CN106161072A

CN106161072A - The collocation method of a kind of feature database, feature configuration management platform and feature plug-in unit

Info

Publication number: CN106161072A
Application number: CN201510188134.5A
Authority: CN
Inventors: 郭兰珂; 何钦斌; 李丹; 张洋; 陈平; 马坤; 张伟男; 刘松柏; 范静; 韦唯
Original assignee: China Mobile Group Chongqing Co Ltd
Current assignee: China Mobile Group Chongqing Co Ltd
Priority date: 2015-04-20
Filing date: 2015-04-20
Publication date: 2016-11-23
Anticipated expiration: 2035-04-20
Also published as: CN106161072B

Abstract

The embodiment of the invention discloses the collocation method of a kind of feature database, described method includes: submit the service feature information of business to be identified to；Described service feature Information application authority file being carried out format specification, and the service feature information of format specification being sent to feature plug-in unit, the service feature information of described format specification is for being saved in feature database by described feature plug-in unit.The embodiment of the present invention further simultaneously discloses a kind of feature configuration management platform and feature plug-in unit.

Description

The collocation method of a kind of feature database, feature configuration management platform and feature plug-in unit

Technical field

The present invention relates to deep message identification (Deep Packet Inspection, the DPI) neck in the communication technology Territory, particularly relates to collocation method, feature configuration management platform and the feature plug-in unit of a kind of feature database.

Background technology

With the development of internet, operator proposes intelligent pipeline and flow management strategy, as intelligence pipe The basis in road, DPI system has carried out a large amount of deployment in a network.Existing DPI system generally includes two Point: identifying engine and traffic identification feature database, its workflow is simply as follows: identify that engine is receiving net During network flow, first identify the characteristic information obtaining network traffics, and carry out with the feature in traffic identification feature database Coupling, then identifies type of service according to matching result.

The ability of DPI system is mainly reflected in that it supports the quantity of the type of service identifying, i.e. business is known The ability of other feature database.In the face of the frequent updating of the Internet, applications, the manufacturer of each DPI system needs constantly more New feature storehouse identification engine of upgrading, meet the identification demand of new type of service.

Generally, when user encounters problems and needs to update feature database, need to notify manufacturer, first divided voluntarily by producer The service feature that analysis, research make new advances, more manually increase to feature database, the feature database after then manufacturer will update To Virtual network operator, by Virtual network operator, in existing network, whether authentication problem solves, if unresolved, Then notify that manufacturer continues analysis, research, updates service feature, until Resolving probiems.Said process new Operating between service feature Liang Ge to be passed through manufacturer, it is impossible to timely and existing feature database merges in existing network checking. If problem does not has been resolved after having updated feature database, needing to initiate new more new technological process once, the cycle is very long, The DPI being difficult to meet instantaneity identifies demand, can not find repetition, the something lost of feature in feature database in time simultaneously The mistakes such as leakage.

In addition, the DPI system disposed on heterogeneous networks, provided by different vendor, separate, as China Mobile Internet (CMNET), GPRS (GPRS) network, Long Term Evolution (LTE) All being deployed with different DPI systems on the network of network equipment such as network, different DPI systems also possesses not Same ability.Feature database interface disunity due to different vendor, it is impossible to dispose the DPI system across manufacturer, The DPI recognition capability of each DPI system is also difficult to unified.

Content of the invention

In view of this, embodiment of the present invention expectation provides the collocation method of a kind of feature database, feature configuration management Platform and feature plug-in unit, it is possible to achieve the unified management in different characteristic storehouse on heterogeneous networks.

For reaching above-mentioned purpose, the technical scheme is that and be achieved in that:

A kind of collocation method of feature database, described method includes:

Submit the service feature information of business to be identified to；

Described service feature Information application authority file is carried out format specification, and the business of format specification is special Reference breath is sent to feature plug-in unit, and the service feature information of described format specification is for being protected by described feature plug-in unit It is stored in feature database.

In such scheme, after the described service feature information submitting business to be identified to, described method is also wrapped Include:

Send container state query messages to described feature plug-in unit, and receive return after the inquiry of described feature plug-in unit Container state response message；

Accordingly, when described container state response message is OK, described service feature Information application is advised Model essay part carries out format specification, and inserts being sent to described feature after the service feature information encryption of format specification Part；

Described method also includes:

Receive the renewal result notification message that described feature plug-in unit sends；Wherein, described renewal result notice disappears Breath includes that renewal is effective or it is invalid to update, and when described renewal result notification message is for updating effective, more new technological process is tied Bundle, when described renewal result notification message is for updating invalid, continues to submit to the new industry of described business to be identified Business characteristic information；

Wherein, described service feature information includes herein below: the ID of business to be identified, title, characteristic ID, Quantity N of feature, the content of N number of feature, the priority of N number of feature；N is the integer more than or equal to 1.

The embodiment of the present invention additionally provides the collocation method of a kind of feature database, and described method includes:

Receive the service feature information of format specification；

The service feature information of described format specification is saved in feature database.

