CA3226756A1 - Method and system for analysing data flows - Google Patents

Abstract

The invention relates to a method for analysing a flow of data packets received via a communication network, a protocol analysis (DAP) in accordance with the following steps: - analysing the first packet (P0) of a batch to check whether the first packet (P0) advertises the protocol of the following data packet (P1); - analysing the one or more following protocols Pi+n, where n?2, by repeating steps of classification through explicit detection (S10), classification through session detection (S20), and classification through deep packet inspection (S40) until identifying at least one protocol the identity of which is certain; and - associating a label with the data packets; and to the system for implementing it.

Description

Description Title of the invention: METHOD AND SYSTEM FOR ANALYZING FLOW FLOWS
DATA
knRRIE RE-P LAN
[0001] Technological developments in terms of implementation network have caused networking speeds to increase beyond capacity of supervision of the network and traffic management equipment used.
Equipment known network monitoring and traffic management generally includes of the network probes, designed to monitor a data stream received via a network of communication.

[0002] In practice, network probes are designed to process a fixed flow of data and monitor specific metrics of that data. Consequently, each time the data flow increases and/or a new measurement of flow data is identified for monitoring, these network probes must be redesigned to modify their processing capabilities to manage the flow modified from data.

[0003] To mitigate the inefficiencies associated with network probes material, we knows network monitoring and network management software solutions traffic in which deep packet inspection (DPI) is performed on only few packets, this technical solution is called Packet Sampling (i.e.
mean taking packets completely randomly from a network flow For take a sample). Such a known solution makes it possible to avoid high processing overhead and higher network latencies. However, a such previous solution is not completely satisfactory, because the analysis is executed limitedly on protocol chains or communication sessions including five fixed fields (source field, recipient field, source port, port recipient, communication protocol). It follows that such an analysis according to art previous version does not allow processing of strings or protocol sessions including pedestal identification is based on a 5-tuple value (source IP, Destination IP, Port Source, Destination Port and Application), nor on tunneling protocols to detection delayed, nor in layers 2 to 7 of the systems interconnection model open (0S1).

[0004] We also know another solution such as that presented by the document EP 1 788 490 A (APPTITUDE INC), teaching a restful architecture on the implementation of a specific FPGA and AS ICs hardware part, and a part software involving packet slicing

[0005] According to the solution described in EP 1 788 490 A, the payload or content attached to a protocol layer is at least partly kept in memory first in the FPGA, then delegated to the CPU and RAM. Architecture hardware does not allow the state of a session to be retained sufficiently a long time.
The system is significantly slowed down when analyzing a data stream of Speed important and prevents a posteriori identification of the protocols. Moreover, THE
FPGA having limited memory, it must empty its cache periodically, This which results in the loss of information and data packets, and can lead to of the inaccurate analysis statistics. In addition, the use of cutting pack (packet slicing), reassembly for analysis therefore involves a risk of loss information. Additionally, digital fingerprint table management calculated based on five tuples (source IP address/port number, address IP/a destination port number and the protocol used) implies identification of a session on the basis of a digital fingerprint calculation not taking into account account only one layer of identification whereas in the case of sessions built on several tunneled or multiplexed protocols, encapsulation creates several hidden sessions that become impossible to identify with a 5-tuple. Of more, the encryption of communications adds variation which will also distort comparisons with a database of digital malware fingerprints. Finally, the solution according to EP 1 788 490 takes into account the payload in the calculation of the hash which will lead to too many variations in the analysis values to remain relevant as part of a comparison, and the 5-tuple calculation approach.

[0006] Furthermore, at very high throughput, the use for calculating the imprint numeric or hash using a 5-tuple method combining techniques hardware (FPGA or ASIC) and Racket Slicing (cutting the package on the layers lower or higher) to speed up packet processing, causes natively a loss of visibility and cascading errors.

[0007] Furthermore, the 5-tuple approach for two sessions having the same 5-tuple, but whose lower layer is different, (i.e. a virtual network different) will be interpreted as if the two sessions are identical when this is not the case, and then leads to a loss of information which can seriously affect the results data analysis.

[0008] The term hash subsequently means a fingerprint digital calculated.

[0009] The present invention remedies the drawbacks and improves the situation.

[0010] The present invention relates to a method of analyzing a data flow of data packets received via a communications network, the data flow comprising batches of packets each defined by a chain of protocols communication attached to at least one session.

[0011] According to a general definition of the invention, the process includes a analysis of protocols according to the following steps:
-analyze the first Pi protocol of a chain of communication protocols according to an explicit detection classification step configured to check if the first protocol Pi announces the following communication protocol Pi+1 of the protocol chain:
-in the event of an announcement, the following protocol Pi+1 thus announced is identified;
-while in the event of non-announcement, analyze the following protocol Pi+1 according to a classification step by session detection;
-analyze according to a classification step by session detection, configured to check if the Pi+1 protocol is attached to a protocol chain known according to a dynamic decision tree by querying a database session dynamics including identified protocol chains:
-in case of attachment, the Pi+1 protocol is identified, and the Pi+2 protocol is analyzed by repeating the detection classification steps explicit, classification by session detection;
- while in the event of non-attachment, analyze the Pi+1 protocol according to a classification step by deep packet inspection;
-analyze the Pi+1 protocol according to a classification step by inspection deep packet, configured to identify the communication protocol of the packet Pi+1 according to a dynamic decision tree correlated to a base of knowledge data including analysis parameters protocols and a base of markers specific to each known protocol;
- in the event of a failure to identify the Pi+1 protocol, send a list of potential protocol candidates to be considered according to at least two detection branches, each detection being attached to a subsession determined to analyze the following protocol(s) Pi+n with by repetition of the classification steps by explicit detection, of classification by session detection, and classification by deep inspection of pack until at least one protocol whose identity is certain is identified;
-in the event of identification of a Pi+n protocol whose identity is certain on a detection branch, retroactively validate the detection branch, and discard the remaining uncommitted detection branches;
-in the event of absence of identification of a Pi+n protocol whose identity is certain on a detection branch, classify the PH-1 protocol as unknown retroactively; And -associate a label to data packets based on each session for which the protocols have been identified.

[0012]
It should be noted that the analysis of the binary characteristics of each pack of a communication session (or chain of protocols) is implemented according to the invention until being able (or not) to determine (identify) the protocol used in this session.

[0013]
Such an approach according to the invention has the advantage of making it possible to have A
higher labeling rate than previous approaches, to the extent or her can be executed from layer 2 to layer 7 of the OSI model, in a single pass packet analysis. It also allows you to identify channels of protocols in the case of tunneling protocols, or protocols to detection delayed as well as continuous detection, even if a protocol is not not identified immediately, detection of subsequent protocols continues.

[0014]
In addition, thanks to the use of the dynamic session database storing previously identified communication sessions, this invention is faster than previous solutions based on a inspection of all packages.

[0015] According to another aspect of the invention, the method comprises furthermore after each classification step, a step of calculating a digital fingerprint of session from a chosen hash function, said digital fingerprint of session being calculated on the basis of the first identified protocol, and on the imprint previously calculated numeric of the already identified protocol chain without taking into account the attached content, each digital footprint being calculated on the basis of parameters (or tuple) chosen and specific to each type of protocol, each type of protocol having its own number of defined markers;
and a step of recording the calculated session digital fingerprint After each protocol identification step following the classification step of each protocol by deep packet inspection or after the validation step retroactive, in a hash table integrated into the dynamic session database, each digital fingerprint being linked to at least one chosen session, said digital fingerprints calculated after each classification step of each protocol by deep packet inspection being able to be updated retroactively in the event of delayed identification of a protocol according to the step of verification.

