CN102833241A - Streaming media service traffic record merged-processing method and device - Google Patents

Abstract

The invention provides a streaming media service traffic record merged-processing method and device. The streaming media service traffic record merged-processing method comprises the following steps of: judging media transmission protocol types of first traffic records in an original traffic record file; and carrying out merged processing on the first traffic records with same media transmission protocol type according to a judged judgment result. According to the technical scheme of the invention, the storage space is reduced and storage resources are saved.

Description

Method and device for merging and processing streaming media service flow records

technical field

The invention relates to communication technology, in particular to a method and device for combining and processing stream media service flow records.

Background technique

Streaming Media (Streaming Media) refers to the continuous audio/video data stream in which data is transmitted and played in chronological order on the network. Different from the traditional playback method, the client does not need to download the entire program file when playing the program in the streaming media mode, but plays it while receiving it, and only needs to cache part of the program data, which saves download waiting time and storage space . Currently commonly used streaming media services are streaming media services based on Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP) and streaming media services based on Peer-to-Peer (P2P) protocol. HTTP uses the request-response mode, that is, the client sends an HTTP request to the server, and the server responds to the HTTP request sent by the client and sends the resources stored in the server to the client for data transmission on the Internet; the P2P protocol sends data to the server through the client. Resource request, the server responds to the resource request sent by the client to the server and feeds back the available node information to the client, the client obtains the available node information from the server and connects to the available node to obtain the requested resource.

The generation process of streaming media service flow records in the prior art is: obtain the streaming media service flow message of the client through the flow collection device, and analyze the content of the IP packet in the obtained streaming media service flow message of the client to generate the client End streaming media traffic records. For the current streaming media service, each time the client initiates a connection to the server, a corresponding streaming media service flow record will be generated. Take the P2P protocol and HTTP as examples to explain the above process; for HTTP, although the access request initiated by the client is a specific video resource, because the streaming media service adopts a caching mechanism for video resource acquisition, it will A certain video resource is divided into several video clips, so that a video resource request from the client often corresponds to several video clips, and at least one traffic record is generated corresponding to each video clip, so a video resource request from the client often generates multiple traffic Record; for the P2P protocol, if a video resource requested by the client corresponds to multiple different addresses, the video resource requested by the client will download the requested video resource from multiple different addresses, and each address will be corresponding One flow record is generated, so a video resource request from the client often generates multiple flow records.

The defect of the existing technology is that: For the resource request initiated by the client, multiple traffic records will be generated. In order to facilitate the query of the client, all the generated traffic records will be stored. The storage space is large, which wastes storage resources. .

Contents of the invention

The present invention provides a streaming media service flow record merging method and device for reducing storage space and saving storage resources.

The first aspect of the present invention is to provide a method for merging streaming media service flow records, including:

Determine the media transfer protocol type of the first traffic record in the original traffic record file;

According to the judging result of the judging, merge processing is performed on the first traffic records of the same media transfer protocol type.

Another aspect of the present invention is to provide a streaming media service flow record merging processing device, including:

A judging module, configured to judge the media transfer protocol type of the first traffic record in the original traffic record file;

The merging processing module is configured to perform merging processing on the first traffic records of the same media transfer protocol type according to the judgment result of the judging module.

The streaming media service flow record merging processing method and device provided by the present invention judge the media transmission protocol type of the first flow record in the original flow record file; The first flow records are merged to merge the flow records in the original flow record files of the same media transfer protocol type.

The technical effects of the invention are: reducing storage space and saving storage resources.

Description of drawings

Fig. 1 is a flowchart of a streaming media service flow record merging processing method provided by an embodiment of the present invention;

FIG. 2 is a flow chart of a method for merging streaming media service flow records provided by another embodiment of the present invention;

FIG. 3 is a flow chart of a method for merging streaming media service flow records according to another embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an original flow record file generation device in the prior art;

Fig. 5 is a schematic structural diagram of an apparatus for merging and processing streaming media service flow records according to an embodiment of the present invention.

