Flow application protocol identification method

Abstract

The invention provides a traffic application protocol identification method. According to the invention, through the load balancing architecture of the intelligent sampling and traffic identification unit of the convergence and shunting device, and in combination with the real-time protocol knowledge base constructed by the traffic learning unit, high-speed protocol identification in a large-traffic scene is realized. The sampling mechanism greatly reduces the calculation load of deep packet detection; traditional packet-by-packet analysis is replaced by a knowledge base comparison strategy, so that the identification process can be completed only by session layer data; a dynamic aging mechanism guarantees the timeliness of the knowledge base; the load balancing and closed loop feedback design improves the flexibility of the system. According to the scheme, on the premise that the recognition precision is guaranteed, the equipment scale, the computing resource consumption and the operation and maintenance cost are remarkably reduced, and efficient support is provided for operator high-concurrency traffic analysis.

Description

Technical Field

[0001] This application relates to the field of traffic data detection, and in particular to a method for identifying traffic application protocols. Background Technology

[0002] Traffic identification technology can identify the business application protocol and application (APP) to which traffic belongs, providing support for business operations in multiple aspects. Currently, some feasible implementations involve collecting network-wide traffic and using deep packet inspection (DPI) technology to analyze the feature codes of internet data content to determine the protocol or application type of the data packets. According to the OSI seven-layer model of computer networks, apart from traditional application protocols (such as telnet, http, SMTP, etc.) which can be identified based on communication ports, other application protocols generally require feature analysis of the communication content at layer seven to determine their specific application type.

[0003] However, such methods require deep packet inspection of each data packet, resulting in cumbersome data processing, high consumption of storage and computing resources, and a correspondingly high workload for operation and maintenance. This leads to poor efficiency and flexibility in the application process. Therefore, a traffic application protocol identification method is needed to solve these problems. Summary of the Invention

[0004] The purpose of this application is to at least solve one of the aforementioned technical defects, particularly the technical defects in the prior art where the data processing process is cumbersome, storage and computing resources are consumed in large quantities, and the maintenance workload is also relatively high, resulting in poor efficiency and flexibility in the application process.

[0005] In a first aspect, this application provides a method for identifying traffic application protocols, the method comprising:

[0006] The full traffic data on the target link is obtained through aggregation and distribution devices;

[0007] The aggregation and splitting device is used to perform traffic replication and traffic splitting, and the full traffic data includes multiple data packets;

[0008] The convergence and distribution device extracts sampled traffic data with a preset learning ratio from the full traffic data, copies and transmits it to the traffic learning unit, and distributes the full traffic data to multiple traffic recognition units according to the recognition ratio.

[0009] The traffic learning unit is used to parse the sampled traffic data, determine the mapping relationship between the application protocol and the server address and server port to form a protocol knowledge base, and push the protocol knowledge base to each of the traffic identification units.

[0010] Furthermore, the traffic identification unit is used to parse the corresponding full traffic data and identify the application protocol based on the protocol knowledge base.

[0011] As an optional implementation, the step of extracting a preset learning ratio of sampled traffic data from the full traffic data through the aggregation and distribution device, copying it, and transmitting it to the traffic learning unit includes:

[0012] Configure the aggregation and distribution device to randomly extract a preset proportion of sampled traffic data at a preset granularity, copy it, and transmit it to the traffic learning unit;

[0013] Furthermore, the traffic learning unit parses the sampled traffic data to determine the mapping relationship between application protocols, server addresses, and server ports, thereby forming a protocol knowledge base, specifically including:

[0014] The traffic learning unit parses the quintuple information of each data packet in the sampled traffic data;

[0015] The five-tuple information includes source address, source port, destination address, destination port, and communication protocol;

[0016] Determine whether the five-tuple information corresponding to each data packet exists in the flow table. If it does not exist, add it to the flow table. If it exists, determine whether the corresponding five-tuple information has completed the application protocol identification process.

[0017] If the application protocol is not identified, then communication feature identification is performed based on the communication data of the corresponding data packet and the quintuple information;

[0018] If the communication feature identification fails, the corresponding data packet will be cached or marked.

[0019] If the communication feature is successfully identified, the application protocol is determined, and a target mapping relationship is constructed between the first combination of the source address and the source port or the second combination of the destination address and the destination port and the application protocol. If the target mapping relationship does not exist in the protocol knowledge base, the target mapping relationship is added to the protocol knowledge base.

[0020] As an optional implementation, the method further includes:

[0021] Calculate the last timestamp of each mapping relationship in the protocol knowledge base;

[0022] When the difference between the timestamp and the current time exceeds the aging period, the corresponding mapping relationship is marked as pending cleanup.

[0023] During the idle period of the traffic learning unit, the mapping relationships to be cleaned are cleared in batches and synchronously updated to each of the traffic identification units.

[0024] As an optional implementation, the step of distributing the full traffic data to multiple traffic identification units according to the identification ratio includes:

[0025] Determine the real-time load capacity of each traffic identification unit, and determine the identification ratio based on the real-time load capacity;

[0026] Based on the load balancing method and the identification ratio, each data packet of the full traffic data is allocated to each traffic identification unit according to a preset granularity.

[0027] As an optional implementation, the traffic identification unit parses the corresponding full traffic data and identifies the application protocol based on the protocol knowledge base, specifically including:

[0028] The protocol knowledge base is received through the traffic identification unit;

[0029] Parse each data packet in the full traffic data allocated to the traffic identification unit to the session layer of the Open Systems Interconnection model, and extract the source address, source port, destination address and destination port;

[0030] The source address and the source port are combined and matched against the protocol knowledge base. If the first match is successful, the corresponding application protocol type is output.

[0031] If the first match fails, the destination address and the destination port are combined and matched a second time with the protocol knowledge base. If the second match succeeds, the corresponding application protocol type is output. If the second match fails, the corresponding data packet is marked as unrecognizable data.

[0032] As an optional implementation, the method further includes:

[0033] For the target traffic identification unit, if the proportion of data packets marked as unidentifiable data exceeds a preset threshold within a preset period, a sampling ratio adjustment mechanism is triggered to increase the identification ratio corresponding to the target traffic identification unit, and the identification ratio is restored after the protocol knowledge base is updated.