[0016] Advantageously, the Applicant observed that the management dynamics of digital prints according to the invention allows the digital print of a non-validated protocol to be updated a posteriori, this evolving extent that the packet is read.

[0017] This unique algorithm makes it possible to detect all the types of protocols with a single probe, i.e. not limited to sequences simple, complex, tunneled and multiplexed protocols.

[0018] Management of digital imprints of the process according to the invention also has the advantage of avoiding a step of cutting the chain protocol (slicing in English) and thus eliminate the risk of loss information, and also allows you to obtain truly unique identifiers on the chain of protocol, regardless of the length of said chain of protocols which compose the OR
the packets.

[0019] In practice, in the event of detection of tunneled protocols, multiplexed, multichannels detected with certainty, the method according to the invention includes the following sub-steps:

-Generate at least one detection branch per verified protocol to support account for subsequent detection, -Calculate a session fingerprint from a function hash chosen for each detection branch, each detection branch being attached to a specific sub-session to analyze the protocol(s) following Pi+n; And -Save the session fingerprint of each detection branch attached to a protocol chain, the recording step being configured For assign a unique identifier to each detection branch of the protocols tunneled, multiplexed, or multi-channel detected.

[0020] Advantageously, the method according to the invention allows to obtain a unique digital fingerprint per channel, or branch of detected protocols, and Thus avoid a loss of information such as two channels having the same identifier.

[0021] For example, the hash table is updated if the detection of at least a session protocol requires the implementation of detection delayed on several packages.

[0022] In practice, the knowledge database includes a basis of static knowledge data, in which the database of static knowledge includes markers based on knowledge empirical characteristics of the protocols, and in which the awareness empirical includes algorithmic means of detecting protocols based on localization standards, logical links between the protocols of communication, requests for comments and frequency models of communication protocols.

[0023] Furthermore, the method according to the invention comprises the execution of an analysis data followed by data extraction for data packets on the base of the associated label.

[0024] According to a first embodiment of the invention, running the analysis protocols and the execution, analysis and extraction of data for A
data packet are performed dynamically on a single core processing of a multi-core processor.

[0025] According to a second embodiment of the invention, running the analysis and data extraction for the data packet are performed on several processing cores of a multi-core processor.

[0026] In practice, the method according to the invention comprising the flow separation of data into a plurality of processing queues in which analysis of protocols followed by analysis and extraction of data are carried out on data packets in each of the processing queues.

[0027] Furthermore, the separation of the data flow in the plurality of files processing wait is based on an RSS scaling algorithm side reception.

[0028] According to one embodiment of the method according to the invention, the analysis of protocol is executed dynamically on layers 2 to 7 of the model of OSI layers.

[0029] The invention also relates to a computer system analysis of a data stream of data packets received via a communications network, the data flow comprising batches of packets each defined by a string of communication protocols attached to at least one session.

[0030] According to another general definition of the invention, the system comprises A
processor comprising at least one processing core for processing a number predetermined data packets per minute and a data analysis engine protocol on at least one processing core, in which the analysis engine of protocol -analysis of the first protocol in a chain of communication protocols according to an explicit detection classification step configured? To check if the first protocol announces the next communication protocol in the chain of protocols, in the event of an announcement, the following protocol thus announced is identified, while in the event of non-announcement, the analysis engine is able to analyze the protocol according to a classification step by session detection;
-analysis according to a classification step by session detection, configured to check if the PH-1 protocol is attached to a protocol chain known according to a dynamic decision tree by querying a database session dynamics including identified protocol chains:

-in case of attachment, the Pi+1 protocol is identified, and the analysis engine is capable of analyzing the PH-2 protocol by repeating the steps of classification by explicit detection, classification by session detection;
- while in the event of non-attachment, the analysis engine is able to analyze the Pi+1 protocol according to a classification step by deep packet inspection;
-analyzes the Pi+1 protocol according to a classification step by inspection deep packet, configured to identify the communication protocol of the packet Pi+1 according to a dynamic decision tree correlated to a base of knowledge data including analysis parameters protocols and a base of markers specific to each known protocol;
- in the event of a failure to identify the Pi-F1 protocol, the analysis engine East capable of issuing a list of potential protocol candidates to be taken into account counts according to at least two branches of detection, each detection being attached to a specific sub-session to analyze the protocol(s) following Pi+n with r-12 by repetition of the classification steps by detection explicit, classification by session detection, and classification by deep packet inspection until identifying at least one protocol whose the identity is certain;
-in the event of identification of a Pi+n protocol whose identity is certain on a detection branch, the analysis engine is able to retroactively validate there detection branch, and discard the remaining detection branches not validated;
-in the event of absence of identification of a Pi+n protocol whose identity is certain on a detection branch, the analysis engine is able to classify the Pi+1 protocol as unknown retroactively; And -a labeling engine capable of associating a label with data packets according to the protocols thus identified.

[0031] In practice, the protocol analysis engine:
-calculates a session fingerprint from a hash function chosen after each classification step, said digital fingerprint being calculated on the basis of the first identified protocol, and on the fingerprint digital previously calculated from the already identified protocol chain without taking into account account of the attached content, each digital footprint is calculated based on of parameters (or tuple) chosen and specific to each type of protocol, each type protocol with its own number of defined markers (n-Tuples);
-saves the calculated session fingerprint after each step protocol identification following classification step of each protocol by deep packet inspection or after the retroactive validation step, in a hash table integrated into the dynamic session database, each digital fingerprint being linked to at least one chosen session, said fingerprints numerical calculated after each classification step of each protocol by deep packet inspection being able to be retroactively updated in case delayed identification of a protocol according to the verification step.

[0032] The protocol analysis engine of the system according to the invention comprises in in addition in case of detection of tunneled, multiplexed, multichannel protocols, or multiplexed multichannels detected with certainty, -Generates at least one detection branch per verified protocol to support account for subsequent detection, -Calculates a session fingerprint from a hash function chosen for each detection branch, each detection branch being attached to a specific sub-session to analyze the protocol(s) following; And -Records the session fingerprint of each detection branch attached to a protocol chain, the recording being configured to assign a unique identifier for each detection branch of the protocols tunneled, multiplexed, or multi-channel detected.

[0033] The system according to the invention further comprises a base data from knowledge comprising a static knowledge database in which the static knowledge database includes markers, also called labels, based on empirical knowledge of characteristics of protocols, and in which empirical knowledge includes means protocol detection algorithms based on standards on the location, logical links between communication protocols, requests for Comments and frequency patterns of communication protocols.

[0034] In practice, the system according to the invention comprises a analysis engine executable content on at least one processing core to analyze and extract the data packet based on the associated label.

[0035] According to one embodiment of the invention, the motor analysis of protocol and the content analysis engine consecutively perform the analysis of protocols followed by analysis and data extraction for the flow of data of data packets, and in which the content analysis engine performs separately parsing and extracting data for data packets labeled differently.

[0036] The system according to the invention further comprises a card interface network coupled to the processor, in which the network card separates the flow of data packets into a plurality of queues of treatment, and wherein the protocol analysis engine and the protocol analysis engine content perform packet analysis and data extraction from packets on each pluralities of processing queues.

[0037] For example, the network card (NIC) separates the data flow from the data packets based on RSS side scaling algorithm reception.

[0038] The method and system according to the invention allow advantageously to identify protocol layers that have not been announced. In the case where these protocols do not announce themselves, or do not announce those that follow, and allow to look for a set of markers likely to validate the identification of a protocol in particular.

