Protocol Identification via Tuple-Based Algorithm Lookup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current protocol identification methods are inefficient due to the need to scan all protocols, leading to low precision and high error rates, especially in networks with port multiplexing, where a single IP address and port pair can be used for different services.
Innovation Solution
A method that extracts an identification tuple from a message, including a network address and optionally a port and transport layer protocol, searches an identification table for a corresponding algorithm application list, and performs content identification to determine the protocol type, reducing the need for scanning all protocols and improving precision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all protocols are scanned using polling or pattern matching methods, then protocol identification coverage is comprehensive, but identification efficiency is low
Solution Approach 1:
The patent pre-establishes an association table mapping IP addresses and port pairs to service types before actual protocol identification occurs. When a data stream arrives, the system performs a direct lookup in this pre-built table rather than scanning all protocols, thus performing the identification work in advance and eliminating the need for comprehensive protocol scanning during runtime.
Solution Approach 2:
The patent creates a simplified copy of protocol identification information in the form of an association table that maps network identifiers (IP address and port pair) to service types. This copy allows for rapid lookup without requiring the full protocol scanning process, achieving fast identification while maintaining coverage for commonly used services.
2Productivity
If IP address and port pair are used to determine service type, then identification speed is improved, but identification precision deteriorates due to port multiplexing
Solution Approach 1:
The patent segments the protocol identification process into two stages: first, quickly determine the service type using IP address and port pair lookup in the association table; second, if needed, perform more detailed protocol analysis. This segmentation allows the system to achieve fast identification for most cases while maintaining the ability to handle complex scenarios requiring higher precision.
Solution Approach 2:
The patent changes the identification parameters from comprehensive protocol scanning to a hierarchical approach: start with coarse-grained parameters (IP address and port pair) for rapid lookup, then escalate to finer-grained parameters (detailed protocol analysis) only when the initial lookup is insufficient or ambiguous, thus adapting parameter granularity to the specific identification needs.
3Reliability
If comprehensive protocol scanning is performed, then identification coverage is maintained, but time consumption increases
Solution Approach 1:
The patent pre-establishes an association table mapping IP addresses and port pairs to service types before actual protocol identification occurs. When a data stream arrives, the system performs a direct lookup in this pre-built table rather than scanning all protocols, thus performing the identification work in advance and eliminating the need for comprehensive protocol scanning during runtime.
Solution Approach 2:
The patent applies partial action by using only the necessary subset of identification information (IP address and port pair) from the association table for most identification cases, rather than performing excessive comprehensive protocol scanning. This partial approach suffices for the majority of scenarios, significantly reducing time consumption while maintaining adequate coverage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The embodiments of the present invention disclose a method, an apparatus and a system for protocol identification. The implementation of the method includes extracting the identification tuple of a message, wherein the identification tuple at least includes a network address; searching an identification table for the algorithm application list corresponding to the identification tuple; and performing a content identification for the message with an algorithm in the algorithm application list to obtain the protocol type of the message. By using the identification tuple which at least includes IP address and is extracted from the message to search for the corresponding algorithm, and then performing content identification for the message with the searched algorithm, the above implementation can improve the message identification precision and reduce the identification error.