CN103731416B - A kind of protocol recognition method based on network traffics and system - Google Patents
A kind of protocol recognition method based on network traffics and system Download PDFInfo
- Publication number
- CN103731416B CN103731416B CN201310676369.XA CN201310676369A CN103731416B CN 103731416 B CN103731416 B CN 103731416B CN 201310676369 A CN201310676369 A CN 201310676369A CN 103731416 B CN103731416 B CN 103731416B
- Authority
- CN
- China
- Prior art keywords
- network
- network flow
- flow
- identified
- traffics
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a kind of protocol recognition method based on network traffics, method includes pre-setting grader, performs following steps: S1. and extracts and store the bag long value of its front 3 net bags from network flow to be identified；S2. the bag long value of front 3 net bags of network flow to be identified is inputted to grader, draw the object type of network flow to be identified；If the object type of network flow the most to be identified is big flow object, then perform step S4, if the object type of network flow to be identified is low discharge object, then perform step S5；S4. the network flow to big flow object, carries out fine-grained network traffics protocol identification based on net payload package；S5. the network flow to low discharge object, carries out the network traffics protocol identification of coarseness based on port.The method improves the throughput of network traffics protocol identification.
Description
Technical field
The present invention relates to technical field of the computer network, be specifically related to a kind of based on network traffics
Protocol recognition method and system.
Background technology
Developing rapidly along with the Internet, various Networks continue to bring out, and the Internet is being given birth to
Acting in product, life and day by day strengthening, the information security issue that we are faced also becomes increasingly conspicuous.
The identification of network traffics agreement, on the one hand contributing to Internet Service Provider provides more preferable data
Transmission service, thus effectively ensure main flow internet, applications；On the other hand, be conducive to more preferably
Management network, the reliable and safety of Logistics networks, solve closely related with various network applications
Problem.Network traffics protocol identification, also referred to as application-level protocol identification or net flow assorted,
Purpose is to identify the application layer protocol type that on network link, the flow of transmission is used.Along with
Internet bandwidth and business demand growing, to network traffics protocol identification speed and identification
Accuracy rate is had higher requirement.
At present, the recognition methods of network traffics agreement is mostly that fine granularity based on net payload package is known
Other method, the method is goed deep into net payload package and is carried out checking identification, therefore can effectively provide net
Protocol information belonging to network flow.
Going deep into net payload package yet with it to check, required time is longer, at express network
Under the conditions of, it is difficult to meet the demand of the network bandwidth.
Summary of the invention
For the deficiencies in the prior art, the present invention provide a kind of network traffics protocol recognition method and
System, it is possible to realize the network traffics protocol identification of high-throughput.
For achieving the above object, the present invention is achieved by the following technical programs:
A kind of protocol recognition method based on network traffics, the method includes pre-setting grader,
Execution following steps:
S1. from network flow to be identified, extract and store the bag long value of its front 3 net bags；
S2. the bag long value of front 3 net bags of network flow to be identified is inputted to grader, draw and treat
Identify the object type of network flow；
If the object type of network flow the most to be identified is big flow object, then perform step S4,
If the object type of network flow to be identified is low discharge object, then perform step S5；
S4. the network flow to big flow object, carries out fine-grained network traffics based on net payload package
Protocol identification；
S5. the network flow to low discharge object, carries out the network traffics agreement of coarseness based on port
Identify.
Wherein, pre-set grader described in include:
Choose the network flow of default bar number, record the bag long value of front 3 net bags of every network flow
With network flow byte length；
According to every network flow byte length, draw the total byte length of network flow relative to network
The cumulative distribution table of flow amount, calculates in cumulative distribution table the flat of network flow length near flex point
Average, is set as threshold value by this meansigma methods；
According to threshold value, network flow is divided into big flow object and two kinds of object class of low discharge object
Type；
The bag long value wrapped by front 3 nets of every network flow and the object type of network flow are as instruction
Practice sample, utilize training sample Training Support Vector Machines model, obtain grader.
Wherein, described supporting vector machine model realizes based on the LibSVM increased income.
Wherein, described step S4 carries out fine-grained network traffics agreement based on net payload package to know
The OpenDPI procotol storehouse increased income according to Bie carries out the protocol identification of network traffics.
Wherein, carrying out the network traffics protocol identification of coarseness based on port in described step S5 is
Network flow is carried out according to the standard port number that Internet Assigned Numbers Authority specifies
The protocol identification of amount.