[0039] Advantageously, the system and method according to the invention allow also to carry out validation by multiple and logical bounces of the protocols analyzed if a layer declared as “safe” is validated, said layer safe thus making it possible to validate all the classification choices carried out.
In other words, the preceding stacks of protocols can be deduced correctly.

[0040] Surprisingly, the method and the system according to the invention allow you to wait for several packets to validate a chain stacking of protocols for a given session, and being able to keep a uniqueness session per branch while guaranteeing a unique digital footprint per session and by detection branch by performing fingerprint calculations continuous digital data on each layer of protocols contained in a packet.

[0041] Finally, the method and the system according to the invention allow us to maintain very deep granularity of network data analysis, and thus limit the protocol identification errors and ensure analysis data reliable.
BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 illustrates a computer system for analyzing a data flow of data packets received via a communications network, in accordance with a example of implementation of the present invention,

[0043] Figure 2 illustrates the diagrams of the computer system, in accordance with an example of implementation of the present invention,

[0044] Figure 3 illustrates the computer system for analyzing a data flow of data packets received via a communications network, in accordance with a example of implementation of the present invention,

[0045] Figure 4 illustrates the flow of events within of a nucleus of processing of the computer system, in accordance with an example of implementation artwork of the present invention,

[0046] Figure 5 illustrates the step of reception and distribution of packets by a network interface card according to the invention,

[0047] Figures 6, 7 and 8 illustrate the steps of analyzing a data flow data packets received via a communications network, in accordance with a example of implementation of the present invention, and

[0048] Figures 9, 10 and 11 illustrate examples of analysis linear in accordance with the invention;

[0049] Figures 12, 13, and 14 illustrate an example of analysis applied to a detection of delayed detection protocols in accordance with the invention;

[0050] Figure 15 illustrates an example of analysis applied to a detection of protocols with management of an associated hash table conforming to the invention;

[0051] Figures 16 and 17 illustrate the management of imprints digital during detection according to the invention; And

[0052] Figure 18 illustrates an example of analysis applied to a detection of multiplexed and multichannel protocols with management of an associated hash table in accordance with the invention.

[0053] Other advantages and characteristics of the invention will appear from the exam description and drawings.
DETAILED DESCRIPTION

[0054] The above techniques are described in more detail in reference to Figures 1 to 18. It should be noted that the description and figures do not only illustrate the principles of this subject matter as well as the examples described herein document and should not be construed as a limitation of the present subject matter. He is therefore understood that various arrangements can be designed which, although not not explicitly described or shown in this document, the following statements After stating principles, aspects and implementations of this object, as well as specific examples thereof, are intended to encompass equivalents of these.

[0055] Figure 1 illustrates a computer system 100 for analyzing a flow of data from data packets received via a communications network (not illustrated), in accordance with an example of the present invention. The computer system can be either a standalone computer or a combination of several systems computers working together in an IT environment distributed.
Examples of computer system 100 may include, but are not limited to, THE
desktop computers, laptops and smartphones, as well as THE
personal digital assistants (PDAs).

[0056] The communication network can be a wireless network or wired, or a combination of these. The communication network can be a set of individual networks, interconnected with each other and functioning as only one large network. Examples of such individual networks include, but are not limited to however limited thereto, the network of the Global System for Mobile Communications (GSM), the network of the Universal Mobile Telecommunications System (UMTS), the LTE (Long Term Evolution), the Personal Communications Services (PCS) network, THE
time division multiple access network (CDMA), the CDMA network (Code-Division Multiple Access), the next generation network (NGN), the network public switched telephone (PSTN) and the integrated digital network services (ISDN). According to the terminology, the communication network includes various entities network, such as gateways and routers; However, these details have been omitted to maintain brevity of description.

[0057] It should be noted that, although the provisions following are provided with regard to the computer system 100, the implementation examples of the present invention can also be implemented on various devices or networks used by a network service provider, providing connectivity network with one or more subscribers, such as government organizations, of the multinational companies, corporations, businesses and others establishments. THE
network service provider can serve as a connection channel between the network communications and computing devices of its subscribers. It suits to note that the network service provider may implement various other equipment, devices, network nodes interconnected by one or more wired or wireless network links to provide network connectivity to subscribers. Network nodes can typically include switches, of the routers, access points and data links that can facilitate there communication between various subscriber hosts (e.g. computers server, client computers, mobile devices, etc.) that can produce and consume data traffic. In another example, the examples can be implemented on various network devices used by establishments /
individual organizations, providing network connectivity and security to one or many of its users.

[0058] With reference to Figures 1 to 18, the computer system 100 may include a processor 102, when the processor 102 comprises at least one core processing 104. The computer system 100 may further include an engine protocol analysis engine 106 and a labeling engine 108. In one example, the protocol analysis engine 106 and labeling engine 108 can be executable on at least one processing core 104.

[0059] The term analysis engine 106 will be used to designate the term protocol analysis engine 106.

[0060] The processor 102 comprises at least one processing core configured to process a predetermined number of data packets per minute And a protocol analysis engine 106 on at least one processing core 104.

[0061] In an example implementation, the analysis engine of protocol 106 analyzes the data stream comprising batches of packets each defined by a chain of communication protocols attached to at least one session. Said protocol analysis engine 106 is configured to analyze the first Pi protocol of a chain of communication protocols according to a classification by detection explicit S10, S11, S12, S13 to check if said first packet Pi announces THE
communication protocol of the following data packet Pi+1 of the chain of protocols.

[0062] In the event of an announcement, the protocol of the following packet, as well announced, is identified S100.

[0063] In the event of non-announcement, the analysis engine 106 is suitable for analyze the next packet Pi+1 to check if it is attached to a protocol chain known and stored in the dynamic database BDDS including chains of protocols already identified, according to a classification by session detection S20, S21, S22.

[0064] The protocol analysis engine 106 is configured to apply a classification method by session detection S20 consisting of checking if the PH-1 protocol is attached to a known protocol chain according to a tree of dynamic decision by querying a dynamic database of session BDDS including identified protocol chains.

[0065] In practice, the computer system 100 is, moreover, coupled to the base of knowledge data 110 on data packets comprising a stage dynamic BDDS specific to storing sessions, as will be described more in detail below, and a BDC stage suitable for storing knowledge relating to protocols. It should be noted that if the knowledge database 110 on the data packets was illustrated as thus distinct from the system computer science 100, 110 data packet knowledge database can also be hosted in the computer system 100 depending on its abilities.

[0066] In the event of attachment, the protocols of the protocol chain known are identified (step S100), the PH-1 protocol is identified, and the motor analysis 106 is capable of analyzing the Pi+2 protocol by repeating the classification steps by explicit detection S10, classification by session detection S20.

[0067] In the event of non-attachment, the analysis engine 106 is able to analyze the protocol following Pi-i-1 according to classification by deep inspection of S40 package, S42, S44, S46.

[0068] According to classification by deep packet inspection S40, the engine analysis 106 is configured to identify the communication protocol of the pack Pi+1 according to a dynamic decision tree correlated to a database of BDC knowledge including protocol analysis parameters and base specific markers, also called labels (see figure 11 and figure 15) to each known protocol.

[0069] In the event of a failure to identify the PH-1 protocol, the engine analysis 106 is capable of issuing a list of potential protocol candidates to be taken into account account according to at least two possible detection branches, each detection being attached to a specific sub-session to analyze the protocol(s) following Pi+n with r-i2 by repetition of the analyzes according to the classification by explicit detection S10, by session detection S20, and by inspection deep of S40 packet until identifying at least one protocol whose identity is certain.

