Service type identification method, electronic equipment and storage medium

Abstract

The invention discloses a business type identification method, electronic equipment and a storage medium, belongs to the field of communication, and is used for improving business type identification performance. The method comprises the following steps: acquiring a target identifier of a message to be identified; under the condition that the target identifier is matched with a historical identifier in a historical context, searching a historical service type corresponding to the historical identifier in the historical context, the historical service type being obtained by identifying a historical message; and outputting the historical service type as the service type of the message to be identified.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of communication, and particularly relates to a service type identification method, an electronic device and a storage medium. BACKGROUND

[0002] Deep packet inspection (DPI) technology is a network traffic analysis technology, which usually identifies and classifies service traffic according to domain name information. For a UDP-based multiplexed and secure transport (QUIC) protocol, a DPI system will first decrypt a QUIC initial packet and reorder and recombine the CRYPTO frame, and then try to match the SNI field domain name information of the TLS1.3 ClientHello message in the CRYPTO frame.

[0003] Since the decryption process of the QUIC initial packet requires a large amount of CPU processing time, as the QUIC service traffic increases, the negative impact of the QUIC service identification and classification function on the performance of the DPI device becomes greater and greater, which can cause the problem of significant performance degradation of the DPI system. SUMMARY

[0004] The embodiments of the present application provide a service type identification method, an electronic device and a storage medium, which can solve the problem of system performance degradation caused by deep packet inspection during service type identification.

[0005] In a first aspect, the embodiments of the present application provide a service type identification method, which comprises: obtaining a target identifier of a to-be-identified packet; in a case where the target identifier matches a historical identifier in a historical context, finding a historical service type corresponding to the historical identifier in the historical context, the historical service type being obtained by identifying a historical packet; and outputting the historical service type as a service type of the to-be-identified packet.

[0006] In a second aspect, the embodiments of the present application provide a service type identification device, which comprises: an obtaining module configured to obtain a target identifier of a to-be-identified packet; an identification module configured to, in a case where the target identifier matches a historical identifier in a historical context, find a historical service type corresponding to the historical identifier in the historical context, the historical service type being obtained by identifying a historical packet; and an output module configured to output the historical service type as a service type of the to-be-identified packet.

[0007] In a third aspect, an electronic device is provided, which includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the method according to the first aspect.

[0008] In a fourth aspect, a readable storage medium is provided, which stores a program or instructions, and the program or instructions, when executed by a processor, implement the steps of the method according to the first aspect.

[0009] In the embodiments of the present application, the target identifier of the to-be-identified message is acquired, the historical business type corresponding to the historical identifier in the historical context is found in a case where the target identifier matches the historical identifier in the historical context, the historical business type is obtained by identifying historical messages, and the historical business type is output as the business type of the to-be-identified message. The historical business type corresponding to the historical identifier in the historical context is found, and then the historical business type is output as the business type of the to-be-identified message, so that the process of business type identification is shortened, and the performance and efficiency of business type identification are improved. BRIEF DESCRIPTION OF DRAWINGS

[0010] Figure 1 is a framework schematic diagram of a QUIC acceleration identification system provided by the embodiments of the present application;

[0011] Figure 2 is a schematic diagram of a flow context provided by the embodiments of the present application;

[0012] Figure 3 is a flow schematic diagram of a business type identification method provided by the embodiments of the present application;

[0013] Figure 4 is a schematic diagram of a first uplink initial message provided by the embodiments of the present application;

[0014] Figure 5 is a schematic diagram of a historical context provided by the embodiments of the present application;

[0015] Figure 6 is a decryption flow schematic diagram of a message provided by the embodiments of the present application;

[0016] Figure 7 is a schematic diagram of a learning context provided by the embodiments of the present application;

[0017] Figure 8 is a schematic diagram of a learning context array provided by the embodiments of the present application;

[0018] Figure 9is a flowchart of a process for calculating a user number statistic provided by an embodiment of the present application;

[0019] Figure 10 is a learning success logic diagram provided by an embodiment of the present application;

[0020] Figure 11 is a learning state management diagram provided by an embodiment of the present application;

[0021] Figure 12 is another learning state management diagram provided by an embodiment of the present application;

[0022] Figure 13 is another learning state management diagram provided by an embodiment of the present application;

[0023] Figure 14 is another learning state management diagram provided by an embodiment of the present application;

[0024] Figure 15 is a flowchart of another service type identification method provided by an embodiment of the present application;

[0025] Figure 16 is a structural diagram of a service type identification apparatus provided by an embodiment of the present application;

[0026] Figure 17 is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0028] The terms “first”, “second”, and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be exchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by “first”, “second”, and the like are generally of a kind and are not limited to the number of objects, for example, the first object can be one or more. In addition, “and / or” in the specification and claims indicates at least one of the connected objects, and the character “ / ” generally indicates that the front and rear associated objects are in an “or” relationship.

[0029] The embodiment of the application provides a QUIC acceleration identification system, and the identification of the service type can be realized through the QUIC acceleration identification system. Figure 1 As shown in the figure, the QUIC acceleration identification system includes a user datagram protocol (UDP) stream management module, a QUIC service identification module, a QUIC acceleration learning module and a QUIC acceleration identification module. The UDP stream management module is responsible for judging whether a UDP stream or a service stream is a QUIC protocol, and sending the first uplink initial message of the QUIC stream, that is, the to-be-identified message of the QUIC stream to the QUIC acceleration identification module. The UDP stream table managed by the module is a dynamic data set.

[0030] The QUIC acceleration identification module can receive the learning success or failure information sent by the QUIC acceleration learning module, and dynamically establish a historical context, which can also be called an acceleration context. The QUIC acceleration identification module can receive the to-be-identified message of the QUIC stream sent by the UDP stream management module, and identify the service type of the to-be-identified message according to the historical context, so as to bypass the decryption and other complex processing of the QUIC service identification module, thereby accelerating the identification process. The acceleration table managed by the module is a dynamic data set, and the acceleration table includes the historical context described above.

[0031] The QUIC acceleration learning module can receive the service type identification result information reported by the QUIC service identification module, dynamically learn through an online statistical learning algorithm, and send the learning success / failure information to the QUIC acceleration identification module. The learning table managed by the module is a dynamic data set.

[0032] The QUIC service identification module can receive the first uplink initial message (to-be-identified message) of the QUIC stream sent by the QUIC acceleration identification module, decrypt, sort, reorganize, decode, match features, identify the service classification, and report the service type identification result to the QUIC acceleration learning module. The feature table managed by the module is a static data set.

[0033] The UDP stream management module can realize a dynamic UDP stream table with a five-tuple as a key. The five-tuple can be a user IP address, a user UDP port, a server IP address, a server UDP port and an IP protocol type. The IP protocol type is 17, indicating UDP, because QUIC is based on UDP. The module attributes the messages with the same five-tuple to the same flow context in the UDP stream table, and a key uniquely identifies a flow context. The data content of the flow context includes the state and identification result information of the flow, for example Figure 2The information shown includes whether the flow definitely cannot contain an uplink initial packet, whether the flow has appeared a first uplink initial packet, whether the flow has been identified, an identification result of the flow, a flow creation timestamp, a flow latest packet timestamp, an uplink packet number statistic of the flow, a downlink packet number statistic of the flow, an uplink byte number statistic of the flow, a downlink byte number statistic of the flow, and the like.

