Application identification method and related apparatus

Abstract

Embodiments of the present application disclose an application identification method and a related apparatus. The method comprises: acquiring parameter information, the parameter information being used for creating a connection, and said connection being used for carrying a data stream; performing identification on the parameter information, and determining an application type corresponding to the data stream; and, on the basis of the application type corresponding to the data stream, performing identification on the data stream to determine one or more identification results, each identification result indicating at least one application action corresponding to the data stream. By means of two-stage identification, the efficiency and identification precision of application identification are improved.

Description

An application identification method and related apparatus

[0001] The present application claims priority to the Chinese Patent Application No. 202410465549.1, filed on April 17, 2024, and entitled "An Application Identification Method and Related Apparatus", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of communication technology, and in particular, to an application identification method and related apparatus. BACKGROUND

[0003] In the face of an increasing number of applications, how to accurately control application traffic is the biggest problem faced by network management. The premise of control is to accurately identify various applications in the network. With the increasing complexity of application programs, traditional application identification technology has been unable to meet the fine control requirements.

[0004] Currently, common application identification technologies include Deep Packet Inspection (DPI) and Deep Flow Inspection (DFI). DPI is a traffic detection and control technology based on the application layer, which disassembles packets, analyzes packet headers and application layer content, and thus identifies application programs and application content. DFI is an application identification technology based on traffic behavior, that is, it identifies the session connection behavior of different applications. By analyzing statistical characteristics of data flow, such as flow duration, flow size, flow rate, or flow direction, and then using machine learning or artificial intelligence technology, the data flow is classified or clustered to determine the application corresponding to the data flow.

[0005] However, the current application identification technology has the problem of poor recognition accuracy. Therefore, how to improve the recognition accuracy of the application identification technology has become a problem to be solved. SUMMARY

[0006] In a first aspect, an application identification method is provided. The method includes: first, an application identification apparatus obtains parameter information, the parameter information being used to create a connection, the connection being used to carry a data flow. Then, the application identification apparatus performs identification processing on the parameter information to determine an application type corresponding to the data flow. Finally, the application identification apparatus performs identification processing on the data flow according to the application type corresponding to the data flow to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data flow, the application action being an action performed by the application.

[0007] In the embodiments of the present application, first, the parameter information when creating a connection is identified to determine the application type corresponding to the data stream carried by the connection. Then, the data stream is identified to determine the application action corresponding to the data stream. Through two-level identification, the efficiency and accuracy of application identification are improved.

[0008] In combination with the first aspect, in a possible implementation manner of the first aspect, the application identification apparatus performs processing on the connection according to the identification result, where performing processing on the connection includes blocking the connection and / or generating the application identification result of the connection.

[0009] In a possible implementation manner, the identification result of the data stream is that the application action is voice over internet protocol (VoIP) communication. In response to the identification result, a virtual private network (VPN) tunnel is interrupted to prevent the VoIP communication, where the VPN tunnel carries the data stream of the VoIP communication.

[0010] In another possible implementation manner, the identification result of the data stream is that the application action is instant messaging office (IMO) download of a configuration file. In response to the identification result, a push (PUSH) channel is interrupted to prevent the IMO download of the configuration file, where the PUSH channel carries the related data stream of the IMO.

[0011] In the embodiments of the present application, the application identification apparatus can also export the identification result and perform related processing on the connection according to the identification result to improve user experience.

[0012] In combination with the first aspect, in a possible implementation manner of the first aspect, the application identification apparatus determines a window set corresponding to the application according to the application type corresponding to the data stream, where the window set includes one or more identification windows, and each identification window is used to identify at least one application action; and then, the data stream is subjected to feature matching using the window set to determine one or more identification results.

[0013] In the embodiments of the present application, the application identification apparatus can use one or more identification windows included in the window set to identify the data stream, thereby improving the identification accuracy.

[0014] In combination with the first aspect, in a possible implementation manner of the first aspect, the identification window includes any one or more of the following:

[0015] The fixed-size window has a granularity including a number of data packets, a number of bytes, or a duration of the data stream;

[0016] Alternatively, a request-response corresponding window, the request-response corresponding window comprising at least one request and a response corresponding to the request, the request corresponding to one or more data packets in a first direction, and the response corresponding to one or more data packets in a second direction, the first direction being opposite to the second direction;

[0017] Alternatively, a sliding window, a size of the sliding window being determined by the data stream identified by the identification window.

[0018] In the embodiments of the present application, the identification window can include multiple types, which improves the implementation flexibility of the scheme and improves the identification accuracy.

[0019] With reference to the first aspect, in a possible implementation manner of the first aspect, the feature matching comprises: length matching of the data packets in the identification window, and / or transmission direction matching of the data packets in the identification window.

[0020] The length matching of the data packets comprises: Internet protocol (IP) layer packet length matching, Transmission Control Protocol (TCP) layer packet length matching, User Datagram Protocol (UDP) layer packet length matching, Transport Layer Security (TLS) layer packet length matching, Quick UDP Internet Connection (QUIC) layer packet length matching, or application layer packet length matching.

[0021] In the embodiments of the present application, the feature matching can include multiple types, which improves the implementation flexibility of the scheme and improves the identification accuracy.

[0022] With reference to the first aspect, in a possible implementation manner of the first aspect, the feature matching further comprises: statistical feature matching, the statistical feature comprising: a number of the data packets in the identification window, an average packet length of the data in the identification window, a bandwidth occupancy of the data in the identification window, a maximum packet length of the data in the identification window, and / or a minimum packet length of the data in the identification window.