In such scheme, before the described service feature information receiving acquisition format specification, described method is also Including:

Receive container state query messages, and after inquiry, return container state response message；Wherein, described Container state includes: Init, Ready, Processing, and the container state inquiring is Ready or Processing During state, the container state response message of return is OK, and the container state inquiring is Init or just in state During transition, the container state response message of return is NOK；

If the service feature information of described format specification is encryption, then the described industry receiving acquisition format specification Business characteristic information, comprising:

Receive the service feature information of format specification, and the industry of format specification according to the secret key decryption of storage Business characteristic information；

After the service feature information of described format specification is saved in feature database, described method also includes:

Feature database after being updated by identification engine calling, identifies the business to be identified that outside network device sends, Judge that whether recognition result is correct；Wherein, described business to be identified is the service feature letter of described format specification Cease corresponding business；

When described recognition result is correct, sends to feature configuration management platform and be used for notifying to update effectively more New result notification message；

When described recognition result is incorrect, it is invalid to send for notifying to update to feature configuration management platform Update result notification message, so that described feature configuration management platform continues to submit the new of described business to be identified to Service feature information；

The service feature information of described format specification includes herein below: the ID of business to be identified, title, spy Levy ID, quantity N of feature, the content of N number of feature, the priority of N number of feature；N is for more than or equal to 1 Integer.

In such scheme, the feature database of described feature plug-in unit includes primary tank and standby container；

Described the service feature information of described format specification is saved in feature database, comprising:

The ID of the business to be identified in service feature information according to described format specification, searches feature for future reference and holds The corresponding service feature information having stored of ID of the business described to be identified of record in device；

Carry out school according to the service feature information to described format specification for the described service feature information having stored Test, when the service feature INFORMATION OF INCOMPLETE of described format specification is included in the service feature information having stored, Verification is passed through；

The service feature information of the described format specification passing through verification is saved in described feature container for future reference；And The service feature information of the described format specification passing through verification is saved in current standby container, carries out Fusion Features；

Exchanging described current standby container is primary tank, is standby container by the exchange of described current primary tank, then, Standby appearance after the service feature information of the described format specification of preservation is saved in exchange in primary tank after exchanging In device；

Accordingly, the feature database after being updated by identification engine calling, comprising:

By identifying that engine scans after active and standby container is exchanged, stop calling in described current primary tank Feature is mated, and the feature used instead in the primary tank after described exchange is mated.

The embodiment of the present invention additionally provides a kind of feature configuration management platform, and described feature configuration manages platform bag Include:

Feature management module, for submitting the service feature information of business to be identified to feature processing block；

Feature processing block, for the service feature Information application specification literary composition submitting described feature management module to Part carries out format specification, and by the service feature information input feature vector sending module of format specification；

Feature sending module, for the service feature by the described format specification of described feature processing block input Information is sent to feature plug-in unit, and the service feature information of described format specification is for being preserved by described feature plug-in unit In feature database.

In such scheme, described feature configuration management platform also includes: distribution policy module；

Described distribution policy module, for submit to described feature management module at described feature processing block After service feature Information application authority file carries out format specification, send container state to described feature plug-in unit Query messages, and receive the container state response message returning after described feature plug-in unit is inquired about；

Accordingly,

Described feature sending module, for the described container state response receiving in described distribution policy module When message is OK, by the service feature information encryption of the described format specification of described feature processing block input After be sent to feature plug-in unit；

Described distribution policy module, is additionally operable to receive the renewal result notification message that described feature plug-in unit sends simultaneously Forward it to described feature management module；Wherein, described renewal result notification message include updating effectively or It is invalid to update；

Described feature management module, is additionally operable to terminate more when described renewal result notification message is for updating effective New technological process, when described renewal result notification message is to update invalid, continues to submit described business to be identified to New service feature information；

Wherein, described service feature information includes: the ID of business to be identified, title, characteristic ID, feature Quantity N, the content of N number of feature, the priority of N number of feature, described N is integer more than or equal to 0.

The embodiment of the present invention additionally provides a kind of feature plug-in unit, and described feature plug-in unit includes:

Feature receiver module, for receiving the service feature information of format specification；

Feature database module, for storing the service feature letter of the format specification that described feature receiver module receives Breath.

In such scheme, described feature plug-in unit also includes feature intelligent management module, container control module and knowledge Other engine modules；

Described feature intelligent manages module, for receiving the industry obtaining format specification at described feature receiver module Before business characteristic information, receive container state query messages and forward it to described container control module；

Described container control module, for inquiring about container state residing for described feature database module, and by described Container state return to described feature intelligent management module, wherein, described container state includes: Init, Ready, Processing；

Described feature intelligent manages module, and being additionally operable to the container state described container control module inquires is During Ready or Processing state, ring to the container state that described Features Management platform returned content is OK Answering message, being Init or during just at status change at the container state inquiring, returned content is the appearance of NOK Device status response message；

Described feature receiver module, specifically in the service feature information of the described format specification receiving being Encryption when, the service feature information of format specification described in the secret key decryption according to storage；

Described identification engine modules, is used for the feature database module after calling renewal, identifies that outside network device is sent out The business to be identified sent, and judge that whether recognition result is correct；Wherein, described business to be identified is described lattice The corresponding business of service feature information of formula specification；

Feature intelligent manages module, is additionally operable to when described identification engine modules judges that recognition result is correct, Send to feature configuration management platform and be used for notifying to update effective renewal result notification message；In described identification When engine modules judges that described recognition result is incorrect, send to feature configuration management platform and be used for notifying to update Invalid renewal result notification message；

The service feature information of described format specification includes herein below: the ID of business to be identified, title, spy Levy ID, quantity N of feature, the content of N number of feature, the priority of N number of feature, described N for more than etc. In the integer of 1.