[0034] The service type identification method provided by the embodiments of the present application, the electronic device, and the storage medium will be described in detail below with reference to the accompanying drawings, specific embodiments, and application scenarios.

[0035] Figure 3 An embodiment of the present application provides a service type identification method. The method can be executed by an electronic device, and the electronic device includes the QUIC acceleration identification system described above. In other words, the method can be executed by software or hardware installed on the electronic device. The method includes the following steps:

[0036] Step 302: Obtain a target identifier of a to-be-identified packet.

[0037] Specifically, the UDP flow management module receives a UDP packet, extracts a five-tuple from the packet, and searches for the UDP flow table by using the five-tuple as a key. The following two cases are distinguished.

[0038] Case one: If the flow context can be searched, the flow context is obtained for subsequent processing.

[0039] The UDP flow management module adds 0 or 1 to the uplink packet number of the flow according to the direction of the packet, adds 0 or 1 to the downlink packet number of the flow according to the direction of the packet, adds 0 or the length to the uplink byte number of the flow according to the direction and length of the packet, and adds 0 or the length to the downlink byte number of the flow according to the direction and length of the packet. The module sets the latest packet timestamp of the flow to the current time.

[0040] Case two: If the flow context cannot be searched, a flow context is newly created in the UDP flow table, the five-tuple is used as the key of the flow context, and the following information is recorded in the data of the flow context: whether the flow definitely cannot contain an uplink initial packet is set to no, whether the flow has appeared a first uplink initial packet is set to no, whether the flow has been identified is set to no, the identification result of the flow is set to empty, the flow creation timestamp is set to the current time, the flow latest packet timestamp is set to the current time, the uplink packet number statistic of the flow is set to 0, the downlink packet number statistic of the flow is set to 0, the uplink byte number statistic of the flow is set to 0, and the downlink byte number statistic of the flow is set to 0. Then, the module obtains the newly created flow context for subsequent processing.

[0041] In addition, the UDP flow management module can receive a five-tuple of a first uplink initial packet of a certain flow from the QUIC service identification module and identification result information of the five-tuple, find a corresponding flow context in the UDP flow table by taking the five-tuple as a key, and record the identification result in the flow context as a service type identification result of the flow.

[0042] The UDP flow management module can obtain a to-be-identified packet in a UDP flow. In an embodiment of the present application, the to-be-identified packet is a first uplink initial packet of a received UDP flow. The specific conditions for determining whether a packet is a first uplink initial packet of a QUIC flow by the UDP flow management module are as follows: the direction of the packet is uplink (i.e., from the user terminal side to the network server side), the type of the packet is a QUIC initial type (decoded according to RFC 9000 QUIC v1 or RFC 9369 QUIC v2), the QUIC header of the packet is a QUIC long header (divided into a long header and a short header according to RFC 9000 QUIC v1), the UDP payload length of the packet is at least 1200 bytes (specified according to the RFC 9000 QUIC v1 protocol), the QUIC version number of the packet is a legal value (for example, the QUIC v1 version number in RFC 9000 is “0x00000001”, and the QUIC v2 version number in RFC 9369 is “0x6b3343cf”), and there can be only 0 or more 0-RTT type uplink long header QUIC packets before the packet in the flow. That is, there can be no downlink packet, no other type of QUIC packet, and no non-QUIC packet before the target packet in the flow.

[0043] As an example, for example Figure 4 The judgment of whether a QUIC flow has a first uplink initial packet is shown in the figure, where the No. 1 packet of the first QUIC flow is the first uplink initial packet of the first QUIC flow. The No. 2 packet of the second QUIC flow is the first uplink initial packet of the second QUIC flow because there is only an uplink 0-RTT type long header packet before it. The No. 1 packet of the third QUIC flow is a short header packet, so it is considered that the third QUIC flow does not have a first uplink initial packet, i.e., there is no to-be-identified packet.

[0044] Specifically, the UDP stream management module can obtain a to-be-identified message (the first uplink initial message) of a UDP stream, and send the to-be-identified message to the QUIC acceleration identification module for processing. The to-be-identified message carries a target identifier, which can be a triple of the to-be-identified message: a server IP address, a server UDP port, and an IP protocol type, wherein the IP protocol type is 17, indicating UDP. Therefore, after receiving the to-be-identified message by the QUIC acceleration identification module, the target identifier can be obtained from the to-be-identified message, that is, the server IP address, the server UDP port, and the IP protocol type can be extracted from the to-be-identified message as the target identifier.

[0045] Step 304: In the case that the target identifier matches a historical identifier in the historical context, the historical service type corresponding to the historical identifier in the historical context is found.

[0046] In the embodiment of the present application, the historical service type is obtained by identifying a historical message, that is, the historical service type is a service type identification result of the historical message, and the historical message is a message whose service type is identified in advance by the QUIC service identification module. Specifically, a dynamic acceleration table with a historical identifier of a historical message as a key is implemented in the QUIC acceleration identification module. The historical identifier can be a triple of the historical message: a server IP address, a server UDP port, and an IP protocol type, wherein the IP protocol type is 17, indicating UDP.

[0047] The QUIC service identification module can attribute messages with the same historical identifier (triple) to the same historical context in the acceleration table, and one historical identifier uniquely identifies one historical context. The data content of the historical context includes the identification result of the service type and other information, for example Figure 5 The acceleration table shown in the figure can include: a historical identifier of a historical service, whether the historical context has been identified, a service type identification result of the historical context, a context creation timestamp, a latest access timestamp of the context, and the like.

[0048] Specifically, after receiving the to-be-identified message by the QUIC service identification module, the target identifier of the to-be-identified message can be used as a key to find a historical identifier matching the target identifier in the acceleration table. If the historical identifier matching the target identifier can be found, the historical service type corresponding to the historical identifier is found from the historical context corresponding to the historical identifier. If the historical identifier matching the target identifier cannot be found, the to-be-identified message is sent to the QUIC service identification module for service type identification.

[0049] Step 306: The historical service type is output as the service type of the to-be-identified message.

[0050] Specifically, in a case where the target identifier matches the historical identifier in the historical context, a historical service type corresponding to the historical identifier in the historical context is searched, and the historical service type is taken as a service type identification result of the to-be-identified packet, i.e., an identification result of the UDP flow to which the to-be-identified packet belongs. The target identifier of the to-be-identified packet and the searched historical service type are sent to the UDP flow management module for output. As an example, it is assumed that in a case where the target identifier of the to-be-identified packet matches the historical identifier in the historical context, a historical service type corresponding to the historical identifier in the historical context is searched, and the historical service type is obtained as "shopping website", then "shopping website" is taken as the service type of the to-be-identified packet, and "shopping website" is output as the service type of the to-be-identified packet.

[0051] The method for identifying a service type provided in the embodiments of the present application can obtain a target identifier of a to-be-identified packet, search for a historical service type corresponding to a historical identifier in a historical context in a case where the target identifier matches the historical identifier in the historical context, the historical service type being obtained by identifying a historical packet, and output the historical service type as the service type of the to-be-identified packet. The historical service type corresponding to the historical identifier in the historical context is searched, and then the historical service type is output as the service type of the to-be-identified packet, thereby shortening the process of service type identification, reducing resource consumption, improving the performance and efficiency of service type identification, and improving the QUIC service identification throughput.