[0070] In the event of identification of a Pi+n protocol whose identity is certain by the analysis engine 106, on a detection branch, said analysis engine 106 is capable of retroactively validating S60 the detection branch, and of discarding THE
other remaining detection branches not validated.

[0071] In the event of absence of identification of a Pi+n protocol whose identity is certain on a detection branch, the analysis engine 106 is able to classify the protocol Pi+1 as unknown S60 retroactively and continue the analysis of following data packets.

[0072] The protocol analysis engine 106 is also capable of calculating a Hi+n session fingerprint from a chosen hash function after each classification step S10, 320, S40, said digital fingerprint Hi+n being calculated on the basis of the first identified protocol, and on the imprint previously calculated digital Hi+n-1 of the protocol chain already identified without taking into account the attached content or payload.

[0073]Each digital fingerprint Hi+n is thus calculated on the basis of parameters or tuple chosen and specific to each type of protocol, each type of protocol with its own number of defined tuples, i.e. n-Tuples.

[0074] For each protocol, a choice of relevant parameters is made from manner dynamic, thus making it possible to manage complete sessions outside of TCP/UDP.

[0075] The analysis engine 106 is then able to record the imprint digital session Hi+n calculated after each identification step of protocol following step S40 or after retroactive validation step S60, in a table of hash integrated into the dynamic BDDS session database, each Hi+n digital fingerprint being linked to at least one chosen session, said Hi+n digital fingerprints calculated after each classification step of each protocol by deep inspection of S40 packet being able to be implemented up to date retroactively in the event of delayed identification of a protocol according to the step of S60 verification.

[0076] In practice, when the analysis engine 106 does not identify not a protocol Pi+1, and issues a list of potential protocol candidates to take into account account according to at least two possible detection branches B1, B2 for detection delayed, each detection being attached to a determined sub-session to analyze the OR
the following protocols Pi+n with r-12 by repeating the analyzes according to the classification by explicit detection S10, by session detection S20, and by S40 deep packet inspection until at least one protocol is identified of which the identity is certain, the analysis engine 106 calculates a fingerprint digital Hi+n session from a chosen hash function, for each branch of detection B1, B2 being attached to a specific subsession to analyze the OR
the following protocols Pi+n.

[0077] The Hi+n session digital fingerprints thus calculated allow the a posteriori identification of one or more protocols previously not identified, even if session detection requires several packets, the table of hash may be updated to take these new elements into account and so do not never lose a single packet or associated data.

[0078] In addition, the analysis engine 106 records the fingerprint digital Hi+n session of each detection branch B1, B2 attached to a chain of protocol, the record being configured to assign an identifier unique to each detection branch_

[0079] With reference to Figure 8, by way of example, the H1 digital fingerprints, H2, and 1-13 are calculated respectively after identification of the protocols Pi, PH-1 and Pi+2 of the protocol chain, and when the classification according to a inspection Deep S40 packet fails to identify PH-1 protocol, fingerprint digital H2T is calculated, and in the case where the protocol identification Pi+3 valid the protocol chain, and PH-1 can be deduced, then, Pi+1 is validated And the H2T digital footprint is updated by calculating and recording a new H2 digital fingerprint.

[0080] According to a particular embodiment of the invention, the analysis engine 106, in case of detection of tunneled, multiplexed, or multichannel protocols detected with certainty, is capable of generating at least one branch of detection Ai, A2, Bi, B2, Cl, 02 by verified protocol to be taken into account for the subsequent detection.

[0081] For each generated detection branch Ai, A2, Bi, B2, Cl, C2, the analysis engine 106 calculates a Hi+n session digital fingerprint from of a chosen hash function, each detection branch being attached has a sub-session determined to analyze the following protocol(s) PH-n;
And

[0082] -Records the Hi+n session digital fingerprint of each branch of detection attached to a protocol chain, the recording being configured to assign a unique identifier to each detection branch of the tunneled, multiplexed or multichannel protocols detected.

[0083] Advantageously, the calculated hash evolves as the packet of data is read, making it possible to analyze and detect all protocols with a single probe (i.e. simple sequences, complex, tunneled, multichannel and multiplexed), and thanks to this repetition of hash calculation, on each layer, each of the identifiers is actually unique, regardless of the length of the protocol chain that makes up the or THE
packages.

[0084] The system 100 further comprises the labeling engine 108, specific to associate a label with data packets based on protocols as well identified.

[0085] The analysis engine 106 is capable of recording the state of session if the current session is unknown with a fingerprint calculated with n-tuples S31, 32 and S33.

[0086] Figure 2 illustrates the diagrams of the computer system 100 for analysis of the data flow of data packets received via the network of communication, in accordance with an example of implementation of the present invention.

[0087] As already described, the computer system 100 can include the processor 102, or the processor 102 may include several processing cores 104-1, 104-2, 104-3, ..., 104-n. The functional block functions labeled as processor(s), can be provided through the use of dedicated hardware as well as equipment capable to execute instructions. When provided by a processor, the functions can be provided by a single dedicated processor, by a single processor sharing or by a plurality of individual processors, some of which may be shared.
Furthermore, explicit use of the term processor would not be interpreted as referring exclusively to hardware capable of executing instructions and may implicitly include, but is not limited to, the processor hardware of signal digital processor (DSP), the network processor, the integrated circuit specific to the app (AS IC), FPGA (field programmable gate array), read-only memory (ROM) for storing instructions, random access memory (RAM), storage not volatile.
Other materials, standard and/or personalized, can also be included.

[0088] The computer system 100 can also include a memory 202 coupled to processor 102, where memory 202 can include any readable media by computer, including, for example, volatile memory (e.g. RAM) and or non-volatile memory (e.g. EPROM, flash memory, etc.).

[0089] In addition, the computer system 100 may include a interface card network (NIC) 204 coupled to processor 102 and memory 202. The card network 204 may be an integrated component of the computer system 100 or may be a separate component, externally coupled to the computer system 100.

[0090] The computer system 100 can, in addition, include the 206 engines, or the engines 206 may include protocol analysis engine 106, engine labeling engine 108 and the content analysis engine 112. In one example, the 206 motors can be implemented as a combination of hardware and firmware. In the examples described here, such combinations of hardware and of Firmware can be implemented in several different ways.
By example, the engine firmware may be executable instructions from the processor, stored on a non-transitory storage medium, readable by machine and the engine hardware may include a processing resource (e.g.
example, implemented as a single processor or a combination of several processors) to execute these instructions.

[0091] In the present examples, the readable storage medium per machine can store instructions which, when executed by the resource of processing, implement the engine functionalities. In such examples, THE
computer system 100 may include the human-readable storage medium machine storing the instructions and processing resource to execute the instructions.
In other examples of the present subject, the storage medium readable by machine may be located in a different location, but accessible to the system computer science 100 and to processor 102.

[0092] The computer system 100 can, in addition, include the data 208, which serve, among other things, as a repository for storing data that can be retrieved, processed, received or generated by the protocol analysis engine 106, the labeling engine 108 and content analysis engine 112. Data 208 may include protocol analysis data 210, data labeling 212, content analysis data 214 and other data 216. In a example, data 208 can be stored in memory 202.

[0093] In an example implementation, the network card 204 can receive the Data flow of data packets through the communication network. There map network 204 can separate the data stream into multiple RX queues of processing and allocate each processing queue to at least one core of treatment 104-1, 104-2, 104-3, ..., 104-n. In an example, the network card 204 can separate data flow into multiple processing queues into function of the RSS (Receive Side Scaling) algorithm scaling on the reception side. A
such algorithm allows packets to be distributed across multiple queues Psa, Psb (reception queues). There are several distribution algorithms, the no longer used names Toeplitz from Microsoft (registered trademark).

