CN101170460A - A monitoring system and method for network call service - Google Patents
A monitoring system and method for network call service Download PDFInfo
- Publication number
- CN101170460A CN101170460A CNA2007101948463A CN200710194846A CN101170460A CN 101170460 A CN101170460 A CN 101170460A CN A2007101948463 A CNA2007101948463 A CN A2007101948463A CN 200710194846 A CN200710194846 A CN 200710194846A CN 101170460 A CN101170460 A CN 101170460A
- Authority
- CN
- China
- Prior art keywords
- telephone service
- network
- packet
- network telephone
- characteristic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Abstract
The invention discloses a network telephone business monitoring system and a method, so as to carry out the interference of the abnormal VOIP business. The method includes the following steps of: catching the data packets which get in and out of the network of the machine; analyzing the obtained feature data of the data packets; storing and analyzing the feature data; determining whether the machine operates the network telephone business according to the feature data, if yes, the ongoing network telephone business is stopped. The invention realizes the interference for the abnormal VOIP business application and ensures the operation of the normal VOIP business.
Description
Technical field
The present invention relates to VOIP (networking telephone) technology, specifically, relate to a kind of the VOIP business be monitored, then abnormal VOIP service application is disturbed, with the system and method that guarantees that normal VOIP business is carried out.
Background technology
The speech income is the major source of revenues of telecom operators, and voice service is again the most reliable telecommunication service simultaneously.Because the development of broadband networks and VOIP technology, many virtual operators particularly some illegal virtual operators adopt cheap and do not have the marketing strategy of service guarantee, influenced the normal management order of telecommunication market, provide the business that does not have quality assurance to the user, greatly impacted normal Service Market.Telecom operators need monitor the VOIP business technically for self interests of protection, sometimes even need forbid and disturbs the VOIP business, accept to be provided the loss of serving and bringing such as illegal virtual operator to avoid the user to be subjected to.
The monitoring of present VOIP and interference, the general method that adopts passive fiber splitter or Port Mirroring, tell one road signal or packet and give special VOIP supervisory control system, analyze and handle by this supervisory control system then, finish monitoring and interference the VOIP service.But this method at first needs a special equipment as supervisory control system, secondly by splitter or Port Mirroring extraction of signal or packet, all can waste certain Internet resources.
Therefore, be necessary the monitoring technique of VOIP is improved, with the demand of adaptive technique development and customer service.
Summary of the invention
Technical problem to be solved by this invention is to be to provide a kind of network telephone service supervisory control system and method, so that abnormal VOIP service application is disturbed.
In order to solve the problems of the technologies described above, the invention provides the network telephone service supervisory control system, comprising:
Network interface card packet capturing engine is used to grasp the packet that debouches native network;
The data packet analysis module is used to analyze described packet and obtains characteristic;
The data packet queue module is used for the described characteristic of inventory analysis;
Networking telephone detection module is used for determining that according to described characteristic whether this machine is just at the operational network telephone service, if then stop ongoing network telephone service.
In the network telephone service supervisory control system of the above, described network interface card packet capturing engine can grasp described packet on this machine network interface card drives.
In the network telephone service supervisory control system of the above, described network interface card packet capturing engine captured packets can comprise the packet that is sent to this machine network interface card from external network, and the packet that sends to external network by this machine network interface card.
In the network telephone service supervisory control system of the above, described characteristic can comprise the User Datagram Protoco (UDP) port numbers for H.323, the packet of the usual end slogan of MGCP, session initiation protocol, and the two-way RTP stream that is encapsulated in the User Datagram Protoco (UDP) bag.
In the network telephone service supervisory control system of the above, the inventory analysis of described data packet queue module can comprise the data structure according to default feature rule, and described characteristic classification is stored in the data structure formation.
Further, can after characteristic reaches described amount threshold, described characteristic be mated, if coupling then determine that this machine is just at the operational network telephone service fully for described data structure formation predetermined number threshold value according to the feature rule.
In the network telephone service supervisory control system of the above, described networking telephone detection module stops ongoing network telephone service, can comprise the cut-out network telephone service, perhaps increases noise in the network telephone service speech stream.