[0034] Secondly, this application provides a traffic application protocol identification device, comprising:

[0035] The acquisition module is used to acquire full traffic data on the target link through the aggregation and distribution equipment;

[0036] The aggregation and splitting device is used to perform traffic replication and traffic splitting, and the full traffic data includes multiple data packets;

[0037] The processing module is used to extract sampled traffic data with a preset learning ratio from the full traffic data through the aggregation and distribution device, copy and transmit it to the traffic learning unit, and distribute the full traffic data to multiple traffic identification units according to the identification ratio.

[0038] The processing module is further configured to parse the sampled traffic data through the traffic learning unit, determine the mapping relationship between the application protocol and the server address and server port, so as to form a protocol knowledge base, and push the protocol knowledge base to each of the traffic identification units;

[0039] Furthermore, the processing module is also used to parse the corresponding full traffic data through the traffic identification unit and to identify the application protocol according to the protocol knowledge base.

[0040] As an optional implementation, the specific method by which the processing module extracts sampled traffic data with a preset learning ratio from the full traffic data through the aggregation and distribution device, copies it, and transmits it to the traffic learning unit includes:

[0041] Configure the aggregation and distribution device to randomly extract a preset proportion of sampled traffic data at a preset granularity, copy it, and transmit it to the traffic learning unit;

[0042] Furthermore, the processing module parses the sampled traffic data through the traffic learning unit to determine the mapping relationship between application protocols, server addresses, and server ports, thereby forming a protocol knowledge base. Specific methods for this include:

[0043] The traffic learning unit parses the quintuple information of each data packet in the sampled traffic data;

[0044] The five-tuple information includes source address, source port, destination address, destination port, and communication protocol;

[0045] Determine whether the five-tuple information corresponding to each data packet exists in the flow table. If it does not exist, add it to the flow table. If it exists, determine whether the corresponding five-tuple information has completed the application protocol identification process.

[0046] If the application protocol is not identified, then communication feature identification is performed based on the communication data of the corresponding data packet and the quintuple information;

[0047] If the communication feature identification fails, the corresponding data packet will be cached or marked.

[0048] If the communication feature is successfully identified, the application protocol is determined, and a target mapping relationship is constructed between the first combination of the source address and the source port or the second combination of the destination address and the destination port and the application protocol. If the target mapping relationship does not exist in the protocol knowledge base, the target mapping relationship is added to the protocol knowledge base.

[0049] Thirdly, this application provides a computer device including one or more processors and a memory storing computer-readable instructions that, when executed by the one or more processors, perform the steps of the method described in the first aspect.

[0050] Fourthly, this application provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the method described in the first aspect.

[0051] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0052] Based on any of the above embodiments, the method provided in this application adopts a two-layer architecture of "sampling learning + knowledge base comparison". The aggregation and distribution device extracts representative traffic through a random sampling mechanism. While ensuring session integrity, only a small number of traffic learning units need to perform deep packet inspection, dynamically building and maintaining a knowledge base mapping protocols to server IP+Port. All data is then load-balanced and distributed to multiple traffic identification units. Each unit only needs to parse data packets to the OSI session layer and complete protocol identification through efficient comparison of source / destination IP+Port with the knowledge base. This design reduces the computational load of deep packet inspection to less than one-tenth of traditional solutions through the sampling mechanism, while the knowledge base comparison mechanism completely avoids resource-intensive operations such as flow table creation, application layer parsing, and context caching. At the operation and maintenance level, protocol rule updates only require upgrading the traffic learning unit, avoiding synchronous adjustments across the entire network. Furthermore, the dynamic aging mechanism of the knowledge base cleans up invalid records, and the closed-loop feedback mechanism automatically adjusts the sampling ratio based on the identification failure rate, further enhancing the long-term adaptability and stability of the system. In summary, this solution addresses the core pain points of traditional solutions, such as high resource consumption, high operation and maintenance costs, and poor scalability, through its extremely simple packet parsing logic, flexible cluster architecture, and centralized knowledge management. It provides a cost-effective technical path for identifying high-speed network traffic with large data volumes. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A flowchart illustrating a related implementation method for traffic application protocol identification provided in one embodiment of this application;

[0055] Figure 2 A schematic diagram of the architecture corresponding to a traffic application protocol identification method provided in one embodiment of this application;

[0056] Figure 3 A schematic diagram illustrating the architecture and specific functions of a traffic application protocol identification method provided in one embodiment of this application;

[0057] Figure 4 This is a flowchart illustrating the method executed by the traffic learning unit in a traffic application protocol identification method provided in one embodiment of this application.

[0058] Figure 5 This is a flowchart illustrating the method executed by the traffic identification unit in a traffic application protocol identification method provided in one embodiment of this application.

[0059] Figure 6 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0060] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] First, let's explain the important nouns and terms that may be involved:

[0062] Traffic identification: refers to the process of identifying different types of traffic behavior or applications by analyzing network traffic data.

[0063] Deep packet inspection (DPI) is an application-layer-based traffic inspection and control technology that analyzes network data packets in depth to identify the application protocol (application) type, content, and other key information within the packets.

[0064] The OSI seven-layer model is a network communication reference model proposed by the International Organization for Standardization (ISO) to define the layered architecture of different network protocols.

[0065] Traffic learning unit: By performing deep packet inspection on sampled network data, it identifies the various application protocols and applications to which the data packets belong, and accumulates the server IPs and ports of various applications.

[0066] Traffic identification unit: Based on the application protocol knowledge base, it identifies the protocol type of the traffic.

[0067] Aggregation and distribution equipment: A network device used to collect, process, and distribute network data traffic.

[0068] It should also be noted that the concepts of IP and address, as well as Port and port number, in this application can be understood as equivalent. The meanings of the related terms will be consistent when they appear below, and will not be repeated hereafter.

