Service action recognition method

Abstract

Provided in the embodiments of the present application is a service action recognition method. The method comprises: acquiring a data stream in traffic of a service action to be recognized, and extracting from the data stream a stream feature of the service action to be recognized; on the basis of the stream feature of the service action to be recognized and a preset mapping relationship, generating a feature symbol sequence of the service action to be recognized, wherein the preset mapping relationship is a mapping relationship between a stream feature of a target service action and a feature symbol of the target service action; and when a feature symbol in the feature symbol sequence matches a feature symbol of the target service action, determining as the target service action the service action to be recognized.

Description

Business action identification method CROSS-REFERENCE TO RELATED APPLICATIONS The present disclosure is based on and claims the priority of Chinese patent application No. 202410133913.4 filed on January 30, 2024, and all the disclosed contents are incorporated into the present disclosure by reference. Technical Field The embodiments of the present application relate to the field of communications, and in particular, to a method for identifying business actions. Background Art In recent years, with the continuous development of mobile Internet, the traffic composition of mobile application apps has become increasingly complex, making it increasingly difficult for network devices to accurately identify app user business actions and analyze user behavior intentions by detecting app network traffic. For example, the speed of an app's first screen opening often affects the user experience. Network equipment aims to detect this opening through DPI (Deep Packet Inspection), analyze the corresponding traffic metrics, and thus measure the user's online experience and trigger further network optimization strategies. However, the traffic composition of an app's first screen opening is often very complex, and existing DPI methods cannot accurately identify this service action. Summary of the Invention The embodiments of the present application provide a method for identifying business actions to at least solve the problem that the DPI method in the related art cannot accurately identify business actions in the APP. According to one embodiment of the present application, a method for identifying a service action is provided, comprising: Obtain the data flow in the traffic of the business action to be identified, and extract the flow characteristics of the business action to be identified from the flow; generate a characteristic symbol sequence of the business action to be identified based on the flow characteristics of the business action to be identified and a preset mapping relationship; wherein the preset mapping relationship is a mapping relationship between the flow characteristics of the target business action and the characteristic symbols of the target business action; when the characteristic symbols in the characteristic symbol sequence match the characteristic symbols of the target business action, determine that the business action to be identified is the target business action. According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps of any of the above method embodiments when running. According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments. BRIEF DESCRIPTION OF THE DRAWINGS FIG1 is a hardware structure block diagram of a mobile terminal for a method for identifying a service action according to an embodiment of the present application; FIG2 is an architecture diagram of a network traffic user intention detection system according to an embodiment of the present application; FIG3 is a flow chart of a method for identifying a business action according to an embodiment of the present application; FIG4 is a schematic diagram of a five-tuple flow representation according to an embodiment of the present application; FIG5 is a schematic diagram of a character characteristic symbol mapping form according to an embodiment of the present application; FIG6 is a schematic diagram of a double-character characteristic symbol in a characteristic symbol mapping table according to an embodiment of the present application; FIG7 is a flow detection process diagram according to an embodiment of the present application; FIG8 is a schematic diagram of feature matching in the flow detection phase according to an embodiment of the present application; FIG9 is a user representation diagram according to an embodiment of the present application; FIG10 is a schematic diagram of reporting an identification result message according to an embodiment of the present application; FIG11 is a schematic diagram of a feature training process according to an embodiment of the present application; FIG12 is a schematic diagram of adjacent compression of a characteristic symbol sequence according to an embodiment of the present application; FIG13 is a schematic diagram of obtaining the longest common characteristic symbol subsequence according to an embodiment of the present application; FIG14 is a schematic diagram of a multi-sequence LCS algorithm according to an embodiment of the present application; FIG15 is a schematic diagram of obtaining characteristic symbols of the start class, the end class, and the existence class according to an embodiment of the present application; FIG16 is a schematic diagram of obtaining a characteristic symbol of a class according to an embodiment of the present application. DETAILED DESCRIPTION The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments. It should be noted that the terms "first", "second", etc. in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. The embodiment of the present invention is explained by taking the first screen opening action of the APP as an example. When a user opens the App on the device, the App will not only connect to various servers of its manufacturer, but also call a variety of public API cloud services (such as: risk control services, domain name query services, mobile advertising services, log services, etc.) to connect to the corresponding API server; its traffic composition is very complex, and it often generates hundreds of TCP connections to HTTP / HTTPS servers with dozens of different domain names. However, the usual DPI detection method will independently identify the APP connection traffic and the connection traffic of each API cloud service, which makes it impossible to accurately identify the first screen opening action of the App, and it is impossible to attribute the traffic of each API cloud service to the first screen opening action of the App. Based on the above-mentioned technical problems, the embodiment of the present application proposes a method for identifying business actions, the technical concept of which is to convert the data flow in the traffic of the business action to be identified into corresponding characteristic symbols, match the characteristic symbols of the business to be identified with the characteristic symbols of the target business action in the characteristic file, and determine that the business action to be identified is the target business action when there is a match. It can not only accurately detect whether the business action to be identified that represents the user's intended behavior is the target business action, but also accurately attribute complex traffic such as access to public App cloud services in the target business action to the corresponding business action. This makes the network device's assessment of the user's Internet experience more accurate and can provide a reasonable basis for network optimization functions. The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 is a hardware structure block diagram of a mobile terminal of a method for identifying a business action in an embodiment of the present application. As shown in Figure 1, the mobile terminal may include one or more (only one is shown in Figure 1) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned mobile terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that the structure shown in Figure 1 is only for illustration and does not limit the structure of the above-mentioned mobile terminal. For example, the mobile terminal may also include more or fewer components than those shown in Figure 1, or have a configuration different from that shown in Figure 1. The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for identifying business actions in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof. The transmission device 106 is used to receive or send data via a network. A specific example of the aforementioned network may include a wireless network provided by the mobile terminal's communications provider. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly. FIG2 is a diagram of the network traffic user intention detection system architecture according to an embodiment of the present application. The embodiment of the present application can be run on the system architecture shown in FIG2 . As shown in FIG2 , the system architecture includes: a feature training module and a traffic detection module, wherein: The feature training module can be used to sample the target business action traffic, extract the flow features of the data flow in the target business action traffic, assign a unique feature symbol to each flow feature, and establish a feature symbol mapping table; sample the target business action traffic multiple times, and generate multiple feature symbol sequences corresponding to the target business action traffic based on the feature symbol mapping table, extract common feature symbols from multiple feature symbol sequences, and use them as identification feature symbols and attribution feature symbols of the target business action respectively. Among them, identification-type characteristic symbols and attribution-type characteristic symbols are used to complete the identification of business actions, improve identification accuracy, and attribute related traffic such as API cloud services to corresponding business actions. The traffic detection module can be used to extract the flow characteristics of the data flow in the traffic of the business action to be identified, and generate a feature symbol sequence of the business action to be identified based on the feature symbol mapping table, and match the feature symbols in the feature symbol sequence of the business action to be identified with the identification feature symbols and the attribution feature symbols of the target business action respectively. On the one hand, it identifies the occurrence of the target business action, and on the other hand, it attributes the relevant business action traffic to be identified to the target business action, thereby realizing accurate identification of business actions and traffic. It should be noted that the aforementioned network traffic user intent detection system can be used as a standalone DPI device or as a built-in DPI component of wireless network equipment, and is applicable to detecting complex network traffic user intent behavior and business actions. The aforementioned network traffic user intent detection system can detect user business action traffic in a serial or online manner, or in a parallel or bypass manner. In this embodiment, a method for identifying a service action running on the above-mentioned mobile terminal or network architecture is provided. FIG3 is a flow chart of a method for identifying a service action according to an embodiment of the present application. As shown in FIG3 , the process includes the following steps: Step S301: Acquire a data flow in the traffic of a service action to be identified, and extract flow features of the service action to be identified from the data flow. In an embodiment of the present application, during the business action traffic detection phase, the user business actions of the App can be accurately identified by detecting the network traffic of the App to analyze the user behavior intention. As an example, the traffic of the business action to be identified generated by the user using the APP can be obtained, and the corresponding flow features can be extracted from the data flow in the traffic of the business action to be identified. In an exemplary embodiment, step S301 may specifically include: A corresponding five-tuple flow table is established for the flow in the traffic of the business action to be identified; the data flow includes at least one request message; based on the five-tuple flow table, the flow characteristics of the business action to be identified are extracted, and the flow characteristics are the server domain name carried in the first request message of the data flow. As an example, the traffic of each user's business action may include multiple data streams, and the types of data streams may be one or more. For example, the types of data streams may include Hypertext Transfer Protocol (HTTP) stream, Hypertext Transfer Protocol Secure (HTTPS) stream, Quick UDP Internet Connection (QUIC) stream, etc., where UDP is the User Datagram Protocol. As an example, after obtaining the user's service action traffic to be identified, a five-tuple flow table may be established for the data flow in the service action traffic to be identified. As an example, each data stream may include one or more request messages, each request message may carry a server domain name, and the stream feature may be the server domain name carried in the first request message of the data stream. As an example, based on the five-tuple flow table, the server domain name carried in the first request message of each data flow can be extracted according to the chronological order of the appearance of the data flows in the business action traffic to be identified. The server domain name carried in the first request message of the extracted data flow is the flow feature. For example, based on the established five-tuple flow table, the host name Host of the first HTTP request message can be extracted for each HTTP flow, and the server name indication (Server Name Indication, SNI) of the first client hello ClientHello message can be extracted for each HTTPS / QUIC flow. Host / SNI is the flow feature. The following further illustrates the process of establishing a five-tuple flow table and extracting flow features in the embodiment of the present application through several examples: Example 1 The process of establishing a five-tuple flow table: Figure 4 is a schematic diagram of a five-tuple flow table according to an embodiment of the present application. As shown in Figure 4, in order to implement data flow-based processing, a flow table in the form of a key-value memory data table can be established, and a flow context can be assigned to each data flow. The key in the flow table can be a five-tuple that uniquely identifies a data flow: user IP address + user port number + network IP address + network port number + TCP / UDP protocol number. Packets that match a five-tuple can be assigned to the corresponding flow context. Among them, the "value" in the flow table is a data structure that stores the processing status information of the data flow. The processing status information of the data flow may include: flow type (for example, HTTP flow, HTTPS flow, QUIC flow, etc.), whether the Host / SNI has been extracted, the characteristic symbol mapped by the Host / SNI, the update timestamp, the cumulative number of packets, the cumulative number of bytes, and other information. Example 2 The process of extracting flow features of HTTP flow: When extracting the Host feature of the first request of the HTTP flow, you can first identify the data flow in the business action traffic to determine whether it is an HTTP flow. If it is an HTTP flow, you can further identify the request message of the HTTP flow. The specific process can be as follows: 1) Identify the data flow in the business action traffic; For example, if the first uplink message containing a TCP payload in a Transmission Control Protocol (TCP) flow in the service action traffic contains a message that matches the regular expression "^(GET|POST).+?\sHTTP / 1\.

