A network port-based full-flow identification analysis method and system

Abstract

The application provides a network port-based full-flow identification analysis method and system, and belongs to the flow identification field. The method accesses full-flow original data packets and presets a configuration file; the original data packets are determined and shunted according to IP layer protocol numbers; when the original data packets are determined as TCP flow or UDP flow, the TCP or UDP flow is determined to be defined, transformable undefined or finally undefined by the preset configuration file and active identification, the transformable undefined flow is transformed into defined flow; the defined TCP and / or UDP flow is unpacked, index data is analyzed, and the name in the configuration file is associated to display the defined TCP and / or UDP flow; if the TCP and / or UDP flow is finally undefined, protocol flow characteristics are extracted, index data is analyzed, and corresponding TCP and / or UDP flow information is displayed. The application improves the comprehensiveness, accuracy, universality and individuality of flow identification.

Description

Technical Field

[0001] This invention belongs to the field of network traffic identification, specifically relating to a method and system for full traffic identification and analysis based on network ports. Background Technology

[0002] With the acceleration of digitalization, network traffic is growing exponentially. From the perspective of traffic source, defined traffic and undefined traffic constitute total traffic. Defined traffic refers to traffic from known protocols or applications (such as HTTP, DNS, and Zoom), which can be identified based on feature databases (such as protocol ports and fingerprints). Undefined traffic refers to traffic that cannot be matched with existing feature databases (such as private IoT protocols and dark web communications). To ensure network security, it is necessary to identify all incoming traffic. Currently, from enterprise intranets to smart cities, traffic monitoring and identification have become key technologies for network security, performance optimization, and compliance management. For example, in network security, full traffic identification and analysis can identify threats such as DDoS attacks and malware propagation; in resource management, full traffic identification and analysis can optimize bandwidth allocation in cloud computing and IoT scenarios.

[0003] In existing technologies, full traffic identification and analysis generally includes three stages: packet capture (e.g., Wireshark, traffic mirroring), BPF preprocessing, and analysis and identification (rule matching, machine learning). The analysis and identification stage typically relies on a traffic feature library to match known traffic. These methods have the following limitations: they can only process defined traffic data; they rely on static matching mechanisms based on port-to-protocol mapping tables (e.g., forcibly associating TCP / 80 with HTTP); they cannot identify and analyze application traffic on ports outside the mapping table; and they cannot process private protocols or unknown traffic using uncommon network port data. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, the present invention aims to provide a method and system for full traffic identification and analysis based on network ports. For defined traffic, feature matching and classification are performed directly, while for undefined traffic, it is included in a separate analysis module for in-depth analysis to extract feature information for display, thereby realizing the identification of full traffic and improving the comprehensiveness and accuracy of traffic identification.

[0005] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0006] In a first aspect, embodiments of the present invention provide a method for full traffic identification and analysis based on network ports, including:

[0007] Step S1: Access the raw data packets of the full traffic to be identified and analyzed;

[0008] Step S2: Preset configuration file. The configuration file includes metrics in at least four dimensions, namely, manually definable TCP / UDP protocol type, port type, web type, and server type, and the metric dimensions are scalable.

[0009] Step S3: Based on the IP layer protocol number, the original data packets of the entire traffic are judged and split. For traffic with TCP characteristics, it is judged as TCP traffic and step S4 is executed; for traffic with UDP characteristics, it is judged as UDP traffic and step S5 is executed.

[0010] Step S4: Determine whether the TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, convert the convertible undefined traffic into defined traffic and expand the configuration file. Merge the converted defined traffic with the identified defined traffic to obtain defined TCP traffic and proceed to step S6. If it is ultimately undefined TCP traffic, proceed to step S7.

[0011] Step S5: Determine whether the UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, convert the convertible undefined traffic into defined traffic and expand the configuration file. Merge the converted defined traffic with the identified defined traffic to obtain defined UDP traffic and proceed to step S6. If it is ultimately undefined UDP traffic, proceed to step S7.

[0012] Step S6: Disassemble the defined TCP traffic and / or defined UDP traffic, analyze the various indicator data, associate them with the names in the configuration file, and display the defined TCP traffic and / or defined UDP traffic in the corresponding area;

[0013] Step S7: Extract protocol traffic features for the final undefined TCP traffic and / or the final undefined UDP traffic, analyze the various indicator data, and display the corresponding TCP traffic information and / or UDP traffic information.

