Protocol identification method and device, and storage medium

Abstract

Embodiments of the present disclosure relate to the technical field of communications, and provide a protocol identification method and device, and a storage medium. The method comprises: receiving signaling of a TCP bearer, extracting four-tuple information of the signaling, and performing protocol identification on the signaling according to the four-tuple information; if it cannot be determined whether a protocol corresponding to the signaling is an HTTP / 2 protocol, performing protocol decoding on the signaling; and if the decoding is successful, determining the protocol corresponding to the signaling as the HTTP / 2 protocol.

Description

Protocol identification method, device and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This disclosure is based on Chinese patent application CN202310717720.9, filed on June 15, 2023, entitled “Protocol Identification Method, Device and Storage Medium”, and claims the priority of the patent application, and all the contents disclosed therein are incorporated into this disclosure by reference. Technical Field

[0003] The present disclosure relates to the field of communication technologies, and in particular to a protocol identification method, device, and storage medium. Background Art

[0004] With the advancement of communications technology, the communications industry has ushered in a new era of exploding 4G traffic and accelerating 5G deployment. At the same time, operators are also facing challenges of increased network complexity and construction and operation and maintenance costs. Traditional operating systems are large and complex, and network management is beyond the capacity of manual processing. To assist operators in managing and controlling network data services, signaling monitoring methods are widely used in networks. Through real-time signaling monitoring, key indicators of network data service operation can be identified, enabling early warning, rapid identification and resolution of network risks, and improving user experience.

[0005] Both the 5G Core Network and the 5G New Call Core Network utilize a service-oriented network architecture design, with network functions (NFs) interacting with each other via HTTP / 2 (Hypertext Transfer Protocol Version 2). Monitoring HTTP / 2 signaling in these two networks requires identifying HTTP / 2 signaling.

[0006] In related technologies, HTTP / 2 signaling is typically identified through well-known port identification. Well-known ports 80 or 8080 are reserved for HTTP / 2 signaling. If TCP (Transmission Control Protocol) carries signaling over port 80 or 8080, it can be determined to be HTTP / 2 signaling. However, NFs can be configured to use non-well-known ports for service interaction. Therefore, HTTP / 2 signaling carried by TCP over non-well-known ports cannot be identified.

[0007] In view of this, how to identify whether the signaling carried by TCP belongs to the HTTP / 2 protocol type has become a technical problem that needs to be solved urgently.

[0008] Summary of the Invention

[0009] The main purpose of the embodiments of the present disclosure is to provide a protocol identification method, device and storage medium, aiming to solve the technical problem of how to identify whether the signaling carried by TCP belongs to the HTTP / 2 protocol type.

[0010] An embodiment of the present disclosure provides a protocol identification method, comprising: receiving signaling carried by TCP, extracting four-tuple information of the signaling, and performing protocol identification on the signaling based on the four-tuple information; if the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, performing protocol decoding on the signaling; if the decoding is successful, determining the protocol corresponding to the signaling as the HTTP / 2 protocol.

[0011] An embodiment of the present disclosure also provides a protocol identification device, which includes a processor, a memory, a computer program stored on the memory and executable by the processor, and a data bus configured to implement connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of any one of the protocol identification methods provided in the description of the embodiments of the present disclosure are implemented.

[0012] An embodiment of the present disclosure further provides a storage medium, which is configured as a computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any protocol identification method provided in the description of the embodiment of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0014] FIG1 is a flow chart of a protocol identification method provided by an embodiment of the present disclosure;

[0015] FIG2 is a schematic diagram of a frame structure of the HTTP / 2 protocol involved in the protocol identification method provided in an embodiment of the present disclosure;

[0016] FIG3a is a schematic diagram of a deployment of a protocol identification device involved in the protocol identification method provided in an embodiment of the present disclosure;

[0017] FIG3 b is a schematic diagram of another deployment of a protocol identification device involved in the protocol identification method provided in an embodiment of the present disclosure;

[0018] FIG4a is a schematic diagram of the architecture of a protocol identification device involved in the protocol identification method provided in an embodiment of the present disclosure;

[0019] FIG4 b is a schematic diagram of a flow chart of implementing protocol identification by a protocol identification device in a protocol identification method provided by an embodiment of the present disclosure;

[0020] FIG5 is a schematic diagram of a process of performing protocol decoding on signaling by a HEADER frame decoding module, as involved in a protocol identification method provided by an embodiment of the present disclosure;

[0021] FIG6 is a diagram illustrating an example of an application scenario involved in the protocol identification method provided in an embodiment of the present disclosure;

[0022] FIG7 is a schematic block diagram of the structure of a protocol identification device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] The following will clearly and completely describe the technical solutions in the embodiments of the present disclosure in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present disclosure without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0024] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, combined, or partially merged, so the actual execution order may vary depending on the actual situation.