[0001] \r\n” payload content, the stream can be identified as an HTTP stream. 2) Identify the request message in the HTTP stream; For example, if the TCP payload of an upstream message of an HTTP flow meets the regular expression “^(GET|POST).+?\sHTTP / 1\.

[0001] \r\n”, it can be determined that the message is a request message. 3) Get the first request message of the HTTP stream; For example, the value of "whether Host / SNI has been extracted" in the flow context in the five-tuple flow table can be used to determine whether the HTTP flow has extracted the Host in the first request; if it has been extracted, the HTTP flow will no longer be extracted; if it has not been extracted, the HTTP flow can be extracted again. 4) Extract the Host value from the first request message of an HTTP stream; For example, the HTTP header (i.e., message header) of the HTTP request message can be decoded, and content that matches the regular expression "Host:\s?(.+)\r\n" can be found in the decoded message header. The content that matches the regular expression "(.+)" is captured, and the captured content is used as the Host value. Example 3 The process of extracting flow features of HTTPS flow: When extracting the SNI feature of the first ClientHello message of an HTTPS flow, you can first identify the flow in the business action traffic to determine whether it is an HTTPS flow. If it is an HTTPS flow, you can further identify the request message of the HTTPS flow. The specific process can be as follows: 1) Identify flows in business action traffic; For example, if the first uplink packet containing a TCP payload in a TCP flow in service action traffic meets the basic decoding conditions of the ClientHello message of the TLS 1.0 / TLS 1.1 / TLS 1.2 / TLS 1.3 protocol, the flow can be identified as an HTTPS flow. 2) Identify the ClientHello message in the HTTPS flow; For example, the first uplink packet containing a TCP payload of an identified HTTPS flow may be used as a ClientHello message. 3) Get the first ClientHello message of the HTTPS stream; For example, the flow context "Have you extracted Host / SNI?" value in the five-tuple flow table can be used to determine whether the HTTPS flow has extracted the SNI in the first ClientHello request. If it has, the HTTPS flow will no longer be extracted. If it has not, the HTTPS flow can be extracted again. 4) Get the SNI value from the first ClientHello message of an HTTPS flow; For example, the first ClientHello message of an HTTPS stream can be decoded according to the TLS1.0 / TLS1.1 / TLS1.2 / TLS1.3 protocol to obtain the TLS Server Name Indication extension field content as the SNI value. Example 4 The process of extracting stream features of QUIC stream: When extracting the SNI feature of the first ClientHello message of a QUIC stream, we can first identify the stream in the service action traffic to determine whether it is a QUIC stream. If it is a QUIC stream, we can further identify the request message of the QUIC stream. The specific process can be as follows: 1) Identify flows in business action traffic; For example, if the first uplink message containing a UDP payload in a UDP stream in the service action traffic meets the basic decoding conditions of the QUIC protocol's Initial type message or Zero Round Trip Time (0-RTT) type message, the stream can be identified as a QUIC stream. For a stream identified as QUIC, the stream type in the stream context can be updated to QUIC in the five-tuple table. 2) Identify the ClientHello message in the QUIC stream; For example, the first uplink message of a QUIC stream containing an Initial type encrypted Crypto frame with a UDP payload can be used as a ClientHello message. 3) Get the first ClientHello message of the QUIC stream; For example, the value of "Host / SNI has been extracted" in the flow context in the five-tuple flow table can be used to determine whether the SNI in the first ClientHello request has been extracted from the QUIC stream; if it has been extracted, the QUIC stream will no longer be extracted; if it has not been extracted, the QUIC stream can be extracted again. 4) Get the SNI value from the first ClientHello message of a QUIC stream; For example, you can decode the QUIC header according to the QUIC protocol, decrypt the Initial type QUIC message according to the QUIC protocol, reassemble the Crypto frame according to the QUIC protocol, and then decode it according to the TLS1.3 protocol to obtain the TLS Sever Name Indication extension field content as the SNI value. Step S303: Generate a characteristic symbol sequence of the service action to be identified according to the flow characteristics of the service action to be identified and the mapping relationship; wherein the preset mapping relationship is a mapping relationship between the flow characteristics of the target service action and the characteristic symbols of the target service action. As an example, a feature file of a pre-set business action traffic can be obtained. The feature file may include a mapping relationship between flow features and feature symbols, feature information of one or more target business actions, and the feature information of each target business action may include the target business action name or number, the feature symbol of the target business action, and so on. As an example, a corresponding characteristic symbol can be pre-assigned to each flow feature. The characteristic symbol can include printable characters or unprintable characters; the number of characteristic symbols can be a single character or a combination of multiple characters. The embodiment of the present invention does not limit the form or type of the characteristic symbol. For example, Figure 5 is a schematic diagram of the character feature symbols in the feature symbol mapping form according to an embodiment of the present application. As shown in Figure 5, Figure 5 shows the feature symbol mapping of more than 30 different Host / SNI stream features generated during the opening of the XXApp first screen. Each Host / SNI stream feature can correspond to a unique single-character feature symbol. Figure 6 is a schematic diagram of a double-character feature symbol in a feature symbol mapping table according to an embodiment of the present application. As shown in Figure 6, a double-character combination of printable characters "A-Za-z0-9" can be selected as a feature symbol set, such as "AA, AB, AC,,,, X0, X1,,,,", which can express a total of 62*62=3844 different Host / SNI original features. Using a double-character combination as a feature symbol set can support more business actions than single-character feature symbols. Figure 6 shows the feature symbol mapping of more than 30 different lightweight Host / SNI generated during the opening of the first screen of XXApp, using double-character feature symbols. Alternatively, a three-character combination of "A-Za-z0-9" may be used as the feature symbol set, for example, including "AAA, AAB, AAC, ...," which can express a total of 62*62*62=238328 different Host / SNI features. In an exemplary embodiment, the characteristic symbol of the target business action includes an identification-type characteristic symbol; the identification-type characteristic symbol includes at least one of the following characteristic symbols: a starting-type characteristic symbol set, a longest common characteristic symbol subsequence, an existence-type characteristic symbol set, and an ending-type characteristic symbol set. As an example, the starting class feature symbol set can be used to indicate the start of the target business action; the longest common feature symbol subsequence can be used to accurately identify the target business action; the existence class feature symbol set can be used to enhance the accuracy of identifying the target business action; and the termination class feature symbol set can be used to indicate the completion of the target business action. As an example, a characteristic symbol sequence of the service action to be identified may be generated according to the flow characteristics of the service action to be identified and the mapping relationship between the flow characteristics and the characteristic symbols. In an exemplary embodiment, step S303 may specifically include: Step S3031, generating a header feature symbol sequence of the flow features according to the time sequence of occurrence of the flow features of the service action to be identified and the mapping relationship; Step S3032, traversing the characteristic symbols of the target service action, and matching the header characteristic symbol sequence with the characteristic symbol of the target service action; Step S3033: generating a feature symbol sequence for the service action to be identified when the identification feature symbol includes the starting feature symbol set and the feature symbol of the header feature symbol sequence matches at least one starting feature symbol in the starting feature symbol set. As an example, the first-appearing flow feature can be determined based on the five-tuple flow table of the business action traffic to be identified, and the header feature symbol sequence of the business action to be identified can be generated based on the first-appearing flow feature, the mapping relationship between the flow feature and the feature symbol. As an example, the characteristic symbols of the target business action in the characteristic file can be traversed, and the characteristic symbols in the head characteristic symbol sequence of the business action to be identified can be matched with the characteristic symbols of the target business action. When the identification class characteristic symbols include a starting class characteristic symbol set, and the characteristic symbols in the head characteristic symbol sequence match at least one starting class characteristic symbol in the starting class characteristic symbol set, the characteristic symbol sequence after the head characteristic symbol sequence of the business action to be identified can be continued to be generated. In an exemplary embodiment, step S3033 may include: The state of the service action