[0023] In the embodiments of the present application, the feature matching can include multiple types, which improves the implementation flexibility of the scheme and improves the identification accuracy.

[0024] In a possible implementation of the first aspect, the feature matching of the data stream using the window set is performed according to a feature matching rule, and the feature matching result of the data stream is determined according to the feature matching rule. The feature matching rule is used to indicate a number of data packets that are not matched in the feature matching process, and / or a position of the data packets that are not matched in the data stream.

[0025] Specifically, in the feature matching of the data stream using the window set, the feature matching can also be performed according to the configured feature matching rule, so as to enhance the universality of the application recognition. The feature matching rule in the embodiments of the present application includes but is not limited to: indicating the number of data packets that are not matched in the feature matching process, and / or indicating the position of the data packets that are not matched in the data stream. For example, the feature matching rule indicates that the 0th data packet to the 8th data packet in the data stream are not matched, and the 9th data packet in the data stream is matched.

[0026] In a possible implementation of the first aspect, after the application type corresponding to the data stream is determined according to the parameter information, the method further includes: when the data stream does not belong to the data stream corresponding to the application type, stopping the application recognition of the data stream.

[0027] In the embodiments of the present application, when the application recognition device determines that the data stream does not belong to the data stream corresponding to the application type (in other words, all the recognition windows in the window set cannot match the data stream), the application recognition of the data stream is stopped. The recognition result of the data stream is set as "unrecognized", and the related data of the data stream is cleared from the cache of the application recognition device. Therefore, the computing resources can be effectively saved.

[0028] In a possible implementation of the first aspect, the parameter information includes any one or more of the following: a keyword of a load of a connection bearer, a packet length of a data packet of the connection bearer, address information of a connection corresponding client, address information of a connection corresponding server, connection corresponding secret key information, domain name information supported by the server, or domain name information expected to be accessed by the client, wherein the server and the client establish a connection.

[0029] In the embodiments of the present application, the types of the parameter information include multiple types, and therefore the recognition accuracy can be improved.

[0030] In the second aspect, the embodiments of the present application provide an application recognition device. The application recognition device includes a processing unit and a transceiver unit, and is configured to execute the method of the first aspect and any one of the implementations of the first aspect.

[0031] The third aspect of the embodiments of the present application provides a chip, which comprises an interface circuit and a processing circuit, the interface circuit and the processing circuit are interconnected through a line, and the processing circuit is used to run a computer program or an instruction to perform the method of the first aspect.

[0032] Optionally, the chip comprises at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, and the at least one processor is used to run a computer program or an instruction to perform the method of the first aspect.

[0033] Optionally, the communication interface of the chip can be an input / output interface, a pin or a circuit, etc.

[0034] In combination with the third aspect, in an implementation manner of the third aspect of the embodiments of the present application, the chip described above in the present application further comprises at least one memory, and the at least one memory stores an instruction. The memory can be a storage unit inside the chip, for example, a register, a cache, etc., or can be a storage unit of the chip (for example, a read-only memory, a random access memory, etc.).

[0035] The fourth aspect of the embodiments of the present application provides an application identification device, which comprises at least one processor, the at least one processor is coupled with a memory; the memory is used to store a program or an instruction; and the at least one processor is used to execute the program or the instruction to enable the device to implement any possible implementation manner of the first aspect.

[0036] The fifth aspect of the embodiments of the present application provides an application identification device, which comprises a communication interface, used to input and / or output signaling or data; and a processor, used to execute a computer executable program to enable the device to implement any possible implementation manner of the first aspect.

[0037] The sixth aspect of the embodiments of the present application provides an application identification device, which comprises at least one logic circuit and an input / output interface; the input / output interface is used to input or output information; and the logic circuit is used to execute any possible implementation manner of the first aspect.

[0038] The seventh aspect of the present application provides a computing system, which comprises the application identification device of any implementation manner of the sixth aspect.

[0039] The eighth aspect of the present application provides a computer readable storage medium, which stores a computer program, and when the computer program is run on a computer, the computer is enabled to execute the method of the first aspect.

[0040] The ninth aspect of the present application provides a computer program product, which, when run on a computer, enables the computer to execute the method of the first aspect.

[0041] The tenth aspect of the present application provides a computing system, comprising an application identification apparatus, wherein the application identification apparatus is configured to perform the method according to any one of the preceding first aspects. BRIEF DESCRIPTION OF DRAWINGS

[0042] Fig. 1 is a schematic diagram of an application identification system according to an embodiment of the present application;

[0043] Fig. 2 is a schematic diagram of another application identification system according to an embodiment of the present application;

[0044] Fig. 3 is a schematic diagram of another application identification system according to an embodiment of the present application;

[0045] Fig. 4 is a schematic diagram of a computer device according to an embodiment of the present application;

[0046] Fig. 5 is a schematic diagram of an embodiment of an application identification method according to an embodiment of the present application;

[0047] Fig. 6 is a schematic diagram of a data flow according to an embodiment of the present application;

[0048] Fig. 7 is a schematic diagram of parameter information in a handshake stage;

[0049] Fig. 8 is a schematic diagram of an application scenario according to an embodiment of the present application;

[0050] Fig. 9 is a schematic diagram of another application scenario according to an embodiment of the present application;

[0051] Fig. 10 is a schematic diagram of an application identification apparatus according to an embodiment of the present application;

[0052] Fig. 11 is a schematic diagram of an application identification apparatus 1101 according to an embodiment of the present application. DETAILED DESCRIPTION

[0053] The terms "first", "second", and the like in the description and in the claims of the present application and in the above drawings to objects similar to one another are used merely for distinguishing like objects and do not necessarily indicate a specific order or sequence. It is to be understood that the terms so used are interchangeable under appropriate circumstances and are merely employed for descriptive purposes. Furthermore, the terms "comprise", "comprising", "have", "having", "include", "including", and the like, are used synonymously to encompass a process, a method, a system, a product, or a device that includes a series of steps, units, or components, but not limited to those steps, units, or components, and are used to indicate that the process, the method, the system, the product, or the device includes the steps, units, or components, but not to those not explicitly listed, or inherent to such process, method, system, product, or device.

