CN106936663A - A kind of method and device for determining the application that terminal is installed - Google Patents
A kind of method and device for determining the application that terminal is installed Download PDFInfo
- Publication number
- CN106936663A CN106936663A CN201511032156.9A CN201511032156A CN106936663A CN 106936663 A CN106936663 A CN 106936663A CN 201511032156 A CN201511032156 A CN 201511032156A CN 106936663 A CN106936663 A CN 106936663A
- Authority
- CN
- China
- Prior art keywords
- application
- message
- data message
- agreement
- terminal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/06—Generation of reports
- H04L43/062—Generation of reports related to network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/18—Protocol analysers
Abstract
The invention discloses a kind of method and device for determining the application that terminal is installed, the network data message of the management application software that terminal is installed is obtained in Preset Time；According to default recognition rule, agreement and the application of the network data message are recognized by deep-packet detection DPI technologies, determine the data message of agreement association and the data message of association；The data message and the data message of association associated according to the agreement, determine the application message that the management application software is included.The method and apparatus for determining the application that terminal is installed provided in an embodiment of the present invention, are capable of the installation application of complete and accurate ground identification terminal, realize the real-time update of application.
Description
Technical field
The present invention relates to moving communicating field, more particularly to a kind of method and dress for determining the application that terminal is installed
Put.
Background technology
With the development of smart mobile phone, the species of the APP (Application, application program) in smart mobile phone
Variation is presented.It is analyzed and recognizes for the application in mobile phone, is conducive to developer to be directed to cellphone subscriber
Service condition to applying improves Consumer's Experience.
DPI (Deep Packet Inspection, deep-packet detection) technology is multiple business fortune in reply network
The method of the brought problem of management of row, i.e., can quickly be parsed using DPI technologies to network data,
So as to enable that carrier network supports the business based on application, such as mail class rate bag, video class money
Take bag, game class rate bag etc..In existing mobile core network, mainly pass through DPI network analysis users
Flow information during online, so that the Apply Names that identifying user is used, and according to the user in a period of time
The statistical conditions of the application message that internet behavior is recorded and user uses, so as to obtain the installation application of user
List.
The existing method for determining the application that terminal is installed has the following disadvantages：1st, DPI systems can only be parsed
The application feature known, it is impossible to recognize the unknown new application reached the standard grade of DPI systems；2nd, for HTTPS (Hyper
Text Transfer Protocol over Secure Socket Layer, Hyper text transfer data security protocol), it is private
There are the application of the encryptions such as agreement, DPI system None- identifieds；3rd, user has installed untapped application, DPI
System None- identified；4th, DPI systems needs analyze user and apply service condition by certain measurement period.
In sum, existing flow information when being surfed the Net by DPI technical Analysis user is so as to identifying user
Using the method for service condition, it is impossible to the installation application of complete identifying user, and cannot real-time update.
The content of the invention
The present invention provides a kind of method and device of analysing terminal application behavior, is used to solve lead in the prior art
Cross DPI technical Analysis user surf the Net when flow information so as to identifying user application service condition method, no
The installation application of can completely identifying user, and cannot real-time update problem.
The embodiment of the present invention provides a kind of method for determining the application that terminal is installed, including：
The network data message of the management application software that terminal is installed is obtained in Preset Time；
According to default recognition rule, the association of the network data message is recognized by deep-packet detection DPI technologies
Negotiate peace and apply, determine the data message of agreement association and the data message of association；
The data message and the data message of association associated according to the agreement, determine the management application
The application message that software kit contains.
Optionally, after the application message that the determination management application software is included, also include：
The network data message is parsed according to default communication protocol, the management application software association is obtained
Terminal iidentification；
The application message included according to the management application software and the management application software associated terminal are identified,
Determine the mapping relations of the terminal iidentification and the application message.
Optionally, the application message included according to the management application software and the management application software
Associated terminal is identified, and is determined after the terminal iidentification and the mapping relations of the application message, is also included：
The terminal iidentification is stored in mapping relations database with the mapping relations of the application message；
According to terminal iidentification to be checked, the mapping relations database is inquired about, obtain the end to be checked
The modification information of each application in the corresponding application message of end mark；
According to the modification information that each is applied in the application message, the terminal iidentification pair to be checked is determined
The grade of each application in the terminal answered.
Optionally, the default communication protocol is general packet radio service technology tunnel protocol GTP, institute
State application message include it is following in it is part or all of：
The mark of application, the mark of agreement, using entrance, using action.