The present invention also provides a kind of network telephone service method for supervising, comprising:
Extracting debouches the packet of native network;
Analyze described packet and obtain characteristic;
The described characteristic of inventory analysis;
Determine that according to described characteristic whether this machine is just at the operational network telephone service, if then stop ongoing network telephone service.
In the above-mentioned network telephone service method for supervising, described packet can grasp on this machine network interface card drives.
In the above-mentioned network telephone service method for supervising, described packet can comprise the packet that is sent to this machine network interface card from external network, and the packet that sends to external network by this machine network interface card.
In the above-mentioned network telephone service method for supervising, described characteristic, can comprise the User Datagram Protoco (UDP) port numbers for H.323, the packet of the usual end slogan of MGCP, session initiation protocol, and the two-way RTP stream that is encapsulated in the User Datagram Protoco (UDP) bag.
In the above-mentioned network telephone service method for supervising, the described characteristic of described inventory analysis can comprise the data structure according to default feature rule, and described characteristic classification is stored in the data structure formation.
Further, can after characteristic reaches described amount threshold, described characteristic be mated, if coupling then determine that this machine is just at the operational network telephone service fully for described data structure formation predetermined number threshold value according to the feature rule.
In the above-mentioned network telephone service method for supervising, the ongoing network telephone service of described prevention can comprise the cut-out network telephone service, perhaps increases noise in the network telephone service speech stream.
The present invention has realized abnormal VOIP service application is disturbed, and has guaranteed the carrying out of normal VOIP business.
Description of drawings
Fig. 1 is a VOIP detection system example structure schematic diagram of the present invention.
Fig. 2 is a VOIP detection method embodiment schematic flow sheet of the present invention.
Embodiment
Describe embodiments of the present invention in detail below with reference to drawings and Examples, how the application technology means solve technical problem to the present invention whereby, and the implementation procedure of reaching technique effect can fully understand and implements according to this.
VOIP detection system of the present invention obtains packet by the program package of increasing income such as for example winpcap on network interface card drives, realize the measuring ability of VOIP not influencing the normal operation of whole computer system in the application layer of computer system.
As shown in Figure 1, VOIP detection system of the present invention comprises:
Network interface card packet capturing engine 10 is used to grasp all particular data packet that native network passes in and out;
Described particular data packet comprises from external network being sent to network interface card and application system send to external network by network interface card packet;
Data packet analysis module 20 links to each other with network interface card packet capturing engine 10, is used to analyze the particular data packet of extracting, and obtains characteristic;
Described characteristic, comprise UDP (User Datagram Protocol, User Datagram Protoco (UDP)) port numbers be H.323, the packet of three kinds of agreement usual end slogans of MGCP (MGCP), SIP (session initiation protocol), and the two-way RTP (Real-TimeTransport Protocol, RTP) that is encapsulated in the UDP bag flows;
Data packet queue module 30 links to each other with data packet analysis module 20, is used for the characteristic that inventory analysis is obtained;
Described inventory analysis mainly is meant data structure according to default feature rule (packet head: MAC, IP, udp port number etc.; Data division: the Partial Feature data of extraction), characteristic is classified, and store in the data structure formation of corresponding packet;
VOIP detection module 40 links to each other with data packet queue module 30, and the VOIP that is used for setting in advance detects rule, determines whether to move the VOIP business, and handles according to predetermined processing policy according to testing result; If do not detect the VOIP business of operation, then empty all intermediate storage; Move if detected the VOIP business, then stop this VOIP business, call out, perhaps in speech stream, insert and disturb UDP to wrap to VOIP conversation increase noise such as cut off illegal VOIP according to strategy.
After the quantity of the characteristic in the data packet queue reaches predetermined threshold values, VOIP detection module 40 is from the data structure formation, extract data structure element, carry out the data characteristics coupling according to the feature rule, if data characteristics (packet head feature and data division feature) is mated fully, then explanation has the VOIP business to move, and handles according to predetermined processing policy; If not exclusively coupling then illustrates and do not carry out the VOIP business, proceed the detection of VOIP.Threshold values wherein is in order to improve the precision of detection, to analyze after reaching reservation threshold again, can preventing because the erroneous judgement that a small amount of wrong bag causes.