[0094] It should be noted that each of the multiple cores of treatment 104-1, 104-2, 104-3, .., 104-n can allow different instances of the multiple motors on these. For example, separate instances of the analytics engine of protocol 106, labeling engine 108 and content analysis engine can be executed in parallel on each of the processing cores 104-1, 2, 104-3 104-n. However, to facilitate understanding, The example following implementation has been explained with regard to a single core of treatment 104-1 of the processor 102, hereinafter referred to as the processing core 104.

[0095] With reference to Figure 5, an example of reception and packet distribution.

[0096] The network card 204 receives the packets according to step S200.

[0097] According to step S202, the network card directly sends the packets to cache memory 202.

[0098] According to step S204, the network card sends the fields of the packages on multiple RX queues (queues) and chooses the correct queue according to the algorithm RSS (receive side scaling) scaling on the reception side.

[0099] According to step S206, each CPU core is linked to a queue RX.

[00100] According to step S208, each CPU core recovers a LOT batch of packets from cache memory (RAM) 202.

[00101] According to step S210, the Pn packet is received by a CPU core, the first protocol in the protocol chain (or stack) is analyzed according to the analysis DAP (S212) in accordance with the invention.

[00102] In one example, the dynamic session packet database BDDS can be stored in protocol 210 analysis data. In a other example, the BDDS database can be included in the database of 110 knowledge about data packets.

[00103] In this example, in addition to the dynamic session database BDDS, 110 data packet knowledge database can also include a database of static data packets. The base static data on data packets may include markers based on an empirical knowledge of the characteristics of the protocols, and in which empirical knowledge includes algorithmic means of detecting protocols based on standards on localization, logical links between THE
communication protocols, requests for RFC comments and templates frequency of communication protocols_

[00104] The protocol analysis engine 106 can also store the protocol communication thus identified in the labeling data 212. The motor labeling device 108 can then access the labeling data 212 and associate a label on the data packets thus analyzed and whose protocols are like this identified.

[00105] The labeling engine 108 then transmits the data packets tagged to the content analysis engine 112. The content analysis engine analyzes and extracts data packets based on their label East associated. For example, the content analysis engine 112 can analyze and extract a first data packet with a label indicating a first protocol of communication based on the first communication protocol. Likewise, the engine content analysis 112 can analyze and extract a second packet of data with the label indicating a second communication protocol differently of first data packet. The content analysis engine 112 can then store the data packets analyzed and extracted into the analysis data of content 214.

[00106] In one example, the content analysis engine 112 can analyze and extract data packets (or metadata from said packets) to to watch and visualize data traffic, detect a reduction in the quality of service, detect cyberattacks and identify any inconsistencies in the configuration of the network. If the content analysis engine 112 detects one of the events mentioned above based on data analysis and mining, engine content analysis 112 can generate a trigger indicating the occurrence of the event when analyzing the data and extracting a set of packages of the data flow. In such a situation, all of the packages of Data can be stored for further processing. In an example, all data packets can be stored in other data 216.

[00107] Figure 3 illustrates the computer system 100, in accordance with a other example of implementation of the present invention. As already described, the system computer 100 may include processor 102 having multiple cores treatment 104-1, 104-2, 104-3, ..., 104-n. The computer system 100 can, in addition, include the network card 204 coupled to processor 102 and the multiple cores of treatment 104-1, 104-2, 104-3, ..., 104-n which are included therein. Furthermore, each of the hearts of treatment multiples 104-1, 104-2, 104-3, ..., 104-n can make it possible to execute instances distinct from the protocol analysis engine 106, the labeling engine 108 and of content analysis engine 112. In addition, the computer system 100 can be coupled to the data packet knowledge database 110.

[00108] The content analysis engine 112, executed on the processing core 104-1, can then analyze and extract the first data packet by function of the data label associated with it.

[00109] In one example, the protocol analysis engine 106 and the engine content analysis tool 112 can sequentially perform the analysis of DAP protocol as illustrated in Figures 6 and 7, followed by analysis and extraction data DAC for the data stream received via the communication network.
By example, once the protocol analysis engine 106 has identified the protocol of communication for the first data packet, the first data packet can be labeled and transmitted to the content analysis engine 112 for analysis and data extraction.

[00110] Alternatively, while the content analysis engine 112 performs analyzing and extracting data on the first data packet Pn, the engine protocol analysis 106 can simultaneously start executing the analysis DAP
for a second data packet Pn+1 following the first data packet in the Pn data stream.

[00111] In practice, the execution of the DAP analysis can be followed in a manner sequential analysis and extraction of DAC data for packets of data on a single processing core of the processor.

[00112] Alternatively, DAP analysis and DAC extraction of data which follows DAP analysis can be processed in parallel on one or more cores or machines dedicated, which facilitates scalability to handle a higher flow of data received from communications network. Thus, the techniques described above can facilitate the processing data streams with data traffic greater than 100 Gbps.

[00113] In another example, as illustrated in Figure 4, an instance of the protocol analysis engine 106 as well as several instances of the engine analysis content 112 can be executed on the processing core 104-1.
Otherwise said, once the protocol analysis engine 106 has performed the analysis DAP on the data packets of the data stream and identified the protocol of communication for data packets, the processing core 104-1 can allow execution parallel of several instances of the content analysis engine 112 for treat data packets based on different labels associated with the data packets data, the different labels being associated according to the protocol of communication identified for the data packets of the data flow.

[00114] In practice, a single processor core processes consecutively DAP protocol analysis followed by DAC content analysis and extraction.

[00115] With a view to scalability, it is possible to dedicate cores, of the complete processors or dedicated machines whose objective is to make turn multiple DACs, in case the analysis and extraction of metadata is too much heavy to be done on a single processor core

[00116] In this way, several data packets having labels different associated can be processed in parallel by the core of treatment 104-1, thus increasing the overall throughput of analyzed data packets and extracted by the computer system 100 in a given period of time.

[00117] Alternatively, the design of a solution based on a treatment asynchronous, two-stage packets (DAP on the one hand and DAC on the other hand) allow a physical break, by separating the DAP processing from the DAC processing (here the DAC processing is following DAP processing for the same packet data).
Based on the needs required by the user, the resources allocated to DAC
may become congested. This break then makes it possible to dedicate some cores to a unique work of the DAC. Beyond single processor cores CPU, it is then possible to dedicate complete processors to the DAC, or even whole machines.

[00118] With reference to Figures 6 to 18, the invention also relates to a process analyzing a data stream of data packets received via a network of communication, the data flow comprising defined batches of packets each by a chain of communication protocols attached to at least one session.

[00119] The method according to the invention comprises an analysis of DAP protocols according to a first step of analysis of the first Pi protocol of a chain of communication protocols according to a detection classification step explicit S10 configured to check if the first Pi protocol announces the communication protocol following Pi+1 of the protocol chain.

[00120] In practice, in the event of an announcement, the following protocol Pi+1 thus announced East identified, while in the event of non-announcement, the method according to the invention is configured to analyze the following protocol Pi+1 according to a step of classification by S20 session detection.

[00121] The classification step by session detection S20 in accordance with the invention is configured to check whether the Pi+1 protocol is attached to chain of known protocols according to a dynamic decision tree by interrogation a dynamic BDDS session database including chains of identified protocols.

[00122] According to one embodiment of the invention, after identification of a protocol during the classification step by session detection S20, the base of dynamic BDDS session data is updated.