[0025] It should be understood that the terms used in this disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure. As used in this disclosure and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0026] In the related art, one way to identify signaling carried by TCP through a non-well-known port is that the client sends a message containing a 24-byte Magic string "PRI*HTTP / 2.0\r\n\r\nSM\r\n\r\n" to the server. If the first application layer message collected after the TCP handshake contains this string, then it can be identified that the application layer protocol carried by the current TCP connection is the HTTP / 2 protocol. However, signaling is received at any time. It is possible that the client has already sent the Magic string when receiving the signaling, or the signaling carrying the Magic information is lost on the intermediate transmission device and the Magic string message cannot be collected, resulting in the inability to identify subsequent signaling on the TCP connection.

[0027] Another approach is for signaling monitoring operators to preconfigure the non-well-known port numbers used by each NF for HTTP / 2 and obtain a configuration file. When TCP carries signaling over this non-well-known port, the configuration file is matched. A successful match identifies the signaling as corresponding to the HTTP / 2 protocol. However, this approach has its limitations. It requires obtaining the non-well-known port numbers used by all NFs for HTTP / 2 across the network. Furthermore, when NF configurations change, the signaling monitoring operators must be notified promptly to modify the configuration, which is practically impossible.

[0028] It can be seen that the existing method for identifying signaling carried by TCP through non-well-known ports has low efficiency, comprehensiveness and accuracy.

[0029] To this end, embodiments of the present disclosure provide a protocol identification method, device, and storage medium. This protocol identification method can quickly and preliminarily identify whether the protocol corresponding to the signaling is HTTP / 2 based on the quadruple information of the signaling. If the preliminary identification fails to determine whether the protocol corresponding to the signaling is HTTP / 2, the signaling is further subjected to protocol decoding, and the decoding result is used to ultimately identify whether the protocol corresponding to the signaling is HTTP / 2. Through this method, even signaling carried by TCP via a non-well-known port can be accurately identified, thereby improving the efficiency, comprehensiveness, and accuracy of identification.

[0030] The following embodiments of the present disclosure are described in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features therein may be combined with each other.

[0031] Please refer to FIG. 1 , which is a flow chart of a protocol identification method provided by an embodiment of the present disclosure.

[0032] As shown in FIG1 , the protocol identification method includes steps S101 to S103 .

[0033] Step S101: Receive signaling carried by TCP, extract the four-tuple information of the signaling, and perform protocol identification on the signaling according to the four-tuple information.

[0034] This protocol identification method can be applied to network operation and maintenance scenarios for both the 5G core network and the 5G new call core network. In network operation and maintenance scenarios, the protocol identification method can be implemented by a protocol identification device, which can be a terminal device with data processing capabilities, such as a server.

[0035] When receiving signaling carried by TCP, the signaling monitoring system extracts the signaling's quadruple information and performs protocol identification on the signaling based on the extracted quadruple information, thereby preliminarily and quickly identifying whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0036] In some embodiments, the four-tuple information of the signaling includes a source IP address, a source port number, a destination IP address, and a destination port number.

[0037] In some embodiments, protocol identification of signaling is performed based on quadruple information, which can be by comparing the quadruple information with a pre-stored protocol type database to determine whether there is pre-stored quadruple information matching the quadruple information in the pre-stored protocol type database; if there is pre-stored quadruple information matching the quadruple information in the pre-stored protocol type database, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol; if there is no pre-stored quadruple information matching the quadruple information in the pre-stored protocol type database, it cannot be determined whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0038] In order to simplify the protocol identification process and improve the efficiency of protocol identification, a pre-stored protocol type database can be pre-built. The pre-stored protocol type data stores the four-tuple information (defined as pre-stored four-tuple information) corresponding to the HTTP / 2 signaling carried by TCP through a non-well-known port that has been historically identified. Specifically, since HTTP / 2 is a long connection, signaling with a protocol type of HTTP / 2 can be transmitted multiple times after the connection is established. For a connection established by TCP using a non-well-known port, if a signaling on the connection is identified as belonging to the HTTP / 2 protocol, then subsequent signaling on the connection must also be a signaling with a protocol type of HTTP / 2. Therefore, the four-tuple information corresponding to the HTTP / 2 signaling carried by TCP through a non-well-known port that has been historically identified can be recorded, its application layer protocol type can be marked as HTTP / 2, and then stored to obtain a pre-stored protocol type database.