[0054] The technical solutions in the embodiments of the present application will be clearly described below with reference to the drawings in the embodiments of the present application. In the description of the present application, unless otherwise specified, " / " represents the meaning of or, for example, A / B can represent A or B; in the present application, "and / or" is only used to describe the association relationship of the associated objects, and represents that there can be three relationships, for example, A and / or B can represent that A exists alone, A and B exist together, and B exists alone. In addition, in the description of the present application, "at least one" means one or more, and "more" means two or more. "At least one" or similar expressions refer to any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b, or c can represent a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, and c can be single or multiple.

[0055] In a possible implementation, refer to FIG. 1. FIG. 1 is a schematic diagram of an application identification system provided by the embodiments of the present application. The system includes at least one client 101, at least one network device 102, and at least one server 103. Each client 101 and network device 102 are connected through wired or wireless mode to communicate. Each server 103 and network device 102 are also connected through wired or wireless mode to communicate.

[0056] For any client 101, the application is installed on the client 101, and when the client 101 runs the application, data flow is generated. At this time, the client 101 can send the data flow to the network device 102. When the network device 102 receives the data flow, the network device 102 can process the data flow to identify the application corresponding to the data flow. Then, when the data flow is transmitted to the server 103, the server 103 can process the data flow to respond to the operation of the client 101.

[0057] The application installed on the client 101 can be a private application or a public network application. The private application refers to an application used in an enterprise, and the public network application refers to an application that anyone can use. For example, the private application can be an application used for communication in an enterprise, and the public network application can be an application used for communication between the enterprise and the outside.

[0058] The client 101 can be any electronic product that can interact with a user through one or more manners such as a keyboard, a touchpad, a touch screen, a remote controller, voice interaction, or a handwriting device, for example, a personal computer (PC), a mobile phone, a smart phone, a personal digital assistant (PDA), a wearable device, a pocket PC (PPC), a tablet computer, a smart car, a smart television, a smart speaker, and the like.

[0059] The network device 102 can be a core switch, an access switch, a router, a gateway (for example, an enterprise gateway, a home gateway, or a wireless gateway), or an embedded device, or the like. The server 103 can be a server, a server cluster composed of multiple servers, a cloud device, or a cloud computing service center.

[0060] In another possible implementation, refer to FIG. 2, which is a schematic diagram of another application identification system according to an embodiment of the present application. The application identification system includes at least one terminal device, at least one network device, and a cloud device. An application running on the terminal device generates a data stream, which is forwarded to the cloud device through the network device. In the application identification system, the terminal device, the network device, or the cloud device can execute the application identification method according to an embodiment of the present application.

[0061] In another possible implementation, refer to FIG. 3, which is a schematic diagram of another application identification system according to an embodiment of the present application. The application identification system includes at least one terminal device, a firewall, at least one network device, and a cloud device. An application running on the terminal device generates a data stream, which is forwarded to the cloud device through the firewall and the network device. In the application identification system, the terminal device, the firewall, the network device, or the cloud device can execute the application identification method according to an embodiment of the present application.

[0062] Refer to FIG. 4, which is a structural schematic diagram of a computer device according to an embodiment of the present application. The computer device can be the client 101, the network device 102, or the server 103 shown in FIG. 1, or the terminal device, the network device, or the cloud device shown in FIG. 2, or the terminal device, the firewall, the network device, or the cloud device shown in FIG. 3. The computer device is configured to execute the application identification method according to an embodiment of the present application. The computer device includes at least one processor 401, a communication bus 402, a memory 403, and at least one communication interface 404.

[0063] The processor 401 can be a general central processing unit (CPU), a network processing unit (NP), a microprocessor, or can be one or more integrated circuits used to implement the schemes of the present application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0064] The communication bus 402 is used to transmit information between the above-mentioned components. The communication bus 402 can be divided into an address bus, a data bus, a control bus and the like. For the convenience of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or only one type of bus.

[0065] The memory 403 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, or can be a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or can be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, an optical disk storage (including a compact disk, a laser disk, an optical disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but not limited to. The memory 403 can exist independently and be connected to the processor 401 through the communication bus 402. The memory 403 can also be integrated with the processor 401.

[0066] The communication interface 404 is configured to communicate with other devices or communication networks. The communication interface 404 includes a wired communication interface, and can further include a wireless communication interface. The wired communication interface can be an Ethernet interface, for example. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be a wireless local area networks (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0067] In specific implementations, as an example, the processor 401 can include one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 4.

[0068] In specific implementations, as an example, the computer device can include multiple processors, such as the processor 401 and the processor 405 as shown in FIG. 4. Each of the processors can be a single-CPU or a multi-CPU. The processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0069] In specific implementations, as an example, the computer device can further include an output device 406 and an input device 407. The output device 406 is in communication with the processor 401, and can display information in various manners. For example, the output device 406 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 407 is in communication with the processor 401, and can receive user input in various manners. For example, the input device 407 can be a mouse, a keyboard, a touch screen device, or a sensing device, etc.