[0052] In an implementation manner, before the target identifier of the to-be-identified packet is obtained, the method further includes:

[0053] In a case where the historical service type is obtained by identifying the historical packet, a learning context matching the historical identifier is obtained, a user number statistic and a traffic number corresponding to the historical service type in the learning context are calculated, and in a case where it is determined that the calculated user number statistic and the traffic number corresponding to the historical service type satisfy a preset learning success condition, the historical context is generated or updated according to the historical identifier and the historical service type in the learning context.

[0054] Specifically, the service type of the historical message can be identified by the QUIC service identification module. The QUIC service identification module can implement a static feature table, in which a plurality of regular expression rules are usually preset, used to match the SNI domain name part of the QUIC flow, and the matched QUIC flow can be identified as the service type specified by the rule. The QUIC service identification module receives the historical message of the QUIC UDP flow forwarded by the QUIC acceleration identification module. The QUIC service identification module compares the QUIC version number in the header of the historical message with the preset information of various QUIC version numbers and whether the QUIC content is encrypted, to determine whether the QUIC content in the historical message is encrypted. For example, the QUIC v1 version number in RFC 9000 is "0x00000001", the QUIC v2 version number in RFC 9369 is "0x6b3343cf", and if the QUIC version number of the historical message matches the two version numbers, it is considered that the QUIC content in the historical message is encrypted. According to whether the QUIC content in the historical message is encrypted, the following two cases are divided:

[0055] Case one: if the QUIC content in the historical message is not encrypted, the QUIC service identification module decodes according to the TLS 1.3 ClientHello message format, and obtains the SNI domain name content, performs identification classification on the domain name to obtain a service type identification result, takes the service type result as the historical service type of the historical message, and sends the five-tuple of the message and the historical service type to the UDP flow management module.

[0056] Case two: if the QUIC content in the historical message is encrypted, Figure 6If the historical message QUIC content is encrypted, the QUIC service identification module obtains the preset corresponding SALT value according to the QUIC version number, and based on the HKDF algorithm and the AES_128_ECB algorithm, according to the QUIC header encryption rule and the QUIC header encoding rule, the symmetric key, the encrypted content starting offset, the encrypted length, the initial vector, the associated data, and the authentication tag are calculated as the decryption parameters by taking "tls13client in", "tls13 quic iv" (or "tls13 quicv2 iv"), "tls13 quic hp" (or "tls13 quicv2 hp"), "tls13 quic key" (or "tls13 quicv2 key"), the SALT value, and the target connection ID as parameters. The QUIC service identification module decrypts the QUIC content using the AEAD_AES_128_GCM algorithm. These key generation materials, algorithms, decryption parameters, and decryption algorithms are processed and implemented according to the RFC protocol (such as RFC 9000 QUIC v1, RFC 9369 QUIC v2), and therefore are not described in detail here. The QUIC service identification module sorts and recombines the multiple CRYPTO frames, PING frames, and PADDING frames that may be arranged in disorder according to the QUIC frame type, the QUIC frame starting offset, and the QUIC frame length, thereby obtaining a complete CRYPTO frame. The TLS 1.3 ClientHello message is obtained from the decrypted and recombined CRYPTO frame and is decoded, and the SNI domain name content is obtained. The SNI domain name content is matched according to the rule, thereby obtaining the service type identification result, which is taken as the historical service type of the historical message and is output. The QUIC service identification module sends the five-tuple of the message and the historical service type to the UDP flow management module. The QUIC service identification module sends the five-tuple of the message and the historical service type to the QUIC acceleration learning module. In this way, the historical service type corresponding to the historical message can be obtained through the QUIC service identification module.

[0057] In the QUIC acceleration learning module, a dynamic learning table is implemented with a historical identifier (three-tuple) as the key. The three-tuple can be the server IP address, the server UDP port, and the IP protocol type. The IP protocol type is 17, indicating UDP.

[0058] The QUIC acceleration learning module classifies messages with the same identifier into the same learning context in the learning table, and one historical identifier uniquely identifies one learning context. The data content of the learning context includes the learning state and the service type identification result, and the like. Figure 7As shown, it includes: learning state (learning / learning success / learning failure), identification result array, total flow number, successful identification result, spot check identification result, spot check number, learning failure start time. Each element of the identification result array includes: identification result, user number statistics of the identification result, and flow number of the identification result.

[0059] The QUIC acceleration learning module receives the historical service type of the historical packet and the five-tuple of the historical packet sent by the QUIC service identification module, and looks up the learning table with the three-tuple of the server IP address, the server UDP port, and the IP protocol type (UDP) in the five-tuple as the key. If a learning context matching the historical identifier can be found, the learning context is obtained for subsequent processing. The QUIC acceleration learning module adds 1 to the total flow number in the learning context. This is because the system module process can guarantee that at most only one packet (that is, the first uplink initial packet of the QUIC flow) of a flow can be sent to the module.

[0060] In the QUIC acceleration learning module, an identification result array is established in the learning context matching the historical identifier, as shown in Figure 8 As shown, each element of the array contains: service type identification result, user number statistics of the service type identification result, and flow number of the service type identification result. The array form is adopted because a small amount of similar data is processed faster in the array form, but a linked list form can also be adopted.

[0061] In the identification result array of the learning context, the QUIC acceleration learning module looks up whether the historical service type corresponding to the historical identifier already exists. There are two cases:

[0062] Case 1: If the historical service type corresponding to the historical identifier does not exist in the array, the historical service type corresponding to the historical identifier obtained by the current identification is placed in the idle position in the array, and the user number statistics corresponding to the array element is set to empty and the flow number is set to 0. The array element is obtained for subsequent processing.

[0063] Case B: If the historical service type corresponding to the historical identifier already exists in the array, the array element is obtained for subsequent processing.

[0064] The user number statistics and the traffic number corresponding to the array element of the historical service type recognition result are calculated and updated by the QUIC acceleration learning module. In a case where the calculated user number statistics and the traffic number corresponding to the historical service type in the learning context meet a preset learning success condition, the historical context in the QUIC acceleration recognition module is generated or updated according to the historical identifier and the historical service type in the learning context. In this way, by pre-recognizing the historical message, the historical service type of the historical message is obtained, and the learning context and the historical context are obtained according to the historical service type of the historical message. When the historical identifier of the historical message is matched with the to-be-recognized message, the historical context is directly searched to obtain the service type recognition result of the to-be-recognized message, so that the to-be-recognized message is avoided to be decrypted, resource consumption is reduced, the performance and efficiency of service type recognition are improved, and the QUIC service recognition throughput of the DPI system is improved.

[0065] In an implementation manner, the calculating the user number statistics and the traffic number corresponding to the historical service type in the learning context comprises: obtaining a user Internet Protocol (IP) address corresponding to the historical service type; calculating the user number statistics according to the user IP address; and increasing the traffic number by a preset number.

[0066] Specifically, the user number statistics corresponding to the array element of the historical service type can be calculated and updated in the following manner:

[0067] The user IP address is obtained from the five-tuple corresponding to the historical service type, the user number statistics is calculated by using the user IP address, the module increases the flow number corresponding to the array element of the historical service type by a preset number, and the preset number can be 1.