Optionally, the default recognition rule of the basis, the network is recognized by deep-packet detection DPI technologies
The agreement of data message and application, determine the data message of agreement association and the data message of association, bag
Include：
According to the agreement that confirmation is recognized, identification protocol metadata；Confirming to recognize the agreement unit
After data, the protocol metadata is extracted according to regular expression, obtain the data message of the agreement association；
According to the application that confirmation is recognized, the mark of the application is obtained；According to the mark of the application,
The corresponding application metadata of mark of the application is recognized, and the first number of the application is extracted according to regular expression
According to the data message of the acquisition association.
The embodiment of the present invention also provides a kind of device for determining the application that terminal is installed, including：
Acquiring unit：Network data message for obtaining the management application software that terminal is installed in Preset Time；
Recognition unit：For according to default recognition rule, the net being recognized by deep-packet detection DPI technologies
The agreement of network data message and application, determine the data message of agreement association and the data message of association；
Determining unit：For the data message and the data message of association that are associated according to the agreement, really
The application message that the fixed management application software is included.
Optionally, the determining unit, is additionally operable to：
The network data message is parsed according to default communication protocol, the management application software association is obtained
Terminal iidentification；
The application message included according to the management application software and the management application software associated terminal are identified,
Determine the mapping relations of the terminal iidentification and the application message.
Optionally, the determining unit, is additionally operable to：
The terminal iidentification is stored in mapping relations database with the mapping relations of the application message；
According to terminal iidentification to be checked, the mapping relations database is inquired about, obtain the end to be checked
The modification information of each application in the corresponding application message of end mark；
According to the modification information that each is applied in the application message, the terminal iidentification pair to be checked is determined
The grade of each application in the terminal answered.
Optionally, the default communication protocol is general packet radio service technology tunnel protocol GTP, institute
State application message include it is following in it is part or all of：
The mark of application, the mark of agreement, using entrance, using action.
Optionally, the recognition unit, specifically for：
According to the agreement that confirmation is recognized, identification protocol metadata；Confirming to recognize the agreement unit
After data, the protocol metadata is extracted according to regular expression, obtain the data message of the agreement association；
According to the application that confirmation is recognized, the mark of the application is obtained；According to the mark of the application,
The corresponding application metadata of mark of the application is recognized, and the first number of the application is extracted according to regular expression
According to the data message of the acquisition association.
A kind of method and device for determining the application that terminal is installed is the embodiment of the invention provides, in Preset Time
Obtain the network data message of the management application software that terminal is installed；According to default recognition rule, by depth
Bag detection DPI technologies recognize agreement and the application of the network data message, determine the data letter of agreement association
The data message of breath and association；The data message and the data letter of association associated according to the agreement
Breath, determines the application message that the management application software is included.Determination terminal peace provided in an embodiment of the present invention
The method and apparatus of the application of dress, are capable of the installation application of complete and accurate ground identification terminal, realize application
Real-time update.
Brief description of the drawings
Technical scheme in order to illustrate more clearly the embodiments of the present invention, institute in being described to embodiment below
The accompanying drawing for needing to use is briefly introduced, it should be apparent that, drawings in the following description are only of the invention
Some embodiments, for one of ordinary skill in the art, are not paying the premise of creative labor
Under, other accompanying drawings can also be obtained according to these accompanying drawings.
Fig. 1 is a kind of method flow schematic diagram for determining the application that terminal is installed provided in an embodiment of the present invention；
Fig. 2 is a kind of method flow schematic diagram based on DPI identification applications provided in an embodiment of the present invention；
Fig. 3 is a kind of apparatus structure schematic diagram for determining the application that terminal is installed provided in an embodiment of the present invention；
Fig. 4 is a kind of schematic device for determining the application that terminal is installed provided in an embodiment of the present invention；
Fig. 5 is a kind of structural representation for merging sensing layer provided in an embodiment of the present invention.
Specific embodiment
In order that the object, technical solutions and advantages of the present invention are clearer, below in conjunction with accompanying drawing to this hair
It is bright to be described in further detail, it is clear that described embodiment is only some embodiments of the invention,
Rather than whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art are not doing
Go out all other embodiment obtained under the premise of creative work, belong to the scope of protection of the invention.
Terminal in the embodiment of the present invention is to refer to the equipment for providing a user with voice and/or data connectivity
, including wireless terminal or catv terminal (device).Wireless terminal can be with the hand-held of wireless connecting function
Formula equipment is connected to other processing equipments of radio modem, through wireless access network and one or many
The mobile terminal that individual core net is communicated.For example, it (or is " honeycomb " that wireless terminal can be mobile phone
Phone) and computer with mobile terminal.And for example, wireless terminal can also be portable, pocket,
Hand-held, built-in computer or vehicle-mounted mobile device.