[0069] By using traffic identification technology to identify the business application protocols and applications to which traffic belongs, support can be provided for business operations in multiple ways. For example, by analyzing users' online behavior, detailed customer profiles can be built to achieve precise marketing; by analyzing the frequency and duration of users' use of different services, network resources can be optimized to improve user experience; by analyzing user preferences, market trends and changes in user needs can be understood, providing a basis for product development and business expansion, and so on.

[0070] Currently, the prevailing method for traffic identification in the industry is to collect network traffic and use deep packet inspection technology to analyze the feature codes of internet data content to determine the protocol or application type of the data packets. According to the OSI seven-layer model of computer networks, apart from traditional application protocols (such as telnet, http, SMTP, etc.) which can be identified based on communication ports, other application protocols generally require feature analysis of the communication content at layer seven to determine the specific application type.

[0071] Please see Figure 1 , Figure 1 This is a flowchart illustrating a possible implementation of traffic application protocol identification in one embodiment of this application, showing the specific process of full traffic application protocol identification in a feasible implementation.

[0072] The methods include:

[0073] Collect all network data.

[0074] Parse the five-tuple information of the data packet (source IP, source port, destination IP, destination port, communication protocol), check if the five-tuple information exists in the flow table. If it does not exist, add a record and proceed to the next step. If it exists, check if the specific application protocol has been identified in the record. If it has been identified, process the next data packet; otherwise, proceed to the next step.

[0075] Unidentified data is further analyzed layer by layer according to the OSI network model to determine data characteristics, including communication ports, keywords in communication content, and data interaction patterns.

[0076] Data packets that conform to certain application protocol characteristics are labeled to determine their application protocol, and the relevant protocol information is recorded in the corresponding 5-tuple flow table.

[0077] Unrecognized data is cached; if it still cannot be recognized after associating with context, it is discarded.

[0078] After processing the current packet, the process moves on to the next packet, and so on.

[0079] Therefore, this implementation method has the following limitations: it requires deep packet inspection for each data packet, and the entire process includes data acquisition, data caching, flow table establishment, OSI layer-by-layer parsing, keyword analysis or flow feature analysis of the communication content, etc. The identification process involves many steps, is cumbersome, and computationally intensive, consuming huge amounts of storage and computing resources, resulting in low processing capacity of the equipment. This technology also has the problem of a large workload for operation and maintenance, because application protocols are frequently updated and changed, so the traffic identification and processing system also needs to be upgraded synchronously. This inevitably requires upgrading all traffic identification devices, involving many devices and a large workload. Therefore, if deep packet inspection technology is used for all traffic, it will face the situation of large-scale construction and difficult operation and maintenance. In today's explosive growth of traffic, the problems of large investment and low efficiency are particularly prominent.

[0080] This invention employs a method that requires deep packet inspection on only a small portion of the traffic (which could be one-tenth or less of the total traffic, depending on the actual situation). The vast majority of the traffic only needs to be identified by comparing server-side information to determine the specific application protocol. Specifically: the size of the traffic requiring identification is assessed, and a suitable sample of traffic is input into the traffic learning unit. The traffic learning unit performs deep packet inspection on the sampled data, analyzing it to determine the server IP and communication port (IP+Port) of various application protocols. Because each different application protocol has a different server IP+Port, through continuous identification of the sampled data, the traffic learning unit can learn all the server IPs and Ports for different applications, thereby constructing a knowledge base of application protocols and their corresponding server information. The traffic learning unit can maintain the knowledge base through the sampled data, such as aging records and adding new records in real time.

[0081] The traffic identification unit collects all network data traffic. Using an application protocol knowledge base distributed by the traffic learning unit, the traffic identification unit only needs to parse the data packets down to the OSI session layer (layer 5) and compare the IP address and port with records in the knowledge base to determine the application protocol to which the data packet belongs. This innovative approach eliminates the need to create flow tables, perform context caching on data packets, or parse down to the application layer (layer 7) for keyword or feature string matching, removing the most resource-intensive and lowest-performance steps. This significantly improves traffic identification performance while maintaining identification capability. During operation and maintenance, only the traffic learning unit needs to be upgraded to adapt to changes in application protocols. Therefore, this invention can greatly reduce the scale of construction, lower construction costs, and improve operational efficiency.

[0082] In summary, the technical concept of this application lies in its method, which employs a two-layer architecture of "sampling learning + knowledge base comparison." The aggregation and distribution device extracts representative traffic through a random sampling mechanism. While ensuring session integrity, only a small number of traffic learning units need to perform deep packet inspection, dynamically building and maintaining a knowledge base mapping protocols to server IP+Port. All data is then load-balanced across multiple traffic identification units. Each unit only needs to parse data packets to the OSI session layer and complete protocol identification through efficient comparison of source / destination IP+Port with the knowledge base. This design reduces the computational load of deep packet inspection to less than one-tenth of traditional solutions through the sampling mechanism, while the knowledge base comparison mechanism completely avoids resource-intensive operations such as flow table creation, application layer parsing, and context caching. At the operation and maintenance level, protocol rule updates only require upgrading the traffic learning unit, avoiding synchronized adjustments across the entire network. Furthermore, the dynamic aging mechanism of the knowledge base cleans up invalid records, and the closed-loop feedback mechanism automatically adjusts the sampling ratio based on the identification failure rate, further enhancing the system's long-term adaptability and stability. In summary, this solution addresses the core pain points of traditional solutions, such as high resource consumption, high operation and maintenance costs, and poor scalability, through its extremely simple packet parsing logic, flexible cluster architecture, and centralized knowledge management. It provides a cost-effective technical path for identifying high-speed network traffic with large data volumes.

[0083] The methods provided in this application will be described in detail below based on the corresponding implementation methods in some practical application scenarios.

[0084] This application provides a method for identifying traffic application protocols, including:

[0085] The full traffic data on the target link is obtained through aggregation and distribution devices;

[0086] The aggregation and splitting device is used to perform traffic replication and traffic splitting, and the full traffic data includes multiple data packets;

[0087] The convergence and distribution device extracts sampled traffic data with a preset learning ratio from the full traffic data, copies and transmits it to the traffic learning unit, and distributes the full traffic data to multiple traffic recognition units according to the recognition ratio.