[0070] In some embodiments, the memory 403 is configured to store program code 210 for implementing the solutions of the present application, and the processor 401 can execute the program code 210 stored in the memory 403. For example, the computer device can implement the application recognition method proposed in the present application by means of the processor 401 and the program code 210 in the memory 403. The computer device can run the application recognition apparatus proposed in the embodiments of the present application, which is configured to execute the application recognition method proposed in the embodiments of the present application.

[0071] Please refer to FIG. 5, which is an embodiment flowchart of an application recognition method proposed in the embodiments of the present application. The application recognition method proposed in the embodiments of the present application includes:

[0072] S1, obtaining parameter information, the parameter information being used for creating a connection, the connection being used for carrying a data flow.

[0073] In step S1, the application recognition apparatus obtains parameter information, which refers to parameter information related to creating a connection in a process of creating the connection, the connection being used for carrying a data flow of an application. For example, refer to FIG. 6, which is a schematic diagram of a data flow in an embodiment of the present application. A connection is first created between a client and a server, and the stage of creating the connection can also be referred to as a connection handshake stage or a handshake stage. The application recognition apparatus obtains parameter information of the stage of creating the connection. Over time, when the connection is created, the connection carries a data flow. Data flows in different time periods often carry data of different applications or different behaviors of an application. For example, in FIG. 6, the data flow first carries data related to sending a video, then carries data related to sending a picture, and finally carries data related to voice.

[0074] In a possible implementation, the parameter information includes any one or more of the following: a keyword of a load carried by the connection, a packet length of a data packet carried by the connection, address information of a client corresponding to the connection, address information of a server corresponding to the connection, key information corresponding to the connection, domain name information supported by the server, or domain name information expected to be accessed by the client, where the connection is established between the server and the client.

[0075] For example, in a connection handshake stage between a client and a server, the application recognition apparatus can obtain handshake messages exchanged between the client and the server, and then obtain the parameter information from the handshake messages. The parameter information is, for example, a server name indication (SNI) field. The SNI is an extension of the transport layer security (TLS) protocol, which allows a client to explicitly indicate the domain name of a server that it wants to connect to in the process of establishing a secure connection with the server. This mechanism is introduced in the ClientHello stage of the TLS handshake process, and the client sends the hostname it tries to connect to through the SNI field, so that the server can provide the correct certificate to the client according to the hostname, thereby completing the establishment of secure communication.

[0076] S2, performing recognition processing on the parameter information to determine an application type corresponding to the data flow.

[0077] In step S2, after the application identification device obtains the parameter information, the application identification device performs identification processing on the parameter information, and then determines the application type corresponding to the data flow or the type of the connection carrying the data flow. For example, after the application identification device obtains the parameter information, the application identification device performs identification processing on the parameter information. If the identification result is that the parameter information is not application-related parameter information, the application identification process ends. If the identification result is that the parameter information is application-related parameter information, the application identification device further performs subsequent application identification methods.

[0078] Further, after the application corresponding to the data flow is determined, the window set corresponding to the application needs to be determined. The window set includes one or more identification windows, and each identification window is used to identify at least one application action. For example, the window set is shown in Table 1.

[0079] Table 1

[0080] For example, as shown in Table 1, when the application type of the data flow #1 is identified as a VPN tunnel in step S2, it is determined that the identification windows included in the window set #1 are used to identify the data flow #1. When the application type of the data flow #2 is identified as a PUSH channel in step S2, it is determined that the identification windows included in the window set #2 are used to identify the data flow #2. When the application type of the data flow #3 is identified as a P2P connection in step S2, it is determined that the identification windows included in the window set #3 are used to identify the data flow #3.

[0081] In a possible implementation, the identification window includes any one or more of the following: a fixed-size window, a window corresponding to a request-response pair, or a sliding window. The following will be introduced respectively.

[0082] A fixed-size window, the granularity of the fixed-size window includes: the number of data packets, the number of bytes, or the duration of the data flow. Specifically, the fixed-size window refers to defining the size of the window according to the number of data packets of the data flow carried by the connection (the number of data packets can also be referred to as the number of packets), the number of bytes of the data flow in a period of time, the number of bytes of the data packet, or the duration of the data flow. For example, every 100 data packets as a window; or every 2000 bytes of traffic as a window; or every 10 seconds of communication data as a window. For example, consider a special network communication scenario, such as an asymmetric routing scenario, the application recognition device can only receive communication data in a single direction of the connection. Therefore, in the asymmetric routing scenario, the definition of the fixed-size window can be the number of packets in a single direction, the number of bytes of the data flow, or the duration of the data flow. For the fixed-size window, it is suitable for identifying application actions with large traffic, such as downloading, watching videos, VoIP calls, etc. The above communication scenarios have the characteristics of long duration and large traffic, so the fixed-size window can effectively identify the above application actions.

[0083] A request-response corresponding window, the request-response corresponding window includes at least one request and a response corresponding to the request, the request corresponds to one or more data packets in a first direction, and the response corresponds to one or more data packets in a second direction, the first direction being opposite to the second direction. For example, the first direction is the uplink direction from the client to the server, and the downlink direction from the server to the client is the second direction. Specifically, for application actions with small traffic, such as application programming interface (API) requests, account login or configuration viewing, etc., a request and a response can generally complete an application action. Therefore, the request-response corresponding window is suitable for identifying a group of requests and responses. In the request-response corresponding window, one or more data packets (or messages) in the first direction are regarded as a request, and one or more data packets (or messages) in the second direction are regarded as a response. A request and a response corresponding to the request are combined as a group of requests and responses.