A kind of protocol identification system based on network traffics, this system includes:
Grader arranges module, is used for pre-setting grader；
Characteristic extracting module, for extracting and store its front 3 nets from network flow to be identified
The bag long value of bag；
Sort module, is used for the bag long values input of front 3 net bags of network flow to be identified to dividing
Class device, draws the object type of network flow to be identified；
Scheduler module, for the object type according to network flow to be identified, by network to be identified
Stream is dispatched to corresponding module, if particularly as follows: the object type of network flow to be identified is big flow
Object, then be dispatched to fine granularity identification module by network flow to be identified, if network flow to be identified
Object type be low discharge object, then network flow to be identified is dispatched to coarseness identification mould
Block；
Fine granularity identification module, for the network flow to big flow object, enters based on net payload package
The fine-grained network traffics protocol identification of row；
Coarseness identification module, for the network flow to low discharge object, is carried out slightly based on port
The network traffics protocol identification of granularity.
Wherein, described grader arranges module and includes:
Choose network flow unit, for choosing the network flow of default bar number, record every network
The bag long value of front 3 net bags of stream and network flow byte length；
Draw cumulative distribution table subelement, for according to every network flow byte length, draw net
The total byte length of network stream is relative to the cumulative distribution table of network flow number；
Threshold value sets subelement, for calculating in cumulative distribution table the network flow length near flex point
Meansigma methods, this meansigma methods is set as threshold value；
Network flow object type judgment sub-unit, for being divided into big stream according to threshold value by network flow
Amount object and two kinds of object types of low discharge object；
Training sample subelement is set, for the bag long value by front 3 net bags of every network flow
It is set to training sample with the object type of network flow；
Training subelement, is used for utilizing training sample Training Support Vector Machines model, is classified
Device.
Wherein, described grader arranges the support vector machine mould described in the training subelement of module
Type realizes based on the LibSVM increased income.
Wherein, carry out fine-grained based on net payload package described in described fine granularity identification module
The OpenDPI procotol storehouse increased income according to network traffics protocol identification carries out network traffics
Protocol identification.
Wherein, the network carrying out coarseness based on port described in described coarseness identification module
Flow protocol is identified as the normal end specified according to Internet Assigned Numbers Authority
Slogan carries out the protocol identification of network traffics.
The present invention has a following beneficial effect:
Owing to the network flow of network medium-small flow object accounts for a big chunk of whole network flow, and
For low discharge object network flow utilize protocol identification based on net payload package compare waste time
Between, therefore the present invention utilizes grader to be classified different network flows, according to classification knot
The network flow of big flow object is utilized and carries out fine-grained network traffics association based on net payload package by fruit
View identifies, the network flow of low discharge object utilizes the network traffics carrying out coarseness based on port
Protocol identification, the shortest owing to carrying out the network traffics protocol identification of coarseness based on port,
Thus in the case of ensureing that accuracy of identification is basically unchanged, compared to overall network fluently being used base
Carry out fine-grained network traffics protocol identification in net payload package, significantly improve gulping down of identification
Tell rate, effectively answer the demand of the right high network bandwidth.
Accompanying drawing explanation
In order to be illustrated more clearly that the embodiment of the present invention or technical scheme of the prior art, below
The accompanying drawing used required in embodiment or description of the prior art will be briefly described, aobvious and
Easily insight, the accompanying drawing in describing below is some embodiments of the present invention, common for this area
From the point of view of technical staff, on the premise of not paying creative work, it is also possible to according to these accompanying drawings
Obtain other accompanying drawing.
Fig. 1 is the flow chart of network traffics protocol recognition method in the embodiment of the present invention 1；
Fig. 2 is the flow chart of network traffics protocol recognition method in the embodiment of the present invention 2；
Fig. 3 is the structural representation of network traffics protocol identification system in the embodiment of the present invention 3.
Detailed description of the invention
For making the purpose of the embodiment of the present invention, technical scheme and advantage clearer, below will knot
Close the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clear,
Complete description, it is clear that described embodiment be a part of embodiment of the present invention rather than
Whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art are not having
Make the every other embodiment obtained under creative work premise, broadly fall into present invention protection
Scope.
Embodiment 1
The embodiment of the present invention proposes a kind of protocol recognition method based on network traffics, sees figure
1, the method includes pre-setting grader, then performs following steps:
Step 101: the bag extracting and storing its front 3 net bags from network flow to be identified is long
Value.
Step 102: the bag long value of front 3 net bags of network flow to be identified is inputted to grader,
Draw the object type of network flow to be identified.