[0039] In this way, when the signaling monitoring system receives signaling carried by TCP, it can extract the four-tuple information of the signaling, compare the extracted four-tuple information with the pre-stored protocol type database, and then find out whether there is pre-stored four-tuple information in the pre-stored protocol type database that is consistent with the extracted four-tuple information.

[0040] If pre-stored four-tuple information that is consistent with the extracted four-tuple information is found in the pre-stored protocol type database, it is determined that the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0041] If the pre-stored four-tuple information that is consistent with the extracted four-tuple information cannot be found in the pre-stored protocol type database, considering the limitations of the pre-stored protocol type database, it cannot be determined whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, and the protocol identification fails.

[0042] In this way, based on the signaling's quadruple information and the pre-stored protocol type database, it is possible to quickly and preliminarily identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, thereby improving the efficiency of protocol identification.

[0043] Step S102: If the identification fails to determine whether the protocol corresponding to the signaling is HTTP / 2, the signaling is subjected to protocol decoding;

[0044] After performing protocol identification on the signaling based on the quadruple information of the signaling, if it is still not certain whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, in order to improve the accuracy of protocol identification, the signaling is further subjected to protocol decoding.

[0045] In some embodiments, protocol decoding of the signaling may be performed by parsing the protocol characteristics of the signaling to determine whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol; if the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, the decoding is determined to be successful.

[0046] Since RFC7540 defines the HTTP / 2 protocol specification, it is known that the HTTP / 2 protocol has specific characteristics. Therefore, the protocol characteristics of the signaling can be parsed to determine whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol. If the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, the decoding is determined to be successful. If the characteristics of the signaling do not conform to the characteristics of the HTTP / 2 protocol, the decoding is determined to have failed.

[0047] In some embodiments, determining whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol can be performed by decoding the frame structure corresponding to the signaling to determine whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol; if the frame structure conforms to the frame structure of the HTTP / 2 protocol, decoding the header field corresponding to the signaling; if the number of decoded header field fields meets a preset number, determining that the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol.

[0048] The specific features of the HTTP / 2 protocol include that the HTTP / 2 protocol has a specific frame structure (also known as a frame format). Based on RFC7540, it can be seen that the HTTP / 2 protocol is composed of multiple types of frames. Please refer to Figure 2, which is a schematic diagram of the frame structure of the HTTP / 2 protocol. As shown in Figure 2, the frame header length of the HTTP / 2 protocol is 9 (24+8+8+1+31=72bit) bytes; the frame type is indicated by Type (Type). It should be noted that in the application scenario of the embodiment of the invention, the signaling monitoring system processes HEADER frames of Type=1 and DATA frames of Type=0; the frame payload (Frame Payload) length is indicated by the Length field.

[0049] The payload of the HEADER frame is encoded using HPACK, a compression encoding technology for HEADER frames that includes eight encoding methods. The header field of the HEADER frame is encoded using one of these eight encoding methods according to a set of rules. Each encoding method implicitly specifies the encoding type and length.

[0050] Therefore, the frame structure of the signaling can be decoded according to the frame structure of the HTTP / 2 protocol to determine whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol.

[0051] In some embodiments, determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol may be to determine whether the frame header length corresponding to the signaling satisfies a first preset length; if the frame header length satisfies the first preset length, determining whether the type of the frame corresponding to the signaling belongs to the preset frame type; if the type of the frame belongs to the preset frame type, determining whether the payload length of the frame corresponding to the signaling satisfies a second preset length; if the payload length of the frame satisfies the second preset length, determining whether the sum of the frame header length and the frame payload length satisfies a third preset length; if the sum of the frame header length and the frame payload length satisfies the third preset length, determining that the frame structure meets the preset conditions.