Detailed ways

Fig. 1 is a flowchart of a method for merging streaming media service flow records provided by an embodiment of the present invention. As shown in Figure 1, the method of the present embodiment includes:

Step 101. Determine the media transfer protocol type of the first traffic record in the original traffic record file.

Specifically, the media transfer protocol type of the first traffic record is determined according to the feature field included in the first traffic record. By analyzing the feature field corresponding to the media transfer protocol type of the first traffic record in the original traffic record file, it can be determined that the media transfer protocol type of the first traffic record is HTTP or P2P protocol.

Step 102: Merge the first traffic records of the same media transfer protocol type according to the judgment result of the judgment.

According to the judgment result, the first flow records with the same media transmission protocol type are combined using different merging processing methods to generate new flow records; in this embodiment, the streaming media services based on HTTP and the streaming media based on P2P The business is described, but not limited to the streaming media business of the above two protocols.

In this embodiment, by judging the media transfer protocol type of the first traffic record in the original traffic record file; according to the judgment result, the first traffic records with the same media transfer protocol type are merged; to merge the media transfer protocol The traffic records in the original traffic record files of the same type reduce storage space and save storage resources.

Fig. 2 is a flowchart of a method for merging streaming media service flow records provided by another embodiment of the present invention. As shown in Figure 2, the method of this embodiment includes:

Step 201: Generate an original flow record file.

Specifically, ① obtain GTP and IP data packets according to the flow collection sequence and the preset flow collection period; ② identify the GTP and IP data packets in the obtained GTP and IP data packets, and complete signaling analysis and Protocol analysis, so as to obtain the characteristic fields related to the transmission media protocol type, the characteristic field related to the HTTP content type, the characteristic field related to the start time of streaming Internet, etc. contained in the traffic record in the original traffic record file; ③ generate the original Flow record files; different records of different users are stored in the corresponding original flow record files according to the order of flow collection according to the collection cycle and the size of a single file, where the collection cycle and the size of a single file corresponding to the collection are set according to different needs of.

Among them, GTP (GPRS Tunneling Protocol, GPRS Tunneling Protocol) is a set of IP-based, used in GSM (Global System for Mobile communications, Global System for Mobile Communications) and UMTS (Universal Mobile Telecommunications System, Universal Mobile Communications System) network Supports the communication protocol of General Packet Radio Service (GPRS). For HTTP, Uniform Resource Locator (URL, Uniform Resource Locator) is an indicator for merge processing, and URL is used to completely describe the addresses of web pages and other resources on the Internet.

Table 1 shows the flow records generated by the original flow record generation device in the prior art, as shown below, all the flow records are stored in the original flow record file.

Table 1

Step 202: Determine the MTP type of the first traffic record in the original traffic record file.

Specifically, the media transfer protocol type of the first traffic record is determined according to the feature field included in the first traffic record.

For example, if the feature field corresponding to the media transfer protocol type is HTTP, it is determined that the media transfer protocol type of the first traffic record in the original traffic record file is HTTP.

For another example, if the feature field corresponding to the media transmission protocol type is the P2P protocol, then it is determined that the media transmission protocol type of the first traffic record in the original traffic record file is the P2P protocol.

Step 203: According to the determination result of the determination, merge the first traffic records of the same media transmission protocol type. In this embodiment, the streaming media service based on the hypertext transfer protocol and the streaming media service based on the P2P protocol are used for illustration, but it is not limited to the streaming media service of the above two protocols.

Wherein, an optional implementation manner of step 203 includes:

Step 2031: If the judgment result is HTTP, merge the first traffic records with the same online account, continuous time periods, the same primary domain address in the URL, and the same HTTP content type to generate The second flow record; the second flow record has the same online account as the first flow record, the same main domain address in the URL, and the same HTTP content type, and the start time of the second flow record is The earliest start time in the first flow record, and the end time of the second flow record is the latest end time in the first flow record;

It should be noted that: the online account may be a phone number, or a user account of a terminal.

