present application can accurately detect the session direction in different scenarios.

[0060] Please refer to Figure 4 , Figure 4 which is a flowchart of the steps of an embodiment of the session direction recognition method of the present application. According to different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted. This session direction recognition method can be applied to the aforementioned session direction recognition device, but is not limited thereto, and the embodiments of the present application do not limit this.

[0061] This embodiment is a further improvement of the foregoing embodiment. The main improvement lies in: In this embodiment, in the case where it is detected that the session between the two devices is not a TCP session, or it is detected that there is no SYN message or SYN-ACK message in the remaining messages, how to determine the session direction between the two devices. In this way, the applicable scenarios of the session direction recognition method can be further expanded, thereby further improving the reliability of the session direction recognition method.

[0062] The specific process of this embodiment is as Figure 4 shown, including the following steps: Step 301, after the two devices establish a session connection, cache each message transmitted between the two devices one by one.

[0063] Step 302: Detect whether the first destination IP information and the first destination port information of the acquired first packet exist in the information cache table; if it is detected that the first destination IP information and the first destination port information exist in the information cache table, execute Step 303; otherwise, execute Step 304.

[0064] Step 303: Determine that the device corresponding to the first destination IP information is the packet receiving party, and the device corresponding to the first source IP information of the first packet is the packet sending party.

[0065] Step 304: Detect whether the session between the two devices is a TCP session according to the first protocol type information of the first packet; if it is detected that the session between the two devices is a TCP session, execute Step 305; otherwise, execute Step 310.

[0066] Step 305: According to the protocol type information of the cached first N packets, detect whether there is a SYN packet or a SYN-ACK packet in the first N packets; if it is detected that there is a SYN packet or a SYN-ACK packet, execute Step 306; otherwise, execute Step 310.

[0067] Step 306: Execute the session direction determination policy, and the session direction determination policy includes: if it is detected that there is a SYN packet, determine that the device corresponding to the second destination IP information of the SYN packet is the packet receiving party, and the device corresponding to the second source IP information of the SYN packet is the packet sending party; if it is detected that there is a SYN-ACK packet, determine that the device corresponding to the third destination IP information of the SYN-ACK packet is the packet sending party, and the device corresponding to the third source IP information of the SYN-ACK packet is the packet receiving party.

[0068] Step 307: Continue to cache the remaining packets of the session between the two devices.

[0069] Step 308: Detect whether there is a SYN packet or a SYN-ACK packet in the remaining packets; if it is detected that there is a SYN packet or a SYN-ACK packet, execute Step 309; otherwise, execute Step 310.

[0070] Step 309: Execute the session direction determination policy.

[0071] Step 310: Determine the interaction characteristics of the packet.

[0072] In some embodiments, application layer protocols such as HTTP, DNS, SMTP, POP3, IMAP, TLS, TELNET, FTP, SNMP, DHCP, SAMBA, TFTP, NTP, LDAP, MYSQL, PGSQL, etc. are based on their protocol characteristics. The client initiates the relevant request connection or operation, and the server responds. Therefore, after identifying the protocol of the session message, the client and server can be analyzed and confirmed based on the interaction characteristics of the message.

[0073] Step 311, detecting whether the protocol of the session is an application layer protocol according to the interaction characteristics, and if it is detected that the protocol of the session is an application layer protocol, executing step 312; otherwise, executing step 313.

[0074] Step 312: Identify the message receiver and the message sender according to the interaction characteristics.

[0075] In some embodiments, after the message receiver and the message sender are identified according to the interaction feature, the destination IP information and the destination port information corresponding to the determined message receiver are stored in the information cache table. In this way, the next time the same two devices conduct a conversation in the same conversation direction, the message sender and the message receiver can be quickly and accurately determined according to the detection method of step 302, thereby further improving the efficiency of conversation direction identification.

[0076] To facilitate understanding, the following describes how to identify the message receiver and message sender based on the interaction characteristics: 1. When the application layer protocol is HTTP, since the client sends HTTPGET, POST and other requests in the HTTP protocol interaction, the server will respond similar to HTTP1.1 200 OK after receiving and processing the relevant requests. Through this interaction process, it can be confirmed that the party that initiates HTTP GET, POST and other requests is the client, that is, the message sender, and the data receiving end is the server, that is, the message receiver.

[0077] 2. When the application layer protocol is the DNS protocol, since the client sends DNS query and other requests in the DNS protocol interaction, the server will respond with a DNS query response after receiving and processing the relevant request. Through this interaction process, it can be confirmed that the party that initiates the DNS query and other requests is the client, and the data receiving end is the server.

[0078] 3. In the case where the application layer protocol is the mail (SMTP, POP3, IMAP) protocol, during the interaction of the mail protocol, after the TCP connection is successful, the server will send the mail server status, and then the client will initiate operations such as an authentication request. After receiving the request, the server will respond. Based on this interaction operation, it can be confirmed that the requesting party is the client and the data receiving party is the server according to the interaction command.

[0079] Step 313, when it is detected that the first destination IP information exists in the information cache table and the first destination port information is less than the first source port information, determine that the device corresponding to the first destination IP information and the first destination port information is the message receiving party, and the device corresponding to the first source IP information and the first source port information is the message sending party.

[0080] Compared with the related art, the embodiments of the present application have at least the following advantages: By establishing an information cache table, since the information cache table stores the historical destination ID information of multiple servers and at least one historical destination port information corresponding to each historical destination ID information, therefore, when it is detected that the first destination IP information and the first destination port information exist in the information cache table, it indicates that the first message is sent from the client to the server, that is, it can be determined that the device corresponding to the first destination IP information is the message receiving party, and the device corresponding to the first source IP information is the message sending party. On the one hand, the above method can quickly detect the message sending party and the message receiving party based on the information carried by the first message and the information cache table, improving the efficiency of session direction recognition; on the other hand, the information stored in the information cache table is all historical data during the session of historical devices, improving the accuracy of session direction recognition. When it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, since each message carries protocol type information, it can be detected whether the session between the two devices is a TCP session through the first protocol type information of the first message, and when the session between the two devices is a TCP session, the message receiving party and the message sending party can be determined based on the protocol type information of the first N messages obtained, which can determine the message receiving party and the message sending party through the characteristics of the TCP session when the message receiving party and the message sending party cannot be determined based on the first destination IP information and the first destination port information, thereby improving the reliability of the session direction recognition method and ensuring that the session direction recognition method provided by the present application can accurately detect the session direction in different scenarios.

[0081] Please refer to Figure 5 , Figure 5 is the step flowchart of an embodiment of the session direction recognition method of the present application. According to different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted. This session direction recognition method can be applied to the aforementioned session direction recognition device, but is not limited thereto. The embodiments of the present application do not limit this.

[0082] This embodiment is a further improvement on the foregoing embodiment. The main improvement lies in: in this embodiment, when it is detected that the first destination IP information does not exist in the information cache table, or the first destination port information is greater than or equal to the first source port information, how to identify the session direction. In this way, the applicable scenarios of the session direction identification method can be expanded, thereby further improving the reliability of the session direction identification method.

[0083] The specific process of this embodiment is as Figure 5 shown and includes the following steps: Step 401, after two devices establish a session connection, cache each packet transmitted between the two devices one by one.

[0084] Step 402, detect whether the first destination IP information and the first destination port information of the first obtained packet exist in the information cache table; if it is detected that the first destination IP information and the first destination port information exist in the information cache table, execute Step 403; otherwise, execute Step 404.

[0085] Step 403, determine the device corresponding to the first destination IP information as the packet receiving party, and the device corresponding to the first source IP information of the first packet as the packet sending party.

[0086] Step 404: According to the first protocol type information of the first packet, detect whether the session between the two devices is a TCP session. If it is detected that the session between the two devices is a TCP session, execute Step 405; otherwise, execute Step 410.

[0087] Step 405, according to the protocol type information of the cached first N packets, detect whether there is a SYN packet or a SYN-ACK packet in the first N packets. If it is detected that there is a SYN packet or a SYN-ACK packet, execute Step 406; otherwise, execute Step 410.

[0088] Step 406, execute the session direction determination strategy, and the session direction determination strategy includes: when it is detected that there is a SYN packet, determine the device corresponding to the second destination IP information of the SYN packet as the packet receiving party, and the device corresponding to the second source IP information of the SYN packet as the packet sending party; when it is detected that there is a SYN-ACK packet, determine the device corresponding to the third destination IP information of the SYN-ACK packet as the packet sending party, and the device corresponding to the third source IP information of the SYN-ACK packet as the packet receiving party.

[0089] Step 407, continue to cache the remaining packets of the session between the two devices.