[0052] That is, first, according to the HTTP / 2 protocol frame header format, the frame header length corresponding to the signaling is decoded to determine whether the frame header length corresponding to the signaling is greater than or equal to 9 (defined as a first preset length). If the frame header length corresponding to the signaling is less than 9, it is not a complete HTTP / 2 frame header, the protocol decoding of the signaling fails, and it is determined that the protocol corresponding to the signaling is not the HTTP / 2 protocol.

[0053] If the length of the signaling frame header is greater than or equal to 9, the frame type (Type) corresponding to the signaling is decoded to determine whether the frame type corresponding to the signaling is a HEADER frame (defined as a preset frame type). If the frame type corresponding to the signaling is not a HEADER frame (that is, the Type corresponding to the signaling is not equal to 1), it means that the decoding of the signaling HEADER frame has failed, and it is determined that the protocol corresponding to the signaling is not the HTTP / 2 protocol.

[0054] If the frame type corresponding to the signaling is a HEADER frame, it must have a payload, and the frame header Length field must be greater than 0. Therefore, the payload length of the frame corresponding to the signaling is further decoded to determine whether the payload length of the frame corresponding to the signaling is greater than 0 (defined as the second preset length). If the payload length of the frame corresponding to the signaling is 0 (that is, the frame header Length field corresponding to the signaling is 0), it is determined that the frame corresponding to the signaling is not a HEADER frame, indicating that the decoding of the signaling HEADER frame has failed, and it is determined that the protocol corresponding to the signaling is not the HTTP / 2 protocol.

[0055] If the payload length of the signaling frame is greater than 0, the process continues to determine whether the sum of the signaling frame header length and the frame payload length is less than or equal to the TCP Payload length (defined as a third preset length). If the sum of the signaling frame header length and the frame payload length is greater than the TCP Payload length, it indicates that the signaling frame is not a complete HEADER frame, and decoding of the signaling HEADER frame fails, determining that the signaling protocol does not belong to the HTTP / 2 protocol.

[0056] If the sum of the signaling frame header length and the frame payload length is less than or equal to the TCP Payload length, it means that the signaling frame is a complete HEADER frame. It can be preliminarily determined that the signaling HEADER frame is decoded successfully. At this time, it can be determined that the signaling frame structure conforms to the HTTP / 2 protocol frame structure.

[0057] To improve recognition accuracy, the header fields corresponding to the signaling are further decoded using the HPACK encoding method. It should be noted that decoding is reliable only if there are more than three header fields. Therefore, a check is performed to determine whether the number of header fields corresponding to the signaling is greater than three (defined as a preset number). If the number of header fields corresponding to the signaling is greater than three, the HEADER frame decoding of the signaling is ultimately determined to be successful, and the protocol corresponding to the signaling is determined to be HTTP / 2.

[0058] Through the above method, the rigor of signaling decoding is improved, thereby improving the accuracy of protocol identification.

[0059] Step S103: If the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol.

[0060] If the decoding is successful, the protocol corresponding to the signaling is determined to be HTTP / 2. In this way, if the signaling quadruple information cannot be used to identify whether the signaling protocol is HTTP / 2, the protocol decoding of the signaling is further implemented, and finally the decoding determines whether the signaling protocol is HTTP / 2, improving the comprehensiveness and accuracy of the identification.

[0061] In some embodiments, after determining the protocol corresponding to the signaling as the HTTP / 2 protocol, the protocol type of the signaling's quadruple information can also be marked as the HTTP / 2 protocol, and the marked quadruple information can be stored in a pre-stored protocol type database to expand the pre-stored protocol type database and provide convenience for subsequent protocol identification.

[0062] In some embodiments, when decoding fails, it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol, and the signaling is discarded.

[0063] The protocol identification method provided above receives signaling carried by TCP, extracts the four-tuple information of the signaling, and performs protocol identification on the signaling based on the four-tuple information; if the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is protocol decoded; if the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol. The present disclosure can preliminarily and quickly identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol based on the four-tuple information of the signaling. If the preliminary identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, the signaling is further protocol decoded, and the decoding result is finally used to identify whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol. Through the above method, even signaling carried by TCP through a non-well-known port can be accurately identified, thereby improving the efficiency, comprehensiveness and accuracy of identification.