Continuous time period refers to ① the end time of the current initial flow record and the start time of the next flow record are continuous, then the two flow records are in the same continuous time period; or ② if the time of the two flow records If there is overlap, the two flow records are also in the same continuous time period. The earliest time of the two flow records is the starting time of the continuous time period, and the latest time of the two flow records is the continuous time period. or ③according to probability statistics and actual usage, you can set the continuous time interval range of two flow records, that is, within this time interval range, the time period of two flow records can be regarded as continuous time period.

The main domain address in the URL is the Uniform Resource Locator part of the access address representing the main domain. The content type of HTTP may specifically include: video/MP2T, application/zip, application/rar, audio/mp3, audio/mp4, audio/midi, video/3gp, video/flv, video/mp4, viedo/mpeg, etc.

Specifically, if it is judged that the media transfer protocol type of the first flow record in the original flow record file is HTTP, then the first flow record is extracted from the original flow record file and stored in the temporary storage flow file; The first traffic records with the same account, continuous time periods, the same primary domain address in the URL, and the same HTTP content type are merged, and the traffic information is accumulated to generate a second traffic record, and the second traffic record Save to the temporary traffic file, and delete the first traffic record stored in the temporary traffic file; continue to check whether there is a traffic record with the media transfer protocol type as HTTP in the original traffic record file until all the original traffic records have been traversed Traffic records in the traffic record file.

According to the above method, all the remaining traffic records in the original traffic file are detected one by one, and after all the remaining traffic records in the original traffic file are detected, all the second traffic records in all temporary files are checked according to the starting time Sequentially insert into the original flow record file one by one, and delete all the second flow records stored in the temporary flow file; the remaining flow records in the original flow record file—the flow records whose media transfer protocol type is not HTTP are still stored in In the original traffic record file; this is used to merge the traffic records in the original traffic record file of the same media transmission protocol type, reducing storage space and saving storage resources.

Step 2032: If the judgment result is a P2P protocol, merge the first traffic records with the same online account and continuous time periods to generate a third traffic record; the third traffic record is the same as the first traffic record. A flow record has the same online account, the start time of the third flow record is the earliest start time in the first flow record, and the end time of the third flow record is the latest in the first flow record end time of .

It should be noted that: the online account may be a phone number, or a user account of a terminal.

Continuous time period refers to ① the end time of the current initial flow record and the start time of the next flow record are continuous, then the two flow records are in the same continuous time period; or ② if the time of the two flow records If there is overlap, the two flow records are also in the same continuous time period. The earliest time of the two flow records is the starting time of the continuous time period, and the latest time of the two flow records is the continuous time period. or ③according to probability statistics and actual usage, you can set the continuous time interval range of two flow records, that is, within this time interval range, the time period of two flow records can be regarded as continuous time period.

The content types corresponding to the P2P protocol may specifically include: PPS Internet TV and Xunleikankan.

Specifically, if it is judged that the media transmission protocol type of the first flow record in the original flow record file is a P2P protocol, then the first flow record is extracted from the original flow record file and stored in the temporary storage flow file; Merge the first flow records with the same online account and consecutive time periods, accumulate the flow information to generate the third flow record, save the third flow record to the temporary storage flow file, and save the third flow record in the temporary storage flow file. The first flow record in the file is deleted; in the original flow record file, continue to inquire whether there is a flow record with the media transfer protocol type as the P2P protocol, until all the flow records in the original flow record file have been traversed.

According to the above method, all the remaining flow records in the original flow file are detected one by one, and when all the remaining flow records in the original flow file are detected, all the third flow records in all temporary files are checked according to the start time. Sequentially insert into the original flow record file one by one, and delete all the third flow records stored in the temporary storage flow file; the rest of the flow records in the original flow record file—the flow records whose media transfer protocol type is not the P2P protocol are still saved In the original traffic record file; in this way, the traffic records in the original traffic record file of the same type of media transmission protocol are merged to reduce storage space and save storage resources.

It is explained here that although in this embodiment, the flow records in the original flow record files of HTTP or the media transfer protocol of the P2P protocol are respectively combined in different ways, in practice, there may be two types of protocols at the same time. Or for more media transmission protocols, different media transmission protocol types can be processed at the same time, and traffic records merged and processed for different media transmission protocol types can be respectively obtained. For example: Judging and merging 100 traffic records in the original traffic record file. Among them, there are traffic records of HTTP and P2P protocols respectively, and the traffic records of HTTP and P2P protocols that meet the conditions are finally obtained as 5. 3 articles.