[0014] In a preferred embodiment of the present invention, when the full traffic original data packet is accessed in step S1, the physical port uses the method of mirroring traffic to copy the traffic to be monitored.

[0015] In a preferred embodiment of the present invention, the physical port is implemented using a Layer 2 manageable switch.

[0016] In a preferred embodiment of the present invention, when setting the configuration file, a database of correspondence between applications and ports is constructed based on the IANA standard port library and combined with custom rules.

[0017] In a preferred embodiment of the present invention, the traffic is passively matched with the configuration file to obtain the defined traffic, and the remainder is the undefined traffic. The identified undefined traffic is then actively identified. Traffic that is determined to be identifiable during active identification is considered as convertible undefined traffic. The convertible undefined traffic and its corresponding port are converted into defined traffic and manually defined and added to the configuration file to complete the expansion of the configuration file.

[0018] In a preferred embodiment of the present invention, when performing data determination and flow division on the original data packets of the full traffic according to the IP layer protocol number in step S3, an IP address identifies a host, and the IP packet header has a field used to identify the upper layer protocol type.

[0019] In a preferred embodiment of the present invention, in the IP layer protocol number, protocol number 6 is used to identify TCP traffic and protocol number 17 is used to identify UDP traffic.

[0020] In a preferred embodiment of the present invention, step S4, determining whether the TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic, specifically includes:

[0021] Step S41: According to the preset configuration file, query the session destination port in the TCP traffic; if the port is within the range of the configuration file, the TCP traffic is determined to be defined TCP traffic; if the port is not within the range of the configuration file, the TCP traffic is determined to be initially undefined TCP traffic.

[0022] Step S42: The user actively identifies the initially undefined TCP traffic; if the initially undefined TCP traffic is an identifiable application, then proceed to step S43; if the undefined TCP traffic is an unidentifiable application, then it is determined to be the final undefined TCP traffic.

[0023] Step S43: Manually define and add TCP ports and corresponding port ranges in the preset configuration file, convert the currently undefined TCP traffic into defined TCP traffic, and merge it with the defined TCP traffic in step S42.

[0024] In a preferred embodiment of the present invention, determining whether UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic specifically includes:

[0025] Step S51: According to the preset configuration file, query the session destination port in the UDP traffic; if the port is within the range of the configuration file, the UDP traffic is determined to be defined UDP traffic; if the port is not within the range of the configuration file, the UDP traffic is determined to be initially undefined UDP traffic.

[0026] Step S52: The user actively identifies the initially undefined UDP traffic; if the initially undefined UDP traffic is an identifiable application, then proceed to step S53; if the undefined UDP traffic is an unidentifiable application, then it is determined to be the final undefined UDP traffic.

[0027] Step S53: Manually define and add UDP ports and corresponding port ranges in the preset configuration file, convert the currently undefined UDP traffic into defined UDP traffic, and merge it with the defined UDP traffic in step S52.

[0028] Secondly, embodiments of the present invention also provide a full traffic identification and analysis system based on network ports. The system includes: a data access port, a configuration file preset module, a traffic splitting module, a TCP identification module, a UDP identification module, a defined traffic analysis module, an undefined traffic analysis module, and a display module; wherein,

[0029] The data access port is used to access the raw data packets of the full traffic to be identified and analyzed;

[0030] The configuration file preset module is used to preset the configuration file. The configuration file includes indicators in at least four dimensions, namely, manually definable TCP / UDP protocol type, port type, web type and server type, and the indicator dimensions are scalable.

[0031] The traffic splitting module is used to determine and split the raw data packets of the entire traffic according to the IP layer protocol number. For traffic with TCP characteristics, it is determined to be TCP traffic and sent to the TCP identification module; for traffic with UDP characteristics, it is determined to be UDP traffic and sent to the UDP identification module.

[0032] The TCP identification module is used to determine whether TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, the convertible undefined traffic is converted into defined traffic and the configuration file is expanded. The converted defined traffic is merged with the identified defined traffic to obtain defined TCP traffic, which is then sent to the defined traffic analysis module. If it is ultimately undefined TCP traffic, it is sent to the undefined traffic analysis module.