As shown in Figure 2, VOIP detection method of the present invention may further comprise the steps:
Strategy comprises following content: at first be directly to eject a warning message, inform that the user please don't continue to use the VOIP business; If surpass a specified time (such as 1 minute etc.) afterwards in warning, the user is also continuing the VOIP business, then insert in speech stream and disturb UDP to wrap to VOIP conversation increase noise, and user's request is abandoned in proportion, the IP connection of its VOIP will can not get ensureing.If last user continues to use the VOIP business, its all-network request is abandoned, make it can't successfully connect network.
Compared with prior art, the present invention has following characteristics:
Fundamental nature from VOIP, the situation that misinterpretation can occur and fail to judge not: detection system can be relatively easy to differentiate for the VOIP system that has used normal protocol port, and for the VOIP system that has adopted non-standard ports, this detection system is considered what actual VOIP session all was made up of two-way RTP (the Real-Time Transport Protocol) stream that is encapsulated in the UDP bag, and the base communications protocol that all VOIP systems adopt is constant, the meeting data portion is also discerned and is decoded when data characteristics is judged, thereby guarantees also can effectively detect the VOIP system that uses proprietary protocol.
Though the disclosed execution mode of the present invention as above, described content is the listed examples for the ease of understanding the present invention just, is not in order to limit the present invention.Technical staff in any the technical field of the invention; under the prerequisite that does not break away from the disclosed spirit and scope of the present invention; can do a little change and retouching what implement in form and on the details; but scope of patent protection of the present invention, still must with appending claims the person of being defined be as the criterion.
Claims (14)
1. a network telephone service supervisory control system is characterized in that, comprising:
Network interface card packet capturing engine is used to grasp the packet that debouches native network;
The data packet analysis module is used to analyze described packet and obtains characteristic;
The data packet queue module is used for the described characteristic of inventory analysis;
Networking telephone detection module is used for determining that according to described characteristic whether this machine is just at the operational network telephone service, if then stop ongoing network telephone service.
2. network telephone service supervisory control system as claimed in claim 1 is characterized in that:
Described network interface card packet capturing engine grasps described packet on this machine network interface card drives.
3. network telephone service supervisory control system as claimed in claim 1 is characterized in that:
Described network interface card packet capturing engine captured packets comprises the packet that is sent to this machine network interface card from external network, and the packet that sends to external network by this machine network interface card.
4. network telephone service supervisory control system as claimed in claim 1 is characterized in that:
Described characteristic, comprise the User Datagram Protoco (UDP) port numbers for H.323, the packet of the usual end slogan of MGCP, session initiation protocol, and the two-way RTP stream that is encapsulated in the User Datagram Protoco (UDP) bag.
5. network telephone service supervisory control system as claimed in claim 1 is characterized in that:
The inventory analysis of described data packet queue module comprises the data structure according to default feature rule, and described characteristic classification is stored in the data structure formation.
6. network telephone service supervisory control system as claimed in claim 5 is characterized in that:
For described data structure formation predetermined number threshold value, after characteristic reaches described amount threshold, described characteristic is mated, if coupling then determine that this machine is just at the operational network telephone service fully according to the feature rule.
7. network telephone service supervisory control system as claimed in claim 1 is characterized in that:
Described networking telephone detection module stops ongoing network telephone service, comprises the cut-out network telephone service, perhaps increases noise in the network telephone service speech stream.
8. a network telephone service method for supervising is characterized in that, comprising:
Extracting debouches the packet of native network;
Analyze described packet and obtain characteristic;
The described characteristic of inventory analysis;
Determine that according to described characteristic whether this machine is just at the operational network telephone service, if then stop ongoing network telephone service.
9. network telephone service method for supervising as claimed in claim 8 is characterized in that:
Described packet grasps on this machine network interface card drives.
10. network telephone service method for supervising as claimed in claim 8 is characterized in that:
Described packet comprises the packet that is sent to this machine network interface card from external network, and the packet that sends to external network by this machine network interface card.
11. network telephone service method for supervising as claimed in claim 8 is characterized in that:
Described characteristic, comprise the User Datagram Protoco (UDP) port numbers for H.323, the packet of the usual end slogan of MGCP, session initiation protocol, and the two-way RTP stream that is encapsulated in the User Datagram Protoco (UDP) bag.