In such scheme, described feature database module includes primary tank and standby container；

Described feature plug-in unit also includes: feature checking module and feature container module for future reference；

Described feature checking module, the business of the format specification for receiving according to described feature receiver module is special The ID of the business to be identified in reference breath, searches the ID of the business described to be identified of record in feature container for future reference The service feature information that corresponding described business to be identified has stored；And according to the described service feature having stored The service feature information to described format specification for the information verifies, at the service feature letter of described format specification When breath is not fully contained in the service feature information having stored, verification is passed through；

Described feature container module for future reference, for preserve described feature checking module verification by after described lattice The service feature information of formula specification；

Described feature intelligent manages module, be additionally operable to by the verification of described feature checking module by after business special Reference breath is saved in the current standby container of described feature database module, carries out Fusion Features, completes current standby container Renewal；

Described container control module, is additionally operable to update in described feature intelligent management module complete current standby container After, exchanging described current standby container is primary tank, exchanges described current primary tank for standby container；

Described feature intelligent manages module, is additionally operable to after the exchange of described container control module completes, by feature Standby container after the described service feature information of preservation is saved in exchange in primary tank after exchanging in library module In；

Described identification engine modules, is exchanged specifically for scanning the active and standby container in described feature database module Afterwards, the feature stopping calling in current primary tank is mated, and uses instead in the primary tank after described exchange Feature is mated.

The collocation method of the feature database that the embodiment of the present invention provides, feature configuration management platform and feature plug-in unit, By application authority file, support different-format service feature information, make service feature information can with system The form of one is distributed to feature plug-in unit, thus supports the business identifying system of different characteristic form, supports interdepartmental System recognition capability is unified.Meanwhile, in order to unify the traffic identification ability of distinct interface different manufacturers system, will DPI system is encapsulated as feature plug-in unit；This feature plug-in unit can be arranged on different outsides by identical interface On the network equipment, during carrying out traffic identification, each outside network device can directly invoke this plug-in unit, And the unification of traffic identification ability can be realized without bigger adjustment source code.Should with the aforedescribed process, Ke Yiyong One feature configuration management platform is unified configuration management and is on the heterogeneous networks equipment of different network systems Each feature plug-in unit.

In addition, the method that application the present embodiment provides, after feature database is updated, in feature plug-in unit Identify engine can directly invoke renewal after feature database, identify outside network device send business to be detected, Judging that whether recognition result is correct, i.e. timely and existing feature database merges to be verified at existing network, shortens more The new cycle.

Brief description

A kind of feature database being applied to feature configuration management platform side that Fig. 1 provides for the embodiment of the present invention 1 Collocation method schematic flow sheet；

The collocation method of a kind of feature database being applied to feature plug-in unit side that Fig. 2 provides for the embodiment of the present invention 1 Schematic flow sheet；

The structured flowchart of a kind of feature configuration management platform that Fig. 3 provides for the embodiment of the present invention 2；

The structured flowchart of a kind of feature plug-in unit that Fig. 4 provides for the embodiment of the present invention 2；

The collocation method schematic flow sheet of a kind of feature database that Fig. 5 provides for the embodiment of the present invention 3.

Detailed description of the invention

Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clearly It Chu, is fully described by.

Embodiment 1

Embodiments provide the collocation method of a kind of feature database, as it is shown in figure 1, the application of described method Managing platform side in feature configuration, the handling process of the present embodiment method comprises the following steps:

Step 101, the service feature information submitting business to be identified to.

Wherein, described service feature information includes the ID of business to be identified, title, characteristic ID, feature Quantity N, the content of N number of feature, the priority of N number of feature.

Update a new application in internet or carry out the new feature of upgrading appearance to original application When, need to be updated the feature database of DPI system, now, this new application or original application are just It is business to be identified.Now, operator just can be by the service feature information input for this business to be identified Managing platform to feature configuration, the service feature information of business to be identified submitted to by described feature configuration management platform. Example, it can be assumed that described service feature information includes: the ID:ID0 of business to be identified, title: A, Characteristic ID: ID01, quantity N:4 of feature, the content of N number of feature: A1, A2, A3, A4, N number of The priority of feature: A1 is the first priority, and A2 is the second priority, and A3 is third priority, A4 It is the 4th priority, the first priority can be set as limit priority.4th priority is lowest priority.

Here it should be noted that four features A1, the ID of A2, A3, A4 are ID01, show This four features are all the features of business A of ID0.Arranging priority to N number of feature is to identify engine When carrying out characteristic matching, returning the high corresponding business of feature of priority, as identified, engine is identifying During the feature of business A, the feature that can identify is A1 and B1, it is assumed that A1 is the first priority, B1 is the second priority, and the priority ratio B1 of A1 is high, now, if feature A1 and B1 can mate, Then identify engine backout feature A1 i.e. business A of corresponding business.If the priority of A1 is identical with B1, this When, corresponding business A of feature A1 mated at first can be returned.

Step 102, described service feature Information application authority file is carried out format specification, and form is advised The service feature information of model is sent to feature plug-in unit.

If there is no storage specification file in feature configuration management platform, it is necessary to send lattice to described feature plug-in unit Formula specification request message, and receive described feature plug-in unit return format specification reply message, described form advise Model includes authority file in replying message.

Apply this authority file can filter out part invalid in described service feature information, by described business Characteristic information is converted to the form that authority file is arranged, and is then sent to the service feature information of format specification Feature plug-in unit.By application authority file, support the formatting of the service feature information of different-format, make industry Business characteristic information can be distributed to feature plug-in unit in a unified format, thus supports the business of different characteristic form Identification system, supports that cross-system recognition capability is unified.Optionally, the authority file in the present embodiment can be XML file.