[0033] The UDP identification module is used to determine whether UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, the convertible undefined traffic is converted into defined traffic and the configuration file is expanded. The converted defined traffic is then merged with the identified defined traffic to obtain defined UDP traffic, which is then sent to the defined traffic analysis module. If it is ultimately undefined UDP traffic, it is sent to the undefined traffic analysis module.

[0034] The defined traffic analysis module is used to disassemble defined TCP traffic and / or defined UDP traffic, analyze various indicator data, associate them with the names in the configuration file, and send the association results to the display module.

[0035] The undefined traffic analysis module is used to extract protocol traffic features from the final undefined TCP traffic and / or the final undefined UDP traffic, analyze various indicator data, and send the corresponding TCP traffic information and / or UDP traffic information to the display module.

[0036] The display module is used to display defined TCP traffic, defined UDP traffic, and ultimately undefined TCP traffic information and / or ultimately undefined UDP traffic information.

[0037] The technical solutions provided in the embodiments of the present invention have the following beneficial effects:

[0038] The network port-based full traffic identification and analysis method and system provided in this invention realizes the identification and analysis of all traffic in the network, improves the accuracy of network situational awareness for administrators, and enhances the accuracy of traffic identification. It supports automatic extraction of unknown protocol features, significantly improves the ability to identify protocols negotiated on uncommon ports, and enhances the comprehensiveness of traffic identification. Simultaneously, it enables personalized traffic identification, allowing for the identification of undefined traffic through passive and / or active methods according to user needs. Furthermore, it optimizes resource utilization efficiency by reducing the maintenance cost of the feature library through a protocol feature extraction engine and employing a traffic feature pre-screening mechanism to reduce the time spent on invalid traffic analysis, thus saving resources.

[0039] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a flowchart of the full traffic identification and analysis method based on network ports as described in an embodiment of the present invention. Detailed Implementation

[0042] After discovering the aforementioned problems, the inventors of this application conducted a detailed study of existing traffic identification methods and systems. The study found that existing traffic identification methods generally only focus on defined traffic, while undefined traffic is typically discarded to ensure network security, but this method results in the loss of some traffic. The researchers of this application discovered that traffic can be categorized into TCP and UDP traffic; TCP is a connection-oriented reliable transmission protocol that provides flow control, congestion control, and data integrity verification; while UDP is a connectionless lightweight transmission protocol that emphasizes low latency and high throughput. Both types of traffic contain defined and undefined traffic. A network port is a logical communication endpoint in a computer network used to identify and distinguish different applications or services. A network port is not a physical interface but an abstract numerical identifier (range: 0-65535), which, together with the IP address, constitutes the complete address for network communication (i.e., IP address: port number). Classifying traffic based on network port categories before identifying defined and undefined traffic can effectively improve the comprehensiveness and accuracy of traffic identification.

[0043] It should be noted that the defects in the above-mentioned prior art solutions are all the result of the inventors' practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the embodiments of the present invention in the following text should be the inventors' contributions to the present invention.

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. It should be noted that, without conflict, the embodiments and features in the embodiments of the present invention can also be combined with each other.

[0045] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In the description of the invention, the terms "first," "second," "third," "fourth," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0046] Based on the above in-depth analysis, this invention provides a method and system for full traffic identification and analysis based on network ports. Without any manual intervention, it automatically identifies unknown TCP and UDP traffic information in the network. For each category, it directly performs feature matching and classification for defined traffic, and for undefined traffic, it includes it in a separate analysis module for in-depth analysis, extracting and displaying feature information. It is suitable for scenarios such as private protocol application monitoring, encrypted traffic detection, network performance optimization, and network security monitoring.

[0047] like Figure 1 As shown, the full traffic identification and analysis method based on network ports includes the following steps:

[0048] Step S1: Access the raw data packets of the full traffic to be identified and analyzed.

[0049] In this step, preferably, the physical port uses traffic mirroring to copy the traffic to be monitored into the system, serving as the traffic source for the entire analysis process. The physical port is a Layer 2 manageable switch, which uses mirroring to copy all traffic information from different sources to the designated physical port.

[0050] Step S2: Preset configuration file. The configuration file includes indicators in at least four dimensions, namely, manually definable TCP / UDP protocol type, port type, web type, and server type, and the indicator dimensions are scalable.

[0051] In this step, for the configuration file, preferably, a database of correspondence between applications and ports is built based on the IANA standard port library, combined with custom rules (supporting custom applications), thus forming the configuration file. Among the four dimensions of the configuration file, the manually defined TCP / UDP protocol type generally refers to the system's default identifiable applications. When configuring, the port number and range, IP address and range, and traffic-related URLs can be manually defined, defining a strong correlation between the indicator content and the overall traffic information. For known but unconventional traffic data, three optional applications—port type, web type, and server type—can be manually created. By combining the above multi-dimensional indicators, the overall traffic data is identified and analyzed, thereby achieving more accurate identification and matching of known traffic. Users can also manually create these three optional application types according to their needs to achieve personalized traffic identification.

[0052] Meanwhile, the configuration file is extensible, with the extension section used for proactive identification of convertible undefined traffic. After passively matching traffic with the configuration file, defined traffic is obtained, and the remainder is undefined traffic. The identified undefined traffic is then proactively identified. If the undefined traffic can be proactively identified, it is considered convertible and is determined to be identifiable traffic during proactive identification. This convertible undefined traffic and its corresponding port are then converted into defined traffic and manually defined and added to the configuration file. This involves manually creating relevant applications to extend the configuration file, converting the identified applications and their corresponding ports into defined traffic, and merging them with the identified defined traffic to obtain complete defined TCP / UDP traffic. This improves the accuracy, precision, and comprehensiveness of full traffic identification and enables flexible management of full traffic identification rules. Users can not only customize the traffic to be identified to passively identify defined traffic according to their needs, but also proactively identify existing undefined traffic and customize relevant applications based on the undefined traffic, achieving flexible deployment of the full traffic identification and analysis method.

[0053] Step S3: Based on the IP layer protocol number, perform data determination and traffic splitting on the original data packets of the entire traffic. For traffic with TCP characteristics, determine it as TCP traffic and proceed to step S4; for traffic with UDP characteristics, determine it as UDP traffic and proceed to step S5.

[0054] In this step, when using IP layer protocol numbers for identification, an IP address can identify a host. The IP packet header has a field that identifies the upper-layer protocol type. Based on the protocol number in this field, it's determined whether the data transmitted via IP is TCP or UDP traffic. In the IP layer protocol number field, protocol number 6 identifies TCP traffic, and protocol number 17 identifies UDP traffic. This step uses IP layer protocol numbers to classify the raw traffic into TCP or UDP traffic. This facilitates more accurate identification based on the data characteristics under TCP in the subsequent identification of defined and undefined traffic, effectively identifying defined and undefined applications. It also facilitates further classification and processing of undefined traffic, ultimately providing a comprehensive and accurate display of defined and undefined traffic under TCP and UDP.

[0055] Step S4: Determine whether the TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, convert the convertible undefined traffic into defined traffic and expand the configuration file. Merge the converted defined traffic with the identified defined traffic to obtain defined TCP traffic and proceed to step S6. If it is ultimately undefined TCP traffic, proceed to step S7.

[0056] This step determines whether TCP traffic is defined, convertible to undefined, or ultimately undefined, specifically including:

[0057] Step S41: According to the preset configuration file, query the session destination port in the TCP traffic; if the port is within the range of the configuration file, the TCP traffic is determined to be defined TCP traffic; if the port is not within the range of the configuration file, the TCP traffic is determined to be initially undefined TCP traffic.

[0058] Step S42: The user actively identifies the initially undefined TCP traffic; if the initially undefined TCP traffic is an identifiable application, then proceed to step S43; if the undefined TCP traffic is an unidentifiable application, then it is determined to be the final undefined TCP traffic.

[0059] Step S43: Manually define and add TCP ports and corresponding port ranges in the preset configuration file, convert the currently undefined TCP traffic into defined TCP traffic, and merge it with the defined TCP traffic in step S42.

[0060] Step S5: Determine whether the UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, convert the convertible undefined traffic into defined traffic and expand the configuration file. Merge the converted defined traffic with the identified defined traffic to obtain defined UDP traffic and proceed to step S6. If it is ultimately undefined UDP traffic, proceed to step S7.

[0061] This step determines whether the UDP traffic is defined, convertible to undefined, or ultimately undefined, specifically including:

[0062] Step S51: According to the preset configuration file, query the session destination port in the UDP traffic; if the port is within the range of the configuration file, the UDP traffic is determined to be defined UDP traffic; if the port is not within the range of the configuration file, the UDP traffic is determined to be initially undefined UDP traffic.

[0063] Step S52: The user actively identifies the initially undefined UDP traffic; if the initially undefined UDP traffic is an identifiable application, then proceed to step S53; if the undefined UDP traffic is an unidentifiable application, then it is determined to be the final undefined UDP traffic.

[0064] Step S53: Manually define and add UDP ports and corresponding port ranges in the preset configuration file, convert the currently undefined UDP traffic into defined UDP traffic, and merge it with the defined UDP traffic in step S52.

[0065] Step S6: Disassemble the defined TCP traffic and / or defined UDP traffic, analyze various indicator data, associate them with the names in the configuration file, and display the defined TCP traffic and / or defined UDP traffic in the corresponding area.

[0066] Step S7: Extract protocol traffic features for the final undefined TCP traffic and / or the final undefined UDP traffic, analyze the various indicator data, and display the corresponding TCP traffic information and / or UDP traffic information.

[0067] In steps S6 and S7, the various indicator data include three categories: business indicators, application indicators, and object indicators. Each category contains several secondary indicators. For example, business indicators include network usage indicators, service access indicators, and service performance indicators; application indicators include traffic throughput, number of bytes, number of successful connections, and number of failed connections, and calculate success rate, failure rate, packet loss, and user experience time; object indicators include object data packet indicators, object transmission efficiency indicators, and object network performance indicators.

[0068] Additionally, in step S7, when extracting protocol traffic features for the final undefined TCP traffic and final undefined UDP traffic, a deep analysis engine can be used to distinguish between encrypted and unencrypted traffic and to parse the traffic data. Further blocking or other processing can be performed on the final displayed undefined TCP traffic and final undefined UDP traffic as needed.

[0069] Based on the same idea, this invention also provides a network port-based full traffic identification and analysis system, which includes: a data access port, a configuration file preset module, a traffic splitting module, a TCP identification module, a UDP identification module, a defined traffic analysis module, an undefined traffic analysis module, and a display module.

[0070] The data access port is used to access the raw data packets of the full traffic to be identified and analyzed;

[0071] The configuration file preset module is used to preset the configuration file. The configuration file includes indicators in at least four dimensions, namely, manually definable TCP / UDP protocol type, port type, web type and server type, and the indicator dimensions are scalable.

[0072] The traffic splitting module is used to determine and split the raw data packets of the entire traffic according to the IP layer protocol number. For traffic with TCP characteristics, it is determined to be TCP traffic and sent to the TCP identification module; for traffic with UDP characteristics, it is determined to be UDP traffic and sent to the UDP identification module.

[0073] The TCP identification module is used to determine whether TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, the convertible undefined traffic is converted into defined traffic and the configuration file is expanded. The converted defined traffic is then merged with the identified defined traffic to obtain defined TCP traffic, which is then sent to the defined traffic analysis module. If it is ultimately undefined TCP traffic, it is sent to the undefined traffic analysis module.

[0074] The UDP identification module is used to determine whether UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, the convertible undefined traffic is converted into defined traffic and the configuration file is expanded. The converted defined traffic is then merged with the identified defined traffic to obtain defined UDP traffic, which is then sent to the defined traffic analysis module. If it is ultimately undefined UDP traffic, it is sent to the undefined traffic analysis module.

[0075] The defined traffic analysis module is used to disassemble defined TCP traffic and / or defined UDP traffic, analyze various indicator data, associate them with the names in the configuration file, and send the association results to the display module.

[0076] The undefined traffic analysis module is used to extract protocol traffic features from the final undefined TCP traffic and / or the final undefined UDP traffic, analyze various indicator data, and send the corresponding TCP traffic information and / or UDP traffic information to the display module.

[0077] The display module is used to display defined TCP traffic, defined UDP traffic, and ultimately undefined TCP traffic information and / or ultimately undefined UDP traffic information.

[0078] In this embodiment, each module is implemented using a processor, with additional memory added as needed for storage. The processor can be, but is not limited to, a microprocessor (MPU), a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, etc. The memory can include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0079] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0080] It should also be noted that the network port-based full traffic identification and analysis system and the network port-based full traffic identification and analysis method described in this embodiment are corresponding. The description and limitations of the method also apply to the system, and will not be repeated here.

[0081] As can be seen from the above technical solutions, the network port-based full traffic identification and analysis method and system provided by the embodiments of the present invention realize the identification and analysis of full traffic in the network, improve the accuracy of network situational awareness for administrators, and enhance the accuracy of traffic identification; it supports automatic extraction of unknown protocol features, significantly improves the ability to identify protocols negotiated on uncommon ports, and enhances the comprehensiveness of traffic identification; at the same time, it can realize personalized traffic identification, and can identify undefined traffic in a passive and / or active manner according to user needs; it also optimizes resource utilization efficiency, reduces the maintenance cost of the feature library through the protocol feature extraction engine, and reduces the time spent on invalid traffic analysis by adopting a traffic feature pre-screening mechanism, thus saving resources.

[0082] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed, and is not intended to limit the scope of the claimed invention, but merely to illustrate preferred embodiments of the invention. Those skilled in the art should understand that the scope of the invention is not limited to the specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A method for full traffic identification and analysis based on network ports, characterized in that, include: Step S1: Access the raw data packets of the full traffic to be identified and analyzed; Step S2: Preset configuration file. The configuration file includes metrics in at least four dimensions, namely, manually definable TCP / UDP protocol type, port type, web type, and server type, and the metric dimensions are scalable. Step S3: Based on the IP layer protocol number, the original data packets of the entire traffic are judged and split. For traffic with TCP characteristics, it is judged as TCP traffic and step S4 is executed; for traffic with UDP characteristics, it is judged as UDP traffic and step S5 is executed. Step S4: Determine whether the TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, convert the convertible undefined traffic and its corresponding port into defined traffic, manually define and add it to the configuration file, merge the converted defined traffic with the identified defined traffic to obtain defined TCP traffic, and execute step S6; if it is ultimately undefined TCP traffic, execute step S7. Step S5: Determine whether the UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, convert the convertible undefined traffic and its corresponding port into defined traffic, manually define and add it to the configuration file, merge the converted defined traffic with the identified defined traffic to obtain defined UDP traffic, and execute step S6; if it is ultimately undefined UDP traffic, execute step S7. Step S6: Disassemble the defined TCP traffic and / or defined UDP traffic, analyze the various indicator data, associate them with the names in the configuration file, and display the defined TCP traffic and / or defined UDP traffic in the corresponding area; Step S7: Extract protocol traffic features for the final undefined TCP traffic and / or the final undefined UDP traffic, analyze the various indicator data, and display the corresponding TCP traffic information and / or UDP traffic information.

2. The full traffic identification and analysis method based on network ports according to claim 1, characterized in that, When the full traffic raw data packet is accessed in step S1, the physical port uses the method of mirroring traffic to copy the traffic to be monitored.

3. The full traffic identification and analysis method based on network ports according to claim 2, characterized in that, The physical ports are implemented using a Layer 2 manageable switch.

4. The method for full traffic identification and analysis based on network ports according to claim 1, characterized in that, When setting up the configuration file, a database of correspondences between applications and ports is built based on the IANA standard port library and combined with custom rules.

5. The full traffic identification and analysis method based on network ports according to claim 4, characterized in that, After passively matching traffic with the configuration file, defined traffic is obtained, and the rest is undefined traffic. The identified undefined traffic is then actively identified. Traffic that is determined to be identifiable during active identification is considered convertible undefined traffic. The convertible undefined traffic and its corresponding port are converted into defined traffic and manually defined and added to the configuration file to complete the expansion of the configuration file.

6. The full traffic identification and analysis method based on network ports according to claim 1, characterized in that, In step S3, when performing data determination and flow division on the raw data packets of the entire traffic based on the IP layer protocol number, an IP address identifies a host, and the IP packet header has a field used to identify the upper layer protocol type.