Step 103: whether the object type judging network flow to be identified is big flow object, if
Then perform step 104, otherwise, perform step 105.
Step 104: the network flow to big flow object, carries out fine-grained net based on net payload package
Network flow protocol identification.
Step 105: the network flow to low discharge object, carries out the network flow of coarseness based on port
Amount protocol identification.
Visible, in embodiments of the present invention, utilize grader different network flows to be carried out point
Class, carries out particulate to the network flow employing of big flow object based on net payload package according to classification results
The network traffics protocol identification of degree, uses recognition rate higher the network flow of low discharge object
Carry out the network traffics protocol identification of coarseness based on port, thus ensureing that accuracy of identification is basic
In the case of constant, carry out fine-grained net compared to overall network stream is all based on net payload package
Network flow protocol identification, significantly improves the throughput of identification, effectively should right high network
The demand of bandwidth.
Embodiment 2:
Below by a specific example, come one of the more detailed description present invention preferably
Embodiment realize process.Seeing Fig. 2, this process comprises the steps:
Step 201: choose the network flow of default bar number, records front 3 net bags of every network flow
Bag long value and network flow byte length.
In this step, randomly selecting the network flow of default bar number, such as presetting bar number is 1000
Bar, wherein these 1000 network flows are different network type and/or the network of heterogeneous networks period
Stream.
Step 202: according to every network flow byte length, draw the total byte length phase of network flow
Cumulative distribution table for network flow number.
In this step, the total byte length accumulation relative to network flow number of network flow is drawn
Scattergram, such as presetting bar number is 1000, the first byte long to these 1000 network flows
Degree is arranged by ascending order, and when drawing cumulative distribution table, abscissa represents by byte length ascending sort
Whole preset network flow, vertical coordinate represents total word of every the network flow byte length that adds up successively
Joint length value.
Step 203: calculate in cumulative distribution table the meansigma methods of network flow length near flex point, will
This meansigma methods is set as threshold value.
In this step, flex point refers to the point that on integral distribution curve, gradient change rate is maximum.Meter
When calculating threshold value, the first ascending order at network flow is adjacent before and after taking network flow corresponding to flex point in arranging
A part of network flow, be weighted its byte length value averagely, then this meansigma methods being set
It is set to threshold value.
Step 204: according to the object type of threshold determination every the network flow set.
In this step, if the byte length of network flow is more than threshold value, the then object of network flow
Type is big flow object；Otherwise, the object type of network flow is low discharge object.
Step 205: by bag long value and the object class of network flow of front 3 net bags of every network flow
Type is set to training sample.
In this step, it is set as training sample by the bag long value of front 3 net bags of every network flow
This feature, is set as the label of training sample, whole training by the object type of network flow
Sample classifier training in step 206.
Step 206: utilize training sample Training Support Vector Machines model, obtain grader.
In this step, described supporting vector machine model realizes based on the LibSVM increased income, root
The training sample obtained according to step 205, Training Support Vector Machines model, use LibSVM's
Parameter optimization function, obtains the grader with higher recognition accuracy.
Step 207: extract and store the bag long value of its front 3 net bags from network flow to be identified.
In this step, for network flow to be identified, its front 3 net bags are extracted from which
Bag long value, and by storage.
Step 208: the bag long value of front 3 net bags of network flow to be identified is inputted to grader,
Draw the object type of network flow to be identified.
In this step, by front 3 net bags of the network flow to be identified of storage in step 207
Bag long value is input in the grader that step 206 obtains, and grader will export network flow to be identified
Object type: big flow object or low discharge object.
Step 209: whether the object type judging network flow to be identified is big flow object, if
Then perform step 210, otherwise, perform step 211.
Step 210: the network flow to big flow object, carries out fine-grained net based on net payload package
Network flow protocol identification.
In this step, described fine-grained network traffics protocol identification is carried out based on net payload package
According to the OpenDPI procotol storehouse increased income carry out the protocol identification of network traffics
Step 211: the network flow to low discharge object, carries out the network flow of coarseness based on port
Amount protocol identification.
In this step, the described network traffics protocol identification carrying out coarseness based on port is root
According to IANA(Internet Assigned Numbers Authority) standard port number that specifies carries out
The protocol identification of network traffics, such as IANA specify that the network flow that destination slogan is 80 belongs to
Http protocol flow.
Visible, in embodiments of the present invention, first with randomly selecting a number of network flow,
These network flow byte lengths randomly selected are utilized to draw cumulative distribution table, from cumulative distribution table
The middle threshold value determining network flow byte length, then utilizes threshold value to flow to the network randomly selected
Row object type divides, and different network flows is divided into big flow object and low discharge object.