[00123] In the event of attachment, the Pi+1 protocol is identified, and the Pi+2 protocol is analyzed by repeating the classification steps by explicit detection S10, from classification by session detection S20.

[00124] Alternatively, in the event of non-attachment, the Pi+1 protocol is analyzed according to a classification step by deep packet inspection S40.

[00125] The classification step by deep packet inspection S40 is configured to identify the communication protocol of the Pi+1 packet according to A
dynamic decision tree correlated to a knowledge database BDC including protocol analysis parameters and a database markers specific to each known protocol.

[00126] In practice, in the event of detection of specific markers of a protocol tested, the Pi+1 protocol is then identified.

[00127] According to one embodiment of the invention, after identification of a protocol during the classification step by deep packet inspection S40, the BDDS dynamic session database is updated.

[00128] Alternatively, in the event of a failure to identify the Pi+1 protocol, THE
method according to the invention comprises a sub-step of transmitting a list of potential protocol candidates for PH-1, to be considered according to less two detection branches B1, B2, each detection being attached to a sub-section session determined to analyze the following protocol(s) Pi+n with n2 by repetition of the classification steps by explicit detection S10, of classification by S20 session detection, and classification by deep inspection of S40 packet until it identifies at least one protocol whose identity is certain.

[00129] In other words, a detection branch B1, B2 will be generated on there basis of a hypothesis of a given potential protocol, and the identification of protocol Pi+n after Pi+1 will be implemented by repeating the steps of classification S10, S20 and S40.

[00130] If a Pi+n protocol whose identity is certain is identified on a branch detection branch B1, B2, the detection branch B1, B2 will be retroactively validated, and the remaining uncommitted detection branches will be discarded.

[00131] According to one embodiment of the invention, after identification of a protocol during the classification steps by session detection S20 and classification by deep packet inspection S40, or by identification a subsequently, the dynamic BDDS session database is updated.

[00132] In the case where the identification of a Pi+n protocol of which identity is certain is not possible on a detection branch, the Pi-i-1 protocol is then classified as unknown S60 retroactively.

[00133] Advantageously, updating the dynamic database of BDDS session allows an acceleration of the identification process, and limit the protocols labeled as unknown.

[00134] The method further comprises a labeling step comprising the association of a label with the data packets according to each session for which the protocols have been identified.

[00135] The method according to the invention further comprises, after each step of classification S10, S20, S40, a step of calculating a digital fingerprint of session H i+n from a chosen hash function, said fingerprint digital Hi+n being calculated on the basis of the first identified protocol, and on the previously calculated digital fingerprint Hi+n-1 of the protocol chain already identified without taking into account the attached content.

[00136] In practice, each Hi+n digital fingerprint is calculated on the basis of parameters or dynamic tuples chosen and specific to each type of protocol, each type of protocol having its own number of markers defines also called n-Tuples.

[00137] As an example, the defined markers also called n-Tuples can not limited to the group formed by recipient IP, source IP, Port RECIPIENT, Source port, protocol, IP address, port, QoS settings QoS, Network Tag, Session Volume, Packet Size, Repeat Count (retry in English), version, type and version of the encryption algorithm, type of encryption, CERT (Computer Emergency Response Team in English) certificate, SNI value (indication of the server name or Server Name Indication in English), Packet size, IP returned, error flag (flag error in English), domain name, client version, server version, version encryption algorithm, compression algorithm, timestamp, Version of IP, host name (hostname in English), lease duration (lease-time in English), URL, user agent, number of bytes of attached content, content type, coded status, cookie header, client name, request service, code value error, request type, protocol value, response timestamp, level of privilege, keyboard type and language, product identification, size screen, or any other similar specific metadata extracted from the protocols in one or several data packets from the validated session, specific metadata analogs extracted from the content attached to one or more data packets of the validated session

[00138] By way of example in accordance with the invention, each protocol can with A
specific set of n-tuples:
PROTOCOLS EXAMPLES OF EXTRACTED METADATA
VLAN and VxLAN Network Tag MPLS ID
TCP Session volume, packet size, number of retry TLS version, type and algorithm version encryption, CERT of certificate, SNI value DNS
m Packet size, returned IP, error flag, domain number, rcode SSH Client version, server version, version algorithm encryption, compression algorithm Timestamp, IP version, Server IP addresses, IP address of DHCP endpoint, the original port/protocol ¨ TCP or UDP ¨ the hostname from the server or endponit, lease-time,...
HTTP Url, user-agent, number of payload bytes, content-type, status code, cookie header, customer name, service requested, error code value, type of Kerberos request, protocol value, response timestamp, level of privilege, encryption type, ...
LDAP session duration, number of logon-errors, end of session flag, query result code, error code, ...
RDP cookie username, keyboard type and language, version client, product ID, screen size, ...
Table of extractable metadata examples for a list of protocols choose.

[00139] The step of Hi+n digital fingerprint calculation is followed by a step recording of said Hi+n session digital fingerprint calculated after each protocol identification step following step S40 or after the stage of retroactive validation S60.

[00140]
The recording is carried out in a hash table integrated into the BDDS dynamic session database, each digital fingerprint Hi+n being linked to at least one chosen session.

[00141] In practical, the Hi+n digital fingerprints calculated after each classification step of each protocol by deep packet inspection being able to be updated retroactively in the event of delayed identification of a protocol according to verification step S60.

[00142] In other words, the hash table is updated if the detection from to least one session protocol requires the implementation of detection delayed on several S60 packets.

[00143] According to a embodiment of the invention, in the event of detection of tunneled, multiplexed, multichannel protocols in a certain manner, the process according to the invention comprises a first sub-step of generating at least a detection branch Ai, A2, B1, B2, Ci, C2 by verified protocol to be taken into account account for subsequent analysis.

[00144] According to a second sub-step, each detection branch AI, A2, B1, B2, Ci, C2 will be treated as a single protocol chain and capable of being analyzed, and includes a sub-step of calculating a digital fingerprint unique Hi+n session from a chosen hash function, attached to a subsession determined for each detection branch AI, A2, B1, B2, CI, C2, and allowing analysis of the following protocol(s) Pi+n.

[00145] Finally, the detection of tunneled, multiplexed, or multichannel includes a final sub-step of recording the digital fingerprint of Hi+n session of each detection branch Ai, A2, Bi, B2, Cl, C2, attached has a protocol chain, the recording step being configured to assign a unique identifier for each detection branch Ai, A2, Bi, B2, Cl, C2 of tunneled, multiplexed, multichannel, detected protocols, and so on advantageously do not confuse two sub-sessions that could lead to analysis information erroneous.

[00146] With reference to Figures 9, and 10 is shown, by way of example, a implementation of the method according to the invention according to a linear analysis in accordance to the invention.

[00147] Here the LOTI lot includes four individualized packages PO, Pi, P2, and P3.
The PO package supports the ETHERNET ETH protocol. The P1 package supports INTERNET IP protocol. P2 packet supports TCP protocol and P3 packet support http protocol.

[00148] After receipt of the LOTI batch of packets, the PO packet is read (step SDL1), here PO = ETH. At step SLD2, the analysis engine checks whether the PO packet announce it protocol of the next packet Pi. Here, we know that ETH always announces the protocol which follows. Here Pl = IP.

[00149] In step SDL3, the engine checks whether the packet P1 announces the protocol of next packet P2. Here we know that IP announces TCP.

[00150] In step SDL4, the engine checks if TCP announces the protocol of the pack following P3. The answer is negative, but knowledge of the protocols indicate that if TCP port = 80 then it is most likely that P3 = http. If the http test in P3 is checked or not, then the session is known or unknown.