[0088] The traffic learning unit is used to parse the sampled traffic data, determine the mapping relationship between the application protocol and the server address and server port to form a protocol knowledge base, and push the protocol knowledge base to each of the traffic identification units.

[0089] Furthermore, the traffic identification unit is used to parse the corresponding full traffic data and identify the application protocol based on the protocol knowledge base.

[0090] For specific system topology details, please refer to [link / reference]. Figure 2 , Figure 2 This is a schematic diagram of the architecture corresponding to the traffic application protocol identification method provided in one embodiment of this application. It more clearly shows the data flow in the aforementioned implementation. The aggregation and distribution device receives the full input traffic, obtains a portion of the sampled data and copies it to the traffic learning unit to learn the mapping between ports and application protocols in real time, adds it to the knowledge base, and pushes it to each traffic identification unit. At the same time, the aggregation and distribution device also distributes the full traffic data to each traffic identification unit according to a certain division method, with a specific granularity, such as session, function, or data packet granularity. Each traffic identification unit identifies the application protocol according to the knowledge base.

[0091] Specifically, the methods may include:

[0092] All links requiring traffic identification are connected via aggregation and distribution devices.

[0093] By using the aggregation and distribution replication and distribution functions, a portion of the data is extracted from the full data and copied to the traffic learning unit as sampling data; the full data is then evenly distributed to multiple traffic identification units in a load-balanced manner.

[0094] The traffic learning unit identifies the application protocols in the sampled data and forms a knowledge base of various protocol types and their corresponding server IP+Port based on the identification results.

[0095] The traffic learning unit pushes a knowledge base of protocol types and their corresponding server IP+Port to each traffic identification unit.

[0096] The traffic identification unit collects all data, parses the key information in the data packet header, and compares it with the records in the knowledge base to determine the application protocol type to which the data packet belongs.

[0097] By configuring specific algorithms on the aggregation and distribution equipment, data can be randomly and proportionally extracted as sampling data. This random sampling ensures the integrity of the data session while maintaining data representativeness. The equipment can then copy this sampled data and output it from the sampling port, ensuring the integrity of the entire dataset. The full dataset can be output to multiple traffic identification units based on load balancing principles, or adjusted according to the real-time operating status of each traffic identification unit.

[0098] For example, as an optional implementation, the step of distributing the full traffic data to multiple traffic identification units according to the identification ratio includes:

[0099] Determine the real-time load capacity of each traffic identification unit, and determine the identification ratio based on the real-time load capacity;

[0100] Based on the load balancing method and the identification ratio, each data packet of the full traffic data is allocated to each traffic identification unit according to a preset granularity.

[0101] This implementation dynamically adjusts the traffic distribution ratio based on the real-time load of the traffic identification unit, and distributes all data to multiple devices at a preset granularity through a load balancing strategy. This design combines real-time load monitoring and dynamic proportional distribution to avoid processing delays caused by single-point overload, while maximizing the utilization of cluster computing resources. The granular distribution mechanism ensures the continuity of data packet processing, improves the overall system throughput efficiency and robustness, and provides elastic support for high-concurrency traffic scenarios.

[0102] Alternatively, for the target traffic identification unit, if the proportion of data packets marked as unidentifiable data exceeds a preset threshold within a preset period, a sampling ratio adjustment mechanism is triggered to increase the identification ratio corresponding to the target traffic identification unit, and the identification ratio is restored after the protocol knowledge base is updated.

[0103] By performing deep packet inspection on the sampled data through the traffic learning unit, the server information (i.e., server IP + Port) corresponding to various application protocols is learned and accumulated to form a protocol knowledge base.

[0104] Based on the protocol knowledge base, the traffic identification unit only needs to parse each data packet down to the OSI session layer (layer 5) to obtain the source IP+port and destination IP+port information. By comparing it with the information in the knowledge base, the application protocol type of the data packet can be determined based on the comparison result.

[0105] The knowledge base solution eliminates the need to create flow tables, associate data packets with context caches, and only requires parsing down to the session layer (layer 5). It also avoids keyword or feature string matching, removing the most resource-intensive and performance-critical steps and significantly improving traffic identification performance. During operation and maintenance, adapting to changes in application protocols only requires upgrading the traffic learning unit. Therefore, this invention can greatly reduce the scale of construction, lower construction costs, and improve operational efficiency.

[0106] This implementation uses aggregation and distribution equipment to intelligently sample and distribute all traffic. Only a small number of traffic learning units need to perform deep packet inspection on the sampled data, building a knowledge base mapping application protocols to server addresses and ports. The traffic identification unit then uses this knowledge base to quickly compare IP+Port to identify the protocol. This solution significantly reduces the computational load of deep packet inspection through the sampling mechanism, avoiding the resource consumption of parsing every packet of the entire traffic. Simultaneously, the centralized construction and distribution mechanism of the knowledge base allows the traffic identification unit to complete efficient matching only at the session layer, significantly reducing the complexity of packet processing. During operation and maintenance, only the traffic learning units need to be updated to adapt to protocol changes, thus achieving a comprehensive benefit of reduced construction costs, improved processing efficiency, and reduced operational complexity while ensuring identification accuracy.

[0107] As mentioned above, please refer to Figure 3 , Figure 3 This is a schematic diagram illustrating the architecture and specific functions of a traffic application protocol identification method provided in one embodiment of this application. Figure 3 The main framework of the traffic learning unit and traffic identification unit is illustrated. All links requiring traffic identification are connected via aggregation and distribution devices. A proprietary algorithm randomly extracts and copies sampled data. The traffic learning unit uses the sampled data to learn and accumulate various application protocol types and their corresponding server IP+Port information, forming a knowledge base. The traffic identification unit collects all data, only needs to parse the IP+Port information of the data packet session layer, compare it with the application protocol knowledge base, and identify the application protocol type of the data packet based on the comparison result.

[0108] Specific methods may include:

[0109] All links requiring traffic identification are connected via aggregation and distribution devices.