In this embodiment, by judging the media transfer protocol type of the first traffic record in the original traffic record file; according to the judgment result, the first traffic records with the same media transfer protocol type are merged; to merge the media transfer protocol The traffic records in the original traffic record files of the same type reduce storage space and save storage resources.

In order to illustrate the technical solution of the present invention more clearly, the following embodiments will describe the technical solution of the present invention in detail by taking the HTTP-based stream media flow record merging method as an example.

Fig. 3 is a flow chart of a method for merging streaming media service flow records according to another embodiment of the present invention. As shown in Figure 3, the method of this embodiment includes:

Step 301: Generate an original flow record file.

The original flow record file can be generated through existing technologies, and will not be repeated here. All original flow records are saved in the original flow record file.

Table 2 shows the original flow record files generated in this embodiment.

Table 2

It can be known from Table 2 that different traffic records of different users (MSISDN1 and MSISDN2) are processed by the processor to generate traffic records respectively, and the above traffic records are stored in the original traffic record file. Wherein, the type of access may include HTTP and email; the access address is the uniform resource locator of the complete access address, and the content type of the protocol is one of the preset protocol content types: video/MP2T.

Step 302: Generate the first merged flow record.

If it is detected that the media transfer protocol type of the first traffic record in the original traffic record is HTTP, and the content type of the protocol is one of the HTTP content types, the first traffic record is merged to generate the first merged traffic Record.

Among them, the content types corresponding to HTTP can specifically include: video/MP2T, application/zip, application/rar, audio/mp3, audio/mp4, audio/midi, video/3gp, video/flv, video/mp4, viedo/ mpeg etc.

At the same time, modify the complete URL to the main domain address in the URL, that is, the content before "?" in Table 1 in the URL address, and temporarily store the generated new traffic records in the temporary traffic record file. This flow record in the original flow record file is deleted.

Table 3 shows the first merged flow record generated in this embodiment.

table 3

From Table 3, we can know the information of the generated first traffic record after merging.

Step 303: Perform merging processing on the first traffic records whose media transfer protocol type is HTTP.

Detect the rest of the traffic records in the original traffic file in Table 2, and merge the first traffic records whose media transfer protocol type is HTTP.

Table 4 shows the combined processing of the first traffic records whose media transfer protocol type is HTTP in this embodiment, and the merged new traffic records stored in the temporary traffic record file.

Table 4

Extract the first flow record from the original flow record file, and save it in the temporary flow file; then set the same online account, and the time period is continuous, and the main domain address in the URL is the same, and the HTTP content type is the same The first flow record is merged, and the flow information is accumulated to generate a second flow record, the second flow record is saved in the temporary flow file, and the first flow record stored in the temporary flow file is deleted; Continue to check whether there is a traffic record whose media transfer protocol type is HTTP in the original traffic record file until all the traffic records in the original traffic record file are traversed.

Note here: continuous time period refers to ① the end time of the current initial flow record and the start time of the next flow record are continuous, then the two flow records are in the same continuous time period; or ② if two If the times of the flow records overlap, the two flow records are also in the same continuous time period. The earliest time of the two flow records is the starting time of the continuous time period, and the latest time of the two flow records is the starting time of the continuous time period. Time is the end time of the continuous time period; or ③ according to the probability statistics and actual use, you can set the continuous time interval range of two flow records, that is, within this time interval range, the time period of the two flow records, It can be regarded as a continuous period of time.

Table 5 shows that in this embodiment, the first traffic record whose media transfer protocol type is HTTP is merged, and the merged new traffic record is inserted into the original traffic record file.

table 5

According to the above method, all the remaining flow records in the original flow file are detected one by one, and after all the remaining flow records in the original flow file are detected, all the merged flow records in all temporary flow files Insert into the original traffic record file one by one according to the starting time sequence, and delete all merged records stored in the temporary traffic file; the rest of the traffic records in the original traffic record file -- the media transfer protocol type is not HTTP The traffic records of the client are still stored in the original traffic record file; in this way, multiple traffic records of the client are merged to reduce storage space and save storage resources.