[00151] In step SLD5, if the session is unknown (for example P3 is not http) then creation of a digital fingerprint of the IPs of source A, of recipient B, ports A and B and a protocol identifier. Then the session like this recognized for the first time is stored in the dynamic session database for subsequent analysis.

[00152] Referring to Figure 11, an example of analysis is shown applied to linear protocol detection for which the UDP protocol is identified, but does not announce the following protocol, the analysis engine 106 implementing work an analysis according to a classification by S20 session detection and by inspection deep S40, whose identified port is port:53, and for which one of the protocols the most likely is the DNS protocol.

[00153] The DNS protocol is identified as the most probable, and will therefore be tested by attempting to identify markers specific to the DNS protocol.

[00154] According to the embodiment, all the markers (or labels) for the DNS protocol are not found.

[00155] According to Figure 11, the QU IC protocol is identified using its markers clean by the analysis engine 106.

[00156] In practice, the identification of probable protocols and their tests in case identification failures are repeated until a limit on the number of tests chosen is achieved.

[00157] With reference to Figure 14, a second example is shown analysis applied to linear protocol detection with a posteriori identification For which the MPLS protocol is identified on a protocol chain, but does not announce not the following protocol,

[00158] Analysis by classification by deep inspection S40 does not allow to identify the associated protocol if the protocol does not include markers sufficient to be identified.

[00159] With reference to Figures 12 and 13, we have shown, by way of example, a implementation of the method according to the invention for an analysis applied to a detection of tunneling protocols, requiring delayed detection in accordance with the invention.

[00160] Here lot LOT2 includes four individualized packages PO, P1, P2, and P3.
The PO package supports the ETHERNET ETH protocol. The P1 package supports MPLS protocol. P2 package supports ETH CW protocol and P3 package Support IP protocol.

[00161] After receipt of the batch LOT2 of packets (step SPT1), the packet PO is read (step SPT2), here PO = ETH. In step SPT3, the analysis engine 106 checks whether THE
packet PO announces the protocol of the following packet P1 according to the step of classification explicit S10. Here we know here that ETH always announces the protocol which follows. Here P1 =
MPLS.

[00162] At step SPT4, the engine checks whether the packet P1 announces the protocol of next packet P2. Here we know that MPLS does not necessarily announce the protocol of next package.

[00163] The protocol analysis according to the invention implements an analysis according to classification by S20 session detection and deep inspection of pack S40, for which the most probable protocols are tested.

[00164] We then assume that P2 is followed by an ETH CW control word.

[00165] The method according to the invention will further comprise a step of assumption of the most probable remaining protocol, and will continue detection on the next protocol by testing the protocol(s) normally following the first supposed protocol.

[00166] In step SPT5, if P2 = ETW CW then it is probable that P3 = ETH, the classification steps S20 and S40 will then be repeated to check if ETH
is good identified and validated.

[00167] In step SPT6, if P3 = ETH then P3 announces P4 which here is IP.

[00168] In step SPT7, P4 is confirmed by the probe as IP.

[00169] At step SPT8, the protocol sequence chain is validated, P2 East retroactively validated as ETH CW.

[00170] In practice, the identification of probable protocols and their tests in case identification failure is repeated until a limit on the number of selected tests is achieved.

[00171] Advantageously, the detection method according to the invention, comprising management of a dynamic hash table on a base of n-tuples, associated with a protocol identification according to explicit classifications S10, by detection of session S20, by deep packet inspection S40, and by detection a posteriori, allows you to greatly limit the loss of visibility and eliminate errors by waterfalls when analyzing a very high-speed data stream, unlike systems of the prior art and in particular those based on an imprint calculation digital of type 5-tuple.

[00172] The Applicant has also observed that the systems of the prior art often require hardware techniques (FPGA or ASIC) which allow of carry out Packet Slicing (cutting the packet on the lower layers or higher) to speed up packet processing, while the solution according to the invention is a method not requiring material techniques for be implemented and maintain a stable packet processing speed for flow rates greater than 100 Gb/s as a non-limiting example.

[00173] Although examples have been described in language specific to methods and/or structural characteristics, it must be understood that the present invention is not limited to specific methods or features described. At otherwise, the specific methods and characteristics are disclosed and explained by way of examples of the present invention.

Claims (2)

Claims [Claim 1] Method for analyzing a data stream of data packets received via a communications network, the data flow comprising batches of packets each defined by a chain of communication protocols attached to at least one session, characterized in that the method comprises a protocol analysis (DAP) according to the following steps:
-analyze the first protocol (Pi) of a chain of protocols communication according to an explicit detection classification step (S10) configured to check if the first protocol (Pi) announces the following communication protocol (Pi+1) of the protocol chain:
-in the event of an announcement, the following protocol (Pi+1) thus announced is identified;
-while in the event of no announcement, analyze the following protocol (Pi+1) according to a session detection classification step (S20);
-analyze according to a classification step by session detection (S20), configured to check if the Pi+1 protocol is attached to a protocol chain known according to a dynamic decision tree by querying a database dynamic session (BDDS) comprising identified protocol chains:
-in case of attachment, the Pi+1 protocol is identified, and the Pi+2 protocol is analyzed by repetition of the classification steps by explicit detection (S10), of classification by session detection (S20);
- while in the event of non-attachment, analyze the Pi+1 protocol according to a stage of classification by deep packet inspection (S40);
-analyze the Pi+1 protocol according to a classification step by inspection deep packet (S40), configured to identify the communication protocol of the pack Pi+1 according to a dynamic decision tree correlated to a database of knowledge (BDC) including protocol analysis parameters and a base of markers specific to each known protocol;
- in the event of a failure to identify the Pi+1 protocol, send a list of candidates of potential protocols to be taken into account according to at least two branches of detection, each detection being attached to a determined sub-session for analyze the following protocol(s) Pi+n with r-i2 by repeating the steps of classification by explicit detection (S10), classification by detection of session (S20), and classification by deep packet inspection (S40) until identify at least one protocol whose identity is certain;
-in the event of identification of a Pi+n protocol whose identity is certain on a branch detection, validate (S60) retroactively the detection branch, and dismiss them remaining detection branches not validated;
-in the event of absence of identification of a Pi+n protocol whose identity is certain about a detection branch, classify the Pi+1 protocol as unknown (S60) retroactively; And -associate a label to data packets based on each session For which protocols have been identified.
[Claim 2] Method for analyzing a data stream of data packets received via a communications network according to claim 1, characterized in what after each classification step (S10, S20, S40):-calculate a session fingerprint (Hi+n) from a function of chosen hash, said digital fingerprint (Hi+n) being calculated on the basis of first protocol identified, and on the digital fingerprint previously calculated (Hi+n-1) of the protocol chain already identified without taking into account the attached content, each digital fingerprint (Hi+n) being calculated on the basis of parameters (or tuple) chosen and specific to each type of protocol, each type of protocol with its own number of defined markers (n-Tuples) ;
-save the digital session fingerprint (Hi+n) calculated after each stage protocol identification following step S40 or after the step of validation retroactive (S60), in a hash table integrated into the database dynamic session (BDDS), each digital fingerprint (Hi+n) being linked to at least one chosen session, said digital fingerprints (Hi+n) calculated after each classification step of each protocol by inspection deep packet (S40) being capable of being updated retroactively in the event delayed identification of a protocol according to the verification step (S60).