[0110] By leveraging the replication and distribution functions of the aggregation and distribution devices, a portion of the data is proportionally and randomly extracted from the full dataset and copied to the traffic learning unit as sample data; the full dataset is then evenly distributed to multiple traffic identification units in a load-balanced manner.

[0111] The traffic learning unit uses deep packet inspection technology to analyze and identify traffic based on the sampled data. Based on the identification results, it learns and accumulates various protocol types and their corresponding server IP and port information to form a knowledge base.

[0112] The traffic learning unit pushes a knowledge base of protocol types and their corresponding server IP+Port to each traffic identification unit.

[0113] The traffic identification unit collects all data, parses out the source and destination IP+Port information of the data packets, and compares them with the records in the knowledge base. Based on the comparison results, the application protocol type of the data packets can be determined. Because the most resource-intensive and performance-degrading steps are removed, a high-throughput and high-efficiency traffic identification function is achieved.

[0114] Based on the total traffic volume and the maximum processing capacity of a single traffic identification unit, the total traffic can be evenly distributed to multiple traffic identification units through aggregation and distribution.

[0115] Please see Figure 4 , Figure 4 This is a flowchart illustrating the method executed by the traffic learning unit in a traffic application protocol identification method provided in one embodiment of this application. As an optional implementation, the step of extracting a preset learning ratio of sampled traffic data from the full traffic data through the aggregation and distribution device, copying it, and transmitting it to the traffic learning unit includes:

[0116] Configure the aggregation and distribution device to randomly extract a preset proportion of sampled traffic data at a preset granularity, copy it, and transmit it to the traffic learning unit;

[0117] Furthermore, the traffic learning unit parses the sampled traffic data to determine the mapping relationship between application protocols, server addresses, and server ports, thereby forming a protocol knowledge base, specifically including:

[0118] The traffic learning unit parses the quintuple information of each data packet in the sampled traffic data;

[0119] The five-tuple information includes source address, source port, destination address, destination port, and communication protocol;

[0120] Determine whether the five-tuple information corresponding to each data packet exists in the flow table. If it does not exist, add it to the flow table. If it exists, determine whether the corresponding five-tuple information has completed the application protocol identification process.

[0121] If the application protocol is not identified, then communication feature identification is performed based on the communication data of the corresponding data packet and the quintuple information;

[0122] If the communication feature identification fails, the corresponding data packet will be cached or marked.

[0123] If the communication feature is successfully identified, the application protocol is determined, and a target mapping relationship is constructed between the first combination of the source address and the source port or the second combination of the destination address and the destination port and the application protocol. If the target mapping relationship does not exist in the protocol knowledge base, the target mapping relationship is added to the protocol knowledge base.

[0124] As an optional implementation, the method further includes:

[0125] Calculate the last timestamp of each mapping relationship in the protocol knowledge base;

[0126] When the difference between the timestamp and the current time exceeds the aging period, the corresponding mapping relationship is marked as pending cleanup.

[0127] During the idle period of the traffic learning unit, the mapping relationships to be cleaned are cleared in batches and synchronously updated to each of the traffic identification units.

[0128] Therefore, a timestamp-based knowledge base aging mechanism can be introduced. By periodically cleaning up outdated mapping relationships and synchronously updating them to the traffic identification unit, the dynamic timeliness of the knowledge base can be ensured. This mechanism, combined with the traffic learning unit's batch processing strategy during idle periods, avoids interference with system performance caused by real-time cleaning, while also preventing misidentification problems caused by outdated records. Through the synergy of the aging mechanism and load balancing, the accuracy of the knowledge base can be guaranteed while maintaining system throughput, further improving the long-term stability of protocol identification.

[0129] Therefore, in specific application scenarios, the main process of the method can include:

[0130] Once the traffic learning unit is started, it begins collecting sampling data.

[0131] The sampled data is analyzed packet by packet to extract the five-tuple information (source IP, source port, destination IP, destination port, and communication protocol).

[0132] Determine if the 5-tuple information already exists in the flow table. If it does not exist, add it to the flow table. If it already exists, determine if the specific application protocol has been identified for the session flow. If it has been identified, proceed to the next packet processing loop; otherwise, proceed to the data feature judgment stage.

[0133] Based on information such as the communication port, keywords, characteristic strings, and context, determine whether the data packet belongs to an identifiable protocol. If the data packet is identifiable, construct the server IP + Port and the corresponding protocol type information; otherwise, determine whether caching is required, and then continue processing the next data packet.

[0134] The system checks the knowledge base to see if the record already exists based on the constructed application protocol information. If it does not exist, the record is added to the knowledge base, the newly added application protocol information is sent to each traffic identification unit, and then the next data packet is processed.

[0135] This implementation ensures the integrity and representativeness of data sessions through pre-defined granular random sampling. The traffic learning unit dynamically constructs a mapping relationship between protocols and server information based on a five-tuple flow table management mechanism and communication feature recognition technology. This process avoids redundant parsing through flow table reuse and improves the success rate of feature recognition by combining contextual association, ensuring the real-time performance and coverage of the knowledge base. The collaborative design of random sampling and flow table management reduces the impact of sampling bias on the completeness of the knowledge base and reduces computational redundancy through flow table reuse, thereby maintaining the sustainability of high-precision protocol recognition in resource-constrained scenarios.

[0136] Please see Figure 5 , Figure 5 This is a flowchart illustrating the method executed by the traffic identification unit in a traffic application protocol identification method provided in one embodiment of this application. As an optional implementation, the traffic identification unit parses the corresponding full traffic data and performs application protocol identification based on the protocol knowledge base, specifically including:

[0137] The protocol knowledge base is received through the traffic identification unit;

[0138] Parse each data packet in the full traffic data allocated to the traffic identification unit to the session layer of the Open Systems Interconnection model, and extract the source address, source port, destination address and destination port;

[0139] The source address and the source port are combined and matched against the protocol knowledge base. If the first match is successful, the corresponding application protocol type is output.

[0140] If the first match fails, the destination address and the destination port are combined and matched a second time with the protocol knowledge base. If the second match succeeds, the corresponding application protocol type is output. If the second match fails, the corresponding data packet is marked as unrecognizable data.

[0141] Therefore, in specific application scenarios, the main process of the method can include:

[0142] The traffic identification unit collects data from the load balancer.

[0143] Parse the data packets to obtain the source IP and port information and the destination IP and port information.

[0144] First, the application protocol knowledge base is searched using the source IP and port as the key. If the record exists, the application protocol type of the data packet can be determined. Otherwise, the destination IP and port information is searched. If the record exists, the application protocol type of the data packet can be determined. If no record is found in either case, it means that the data packet is unrecognizable.

[0145] Output relevant result information based on the recognition results.

[0146] This implementation employs a hierarchical matching strategy in the traffic identification unit: first, it searches the knowledge base using the source IP + Port; if that fails, it then matches the destination IP + Port. This process only requires parsing data packets down to the session layer, avoiding the resource consumption of application-layer keyword matching in traditional solutions. The two-tiered retrieval mechanism covers both server and client protocol features, significantly reducing single-packet processing time while maintaining recognition accuracy, achieving low-latency, high-throughput protocol identification in high-traffic scenarios.

[0147] As an optional implementation, the method further includes:

[0148] For the target traffic identification unit, if the proportion of data packets marked as unidentifiable data exceeds a preset threshold within a preset period, a sampling ratio adjustment mechanism is triggered to increase the identification ratio corresponding to the target traffic identification unit, and the identification ratio is restored after the protocol knowledge base is updated.

[0149] This implementation triggers dynamic sampling adjustments by using a threshold for the proportion of unidentifiable data packets, temporarily increasing the sampling ratio of the target traffic identification unit to supplement the knowledge base. This mechanism, combined with real-time updates to the protocol knowledge base and a traffic splitting ratio recovery strategy, adaptively responds to new protocols or server-side changes, avoiding system performance degradation caused by continuous identification failures. The closed-loop feedback design enhances the system's fault tolerance and dynamic adaptability, ensuring identification completeness during long-term operation.

[0150] In this application, aggregation and switching equipment is used to achieve effective data sampling while ensuring the integrity of the entire dataset. The entire dataset is evenly distributed across multiple traffic learning units in a load-balanced manner. Only a small number of traffic learning units are needed to perform deep packet inspection on the sampled data, learning and accumulating server IP+Port information for each application protocol to form a knowledge base. The traffic identification unit can quickly and efficiently identify data packets based on the application protocol knowledge base. Because the traffic identification unit reduces a significant amount of packet parsing or keyword / feature string comparison work, efficiency is greatly improved. The traffic learning unit and the traffic identification unit are independent; when the application protocol identification rules change, only the traffic identification unit needs to be upgraded, reducing a large amount of maintenance work.

[0151] Therefore, the key to creativity lies in:

[0152] The aggregation and distribution equipment can intelligently sample data, and the entire dataset can be load-balanced and distributed to multiple traffic identification units. Only a small number of traffic learning units are needed to perform deep packet inspection on the sampled data to build an application protocol knowledge base. The traffic identification units only need to perform simple packet parsing and efficient IP+Port retrieval to complete the protocol identification function for the data packets. When the application protocol identification rules change, only the traffic learning units need to be upgraded.

[0153] This application also provides a traffic application protocol identification device, including:

[0154] The acquisition module is used to acquire full traffic data on the target link through the aggregation and distribution equipment;

[0155] The aggregation and splitting device is used to perform traffic replication and traffic splitting, and the full traffic data includes multiple data packets;

[0156] The processing module is used to extract sampled traffic data with a preset learning ratio from the full traffic data through the aggregation and distribution device, copy and transmit it to the traffic learning unit, and distribute the full traffic data to multiple traffic identification units according to the identification ratio.

[0157] The processing module is further configured to parse the sampled traffic data through the traffic learning unit, determine the mapping relationship between the application protocol and the server address and server port, so as to form a protocol knowledge base, and push the protocol knowledge base to each of the traffic identification units;

[0158] Furthermore, the processing module is also used to parse the corresponding full traffic data through the traffic identification unit and to identify the application protocol according to the protocol knowledge base.

[0159] This implementation uses aggregation and distribution equipment to intelligently sample and distribute all traffic. Only a small number of traffic learning units need to perform deep packet inspection on the sampled data, building a knowledge base mapping application protocols to server addresses and ports. The traffic identification unit then uses this knowledge base to quickly compare IP+Port to identify the protocol. This solution significantly reduces the computational load of deep packet inspection through the sampling mechanism, avoiding the resource consumption of parsing every packet of the entire traffic. Simultaneously, the centralized construction and distribution mechanism of the knowledge base allows the traffic identification unit to complete efficient matching only at the session layer, significantly reducing the complexity of packet processing. During operation and maintenance, only the traffic learning units need to be updated to adapt to protocol changes, thus achieving a comprehensive benefit of reduced construction costs, improved processing efficiency, and reduced operational complexity while ensuring identification accuracy.

[0160] As an optional implementation, the specific method by which the processing module extracts sampled traffic data with a preset learning ratio from the full traffic data through the aggregation and distribution device, copies it, and transmits it to the traffic learning unit includes:

[0161] Configure the aggregation and distribution device to randomly extract a preset proportion of sampled traffic data at a preset granularity, copy it, and transmit it to the traffic learning unit;

[0162] Furthermore, the processing module parses the sampled traffic data through the traffic learning unit to determine the mapping relationship between application protocols, server addresses, and server ports, thereby forming a protocol knowledge base. Specific methods for this include:

[0163] The traffic learning unit parses the quintuple information of each data packet in the sampled traffic data;

[0164] The five-tuple information includes source address, source port, destination address, destination port, and communication protocol;

[0165] Determine whether the five-tuple information corresponding to each data packet exists in the flow table. If it does not exist, add it to the flow table. If it exists, determine whether the corresponding five-tuple information has completed the application protocol identification process.