In this embodiment, by merging the flow records in the original flow record file in Table 2, multiple flow records in the original flow record file are merged into one flow record, which reduces storage space and saves storage resources.

Fig. 4 is a schematic structural diagram of an original flow record file generation device in the prior art; as shown in Fig. 4 , the original flow record file generation device in the prior art includes an acquisition module 41, an analysis module 42 and an original flow record file generation module 43;

The collection module 41 is used to obtain GTP and IP data packets according to the flow collection sequence and the preset flow collection cycle;

The parsing module 42 is used to identify the GTP and IP packets in the acquired GTP and IP datagrams, and complete signaling parsing and protocol parsing, so as to obtain the information contained in the traffic records in the original traffic record files and the transmission Characteristic fields related to media protocol type, characteristic fields related to HTTP content type, characteristic fields related to streaming start time, etc.;

The original flow record file generation module 43 is used to generate the original flow record file; different records of different users are stored in the corresponding original flow record file according to the flow collection sequence according to the collection period and the single file size, wherein the collection period corresponds to the collection The size of a single file is set according to different requirements.

FIG. 5 is a schematic structural diagram of an apparatus for merging and processing streaming media service flow records provided by an embodiment of the present invention; as shown in FIG. in,

A judging module 51, configured to judge the media transfer protocol type of the first traffic record in the original traffic record file;

The original flow record file generation module 43 in the original flow record file generation device of the prior art is connected to the judging module 51 of the device in this embodiment through an interface, which can be a separate device; The judging module 51 and the merging processing module 52 of this embodiment are installed on the basis of the recording file generating device. Judgment module 51 is specifically used for:

According to the feature field included in the first traffic record, determine the media transfer protocol type of the first traffic record.

The merging processing module 52 is configured to perform merging processing on the first traffic records of the same media transfer protocol type according to the judgment result of the judging module 41 .

Further, the merging processing module 52 is specifically used for:

If the judgment result is HTTP, the first traffic records with the same online account, continuous time periods, the same main domain address in the URL, and the same HTTP content type are merged to generate the second traffic record; the second flow record has the same online account as the first flow record, the same main domain address in the URL, and the same HTTP content type, and the start time of the second flow record is the first The earliest start time in a flow record, and the end time of the second flow record is the latest end time in the first flow record. Combine the HTTP traffic records in the first traffic records with the same online account, continuous time periods, the same main domain address in the URL, and the same HTTP content type to generate a new HTTP traffic record, and The generated new HTTP flow records are temporarily stored in the temporary flow record file; when all flow records whose protocol type is HTTP in the first flow record file are all merged and processed one by one, they will be temporarily stored in the temporary flow record The generated second traffic records of HTTP in the file are inserted into the original traffic record file one by one according to the order of start time, and the updated traffic records of the original traffic records are obtained, as well as the generated traffic records stored in the temporary storage file. The second traffic record of HTTP is deleted; the remaining traffic records in the original traffic record file—the traffic records whose media transfer protocol type is not HTTP are still stored in the original traffic record file.

If the judgment result is a P2P protocol, the first traffic records with the same online account and continuous time periods are merged to generate a third traffic record; the third traffic record is the same as the first traffic record have the same online account, the start time of the third flow record is the earliest start time in the first flow record, and the end time of the third flow record is the latest end time in the first flow record . Combine the flow records of the P2P protocol in the first flow records with the same online account and continuous time periods, generate new flow records of the P2P protocol, and temporarily store the generated new flow records of the P2P protocol in the temporary stored in the traffic record file; when all the traffic records whose protocol type in the first traffic record file is P2P protocol are merged and processed one by one, the generated third traffic of the P2P protocol temporarily stored in the temporarily stored traffic record file The records are inserted into the original flow record file one by one according to the order of start time, the updated flow record of the original flow record is obtained, and the third flow record of the generated P2P protocol stored in the temporary storage flow file is deleted; the original flow The rest of the traffic records in the record file—the traffic records whose media transmission protocol type is not the P2P protocol are still saved in the original traffic record file.