After described service feature Information application authority file is carried out format specification, feature configuration manages platform Container state query messages can be sent to feature plug-in unit, to inquire about current container state if appropriate for carrying out Follow-up more new technological process.When described container state response message is OK, by the service feature of format specification Information is sent to feature plug-in unit, when container state response message is NOK, continues to send to feature plug-in unit Container state query messages, until the container state response message that the described feature plug-in unit receiving returns is OK。

Described before described feature plug-in unit sends container state query messages or to described feature plug-in unit Before sending format specification request message, feature configuration management platform feature plug-in unit is issued its open IP with Port, to reduce the loaded down with trivial details configuration of feature plug-in unit, feature plug-in registration in this DPI system when, can be by spy The address information levying plug-in unit is saved in feature configuration management platform, and feature configuration management platform is according to storage The address information of feature plug-in unit, starts port snoop, and it is flat to initiate feature configuration management to described feature plug-in unit The IP of platform and port negotiation, so that described feature plug-in unit obtains IP and the end of described feature configuration management platform Mouthful, and then communicate with described feature configuration management platform.

Owing to feature is the Key Asset in DPI system, in order to prevent from being trapped utilization, increase security, Service feature information after format specification can be encrypted, optionally, superencipherment mark can be used to it Accurate (Advanced Encryption Standard, AES) encryption.

After the service feature information of format specification is sent to feature plug-in unit by described feature configuration management platform, institute State feature plug-in unit and will start more new technological process, in the feature container of feature plug-in unit, preserve this service feature information, And after renewal completes, detection updates whether effectively (whether the new feature i.e. preserving can make identification engine accurate Really identify this business to be identified), and just disappear to feature configuration management platform transmission renewal result notice Breath, if update result notification message for updating effective, more new technological process terminates；If described renewal result notice When message is for updating invalid, continue to submit new service feature information to.New service feature information can be New feature can be increased, it is also possible to be modification original service feature letter on the basis of original service feature information Breath.Example, changing original service feature information can make the priority of the existing feature of modification, need by During hit, heighten priority, it is not necessary to when being hit, turn down priority；Also can be to delete existing spy Levy content and corresponding priority thereof, increase new feature and corresponding priority thereof.

Embodiments provide the collocation method of a kind of feature database, as in figure 2 it is shown, the application of described method In feature plug-in unit side, the handling process of the present embodiment method comprises the following steps:

Step 201, the service feature information receiving acquisition format specification.

Feature plug-in unit, before communicating with feature configuration management platform, needs to start port snoop, receives The IP of the feature configuration management platform that feature configuration management platform is initiated and port negotiation, obtain described feature and join Put IP and the port of management platform, and then communicate with described feature configuration management platform.

In the present embodiment, disappear if feature configuration management platform have sent container state inquiry to feature plug-in unit Breath, inquire about current container state if appropriate for carry out feature database update when, described feature plug-in unit can be inquired about Current container state, it is generally the case that described container state has following three kinds: Init, Ready, Processing；Wherein, Init transition are Ready, represent that business identifying system initializes (not containing feature database) Complete；Ready transition are Processing, represent the initialization in finishing service identification system features storehouse, enter Duty；Processing transition are Processing, represent finishing service identification system features qurush level； Processing transition are Init, represent business identifying system deinitialization, become unavailable.At Ready or During Processing state, can carry out feature database renewal, the container state response message of return is OK, other During state or status change, it is impossible to carry out feature database renewal, the container state response message of return is NOK。

Feature configuration management platform, when the container state response message receiving is OK, needs described industry Business characteristic information application authority file is being sent to feature plug-in unit after carrying out format specification.If described feature configuration Do not have storage specification file in management platform, then described feature configuration management platform can be by described service feature Before Information application authority file carries out format specification, send format specification request message to described feature plug-in unit, And the format specification receiving the return of described feature plug-in unit replies message, described format specification comprises in replying message There is authority file.

If the service feature information after described format specification is encryption, then also need to the double secret key according to storage Service feature information after described format specification is decrypted.

Step 202, the service feature information of described format specification is saved in feature database.

Described feature plug-in unit, can be directly by described after receiving the service feature information of described format specification The service feature information of format specification is saved in the feature database of described feature plug-in unit.

In order to ensure that described feature plug-in unit still can carry out traffic identification, permissible when carrying out feature renewal The feature database of described feature plug-in unit is set to two containers: primary tank and standby container.Now, by described lattice The feature database that the service feature information of formula specification is saved in described feature plug-in unit just includes: by the industry of format specification Business characteristic information is saved in current standby container, carries out Fusion Features.This feature merges directly operation in internal memory, When carrying out Fusion Features by current standby container internal memory, the identification engine in feature plug-in unit can call works as Front primary tank carries out traffic identification, this reduces fusion process to the interference identifying, it is to avoid business is known Do not interrupt.

The service feature information of described format specification is being saved in current standby container, current standby container is being carried out Updating, not completing if updated, be then transmitted to feature configuration management platform the reason that by renewal failure, so that It the reason that described feature configuration management platform is according to described renewal unsuccessfully, is adjusted, re-starts step 101-102.The reason that update unsuccessfully can be to update content too much, the Out of Memory of described standby container, now, After feature configuration management platform receives the reason that update unsuccessfully, the content of service feature information will be reduced, Resubmit service feature information.