[0068] In an implementation manner, the calculating the user number statistics according to the user IP address comprises: calculating a hash value of the user IP address; obtaining a first remainder result by taking each hash value modulo a first preset number; setting a first preset number of binary bits, and setting a bit corresponding to the first remainder result on the binary bits to 1; and calculating the user number statistics according to the bit set to 1 on the binary bits.

[0069] Specifically, the user IP address is obtained from the five-tuple, an appropriate hash algorithm (for example, a lightweight hash algorithm such as a DJB algorithm, or a heavyweight hash algorithm such as an MD5 algorithm) is selected to calculate a hash value of the user IP address, the hash value is taken modulo a preset M value, for example, M = 32, and the first remainder result X is a number between 0 and 31, for example, X = 3. For example, Figure 8As shown, in the array element, the first X bit is set to 1 as a statistical bitmap with M binary bits, although there may be different user IP addresses mapped to the same first X bit, the more the number of users, the more the number of binary bits with value 1 in the statistical bitmap, which indicates that the more the number of different users of the array element, and the number of binary bits with value 1 in this statistical bitmap forms a statistical quantity which is not accurate but statistically significant, which can represent how many different user numbers (different user IP address numbers). For example Figure 9 As shown, assuming M = 32, the number of binary bits with value 1 in the three statistical bitmaps is 6, 15, and 21, respectively, indicating fewer, more, and many users. In this way, the user number statistics can be calculated, and the memory space of the learning context occupied by this calculation method is very small and will not increase with the increase of the number of users, which occupies small and controllable memory resources.

[0070] In an implementation manner, the calculating the user number statistics and the flow number corresponding to the historical service type in the learning context comprises:

[0071] Obtaining the user internet protocol address corresponding to the historical service type; recording the number of user internet protocol addresses by using a linked list or a hash table to update the user number statistics; and increasing the flow number by a preset number.

[0072] Specifically, the user IP address can be obtained from the five-tuple, and in the array element, a plurality of different user IP addresses are recorded by using a linked list or a hash table. The flow number of the array element corresponding to the historical service type is increased by a preset number, which can be 1. In this way, the accurate user number can be obtained.

[0073] In an implementation manner, the learning success condition comprises: the updated user number statistics corresponding to the historical service type is greater than a first threshold value; the updated flow number corresponding to the historical service type is greater than a second threshold value; and a ratio of the updated flow number corresponding to the historical service type to a total flow number of the learning context is greater than a third threshold value.

[0074] The learning success condition checking method of the embodiments of the present application is that when the learning context is in a learning state, after the QUIC acceleration learning module receives the historical service type of the historical packet sent by the QUIC service identification module, the total flow number and the statistical data of the identification result array in the learning context corresponding to the historical service type can be updated. If a certain identification result of the learning context simultaneously satisfies the following three learning success conditions, the learning state of the learning context is migrated to a learning success state by the QUIC acceleration learning module, and the successful identification result is set as the historical service type.

[0075] Learning success condition 1: The updated user count for the historical business type is greater than a preset first threshold. (For example, if it is below the threshold, the minimum number of bits is 20).

[0076] Learning success condition 2: The number of traffic corresponding to the updated historical service type is greater than the preset second threshold. (For example: the second preset threshold is 1000 traffic).

[0077] Learning success condition 3: The ratio of the updated number of flows corresponding to the historical business type to the total number of flows in the learning context is greater than the third threshold. (For example, the third threshold is 90%).

[0078] As an example, such as Figure 10 As shown, if the recognition result No. 2 in the context recognition result array simultaneously meets all three learning success conditions, then the context is considered successfully learned, and the learned recognition result is "Youtube". The successful recognition result of this context is then recorded as "Youtube". In this way, by using these success conditions, stable and unchanging recognition results for a large number of user visits can be identified, ensuring the stability of the business type recognition results.

[0079] In one implementation, generating or updating the historical context based on the historical identifier and historical business type in the learning context includes:

[0080] If the historical context is not found based on the historical identifier, the historical context is generated based on the historical identifier and historical service type in the learning context; or if the historical context is found based on the historical identifier, the historical context is updated based on the historical identifier and historical service type in the learning context.

[0081] Specifically, the QUIC acceleration identification module receives the historical identifiers and historical service types of historical packets sent by the QUIC acceleration learning module, and uses these historical identifiers as keys to look up the acceleration table. Based on the lookup results and learning results, the process is divided into the following four cases:

[0082] In case 1, if the historical context cannot be found based on the historical identifier, and the learning result in the learning context is learning failure, then this information is ignored.

[0083] Scenario 2: If the historical context cannot be found based on the historical identifier, and the learning result in the learning context is successful, then a new historical context is generated in the acceleration table, with the historical identifier (triple) as the key of the historical context, and the following is recorded in the data of the historical context: the historical context has been identified, the historical business type, the creation timestamp is the current time, and the latest access timestamp is the current time.

[0084] Case three, if the historical context is found according to the historical identification, and the learning result in the learning context is learning failure, the acceleration context is deleted from the acceleration table.

[0085] Case four, if the historical context is found according to the historical identification, and the learning result in the learning context is learning success, according to the historical identification and the historical service type in the learning context: the historical context has been identified, the historical service type, and the latest access timestamp is the current time.

[0086] In this way, through the generated or updated historical context, when identifying the to-be-identified message, the matching historical service type can be found according to the target identification of the to-be-identified message, so that the historical service type is output as the service type of the to-be-identified message, avoiding decryption and identification of the to-be-identified message, reducing resource consumption, improving the performance and efficiency of service type identification, and improving the QUIC service identification throughput.

[0087] In an implementation manner, the outputting the historical service type as the service type of the to-be-identified message comprises:

[0088] checking whether the actual service type corresponding to the target identification is same as the historical service type; and in a case where the actual service type corresponding to the target identification is same as the historical service type, outputting the historical service type as the service type of the to-be-identified message.

[0089] Specifically, in a case where the target identification matches the historical identification of the historical service, it is necessary to check whether the actual service corresponding to the target identification is same as the historical service type of the historical service. In a case where the actual service type corresponding to the target identification is same as the historical service type, the historical service type is output as the service type of the to-be-identified message. The checking manner can be set according to requirements, for example, the message of the service type can be counted, and every N messages are extracted for checking. This checking is a light-weight checking mechanism, when the QUIC service server IP+actual service changes, the checking can find the change, avoiding the difference between the output service type of the to-be-identified service and the actual service type.

[0090] In an implementation manner, after the checking whether the actual service type corresponding to the target identification is same as the historical service type, the method further comprises: in a case where the actual service type corresponding to the target identification is different from the historical service type, performing decryption and identification on the to-be-identified message.

[0091] Specifically, in the case that the actual service corresponding to the target identifier is checked to be different from the historical service type of the historical service, it is indicated that the actual service type of the to-be-identified service has changed, and then the to-be-identified service needs to be sent to the QUIC service identification module for identification.

[0092] In an implementation manner, the checking whether the actual service type corresponding to the target identifier is same as the historical service type comprises:

[0093] generating an arbitrary random number, taking the arbitrary random number and a second preset number as remainders to obtain a second remainder result, determining that the actual service type corresponding to the target identifier is same as the historical service type in the case that the second remainder result does not hit a preset sampling probability, and determining that the actual service type corresponding to the target identifier is different from the historical service type in the case that the second remainder result hits the preset sampling probability.