The bag long value wrapped by front 3 nets of every network flow and the object type of every network flow are as instruction
Practice sample, utilize training sample Training Support Vector Machines model, then obtain grader.
The present invention utilize the grader obtained different network flows is classified, according to dividing
The network flow of big flow object is utilized and carries out fine-grained network flow based on net payload package by class result
Amount protocol identification, utilizes the network carrying out coarseness based on port to the network flow of low discharge object
Flow protocol identification, thus in the case of ensureing that accuracy of identification is basically unchanged, compared to entirely
Portion's network flow all utilizes and carries out fine-grained network traffics protocol identification based on net payload package, significantly
Degree improves the throughput of identification, effectively answers the demand of the right high network bandwidth.
Embodiment 3
The embodiment of the present invention proposes a kind of protocol identification system based on network traffics, sees figure
3, this system includes:
Grader arranges module 301, is used for pre-setting grader；
Characteristic extracting module 302, for extract from network flow to be identified and store its front 3
The bag long value of individual net bag；
Sort module 303, for inputting the bag long value of front 3 net bags of network flow to be identified extremely
Grader, draws the object type of network flow to be identified；
Scheduler module 304, for the object type according to network flow to be identified, by net to be identified
Network stream is dispatched to corresponding module, if particularly as follows: the object type of network flow to be identified is big stream
Amount object, then be dispatched to fine granularity identification module by network flow to be identified, if network to be identified
The object type of stream is low discharge object, then network flow to be identified is dispatched to coarseness identification
Module；
Fine granularity identification module 305, for the network flow to big flow object, based on net payload package
Carry out fine-grained network traffics protocol identification；
Coarseness identification module 306, for the network flow to low discharge object, is carried out based on port
The network traffics protocol identification of coarseness.
Described grader arranges module 301 and includes:
Choose network flow unit 3010, for choosing the network flow of default bar number, record every
The bag long value of front 3 net bags of network flow and network flow byte length；
Draw cumulative distribution table subelement 3011, for according to every network flow byte length, paint
The total byte length of network flow processed is relative to the cumulative distribution table of network flow number；
Threshold value sets subelement 3012, for calculating in cumulative distribution table the network flow near flex point
The meansigma methods of length, is set as threshold value by this meansigma methods；
Network flow object type judgment sub-unit 3013, for being divided into network flow according to threshold value
Big flow object and two kinds of object types of low discharge object；
Training sample subelement 3014 is set, for the bag by front 3 net bags of every network flow
The object type of long value and network flow is set to training sample；
Training subelement 3015, is used for utilizing training sample Training Support Vector Machines model, obtains
Grader.
Wherein, described grader arranges the support vector machine mould described in the training subelement of module
Type realizes based on the LibSVM increased income.
Wherein, carry out fine-grained based on net payload package described in described fine granularity identification module
The OpenDPI procotol storehouse increased income according to network traffics protocol identification carries out network traffics
Protocol identification.
Wherein, the network carrying out coarseness based on port described in described coarseness identification module
Flow protocol is identified as the normal end specified according to Internet Assigned Numbers Authority
Slogan carries out the protocol identification of network traffics.
Owing to the network flow of network medium-small flow object accounts for a big chunk of whole network flow, and
Network flow for low discharge object utilizes protocol recognition method based on net payload package to compare waste
Time and effect are general, therefore utilize grader to carry out different network flows point in the present invention
Class, carries out particulate to the network flow utilization of big flow object based on net payload package according to classification results
The network traffics protocol identification of degree, the network flow utilization to low discharge object is carried out slightly based on port
The network traffics protocol identification of granularity, thus in the case of ensureing that accuracy of identification is basically unchanged,
The knowledge of fine-grained network traffics agreement is carried out compared to overall network stream being all based on net payload package
Not, significantly improve the throughput of identification, effectively answer the demand of the right high network bandwidth
Above example is merely to illustrate technical scheme, is not intended to limit；Although
With reference to previous embodiment, the present invention is described in detail, those of ordinary skill in the art
It is understood that the technical scheme described in foregoing embodiments still can be modified by it,
Or wherein portion of techniques feature is carried out equivalent；And these amendments or replacement, do not make
The essence of appropriate technical solution departs from the spirit and scope of various embodiments of the present invention technical scheme.