to be identified is marked as the starting state of the target service action; and a characteristic symbol sequence of the service action to be identified is generated in the starting state. In an exemplary embodiment, the method further includes: Get the maximum duration of the target business action; When the duration of generating the characteristic symbol sequence of the service action to be identified reaches the maximum duration of the target service action, the generation of the characteristic symbol sequence of the service action to be identified is stopped. As an example, when the characteristic symbol in the header characteristic symbol sequence matches at least one starting-class characteristic symbol in the starting-class characteristic symbol set, the service action state to be identified can be marked as the starting state of the target service action. As an example, the feature file may also include the maximum duration of the target business action, which may be obtained, and the generation may be stopped when the duration of the feature symbol sequence for the business action to be identified reaches the maximum duration of the target business action. As an example, when the state of the business action to be identified is the starting state of the target business action, the characteristic symbol sequence following the head characteristic symbol sequence of the business action to be identified can continue to be generated, and the generation time can be stopped when the generated time reaches the maximum duration of the target business action. Step S304: When the characteristic symbol in the characteristic symbol sequence matches the characteristic symbol of the target service action, determine that the service action to be identified is the target service action. As an example, the characteristic symbols in the characteristic symbol sequence of the business action to be identified can be matched with the characteristic symbols of the target business action. When the characteristic symbols in the characteristic symbol sequence of the business action to be identified match the characteristic symbols of the target business action, the business action to be identified is determined to be the target business action. As an example, the target business action may be a user business action of an App, such as an action of opening the first screen of an App. In an exemplary embodiment, step S304 may include: Step S3041, determining whether the characteristic symbols in the characteristic symbol sequence match the longest common characteristic symbol subsequence; Step S3042: When the characteristic symbol in the characteristic symbol sequence matches the longest common characteristic symbol subsequence, the service action to be identified is determined to be a target service action, and the identification accuracy is determined to be a first accuracy. As an example, if the longest common characteristic symbol subsequence of the target business action exists in the characteristic symbol sequence of the business action to be identified, it can be determined that the business action identification is successful, and the business action to be identified that the user is currently performing is the target business action, and it can be confirmed that the recognition accuracy at this time is average. As an example, if the characteristic symbol sequence of the service action to be identified does not match the longest common characteristic symbol subsequence of the target service action within the maximum duration of the target service action, it can be determined that the service action identification has failed. In an exemplary embodiment, after step S3042, the following steps may also be included: Determine whether the characteristic symbols in the characteristic symbol sequence include all existence-class characteristic symbols in the existence-class characteristic symbol set; when the characteristic symbols in the characteristic symbol sequence include all existence-class characteristic symbols in the existence-class characteristic symbol set, determine that the recognition accuracy of the business action to be identified as the target business action is the second accuracy, wherein the second accuracy is higher than the first accuracy. As an example, after identifying that the characteristic symbol sequence of the business action to be identified contains the longest common characteristic symbol subsequence of the target business action, it is possible to continue to identify whether the characteristic symbol sequence of the business action to be identified contains all the existence-class characteristic symbols of the target business action. If it contains all the existence-class characteristic symbols of the target business action, it can be considered that the recognition accuracy of identifying the business action to be identified as the target business action is the second accuracy, and the second accuracy is higher than the first accuracy. By matching the existence-class characteristic symbols, the recognition accuracy of identifying the to-be-recognized business action as the target business action can be improved. It should be noted that the first accuracy and second accuracy in the embodiments of the present application are evaluations of the recognition results. They can be expressed as specific numerical values, for example, the first accuracy is 60% and the second accuracy is 90%; they can also be expressed as recognition levels, for example, the first accuracy is fair and the second accuracy is high; the first accuracy is medium and the second accuracy is excellent, etc.; they can also be expressed by thresholds, for example, the first accuracy is less than or equal to a preset accuracy threshold and the second accuracy is greater than the preset accuracy threshold, etc. The embodiments of the present application do not limit the evaluation method of the recognition results. In an exemplary embodiment, the characteristic symbol of the target service action further includes a characteristic symbol of the attribution category; after step S304, the following may also be included: Step S305, matching the characteristic symbols in the characteristic sequence with the attribution characteristic symbols; Step S306: When the characteristic symbol matches the attribution characteristic symbol, determine that the data flow corresponding to the characteristic symbol is the data flow in the target service action traffic. As an example, the attribution characteristic symbol set can be used to accurately attribute flows in traffic to target service actions. As an example, when the characteristic symbol in the characteristic sequence of the business action to be identified matches the attribution characteristic symbol, it can be determined that the data flow corresponding to the characteristic symbol belongs to the data flow in the target business action traffic, thereby achieving accurate identification of the traffic. The following uses several examples to further illustrate the traffic detection process and feature symbol matching process in the service action recognition process during the service action traffic detection phase: Example 5 Traffic detection process: FIG7 is a schematic diagram of a flow detection process according to an embodiment of the present application. As shown in FIG7 , the flow detection process may specifically include the following steps: Step 1: Load the signature file. The feature files obtained during the training phase can be loaded into the system memory. Step 2: Obtain stream-level Host / SNI features. The system performs user-based detection and can establish a five-tuple flow table for each user's Internet traffic. It can extract the Host of the first HTTP request message for each HTTP flow and the SNI of the first ClientHello message for each HTTPS / QUIC flow. Step 3: Get the characteristic symbol. The system maps Host / SNI to a characteristic symbol based on the characteristic symbol mapping table. Step 4: Get the characteristic symbol sequence. The characteristic information of each business action in the characteristic file can be traversed. If the characteristic symbol of the business action to be identified exists in the starting class characteristic symbol set of a business action in the characteristic file, the business action of the user is marked as the starting state, and the subsequent characteristic symbols of the user can be recorded in sequence until the business action is identified or the maximum duration of the business action is reached, thereby obtaining the characteristic symbol sequence of the user's business action. Step 5: Matching the longest common characteristic symbol subsequence: If the longest common characteristic symbol subsequence of the service action to be identified is found within the corresponding characteristic symbol sequence of the user, the service action is considered successfully identified, indicating that the user is currently performing the target service action, and the recognition accuracy is considered fair. If the longest common characteristic symbol subsequence of the service action is not matched within the maximum duration of the service action, the service action is considered unsuccessful and subsequent steps are not continued. Step 6: Matching presence features: If the identification is successful and the corresponding feature symbol sequence of the user contains all the symbols in the presence feature symbol set of the service action, the identification accuracy is considered high. Step 7: Matching Termination Features: If the system detects successful recognition and the characteristic symbol in the user's corresponding characteristic symbol sequence is present in the termination characteristic symbol set for the service action, the service action is considered recognized. If the system does not match the termination characteristic symbol for the service action within the maximum duration of the service action, the service action is considered recognized as a failure and the subsequent steps are not continued. Step 8: Matching the attribution signature and reporting the identification