Note here: Although in this embodiment the flow records in the original flow record files of HTTP or P2P protocol media transfer protocols are respectively merged using different merging processing modules, in practice, there may be two kinds of protocols at the same time Types, or more media transmission protocols, can process different media transmission protocol types at the same time, and respectively obtain traffic records merged and processed for different media transmission protocol types. For example: Judging and merging 100 traffic records in the original traffic record file. Among them, there are traffic records of HTTP and P2P protocols respectively, and the traffic records of HTTP and P2P protocols that meet the conditions are finally obtained as 5. 3 articles.

The device in this embodiment may further include a flow record storage module, configured to store an updated flow record of the original flow record; merge the flow records having the same protocol type in the first flow record in the original flow record file The obtained second flow record or the third flow record respectively replaces the corresponding flow record in the first flow record before merging, so as to obtain an updated flow record of the original flow record. The streaming media service flow record merging processing device of this embodiment judges the media transmission protocol type of the first flow record in the original flow record file through the judging module; The first traffic records with the same protocol type are merged; since the judging module in the device of this embodiment can judge the media transfer protocol type of the traffic record in the original traffic record file, and the traffic with the same media transfer protocol type Records are merged to reduce storage space and save storage resources.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by program instructions and related hardware. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above-mentioned method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope. …

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by program instructions and related hardware. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above-mentioned method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (6)

1. A stream media service flow record merging processing method is characterized by comprising the following steps:

judging the type of a media transmission protocol of a first flow record in an original flow record file;

and merging the first flow records with the same media transmission protocol type according to the judged result.

2. The method according to claim 1, wherein said merging the first traffic records of the same media transport protocol type according to the judgment result of the judgment comprises:

if the judgment result is a hypertext transfer protocol (HTTP), merging the first traffic records with the same internet access account, continuous time period, the same main domain address in a Uniform Resource Locator (URL) and the same content type of the HTTP protocol to generate a second traffic record; the second traffic record and the first traffic record have the same internet access account, the same home domain address in the URL, and the same content type of HTTP, the start time of the second traffic record is the earliest start time in the first traffic record, and the end time of the second traffic record is the latest end time in the first traffic record;

if the judgment result is a point-to-point P2P protocol, merging the first flow records with the same internet surfing account and continuous time period to generate a third flow record; the third flow record and the first flow record have the same internet access account, the start time of the third flow record is the earliest start time in the first flow record, and the end time of the third flow record is the latest end time in the first flow record.

3. The method according to claim 1 or 2, wherein the determining the media transport protocol type of the first traffic record in the original traffic record file comprises:

and judging the type of the media transmission protocol of the first flow record according to the characteristic field contained in the first flow record.

4. A device for merging and processing stream media service traffic records, comprising:

the judging module is used for judging the media transmission protocol type of the first flow record in the original flow record file;

and the merging processing module is used for merging the first traffic records with the same media transmission protocol type according to the judgment result of the judgment module.

5. The apparatus of claim 4, wherein the merge processing module is specifically configured to:

if the judgment result is a hypertext transfer protocol (HTTP), merging the first traffic records with the same internet access account, continuous time period, the same main domain address in a Uniform Resource Locator (URL) and the same content type of the HTTP to generate a second traffic record; the second traffic record and the first traffic record have the same internet access account, the same home domain address in the URL, and the same content type of HTTP, the start time of the second traffic record is the earliest start time in the first traffic record, and the end time of the second traffic record is the latest end time in the first traffic record;

if the judgment result is a point-to-point P2P protocol, merging the first flow records with the same internet surfing account and continuous time period to generate a third flow record; the third flow record and the first flow record have the same internet access account, the start time of the third flow record is the earliest start time in the first flow record, and the end time of the third flow record is the latest end time in the first flow record.

6. The apparatus according to claim 4 or 5, wherein the determining module is specifically configured to: and judging the type of the media transmission protocol of the first flow record according to the characteristic field contained in the first flow record.

Images