Claims (8)
1. a protocol recognition method based on network traffics, it is characterised in that the method includes
Pre-set grader, execution following steps:
S1. from network flow to be identified, extract and store the bag long value of its front 3 net bags；
S2. the bag long value of front 3 net bags of network flow to be identified is inputted to grader, draw and treat
Identify the object type of network flow；
If the object type of network flow the most to be identified is big flow object, then perform step S4,
If the object type of network flow to be identified is low discharge object, then perform step S5；
S4. the network flow to big flow object, carries out fine-grained network traffics based on net payload package
Protocol identification；
S5. the network flow to low discharge object, carries out the network traffics agreement of coarseness based on port
Identify；
Wherein, pre-set grader described in include:
Choose the network flow of default bar number, record the bag long value of front 3 net bags of every network flow
With network flow byte length；
According to every network flow byte length, draw the total byte length of network flow relative to network
The cumulative distribution table of flow amount, calculates in cumulative distribution table the flat of network flow length near flex point
Average, is set as threshold value by this meansigma methods；
According to threshold value, network flow is divided into big flow object and two kinds of object class of low discharge object
Type；
The bag long value wrapped by front 3 nets of every network flow and the object type of network flow are as instruction
Practice sample, utilize training sample Training Support Vector Machines model, obtain grader.
Method the most according to claim 1, it is characterised in that described support vector machine mould
Type realizes based on the LibSVM increased income.
Method the most according to claim 1, it is characterised in that base in described step S4
The OpenDPI net increased income according to net payload package carries out fine-grained network traffics protocol identification
Network protocol library carries out the protocol identification of network traffics.
Method the most according to claim 1, it is characterised in that base in described step S5
The network traffics protocol identification of coarseness is carried out for according to Internet Assigned in port
The standard port number that Numbers Authority specifies carries out the protocol identification of network traffics.
5. a protocol identification system based on network traffics, it is characterised in that this system includes:
Grader arranges module, is used for pre-setting grader；
Characteristic extracting module, for extracting and store its front 3 nets from network flow to be identified
The bag long value of bag；
Sort module, is used for the bag long values input of front 3 net bags of network flow to be identified to dividing
Class device, draws the object type of network flow to be identified；
Scheduler module, for the object type according to network flow to be identified, by network to be identified
Stream is dispatched to corresponding module, if particularly as follows: the object type of network flow to be identified is big flow
Object, then be dispatched to fine granularity identification module by network flow to be identified, if network flow to be identified
Object type be low discharge object, then network flow to be identified is dispatched to coarseness identification mould
Block；
Fine granularity identification module, for the network flow to big flow object, enters based on net payload package
The fine-grained network traffics protocol identification of row；
Coarseness identification module, for the network flow to low discharge object, is carried out slightly based on port
The network traffics protocol identification of granularity；
Wherein, described grader arranges module and includes:
Choose network flow unit, for choosing the network flow of default bar number, record every network
The bag long value of front 3 net bags of stream and network flow byte length；
Draw cumulative distribution table subelement, for according to every network flow byte length, draw net
The total byte length of network stream is relative to the cumulative distribution table of network flow number；
Threshold value sets subelement, for calculating in cumulative distribution table the network flow length near flex point
Meansigma methods, this meansigma methods is set as threshold value；
Network flow object type judgment sub-unit, for being divided into big stream according to threshold value by network flow
Amount object and two kinds of object types of low discharge object；
Training sample subelement is set, for the bag long value by front 3 net bags of every network flow
It is set to training sample with the object type of network flow；
Training subelement, is used for utilizing training sample Training Support Vector Machines model, is classified
Device.
System the most according to claim 5, it is characterised in that described grader arranges mould
Supporting vector machine model described in the training subelement of block realizes based on the LibSVM increased income.
System the most according to claim 5, it is characterised in that described fine granularity identification mould
Described in block carry out fine-grained network traffics protocol identification based on net payload package according to increase income
OpenDPI procotol storehouse carry out the protocol identification of network traffics.