results: If the system detects that the identification is complete, it can classify the traffic with the attribution signature symbol into the service action and mark the flow record of the relevant traffic with the name or number of the service action. The identification results can be summarized and reported to the external system via messaging. This example converts the data flow in the traffic of the business action to be identified into corresponding characteristic symbols, matches the characteristic symbols of the business to be identified with the characteristic symbols of the target business action in the characteristic file, and determines that the business action to be identified is the target business action if there is a match. It can not only accurately detect whether the business action to be identified that represents the user's intended behavior is the target business action, but also accurately attribute complex traffic such as access to public App cloud services in the target business action to the corresponding business action. This makes the network equipment's assessment of the user's Internet experience more accurate and provides a reasonable basis for network optimization functions. Example 6 The matching process of characteristic symbols: Figure 8 is a schematic diagram of feature matching in the traffic detection stage according to an embodiment of the present application. Referring to Figure 8, it is assumed that the feature information of the target business action is: the starting class feature symbol set is {A, B}; the longest common feature symbol subsequence is BDEJOPTQJW 0; the existence class feature symbol set is {G, F, X, Y}; the termination class feature symbol set is {H, 0}; the attribution class feature symbol set is {A, B, D, E, F, G, H, I, J, K, M, N, O, P, Q, R, T, V, X, Y, Z, 0}, and the user's current feature symbol sequence is: AABABCCCDCEEFGHIJKOPQ RSTUSQVQJWXYZDH 0. After a feature matching process of four steps, namely, matching the starting class feature symbol, matching the longest common feature symbol subsequence, matching the existence class feature symbol, and matching the termination class feature symbol, it can be confirmed that the user is currently performing the target business action. After identifying that a user has performed the target service action, we can further check whether each symbol in the user's current feature symbol sequence exists in the attribution feature symbol set. The bolded feature symbols in the user's current feature symbol sequence, as shown in Figure 8, exist in the attribution feature symbol set. The data flow corresponding to the attribution feature symbol in the user's current feature symbol sequence can be attributed to the data flow in the target service action traffic. This example matches the characteristic symbols of the service to be identified with the characteristic symbols of the target service action in the characteristic file. By determining whether the characteristic symbols of the service to be identified match the starting characteristic symbol, the longest common characteristic symbol subsequence, and the ending characteristic symbol, it can be used to identify that the user is currently performing the target service action. The accuracy of identifying that the user is currently performing the target service action can be improved by matching the existence characteristic symbols. Furthermore, by matching the attribution characteristic symbols of the target service action, the data flow corresponding to the attribution characteristic symbol in the user's current characteristic symbol sequence can be attributed to the data flow within the target service action traffic. This allows network devices to more accurately assess the user's Internet experience and provides a reasonable basis for network optimization. As an example, before identifying the business traffic to be identified, in order to implement detection based on user business actions, a user table in the form of a key-value memory data table can be pre-established, and a user context can be assigned to each user to record the detection status information of the business action. For example, Figure 9 is a schematic diagram of a user table according to an embodiment of the present application. As shown in Figure 9, the "key" in the user table can be a "user IP address" or a "combination of a user IP address and a VLAN ID" that uniquely identifies a user, and all messages matching a unique identifier can be attributed to the corresponding user context. The "value" is a data structure in the form of an array or a one-dimensional linked list, which stores the detection status information of one or more possible business actions of a user. Each array or linked list element can include, but is not limited to, dynamic information such as the business action number, business action status, business action start timestamp, and business action recognition accuracy. After successfully identifying that a user has completed a business action, the user table of the user generates the detection status information of the business action, which is based on the "value" in the user table of the user. As an example, after successfully identifying that a user has completed a business action, a business action identification message can be generated based on the "key" and "value" in the user table and sent to an external system. The external system can perform a correlation analysis between the user's intended behavior and the processing performance of the network device based on the business action identification message, find the impact of the network device performance indicators on the user's intended behavior, and then improve the user experience by adjusting the performance indicators of the network device. For example, FIG10 is a schematic diagram of reporting an identification result message according to an embodiment of the present application. As shown in FIG10 , after successfully identifying that a user has completed a business action, the relevant identification and statistical information of the user's business action (for example, who, when, and what happened) can be sent to an external system in the form of a message, wherein the message may include: 1) The user's "user IP address" or "combination of user IP address and VLAN ID" information. 2) The start time and end time information of the user's business action. 3) The name or number of the user's business action. 4) Traffic statistics such as the number of flows, bytes, and packets for the user's service action. Based on the above information in the message, the external system can perform correlation analysis on the user's intended behavior and the processing performance of the network device, find out the impact of the network device performance indicators on the user's intended behavior, and then improve the user's network experience by adjusting the performance indicators of the network device. In an embodiment of the present invention, a service feature training phase may be included before the service action traffic detection phase. In the service feature training phase, common patterns of complex network traffic of target service actions may be pre-determined to generate feature information. The specific process may be as follows: In an exemplary embodiment, before step S301, the following steps may also be included: The traffic of the target business action is sampled, and flow features are extracted from the data flow in the traffic of the target business action; a unique feature symbol is assigned to each flow feature of the target business action, and a mapping relationship between the flow features of the target business action and the feature symbols of the target business action is established. In an exemplary embodiment, the type of data flow in the traffic of the target business action includes at least one of the following: HTTP flow, HTTPS flow, and QUIC flow. In the embodiment of the present invention, the server domain name carried in the first request message of each data stream can be used as the corresponding stream feature, and a mapping relationship between the stream feature and the feature symbol can be established in the service feature training stage. As an example, the traffic of the target business action can be sampled in advance to establish a five-tuple flow table of the target business action. Based on the five-tuple flow table of the target business action, the flow characteristics of each data flow in the traffic of the target business action can be extracted separately, and a unique characteristic symbol can be assigned to the flow characteristics of each data flow of the target business action, and a mapping relationship between the flow characteristics and the characteristic symbols can be established. As an example, stream-level HTTP Host or stream-level HTTPS SNI or stream-level QUIC SNI can be used as the "lightweight stream feature". For example, based on the established five-tuple flow table, the host name Host of the first HTTP request message can be extracted for each HTTP flow, and the server name indication (Server Name Indication, SNI) of the first client hello ClientHello message can be extracted for each HTTPS / QUIC flow, and Host / SNI can be used as the characteristics of the data flow. In an exemplary embodiment, before obtaining the data flow in the traffic of the service action to be identified, the method further includes: Step A11, sampling the traffic of the target service action multiple times, extracting flow features from the data flow of the target service action traffic sampled each time, and generating multiple groups of flow feature samples corresponding to the traffic of the target service action; Step A12: Generate multiple characteristic symbol sample sequences corresponding to the target service action according to the mapping relationship and the multiple groups of flow characteristic samples. In an exemplary embodiment, after step A12, the method further includes: Step A13: extract multiple characteristic symbol sample sequences corresponding to the target service action to obtain the identification