Complete if updating, then described current standby container can be exchanged by feature plug-in unit is primary tank, works as described It is standby container that front primary tank is exchanged, then, and the industry of the described format specification preserving in the primary tank after exchanging Business characteristic information synchronizes in the standby container after being saved in exchange.Example, it is assumed that two in described feature plug-in unit Individual feature container is a-1, a-2, before the service feature information of described format specification is saved in feature database, Current primary tank is a-1, and current standby container is a-2, protects the service feature information of described format specification Being stored in a-2, then exchanging the role of a-1, a-2, a-1 exchanges as container, and it is primary tank that a-2 exchanges, A-2 saves the service feature information of described format specification, has at this moment been accomplished by also preserving institute in a-1 State the service feature information of format specification.

Identification engine in described feature plug-in unit scans after active and standby container is exchanged, and can stop calling described Feature in current primary tank is mated, and the feature used instead in the primary tank after described exchange is mated.

Here, it is current spy to ensure the service feature information of format specification preserving in described feature database Levying does not has in storehouse, needs to verify the service feature information of described format specification before updating feature database, Checking procedure specifically includes that the ID of the business to be identified in the service feature information according to described format specification, The corresponding described business to be identified of ID searching the business described to be identified of record in feature container for future reference is deposited The service feature information of storage；And according to the business to described format specification for the described service feature information having stored Characteristic information verifies.

If the service feature information of described format specification is completely contained in the service feature information having stored, Then show the service feature information of this format specification in feature database, it is not necessary to update feature database, now Verification is not passed through, and can send to described feature configuration management platform and check the renewal result do not passed through notice to disappear Breath, so that described feature configuration management platform continues to submit to the new service feature information of described business to be identified.

If the service feature information having stored has different from the service feature information content of described format specification, Show the service feature information of this format specification is needed to update by new business or feature or priority, Now then verification is passed through, and carries out follow-up more new technological process.Thus can avoid carrying out unnecessary renewal.

Example, if internet have updated a kind of new application, not this applied business pair in feature database The feature answered, so during carrying out above-mentioned inspection process, unwritten institute in feature container for future reference State the ID characteristic of correspondence of business to be identified, at this moment check and necessarily pass through.If just should to a certain in internet And have updated a function, this applied business that is stored with in feature database some features corresponding, so carrying out During above-mentioned inspection process, need the service feature information of described format specification and feature container for future reference The service feature information having stored of middle record contrasts, if the service feature information of described format specification It has been fully contemplated by the described service feature information having stored, then shown the service feature letter of this format specification Breath is in feature database, it is not necessary to be updated, if the service feature information of described format specification does not has again Have and be fully contemplated by the described service feature information having stored, then show the service feature of described format specification This business is had new character representation by information, is at this moment accomplished by updating feature database.

Optionally, as in figure 2 it is shown, the method that the present embodiment provides also includes follow-up verification step 203 He 204, whether the feature of the preservation in verification step 202 can described business to be identified on accurate match.

Step 203, by identify engine calling update after feature database, identify outside network device send Business to be identified, it is judged that whether recognition result is correct.

Wherein, described business to be identified is the corresponding business of service feature information of described format specification；To After the feature database of feature plug-in unit is entered in the service feature information updating of the format specification of this business, need to renewal Whether feature can mate this business accurate is detected, now, it is necessary to outside network device is to feature plug-in unit Send business to be identified, the feature database after identification engine calling renewal in described feature plug-in unit, identify outside The business to be identified that the network equipment sends, it is judged that whether recognition result is correct.

Step 204, when described recognition result is correct, to feature configuration management platform send update result lead to Know message.

If identifying correct, then show that the feature being saved in feature database can make feature plug-in unit identify this business, Update effectively, now just send to feature configuration management platform and update result notification message, described renewal result Notification message is used for notifying to update effectively；If identifying incorrect, then show to be saved in the feature of feature database not Feature plug-in unit can be made to identify this business, and it is invalid to update, and now sends to feature configuration management platform and updates knot Really notification message；Wherein, described renewal result notification message be used for notifying updating invalid, so that described feature Configuration management platform continues to submit to the new service feature information of described business to be identified.

New service feature information can be can to increase on the basis of the upper service feature information once submitted to newly Feature, it is also possible to be the last service feature information of modification.Example, change original service feature Information can be the priority of the existing feature of modification, when needing to be hit, heightens priority, it is not necessary to ordered When middle, turn down priority；Also can be to delete existing feature and corresponding priority thereof, increase new Feature and corresponding priority.

The method that the present embodiment provides, by application authority file, supports the service feature information of different-format Formatting, make service feature information can be distributed to feature plug-in unit in a unified format, thus support difference The business identifying system of characteristic format, supports that cross-system recognition capability is unified.Meanwhile, connect to unify difference The traffic identification ability of mouth different manufacturers system, the core algorithm in traffic identification simultaneously to be protected and feature database, Therefore need the identification engine comprising core algorithm and feature database are encapsulated as feature plug-in unit；Simultaneously in order to provide Fault tolerant mechanism and the convenient management of reply, can also carry out above-mentioned additive method flow process in feature plug-in unit, after Continuous third party's network system, during carrying out traffic identification, can directly invoke this plug-in unit, and be not necessarily to bigger Adjust source code and can realize the unification of traffic identification ability.Should can be joined by a feature with the aforedescribed process Put the feature plug-in unit that management platform is on the heterogeneous networks equipment of different network systems to unify configuration management.

In addition, the method that application the present embodiment provides, after feature database is updated, identify that engine is permissible Directly invoke the feature database after renewal, identify the business to be detected that outside network device sends, it is judged that identify knot Whether fruit is correct, and i.e. timely and existing feature database merges to be verified at existing network, shortens the update cycle.

Embodiment 2

Embodiments provide a kind of feature configuration management platform, as it is shown on figure 3, described feature configuration Management platform includes: feature management module the 301st, feature processing block the 302nd, feature sending module 303.

Feature management module 301, for submitting the service feature of business to be identified to feature processing block 302 Information.Wherein, described service feature information includes: the ID of business to be identified, title, characteristic ID, special Quantity N levied, the content of N number of feature, the priority of N number of feature.

Feature processing block 302, should for the service feature information submitting described feature management module 301 to After carrying out format specification with authority file, by the service feature information input feature vector sending module of format specification 303。

Feature sending module 303, for the described format specification that inputs described feature processing block 302 Service feature information is sent to feature plug-in unit, and the service feature information of described format specification is for by described feature Plug-in unit is saved in feature database.

As it is shown on figure 3, described feature configuration management platform also includes: distribution policy module 304.

Distribution policy module 304, is used for described feature management module 301 at described feature processing block 302 After the service feature Information application authority file submitted to carries out format specification, send to described feature plug-in unit and hold Device STATUS ENQUIRY message, and receive the container state response message returning after described feature plug-in unit is inquired about.

Accordingly, described feature sending module 303, for receive in described distribution policy module 304 When described container state response message is OK, the described form inputting described feature processing block 302 is advised The service feature information of model is sent to feature plug-in unit.

Described distribution policy module 304, for described feature plug-in unit send container state query messages it Before, the address information of the feature plug-in unit according to storage, start port snoop, and initiate to described feature plug-in unit The IP of feature configuration management platform and port negotiation, so that described feature plug-in unit obtains the management of described feature configuration The IP of platform and port, and then communicate with described feature configuration management platform.

If feature processing block 302 does not has storage specification file, then described distribution policy module 304, also uses Ask message in sending format specification to described feature plug-in unit, and receive the form rule that described feature plug-in unit returns Model replies message, and then described authority file inputs to described feature processing block 302, and described form is advised Model includes authority file in replying message.So feature processing block 302 just can be by described Features Management The service feature Information application authority file that module 301 is submitted to carries out format specification.

In order to improve security, described feature sending module 303, specifically for by described feature processing block It is sent to feature plug-in unit after the service feature information encryption of the described format specification of 32 inputs.

Described distribution policy module 304, the renewal result notice being additionally operable to receive the transmission of described feature plug-in unit disappears Cease and forward it to described feature management module；Wherein, described renewal result notification message includes that renewal has Effect or update invalid；Described feature management module 301, is additionally operable at described renewal result notification message as more Terminate more new technological process when newly effectively；When described renewal result notification message is to update invalid, continue to submit institute to State the new service feature information of business to be identified.

The embodiment of the present invention additionally provides a kind of feature plug-in unit, and as shown in Figure 4, described feature plug-in unit includes: Feature receiver module the 401st, feature database module 402.

Feature receiver module 401, for receiving the service feature information obtaining format specification.Optionally, institute State feature receiver module 401, be to add specifically for the service feature information at the described format specification receiving When close, the service feature information of format specification described in the secret key decryption according to storage.

Feature database module 402, for storing the industry of the format specification that described feature receiver module 401 receives Business characteristic information.

As shown in Figure 4, described feature plug-in unit also includes identifying engine modules the 403rd, feature intelligent management module 404th, container control module 405.

Described identification engine modules 403 is used for the feature database module 402 after calling renewal, identifies external network The business to be identified that equipment sends, and judge that whether recognition result is correct；Wherein, described business to be identified is The corresponding business of service feature information of described format specification.

Described feature intelligent manages module 404, for judging to identify knot in described identification engine modules 403 When fruit is correct, sends to feature configuration management platform and be used for notifying to update effectively updating result notification message. Described feature intelligent manages module 404, is additionally operable to judge that described identification is tied in described identification engine modules 403 When really incorrect, send for notifying to update invalid renewal result notification message to feature configuration management platform.

Described feature intelligent manages module 404, is additionally operable to receive at described feature receiver module 401 obtain lattice Before the service feature information of formula specification, receive container state query messages, and forward it to described container Control module 405.

Accordingly, as shown in Figure 4, described container control module 405, is used for inquiring about described feature database module Container state residing for 402；And described container state is returned to described feature intelligent management module 404, its In, described container state includes: Init, Ready, Processing.

Described feature intelligent manages module 404, is additionally operable to the appearance inquiring in described container control module 405 It when device state is Ready or Processing state, is OK's to described Features Management platform returned content Container state response message, is Init or during just at status change at the container state inquiring, returned content Container state response message for NOK.

Described feature intelligent manages module 404, is additionally operable to, before receiving container state query messages, start Port snoop, receives IP and the port negotiation of the feature configuration management platform that feature configuration management platform is initiated, Obtain IP and the port of described feature configuration management platform, and then lead to described feature configuration management platform Letter.

Described feature intelligent manages module 404, is additionally operable to receive at described feature receiver module 401 obtain lattice Before the service feature information of formula specification, receive format specification request message, and return format specification reply disappear Breath, described format specification includes authority file in replying message.

In the present embodiment, in order to ensure when feature database is updated, described feature plug-in unit still can enter Row traffic identification, can include primary tank and standby container in described feature database module 402；As shown in Figure 4, Described feature plug-in unit also includes: container control module 405.

Described feature intelligent manages module 404, special for the business receiving described feature receiver module 401 Reference breath is saved in the current standby container of described feature database module 402, carries out Fusion Features, completes current The renewal of standby container；Described container control module 405, in described feature intelligent management module 404 more After newly completing current standby container, exchanging described current standby container is primary tank, adjusts described current primary tank It is changed to standby container；Described feature intelligent manages module 404, for exchanging in described container control module 405 After completing, the described service feature information of preservation in the primary tank after exchanging in described feature database module 402 It is saved in the standby container after exchange；Accordingly, described identification engine modules 403, is used for scanning described After active and standby container in feature database module 402 is exchanged, the feature stopping calling in current primary tank is carried out Coupling, the feature used instead in the primary tank after described exchange is mated.

Here, it is current spy to ensure the service feature information of format specification preserving in described feature database Levying does not has in storehouse, needs to verify the service feature information of described format specification before updating feature database, As shown in Figure 4, described feature plug-in unit also includes: feature checking module 406 and feature container module for future reference 407.In described feature plug-in unit, the service feature information of also described format specification includes herein below: industry to be identified The ID of business, title, characteristic ID, quantity N of feature, the content of N number of feature, the priority of N number of feature； Then, described feature checking module 406, for the described form receiving according to described feature receiver module 401 The ID of the business to be identified in the service feature information of specification, searches the institute of record in described feature container for future reference State the corresponding service feature information having stored of ID of business to be identified；Then according to the described business having stored The service feature information to described format specification for the characteristic information verifies, special in the business of described format specification When reference breath is completely contained in the service feature information having stored, then verifies and do not pass through, on described form rule When the service feature INFORMATION OF INCOMPLETE of model is included in the service feature information having stored, verification is passed through.

Described feature container module 407 for future reference, for preserving the industry after described feature checking module 406 verifies Business characteristic information；Accordingly, described feature database module 402, for the described format specification passing through verification Service feature information be saved in current standby container.

Feature plug-in unit can be deployed in the different outside network devices of different network systems by identical interface In, such as gateway, programmable computer controller (PCC), probe device, gateway fire wall etc..Entering During row traffic identification, the different outside network devices of different network systems can directly invoke this plug-in unit and enter Row traffic identification, and the unification of traffic identification ability can be realized without bigger adjustment source code.

In actual applications, in the present embodiment, each module in feature configuration management platform can be processed by central authorities Device (CPU), microprocessor (MPU), digital signal processor (DSP) or field programmable gate array Etc. (FPGA) device realizes；Each module in feature plug-in unit also can be by central processing unit (CPU), micro- The devices such as processor (MPU), digital signal processor (DSP) or field programmable gate array (FPGA) Part realizes.In different operating system, feature plug-in unit can select different document forms.

Embodiment 3

Embodiments providing the collocation method of a kind of feature database, the method is flat by feature configuration management Platform and feature plug-in unit realize, as it is shown in figure 5, the handling process of the present embodiment method comprises the following steps:

In step 501, feature configuration management platform, feature management module is submitted to be identified to feature processing block The service feature information of business.

Described service feature Information application authority file is carried out format specification by step 502, feature processing block, It is then sent to distribution policy module.

If there is no storage specification file in distribution policy module, it is necessary to from the feature intelligent management of feature plug-in unit Module obtains this authority file.Described distribution policy module, is additionally operable to send form to described feature plug-in unit Specification request message, and receive described feature plug-in unit return format specification reply message, described format specification Authority file is included in replying message；Now, described distribution policy module, is additionally operable to described specification literary composition Part inputs to described feature processing block.

Feature in described feature plug-in unit for the distribution policy module in step 503, feature configuration management platform Intelligent management module sends container state query messages.

Or sending format specification in described distribution policy module to described feature plug-in unit before step 503 please Before seeking message, the distribution policy module set up in feature configuration management platform is needed to manage mould with feature intelligent Communication connection relation between block.Distribution policy module feature intelligent management module is issued its open IP with Port, to reduce the loaded down with trivial details configuration of feature plug-in unit, feature plug-in registration in this system when, feature can be inserted The address information of part is saved in distribution policy module, the ground of the feature plug-in unit according to storage for the distribution policy module Location information, starts port snoop, and initiates IP and port to the feature intelligent management module of described feature plug-in unit Consult, so that described feature intelligent management module obtains IP and port, the Jin Eryu of described distribution policy module Described distribution policy module communicates.This negotiations process way does not shows.

In step 504, feature plug-in unit, described feature intelligent management module receives container state query messages, And forward it to described container control module.

Container state residing for step 505, the described feature database module of described container control module inquiry, and will Described container state is transmitted to feature intelligent management module.

Distribution policy mould in described Features Management platform in step 506, described feature intelligent management module Block returns container state response message.

Described feature intelligent management module described container control module forward come container state be Ready or During Processing state, to the container state response message that described distribution policy module returned content is OK, When forwarding the container state coming to be Init or just at status change, returned content is that the container state of NOK rings Answer message.

Step 507, described distribution policy module when the described container state response message receiving is OK, Insert being sent to feature after the service feature information encryption of the described format specification of described feature processing block input The feature receiver module of part.

The business of step 508, described feature receiver module format specification according to the secret key decryption of storage is special Reference ceases, and the service feature information by the described format specification after deciphering is sent to feature checking module.

Step 509, described feature checking module proceed by verification, and described feature checking module is according to described The ID of the business to be identified in the service feature information of the format specification that feature receiver module receives, searches for future reference The business that in feature container, the corresponding described business to be identified of ID of the business described to be identified of record has stored Characteristic information；And according to the service feature information to described format specification for the described service feature information having stored Verifying, the service feature INFORMATION OF INCOMPLETE at described format specification is included in the service feature letter having stored When in breath, verification is passed through.

