CN101184081A - Method and device for identifying point-to-point service in communication network - Google Patents
Method and device for identifying point-to-point service in communication network Download PDFInfo
- Publication number
- CN101184081A CN101184081A CN 200610148469 CN200610148469A CN101184081A CN 101184081 A CN101184081 A CN 101184081A CN 200610148469 CN200610148469 CN 200610148469 CN 200610148469 A CN200610148469 A CN 200610148469A CN 101184081 A CN101184081 A CN 101184081A
- Authority
- CN
- China
- Prior art keywords
- tcp
- point
- linking number
- analysis
- factor
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/104—Peer-to-peer [P2P] networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a method of identifying point-to-point services in a communication network, which comprises the following steps: TCP connection information is collected; the characteristics of TCP connections of the TCP connection information are analyzed; whether the service corresponding to the TCP connection is a point-to-point service is judged based on the analysis. The invention also discloses a device used to identify the point-to-point services in the communication network, which comprises a data collection unit, a data analysis unit and an evaluation unit; wherein the data collection unit collects the TCP connection information, the data analysis unit analyzes the characteristics of the TCP connections of the TCP connection information collected by the data collection unit; the evaluation unit judges whether the related service is a point-to-point service based on the analysis of the data analysis unit. The invention has the advantage that point-to-point services can be accurately and quickly identified.
Description
Technical field
The present invention relates to communication technical field, relate in particular to method and the device in communication network, point-to-point service discerned.
Background technology
Under traditional mode, typical internet transmission form is the form of client to server.As web page browsing, the PC of client will send request earlier, downloads webpage or program from Website server then.This pattern still can satisfy in the web page browsing epoch.But along with a large amount of appearance of audio frequency, video, server just can't provide service to more user simultaneously owing to be limited by bandwidth.It is point-to-point that (peer-to-peer, P2P) appearance of technology has solved this problem.The P2P technology, promptly end-to-end peer-to-peer network technology is meant that network host serves as server and provides service to other peer-to-peer (Peer) serving as when client is obtained resource.
Yet along with the continuous expansion that the P2P technology is used, especially for the file-sharing business based on the P2P system, P2P communication can take the more network bandwidth, thereby is easy to consume a large amount of Internet resources, causes the congested of network.Therefore, need control, and be that the P2P business is carried out effective recognition the prerequisite that the P2P business is controlled to the P2P business in the network.
Three kinds of P2P business recognition methods commonly used are arranged at present:
Method one: discern the P2P business based on port numbers.This is because early stage P2P business is to send data by fixed port number.For example, commercial Gnutella software sends data by 6346 or 6347 port numbers, and another kind of business software DirectConnect sends data by 411 or 412 port numbers.Therefore, a fixed port that need are adopted the P2P business just be monitored and can identify the P2P data flow.But, present most of P2P business have used the dynamic random port numbers to send data, therefore by discerning, follow the tracks of or control P2P communication based on the analytical method of port numbers is very difficult simply.
Method two: the statistical nature of flow Network Based is discerned the P2P business.This is because pure P2P flow has its unique distribution characteristics, not only the flow than traditional business is big to be embodied in the flow of pure P2P business, and when business begins, can comparatively promptly increase, and after being stabilized near a period of time the higher value, sharply descend again.Therefore according to the unique distribution feature of P2P flow, utilize some changes in distribution situations in the network flow statistic to weigh the amount of information of P2P traffic characteristic usually.Some companies are still using this technology at present.Yet, when other non-P2P business also produce big flow, can the statistic of pure P2P service traffics be exerted an influence.Therefore discerning the P2P business in this way has certain error.
Method three: discern the P2P business based on agreement.This is that each agreement all has its certain protocol identifier because each P2P business all has oneself a agreement.Therefore, can discern the P2P business by the protocol identifier in each packet in the detection network.But this mode need detect each packet in the network, therefore the further delay of aggravation network.
Summary of the invention
Based on the problems referred to above, the invention provides in a kind of peer-to-peer network the point-to-point service recognition technology.By this technology, can be accurately and discern point-to-point service apace.
According to an aspect of the present invention, the invention discloses the method for identification point-to-point service in a kind of communication network, comprising:
Collect TCP (transmission control protocol, transmission control protocol) link information;
Described TCP link information is carried out TCP linking number specificity analysis;
Judge according to analysis result whether described TCP connects pairing business is point-to-point service.