System the most according to claim 5, it is characterised in that described coarseness identification mould
The network traffics protocol identification of coarseness is carried out for according to Internet based on port described in block
The standard port number that Assigned Numbers Authority specifies carries out the agreement of network traffics to be known
Not.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310676369.XA CN103731416B (en) | 2013-12-11 | 2013-12-11 | A kind of protocol recognition method based on network traffics and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310676369.XA CN103731416B (en) | 2013-12-11 | 2013-12-11 | A kind of protocol recognition method based on network traffics and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103731416A CN103731416A (en) | 2014-04-16 |
| CN103731416B true CN103731416B (en) | 2016-11-16 |
Family
ID=50455343
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310676369.XA Active CN103731416B (en) | 2013-12-11 | 2013-12-11 | A kind of protocol recognition method based on network traffics and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103731416B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104468273A (en) * | 2014-12-12 | 2015-03-25 | 北京百度网讯科技有限公司 | Method and system for recognizing application type of flow data |
| CN109952743B (en) * | 2016-12-06 | 2021-02-09 | 华为技术有限公司 | System and method for low memory and low flow overhead high flow object detection |
| CN112367215B (en) * | 2020-09-21 | 2022-04-26 | 杭州安恒信息安全技术有限公司 | Network traffic protocol identification method and device based on machine learning |
| CN113746758B (en) * | 2021-11-05 | 2022-02-15 | 南京敏宇数行信息技术有限公司 | Method and terminal for dynamically identifying flow protocol |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101388848A (en) * | 2008-10-13 | 2009-03-18 | 北京航空航天大学 | Flow recognition method combining network processor with general processor |
| CN101984635A (en) * | 2010-11-23 | 2011-03-09 | 清华大学 | Method and system for flow identification of point to point (P2P) protocol |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8619587B2 (en) * | 2010-01-05 | 2013-12-31 | Futurewei Technologies, Inc. | System and method to support enhanced equal cost multi-path and link aggregation group |
| CN101814977B (en) * | 2010-04-22 | 2012-11-21 | 北京邮电大学 | TCP flow on-line identification method and device utilizing head feature of data stream |
| CN102055627B (en) * | 2011-01-04 | 2012-06-13 | 深信服网络科技（深圳）有限公司 | Method and device for identifying peer-to-peer (P2P) application connection |
-
2013
- 2013-12-11 CN CN201310676369.XA patent/CN103731416B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101388848A (en) * | 2008-10-13 | 2009-03-18 | 北京航空航天大学 | Flow recognition method combining network processor with general processor |
| CN101984635A (en) * | 2010-11-23 | 2011-03-09 | 清华大学 | Method and system for flow identification of point to point (P2P) protocol |
Non-Patent Citations (2)
| Title |
|---|
| 《Accelerating Application Identification with Two-Stage Matching and Pre-Classification》;HE Fei等;《TSINGHUA SCIENCE AND TECHNOLOGY》;20110831;全文 * |
| 《网络流量分类研究进展与展望》;熊刚等;《集成技术》;20120531;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103731416A (en) | 2014-04-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105224606B (en) | A kind of processing method and processing device of user identifier | |
| CN103731416B (en) | A kind of protocol recognition method based on network traffics and system | |
| CN104767692B (en) | A kind of net flow assorted method | |
| CN104615730B (en) | A kind of multi-tag sorting technique and device | |
| CN104391749A (en) | Resource allocation method and device | |
| CN106529883A (en) | Data object distribution method and device | |
| CN105022729B (en) | A kind of user preference determines method and device | |
| CN102314336B (en) | A kind of data processing method and system | |
| CN108199863A (en) | A kind of net flow assorted method and system based on the study of two benches sequence signature | |
| CN110012035A (en) | Network flow identification method, system, device and computer readable storage medium | |
| CN102609351B (en) | For the method, apparatus and system of the performance of analytic system | |
| CN108021651A (en) | Network public opinion risk assessment method and device | |
| CN111131304A (en) | Cloud platform-oriented large-scale virtual machine fine-grained abnormal behavior detection method and system | |
| CN103024819B (en) | Data distribution method of third-generation mobile communication core network based on user terminal IP (Internet Protocol) | |
| CN111782900B (en) | Abnormal service detection method and device, electronic equipment and storage medium | |
| CN104361010A (en) | Automatic classification method for correcting news classification | |
| CN116668380B (en) | Message processing method and device of convergence diverter equipment | |
| CN110222795A (en) | The recognition methods of P2P flow based on convolutional neural networks and relevant apparatus | |
| CN104348642A (en) | A spam information filtering method and device | |
| CN103001828A (en) | Message statistical method and device and network device based on data flow | |
| CN106257867A (en) | A kind of business recognition method encrypting flow and device | |
| CN106682058A (en) | Screening method, device and system of application programs | |
| CN110034970A (en) | The network equipment distinguishes method of discrimination and device | |
| CN108494635A (en) | A kind of network flow detection system based on cloud computing | |
| CN109800074A (en) | Task data concurrently executes method, apparatus and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |