5g traffic screening method, system, device and storage medium based on multi-core processing unit

Abstract

This invention relates to a 5G traffic filtering method, system, device, and storage medium based on a multi-core processing unit. The method includes: receiving raw traffic; copying and performing basic parsing on the raw traffic; distributing filtered user plane traffic and signaling plane traffic to a multi-core processing unit; performing deep protocol parsing on the received user plane traffic; dynamically identifying 5G user plane interface traffic based on the protocol characteristics of the user plane traffic; generating a first dynamic rule; performing deep protocol parsing on the received signaling plane traffic; generating a second dynamic rule; distributing the first and second dynamic rules to a switching chip; performing final filtering on the traffic based on the first and second dynamic rules; and outputting the target 5G traffic. Through the synergistic effect of the first and second dynamic rules, the accuracy and automation level of signaling traffic filtering are improved, while significantly simplifying the configuration and maintenance complexity of the equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a 5G traffic screening method and device based on a multi-core processing unit, equipment and a storage medium. BACKGROUND

[0002] The convergence shunt device is a crucial infrastructure in the field of communication network, especially 5G network operation and maintenance, security monitoring and big data collection. It is usually used in conjunction with a splitter, responsible for collecting, screening and shunting the massive traffic in the network, and accurately distributing the target traffic to the back-end analysis system or monitoring platform.

[0003] In the current 5G network environment, the traffic that needs to be collected and analyzed mainly contains two aspects: user plane traffic and signaling plane traffic. The user plane traffic mainly involves N3 (between RAN and UPF) and N9 (between UPFs) interfaces, carrying the user's actual service data. However, the actual traffic environment in the network is very complex, mainly reflected in: first, the user plane traffic not only contains standard N3 / N9 interface traffic, but also may mix S1-U, S5 / S8 interface traffic in the 5G and 4G converged networking scenario, and data from the N6 interface (between UPF and data network); second, in the user plane traffic, in addition to ordinary Internet data, there may be embedded key business data such as SIP voice (VoNR), 5G message, SMS, etc. The signaling plane traffic involves N11 (between AMF and SMF), N16 (between SMFs of different operators), etc. interfaces, responsible for session management, mobility management and other control signaling.

[0004] Currently, the industry is based on static engineering parameter data to filter 5G traffic. This scheme relies on pre-configured core network element (such as UPF, SMF, etc.) IP address and other engineering parameter information, and realizes screening by matching traffic IP address with engineering parameter library.

[0005] However, with the evolution of 5G network architecture and the expansion of deployment scale, this filtering scheme based on static engineering parameters exposes many inherent defects and deficiencies:

[0006] 1. 5G network elements often use virtualized deployment and support elastic scaling, with frequent IP address changes. Static engineering parameter data updates lag, resulting in the shunt device being unable to correctly identify new traffic after network element adjustment or expansion, causing incomplete output traffic.

[0007] 2. The media stream (RTP / RTCP) of the SIP voice and other services embedded in the user plane traffic is dynamically negotiated. Static parameters cannot match these dynamic parameters, resulting in mixed traffic with a large amount of non-data service traffic, with low purity.

[0008] 3.5G signaling network element multiple service interface commonly share IP address. Based on unilateral IP filtering will mix multiple interface traffic; based on two sides IP combination filtering rules quantity is huge, and in roaming scene because unable to acquire external network element engineering parameter and fail. SUMMARY

[0009] The purpose of the present application is to provide a 5G traffic screening method based on multi-core processing unit, to solve the problem of 5G traffic screening based on multi-core processing unit.