[0090] Step 408: Detect whether there is a SYN packet or a SYN-ACK packet in the remaining packets. If a SYN packet or a SYN-ACK packet is detected, execute Step 409; otherwise, execute Step 410.

[0091] Step 409: Execute the session direction determination policy.

[0092] Step 410: Determine the interaction characteristics of the packets.

[0093] Step 411: Detect whether the protocol of the session is an application layer protocol according to the interaction characteristics. If the protocol of the session is detected to be an application layer protocol, execute Step 412; otherwise, execute Step 413.

[0094] Step 412: Identify the packet receiver and the packet sender according to the interaction characteristics.

[0095] Step 413: Detect whether the first destination IP information exists in the information cache table and whether the first destination port information is less than the first source port information of the first packet. If the first destination IP information is detected to exist in the information cache table and the first destination port information is less than the first source port information, execute Step 414; otherwise, execute Step 415.

[0096] Step 414: Determine that the device corresponding to the first destination IP information and the first destination port information is the packet receiver, and the device corresponding to the first source IP information and the first source port information is the packet sender.

[0097] Step 415: Detect whether the first destination port information is greater than the first preset threshold and whether the first source port information is less than the second preset threshold. If the first destination port information is detected to be greater than the first preset threshold and the first source port information is less than the second preset threshold, execute Step 416; otherwise, execute Step 417.

[0098] Specifically, the first preset threshold is greater than the second preset threshold.

[0099] In some embodiments, the first preset threshold is set to 30000 and the second preset threshold is set to 10000. Compare whether the first destination port information is greater than the first preset threshold and whether the first source port information is less than the second preset threshold, that is, compare whether the first destination port number is greater than 30000 and whether the first source port number is less than 10000.

[0100] Step 416: Determine that the device corresponding to the first destination IP information and the first destination port information is the packet sender, and the device corresponding to the first source IP information and the first source port information is the packet receiver.

[0101] Step 417: Determine that the device corresponding to the first destination IP information and the first destination port information is the message receiver, and the device corresponding to the first source IP information and the first source port information is the message sender.

[0102] Compared with the related art, the embodiments of the present application have at least the following advantages: By establishing an information cache table, since the information cache table stores the historical destination ID information of multiple servers and at least one historical destination port information corresponding to each historical destination ID information, therefore, when it is detected that the first destination IP information and the first destination port information exist in the information cache table, it indicates that the first message is sent from the client to the server, that is, it can be determined that the device corresponding to the first destination IP information is the message receiver, and the device corresponding to the first source IP information is the message sender. On the one hand, the above method can quickly detect the message sender and the message receiver based on the information carried by the first message and the information cache table, improving the efficiency of session direction recognition; on the other hand, the information stored in the information cache table is all historical data during the session of historical devices, improving the accuracy of session direction recognition. When it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, since each message carries protocol type information, it can be detected whether the session between the two devices is a TCP session through the first protocol type information of the first message, and when the session between the two devices is a TCP session, the message receiver and the message sender are determined based on the protocol type information of the first N messages obtained, which can determine the message receiver and the message sender through the characteristics of the TCP session when the message receiver and the message sender cannot be determined based on the first destination IP information and the first destination port information, thereby improving the reliability of the session direction recognition method and ensuring that the session direction recognition method provided by the present application can accurately detect the session direction in different scenarios.

[0103] Based on the same idea as the session direction recognition method in the above embodiments, the present application also provides a session direction recognition device, which can be used to execute the above session direction recognition method. For the convenience of description, in the structural schematic diagram of the embodiment of the session direction recognition device, only the parts related to the embodiments of the present application are shown. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and it may include more or fewer components than those illustrated, or combine some components, or have different component arrangements.

[0104] Such as Figure 6As shown, the conversation direction identification device 60 includes an acquisition module 601, a first detection module 602, a determination module 603, and a second detection module 604. In some embodiments, the above modules may be programmable software instructions stored in a memory and callable and executed by a processor. It is understood that in other embodiments, the above modules may also be program instructions or firmware fixed in the processor.

[0105] The acquisition module 601 is used to acquire the messages transmitted between the two devices after the two devices establish a session connection, wherein each of the messages carries source IP information, source port information, destination IP information, destination port information and protocol type information; A first detection module 602 is used to detect whether the first destination IP information and the first destination port information of the first message obtained exist in the information cache table, wherein the information cache table stores multiple historical destination ID information and at least one historical destination port information corresponding to each of the historical destination ID information; A determination module 603 is used to determine that the device corresponding to the first destination IP information is a message receiver, and the device corresponding to the first source IP information of the first message is a message sender when the first detection module 602 detects that the first destination IP information and the first destination port information exist in the information cache table; The second detection module 604 is used to detect whether the session between the two devices is a TCP session according to the first protocol type information of the first message when the first detection module 602 detects that the first destination IP information and the first destination port information do not exist in the information cache table; When the second detection module 604 detects that the session between the two devices is a TCP session, the determination module 603 is also used to determine the message receiver and the message sender in the two devices based on the protocol type information of the first N messages obtained, where N is an integer greater than 1.

[0106] Please refer to Figure 7 , Figure 7 This is a schematic diagram of an embodiment of an electronic device of the present application.

[0107] The electronic device 100 includes a memory 20, a processor 30, and a computer program 40 stored in the memory 20 and executable on the processor 30. When the processor 30 executes the computer program 40, the steps in the above-mentioned conversation direction identification method embodiment are implemented, for example Figure 1 Steps 101 to 104 are shown.

[0108] Exemplarily, the computer program 40 can also be segmented into one or more modules / units. One or more modules / units are stored in the memory 20 and executed by the processor 30. One or more modules / units can be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program 40 in the electronic device 100. For example, it can be segmented into the acquisition module 601, the first detection module 602, the determination module 603, and the second detection module 604 as shown.

[0109] Those skilled in the art can understand that the schematic diagram is only an example of the electronic device 100 and does not constitute a limitation on the electronic device 100. It may include more or fewer components than shown, or combine certain components, or different components. For example, the electronic device 100 may also include input / output devices, network access devices, buses, etc.

[0110] The processor 30 can be a central processing unit (CPU), or can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, a single-chip microcomputer, or the processor 30 can also be any conventional processor, etc.

[0111] The memory 20 can be used to store the computer program 40 and / or modules / units. The processor 30 realizes various functions of the electronic device 100 by running or executing the computer program and / or modules / units stored in the memory 20, and by calling the data stored in the memory 20. The memory 20 mainly includes a program storage area and a data storage area. Among them, the program storage area can store an operating system, application programs required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the electronic device 100 (such as audio data), etc. In addition, the memory 20 can include high-speed random access memory, and can also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0112] If the modules / units integrated in the electronic device 100 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a storage medium. Based on this understanding, to implement all or part of the processes in the above-mentioned embodiment methods of this application, it can also be completed by instructing relevant hardware through a computer program. The computer program can be stored in a storage medium. When the computer program is executed by a processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file, or some intermediate form, etc. The storage medium can include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the content included in the storage medium can be appropriately increased or decreased according to the requirements of patent practice. For example, according to patent practice, the storage medium does not include electrical carrier signals and telecommunication signals.

[0113] The above has introduced in detail the session direction recognition method, device, electronic device, and storage medium provided by this application. Specific examples are used in this article to elaborate on the principle and implementation manner of this application. The description of the above embodiments is only used to help understand the method and its core idea of this application; at the same time, for those skilled in the art, according to the idea of this application, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to this application.

Claims

1. A method for identifying a session direction, characterized in that, Including: After two devices establish a session connection, obtain the packets transmitted between the two devices, where each packet carries source IP information, source port information, destination IP information, destination port information, and protocol type information; Detect whether the first destination IP information and the first destination port information of the first obtained packet exist in the information cache table, where the information cache table stores historical destination ID information of multiple servers and at least one historical destination port information corresponding to each historical destination ID information; When it is detected that the first destination IP information and the first destination port information exist in the information cache table, determine the device corresponding to the first destination IP information as the packet receiver, and the device corresponding to the first source IP information of the first packet as the packet sender; When it is detected that the first destination IP information and the first destination port information do not exist in the information cache table, detect whether the session between the two devices is a TCP session according to the first protocol type information of the first packet; When it is detected that the session between the two devices is a TCP session, determine the packet receiver and the packet sender in the two devices according to the protocol type information of the first N obtained packets, where N is an integer greater than 1.

2. The session direction identification method according to claim 1, wherein The determining the packet receiver and the packet sender in the two devices according to the protocol type information of the first N obtained packets includes: According to the protocol type information of the first N packets, detect whether there is a SYN packet or a SYN-ACK packet in the first N packets; When it is detected that there is a SYN packet or a SYN-ACK packet, execute a session direction determination strategy, and the session direction determination strategy includes: When it is detected that there is a SYN packet, determine the device corresponding to the second destination IP information of the SYN packet as the packet receiver, and the device corresponding to the second source IP information of the SYN packet as the packet sender; When it is detected that there is a SYN-ACK packet, determine the device corresponding to the third destination IP information of the SYN-ACK packet as the packet sender, and the device corresponding to the third source IP information of the SYN-ACK packet as the packet receiver.

3. The session direction identification method according to claim 2, characterized in that The obtaining the packets transmitted between the two devices includes: Cache each of the packets transmitted between the two devices one by one; The determining the packet receiver and the packet sender in the two devices according to the protocol type information of the first N obtained packets includes: Determine the packet receiver and the packet sender in the two devices according to the protocol type information of the first N cached packets; The method further includes: When it is detected that there is no SYN packet or SYN-ACK packet in the first N packets, continue to cache the remaining packets of the session between the two devices; Detect whether there is a SYN packet or a SYN-ACK packet in the remaining packets; When it is detected that there is the SYN packet or the SYN-ACK packet, execute the session direction determination policy.

4. The session direction identification method according to claim 3, wherein The method further includes: When it is detected that the session between the two devices is not a TCP session, or when it is detected that there is no SYN packet or SYN-ACK packet in the remaining packets, determine the interaction characteristics of the packets; Detect whether the protocol of the session is an application layer protocol according to the interaction characteristics; When it is detected that the protocol of the session is the application layer protocol, identify the packet receiver and the packet sender according to the interaction characteristics.

5. The session direction identification method according to claim 4, characterized in that The method further includes: When it is detected that the protocol of the session is not the application layer protocol, detect whether the first destination IP information exists in the information cache table, and whether the first destination port information is less than the first source port information of the first packet; When it is detected that the first destination IP information exists in the information cache table and the first destination port information is less than the first source port information, determine the device corresponding to the first destination IP information and the first destination port information as the packet receiver, and the device corresponding to the first source IP information and the first source port information as the packet sender.

6. The session direction identification method according to claim 5, characterized in that The method further includes: When it is detected that the first destination IP information does not exist in the information cache table, or the first destination port information is greater than or equal to the first source port information, detect whether the first destination port information is greater than a first preset threshold and whether the first source port information is less than a second preset threshold, where the first preset threshold is greater than the second preset threshold; When it is detected that the first destination port information is greater than the first preset threshold and the first source port information is less than the second preset threshold, determine the device corresponding to the first destination IP information and the first destination port information as the packet sender, and the device corresponding to the first source IP information and the first source port information as the packet receiver.

7. The session direction identification method according to claim 6, wherein The method further includes: When it is detected that the first destination port information is less than or equal to the first preset threshold, or the first source port information is greater than or equal to the second preset threshold, determine the device corresponding to the first destination IP information and the first destination port information as the packet receiver, and the device corresponding to the first source IP information and the first source port information as the packet sender.

8. A session direction recognition device, characterized in that, It includes: An acquisition module, a first detection module, a determination module, and a second detection module; The acquisition module is used to obtain the packets transmitted between the two devices after the two devices establish a session connection, where each packet carries source IP information, source port information, destination IP information, destination port information, and protocol type information; The first detection module is configured to detect whether the first destination IP information and the first destination port information of the obtained first packet exist in the information cache table, where the information cache table stores multiple historical destination ID information and at least one historical destination port information corresponding to each historical destination ID information; The determination module is configured to, when the first detection module detects that the first destination IP information and the first destination port information exist in the information cache table, determine that the device corresponding to the first destination IP information is the packet receiving party, and the device corresponding to the first source IP information of the first packet is the packet sending party; When the first detection module detects that the first destination IP information and the first destination port information do not exist in the information cache table, the second detection module is configured to detect whether the session between two devices is a TCP session according to the first protocol type information of the first packet; When the second detection module detects that the session between two devices is a TCP session, the determination module is further configured to determine the packet receiving party and the packet sending party in the two devices according to the protocol type information of the obtained first N packets, where N is an integer greater than 1.

9. An electronic device, the electronic device comprising a processor and a memory, characterized in that, The memory is configured to store instructions, and the processor is configured to call the instructions in the memory, so that the electronic device executes the session direction identification method according to any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores computer instructions, and when the computer instructions run on an electronic device, the electronic device is caused to execute the session direction identification method according to any one of claims 1 to 7.

Images