[0064] In some embodiments, in order to facilitate the signaling monitoring system to perform protocol identification, a protocol identification device can be deployed for the signaling monitoring system, thereby realizing protocol identification of the signaling through the protocol identification device. For example, the protocol identification device can be built into the signaling monitoring system, as shown in Figure 3a; the protocol identification device can also be pre-installed in the signaling monitoring system, as shown in Figure 3b. Regardless of the deployment method, the signaling monitoring system must first perform protocol identification on the signaling. Only when it is identified that the protocol corresponding to the signaling belongs to the HTTP / 2 protocol can subsequent XDR synthesis processing be performed.

[0065] In some embodiments, as shown in FIG4a , FIG4a is a schematic diagram of the architecture of a protocol identification device. The protocol identification device may include functional modules such as a protocol identification main module, a data storage module, and a HEADER frame decoding module.

[0066] Please continue to refer to FIG. 4 b , which is a flow chart showing how the signaling monitoring system implements protocol identification through the above-mentioned functional modules of the protocol identification device. Specifically, ① when the signaling monitoring system receives signaling carried by TCP, it first extracts the four-tuple information of the signaling through the protocol identification main module of the protocol identification device; ② then, through the data storage module of the protocol identification device, it queries whether there is pre-stored four-tuple information matching the four-tuple information of the signaling in the pre-stored protocol type database. If the query is successful, the message of successful query is returned to the protocol identification main module, and the protocol identification main module determines the protocol corresponding to the signaling as the HTTP / 2 protocol. If the query fails, the message of failed query is returned to the protocol identification main module; ③ then, through the HEADER frame decoding module of the protocol identification device, the signaling is decoded according to the format of the HTTP / 2 HEADER frame; ④ the decoding result is returned to the protocol identification main module; ⑤ when the protocol identification main module confirms that the decoding is successful, the data storage module marks the protocol type of the four-tuple information of the signaling as the HTTP / 2 protocol, and stores the marked four-tuple information in the pre-stored protocol type database; ⑥ the protocol identification main module determines the protocol corresponding to the signaling as the HTTP / 2 protocol.

[0067] In this way, the signaling monitoring system performs preliminary protocol identification on the signaling carried by TCP through the above-mentioned functional module of the protocol identification device, and if the preliminary identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, it performs further protocol decoding on the signaling, and finally determines whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol through the decoding, thereby achieving efficient, comprehensive and accurate identification of the signaling.

[0068] In some embodiments, please refer to FIG. 5 , which is a schematic diagram of a process of performing protocol decoding on signaling by a HEADER frame decoding module. Specifically, first decode the frame header length corresponding to the signaling, and determine whether the frame header length corresponding to the signaling is greater than or equal to 9. If the frame header length corresponding to the signaling is less than 9, the HEADER frame decoding fails; if the frame header length corresponding to the signaling is greater than or equal to 9, then decode the frame type corresponding to the signaling, and determine whether the frame type corresponding to the signaling is a HEADER frame. If the frame type corresponding to the signaling is not a HEADER frame, the HEADER frame decoding fails; if the frame type corresponding to the signaling is a HEADER frame, then decode the payload length of the frame corresponding to the signaling, and determine whether the payload length of the frame corresponding to the signaling is greater than 0. If the payload length of the frame corresponding to the signaling is 0, the HEADER frame decoding fails; if the payload length of the frame corresponding to the signaling is greater than 0, continue to determine whether the sum of the frame header length corresponding to the signaling and the payload length of the frame is less than or equal to the length of the TCP Payload. If the sum of the frame header length corresponding to the signaling and the payload length of the frame is greater than the length of the TCP Payload, the HEADER frame decoding fails; if the sum of the frame header length corresponding to the signaling and the payload length of the frame is less than or equal to the TCP Payload The payload length is further analyzed, and the corresponding header fields of the signaling are decoded according to the HPACK encoding method. If more than three header fields are decoded, the HEADER frame decoding is successful, and it can be determined that the protocol corresponding to the signaling is HTTP / 2. This method improves the rigor and accuracy of protocol decoding, thereby improving the accuracy of signaling recognition.

[0069] To better understand the above embodiment, please refer to FIG6 , which is an example diagram of an application scenario of protocol identification. The example application scenario is as follows:

[0070] In the network operation and maintenance scenarios of the 5G core network and the 5G new call core network, when the signaling monitoring system receives signaling carried by TCP, it first performs well-known port identification to determine whether the signaling is signaling carried by TCP through the well-known port 80 or 8080. If not, it means that the signaling is signaling carried by TCP through a non-well-known port; then it extracts the four-tuple information of the signaling and queries the pre-stored protocol type database whether there is pre-stored four-tuple information matching the four-tuple information of the signaling. If the query is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol. If the query fails, the signaling is then decoded. If the decoding is successful, the protocol corresponding to the signaling is finally determined to be the HTTP / 2 protocol, thereby achieving accurate identification of signaling carried by non-well-known ports and improving the efficiency, comprehensiveness and accuracy of identification.

[0071] Please refer to FIG. 7 , which is a schematic block diagram of the structure of a protocol identification device provided by an embodiment of the present disclosure.

[0072] As shown in FIG7 , the protocol identification device 300 includes a processor 301 and a memory 302 . The processor 301 and the memory 302 are connected via a bus 303 , such as an I 2 C (Inter-Integrated Circuit) bus.

[0073] Specifically, the processor 301 is configured to provide computing and control capabilities to support the operation of the entire protocol identification device. The processor 301 can be a central processing unit (CPU), and the processor 301 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0074] Specifically, the memory 302 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0075] Those skilled in the art will understand that the structure shown in FIG7 is merely a block diagram of a partial structure related to the embodiment of the present disclosure, and does not constitute a limitation on the protocol identification device to which the embodiment of the present disclosure is applied. The specific server may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0076] The processor is configured to run a computer program stored in a memory, and implement any one of the protocol identification methods provided in the embodiments of the present disclosure when executing the computer program.

[0077] In one embodiment, the processor is configured to run a computer program stored in the memory, and to perform the following steps when executing the computer program:

[0078] Receive signaling carried by TCP, extract quadruple information of the signaling, and perform protocol identification on the signaling according to the quadruple information;

[0079] If the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, performing protocol decoding on the signaling;

[0080] If the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol.

[0081] In one embodiment, when implementing the performing protocol identification on the signaling according to the quadruple information, the processor is configured to implement:

[0082] Comparing the four-tuple information with a pre-stored protocol type database to determine whether there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database;

[0083] If there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, determining the protocol corresponding to the signaling as the HTTP / 2 protocol;

[0084] If there is no pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, it is not possible to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

[0085] In one embodiment, when implementing the protocol decoding of the signaling, the processor is configured to implement:

[0086] Analyze the protocol characteristics of the signaling and determine whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol;

[0087] If the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, it is determined that the decoding is successful.

[0088] In one embodiment, when parsing the protocol features of the signaling and determining whether the protocol features of the signaling conform to features of the HTTP / 2 protocol, the processor is configured to implement:

[0089] Decoding the frame structure corresponding to the signaling to determine whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol;

[0090] If the frame structure conforms to the frame structure of the HTTP / 2 protocol, decoding the header field corresponding to the signaling;

[0091] If the number of decoded header fields meets the preset number, it is determined that the protocol characteristics of the signaling meet the characteristics of the HTTP / 2 protocol.

[0092] In one embodiment, when implementing the determining whether the frame structure corresponding to the signaling complies with the frame structure of the HTTP / 2 protocol, the processor is further configured to implement:

[0093] Determining whether the frame header length corresponding to the signaling meets a first preset length;

[0094] If the frame header length meets the first preset length, determining whether the type of the frame corresponding to the signaling belongs to the preset frame type;

[0095] If the frame type belongs to the preset frame type, determining whether the payload length of the frame corresponding to the signaling meets a second preset length;

[0096] If the payload length of the frame satisfies a second preset length, determining whether the sum of the frame header length and the payload length of the frame satisfies a third preset length;

[0097] If the sum of the frame header length and the frame payload length meets a third preset length, it is determined that the frame structure complies with the frame structure of the HTTP / 2 protocol.

[0098] In one embodiment, after determining that the protocol corresponding to the signaling is the HTTP / 2 protocol when the decoding is successful, the processor is further configured to implement:

[0099] The protocol type of the four-tuple information is marked as HTTP / 2 protocol, and the marked four-tuple information is stored in the pre-stored protocol type database.