[0166] If the application protocol is not identified, then communication feature identification is performed based on the communication data of the corresponding data packet and the quintuple information;

[0167] If the communication feature identification fails, the corresponding data packet will be cached or marked.

[0168] If the communication feature is successfully identified, the application protocol is determined, and a target mapping relationship is constructed between the first combination of the source address and the source port or the second combination of the destination address and the destination port and the application protocol. If the target mapping relationship does not exist in the protocol knowledge base, the target mapping relationship is added to the protocol knowledge base.

[0169] This implementation ensures the integrity and representativeness of data sessions through pre-defined granular random sampling. The traffic learning unit dynamically constructs a mapping relationship between protocols and server information based on a five-tuple flow table management mechanism and communication feature recognition technology. This process avoids redundant parsing through flow table reuse and improves the success rate of feature recognition by combining contextual association, ensuring the real-time performance and coverage of the knowledge base. The collaborative design of random sampling and flow table management reduces the impact of sampling bias on the completeness of the knowledge base and reduces computational redundancy through flow table reuse, thereby maintaining the sustainability of high-precision protocol recognition in resource-constrained scenarios.

[0170] As an optional implementation, the processing module is further configured to:

[0171] Calculate the last timestamp of each mapping relationship in the protocol knowledge base;

[0172] When the difference between the timestamp and the current time exceeds the aging period, the corresponding mapping relationship is marked as pending cleanup.

[0173] During the idle period of the traffic learning unit, the mapping relationships to be cleaned are cleared in batches and synchronously updated to each of the traffic identification units.

[0174] This implementation introduces a timestamp-based knowledge base aging mechanism. By periodically cleaning up outdated mapping relationships and synchronously updating them to the traffic identification unit, the dynamic timeliness of the knowledge base is ensured. This mechanism, combined with the traffic learning unit's batch processing strategy during idle periods, avoids interference with system performance caused by real-time cleaning and prevents misidentification due to outdated records. Through the synergy of the aging mechanism and load balancing, the accuracy of the knowledge base is guaranteed while maintaining system throughput, further improving the long-term stability of protocol identification.

[0175] As an optional implementation, the specific method by which the processing module distributes the full traffic data to multiple traffic identification units according to the identification ratio includes:

[0176] Determine the real-time load capacity of each traffic identification unit, and determine the identification ratio based on the real-time load capacity;

[0177] Based on the load balancing method and the identification ratio, each data packet of the full traffic data is allocated to each traffic identification unit according to a preset granularity.

[0178] This implementation dynamically adjusts the traffic distribution ratio based on the real-time load of the traffic identification unit, and distributes all data to multiple devices at a preset granularity through a load balancing strategy. This design combines real-time load monitoring and dynamic proportional distribution to avoid processing delays caused by single-point overload, while maximizing the utilization of cluster computing resources. The granular distribution mechanism ensures the continuity of data packet processing, improves the overall system throughput efficiency and robustness, and provides elastic support for high-concurrency traffic scenarios.

[0179] As an optional implementation, the processing module parses the corresponding full traffic data through the traffic identification unit and performs application protocol identification based on the protocol knowledge base in the following specific ways:

[0180] The protocol knowledge base is received through the traffic identification unit;

[0181] Parse each data packet in the full traffic data allocated to the traffic identification unit to the session layer of the Open Systems Interconnection model, and extract the source address, source port, destination address and destination port;

[0182] The source address and the source port are combined and matched against the protocol knowledge base. If the first match is successful, the corresponding application protocol type is output.

[0183] If the first match fails, the destination address and the destination port are combined and matched a second time with the protocol knowledge base. If the second match succeeds, the corresponding application protocol type is output. If the second match fails, the corresponding data packet is marked as unrecognizable data.

[0184] This implementation employs a hierarchical matching strategy in the traffic identification unit: first, it searches the knowledge base using the source IP + Port; if that fails, it then matches the destination IP + Port. This process only requires parsing data packets down to the session layer, avoiding the resource consumption of application-layer keyword matching in traditional solutions. The two-tiered retrieval mechanism covers both server and client protocol features, significantly reducing single-packet processing time while maintaining recognition accuracy, achieving low-latency, high-throughput protocol identification in high-traffic scenarios.

[0185] As an optional implementation, the processing module is further configured to:

[0186] For the target traffic identification unit, if the proportion of data packets marked as unidentifiable data exceeds a preset threshold within a preset period, a sampling ratio adjustment mechanism is triggered to increase the identification ratio corresponding to the target traffic identification unit, and the identification ratio is restored after the protocol knowledge base is updated.

[0187] This implementation triggers dynamic sampling adjustments by using a threshold for the proportion of unidentifiable data packets, temporarily increasing the sampling ratio of the target traffic identification unit to supplement the knowledge base. This mechanism, combined with real-time updates to the protocol knowledge base and a traffic splitting ratio recovery strategy, adaptively responds to new protocols or server-side changes, avoiding system performance degradation caused by continuous identification failures. The closed-loop feedback design enhances the system's fault tolerance and dynamic adaptability, ensuring identification completeness during long-term operation.

[0188] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. For example, a processing module can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as program code in the device's memory, and its functions can be called and executed by a processing element. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0189] Indicatively, such as Figure 6 As shown, Figure 6 This is a schematic diagram of the internal structure of a computer device 300 provided in an embodiment of this application. The computer device 300 can be provided as a server. (Refer to...) Figure 6 The computer device 300 includes a processing component 302, which further includes one or more processors, and memory resources represented by memory 301 for storing instructions, such as application programs, that can be executed by the processing component 302. The application programs stored in memory 301 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 302 is configured to execute instructions to perform the methods of any of the embodiments described above.

[0190] The computer device 300 may also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate on an operating system stored in memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0191] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0192] This application provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the method provided in any embodiment.