12. network telephone service method for supervising as claimed in claim 8 is characterized in that:
The described characteristic of described inventory analysis comprises the data structure according to default feature rule, and described characteristic classification is stored in the data structure formation.
13. network telephone service method for supervising as claimed in claim 12 is characterized in that:
For described data structure formation predetermined number threshold value, after characteristic reaches described amount threshold, described characteristic is mated, if coupling then determine that this machine is just at the operational network telephone service fully according to the feature rule.
14. network telephone service method for supervising as claimed in claim 8 is characterized in that:
The ongoing network telephone service of described prevention comprises the cut-out network telephone service, perhaps increases noise in the network telephone service speech stream.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNA2007101948463A CN101170460A (en) | 2007-11-27 | 2007-11-27 | A monitoring system and method for network call service |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNA2007101948463A CN101170460A (en) | 2007-11-27 | 2007-11-27 | A monitoring system and method for network call service |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101170460A true CN101170460A (en) | 2008-04-30 |
Family
ID=39390939
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNA2007101948463A Pending CN101170460A (en) | 2007-11-27 | 2007-11-27 | A monitoring system and method for network call service |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101170460A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102340454A (en) * | 2011-11-10 | 2012-02-01 | 中国人民解放军重庆通信学院 | General identification method of VoIP (voice over Internet protocol) network data stream |
| CN102402215A (en) * | 2010-09-09 | 2012-04-04 | 费希尔-罗斯蒙特系统公司 | Methods and apparatus to collect process control data |
-
2007
- 2007-11-27 CN CNA2007101948463A patent/CN101170460A/en active Pending
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102402215A (en) * | 2010-09-09 | 2012-04-04 | 费希尔-罗斯蒙特系统公司 | Methods and apparatus to collect process control data |
| CN102340454A (en) * | 2011-11-10 | 2012-02-01 | 中国人民解放军重庆通信学院 | General identification method of VoIP (voice over Internet protocol) network data stream |
| CN102340454B (en) * | 2011-11-10 | 2017-10-31 | 中国人民解放军重庆通信学院 | A kind of universal identification method of voip network data flow |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9531782B2 (en) | Dynamic management of collaboration sessions using real-time text analytics | |
| CN100428688C (en) | Protective method for network attack | |
| EP2084854B1 (en) | Media session identification method for ip networks | |
| US20090109858A1 (en) | Communication Quality Determining Apparatus, Communication Quality Determining Method and Its Program | |
| CN101022343B (en) | Network invading detecting/resisting system and method | |
| CN102164053A (en) | Network fault detection system | |
| CN103139315A (en) | Application layer protocol analysis method suitable for home gateway | |
| KR101329263B1 (en) | Network-based data traffic detection and control | |
| CN101022404A (en) | Management communication system | |
| CN101399749A (en) | Method, system and device for packet filtering | |
| CN105991637A (en) | Network attack protection method and network attack protection device | |
| CN107743228A (en) | Video quality detection method, monitoring device and storage medium | |
| CN101645778B (en) | Network service flow identification system and identification method thereof | |
| CN101072174A (en) | Tencent voice identifying method based on pay load deep detection and session correlating technology | |
| CN101321097A (en) | Tencent network living broadcast business recognition method based on payload depth detection | |
| CN1992650B (en) | Method for detecting calling continuity of IP packet carrying network | |
| EP1881641B1 (en) | A method for implementing online maintenance in the communication network | |
| CN101170460A (en) | A monitoring system and method for network call service | |
| US8725901B2 (en) | Analysis tool for intra-node application messaging | |
| CN107210969B (en) | Data processing method based on software defined network and related equipment | |
| JP2009053969A (en) | Service providing system, filtering device, filtering method and message confirmation method | |
| CN107846520A (en) | single-pass detection method and device | |
| CN101826991A (en) | Method and system for identifying illegal data packet | |
| KR20100058964A (en) | Apparatus for blocking voip spam using spam index | |
| US10979556B2 (en) | Detecting and reporting user triggered call drops |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Open date: 20080430 |