[0094] Specifically, after the historical service type matching the target identifier is found in the historical context, the sampling probability can be calculated, and the sampling probability can be calculated through a random number. An arbitrary random number R1 is generated, R1 is taken as a remainder of a second preset number, for example, a second preset number 100 is taken as a remainder to obtain a second remainder result R2, and the value range of R2 is 0-99, that is, 0, 1, 2, …, 98, 99, a total of 100 possible values. Assuming that the preset sampling probability of this module is 10%, it is considered that the sampling probability hits when R2 is 0-9, and it is considered that the actual service type corresponding to the target identifier is different from the historical service type. If the sampling probability is not hit, it is determined that the actual service type corresponding to the target identifier is same as the historical service type, the historical service type learned from the historical context is obtained, and the five-tuple of the packet and the historical service type are sent to the UDP flow management module for output. Thus, the historical service type is output as the service type of the to-be-identified packet, the service identification process is shortened, the resource consumption is reduced, the performance and efficiency of service type identification are improved, and the QUIC service identification throughput of the DPI system is improved.

[0095] In an embodiment, each existing historical context in the acceleration table can be scanned by the QUIC acceleration identification module, a time difference from a latest access timestamp to a current time is calculated, and the historical context is deleted if the time difference exceeds a preset longest aging recycling duration. The longest aging recycling duration can be set according to actual needs, and is not specifically limited here.

[0096] In an implementation manner, before the learning context is generated or updated according to the historical identifier and the historical service type in the learning context, the method further includes: in a case where the user quantity statistic and the traffic quantity corresponding to the updated historical service type meet a preset learning success condition, setting the learning context as a learning success state.

[0097] Specifically, the embodiment of the application provides a learning state management mechanism for the learning context in the QUIC acceleration learning module, as shown in Figure 11

[0098] Current state: learning. Trigger condition: the user quantity statistic and the traffic quantity corresponding to the updated historical service type meet the preset learning success condition. State migration: change to the learning success state. Action: send the historical identifier and the historical service type to the QUIC acceleration identification module.

[0099] In this way, in a case where the user quantity statistic and the traffic quantity corresponding to the updated historical service type meet the preset learning success condition, the learning context is set as the learning success state.

[0100] In an implementation manner, before the learning context is generated or updated according to the historical identifier and the historical service type in the learning context, the method further includes: in a case where the user quantity statistic and the traffic quantity corresponding to the updated historical service type meet a preset learning success condition, setting the learning context as a learning success state.

[0101] Specifically, the embodiment of the application provides a learning state management mechanism for the learning context in the QUIC acceleration learning module, as shown in Figure 11

[0102] Current state: none. Trigger condition: in a case where the learning context is failed to be found according to the historical identifier, the learning context is generated according to the historical identifier and the historical service type. State migration: change to the learning state. Action: none.

[0103] Current state: learning. Trigger condition: the learning success condition is not met. State migration: keep the learning state unchanged. Action: none.

[0104] Current state: learning. Trigger condition: timeout without receiving the historical identifier and the historical service type from the QUIC service identification module. State migration: delete the learning context from the learning table. Action: send learning failure information to the QUIC acceleration identification module.

[0105] Current state: learning success. Trigger condition: the learning success condition is met. State migration: keep the learning success state unchanged. Action: none. ​​

[0106] Current state: learning success. Trigger condition: learning failure condition is met. State transition: change to learning failure state. Action: send learning failure information to QUIC acceleration identification module.

[0107] Current state: learning success. Trigger condition: timeout without receiving historical identification and historical service type from QUIC service identification module. State transition: delete the learning context from the learning table. Action: send learning failure result to QUIC acceleration identification module.

[0108] As an example, as shown in Figure 12 , taking a learning context as an example, when the learning context is in the learning state all the time, and the historical service type of the learning context is no longer received from the QUIC service identification module for a long time (such as more than 12 hours of preset time length from T2 time to T3 time), the module deletes the learning context from the learning table, and the module sends learning failure information of the learning context to the QUIC acceleration identification module at T3 time.

[0109] As another example, as shown in Figure 13 , taking a learning context as an example, when the learning context reaches the learning success condition at T2 time, and changes from the learning state to the learning success state at T2 time, the module sends the historical service type of the learning context to the QUIC acceleration identification module at T2 time. At T3 time, the module receives the historical service type of the learning context from the QUIC service identification module for the last time, and the identification result information of the learning context is no longer received from the QUIC service identification module for a long time (such as more than 12 hours of preset time length from T3 time to T4 time), the module deletes the learning context from the learning table at T4 time, and the module sends learning failure information of the learning context to the QUIC acceleration identification module at T4 time.

[0110] As another example, as shown in Figure 14 , taking a learning context as an example, when the learning context reaches the learning success condition at T2 time, and changes from the learning state to the learning success state at T2 time, the module sends the learning success result information of the learning context to the QUIC acceleration identification module at T2 time. At T3 time, the learning context reaches the learning failure condition through spot check, changes from the learning success state to the learning failure state at T3 time, the module sends learning failure information of the learning context to the QUIC acceleration identification module at T3 time. The learning context is deleted from the learning table by the module at T4 time, which starts from T3 time and lasts for more than 12 hours of preset learning failure duration. Learning failure state cannot be re-learned, and can be re-learned after timeout.

[0111] In an implementation, after the learning context of the historical identifier match is acquired, the method further includes:

[0112] In a case where the historical service type is different from the preset sampling result recorded in the learning context, updating the sampling result of the learning context as the historical service type and setting the sampling number as 1; in a case where the historical service type is same as the preset sampling result recorded in the learning context, adding 1 to the sampling number; in a case where the sampling number is greater than a fourth threshold and the preset sampling result is different from the historical service type, setting the learning context as a learning failure state.

[0113] Specifically, after the learning context of the historical identifier match is acquired, when the learning context is in a learning success state, the historical service type of the specified five tuple is received by the QUIC acceleration identification module from the QUIC service identification module. It is checked whether the historical service type is same as the preset sampling result (the last sampling identification result) recorded in the learning context, which is divided into the following two cases:

[0114] Case 1: if the current identification result is different from the preset sampling result (the last sampling identification result), then the sampling identification result in the learning context is updated as the received historical service type, and the sampling number is set as 1, that is, the sampling number is re-counted.

[0115] Case 2: if the received historical service type is same as the last sampling identification result, then the sampling number is added by 1.

[0116] Specifically, the learning failure condition is that if the sampling number of the learning context is greater than a fourth threshold (such as 15) and the preset sampling result is different from the historical service type, then it is considered that the learning fails, and the learning state of the learning context is migrated to a learning failure state.

[0117] Next, the service type identification method provided by the embodiments of the present application is further described by referring to the service type identification schematic diagram as shown in FIG. 1. Figure 15 The service type identification method includes the following steps:

[0118] Stage A: identification process

[0119] Step A1: extract the five tuple from a UDP stream, and find the flow context in the UDP stream table by taking the five tuple as the key. If not found, create a new flow context. If found, acquire the flow context.

[0120] Step A2: if the flow context already exists the identification result of the UDP stream, then directly output the identification result.

[0121] Step A3: If the identification result of the UDP stream does not exist in the flow context, check whether the first uplink initial packet of the QUIC stream has been found in the flow.