[0084] Alternatively, a sliding window, the size of the sliding window is determined by the data flow identified by the identification window. Specifically, for some flexible application actions, a sliding window can be used for matching. After each new data packet in the data flow arrives at the application recognition device, it is added to the sliding window, and then the oldest data packet in the sliding window is eliminated from the sliding window.

[0085] For the convenience of understanding, please refer to FIG. 7, which is a schematic diagram of parameter information in a handshake stage. The parameter information obtained by the application identification apparatus is shown in FIG. 7. According to the parameter information "SNI: mtalk.google.com", it can be identified that the connection corresponding to the parameter information is a push (PUSH) channel. The parameter information is application-related parameter information, and the subsequent step S3 needs to be performed. For example, the application identification apparatus determines that the data stream corresponding to the application needs to be further identified, and specifically, the data stream is identified from the first application data packet in the data stream.

[0086] S3, identifying the data stream according to the application type corresponding to the data stream, to determine one or more identification results.

[0087] In step S3, after determining the application type corresponding to the data stream, the data stream is identified using the window set corresponding to the application type to determine one or more identification results, each of which indicates at least one application action corresponding to the data stream.

[0088] In one possible implementation, the data stream is matched using the window set to determine one or more identification results. The feature matching includes, but is not limited to, identifying the length matching of the data packet in the window, and / or identifying the transmission direction matching of the data packet in the window.

[0089] Specifically, the "length matching" in the embodiment of the application includes identifying the packet length matching of a single data packet in the window, or identifying the packet length matching of multiple data packets in the window. The packet length matching can be a fixed value, for example, 500KB, which means that the packet length of the data packet in the identification window is 500KB, and the matching is successful. The packet length matching can also be a range value, for example, (20KB, 500KB), which means that the packet length of the data packet in the identification window is greater than 20KB and less than 500KB, and the matching is successful.

[0090] Further, the length matching of the data packet can also be length matching for different transmission protocols in the data stream. For example, the length matching of the data packet includes the packet length matching of the Internet Protocol (IP) layer, the packet length matching of the Transmission Control Protocol (TCP) layer, the packet length matching of the User Datagram Protocol (UDP) layer, the packet length matching of the Transport Layer Security (TLS) layer, the packet length matching of the Quick UDP Internet Connections (QUIC) layer, or the packet length matching of the application layer.

[0091] Further optionally, the feature matching further comprises: statistical feature matching, the statistical feature comprises: number of data packets in the identified window, average packet length of data in the identified window, bandwidth occupation of data in the identified window, maximum packet length of data in the identified window, and / or, minimum packet length of data in the identified window.

[0092] For the convenience of understanding, in one possible implementation of the window set, as shown in Table 2.

[0093] Table 2

[0094] Further optionally, in the process of using the window set to perform feature matching on the data stream, the feature matching can also be performed according to the configured feature matching rule to enhance the universality of application identification. The feature matching rule in the embodiments of the present application includes but is not limited to: the number of data packets that are not matched in the process of feature matching, and / or, the position of the data packets that are not matched in the data stream. For example, the feature matching rule indicates that the 0th~8th data packets in the data stream are not matched, and the 9th data packet in the data stream is matched.

[0095] S4, performing processing on the connection according to the identification result.

[0096] In step S4, after the application identification device determines the identification result, the processing on the connection is performed according to the identification result. Specifically, the processing on the connection includes: blocking the connection, and / or, generating the application identification result of the connection.

[0097] For example, the identification result determined by the application identification device is VoIP communication, and the application identification device blocks the connection. Moreover, the application identification device generates the application identification result of the connection, which includes: the application action of the connection is VoIP, and the blocking is performed on the connection.

[0098] For another example, the identification result determined by the application identification device is IMO download profile, and the application identification device blocks the connection. Moreover, the application identification device generates the application identification result of the connection, which includes: the application action of the connection is IMO download profile, and the blocking is performed on the connection.

[0099] Optionally, in the above step S2~step S3, when the application identification device determines that the data stream does not belong to the data stream corresponding to the application type (in other words, all the identified windows in the window set cannot match the data stream), the application identification of the data stream is stopped. The identification result of the data stream is set to "unidentified", and the related data of the data stream is cleared from the cache of the application identification device.

[0100] In the embodiments of the present application, first, the parameter information when creating a connection is identified to determine the application type corresponding to the data stream carried by the connection. Then, the data stream is identified to determine the application action corresponding to the data stream. Through two-level identification, the efficiency and accuracy of application identification are improved. The targets for identification in different stages are different, which can improve the identification accuracy. In addition, the parameter information is identified in the handshake stage, which can help filter irrelevant connections and improve the identification processing performance. The data stream is identified through multiple identification windows to improve the identification accuracy. The application identification device can also export the identification result and perform related processing on the connection according to the identification result to improve the user experience.

[0101] In combination with the foregoing embodiments, some application scenarios of the embodiments of the present application are introduced next.