characteristic symbol and the attribution characteristic symbol. For example, the target service action traffic is sampled N times, and the flow characteristics of the data flow in each sample of the target service action traffic are extracted. For each sample, a corresponding feature symbol sequence sample can be generated based on the order in which each Host / SNI feature appears and the mapping relationship between the flow characteristics and the feature symbols. N sampling times can generate N groups of feature symbol sequence samples. Common feature symbols can be extracted from these N groups of feature symbol sequence samples as the identification feature symbols and attribution feature symbols of the target service action. For example, common characteristic symbols can be obtained from N groups of characteristic symbol sequence samples and used as the longest common characteristic symbol subsequence, starting characteristic symbol set, ending characteristic symbol set, existence characteristic symbol set, belonging characteristic symbol set, etc. of the target business action. As an example, all common feature symbols with the same order in multiple feature symbol sample sequences can be extracted in sequence as the longest common feature symbol subsequence; feature symbols that exist in multiple feature symbol sample sequences and are located within the first preset character range at the start position of each sample sequence are used as a starting feature symbol set; feature symbols that exist in multiple feature symbol sample sequences and are located within the second preset character range at the end position of each sample sequence are used as a terminating feature symbol set; feature symbols that are not starting feature symbols, are not terminating feature symbols, and are not in the longest common feature symbol subsequence in multiple feature symbol sample sequences are used as an existing feature symbol set; feature symbols that exist in feature symbol sample sequences exceeding a preset percentage of the total number of feature symbol sample sequences are used as belonging feature symbols. In an exemplary embodiment, step A12 may include: Based on the mapping relationship between the flow characteristics and the characteristic symbols and the multiple groups of flow characteristic samples, multiple preliminary characteristic symbol sample sequences corresponding to the target business action are generated; adjacent continuously repeated characteristic symbols in the preliminary characteristic symbol sequence are compressed into one characteristic symbol to generate multiple characteristic symbol sample sequences corresponding to the target business action. As an example, the lightweight Host / SNI original feature sequence generated by the target service action can be mapped into a preliminary feature symbol sequence based on the mapping relationship between flow features and feature symbols. A proximity compression method can be applied to the preliminary feature symbol sequence to compress adjacent, continuously repeated feature symbols in the preliminary feature symbol sequence into a single feature symbol, thereby generating a feature symbol sequence. For example, "CC" can be compressed into a single "C" and "EEEE" into a single "E." The following uses several examples to illustrate the feature training process in the business feature training phase, the feature symbol sequence proximity compression process, and the acquisition process of the longest common feature symbol subsequence, the starting class feature symbol set, the ending class feature symbol set, the existence class feature symbol set, and the belonging class feature symbol set. Example 7 Feature training process in the business feature training phase: FIG11 is a schematic diagram of a feature training process according to an embodiment of the present application. As shown in FIG11 , feature training may specifically include the following steps: Step 1: Get the lightweight Host / SNI characteristics of the stream. The system samples the target business action traffic and establishes a five-tuple flow table. For each HTTP flow, it extracts the Host of the first HTTP request message and the SNI of each HTTPS / QUIC ClientHello message. The Host / SNI can be used as the lightweight original feature of the flow. Step 2: Create a feature symbol mapping table. A feature symbol mapping table of lightweight original feature Host / SNI may be established to assign a unique feature symbol to each Host / SNI. Step 3: Obtain N sets of characteristic symbol sequences. The target service action traffic may be sampled N times. For each sampling, a corresponding feature symbol sequence is generated according to the order in which each Host / SNI original feature appears. Thus, N feature symbol sequences may be obtained from N samplings. Get the maximum duration of N sampling times to avoid false matches caused by unlimited accumulation of features during the traffic detection phase. Step 4: Obtain identification features and attribution features. The following features can be obtained from the N feature symbol sequences sampled N times: 1) Obtain a set of start-class characteristic symbols to indicate the start of the target business action. 2) Obtain the longest common feature symbol subsequence for accurate identification of target business actions. 3) Obtain a set of presence-class feature symbols to enhance the accuracy of target business action recognition. (Optional) 4) Obtain a set of attribution characteristic symbols to accurately attribute relevant traffic to the target business action. 5) Obtain a set of termination-type characteristic symbols to indicate the completion of the target business action. Step 5: Generate signature file. The characteristic information of the target business action can be converted into structured data and saved in a characteristic file. A characteristic file can contain a characteristic symbol mapping table and characteristic information of one or more business actions. The characteristic information of each target business action can include the following: 1) Target business action name or number; 2) Maximum duration of the target business action; 3) a set of characteristic symbols of the starting class; 4) the longest common characteristic symbol subsequence; 5) There exists a set of class characteristic symbols; 6) A collection of characteristic symbols of the belonging category; 7) Termination class feature symbol set. Example 8 Characteristic symbol sequence proximity compression process: FIG12 is a schematic diagram of the adjacent compression of a characteristic symbol sequence according to an embodiment of the present application. As shown in FIG12 , taking the App home screen opening action as the target service action as an example, FIG12 shows the process of the system sampling 10 test samples of the target service action and obtaining the corresponding 10 characteristic symbol sequences. The following is an example of a sampling test "Test No 1" of the target service action in FIG12 : 1) The lightweight original feature sequence obtained by the system in a sampling test "TestNo 1" on the target business action is "SNI:edith.xiaohongshu.com; SNI:www.xiaohongshu.com; SNI:edith.xiaohongshu.com; SNI:www.xiaohongshu.com; SNI:dns.alidns.com; SNI:as.xiaohongshu.com; SNI:dns.alidns.com; SNI:dns.alidns.com; SNI:doh.pub; SNI:doh.pub; SNI:doh.pub; SNI:doh.pub ub;SNI:crash.xiaohongshu.com;HOST:fp-it.fengkongcloud.com;SNI:lng.xiaohongshu.com;SNI:sns-avatar-qc.xhscdn.com;SNI:t2.xia ohongshu.com; SNI: ci.xiaohongshu.com; SNI: ca.iadsdk.apple.com; SNI: pages.xiaohongshu.com; SNI: pages.xiaohongshu.com; HOST: sns-i mg-hw.xhscdn.com;HOST:sns-img-hw.xhscdn.com;HOST:sns-img-hw.xhscdn.com;HOST:cdn-api-verify.mob.com;HOST:f.gm.mob.com;HOST :f.gm.mob.com;HOST:www.xiaohongshu.com;SNI:fe-video-qc.xhscdn.com;SNI:web-resource-app.xiaohongshu.com;SNI:rn-resource-ap p.xiaohongshu.com;SNI:rn-resource-app.xiaohongshu.com;SNI:bag.itunes.apple.com;SNI:web-resource-app.xiaohongshu.com;SNI:a ges.xiaohongshu.com;HOST:www.xiaohongshu.com;HOST:license.vod2.myqcloud.com;HOST:www.xiaohongshu.com;HOST:www.xiaohongshu.com; SNI: t2.xiaohongshu.com; SNI: t2.xiaohongshu.com; SNI: t2.xiaohongshu.com; HOST: sns-img-hw.xhscdn.com; HOST: sns-img-hw.xhscdn.com; ohongshu.com;HOST:sns-video-hw.xhscdn.com;SNI:spider-tracker.xiaohongshu.com;HOST:l.gm.mob.com;SNI:as.xiaohongshu.com;SNI:lng.xiaohongshu.com;SNI:log-verify.mob.com;". 2) According to the mapping relationship between stream features and feature symbols in the single-character feature symbol mapping table in FIG5 , the preliminary feature symbol sequence obtained from “TestNo1” is “ABABCDCCEEEEFGHIJKLMMNNNOPPQRSTTUSMQVQQJJJNNNWXYZDH0”. 