[0193] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0194] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0195] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identifying traffic application protocols, characterized in that, The method includes: The full traffic data on the target link is obtained through aggregation and distribution devices; The aggregation and splitting device is used to perform traffic replication and traffic splitting, and the full traffic data includes multiple data packets; The convergence and distribution device extracts sampled traffic data with a preset learning ratio from the full traffic data, copies and transmits it to the traffic learning unit, and distributes the full traffic data to multiple traffic recognition units according to the recognition ratio. The traffic learning unit is used to parse the sampled traffic data, determine the mapping relationship between the application protocol and the server address and server port to form a protocol knowledge base, and push the protocol knowledge base to each of the traffic identification units. Furthermore, the traffic identification unit is used to parse the corresponding full traffic data and identify the application protocol based on the protocol knowledge base.

2. The method according to claim 1, characterized in that, The step of extracting a preset learning ratio of sampled traffic data from the full traffic data through the aggregation and distribution device, copying it, and transmitting it to the traffic learning unit includes: Configure the aggregation and distribution device to randomly extract a preset proportion of sampled traffic data at a preset granularity, copy it, and transmit it to the traffic learning unit; Furthermore, the traffic learning unit parses the sampled traffic data to determine the mapping relationship between application protocols, server addresses, and server ports, thereby forming a protocol knowledge base, specifically including: The traffic learning unit parses the quintuple information of each data packet in the sampled traffic data; The five-tuple information includes source address, source port, destination address, destination port, and communication protocol; Determine whether the five-tuple information corresponding to each data packet exists in the flow table. If it does not exist, add it to the flow table. If it exists, determine whether the corresponding five-tuple information has completed the application protocol identification process. If the application protocol is not identified, then communication feature identification is performed based on the communication data of the corresponding data packet and the quintuple information; If the communication feature identification fails, the corresponding data packet will be cached or marked. If the communication feature is successfully identified, the application protocol is determined, and a target mapping relationship is constructed between the first combination of the source address and the source port or the second combination of the destination address and the destination port and the application protocol. If the target mapping relationship does not exist in the protocol knowledge base, the target mapping relationship is added to the protocol knowledge base.

3. The method according to claim 2, characterized in that, The method further includes: Calculate the last timestamp of each mapping relationship in the protocol knowledge base; When the difference between the timestamp and the current time exceeds the aging period, the corresponding mapping relationship is marked as pending cleanup. During the idle period of the traffic learning unit, the mapping relationships to be cleaned are cleared in batches and synchronously updated to each of the traffic identification units.

4. The method according to claim 1, characterized in that, The step of distributing the full traffic data to multiple traffic identification units according to the identification ratio includes: Determine the real-time load capacity of each traffic identification unit, and determine the identification ratio based on the real-time load capacity; Based on the load balancing method and the identification ratio, each data packet of the full traffic data is allocated to each traffic identification unit according to a preset granularity.

5. The method according to claim 1, characterized in that, The traffic identification unit parses the corresponding full traffic data and identifies the application protocol based on the protocol knowledge base, specifically including: The protocol knowledge base is received through the traffic identification unit; Parse each data packet in the full traffic data allocated to the traffic identification unit to the session layer of the Open Systems Interconnection model, and extract the source address, source port, destination address and destination port; The source address and the source port are combined and matched against the protocol knowledge base. If the first match is successful, the corresponding application protocol type is output. If the first match fails, the destination address and the destination port are combined and matched a second time with the protocol knowledge base. If the second match succeeds, the corresponding application protocol type is output. If the second match fails, the corresponding data packet is marked as unrecognizable data.

6. The method according to claim 5, characterized in that, The method further includes: For the target traffic identification unit, if the proportion of data packets marked as unidentifiable data exceeds a preset threshold within a preset period, a sampling ratio adjustment mechanism is triggered to increase the identification ratio corresponding to the target traffic identification unit, and the identification ratio is restored after the protocol knowledge base is updated.

7. A traffic application protocol identification device, characterized in that, include: The acquisition module is used to acquire full traffic data on the target link through the aggregation and distribution equipment; The aggregation and splitting device is used to perform traffic replication and traffic splitting, and the full traffic data includes multiple data packets; The processing module is used to extract sampled traffic data with a preset learning ratio from the full traffic data through the aggregation and distribution device, copy and transmit it to the traffic learning unit, and distribute the full traffic data to multiple traffic identification units according to the identification ratio. The processing module is further configured to parse the sampled traffic data through the traffic learning unit, determine the mapping relationship between the application protocol and the server address and server port, so as to form a protocol knowledge base, and push the protocol knowledge base to each of the traffic identification units; Furthermore, the processing module is also used to parse the corresponding full traffic data through the traffic identification unit and to identify the application protocol according to the protocol knowledge base.

8. The apparatus according to claim 7, characterized in that, The specific method by which the processing module extracts sampled traffic data with a preset learning ratio from the full traffic data through the aggregation and distribution device, copies it, and transmits it to the traffic learning unit includes: Configure the aggregation and distribution device to randomly extract a preset proportion of sampled traffic data at a preset granularity, copy it, and transmit it to the traffic learning unit; Furthermore, the processing module parses the sampled traffic data through the traffic learning unit to determine the mapping relationship between application protocols, server addresses, and server ports, thereby forming a protocol knowledge base. Specific methods for this include: The traffic learning unit parses the quintuple information of each data packet in the sampled traffic data; The five-tuple information includes source address, source port, destination address, destination port, and communication protocol; Determine whether the five-tuple information corresponding to each data packet exists in the flow table. If it does not exist, add it to the flow table. If it exists, determine whether the corresponding five-tuple information has completed the application protocol identification process. If the application protocol is not identified, then communication feature identification is performed based on the communication data of the corresponding data packet and the quintuple information; If the communication feature identification fails, the corresponding data packet will be cached or marked. If the communication feature is successfully identified, the application protocol is determined, and a target mapping relationship is constructed between the first combination of the source address and the source port or the second combination of the destination address and the destination port and the application protocol. If the target mapping relationship does not exist in the protocol knowledge base, the target mapping relationship is added to the protocol knowledge base.

9. A computer device, characterized in that, The method includes one or more processors and a memory storing computer-readable instructions that, when executed by the one or more processors, perform the steps of the method as described in any one of claims 1-6.

10. A storage medium, characterized in that, The storage medium stores computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the method as described in any one of claims 1-6.

Images