7. The full traffic identification and analysis method based on network ports according to claim 6, characterized in that, In the IP layer protocol numbering, protocol number 6 is used to identify TCP traffic, and protocol number 17 is used to identify UDP traffic.

8. The full traffic identification and analysis method based on network ports according to claim 1, characterized in that, Step S4 determines whether the TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic, specifically including: Step S41: According to the preset configuration file, query the session destination port in the TCP traffic; if the port is within the range of the configuration file, the TCP traffic is determined to be defined TCP traffic; if the port is not within the range of the configuration file, the TCP traffic is determined to be initially undefined TCP traffic. Step S42: The user actively identifies the initially undefined TCP traffic; if the initially undefined TCP traffic is an identifiable application, then proceed to step S43; if the undefined TCP traffic is an unidentifiable application, then it is determined to be the final undefined TCP traffic. Step S43: Manually define and add TCP ports and corresponding port ranges in the preset configuration file, convert the currently undefined TCP traffic into defined TCP traffic, and merge it with the defined TCP traffic in step S42.

9. The full traffic identification and analysis method based on network ports according to claim 1, characterized in that, Determining whether UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic includes: Step S51: According to the preset configuration file, query the session destination port in the UDP traffic; if the port is within the range of the configuration file, the UDP traffic is determined to be defined UDP traffic; if the port is not within the range of the configuration file, the UDP traffic is determined to be initially undefined UDP traffic. Step S52: The user actively identifies the initially undefined UDP traffic; if the initially undefined UDP traffic is an identifiable application, then proceed to step S53; if the undefined UDP traffic is an unidentifiable application, then it is determined to be the final undefined UDP traffic. Step S53: Manually define and add UDP ports and corresponding port ranges in the preset configuration file, convert the currently undefined UDP traffic into defined UDP traffic, and merge it with the defined UDP traffic in step S52.

10. A full traffic identification and analysis system based on network ports, characterized in that, The system includes: a data access port, a configuration file preset module, a traffic splitting module, a TCP identification module, a UDP identification module, a defined traffic analysis module, an undefined traffic analysis module, and a display module; wherein, The data access port is used to access the raw data packets of the full traffic to be identified and analyzed; The configuration file preset module is used to preset the configuration file. The configuration file includes indicators in at least four dimensions, namely, manually definable TCP / UDP protocol type, port type, web type and server type, and the indicator dimensions are scalable. The traffic splitting module is used to determine and split the raw data packets of the entire traffic according to the IP layer protocol number. For traffic with TCP characteristics, it is determined to be TCP traffic and sent to the TCP identification module; for traffic with UDP characteristics, it is determined to be UDP traffic and sent to the UDP identification module. The TCP identification module is used to determine whether TCP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, the convertible undefined traffic and its corresponding port are converted into defined traffic, and manually defined and added to the configuration file. The converted defined traffic is then merged with the identified defined traffic to obtain defined TCP traffic, which is then sent to the defined traffic analysis module. If it is ultimately undefined TCP traffic, it is sent to the undefined traffic analysis module. The UDP identification module is used to determine whether UDP traffic is defined traffic, convertible undefined traffic, or ultimately undefined traffic by using a preset configuration file and active identification. If it is defined traffic and / or convertible undefined traffic, the convertible undefined traffic and its corresponding port are converted into defined traffic, and manually defined and added to the configuration file. The converted defined traffic is then merged with the identified defined traffic to obtain defined UDP traffic, which is then sent to the defined traffic analysis module. If it is ultimately undefined UDP traffic, it is sent to the undefined traffic analysis module. The defined traffic analysis module is used to disassemble defined TCP traffic and / or defined UDP traffic, analyze various indicator data, associate them with the names in the configuration file, and send the association results to the display module. The undefined traffic analysis module is used to extract protocol traffic features from the final undefined TCP traffic and / or the final undefined UDP traffic, analyze various indicator data, and send the corresponding TCP traffic information and / or UDP traffic information to the display module. The display module is used to display defined TCP traffic, defined UDP traffic, and ultimately undefined TCP traffic information and / or ultimately undefined UDP traffic information.

Images