[0010] The first aspect of the present application provides a 5G traffic screening method based on multi-core processing unit, comprising:

[0011] Accessing the original traffic through the physical interface unit, copying and basic analyzing the original traffic by the switching chip, and preliminarily screening according to the preset filtering rules, and distributing the screened user plane traffic and signaling plane traffic to the multi-core processing unit;

[0012] The multi-core processing unit performs deep protocol analysis on the received user plane traffic, dynamically identifies 5G user plane interface traffic according to the protocol characteristics of the user plane traffic, the 5G user plane interface traffic includes voice, message and media stream traffic, and generates a first dynamic rule for filtering the voice, message and media stream traffic;

[0013] The multi-core processing unit performs deep protocol analysis on the received signaling plane traffic, dynamically identifies target signaling interface traffic according to the application layer protocol characteristics, parses the address and tunnel information of the 5G user plane network element from the target signaling interface traffic, and generates a second dynamic rule for identifying 5G user plane traffic;

[0014] The first dynamic rule and the second dynamic rule are issued to the switching chip, and the switching chip performs final screening on the traffic according to the first dynamic rule and the second dynamic rule, and outputs the target 5G traffic.

[0015] In a possible implementation, the 5G user plane interface traffic is dynamically identified according to the protocol characteristics of the user plane traffic, comprising:

[0016] The user plane traffic is analyzed by GTP protocol, and the traffic meeting the 5G user plane data characteristics is screened out by identifying the preset characteristic combination in the protocol header, and the user plane data not meeting the 5G user plane interface characteristics is filtered out.

[0017] In a possible implementation, the first dynamic rule for filtering the voice, message and media stream traffic is generated, comprising:

[0018] Deep protocol analysis is performed on the user plane traffic, and session control signaling used for establishing and managing a communication session is identified;

[0019] The session control signaling is analyzed, and transport layer network address and port information dynamically allocated for a media stream are extracted;

[0020] According to the transport layer network address and port information, a first dynamic rule is dynamically generated.

[0021] In a possible implementation, the target signaling interface traffic is dynamically identified according to the application layer protocol features, and the method comprises the following steps:

[0022] The signaling plane traffic is subjected to application layer protocol decoding, and the protocol message structure and content features of the service-oriented architecture interface are analyzed, so that the target signaling interface traffic related to user plane connection management is identified and separated from the converged signaling plane traffic.

[0023] In a possible implementation, the preliminary screening according to the preset filtering rule comprises the following steps:

[0024] The access network identification information in the signaling message is analyzed by using the deep packet inspection technology, and the IP header features and the pre-defined network element address list are combined to identify and distinguish the traffic of different access types, so that the pre-classification and filtering of the traffic are realized.

[0025] The second aspect of the present application provides a 5G traffic screening system based on a multi-core processing unit, which comprises:

[0026] A physical interface unit is configured to access original traffic.

[0027] A switching chip unit is connected to the physical interface unit and is configured to copy and perform basic analysis on the original traffic, and perform preliminary screening according to a preset filtering rule, and distribute the screened user plane traffic and signaling plane traffic to a multi-core processing unit.

[0028] The multi-core processing unit is connected to the switching chip unit and is configured to perform deep protocol analysis on the received user plane traffic, dynamically identify 5G user plane interface traffic according to the protocol features of the user plane traffic, the 5G user plane interface traffic comprising voice, message and media stream traffic, and generate a first dynamic rule for filtering the voice, message and media stream traffic.

[0029] The received signaling plane traffic is subjected to deep protocol analysis, target signaling interface traffic is dynamically identified according to the application layer protocol features, the address and tunnel information of the 5G user plane network element are analyzed from the target signaling interface traffic, and a second dynamic rule for identifying 5G user plane traffic is generated.

[0030] The multi-core processing unit issues the first dynamic rule and the second dynamic rule to the switch chip, and the switch chip performs final screening on the traffic according to the first dynamic rule and the second dynamic rule, and outputs target 5G traffic.

[0031] In a possible implementation, the multi-core processing unit comprises:

[0032] The first software module is used for processing user plane traffic, and realizes 5G user plane interface traffic identification and filtering of session and media traffic.

[0033] The second software module is used for processing signaling plane traffic, and realizes target signaling interface traffic identification and extraction of user plane network element and tunnel information.

[0034] The third aspect of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor realizes the multi-core processing unit-based 5G traffic screening method according to the first aspect of the present application when executing the computer program.

[0035] The fourth aspect of the present application provides a computer readable storage medium, which stores a computer program, and the computer program realizes the multi-core processing unit-based 5G traffic screening method according to the first aspect of the present application when executed by a processor.

[0036] Compared with the prior art, the present application has the following beneficial effects:

[0037] Through the synergistic effect of the first dynamic rule and the second dynamic rule, the first dynamic rule purifies the captured traffic, and the second dynamic rule dynamically extracts the UPF address from the real-time signaling, realizes the full-process dynamic of traffic identification to content screening, reduces the dependence on external work parameter data such as roaming scenarios, significantly improves the accuracy and automation level of signaling traffic filtering, and greatly simplifies the configuration and operation and maintenance complexity of the device.

[0038] Through deep analysis of the SIP / SDP protocol in the user plane traffic by the multi-core processing unit, the media stream address port is dynamically obtained and the first dynamic rule is generated, which realizes accurate stripping of voice, message and other non-data service traffic, and significantly improves the purity of the output traffic.

[0039] The multi-core processing unit dynamically analyzes the signaling plane traffic, extracts the current active UPF network element address information, and generates the second dynamic rule, so that the traffic screening can adapt to the network topology changes in real time, and ensures the complete capture of the 5G user plane traffic. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1This is a flowchart illustrating the 5G traffic filtering method based on a multi-core processing unit according to the present invention.

[0041] Figure 2 This is a schematic diagram of the architecture of the 5G traffic filtering system based on a multi-core processing unit according to the present invention.

[0042] Figure 3 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0044] It should be noted that the serial numbers assigned to the components in the embodiments of the present invention, such as "first" and "second", are only used to distinguish the described objects and have no sequential or technical meaning.

[0045] The following is combined with Figure 1 This invention describes a 5G traffic filtering method based on a multi-core processing unit.

[0046] A 5G traffic filtering method based on multi-core processing units includes:

[0047] S1. Traffic aggregation and pre-filtering: The raw traffic is accessed through the physical interface unit, the switching chip copies and performs basic parsing of the raw traffic, and performs preliminary filtering according to the preset filtering rules, and distributes the filtered user plane traffic and signaling plane traffic to the multi-core processing unit.

[0048] The raw traffic in the network comes through physical interfaces such as SFP+ or QSFP28 of network devices. This traffic is a mixture of user plane data (such as N3 and N9 interface traffic) and signaling plane data (such as N11 and N16 interface traffic).

[0049] First, inbound traffic is copied multiple times to facilitate parallel processing of the user plane and signaling plane. The switching chip performs line-rate, coarse-grained filtering of the traffic based on pre-configured filtering rules. This stage primarily parses header information from the link layer (e.g., MAC address), network layer (e.g., IP address, protocol type), and transport layer (e.g., port number). For example, preset rules might include: allowing only traffic with destination IP addresses in the core network element address range; filtering out network management protocol traffic such as ICMP; and distinguishing traffic from different links based on VLAN ID.

[0050] After initial screening, the relatively clean user plane traffic and signaling plane traffic are distributed to the multi-core processing units. This effectively reduces the burden of handling invalid traffic for the multi-core processing units.

[0051] When performing preliminary screening using preset filtering rules, deep packet inspection technology can be used to analyze the access network identification information in the signaling message, and combined with IP header features and a predefined list of network element addresses, to identify and distinguish traffic of different access types, so as to achieve pre-classification and filtering of traffic.

[0052] For example, parse the P-Access-Network-Info header field in SIP signaling, or parse the relevant AVP (attribute-value pair) in the Diameter protocol, and check the Access-Type parameter. If the parameter value is "non-3gpp", "Wi-Fi", etc., it indicates that this traffic comes from a non-3GPP access.

[0053] In addition, IP header characteristics can be combined, such as checking whether it carries IPSec encapsulation (a typical security feature of non-3GPP access), or whether the source IP address belongs to the known address range of non-3GPP interoperability function (N3IWF) network elements.

[0054] S2. Deep processing of user plane traffic and dynamic rule generation: The multi-core processing unit performs deep protocol parsing on the received user plane traffic, dynamically identifies 5G user plane interface traffic based on the protocol characteristics of the user plane traffic, the 5G user plane interface traffic includes voice, message and media stream traffic, and generates a first dynamic rule for filtering the voice, message and media stream traffic.

[0055] User plane traffic distributed to the multi-core processing unit undergoes deep packet inspection (DPI) and state tracking by a dedicated software module (user plane processing engine) running on it. This engine performs GTP protocol parsing on the traffic. By identifying characteristic combinations in the GTP protocol header, it can accurately distinguish 5G user plane traffic (such as N3 and N9 interfaces) from traffic of other standards (such as 4G S1-U interface traffic).

[0056] Based on the identification of 5G user plane traffic, the engine further identifies and separates the mixed voice (such as VoNR), messaging (such as 5G messages), and media stream traffic, and generates a first dynamic rule for filtering these traffic. This rule is dynamic, meaning it automatically updates as signaling interactions in the network change without manual intervention.

[0057] The first dynamic rule can be generated in the following way:

[0058] The user plane traffic is subjected to deep protocol parsing to identify session control signaling used to establish and manage communication sessions; the session control signaling is parsed to extract the transport layer network address and port information dynamically allocated to the media stream; and a first dynamic rule is dynamically generated based on the transport layer network address and port information.

[0059] Specifically, this involves deep analysis of application layer protocols within user plane traffic. For example, identifying SIP (Session Initiation Protocol) signaling. SIP signaling is used to establish, modify, and terminate multimedia sessions, and its message header contains specific method fields such as INVITE, ACK, and BYE. These characteristics allow for accurate identification of SIP traffic.

[0060] The identified SIP signaling (such as INVITE requests and 200 OK responses) is parsed, and its message body typically uses SDP (Session Description Protocol). Parsing the SDP content allows extraction of key information from the media stream, such as:

[0061] Line 'c' specifies the IP address for the media stream connection.

[0062] m line: Specifies the transmission port of the media stream (such as the RTP port), and it is usually agreed that the RTCP port is the RTP port + 1.

[0063] These IP addresses and ports are dynamically negotiated during session establishment and cannot be predicted through static parameters.

[0064] Based on the extracted IP address and port number, a precise IP 5-tuple rule (source IP, destination IP, protocol, source port, destination port) is dynamically generated. This rule is an important component of the first dynamic rule, used to instruct the output filtering unit to filter out the corresponding voice (RTP) and control (RTCP) media streams, thereby removing VoNR voice and other service data from the N3 interface traffic.

[0065] S3. Signaling plane traffic deep processing and dynamic rule generation: The multi-core processing unit performs deep protocol parsing on the received signaling plane traffic, dynamically identifies the target signaling interface traffic based on the application layer protocol characteristics, parses the address and tunnel information of the 5G user plane network element from the target signaling interface traffic, and generates a second dynamic rule for identifying the 5G user plane traffic.

[0066] Signaling plane traffic distributed to the multi-core processing unit is processed by a separate software module (signaling plane processing engine). This engine performs application layer protocol decoding on the signaling plane traffic, particularly for the HTTP / 2 protocol. By parsing its specific message structure and content characteristics, it can intelligently identify target interface (such as N11, N16) traffic related to user plane management from massive amounts of signaling. Deep analysis is performed on the identified target signaling traffic (such as PDU session establishment requests on the N11 interface) to extract key information such as the IP address and Tunnel Endpoint Identifier (TEID) of currently active UPF (User Plane Function) network elements. Based on this information, a second dynamic rule (usually a whitelist rule) is generated to accurately identify 5G user plane traffic.

[0067] S4. Rule distribution and final traffic filtering: The first dynamic rule and the second dynamic rule are distributed to the switching chip. The switching chip performs final filtering of the traffic according to the first dynamic rule and the second dynamic rule, and outputs the target 5G traffic.

[0068] The first dynamic rules (such as a blacklist for filtering voice / messages) and the second dynamic rules (such as a whitelist for identifying 5G traffic), generated by the multi-core processing unit, are sent in real time to the output filtering unit of the switching chip. The output filtering unit is a high-performance rule matching engine that performs final, precise filtering of traffic based on these dynamically generated rules. For example, it only allows data packets that match the second dynamic rule (5G user plane traffic) but not the first dynamic rule (non-voice / message traffic) to pass through, thus outputting "clean" target 5G data traffic. Furthermore, the output filtering unit also has rule aging and statistical functions, periodically cleaning up expired rules and recording the number of hits.

[0069] In this application, the identification of 5G user plane traffic can be carried out in the following way:

[0070] The user plane traffic is parsed using the GTP protocol. By identifying the preset feature combinations in the protocol header, traffic that matches the characteristics of 5G user plane data is filtered out, while user plane data that does not match the characteristics of the 5G user plane interface is filtered out.

[0071] 5G user plane data typically uses the GTPv1 protocol, which has a unique combination of characteristics that distinguishes it from 4G traffic. For example:

[0072] Version number: must be a value indicating GTPv1.

[0073] Protocol Type: Must be a specific value to indicate that this is the GTP protocol rather than GTP.

[0074] Message Type: Must be a specific value, indicating that this is a T-PDU message carrying user data packets.

[0075] Extension Header: Must exist and contain a PDU Session Container. This is a unique identifier assigned by the 5G core network to each PDU session and is a key feature that distinguishes 5G from 4G traffic.

[0076] Only when a data packet simultaneously meets all the above characteristics is it determined to be legitimate 5G user plane traffic on the N3 or N9 interface. This method can effectively filter out traffic from interfaces such as S1-U and S5 / S8 that coexist in 4G / 5G converged networks.

[0077] For target signaling interface traffic, the following methods can be used for identification:

[0078] Application layer protocol decoding is performed on signaling plane traffic. By parsing the protocol message structure and content characteristics of the service architecture interface, the target signaling interface traffic related to user plane connection management is identified and separated from the aggregated signaling plane traffic.

[0079] The 5G core network signaling adopts a service-based architecture (SBA) and uses the HTTP / 2 protocol. The signaling plane processing engine first decodes the traffic using HTTP / 2. Since HTTP / 2 uses the HPACK algorithm to compress the header, the engine needs to learn and build a dynamic index table to complete the decompression. Afterwards, the decoded HTTP / 2 messages are analyzed.

[0080] Resolve the URI path; for example, a POST request containing " / nsmf-pdusession / v1 / pdu-sessions" is likely from the N11 interface (SMF service).

[0081] Parse specific fields in the JSON message body, such as supi (user permanent identifier) ​​and dnn (data network name).

[0082] Parse specific HTTP header fields, such as 3gpp-sbi-target, which explicitly indicates the target network functionality.

[0083] By matching these features, the traffic of target signaling interfaces such as N11 and N16 can be accurately identified.

[0084] The second dynamic rule for the signaling plane can be generated in the following way:

[0085] Real-time analysis of signaling interaction processes related to session management on the target signaling interface;

[0086] From the forwarding rule information contained in the session control message of the signaling interaction process, the user plane network element address and tunnel identification information determined for user plane data forwarding are parsed out; based on the user plane network element address and tunnel identification information, a whitelist rule for accurately identifying 5G user plane traffic is constructed, and this whitelist rule is the second dynamic rule.

[0087] Specifically, the engine monitors the complete signaling process for PDU session establishment on the N11 interface, especially the PFCP (Packet Forwarding Control Protocol) session interaction between the SMF and UPF. It performs in-depth analysis of key messages such as the PFCP SessionEstablishment Request. From information elements (IEs) such as PDR (Packet Inspection Rule) and FAR (Forwarding Action Rule) within these messages, it extracts the network layer address (UPF's N3 / N9 interface IP) and tunnel identifier (TEID) assigned by the UPF to user plane data. The extracted IP address and TEID (or at least the IP address) information are combined to generate a whitelist rule, i.e., the second dynamic rule. This rule is used to allow GTP-U packets originating from or destined for these UPFs during the final filtering process, thereby ensuring the filtering of clean 5G user plane traffic and automatically adapting to scenarios of UPF expansion or IP address changes.

[0088] like Figure 2 As shown, the present invention also provides a 5G traffic filtering system based on a multi-core processing unit, comprising:

[0089] Physical interface unit 10 is used to access raw traffic;

[0090] The switching chip unit 20 is connected to the physical interface unit and is used to copy and perform basic parsing of the raw traffic, and to perform preliminary screening according to preset filtering rules, and distribute the filtered user plane traffic and signaling plane traffic to the multi-core processing unit.

[0091] The multi-core processing unit 30, connected to the switching chip unit, is used to perform deep protocol parsing on the received user plane traffic, dynamically identify 5G user plane interface traffic based on the protocol characteristics of the user plane traffic, the 5G user plane interface traffic including voice, message and media stream traffic, and generate a first dynamic rule for filtering the voice, message and media stream traffic.

[0092] The received signaling plane traffic is subjected to deep protocol parsing. The target signaling interface traffic is dynamically identified based on the application layer protocol characteristics. The address and tunnel information of the 5G user plane network element are parsed from the target signaling interface traffic to generate a second dynamic rule for identifying 5G user plane traffic.

[0093] The multi-core processing unit 30 and the switching chip unit 20 also interact a second time. The multi-core processing unit sends the first dynamic rule and the second dynamic rule to the switching chip. The switching chip performs final filtering of the traffic according to the first dynamic rule and the second dynamic rule and outputs the target 5G traffic.

[0094] In one embodiment, the multi-core processing unit includes:

[0095] The first software module is used to process user plane traffic, realize 5G user plane interface traffic identification and session and media traffic filtering;

[0096] The second software module is used to process signaling plane traffic, realize the identification of target signaling interface traffic and the extraction of user plane network element and tunnel information.

[0097] In one embodiment, such as Figure 3 As shown, a computer device 40 is provided, including a memory 42, a processor 41, and a computer program 43 stored in the memory 42 and executable on the processor 41. When the processor 41 executes the computer program 43, it implements the steps in the data processing method of the above embodiments. To avoid repetition, these steps will not be described again here. Alternatively, when the processor 41 executes the computer program 43, it implements the functions of each module in the above embodiments of the 5G traffic filtering system based on a multi-core processing unit. To avoid repetition, these steps will not be described again here.

[0098] In one embodiment, a readable storage medium is provided, which stores a computer program 43. When the computer program 43 is executed by the processor 41, it implements the steps in the data processing method of the above embodiments. To avoid repetition, these steps will not be repeated here. Alternatively, when the processor 41 executes the computer program 43, it implements the functions of each module in the above data processing device embodiments. To avoid repetition, these functions will not be repeated here.

[0099] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAM bus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0100] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional modules, sub-modules, and units as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A 5G traffic filtering method based on multi-core processing units, characterized in that, include: The raw traffic is accessed through the physical interface unit, and the switching chip copies and performs basic parsing of the raw traffic. It then performs preliminary filtering according to preset filtering rules and distributes the filtered user plane traffic and signaling plane traffic to the multi-core processing unit. The multi-core processing unit performs deep protocol parsing on the received user plane traffic, dynamically identifies 5G user plane interface traffic based on the protocol characteristics of the user plane traffic, the 5G user plane interface traffic includes voice, message and media stream traffic, and generates a first dynamic rule for filtering the voice, message and media stream traffic. The multi-core processing unit performs deep protocol parsing on the received signaling plane traffic, dynamically identifies the target signaling interface traffic based on the application layer protocol characteristics, parses the address and tunnel information of the 5G user plane network element from the target signaling interface traffic, and generates a second dynamic rule for identifying 5G user plane traffic. The first dynamic rule and the second dynamic rule are sent to the switching chip, and the switching chip performs final filtering of the traffic according to the first dynamic rule and the second dynamic rule, and outputs the target 5G traffic.

2. The 5G traffic filtering method based on a multi-core processing unit according to claim 1, characterized in that, The dynamic identification of 5G user plane interface traffic based on the protocol characteristics of user plane traffic includes: The user plane traffic is parsed using the GTP protocol. By identifying the preset feature combinations in the protocol header, traffic that matches the characteristics of 5G user plane data is filtered out, while user plane data that does not match the characteristics of the 5G user plane interface is filtered out.

3. The 5G traffic filtering method based on a multi-core processing unit according to claim 2, characterized in that, The generation of the first dynamic rule for filtering the voice, message, and media stream traffic includes: Deep protocol parsing is performed on the user plane traffic to identify session control signaling used to establish and manage communication sessions; The session control signaling is parsed to extract the transport layer network address and port information dynamically allocated to the media stream; The first dynamic rule is dynamically generated based on the transport layer network address and port information.

4. The 5G traffic filtering method based on a multi-core processing unit according to claim 1, characterized in that, The dynamic identification of target signaling interface traffic based on application layer protocol characteristics includes: Application layer protocol decoding is performed on signaling plane traffic. By parsing the protocol message structure and content characteristics of the service architecture interface, the target signaling interface traffic related to user plane connection management is identified and separated from the aggregated signaling plane traffic.

5. The 5G traffic filtering method based on a multi-core processing unit according to claim 4, characterized in that, The step of parsing the address and tunnel information of the 5G user plane network element from the target signaling interface traffic to generate a second dynamic rule for identifying the 5G user plane traffic includes: Real-time analysis of signaling interaction processes related to session management on the target signaling interface; From the forwarding rule information contained in the session control message of the signaling interaction process, the user plane network element address and tunnel identification information determined for user plane data forwarding are parsed out; Based on the user plane network element address and tunnel identification information, a whitelist rule is constructed for accurately identifying 5G user plane traffic. This whitelist rule is the second dynamic rule.

6. The 5G traffic filtering method based on a multi-core processing unit according to claim 1, characterized in that, The preliminary screening based on preset filtering rules includes: By analyzing the access network identification information in signaling messages using deep packet inspection technology, and combining it with IP header features and a predefined list of network element addresses, traffic of different access types can be identified and distinguished to achieve pre-classification and filtering of traffic.

7. A 5G traffic filtering system based on a multi-core processing unit, characterized in that, include: The physical interface unit is used to access raw traffic; The switching chip unit, connected to the physical interface unit, is used to copy and perform basic parsing of the raw traffic, and to perform preliminary filtering according to preset filtering rules, distributing the filtered user plane traffic and signaling plane traffic to the multi-core processing unit. A multi-core processing unit, connected to the switching chip unit, is used to perform deep protocol parsing on the received user plane traffic, dynamically identify 5G user plane interface traffic based on the protocol characteristics of the user plane traffic, the 5G user plane interface traffic including voice, message and media stream traffic, and generate a first dynamic rule for filtering the voice, message and media stream traffic. The received signaling plane traffic is subjected to deep protocol parsing. The target signaling interface traffic is dynamically identified based on the application layer protocol characteristics. The address and tunnel information of the 5G user plane network element are parsed from the target signaling interface traffic to generate a second dynamic rule for identifying 5G user plane traffic. The multi-core processing unit sends the first dynamic rule and the second dynamic rule to the switching chip. The switching chip performs final filtering of the traffic according to the first dynamic rule and the second dynamic rule, and outputs the target 5G traffic.

8. The 5G traffic filtering system based on a multi-core processing unit according to claim 7, characterized in that, The multi-core processing unit includes: The first software module is used to process user plane traffic, realize 5G user plane interface traffic identification and session and media traffic filtering; The second software module is used to process signaling plane traffic, realize the identification of target signaling interface traffic and the extraction of user plane network element and tunnel information.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the 5G traffic filtering method based on a multi-core processing unit as described in any one of claims 1-6.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the 5G traffic filtering method based on a multi-core processing unit as described in any one of claims 1-6.

Images