Wherein, the step of described collection TCP link information can comprise: be unit classified statistics tcp data bag with the time period, obtain the TCP link information according to the header packet information of tcp data bag; Described TCP link information comprises the TCP linking number, uploads flow and total flow.
Preferably, described TCP linking number specificity analysis step comprises:
Generate the factor that is used for TCP linking number specificity analysis according to described TCP link information, described factor comprises TCP linking number rate of change, upload flow accounts for the average percent of total flow and uploads flow.
Can utilize the fuzzy operation rule that described factor is carried out TCP linking number specificity analysis.
Preferably, the described step of utilizing the fuzzy operation rule that described factor is carried out TCP linking number specificity analysis comprises:
Described factor is carried out corresponding membership function computing respectively, obtain factor assessed value matrix;
Described factor assessed value matrix and each corresponding factor weights are multiplied each other, obtain analysis result.
Wherein, distribute by Cauchy and determine described membership function.
Preferably, judge that according to analysis result whether described TCP connects pairing business is that the step of point-to-point service comprises:
With analysis result with the assessment threshold ratio, if described analysis result greater than this threshold value, then is a point-to-point service; Otherwise, be not point-to-point service.
Wherein, utilize the fuzzy operation rule carries out TCP linking number specificity analysis step to described factor before, also comprise described:
Judge the size of TCP linking number rate of change and rate of change threshold value, if the step of back is then preserved and carried out to described TCP linking number rate of change greater than this threshold value; Otherwise, be back to and collect TCP link information step.
Preferably, described TCP link information is carried out TCP linking number specificity analysis; Judge that according to analysis result whether described TCP connects pairing business is point-to-point service, comprising:
The size that compares TCP linking number and linking number threshold value;
If described TCP linking number greater than this threshold value, then is a point-to-point service; Otherwise, be not point-to-point service.
Wherein, describedly judge that according to analysis result whether described TCP connects pairing business is also to comprise after the point-to-point service step:
If the P2P business is exported analysis result;
Otherwise, be back to and collect TCP link information step.
On the other hand, the invention also discloses a kind of device of in communication network, point-to-point service being discerned, comprise data collection module, data analysis unit and assessment unit; Wherein,
Described data collection module can be a data receiver, is used for receiving and collecting the TCP link information;
Data analysis unit is carried out TCP linking number specificity analysis to the TCP link information of collecting from described data collection module;
Described assessment unit judges according to the analysis result of described data analysis unit whether described TCP connects pairing business is point-to-point service.
Preferably, described data analysis unit comprises: data processing module, data analysis module.
Described data processing module can generate the factor that is used for TCP linking number specificity analysis according to described TCP link information.
Described data analysis module can utilize the fuzzy operation rule that described factor is carried out TCP linking number specificity analysis.
Preferably, described data analysis module comprises: assessed value matrix generation module, analysis result generation module;
Assessed value matrix generation module carries out corresponding membership function computing respectively to described factor, obtains factor assessed value matrix;
The analysis result generation module multiplies each other described factor assessed value matrix and each corresponding factor weights, obtains analysis result.
Wherein, described factor can comprise TCP linking number rate of change.
Described device also can comprise judge module, will be big or small by TCP linking number rate of change and rate of change threshold ratio that data processing module generates.If described TCP linking number rate of change then is sent to data analysis module with described factor by data storage cell greater than this threshold value; Otherwise the director data collector unit continues to collect the TCP link information.
Wherein, described TCP link information can comprise the TCP linking number.
Described data analysis unit will be big or small from TCP linking number and linking number threshold ratio that data collection module is collected;
Described assessment unit judges according to the analysis result of described data analysis unit whether described TCP connects pairing business is point-to-point service.
By technique scheme, the present invention can reach following technique effect:
At first, the means of point-to-point flow identification are carried out in utilization of the present invention to the statistical nature of the TCP number of connection in the peer-to-peer network.Because it all is that TCP connects that each group of P2P communication connects, and therefore can more easily get access to the TCP link information by the identification to packet.
Secondly, when beginning P2P is professional,, and whenever sets up one group and connect and often all can send a large amount of TCP connection request packets, therefore can produce a large amount of TCP linking numbers because node and a large amount of nodes connect.So by can accurate recognition P2P business to TCP linking number specificity analysis in the network.Especially, the present invention has adopted the fuzzy operation rule, and the comprehensive assessment by to information such as TCP linking numbers further improves accuracy of identification.
At last, owing to can set up the TCP connection by sending synchronization bit/acknowledgement bit bag (SYN/ACK) between node, and thereby method and apparatus of the present invention draws the TCP linking number by the quantity of the bag of the SYN/ACK in the network is added up, this statistics is also fast in real time, can not cause the delay of network.
Description of drawings
Fig. 1 is a P2P management process schematic diagram of the present invention;
Fig. 2 can manage the IP network infrastructure figure of P2P business for the present invention;
Fig. 3 is the schematic flow sheet of P2P traffic identification preferred embodiment one of the present invention;
Fig. 4 is the structure drawing of device of P2P traffic identification preferred embodiment one of the present invention;
Fig. 5 is the schematic flow sheet of P2P traffic identification preferred embodiment two of the present invention;
Fig. 6 is the structure drawing of device of P2P traffic identification preferred embodiment two of the present invention.
Embodiment
Distributed P 2 P communication can be divided into four-stage according to its operation principle, is respectively: discovery and the startup stage, share stage, inquiry and searching stage and download phase.At preceding three phases, node and LIST SERVER connect and add the P2P network, send the upload file tabulation, to the LIST SERVER inquiry and seek other nodes that have file interested.In download phase, interested other nodal informations in the tabulation that described node provides according to LIST SERVER connect, one by one to finish the mutual biography of file.
Generally speaking, in order to guarantee the operate as normal of P2P network, the P2P consultation is provided with a maximum number of connections.In download phase, if the linking number of node does not reach the maximum number of connections that presets, this node just can continue to connect with more node so.Usually, because phenomenons such as the delay of network or packet losses, perhaps owing to user's use habit, a node will send a large amount of connectivity request messages when connecting with a plurality of nodes.Thereby when carrying out the P2P business, internodal TCP connectivity request message number can obviously rise.Simultaneously, carry out soon in the professional beginning of P2P because node and other nodes connect, and node can not send connectivity request message again after setting up connection.Therefore, the TCP linking number peak value of P2P business appears at the professional beginning of P2P soon.Because this peak value produces by P2P is professional, so can reflect the characteristic that comprises P2P file-sharing and P2P stream by this peak value.
The present invention has utilized the connection performance of TCP to discern and manage the P2P business.See also P2P management process schematic diagram of the present invention shown in Figure 1; Its concrete P2P management process is:
Step 101: the TCP link information of collecting user terminal;
Step 102: analyze and the TCP that judges described user terminal whether connect be the TCP connection performance of P2P business.If enter step 103; Otherwise, return step 101;
Step 103: think that user terminal is P2P user, send the P2P analysis result;
Step 104: set up described P2P user terminal strategy according to analysis result, and control service quality;
Step 105: send corresponding strategies;
Step 106: according to described strategy pay, related management such as authentication.
See also Fig. 2, in IP network, can finish above-mentioned P2P management process, be i.e. P2P identification module 201, P2P strategy and control module 202, P2P administration module 203 by three logic function modules.Wherein, P2P identification module 201 is used for the TCP connection performance of supervisory user terminal, judge whether described TCP connects pairing business is the P2P business, and the analysis result of P2P business is sent to P2P strategy and control module 202, the P2P strategy is set up described P2P user terminal strategy with control module 202 according to this analysis result, control the service quality of communication, and corresponding P2P user terminal strategy is sent to P2P administration module 203.P2P administration module 203 according to complete charge from P2P strategy and P2P user terminal strategy that control module 202 is sent, relevant management such as authentication.
By foregoing description as can be known, if the flow of the P2P business in the IP network is managed and controls, need earlier the P2P business to be discerned, and then manage control accordingly, so that guarantee the service quality of network according to the P2P analysis result that generates.
The technical scheme of a kind of point-to-point service identification provided by the invention is: collect the TCP link information; Described TCP link information is carried out TCP linking number specificity analysis; Judge according to analysis result whether described TCP connects pairing business is point-to-point service.
See also the schematic flow sheet of the preferred embodiment one of P2P communication flows of the present invention recognition methods shown in Figure 3.Particularly, can finish method of the present invention by following steps:
Step 301: collect the TCP link information.
The TCP link information comprises that user terminal at the TCP of current period linking number, uploads flow number and total flow number.Described TCP link information has multiple collection mode, for example can be at (the Gateway GPRS Support Node of the GGSN in user terminal, gateway, router or the mobile communications network, be Gateway GPRS Support Node) on, a software development kit SDK (Software Development Kit) who is used for data packet analysis is installed, as preferred winPcap software kit.Then, utilize this software kit that the header packet information of packet is analyzed, collect the TCP link information.If the present invention is applied in the IMS network, owing to will set up the IMS session before setting up the TCP connection, and the line server in the IMS network (Presence Server) can write down online user's information, therefore can obtain the TCP link information by online user's information that line server write down in the IMS network.
Based on the operation principle of P2P communication, after the beginning of P2P business, this business initiation user can set up TCP with a large amount of other users and be connected, and transmission is set up TCP and connected required connection request bag, for example synchronization bit/acknowledgement bit bag (SYN/ACK).The present invention obtains the TCP linking number by the quantity of described connection request bag is added up, and gets access to according to the header data information of described connection request bag and to upload data traffic number and total flow number.Collection mode of the present invention preferably is that unit is collected with the time period, and the described time period can set in advance according to measured data, for example will be made as an interval in 30 seconds.
Step 302～step 303: handle the TCP link information and judge preservation.
At first, generate TCP linking number rate of change and average percent according to the TCP link information of collecting, wherein, described TCP linking number rate of change is the linking number of current period and the ratio of the linking number of last period, and average percent is for facing the percentage of on average uploading flow and total flow of several periods mutually.
The present invention be averaged upload flow be because, those skilled in the art will know that, all P2P business, especially P2P streaming media service, be characterized in that the user is only after setting up the TCP connection and obtaining a given data, can upload, and uploading flow, to increase to stable be after user's TCP linking number tends towards stability, therefore upload the increase of flow and tend towards stability and to be later than TCP linking number peak value usually, so for the data that make measurement more help accurate judgement, the time period of uploading flow measurement is arranged on behind the TCP linking number peak value soon, and get the mean value of the linking number that faces several time periods mutually, therefore described average percent is not the percentage of uploading flow and total flow when TCP connects peak value and occurs, but after TCP connection peak value the mean value of uploading flow of the several periods in very short time and the percentage of total flow.
Secondly, judge the size of TCP linking number rate of change and rate of change threshold value, described threshold value sets in advance, and its threshold range is preferably more than or equal to 4, and the present invention preferably is set to 4 with the rate of change threshold value.When the TCP linking number rate of change that generates during greater than this threshold value, then preserve described TCP linking number rate of change, average percent and upload flow value, and execution in step 304; Otherwise, return step 301 after result abandoned.
Step 304: rate of change, percentage are when uploaded flow value analysis.
In order to analyze better, utilize the fuzzy operation rule to TCP linking number rate of change, average percent and upload these three factors of flow value and analyze, for convenience of explanation, TCP linking number rate of change to be expressed as Cr, average percent here be θ, upload flow value is t
u
At first, calculate the numerical value of above-mentioned three factors respectively with corresponding membership function.The result of each function comprises two values, and expression is the possibility of P2P business and is not the possibility of P2P business respectively.
For convenience of description, definition U is set of factors, the i.e. U={u that above-mentioned three factors are formed
1, u
2, u
3, wherein, u
1Be Cr, u
2Be θ, u
3Be t
uSimultaneously, definition V is the assessment collection of each factor, i.e. V={v
1, v
2, wherein, v
1Expression is the possibility of P2P business, v
2Expression is not the possibility of P2P business.
Utilize corresponding membership function to pass through the FUZZY MAPPING of each factor from U to V obtained the assessment collection of each factor:
f：U→F(V)
Be u
1| → (r
I1, r
I2),
According to the different problems of fuzzy diagnosis, different membership function establishing methods can be arranged.In general, mainly contain three kinds of methods, promptly F statistical method, trichotomy, and distribute to determine membership function by F.Owing to need to make up two phase functions in this problem, suggestion is adopted and is distributed to determine membership function by F.Common distribution comprises distributed rectangular or half distributed rectangular, half trapezoidal profile or trapezoidal profile, parabolical distribution, normal distribution, Cauchy distributes and mountain range shape distributes.Suggestion is chosen Cauchy and is distributed to determine membership function, can obtain evaluation result preferably like this.
Be example hereinafter, obtain the data decimation Cauchy structure membership function that distributes according to experiment with Cr and θ.Factor t
uMembership function also can obtain by similar method.
For example, the empirical membership function with Cr is defined as:
Calculating by to the membership function of factor Cr obtains r as a result
11, its value representation is the possibility of P2P business.Simultaneously, with 1-r
11The result as the possibility that is not the P2P business, i.e. r
12, then according to r
11, r
12 canObtain the assessment collection V of factor Cr
1
Equally, can be as the experimental membership function of the factor θ that gives a definition:
Calculating by to the membership function of factor θ obtains r according to the method described above with its result
21, r
22Two values are represented respectively to be the possibility of P2P business and not to be the possibility of P2P business, thereby again according to r
21, r
22Obtain the assessment collection V of factor θ
2
For factor t
u, can be equally according to the method described above, obtain factor t by Cauchy's membership function that makes up that distributes
uAssessment collection V
3, repeat no more here.
Result according to described three membership functions generates an assessed value matrix again, promptly
For the unexpected winner file of P2P business, because it is less to participate in the mutual number of users that passes of this document, the TCP linking number that causes the user to set up is less, so the TCP linking number peak value of this class unexpected winner file is obvious not as the TCP linking number peak value of popular file in the P2P business.And under some extreme cases, some non-P2P business (for example web business) also might be set up more TCP connection owing to opening a large amount of webpages at short notice, at this moment can be comparatively approaching with the TCP connection performance of unexpected winner P2P business on the linking number characteristic.At this moment rely on TCP linking number rate of change merely and can be difficult to accurate differentiation.And, uploaded flow much smaller than the P2P business owing to what the web business produced according to the P2P traffic performance, so can pass through factor t
uOn flow, distinguished.Because factor t
uOnly at special circumstances, so t
uWeights be lower than the weights of other two factors.
Because the importance difference of described three factors, so its weights difference are as being set to 0.4,0.4 and 0.2 respectively with the weights of three factors.Definition A is the weights collection of described three factors, i.e. A=(a
1, a
2, a
3), wherein, a
1Be the weights of Cr, a
2Be the weights of θ, a
3Be t
uWeights.
At last, weight vector and assessed value matrix by B=AR calculates three factors obtain comprehensive assessment B as a result.Described B has two component values, i.e. B=(b
1, b
2), wherein, b
1Expression is the possibility of P2P business, b
2Expression is not the possibility of P2P business.
Step 305: the analysis and assessment result, judge whether described TCP connects pairing business is the P2P business.
According to the comprehensive assessment that generates B and make final identification as a result.The precision of identification can decide by adjusting its assessment threshold value: if adopt lower precision, only need b according to user's needs
1＞b
2, promptly this moment, described assessment threshold value can be made as 0.5.Work as b
1＞0.5, think that then relevant business is the P2P business; Otherwise, then think not to be the P2P business.If the raising precision can suitably improve the assessment threshold value.Work as b
1Greater than this assessment threshold value, can think that then relevant business is the P2P business; Otherwise, be not the P2P business.
When analysis result shows that relevant business is the P2P business, execution in step 306; Otherwise be back to step 301.
Step 306: analysis result is exported.
To be the analysis result output of P2P business, the P2P system can set up the P2P strategy and carry out corresponding management according to described analysis result then, and then control service quality.Because the work such as management after the output analysis result are not protection contents of the present invention, so repeat no more here.
Based on technique scheme, the present invention also provides a kind of device that is used to realize point-to-point service identification, comprising: data collection module 401, data analysis unit 402, and assessment unit 409.Wherein, data collection module 401 exports the TCP link information of collecting to data analysis unit 402; 402 pairs of described TCP link informations of described data analysis unit are carried out TCP linking number specificity analysis; Assessment unit 409 judges according to the analysis result of described data analysis unit 402 whether described TCP connects pairing business is point-to-point service.
Fig. 4 is used to realize the structure drawing of device of embodiment one of the method for P2P traffic identification for the present invention.Described device comprises: data collection module 401, data analysis unit 402, memory cell 405, assessment unit 409, and regulon 410.
Wherein, described data analysis unit 402 comprises data processing module 403, judge module 404, data analysis module 407; Described data analysis module 407 comprises assessed value matrix generation module 406, analysis result generation module 408.
The present invention is to the method for P2P traffic identification, except adopting above-mentioned fuzzy algorithmic approach analyzes factors such as TCP linking number rates of change, and can also be merely by the analysis of TCP linking number be discerned.This is owing to carry out P2P when professional, and service node can be set up a large amount of TCP with other nodes and be connected and carry out file and pass mutually, and the TCP linking number of P2P business is more than the linking number of other non-P2P business.If so the TCP linking number in a period of time is bigger than the quantity of last period, think that then a large amount of this moment TCP linking numbers is the P2P linking number, the business of this period operation is the P2P business.
Fig. 5 is the schematic flow sheet of the present invention to the embodiment two of P2P traffic identification.The concrete steps of this flow process are:
Step 501: collect the TCP linking number.
Described TCP link information comprise user terminal at the TCP of current period linking number, upload flow number and total flow number.Described TCP link information has multiple collection mode, for example can be at (the Gateway GPRSSupport Node of the Gateway GPRS Support Node in user terminal, gateway, router or the mobile communications network, GGSN) on, a software development kit SDK (Software Development Kit) who is used for data packet analysis is installed, as a preferred winPcap software kit.Then, utilize this software kit that the header packet information of packet is analyzed, collect the TCP link information.The present invention obtains the TCP linking number by the connection request bag quantity of TCP is added up.The optimal way of collecting is for being that unit is collected with a time period, and the described time period can set in advance according to measured data, is an interval as 30 seconds.
If in the IMS network, owing to set up the IMS meeting before setting up the TCP connection, and the line server in the IMS network (Presence Server) can write down online user's information.Therefore, the online user's information that writes down on can be by line server in the IMS network is obtained the TCP linking number.
Step 502～step 503: analyze TCP linking number characteristic and judge whether described TCP connects pairing business is the P2P business.
P2P linking number of collecting and the linking number threshold value that presets are compared analysis, and judge according to analysis result whether described TCP connects pairing business is the P2P business.If the TCP linking number in a period of time, thinks then that the business of this period operation is the P2P business greater than described linking number threshold value; Otherwise, be not the P2P business.
Wherein, described linking number threshold value can be provided with according to the requirement of user to accuracy of identification empirically.For example, can gather the connection data of many group P2P business, get that wherein TCP linking number peak value is lower, but still the number of linking number peak value that is higher than most of non-P2P business is as the linking number threshold value.The above-mentioned method to set up that provides is one of them embodiment, and it is provided with thought and is, if the numerical value between the TCP linking number peak value of professional TCP linking number peak value of non-P2P and P2P business, can both be as the linking number threshold value.Because described threshold value belongs to empirical setting, its method to set up is not unique, and therefore described threshold value and method to set up thereof be so long as based on above-mentioned thought, the scope that all belongs to the present invention and protected.
When being the P2P business, execution in step 504; Otherwise be back to step 501.
Step 504: analysis result is exported.
To be the analysis result output of P2P business, the P2P system can set up the P2P strategy and carry out corresponding management according to described analysis result then, and then control service quality.With the work such as management after the analysis result output is not protection content of the present invention, so repeat no more here.
Based on technique scheme, the present invention also provides a kind of device that is used to realize the method embodiment two of P2P traffic identification, sees also Fig. 6.Fig. 6 is used to realize the structure drawing of device of the method embodiment two of P2P traffic identification for the present invention.Described device comprises data collection module 601, data analysis unit 602, assessment unit 603 and regulon 604.Wherein, data collection module 601 is used to check data packet head, and is that the TCP linking number is collected in unit grouping with the time period according to TCP connection request packet, and exports the TCP link information of collecting to data analysis unit 602.Described data analysis unit 602 is carried out TCP linking number specificity analysis by big or small to TCP linking number and linking number threshold ratio.Assessment unit 603 judges according to the analysis result of described data analysis unit 602 whether described TCP connects pairing business is point-to-point service.If the TCP linking number in a period of time is greater than described linking number threshold value, then described assessment unit 603 thinks that the business that this period moves is the P2P business, simultaneously with result's output of described P2P business; Otherwise described assessment unit 603 director data collector units 601 continue to collect the TCP link information.
Described regulon 604 is used to be provided with collection time period and linking number threshold value.
Above-described embodiment of the present invention does not constitute the qualification to protection range of the present invention.Any modification of being done within the spirit and principles in the present invention, be equal to and replace and improvement etc., all should be included within the protection range of the present invention.
Claims (14)
1. the method for identification point-to-point service in the communication network is characterized in that comprising:
Collect the TCP link information;
Described TCP link information is carried out TCP linking number specificity analysis;
Judge according to analysis result whether described TCP connects pairing business is point-to-point service.
2. the method for claim 1 is characterized in that, described collection TCP link information comprises:
With the time period is unit classified statistics tcp data bag, obtains the TCP link information according to the header packet information of tcp data bag; Described TCP link information comprises the TCP linking number, uploads flow and total flow.
3. the method for claim 1 is characterized in that, described TCP linking number specificity analysis comprises:
Generate the factor that is used for TCP linking number specificity analysis according to described TCP link information, described factor comprises TCP linking number rate of change, upload flow accounts for the average percent of total flow and uploads flow;
Utilize the fuzzy operation rule that described factor is carried out TCP linking number specificity analysis.
4. method as claimed in claim 3 is characterized in that, describedly utilizes the fuzzy operation rule that described factor is carried out TCP linking number specificity analysis to comprise:
Described factor is carried out corresponding membership function computing respectively, obtain factor assessed value matrix;
Described factor assessed value matrix and each corresponding factor weights are multiplied each other, obtain analysis result.
5. method as claimed in claim 4 is characterized in that, by Cauchy's definite membership function that distributes.
6. as claim 1 or 4 described methods, it is characterized in that, describedly judge that according to analysis result whether described TCP connects pairing business is that the step of point-to-point service comprises:
With analysis result with the assessment threshold ratio, if described analysis result greater than this threshold value, then is a point-to-point service; Otherwise, be not point-to-point service.
7. method as claimed in claim 3 is characterized in that, utilizes the fuzzy operation rule carries out TCP linking number specificity analysis step to described factor before described, also comprises:
Judge the size of TCP linking number rate of change and rate of change threshold value, if the step of back is then preserved and carried out to described TCP linking number rate of change greater than this threshold value; Otherwise, be back to and collect TCP link information step.
8. method as claimed in claim 2 is characterized in that, described TCP link information is carried out TCP linking number specificity analysis; Judge that according to analysis result whether described TCP connects pairing business is point-to-point service, comprising:
The size that compares TCP linking number and linking number threshold value;
If described TCP linking number greater than this threshold value, then is a point-to-point service; Otherwise, be not point-to-point service.
9. as claim 6 or 8 described methods, it is characterized in that, describedly judge that according to analysis result whether described TCP connects pairing business is also to comprise after the point-to-point service step:
If point-to-point service is exported analysis result;
Otherwise, be back to and collect TCP link information step.
10. the device of identification point-to-point service in the communication network is characterized in that comprising data collection module, data analysis unit and assessment unit; Wherein,
Described data collection module is collected the TCP link information;
Described data analysis unit is carried out TCP linking number specificity analysis to the TCP link information of collecting from described data collection module;
Described assessment unit judges according to the analysis result of described data analysis unit whether described TCP connects pairing business is point-to-point service.
11. device as claimed in claim 10 is characterized in that, described data analysis unit comprises: data processing module, data analysis module;
Data processing module generates the factor that is used for TCP linking number specificity analysis according to described TCP link information;
Data analysis module utilizes the fuzzy operation rule that described factor is carried out TCP linking number specificity analysis.
12. device as claimed in claim 11 is characterized in that, described data analysis module comprises: assessed value matrix generation module, analysis result generation module;
Assessed value matrix generation module carries out corresponding membership function computing respectively to described factor, obtains factor assessed value matrix;
The analysis result generation module multiplies each other described factor assessed value matrix and each corresponding factor weights, obtains analysis result.
13. device as claimed in claim 11 is characterized in that, described factor comprises TCP linking number rate of change;
Described device also comprises judge module, will be big or small by TCP linking number rate of change and rate of change threshold ratio that data processing module generates, if described TCP linking number rate of change then is sent to data analysis module with described factor by data storage cell greater than this threshold value; Otherwise the director data collector unit continues to collect the TCP link information.