[0122] Step A4: If the first uplink initial packet of the QUIC stream has been found in the flow, output the result as unidentifiable.

[0123] Step A5: If the first uplink initial packet of the QUIC stream has not been found in the flow, check the packet count of the packet in the flow.

[0124] Step A6: Based on the QUIC protocol (RFC 9000 QUIC v1 and RFC 9369 QUIC V2), determine whether the packet is the first uplink initial packet of the QUIC stream. The specific determination conditions are: the direction of the packet is uplink, and the UDP payload length of the packet is greater than or equal to 1200 bytes, and the QUIC header of the packet is a long header, and the QUIC packet type of the packet is an initial type, and the QUIC version number of the packet is a legal value specified by the QUIC protocol, and the previous packet of the flow of the packet can only be 0 or at most N-1 uplink QUIC packets of the 0-RTT type. The determination conditions of the uplink QUIC packet of the 0-RTT type are: the direction of the packet is uplink, and the QUIC header of the packet is a long header, and the QUIC packet type of the packet is a 0-RTT type, and the QUIC version number of the packet is a legal value specified by the QUIC protocol.

[0125] Step A8: If the to-be-identified packet is the first initial packet of the QUIC stream (to-be-identified packet), obtain the target identifier from the packet, i.e., the triple (server IP address, server UDP port, IP protocol type UDP), and use the triple as a key to search for the historical context in the acceleration table.

[0126] Step A9: If the historical context cannot be found, decrypt the packet as the first uplink initial packet of the QUIC, sort and recombine the multiple CRYPTO frames after decryption into a TLS 1.3 ClientHello message, extract the SNI domain name from the ClientHello message, identify the SNI domain name to obtain the identification result, and transfer the packet and the identification result to phase B for learning.

[0127] Step A10: If the historical context can be found, calculate the spot check probability.

[0128] Step A11: If the sampling probability is less than or equal to the preset value, the QUIC first uplink initial message is decrypted, the multiple CRYPTO frames after decryption are sorted and reorganized into a TLS 1.3 ClientHello message, the SNI domain name is extracted from the ClientHello message, the SNI domain name is identified, the identification result is obtained, and the message and the identification result are transferred to stage C for sampling.

[0129] Step A12: If the sampling probability is greater than the preset value, the historical service type obtained by successful learning recorded in the acceleration context is directly output as the service type of the current to-be-identified message. The five-tuple is obtained from the message, the UDP flow table is searched with the five-tuple as the key, the corresponding flow context is obtained, and the identification result is recorded in the flow context.

[0130] Stage B: Learning process:

[0131] Step B1: The historical identifier, i.e., the three-tuple (server IP address, server UDP port, IP protocol type UDP) of the historical first uplink initial message (historical message) of the historical QUIC flow, is obtained, and the learning context is searched in the learning table with the three-tuple as the key. If not found, a new learning context is created, and the learning state is set to learning. If found, and the learning state is learning, the learning context is obtained.

[0132] Step B2: According to the information of the historical message, the content of the learning context is updated. First, the total number of flows of the learning context is increased by 1. Second, the historical service type of the historical message is recorded in the learning context. Third, the number of flows of the historical service type of the learning context is increased by 1. Fourth, the user IP address of the historical message is hashed and the user number statistical quantity of the identification result of the learning context is updated.

[0133] Step B3: The system checks the learning context, whether it meets the learning success condition. If the learning success condition is met, the learning state of the learning context is set to learning success, and the identification result of the historical message is recorded as the successful identification result of the learning context. The learning success condition is that the user number statistical quantity of a certain identification result of the learning context is greater than a preset value, and the number of flows thereof is greater than a preset value, and the proportion of the number of flows thereof to the total number of flows of the learning context is greater than a preset value.

[0134] Step B4: For the learning context that has learned successfully, the same three-tuple (server IP address, server UDP port, IP protocol type UDP) as the key of the learning context is used as the historical identifier, a historical context is newly created in the acceleration table, and the learning successful historical service type is recorded in the historical context.

[0135] Stage C: Spot-checking process:

[0136] Step C1: Record the spot-checking recognition result in the learning context, and if the spot-checking recognition result is unchanged for a plurality of times (greater than a preset number) but is different from the successful learning recognition result, set the learning state of the learning context to learning failure.

[0137] Step C2: The system takes the triple of the learning context as a key to search the acceleration table and delete the corresponding historical context.

[0138] Stage D: Aging process:

[0139] Step D1: Scan each flow context in the UDP flow table, and if a flow context exceeds a preset time length from the time when the last packet accessing it arrives to the current time, delete the flow context.

[0140] Step D2: Scan each learning context in the learning table, and if a learning context with a learning state of learning or learning success exceeds a preset time length from the time when the last packet accessing it arrives to the current time, delete the learning context.

[0141] Step D3: Scan each learning context in the learning table, and if a learning context with a learning state of learning failure exceeds a preset time length from the time when it fails to learn to the current time, delete the learning context.

[0142] Step D4: Scan each historical context in the acceleration table, and if an acceleration context exceeds a preset time length from the time when the last packet accessing it arrives to the current time, delete the acceleration context.

[0143] It should be noted that the execution subject of the business type identification method provided in the embodiments of the present application can be a business type identification device, or a control module in the business type identification device for executing the business type identification method. In the embodiments of the present application, the business type identification device is taken as an example to execute the business type identification method, and the business type identification device provided in the embodiments of the present application is described.

[0144] Figure 16 is a structural schematic diagram of the business type identification device according to the embodiments of the present application. As shown in Figure 16 the business type identification device 1600 includes an acquisition module 1610, an identification module 1620, and an output module 1630.

[0145] The acquisition module 1610 is configured to acquire a target identifier of a to-be-identified message; the identification module 1620 is configured to, in a case where the target identifier matches a historical identifier in a historical context, find a historical service type corresponding to the historical identifier in the historical context, the historical service type being obtained by identifying a historical message; and the output module 1630 is configured to output the historical service type as a service type of the to-be-identified message.

[0146] In an implementation manner, the identification module 1620 is configured to, in a case where the historical service type is obtained by identifying the historical message, acquire a learning context to which the historical identifier matches; calculate a user number statistic and a flow number in the learning context corresponding to the historical service type; and in a case where it is determined that the user number statistic and the flow number corresponding to the historical service type calculated satisfy a preset learning success condition, generate or update the historical context according to the historical identifier and the historical service type in the learning context.

[0147] In an implementation manner, the identification module 1620 is configured to acquire a user Internet protocol address corresponding to the historical service type; calculate the user number statistic according to the user Internet protocol address; and increase the flow number by a preset number.

[0148] In an implementation manner, the identification module 1620 is configured to calculate hash values of the user Internet protocol addresses; obtain first remainder results by taking each of the hash values modulo a first preset number; set the first preset number of binary bits, and set a bit corresponding to the first remainder result on the binary bits to 1; and calculate the user number statistic according to bits that are 1 on the binary bits.

[0149] In an implementation manner, the identification module 1620 is configured to acquire a user Internet protocol address corresponding to the historical service type; record a number of the user Internet protocol addresses by using a linked list or a hash table to update the user number statistic; and increase the flow number by a preset number.