[0102] Please refer to FIG. 8, which is a schematic diagram of an application scenario in the embodiments of the present application. Take the identification processing of the Internet instant messaging office (IMO) application by the application identification device as an example to introduce the specific process of application identification. The IMO can change its traffic characteristics to evade blocking. The traffic characteristic change of the IMO is performed according to the configuration file of the IMO, which describes how the traffic characteristics change and the information related to the change, such as secret keys, server IP addresses, and / or domain names. The client running the IMO needs to download the configuration file from the server of the IMO regularly, and the IMO can change the traffic characteristics in time. In order to hide the download traffic of the configuration file, the client running the IMO uses the PUSH channel to transmit the configuration file. The PUSH channel is a public communication mechanism provided by the current “Android” or “iOS” operating system, and multiple applications can use the PUSH channel to transmit their own related data, so the PUSH channel carries data of different application actions. In addition, since the PUSH channel needs to transmit the data of the application in real time, the client generally creates a connection after starting, and the connection will not be disconnected until the client is shut down or the network of the client is interrupted.

[0103] When the connection handshake phase of the PUSH channel, the application recognition device recognizes the PUSH channel through the SNI field of the handshake message. Then, the data stream carried by the PUSH channel is recognized. Specifically, the first application data message of the data stream is used to recognize the data stream. When the application data message appears in the data stream, it means that it enters the data transmission phase. In combination with the foregoing Table 2, the application recognition device uses the window set #2 in the recognition window set to perform the recognition processing on the data stream, wherein the sliding window #2 “[367KB, 601KB, 150KB]” matches the three data packets in the data stream in turn, which means that the sliding window #2 successfully matches the data stream. The recognition result of the data stream is that the application action is IMO download configuration file. In response to the recognition result, the PUSH channel is interrupted, and the IMO download configuration file is prevented.

[0104] Please refer to FIG. 9, which is a schematic diagram of another application scenario in the embodiment of the present application. Taking the recognition processing of the VoIP application by the application recognition device as an example, the specific flow of the application recognition is introduced. After the client creates a VPN tunnel using the VPN application, the VPN application transmits all the traffic or the traffic of the specified application on the client through the VPN tunnel. In this case, when the client runs the VoIP application, the traffic of the VoIP application will use the VPN tunnel to perform the transmission. When the application recognition device needs to block the communication of the VoIP application, the traffic of the VoIP application needs to be recognized from the multiple traffics carried by the VPN tunnel.

[0105] In the process of creating the VPN tunnel, the client obtains the parameter information related to the creation of the VPN tunnel, such as the load keyword, the packet length, or the IP address information of the server. Then, the application recognition device determines that the created connection is the VPN tunnel according to the parameter information, and determines that the application type of the data stream to be recognized is the VPN tunnel. The application recognition device further performs the recognition processing on the data stream carried by the VPN tunnel. In one possible implementation manner, the handshake phase of the VPN tunnel is usually completed in the first 64 data packets of the data stream, so the recognition processing is performed from the 64th data packet of the data stream. In combination with the foregoing Table 2, the application recognition device uses the window set #1 in the recognition window set to perform the recognition processing on the data stream, wherein the fixed size window #1 matches the data stream. Therefore, the recognition result of the data stream is that the application action is VoIP communication. In response to the recognition result, the VPN tunnel is interrupted, and the VoIP communication is prevented.

[0106] Based on the embodiments corresponding to FIG. 5 to FIG. 9, in order to better implement the above scheme of the embodiments of the present application, the following further provides a related device for implementing the above scheme. Referring to FIG. 10, FIG. 10 is a structural schematic diagram of an application identification device provided by the embodiments of the present application. The application identification device 1000 comprises: a transceiving module 1001 and a processing module 1002, the application identification device 1000 comprises:

[0107] The transceiving module 1001 is configured to acquire parameter information, the parameter information being used for creating a connection, the connection being used for carrying a data stream;

[0108] The processing module 1002 is configured to perform identification processing on the parameter information, so as to determine an application type corresponding to the data stream.

[0109] The processing module 1002 is further configured to perform identification processing on the data stream according to the application type corresponding to the data stream, so as to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data stream, the application action being an action performed by an application.

[0110] In a possible implementation manner, the processing module 1002 is further configured to block the connection according to the identification result, and / or generate an application identification result of the connection.

[0111] In a possible implementation manner, the processing module 1002 is further configured to determine a window set corresponding to the application according to the application type corresponding to the data stream, the window set comprising one or more identification windows, and each identification window being used for identifying at least one application action.

[0112] The processing module 1002 is further configured to perform feature matching on the data stream using the window set, so as to determine one or more identification results.

[0113] In a possible implementation manner, the identification window comprises any one or more of the following:

[0114] A fixed-size window, a granularity of the fixed-size window comprising: a number of data packets, a number of bytes, or a duration of the data stream;

[0115] Or, a request-response corresponding window, the request-response corresponding window comprising at least one request and a response corresponding to the request, the request corresponding to one or more data packets in a first direction, and the response corresponding to one or more data packets in a second direction, the first direction being opposite to the second direction;

[0116] Or, a sliding window, a size of the sliding window being determined by the data stream identified by the identification window.

[0117] In a possible implementation, the feature matching comprises: identifying length matching of the data packets in the window, and / or, identifying transmission direction matching of the data packets in the window.

[0118] The length matching of the data packets comprises: message length matching of an Internet Protocol (IP) layer, message length matching of a Transmission Control Protocol (TCP) layer, message length matching of a User Datagram Protocol (UDP) layer, message length matching of a Transport Layer Security (TLS) layer, message length matching of a Quick UDP Internet Connections (QUIC) layer, or message length matching of an application layer.

[0119] In a possible implementation, the feature matching further comprises: statistical feature matching, and the statistical features comprise: identifying the number of the data packets in the window, identifying the average packet length of the data in the window, identifying the bandwidth occupation of the data in the window, identifying the maximum packet length of the data in the window, and / or, identifying the minimum packet length of the data in the window.

[0120] In a possible implementation, the processing module 1002 is further configured to perform feature matching on the data stream according to the feature matching rule using the set of windows, and determine a feature matching result of the data stream, wherein the feature matching rule is used to indicate the number of the data packets that are not matched in the process of the feature matching, and / or, the positions of the data packets that are not matched in the data stream.

[0121] In a possible implementation,

[0122] The processing module 1002 is further configured to stop the application identification on the data stream when the data stream does not belong to the data stream corresponding to the application type.

[0123] In a possible implementation, the parameter information comprises any one or more of the following:

[0124] The key of the load of the connection, the packet length of the data packet of the connection, the address information of the connection corresponding client, the address information of the connection corresponding server, the key information of the connection corresponding server, the domain name information supported by the server, or the domain name information expected to be accessed by the client, wherein the server and the client establish the connection.

[0125] Referring to FIG. 11, FIG. 11 is a structural schematic diagram of an application identification apparatus 1101 according to an embodiment of the present application. The application identification apparatus 1101 can be the application identification apparatus in the foregoing embodiments. As shown in FIG. 11, the application identification apparatus 1101 includes a processor 1103, and the processor 1103 is coupled with a system bus 1105. The processor 1103 can be one or more processors, and each processor can include one or more processor cores. A video adapter 1107 can drive a display 1109, and the display 1109 is coupled with the system bus 1105. The system bus 1105 is coupled with a bus bridge 2111 and an input / output (I / O) bus. An I / O interface 1126 is coupled with the I / O bus. The I / O interface 1126 communicates with various I / O devices, such as an input device 2117 (e.g., a touch screen), an external storage 2110 (e.g., a hard disk, a floppy disk, an optical disk or a USB (Universal Serial Bus) device), a multimedia interface, etc. A transceiver 1123 (which can send and / or receive radio communication signals) and an external USB port 1125 are also provided. Optionally, the interface connected with the I / O interface 1126 can be a USB interface.

[0126] The processor 1103 can be any conventional processor, including a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor or a combination of the above. Alternatively, the processor can be a special purpose device, such as an ASIC.

[0127] A hard disk drive interface 1131 is coupled with the system bus 1105. A hard disk drive interface and a hard disk drive 1133 are connected. A system memory 1135 is coupled with the system bus 1105. Data running in the system memory 1135 can include an operating system (OS) 1137 of the application identification apparatus 1101, an application program 1143 and a schedule.

[0128] The processor 1103 can communicate with the system memory 1135 through the system bus 1105, fetch instructions and data in the application program 1143 from the system memory 1135, and thus realize the execution of the program.

[0129] The operating system includes a shell 1139 and a kernel 1141. The shell 1139 is an interface between a user and the kernel of the operating system. The shell is the outermost layer of the operating system. The shell manages the interaction between the user and the operating system: waits for the user's input, interprets the user's input to the operating system, and processes various outputs of the operating system.

[0130] The kernel 1141 is composed of those parts of an operating system that manage memory, files, processes, and system resources. The kernel 1141 directly interacts with hardware, and the operating system kernel usually runs processes and provides inter-process communication, provides CPU time-slice management, interrupts, memory management, and IO management, and so on.

[0131] The embodiments of the present application also provide a computer program product, which, when running on a computer, causes the computer to perform the steps performed by the application recognition device or the steps performed by the computing device.

[0132] The embodiments of the present application also provide a computer readable storage medium, which stores a program for signal processing, and when the program runs on a computer, causes the computer to perform the steps performed by the application recognition device or the steps performed by the computing device.

[0133] The application recognition device or the computing device provided by the embodiments of the present application can be a chip, which includes a processing unit, for example, a processor, and a communication unit, for example, an input / output interface, a pin, or a circuit, etc. The processing unit can execute computer execution instructions stored in a storage unit, so that the chip in the application recognition device performs the compiling method described in the above embodiments. Alternatively, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit can also be a storage unit outside the chip in the wireless access device, such as a read-only memory (ROM) or other types of static application recognition devices that can store static information and instructions, a random access memory (RAM), etc.

[0134] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the system, device and unit described above can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0135] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely illustrative. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different units, can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0136] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments of the present application.

[0137] In addition, each functional unit in the embodiments of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware, or in the form of software functional units.

[0138] If the integrated unit is implemented in the form of software functional units and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application essentially or substantially, or all or part of the technical solutions, can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, and various other media that can store program codes.

Claims

1. An application identification method characterized by comprising: The method comprises: obtaining parameter information, the parameter information being used to create a connection, the connection being used to carry a data flow; performing identification processing on the parameter information to determine an application type corresponding to the data flow; performing identification processing on the data flow according to the application type corresponding to the data flow to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data flow, the application action being an action performed by an application.

2. The method of claim 1, wherein, The method further comprises: blocking the connection and / or generating an application identification result of the connection according to the identification result.

3. The method according to claim 1 or 2, characterized in that, The identification processing on the data flow according to the application type corresponding to the data flow to determine the one or more identification results comprises: determining a window set corresponding to the application according to the application type corresponding to the data flow, the window set comprising one or more identification windows, each identification window being used to identify at least one application action; performing feature matching on the data flow using the window set to determine the one or more identification results.

4. The method of claim 3, wherein, The identification window comprises any one or more of: a fixed-size window, a granularity of the fixed-size window comprising a number of data packets, a number of bytes, or a duration of the data flow; or a request-response corresponding window, the request-response corresponding window comprising at least one request and a response corresponding to the request, the request corresponding to one or more data packets in a first direction, and the response corresponding to one or more data packets in a second direction, the first direction being opposite to the second direction; or a sliding window, a size of the sliding window being determined by the data flow identified by the identification window.