Step 510, by described feature checking module verify after service feature information be saved in feature for future reference hold Device module.

Step 511, by described feature checking module verify after service feature information be saved in feature database module.

In the present embodiment, in order to ensure when feature database is updated, described feature plug-in unit still can enter Row traffic identification, can include primary tank and standby container in described feature database module；Can be first by described spy Levy the service feature information updating that receiver module receives in the current standby container of described feature database module, carry out Fusion Features, updates and completes current standby container；And complete current standby container updating in described feature database module After, exchanging described current standby container is primary tank, exchanges described current primary tank for standby container；Then After exchange completes, the described service feature preserving in the primary tank after exchanging in described feature database module is believed Cease in the standby container after being saved in exchange.

Step 512, identify engine modules call renewal after feature database module, identify outside network device send out The business to be identified sent, and judge that whether recognition result is correct；Wherein, described business to be identified is described lattice The corresponding business of service feature information of formula specification.

Recognition result is sent to feature intelligent management module by step 513, identification engine modules.

Step 514, feature intelligent management module manage dividing of platform according to described recognition result to feature configuration Send out policy module and send renewal result notification message.

Feature intelligent management module, when described identification engine modules judges that recognition result is correct, is joined to feature The distribution policy module putting management platform sends for notifying to update effective renewal result notification message；Institute State identification engine modules when judging that described recognition result is incorrect, manage the distribution policy of platform to feature configuration Module sends for notifying to update invalid renewal result notification message.

Renewal result notification message is transmitted to described Features Management mould by step 515, described distribution policy module Block.

Described feature management module terminates more new technological process when described renewal result notification message is for updating effective, When described renewal result notification message is to update invalid, continue to submit to the new business of described business to be identified Characteristic information.

New service feature information can be can to increase new feature on the basis of original service feature information, Also can be the original service feature information of modification, specifically be come by the operator of feature configuration management platform one end Carry out.Example, change the priority that original service feature information can be the existing feature of modification, need When being hit, heighten priority, it is not necessary to when being hit, turn down priority；Also can be that deletion is existing Feature and corresponding priority thereof, increase new feature and corresponding priority thereof.

After described feature management module have submitted service feature information again, continue according to step 501-515 Carry out.

In the present embodiment, can also need to carry out characteristic query according to user, feature configuration manages platform The Business Name of user's input, traffic ID, characteristic ID, feature can be sent to feature plug-in unit, Whether feature plug-in unit can exist this Business Name, industry by feature container module for future reference in query characteristics storehouse Business ID, characteristic ID, feature.

Those skilled in the art are it should be appreciated that embodiments of the invention can be provided as method, system or meter Calculation machine program product.Therefore, the present invention can use hardware embodiment, software implementation or combine software and The form of the embodiment of hardware aspect.And, the present invention can use and wherein include calculating one or more Computer-usable storage medium (including but not limited to magnetic disc store and the optical storage of machine usable program code Device etc.) form of the upper computer program implemented.

The present invention is with reference to method according to embodiments of the present invention, equipment (system) and computer program Flow chart and/or block diagram describe.It should be understood that can be by computer program instructions flowchart and/or side Flow process in each flow process in block diagram and/or square frame and flow chart and/or block diagram and/or the knot of square frame Close.Can provide these computer program instructions to all-purpose computer, special-purpose computer, Embedded Processor or The processor of other programmable data processing device is to produce a machine so that by computer or other can The instruction that the processor of programming data processing equipment performs produces for realizing in one flow process or multiple of flow chart The device of the function specified in flow process and/or one square frame of block diagram or multiple square frame.

These computer program instructions may be alternatively stored in and can guide computer or other programmable data processing device In the computer-readable memory working in a specific way so that be stored in this computer-readable memory Instruction produces the manufacture including command device, and this command device realizes at one flow process of flow chart or multiple stream The function specified in journey and/or one square frame of block diagram or multiple square frame.

These computer program instructions also can be loaded in computer or other programmable data processing device, makes Sequence of operations step must be performed to produce computer implemented place on computer or other programmable devices Reason, thus the instruction performing on computer or other programmable devices provides for realizing flow chart one The step of the function specified in flow process or multiple flow process and/or one square frame of block diagram or multiple square frame.

The above, only presently preferred embodiments of the present invention, it is not intended to limit the protection model of the present invention Enclose.

Claims

1. the collocation method of a feature database, it is characterised in that described method includes:

Submit the service feature information of business to be identified to；

2. collocation method according to claim 1, it is characterised in that submit business to be identified to described Service feature information after, described method also includes:

Described method also includes:

3. the collocation method of a feature database, it is characterised in that described method includes:

Receive the service feature information of format specification；

4. collocation method according to claim 3, it is characterised in that obtain form rule described reception Before the service feature information of model, described method also includes:

5. collocation method according to claim 4, it is characterised in that the feature database of described feature plug-in unit Include primary tank and standby container；

6. a feature configuration management platform, it is characterised in that described feature configuration management platform includes:

7. feature configuration according to claim 6 management platform, it is characterised in that described feature configuration Management platform also includes: distribution policy module；

Accordingly,

8. a feature plug-in unit, it is characterised in that described feature plug-in unit includes:

9. feature plug-in unit according to claim 8, it is characterised in that described feature plug-in unit also includes spy Levy Intelligent management module, container control module and identification engine modules；

10. feature plug-in unit according to claim 9, it is characterised in that wrap in described feature database module Containing primary tank and standby container；