[0150] In an implementation manner, the learning success condition includes that a user number statistic corresponding to the historical service type after being updated is greater than a first threshold value; a flow number corresponding to the historical service type after being updated is greater than a second threshold value; and a ratio of the flow number corresponding to the historical service type after being updated to a total flow number of the learning context is greater than a third threshold value.

[0151] In an implementation manner, the identification module 1620 is configured to generate the historical context according to the historical identifier and the historical service type in the learning context in a case where the historical context is not found according to the historical identifier; or update the historical context according to the historical identifier and the historical service type in the learning context in a case where the historical context is found according to the historical identifier.

[0152] In an implementation manner, the identification module 1620 is configured to check whether the actual service type corresponding to the target identifier is same as the historical service type; and output the historical service type as the service type of the to-be-identified packet in a case where the actual service type corresponding to the target identifier is same as the historical service type.

[0153] In an implementation manner, the identification module 1620 is further configured to perform decryption identification on the to-be-identified packet in a case where the actual service type corresponding to the target identifier is different from the historical service type.

[0154] In an implementation manner, the identification module 1620 is configured to generate an arbitrary random number, take the arbitrary random number and a second preset number as a remainder to obtain a second remainder result, determine that the actual service type corresponding to the target identifier is same as the historical service type in a case where the second remainder result does not hit a preset examination probability, and determine that the actual service type corresponding to the target identifier is different from the historical service type in a case where the second remainder result hits the preset examination probability.

[0155] In an implementation manner, the identification module 1620 is configured to set the learning context as a learning success state in a case where the statistical quantity of users and the quantity of flows corresponding to the updated historical service type satisfy a preset learning success condition.

[0156] In an implementation manner, the identification module 1620 is configured to generate the learning context according to the historical identifier and the historical service type in a case where the learning context fails to be found according to the historical identifier, and set the learning context as a learning state.

[0157] In an implementation manner, the identification module 1620 is configured to update the examination result of the learning context to the historical service type and set an examination frequency to 1 in a case where the historical service type is different from a preset examination result recorded in the learning context, increase the examination frequency by 1 in a case where the historical service type is same as the preset examination result recorded in the learning context, and set the learning context as a learning failure state in a case where the examination frequency is greater than a fourth threshold value and the preset examination result is different from the historical service type.

[0158] The service type identification apparatus in the embodiments of the present application can be an apparatus, or a component, an integrated circuit, or a chip in a terminal. The apparatus can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and the non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc., and the embodiments of the present application are not limited in this regard. The service type identification apparatus in the embodiments of the present application can be an apparatus with an operating system. The operating system can be an Android operating system, an ios operating system, or other possible operating systems, and the embodiments of the present application are not limited in this regard.

[0159] The service type identification apparatus provided in the embodiments of the present application can implement the method embodiments to achieve various processes, and thus repeated descriptions are not given herein. Figures 1 to 15 The method embodiments to achieve various processes, and thus repeated descriptions are not given herein.

[0160] Optionally, as shown in Figure 17 The embodiments of the present application further provide an electronic device 1700, which comprises a processor 1701 and a memory 1702, and the memory 1702 stores a program or instructions which can be run on the processor 1701, and the program or instructions are executed by the processor 1701 to achieve the following: obtaining a target identifier of a to-be-identified message; in a case where the target identifier matches a historical identifier in a historical context, searching for a historical service type corresponding to the historical identifier in the historical context, the historical service type being obtained by identifying a historical message; and outputting the historical service type as a service type of the to-be-identified message.

[0161] In an implementation manner, before the target identifier of the to-be-identified message is obtained, in a case where the historical service type is obtained by identifying the historical message, a learning context matched with the historical identifier is obtained; a user number statistic and a traffic number corresponding to the historical service type in the learning context are calculated; in a case where it is determined that the user number statistic and the traffic number corresponding to the historical service type calculated satisfy a preset learning success condition, the historical context is generated or updated according to the historical identifier and the historical service type in the learning context.

[0162] In an implementation manner, the user Internet protocol address corresponding to the historical service type is acquired; the user number statistic is calculated according to the user Internet protocol address; and the flow number is increased by a preset number.

[0163] In an implementation manner, the hash value of the user Internet protocol address is calculated; each hash value is taken remainder by a first preset number to obtain a first remainder result; the first preset number of binary bits are set, and the bits corresponding to the first remainder result on the binary bits are set to 1; and the user number statistic is calculated according to the bits set to 1 on the binary bits.

[0164] In an implementation manner, the user Internet protocol address corresponding to the historical service type is acquired; the number of the user Internet protocol addresses is recorded by a linked list or a hash table to update the user number statistic; and the flow number is increased by a preset number.

[0165] In an implementation manner, the learning success condition comprises that the updated user number statistic corresponding to the historical service type is greater than a first threshold value; the updated flow number corresponding to the historical service type is greater than a second threshold value; and the ratio of the updated flow number corresponding to the historical service type to the total flow number of the learning context is greater than a third threshold value.

[0166] In an implementation manner, in a case where the historical context is not found according to the historical identifier, the historical context is generated according to the historical identifier and the historical service type in the learning context; or in a case where the historical context is found according to the historical identifier, the historical context is updated according to the historical identifier and the historical service type in the learning context.

[0167] In an implementation manner, it is checked whether the actual service type corresponding to the target identifier is same as the historical service type; and in a case where the actual service type corresponding to the target identifier is same as the historical service type, the historical service type is output as the service type of the to-be-identified packet.

[0168] In an implementation manner, after the checking whether the actual service type corresponding to the target identifier is same as the historical service type, in a case where the actual service type corresponding to the target identifier is different from the historical service type, the to-be-identified packet is decrypted and identified.

[0169] In an implementation manner, an arbitrary random number is generated; the arbitrary random number is taken modulo a second preset number to obtain a second modulo result; in a case where the second modulo result does not hit a preset sampling probability, it is determined that an actual service type corresponding to the target identifier is the same as the historical service type; in a case where the second modulo result hits the preset sampling probability, it is determined that the actual service type corresponding to the target identifier is different from the historical service type.

[0170] In an implementation manner, before the historical context is generated or updated according to the historical identifier and the historical service type in the learning context, in a case where a user quantity and a traffic quantity corresponding to the updated historical service type meet a preset learning success condition, the learning context is set to a learning success state.

[0171] In an implementation manner, before the learning context matched with the historical identifier is acquired, in a case where the learning context is failed to be found according to the historical identifier and the historical service type, the learning context is generated according to the historical identifier and the historical service type; and the learning context is set to a learning state.

[0172] In an implementation manner, after the learning context matched with the historical identifier is acquired in a case where the historical service type is acquired, in a case where the historical service type is different from a preset sampling result recorded in the learning context, the sampling result of the learning context is updated to the historical service type and a sampling number is set to 1; in a case where the historical service type is the same as the preset sampling result recorded in the learning context, the sampling number is increased by 1; in a case where the sampling number is greater than a fourth threshold value and the preset sampling result is different from the historical service type, the learning context is set to a learning failure state.

[0173] The specific execution steps can refer to the steps of the method for identifying a service type, and the same technical effects can be achieved. To avoid repetition, details are not described herein.

[0174] It should be noted that the electronic device in the embodiments of the present application includes a server, a terminal, or other devices other than the terminal.

