CN102307123B - 基于传输层流量特征的nat流量识别方法 - Google Patents
基于传输层流量特征的nat流量识别方法 Download PDFInfo
- Publication number
- CN102307123B CN102307123B CN 201110261990 CN201110261990A CN102307123B CN 102307123 B CN102307123 B CN 102307123B CN 201110261990 CN201110261990 CN 201110261990 CN 201110261990 A CN201110261990 A CN 201110261990A CN 102307123 B CN102307123 B CN 102307123B
- Authority
- CN
- China
- Prior art keywords
- nat
- data
- flow
- feature
- network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 51
- 230000005540 biological transmission Effects 0.000 title abstract description 5
- 238000013519 translation Methods 0.000 title abstract description 5
- 238000000605 extraction Methods 0.000 claims abstract description 20
- 238000012549 training Methods 0.000 claims abstract description 20
- 239000000284 extract Substances 0.000 claims description 12
- RTZKZFJDLAIYFH-UHFFFAOYSA-N Diethyl ether Chemical compound CCOCC RTZKZFJDLAIYFH-UHFFFAOYSA-N 0.000 claims description 10
- 230000008569 process Effects 0.000 claims description 10
- 238000010845 search algorithm Methods 0.000 claims description 8
- 230000004907 flux Effects 0.000 claims description 6
- 238000002203 pretreatment Methods 0.000 claims description 4
- 238000012512 characterization method Methods 0.000 claims description 3
- 230000004069 differentiation Effects 0.000 claims description 3
- 238000013507 mapping Methods 0.000 claims description 3
- 241001269238 Data Species 0.000 claims description 2
- 101100206196 Arabidopsis thaliana TCP3 gene Proteins 0.000 claims 1
- 101100260060 Saccharomyces cerevisiae (strain ATCC 204508 / S288c) CCT3 gene Proteins 0.000 claims 1
- 238000005516 engineering process Methods 0.000 abstract description 13
- 238000001514 detection method Methods 0.000 description 24
- 235000014510 cooky Nutrition 0.000 description 12
- 238000007418 data mining Methods 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 3
- 230000006399 behavior Effects 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 230000000977 initiatory effect Effects 0.000 description 3
- 238000011160 research Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000002411 adverse Effects 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 230000002457 bidirectional effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000009194 climbing Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000013480 data collection Methods 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 230000002950 deficient Effects 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 239000012467 final product Substances 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000001939 inductive effect Effects 0.000 description 1
- 238000003780 insertion Methods 0.000 description 1
- 230000037431 insertion Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000012856 packing Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 239000000047 product Substances 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 230000008521 reorganization Effects 0.000 description 1
- 230000000630 rising effect Effects 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000007619 statistical method Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 230000001052 transient effect Effects 0.000 description 1
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims (8)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN 201110261990 CN102307123B (zh) | 2011-09-06 | 2011-09-06 | 基于传输层流量特征的nat流量识别方法 |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN 201110261990 CN102307123B (zh) | 2011-09-06 | 2011-09-06 | 基于传输层流量特征的nat流量识别方法 |
Publications (2)
Publication Number | Publication Date |
---|---|
CN102307123A CN102307123A (zh) | 2012-01-04 |
CN102307123B true CN102307123B (zh) | 2013-09-25 |
Family
ID=45380937
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN 201110261990 Active CN102307123B (zh) | 2011-09-06 | 2011-09-06 | 基于传输层流量特征的nat流量识别方法 |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN102307123B (zh) |
Families Citing this family (24)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102811220A (zh) * | 2012-07-31 | 2012-12-05 | 张江 | 宽带上网防私接串接的系统及方法 |
CN102882733B (zh) * | 2012-10-24 | 2015-08-19 | 广东天波信息技术股份有限公司 | 一种穿越nat设备实现web网管方法 |
CN102984163B (zh) * | 2012-12-06 | 2015-09-30 | 华为技术有限公司 | 控制同一ip地址的多个主机访问网络的方法及系统 |
CN105162901B (zh) * | 2015-09-30 | 2019-05-14 | 北京特立信电子技术股份有限公司 | 一种基于sopc的nat的实现方法及装置 |
CN105577679B (zh) * | 2016-01-14 | 2019-02-15 | 华东师范大学 | 一种基于特征选择与密度峰值聚类的异常流量检测方法 |
CN106850599B (zh) * | 2017-01-18 | 2019-12-03 | 中国科学院信息工程研究所 | 一种基于融合用户行为和迅雷id的nat检测方法 |
CN107195020A (zh) * | 2017-05-25 | 2017-09-22 | 清华大学 | 一种面向列车自动驾驶模式学习的列车运行记录数据处理方法 |
CN107454202A (zh) * | 2017-07-11 | 2017-12-08 | 浙江远望信息股份有限公司 | 一种基于http协议分析的nat边界发现方法 |
CN108259637A (zh) * | 2017-11-30 | 2018-07-06 | 湖北大学 | 一种基于决策树的nat设备识别方法及装置 |
CN109726744B (zh) * | 2018-12-14 | 2020-11-10 | 深圳先进技术研究院 | 一种网络流量分类方法 |
CN109510785B (zh) * | 2018-12-27 | 2020-12-29 | 杭州迪普科技股份有限公司 | 一种镜像报文的方法和装置 |
CN110049147B (zh) * | 2019-03-28 | 2020-07-31 | 中国科学院计算技术研究所 | 一种nat后主机数量检测方法 |
CN110572325A (zh) * | 2019-09-06 | 2019-12-13 | 成都深思科技有限公司 | 一种nat路由器流量识别方法 |
CN110769077B (zh) * | 2019-10-14 | 2021-12-31 | 新华三信息安全技术有限公司 | 一种报文处理方法、装置、网络设备及存储介质 |
CN110868409A (zh) * | 2019-11-08 | 2020-03-06 | 中国科学院信息工程研究所 | 一种基于tcp/ip协议栈指纹的操作系统被动识别方法及系统 |
CN110912904B (zh) * | 2019-11-27 | 2021-07-02 | 腾讯科技(深圳)有限公司 | 恶意设备识别方法、装置、存储介质和计算机设备 |
CN110912933B (zh) * | 2019-12-17 | 2021-04-02 | 中国科学院信息工程研究所 | 一种基于被动测量的设备识别方法 |
CN113381968B (zh) * | 2020-03-09 | 2022-10-18 | 中国移动通信集团设计院有限公司 | 宽带防私接判断方法、装置、电子设备及存储介质 |
CN113381967B (zh) * | 2020-03-09 | 2022-11-01 | 中国移动通信集团设计院有限公司 | 宽带防私接判断方法、装置、电子设备及存储介质 |
CN112615854B (zh) * | 2020-12-17 | 2022-07-12 | 北京天融信网络安全技术有限公司 | 终端准入控制方法、装置、准入服务器及存储介质 |
CN114884918A (zh) * | 2022-05-20 | 2022-08-09 | 深圳铸泰科技有限公司 | 一种基于ip标识号的nat设备识别方法及系统 |
CN115567322B (zh) * | 2022-11-15 | 2023-03-10 | 成都数默科技有限公司 | 一种基于tcp服务开放端口识别异常通信的方法 |
CN116032851B (zh) * | 2022-12-30 | 2024-05-14 | 上海天旦网络科技发展有限公司 | 基于间隔时序轨迹特征的tcp短连接的nat识别方法及系统 |
CN117579525B (zh) * | 2023-11-20 | 2024-06-11 | 北京思存通信技术有限公司 | 一种网络协议特征识别系统 |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101510873A (zh) * | 2009-03-20 | 2009-08-19 | 扬州永信计算机有限公司 | 基于支持向量机的混合式点对点流量检测方法 |
US20100205120A1 (en) * | 2009-02-06 | 2010-08-12 | Microsoft Corporation | Platform for learning based recognition research |
-
2011
- 2011-09-06 CN CN 201110261990 patent/CN102307123B/zh active Active
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20100205120A1 (en) * | 2009-02-06 | 2010-08-12 | Microsoft Corporation | Platform for learning based recognition research |
CN101510873A (zh) * | 2009-03-20 | 2009-08-19 | 扬州永信计算机有限公司 | 基于支持向量机的混合式点对点流量检测方法 |
Non-Patent Citations (2)
Title |
---|
P2P流量识别方法比较研究;龙坤;《信息工程大学学报》;20090630;全文 * |
龙坤.P2P流量识别方法比较研究.《信息工程大学学报》.2009, |
Also Published As
Publication number | Publication date |
---|---|
CN102307123A (zh) | 2012-01-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN102307123B (zh) | 基于传输层流量特征的nat流量识别方法 | |
US8180892B2 (en) | Apparatus and method for multi-user NAT session identification and tracking | |
CN101562534B (zh) | 一种网络行为分析系统 | |
US10332005B1 (en) | System and method for extracting signatures from controlled execution of applications and using them on traffic traces | |
CN102724317B (zh) | 一种网络数据流量分类方法和装置 | |
KR101295708B1 (ko) | 트래픽 수집장치, 트래픽 분석장치, 시스템 및 그 분석방법 | |
CN106330584A (zh) | 一种业务流的识别方法及识别装置 | |
CN102271090A (zh) | 基于传输层特征的流量分类方法及装置 | |
Benson et al. | Leveraging internet background radiation for opportunistic network analysis | |
CN111953552B (zh) | 数据流的分类方法和报文转发设备 | |
Mongkolluksamee et al. | Counting NATted hosts by observing TCP/IP field behaviors | |
CN106789242A (zh) | 一种基于手机客户端软件动态特征库的识别应用智能分析引擎 | |
CN104092588B (zh) | 一种基于SNMP与NetFlow结合的网络异常流量检测方法 | |
CN106789728A (zh) | 一种基于NetFPGA的VoIP流量实时识别方法 | |
CN107948015B (zh) | 一种服务质量分析方法、装置及网络系统 | |
CN108512816A (zh) | 一种流量劫持的检测方法及装置 | |
US10419351B1 (en) | System and method for extracting signatures from controlled execution of applications and application codes retrieved from an application source | |
Cohen | Source attribution for network address translated forensic captures | |
CN114301640B (zh) | 一种基于SRv6网络协议进行的攻防演练的方法及系统 | |
CN109309679A (zh) | 一种基于tcp流状态的网络扫描检测方法及检测系统 | |
CN113726809B (zh) | 基于流量数据的物联网设备识别方法 | |
KR100710047B1 (ko) | Ip 네트워크 환경에서의 트래픽 분석장치 | |
Oudah et al. | Using burstiness for network applications classification | |
CN114760216A (zh) | 一种扫描探测事件确定方法、装置及电子设备 | |
CN108347447B (zh) | 基于周期性通讯行为分析的p2p僵尸网络检测方法、系统 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
C14 | Grant of patent or utility model | ||
GR01 | Patent grant | ||
ASS | Succession or assignment of patent right |
Owner name: SICHUAN ZHILIAN KECHUANG TECHNOLOGY CO., LTD. Free format text: FORMER OWNER: UNIVERSITY OF ELECTRONIC SCIENCE AND TECHNOLOGY OF CHINA Effective date: 20141210 |
|
C41 | Transfer of patent application or patent right or utility model | ||
COR | Change of bibliographic data |
Free format text: CORRECT: ADDRESS; FROM: 611731 CHENGDU, SICHUAN PROVINCE TO: 610041 CHENGDU, SICHUAN PROVINCE |
|
TR01 | Transfer of patent right |
Effective date of registration: 20141210 Address after: 610041, No. 1, building 1, No. 104, No. 1129, Century Road, Chengdu hi tech Zone, Sichuan, 1 Patentee after: Zhaopin Sichuan Kechuang Technology Co. Ltd. Address before: 611731 Chengdu province high tech Zone (West) West source Avenue, No. 2006 Patentee before: University of Electronic Science and Technology of China |
|
C41 | Transfer of patent application or patent right or utility model | ||
TR01 | Transfer of patent right |
Effective date of registration: 20160921 Address after: 610000, No. 2, No. 51, No. 1, Wu Qing Road, Wuhou District Metro Administrative Science Park, Chengdu, Sichuan 1, China Patentee after: Sichuan Chengzhi hearing Technology Co. Ltd. Address before: 610041, No. 1, building 1, No. 104, No. 1129, Century Road, Chengdu hi tech Zone, Sichuan, 1 Patentee before: Zhaopin Sichuan Kechuang Technology Co. Ltd. |
|
PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: NAT (Network Address Translation) flow identification method based on transmission layer flow characteristic Effective date of registration: 20181012 Granted publication date: 20130925 Pledgee: Chengdu SME financing Company Limited by Guarantee Pledgor: Sichuan Chengzhi hearing Technology Co. Ltd. Registration number: 2018510000099 |
|
PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
PC01 | Cancellation of the registration of the contract for pledge of patent right |
Date of cancellation: 20200119 Granted publication date: 20130925 Pledgee: Chengdu SME financing Company Limited by Guarantee Pledgor: Sichuan Chengzhi hearing Technology Co. Ltd. Registration number: 2018510000099 |
|
PC01 | Cancellation of the registration of the contract for pledge of patent right | ||
PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Nat traffic identification method based on transport layer traffic characteristics Effective date of registration: 20210207 Granted publication date: 20130925 Pledgee: Chengdu SME financing Company Limited by Guarantee Pledgor: SICHUAN WISCRED TECHNOLOGY Co.,Ltd. Registration number: Y2021980001104 |