3) Compressing the preliminary characteristic symbol sequence “ABABCDCCEEEEFGHIJKLMMNNNOPPQRSTTUSMQVQQJJJNNNWXYZDH0” using adjacent characteristic symbols, the compressed characteristic symbol sequence can be “ABABCDCEFGHIJKLMNOPQRSTUSMQVQJNWXYZDH0”. Example 9 The process of obtaining the longest common characteristic symbol subsequence: Based on a multi-sequence LCS (Longest Common Subsequence) algorithm, a common characteristic symbol subsequence can be obtained from multiple characteristic symbol sample sequences of the target service action, and the longest common characteristic symbol sequence among the multiple characteristic symbol sample sequences can be used as the longest common characteristic symbol subsequence. FIG13 is a schematic diagram of obtaining the longest common feature symbol subsequence according to an embodiment of the present application, using the 13 feature symbol sequences generated in FIG12 as an example. As shown in FIG13 , based on the multi-sequence LCS algorithm, a common feature symbol subsequence of the 10 feature symbol sequences obtained from multiple trainings of the target service action can be obtained, and the longest common feature symbol sequence among the 10 feature symbol sample sequences can be used as the longest common feature symbol subsequence. Each symbol in the longest common characteristic symbol subsequence may be continuous or discontinuous, but the order in which they appear in each characteristic symbol sequence is the same or remains unchanged. Figure 13 shows the common characteristic symbols in characteristic sequences No. 1 through No. 10 in bold. As shown in Figure 13, the longest common characteristic symbol subsequence, "BDEJOPTQJW0," can be obtained using the multi-sequence LCS algorithm. The figure shows that the symbols in the longest common characteristic symbol subsequence, "BDEJOPTQJW0," are not continuous, but their order of appearance remains unchanged. Among them, although A is included in all 10 characteristic symbol sequences in FIG13 , A sometimes comes before B and sometimes comes after B. The order of A and B is disordered, and A and B cannot be selected at the same time. Therefore, only one of A and B can be selected. The selected B in FIG13 is only an example. A can also be selected, but B needs to be discarded. Those skilled in the art can make a selection based on actual conditions, and the embodiments of the present invention are not limited here. Example 10 The process of obtaining the longest common subsequence based on the multi-sequence LCS algorithm: The present application may use a multi-sequence LCS algorithm to obtain the longest common subsequence from multiple sequences. A specific method is to randomly select two sequences and obtain the longest common subsequence between the two sequences as a temporary longest common subsequence. Then, the temporary longest common subsequence is combined with a third randomly selected sequence to obtain a new temporary longest common subsequence. This process continues until all sequences have been processed. The final temporary longest common subsequence is then used as the longest common subsequence of the multiple sequences. The longest common subsequence of two sequences is the longest common subsequence among all non-empty subsequences in the two sequences. The symbols in the subsequence can be continuous or discontinuous, but the order of the symbols in the subsequence remains consistent with the original sequence. For example, the non-empty common subsequences of "ABCD" and "NAXDE" are "A", "D", and "AD", where "AD" is the longest common subsequence. For example, FIG14 is a schematic diagram of a multi-sequence LCS algorithm according to an embodiment of the present application. As shown in FIG14 , it includes three characteristic symbol sequences “ABCDEFGH”, “6A1CDFFXY”, and “BDAAZ217F”. We can first obtain the temporary longest common subsequence of the first two sequences "ABCDEFGH" and "6A1CDFFXY", which is "ACDF". Then, we can obtain a new temporary longest common subsequence "AF" from the temporary longest common subsequence "ACDF" and the third sequence "BDAAZ217F". The final temporary "AF" is the longest common subsequence of these three sequences. The LCS algorithm is a conventional algorithm for finding the longest common subsequence of two sequences. It can be implemented using a full traversal method or based on a dynamic programming method. The specific algorithm will not be described in detail in this application. Example 11 The process of obtaining the starting class feature symbol set, the ending class feature symbol set, and the existence class feature symbol set: In an embodiment of the present invention, feature symbols that exist in multiple feature symbol sample sequences and are located within the first preset character range at the start position of each sample sequence can be used as a starting feature symbol set; feature symbols that exist in multiple feature symbol sample sequences and are located within the second preset character range at the end position of each sample sequence can be used as a terminating feature symbol set; and feature symbols that exist in multiple feature symbol sample sequences but are not starting feature symbols, are not terminating feature symbols, and are not in the longest common feature symbol subsequence can be used as an existing feature symbol set. FIG15 is a schematic diagram of obtaining characteristic symbols of the start class, the end class, and the existence class according to an embodiment of the present application. As shown in FIG15 , 1) A characteristic symbol that exists in all sequences and is located near the beginning of each sequence can be used as a starting characteristic symbol. As shown in Figure 15, the starting characteristic symbol of this service action is "A" or "B". The "near the beginning of each sequence" refers to the first X characters of each sequence, for example, X = 5. 2) A characteristic symbol that exists in all sequences and is located near the end of each sequence can be used as a termination characteristic symbol. As shown in the figure, the termination characteristic symbol of this service action is "H" or "0". The "end position" of each sequence refers to the last Y characters of each sequence, for example, Y = 5. 3) From the characteristic symbols that exist in all sequences, Z characteristic symbols can be selected as existence-class characteristic symbols, ensuring that these characteristic symbols are not start-class characteristic symbols, not end-class characteristic symbols, and not characteristic symbols in the longest common characteristic symbol subsequence. For example, "F", "G", "X", and "Y" in Figure 15. 4) Recognition accuracy can be divided into multiple levels, and the presence of class signatures can be used to increase recognition accuracy. For example, recognition accuracy can be divided into two levels: moderate accuracy and high accuracy. 5) There are class characteristic symbols. The difference between them and the characteristic symbols in the longest common characteristic symbol subsequence is that the order of the class characteristic symbols in each sequence is inconsistent, while the order in which each symbol in the longest common characteristic symbol subsequence appears in the corresponding characteristic symbol sequence remains unchanged. Example 12 The process of obtaining the attribute characteristic symbol set: In an embodiment of the present application, a characteristic symbol that exists in more than a preset percentage of the total number of characteristic symbol sample sequences is considered an attribution-class characteristic symbol. For example, a characteristic symbol that exists in more than 70% of the total number of sequences can be considered an attribution-class characteristic symbol. That is, if a characteristic symbol exists in more than 7 out of 10 sequences, then the characteristic symbol is considered an attribution-class characteristic symbol. Figure 16 is a schematic diagram of obtaining the attribution-category characteristic symbols according to an embodiment of the present application. In Figure 13, the characteristic symbols that exist in all sequences are used as attribution-category characteristic symbols and are displayed in bold. Among them, the characteristic symbols that are not bold indicate that the characteristic symbols do not appear in all the characteristic symbol sequences in Figure 16, for example, "C" does not appear in the characteristic symbol sequence No6, "L" does not appear in the characteristic symbol sequences No2, No3, No4, No5, No6, No7, No8, No9, No10, and so on. In the embodiment of the present application, all characteristic symbols in all sequences are not considered as belonging characteristic symbols, which can avoid misidentification of occasional interference traffic. The embodiment of the present application obtains the flow in the traffic of the business action to be identified, and extracts the flow characteristics of the business action to be identified from the flow; obtains the mapping relationship and the characteristic symbol of the target business action; the mapping relationship is the mapping relationship between the flow characteristics and the characteristic symbols; according to the flow characteristics and the mapping relationship of the business action to be identified, a characteristic symbol sequence corresponding to the business action to be identified is generated; when the characteristic symbol in the characteristic symbol sequence matches the characteristic symbol of the target business action, the business action to be identified is determined to be the target business action, which solves the problem that the DPI method in the related art cannot accurately identify the business actions in the APP, and can accurately identify the business actions in the APP to characterize the user's intended behavior, thereby making the network device's evaluation of the user's Internet experience more accurate and providing a reasonable basis for the network optimization function. Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application. An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above method embodiments when run. In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk. An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments. In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor. For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here. Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software. The above description is merely an exemplary embodiment of the present application and is not intended to limit the present application. Those skilled in the art will readily appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A method for identifying a business action, comprising: Acquire a data flow in the traffic of the service action to be identified, and extract flow features of the service action to be identified from the data flow; Generate a characteristic symbol sequence of the service action to be identified according to the flow characteristics of the service action to be identified and a preset mapping relationship; wherein the preset mapping relationship is a mapping relationship between the flow characteristics of the target service action and the characteristic symbols of the target service action; In a case where the characteristic symbol in the characteristic symbol sequence matches the characteristic symbol of the target service action, the service action to be identified is determined to be the target service action.