5. The method according to claim 3 or 4, characterized in that, The feature matching comprises length matching of data packets in the identification window and / or direction matching of data packets in the identification window. The length matching of data packets comprises Internet Protocol (IP) layer packet length matching, Transmission Control Protocol (TCP) layer packet length matching, User Datagram Protocol (UDP) layer packet length matching, Transport Layer Security (TLS) layer packet length matching, Quick UDP Internet Connections (QUIC) layer packet length matching, or application layer packet length matching.

6. The method according to any one of claims 3-5, characterized in that, The feature matching further comprises statistical feature matching, the statistical features comprising a number of data packets in the identification window, an average packet length of data in the identification window, a bandwidth occupancy of data in the identification window, a maximum packet length of data in the identification window, and / or a minimum packet length of data in the identification window.

7. The method according to any one of claims 3-6, characterized in that, The feature matching on the data flow using the window set to determine the feature matching result of the data flow comprises: performing feature matching on the data flow using the window set according to a feature matching rule to determine the feature matching result of the data flow, the feature matching rule being used to indicate a number of data packets that are not matched in the feature matching process and / or positions of the data packets that are not matched in the data flow.

8. The method according to any one of claims 1-7, characterized in that, After determining the application type corresponding to the data flow according to the parameter information, the method further comprises: When the data stream does not belong to the data stream corresponding to the application type, stopping application identification of the data stream.

9. The method according to any one of claims 1-8, characterized in that, The parameter information includes any one or more of the following: The key of the load carried by the connection, the packet length of the data packet carried by the connection, the address information of the client corresponding to the connection, the address information of the server corresponding to the connection, the key information corresponding to the connection, the domain name information supported by the server, or the domain name information expected to be accessed by the client, wherein the connection is established between the server and the client.

10. An application recognition apparatus characterized by comprising: The device includes a processing module and a transceiver module, and the device includes: The transceiver module is configured to obtain parameter information, wherein the parameter information is used to create a connection, and the connection is used to carry a data stream. The processing module is configured to perform identification processing on the parameter information to determine an application type corresponding to the data stream. The processing module is further configured to perform identification processing on the data stream according to the application type corresponding to the data stream to determine one or more identification results, wherein each identification result indicates at least one application action corresponding to the data stream.

11. The device of claim 10, wherein: The processing module is further configured to block the connection according to the identification result, and / or generate an application identification result of the connection.

12. The device of claim 10 or 11, wherein: The processing module is further configured to determine a window set corresponding to the application according to the application type corresponding to the data stream, wherein the window set includes one or more identification windows, and each identification window is used to identify at least one application action. The processing module is further configured to perform feature matching on the data stream using the window set to determine the one or more identification results.

13. The apparatus of claim 12, wherein, The identification window includes any one or more of the following: A fixed-size window, wherein the granularity of the fixed-size window includes the number of data packets, the number of bytes, or the duration of the data stream. Or, a request-response corresponding window, wherein the request-response corresponding window includes at least one request and a response corresponding to the request, the request corresponds to one or more data packets in a first direction, and the response corresponds to one or more data packets in a second direction, wherein the first direction is opposite to the second direction. Or, a sliding window, wherein the size of the sliding window is determined by the data stream identified by the identification window.

14. The apparatus of claim 12 or 13, wherein, The feature matching includes length matching of data packets in the identification window and / or transmission direction matching of data packets in the identification window. The length matching of data packets includes Internet Protocol (IP) layer packet length matching, Transmission Control Protocol (TCP) layer packet length matching, User Datagram Protocol (UDP) layer packet length matching, Transport Layer Security (TLS) layer packet length matching, Quick UDP Internet Connections (QUIC) layer packet length matching, or application layer packet length matching.

15. The apparatus of any one of claims 12-14, wherein, The feature matching further includes statistical feature matching, and the statistical features include a number of data packets in the identification window, an average packet length of data in the identification window, a bandwidth occupation of data in the identification window, a maximum packet length of data in the identification window, and / or a minimum packet length of data in the identification window.

16. The apparatus of any of claims 12-15, wherein, The processing module is further configured to perform feature matching on the data stream using the window set according to a feature matching rule, and determine a feature matching result of the data stream, the feature matching rule being used to indicate a number of data packets that are not matched in the feature matching process and / or positions of the data packets that are not matched in the data stream.

17. The apparatus of any of claims 10-16, wherein, The processing module is further configured to stop application identification on the data stream when the data stream does not belong to a data stream corresponding to the application type.

18. The apparatus of any one of claims 10-17, wherein, The parameter information includes any one or more of the following: a keyword of a load of the connection, a packet length of a data packet of the connection, address information of a client corresponding to the connection, address information of a server corresponding to the connection, key information corresponding to the connection, domain name information supported by the server, or domain name information expected to be accessed by the client, wherein the connection is established between the server and the client.

19. An application recognition apparatus characterized by comprising: The processor device includes a communication interface and a processor: The communication interface is configured to input and / or output signaling or data. The processor is configured to execute a computer executable program, so that the method in any one of claims 1-9 is executed.

20. A chip, characterized by including: an interface circuit and a processing circuit, the interface circuit and the processing circuit being connected, and the chip being configured to execute the method in any one of claims 1-9.

21. A computer program product, characterised in that, The computer program product stores instructions, which, when executed by a computer, cause the computer to implement the method in any one of claims 1-9.

Images