[Claim 3] Method for analyzing a data stream of data packets received via a communications network according to claim 2, characterized in what in the event of detection of tunneled, multiplexed, multichannel protocols certainty, the method according to the invention comprises the sub-steps following:
-Generate at least one detection branch per verified protocol to support account for subsequent detection, -Calculate a session fingerprint (Hi+n) from a function hash chosen for each detection branch, each detection branch being attached to a specific sub-session to analyze the protocols following Pi+n ; And -Record the session fingerprint (Hi+n) of each branch of detection attached to a protocol chain, the recording step being configured to assign a unique identifier to each detection branch of the tunneled, multiplexed, multichannel, or multiplexed protocols detected.
[Claim 4] Method for analyzing a data stream of data packets received via a communications network according to claim 2 or claim 3, characterized in that the hash table is updated if the detection of at less a session protocol requires the implementation of detection delayed on several packets (S60).
[Claim 5] Method according to one of claims 1 to 4, in which the base Knowledge Data Base (BDC) includes a database of static knowledge, in which the knowledge database static includes markers based on empirical knowledge of characteristics of the protocols, and in which empirical knowledge includes algorithmic means for detecting protocols based on standards on localization, logical links between protocols of communication, requests for comments (RFC) and templates frequency of communication protocols.

[Claim 6] Method according to one of claims 1 to 5, comprising in in addition to performing data analysis followed by data extraction (DAC) for data packets based on the associated label.
[Claim 7] Method according to claim 6, in which the execution of protocol analysis (DAP) and performing analysis and extraction of the data (DAC) for a data packet is carried out in a manner dynamics on a single processing core of a multi-core processor.
[Claim 8] Method according to claim 6 or 7, wherein the execution of Data analysis and extraction (DAC) for the data packet are carried out on several processing cores of a multi-core processor.
[Claim 9] Method according to one of claims 6 to 8, including in addition to separating the data stream into a plurality of queues of processing in which protocol analysis (DAP) followed by analysis and of Data extraction (DAC) are performed on data packets in each of the processing queues.
[Claim 10] Process according to claim 9, in which the separation of data flow in the plurality of processing queues is based on a RSS scaling algorithm on the receiving side.
[Claim 11] Method according to one of claims 1 to 10, in which protocol analysis (DAP) is performed dynamically on layers 2 to 7 of the layer model (0S1).
[Claim 12] Computer system for analyzing a data flow of packages of data received via a communications network, the data flow comprising batches of packets each defined by a chain of protocols communication attached to at least one session, characterized in that the system comprises a processor comprising at least one processing core for processing a number predetermined data packets per minute and a data analysis engine protocol (106) on at least one processing core, in which the engine protocol analysis (106):
-analysis of the first protocol (Pi) of a chain of communication protocols according to an explicit detection classification step (S10) configured to check if the first protocol (Pi) announces the following communication protocol (Pi+1) of the chain of protocols, in the event of an announcement, the following protocol (Pi+1) as well announced is identified, while in the event of non-announcement, the analysis engine of protocol (106) is capable of analyzing the protocol (Pi+1) according to a step of classification by session detection (S20);
-analysis according to a classification step by session detection (S20), configured to check if the Pi+1 protocol is attached to a chain of protocols known according to a dynamic decision tree by querying a database dynamic session (BDDS) comprising identified protocol chains:
-in case of attachment, the Pi+1 protocol is identified, and the analysis engine protocol (106) is capable of analyzing the Pi+2 protocol by repeating the steps of classification by explicit detection (S10), classification by detection of session (S20);
- while in the event of non-attachment, the protocol analysis engine (106) is suitable for analyze the Pi+1 protocol according to a classification step by inspection deep package (S40);
-analyzes the Pi+1 protocol according to a classification step by inspection deep packet (S40), configured to identify the communication protocol of the Pi+1 packet according to a dynamic decision tree correlated to a database knowledge base (BDC) including protocol analysis parameters and a base of markers specific to each known protocol;
- in the event of a failure to identify the Pi+1 protocol, the analysis engine protocol (106) is able to emit a list of potential protocol candidates to take taken into account according to at least two branches of detection, each detection being attached to a specific sub-session to analyze the protocol(s) following Pi+n with r-12 by repetition of the classification steps by detection explicit (S10), classification by session detection (S20), and classification by deep packet inspection (S40) until identifying at least one protocol whose identity is certain;
-in the event of identification of a Pi+n protocol whose identity is certain on a branch detection, the protocol analysis engine (1 06) is able to validate (S60) retroactively the detection branch, and discard the detection branches remaining unvalidated;
-in the event of absence of identification of a Pi+n protocol whose identity is certain about a detection branch, the protocol analysis engine (106) is capable of classify the Pi+1 protocol as unknown (S60) retroactively; And -a labeling engine capable of associating a label with data packets in function of the protocols thus identified.
[Claim 13] Computer system according to claim 12, characterized in what the protocol analysis engine (106):
-calculates a session fingerprint (Hi+n) from a function of hash chosen after each classification step (S10, S20, S40), said digital fingerprint (Hi+n) being calculated on the basis of the first protocol identified, and on the previously calculated digital fingerprint (Hi+n-1) of the chain of protocols already identified without taking into account the attached content, each digital fingerprint (Hi+n) being calculated on the basis of parameters (or tuple) chosen and specific to each type of protocol, each type of protocol having its own number of defined markers (n-Tuples);
-records the digital session fingerprint (Hi+n) calculated after each stage protocol identification following step S40 or after the step of validation retroactive (S60), in a hash table integrated into the database dynamic session (BDDS), each digital fingerprint (Hi+n) being linked to at least one chosen session, said digital fingerprints (Hi+n) calculated after each classification step of each protocol by inspection deep packet (S40) being capable of being updated retroactively in the event delayed identification of a protocol according to the verification step (S60).
[Claim 14] Computer system according to claim 12 or 13, characterized in that the protocol analysis engine (106), in the event of detection tunneled, multiplexed, multichannel, or multiplexed multichannel protocols detected with certainty, -Generates at least one detection branch per verified protocol to support account for subsequent detection, -Calculates a session fingerprint (Hi+n) from a function of hash chosen for each detection branch, each detection branch being attached to a specific sub-session to analyze the protocols following Pi+n ; And -Records the session fingerprint (Hi+n) of each branch of detection attached to a protocol chain, the recording being configured to assign a unique identifier for each detection branch of the protocol(s) tunneled, multiplexed, multichannel, or multiplexed multichannel detected.
[Claim 15] Computer system according to one of claims 12 to 14, in which the knowledge database further comprises a database static knowledge data in which the knowledge database static knowledge includes markers based on knowledge empirical characteristics of the protocols, and in which the awareness empirical includes algorithmic means of detecting protocols based on standards on localization, logical links between protocols of communication, requests for comments (RFC) and templates frequency of communication protocols.
[Claim 16] Computer system according to one of claims 12 to 15, further comprising a content analysis engine (112) executable on at minus one processing core to analyze and extract the data packet on the base of the associated label.
[Claim 17] Computer system according to claim 16, wherein THE
protocol analysis engine (106) and the content analysis engine (112) consecutively perform protocol analysis (DAP) followed by analysis and of data extraction (DAC) for data stream of data packets, And in which the content analysis engine separately performs the analysis and data extraction (DAC) for labeled data packets differently.
[Claim 18] Computer system according to claim 16 or 17, further comprising a network interface card (NIC) coupled to the processor, in which the network card separates the data stream from the data packets into a plurality of processing queues, and in which the engine analysis protocol (DAP) and the content analysis engine (112) perform analysis packets (DAP) and data extraction (DAC) of packets on each of the pluralities of processing queues.
[Claim 19] Computer system according to claim 18, wherein there network card (NIC) separates the data stream from data packets into function of the RSS scaling algorithm on the receiving side.