2. The method according to claim 1, wherein The obtaining of a data flow in the traffic of the service action to be identified, and extracting a flow feature of the service action to be identified from the data flow, includes: Establishing a corresponding five-tuple flow table for the data flow in the traffic of the service action to be identified; the data flow includes at least one request message; Based on the five-tuple flow table, a flow feature of the service action to be identified is extracted, where the flow feature is a server domain name carried in the first request message of the data flow.

3. The method according to claim 1, wherein The characteristic symbols of the target service action include identification characteristic symbols; the identification characteristic symbols include at least one of the following: a starting characteristic symbol set, a longest common characteristic symbol subsequence, an existence characteristic symbol set, and a termination characteristic symbol set.

4. The method according to claim 3, wherein: The step of generating a characteristic symbol sequence of the service action to be identified according to the flow characteristics of the service action to be identified and a preset mapping relationship includes: Generate a header feature symbol sequence corresponding to the flow features according to the time sequence of occurrence of the flow features of the service action to be identified and the mapping relationship; Traversing the characteristic symbols of the target service action, and matching the header characteristic symbol sequence with the characteristic symbols of the target service action; When the identification characteristic symbols include the starting characteristic symbol set and the characteristic symbols of the header characteristic symbol sequence match at least one starting characteristic symbol in the starting characteristic symbol set, the characteristic symbol sequence of the service action to be identified is generated.