[0100] In one embodiment, after implementing the protocol decoding of the signaling, the processor is further configured to implement:

[0101] In the case of a decoding failure, it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol, and the signaling is discarded.

[0102] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the protocol identification device described above can refer to the corresponding process in the aforementioned protocol identification method embodiment, and will not be repeated here.

[0103] An embodiment of the present disclosure also provides a storage medium, which is configured as a computer-readable storage medium, and the storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of any protocol identification method provided in the description of the embodiment of the present disclosure.

[0104] The storage medium may be an internal storage unit of the protocol identification device described in the aforementioned embodiment, such as a hard disk or memory of the protocol identification device. The storage medium may also be an external storage device of the protocol identification device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the protocol identification device.

[0105] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As is well known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable, and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media generally embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0106] It should be understood that the term "and / or" as used in this disclosure and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system that includes a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements that are inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system that includes the element.

[0107] The serial numbers of the embodiments of the present disclosure are for description only and do not represent the advantages or disadvantages of the embodiments. The above description is only a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present disclosure, and these modifications or replacements should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A protocol identification method, include: Receive signaling carried by TCP, extract quadruple information of the signaling, and perform protocol identification on the signaling according to the quadruple information; If the identification fails to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol, performing protocol decoding on the signaling; When the decoding is successful, the protocol corresponding to the signaling is determined to be the HTTP / 2 protocol.

2. The protocol identification method according to claim 1, in, The performing protocol identification on the signaling according to the four-tuple information includes: Compare the four-tuple information with a pre-stored protocol type database to determine whether there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database; If there is pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, determining the protocol corresponding to the signaling as the HTTP / 2 protocol; If there is no pre-stored four-tuple information matching the four-tuple information in the pre-stored protocol type database, it is not possible to determine whether the protocol corresponding to the signaling belongs to the HTTP / 2 protocol.

3. The protocol identification method according to claim 1, in, The performing protocol decoding on the signaling includes: Parsing the protocol characteristics of the signaling, and determining whether the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol; If the protocol characteristics of the signaling conform to the characteristics of the HTTP / 2 protocol, it is determined that the decoding is successful.

4. The protocol identification method according to claim 3, in, The parsing of the protocol features of the signaling to determine whether the protocol features of the signaling conform to features of the HTTP / 2 protocol includes: Decoding the frame structure corresponding to the signaling, and determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol; If the frame structure conforms to the frame structure of the HTTP / 2 protocol, decoding the header field corresponding to the signaling; If the number of decoded header field fields meets the preset number, it is determined that the protocol characteristics of the signaling meet the characteristics of the HTTP / 2 protocol.

5. The protocol identification method according to claim 4, in, The determining whether the frame structure corresponding to the signaling conforms to the frame structure of the HTTP / 2 protocol includes: Determining whether the frame header length corresponding to the signaling meets a first preset length; If the frame header length satisfies a first preset length, determining whether the type of the frame corresponding to the signaling belongs to a preset frame type; If the type of the frame belongs to the preset frame type, determining whether the payload length of the frame corresponding to the signaling satisfies a second preset length; If the payload length of the frame satisfies the second preset length, determining whether the sum of the frame header length and the payload length of the frame satisfies the third preset length; If the sum of the frame header length and the frame payload length meets a third preset length, it is determined that the frame structure complies with the frame structure of the HTTP / 2 protocol.

6. The protocol identification method according to claim 2, in, In the case where the decoding is successful, after determining that the protocol corresponding to the signaling is the HTTP / 2 protocol, the method includes: The protocol type of the four-tuple information is marked as HTTP / 2 protocol, and the marked four-tuple information is stored in The pre-stored protocol type database.

7. The protocol identification method according to claim 1, in, The four-tuple information includes a source IP address, a source port number, a destination IP address and a destination port number.

8. The protocol identification method according to claim 1, in, After the signaling is subjected to protocol decoding, the method further comprises: In the case where the decoding fails, it is determined that the protocol corresponding to the signaling does not belong to the HTTP / 2 protocol, and the signaling is discarded.

9. A protocol identification device, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus configured to implement a connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of the protocol identification method as described in any one of claims 1 to 8 are implemented.

10. A storage medium, configured as a computer-readable storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the protocol identification method described in any one of claims 1 to 8.

Images