14. device as claimed in claim 10 is characterized in that, described TCP link information comprises the TCP linking number;
Described data analysis unit will be big or small from TCP linking number and linking number threshold ratio that data collection module is collected;
Described assessment unit judges according to the analysis result of described data analysis unit whether described TCP connects pairing business is point-to-point service.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 200610148469 CN101184081A (en) | 2006-11-14 | 2006-11-14 | Method and device for identifying point-to-point service in communication network |
| PCT/EP2007/062039 WO2008058884A1 (en) | 2006-11-14 | 2007-11-08 | Method for identifying peer to peer services in a communications network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 200610148469 CN101184081A (en) | 2006-11-14 | 2006-11-14 | Method and device for identifying point-to-point service in communication network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101184081A true CN101184081A (en) | 2008-05-21 |
Family
ID=39223438
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 200610148469 Pending CN101184081A (en) | 2006-11-14 | 2006-11-14 | Method and device for identifying point-to-point service in communication network |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN101184081A (en) |
| WO (1) | WO2008058884A1 (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101645803B (en) * | 2008-08-05 | 2011-11-23 | 中兴通讯股份有限公司 | P2P service identification method and Internet service identification system |
| CN110290003A (en) * | 2019-06-27 | 2019-09-27 | 携程旅游信息技术（上海）有限公司 | Dynamically distribute the method and system of the TCP connection number of short message supplier |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8634463B2 (en) | 2006-04-04 | 2014-01-21 | Qualcomm Incorporated | Apparatus and method of enhanced frame interpolation in video compression |
| CN102111401B (en) * | 2010-12-16 | 2013-12-04 | 华为数字技术（成都）有限公司 | Protocol recognition method and device as well as equipment |
-
2006
- 2006-11-14 CN CN 200610148469 patent/CN101184081A/en active Pending
-
2007
- 2007-11-08 WO PCT/EP2007/062039 patent/WO2008058884A1/en active Application Filing
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101645803B (en) * | 2008-08-05 | 2011-11-23 | 中兴通讯股份有限公司 | P2P service identification method and Internet service identification system |
| CN110290003A (en) * | 2019-06-27 | 2019-09-27 | 携程旅游信息技术（上海）有限公司 | Dynamically distribute the method and system of the TCP connection number of short message supplier |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2008058884A1 (en) | 2008-05-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Basher et al. | A comparative analysis of web and peer-to-peer traffic | |
| CN102045363B (en) | Establishment, identification control method and device for network flow characteristic identification rule | |
| CN101026509B (en) | End-to-end low available bandwidth measuring method | |
| Dewes et al. | An analysis of Internet chat systems | |
| Klemm et al. | Characterizing the query behavior in peer-to-peer file sharing systems | |
| US7782796B2 (en) | Method for generating an annotated network topology | |
| Reyes-Lecuona et al. | A page-oriented WWW traffic model for wireless system simulations | |
| CN104301161B (en) | Computational methods, computing device and the communication system of quality of service index | |
| CN102752792A (en) | Method, device and system for monitoring internet service quality of mobile terminal | |
| Spoto et al. | Analysis of PPLive through active and passive measurements | |
| CN102724063A (en) | Log collection server, data packet delivering and log clustering methods and network | |
| CN101499914A (en) | Parent node selection method, system and node for multicast system | |
| CN113810293B (en) | Network preferred agent method, device, electronic equipment, server and storage medium | |
| Imtiaz et al. | Churn in the bitcoin network | |
| CN101184081A (en) | Method and device for identifying point-to-point service in communication network | |
| Baldesi et al. | Improving P2P streaming in wireless community networks | |
| JP6347510B2 (en) | Communication behavior analysis apparatus and user experience quality estimation method | |
| Bao et al. | QoE collaborative evaluation method based on fuzzy clustering heuristic algorithm | |
| CN108924869A (en) | A kind of robust transmission assessment method based on multipath | |
| CN101127699A (en) | A real time data transmission path generation method for point-to-point environment | |
| Liu et al. | Approaching optimal peer-to-peer overlays | |
| Zhang et al. | Characterizing peer-to-peer traffic across Internet | |
| Li et al. | On Gnutella topology dynamics by studying leaf and ultra connection jointly in phase space | |
| Negreira et al. | End-to-end measurements over GPRS-EDGE networks | |
| Cai et al. | Adaptive caching strategy based on big data learning in ICN |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| C41 | Transfer of patent application or patent right or utility model | ||
| PB01 | Publication | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20080328 Address after: Munich, Germany Applicant after: Nokia Siemens Networks Address before: Munich, Germany Applicant before: Siemens AG |
|
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Open date: 20080521 |