5. The method according to claim 4, wherein The step of generating the characteristic symbol sequence for the service action to be identified, when the identification characteristic symbol includes the starting characteristic symbol set and the characteristic symbol of the header characteristic symbol sequence matches at least one starting characteristic symbol in the starting characteristic symbol set, includes: Marking the state of the to-be-identified business action as the starting state of the target business action; A characteristic symbol sequence of the service action to be identified is generated in the initial state.

6. The method according to claim 5, wherein: Also includes: Get the maximum duration of the target business action; When the duration of generating the characteristic symbol sequence of the service action to be identified reaches the maximum duration of the target service action, the generation of the characteristic symbol sequence of the service action to be identified is stopped.

7. The method according to claim 3, wherein: When the characteristic symbol in the characteristic symbol sequence matches the characteristic symbol of the target service action, determining that the service action to be identified is the target service action includes: Determining whether a characteristic symbol in the characteristic symbol sequence matches the longest common characteristic symbol subsequence; In a case where the characteristic symbols in the characteristic symbol sequence match the longest common characteristic symbol subsequence, the service action to be identified is determined to be a target service action, and the identification accuracy is determined to be a first accuracy.

8. The method according to claim 7, wherein: After determining that the service action to be identified is a target service action, the method further includes: Determining whether the characteristic symbols in the characteristic symbol sequence include all the presence-type characteristic symbols in the presence-type characteristic symbol set; When the characteristic symbols in the characteristic symbol sequence include all existence-class characteristic symbols in the existence-class characteristic symbol set, the recognition accuracy of determining that the business action to be identified is the target business action is the second accuracy, wherein the second accuracy is higher than the first accuracy.

9. The method according to claim 7, wherein: The characteristic symbol of the target service action also includes a class characteristic symbol; after determining that the service action to be identified is the target service action, the method further includes: Matching the characteristic symbols in the characteristic sequence with the attribution characteristic symbols; In a case where the characteristic symbol matches the attribution characteristic symbol, it is determined that the data flow corresponding to the characteristic symbol is the data flow in the target service action traffic.

10. The method according to claim 1, wherein Before obtaining the data flow in the traffic of the service action to be identified, the following steps are also included: Sampling the traffic of the target service action, and extracting flow features from the data flow in the traffic of the target service action; A unique characteristic symbol is assigned to each flow characteristic of the target service action, and a mapping relationship between the flow characteristics of the target service action and the characteristic symbols of the target service action is established.

11. The method according to claim 9, wherein: Before obtaining the data flow in the traffic of the service action to be identified, the following steps are also included: Sampling the traffic of the target service action multiple times, extracting flow features from the data flow of the target service action traffic sampled each time, and generating multiple groups of flow feature samples corresponding to the traffic of the target service action; According to the mapping relationship and the multiple groups of flow feature samples, multiple feature symbol sample sequences corresponding to the target service action are generated.

12. The method according to claim 11, wherein After generating a plurality of characteristic symbol sample sequences corresponding to the target service action, the method further includes: Extract multiple characteristic symbol sample sequences corresponding to the target service action to obtain the identification characteristic symbol and the attribution characteristic symbol.

13. The method according to claim 11, wherein The generating, based on the mapping relationship between the flow characteristics and the characteristic symbols and the multiple groups of flow characteristic samples, a plurality of characteristic symbol sample sequences corresponding to the target service action includes: Generating a plurality of preliminary feature symbol sample sequences corresponding to the target service action according to the mapping relationship between the flow feature and the feature symbol and the plurality of groups of flow feature samples; Adjacent, continuously repeated characteristic symbols in the preliminary characteristic symbol sequence are compressed into one characteristic symbol to generate a plurality of characteristic symbol sample sequences corresponding to the target service action.

14. The method according to any one of claims 1 to 11, wherein: The type of data flow in the traffic of the target business action includes at least one of the following flows: HTTP flow, HTTPS flow, and QUIC flow.

15. A computer-readable storage medium having a computer program stored therein, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 13 are implemented.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 13 when executing the computer program.

Images