[0175] The above electronic device structure does not constitute a limitation on the electronic device, which can include more or fewer components than those shown, or combine some components, or have different arrangements of components, for example, the input unit can include a Graphics Processing Unit (GPU) and a microphone, and the display unit can be configured in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes at least one of a touch panel and other input devices. The touch panel is also referred to as a touch screen. The other input devices can include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), a trackball, a mouse, a joystick, and the like, which will not be described here.

[0176] The memory can be used to store software programs and various data. The memory can mainly include a first storage area storing programs or instructions and a second storage area storing data, wherein the first storage area can store an operating system, application programs or instructions required by at least one function (such as a sound playing function, an image playing function, etc.), and the like. In addition, the memory can include a volatile memory or a non-volatile memory, or the memory can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM), a Static RAM (SRAM), a Dynamic RAM (DRAM), a Synchronous DRAM (SDRAM), a Double Data Rate SDRAM (DDR SDRAM), an Enhanced SDRAM (ESDRAM), a Synchlink DRAM (SLDRAM), and a Direct Rambus RAM (DRRAM).

[0177] The processor can include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and an application program, and the modem processor mainly processes a wireless communication signal, such as a baseband processor. It can be understood that the above-mentioned modem processor can also not be integrated into the processor.

[0178] The embodiment of the application further provides a readable storage medium, which stores a program or instructions, and the program or instructions are executed by a processor to realize each process of the above-mentioned business type identification method embodiment and achieve the same technical effects. To avoid repetition, details are not described herein.

[0179] The processor is the processor in the electronic device in the above-mentioned embodiment. The readable storage medium includes a computer readable storage medium, such as a ROM, a RAM, a magnetic disk, or an optical disk.

[0180] It should be noted that in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles, or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article, or device that includes the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the application is not limited to the order of performing the functions shown or discussed, and can also include performing the functions in a substantially simultaneous manner or in reverse order, for example, the described method can be performed in an order different from the described order, and various steps can also be added, omitted, or combined. In addition, the features described with reference to some examples can be combined in other examples.

[0181] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a computer software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, an optical disk), and includes a plurality of instructions for making a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in each embodiment of the present application.

[0182] The embodiments of the present application are described above with reference to the accompanying drawings, but the present application is not limited to the specific embodiments described above, and the specific embodiments described above are merely illustrative, but not restrictive, and a person of ordinary skill in the art can make many forms under the inspiration of the present application without departing from the purpose of the present application and the scope protected by the claims.

Claims

1. A method of identifying a service type, characterized by, The method comprises the following steps: obtaining a target identifier of a message to be identified; in a case where the target identifier matches a historical identifier in a historical context, finding a historical service type corresponding to the historical identifier in the historical context, the historical service type being obtained by identifying a historical message; outputting the historical service type as a service type of the message to be identified.

2. The identification method according to claim 1, characterized in that, Before the step of obtaining the target identifier of the message to be identified, the method further comprises the following steps: in a case where the historical service type is obtained by identifying the historical message, obtaining a learning context matching the historical identifier; calculating a user number statistic and a traffic number corresponding to the historical service type in the learning context; in a case where the user number statistic and the traffic number corresponding to the historical service type calculated satisfy a preset learning success condition, generating or updating the historical context according to the historical identifier and the historical service type in the learning context.

3. The identification method according to claim 2, characterized in that, The step of calculating the user number statistic and the traffic number corresponding to the historical service type in the learning context comprises the following steps: obtaining a user Internet protocol address corresponding to the historical service type; calculating the user number statistic according to the user Internet protocol address; increasing the traffic number by a preset number.

4. The identification method according to claim 3, characterized in that, The step of calculating the user number statistic according to the user Internet protocol address comprises the following steps: calculating a hash value of the user Internet protocol address; obtaining a first remainder result by taking each hash value modulo a first preset number; setting the first preset number of binary bits, and setting a bit corresponding to the first remainder result on the binary bits to 1; calculating the user number statistic according to the bits set to 1 on the binary bits.

5. The identification method according to claim 2, characterized in that, The step of calculating the user number statistic and the traffic number corresponding to the historical service type in the learning context comprises the following steps: obtaining a user Internet protocol address corresponding to the historical service type; updating the user number statistic by recording the number of user Internet protocol addresses through a linked list or a hash table; increasing the traffic number by a preset number.

6. The identification method according to claim 2, characterized in that, The learning success condition comprises the following conditions: the updated user number statistic corresponding to the historical service type is greater than a first threshold value; the updated traffic number corresponding to the historical service type is greater than a second threshold value; a ratio of the updated traffic number corresponding to the historical service type to a total flow number of the learning context is greater than a third threshold value.

7. The identification method according to claim 2, characterized in that, The step of generating or updating the historical context according to the historical identifier and the historical service type in the learning context comprises the following steps: in a case where the historical context is not found according to the historical identifier, generating the historical context according to the historical identifier and the historical service type in the learning context; or in a case where the historical context is found according to the historical identifier, updating the historical context according to the historical identifier and the historical service type in the learning context.

8. The identification method of claim 1, wherein, The step of outputting the historical service type as the service type of the message to be identified comprises the following steps: checking whether an actual service type corresponding to the target identifier is the same as the historical service type; In a case where the actual service type corresponding to the target identifier is identical to the historical service type, the historical service type is output as the service type of the to-be-identified packet.

9. The identification method according to claim 8, characterized in that, After the checking whether the actual service type corresponding to the target identifier is identical to the historical service type, the method further includes: In a case where the actual service type corresponding to the target identifier is different from the historical service type, the to-be-identified packet is decrypted and identified.

10. The identification method according to claim 9, characterized in that, The checking whether the actual service type corresponding to the target identifier is identical to the historical service type includes: generating an arbitrary random number; taking the arbitrary random number and a second preset number as a remainder to obtain a second remainder result; in a case where the second remainder result does not hit a preset examination probability, determining that the actual service type corresponding to the target identifier is identical to the historical service type; in a case where the second remainder result hits the preset examination probability, determining that the actual service type corresponding to the target identifier is different from the historical service type.

11. The identification method according to claim 2, characterized in that, Before the generating or updating the historical context according to the historical identifier and the historical service type in the learning context, the method further includes: in a case where the user quantity and the traffic quantity corresponding to the updated historical service type satisfy a preset learning success condition, setting the learning context as a learning success state.

12. The identification method according to claim 2, characterized in that, Before the obtaining the learning context matched with the historical identifier, the method further includes: in a case where the learning context is failed to be found according to the historical identifier, generating the learning context according to the historical identifier and the historical service type; setting the learning context as a learning in progress state.

13. The identification method according to claim 2, characterized in that, After the obtaining the learning context matched with the historical identifier, in a case where the historical service type is obtained, the method further includes: in a case where the historical service type is different from a preset examination result recorded in the learning context, updating the examination result of the learning context to the historical service type and setting an examination frequency to 1; in a case where the historical service type is identical to the preset examination result recorded in the learning context, increasing the examination frequency by 1; in a case where the examination frequency is greater than a fourth threshold value and the preset examination result is different from the historical service type, setting the learning context as a learning failure state.

14. An electronic device, comprising: The apparatus includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, and the program or instructions are executed by the processor to implement the steps of the service identification method according to any one of claims 1-13.

15. A readable storage medium, characterized by, The program or instructions are stored on the readable storage medium, and the program or instructions are executed by the processor to implement the steps of the service identification method according to any one of claims 1-13.

Images