Application in the embodiment of the present invention is the software in terminal, it is therefore an objective to meet user's different field,
The application demand of different problems, for example：Taobao, wechat, QQ etc..
The embodiment of the present invention provides a kind of method for determining the application that terminal is installed.As shown in figure 1, being this hair
The method journey schematic diagram of the application that a kind of determination terminal that bright embodiment is provided is installed, including：
Step 101：The network data message of the management application software that terminal is installed is obtained in Preset Time.
Step 102：According to default recognition rule, the agreement of network data message is recognized by DPI technologies and is answered
With, determine agreement association data message and association data message.
Step 103：The data message and the data message of association associated according to agreement, it is determined that management application
The application message that software kit contains.
In embodiments of the present invention, management application software is with the application software function of being installed in management terminal
Application, such as 360 security guards, Android application market, millet application market etc..
Specifically, Preset Time can be that the application management software that terminal is installed produces network number in step 101
According to the time of message, network data message can be flow information.
The usual analyzing IP of traditional packet check (Internet Protocol, the agreement interconnected between network) packet
Four layers of herein below, generally comprise " five-tuple ", i.e. source address, source port, destination address, destination
Mouth and protocol type.DPI technologies are to carry out depth analysis to the content of application layer, so as to according to application layer
Content characteristic recognizes its application type or content.As IP packets, TCP (Transmission Control
Protocol, transmission control protocol) or UDP (User Datagram Protocol, UDP)
When data flow is by the network equipment for being based on DPI technologies, DPI engines are by deeply reading the interior of IP payload packages
Hold and come in OSI (Open System Interconnect, open system interconnection reference model) layer 7 agreement
Application layer message recombinated, so as to identify the application layer protocol of IP bags.
In step 102, the network data message of parsing management application software is recognized in the way of DPI.To from
Scattered IP messages, can converge convergence according to the mode of five-tuple, and each IP message extracts data when recognizing
Body payload portions.
Specifically, the agreement for being recognized according to confirmation, identification protocol metadata；Confirming to recognize agreement unit
After data, protocol metadata is extracted according to regular expression, obtain the data message of agreement association；According to true
The application that understanding is clipped to, obtains the mark of application；According to the mark of application, recognize that the mark of application is corresponding
Using metadata, and metadata is applied according to regular expression extraction, obtain the data message of association.
Further, agreement is the rule of data transfer, for example, HTTP (Hyper Text Transfer Protocol,
HTTP), FTP (File Transfer Protocol, FTP)；Protocol metadata is
Constitute agreement basic element, the grammer, semanteme, sequential including agreement etc..Applied to constitute using metadata
Basic element, such as trade name of Taobao's shopping cart, Taobao's application of Android application market etc..
In step 103, the data message and the data message of association associated according to agreement are managed
The application message that application software is included.Application message include it is following in it is part or all of：The mark of application,
The mark of agreement, using entrance, using action.For example, the mark of application can be " Sina weibo "；Association
The mark of view can be " HTTP "；It is the bearing mode that user surfs the Net, such as webpage or APP using entrance；
Using the application button that action is used for user, such as browse, unload, update, comment on.
For example, by DPI technologies, the network data message that Android market reports in identification terminal obtains end
The application message that Android market includes in end, it is as shown in table 1, i.e., all in the corresponding terminal in Android market
Using and with association information.
The application message that the Android market of table 1 includes
| Application identities | Protocol-identifier | Using entrance | Using action | |
| 1 | Sina weibo | HTTP | APP | Update |
| 2 | HTTP | APP | Unloading | |
| 3 | FTP | APP | Comment | |
| 4 | Taobao | FTP | APP | Update |
Further, management application software can also be parsed according to default communication protocol after step 103
Network data message, obtains the terminal iidentification of management application software association；Specifically, can be according to GTP
(General Packet Radio Service Tunneling Protocol, GPRS Tunnel Protocol), should by management
Identified with the network data message reflexless terminal of software, for example, the network data report uploaded according to Android market
Text obtains the corresponding phone number in Android market for A.
Then, application message and management application software the associated terminal mark for being included according to management application software,
Determine the mapping relations of terminal iidentification and application message.For example, the corresponding applications of phone number A can be obtained
Information is table 1.
In embodiments of the present invention, the mapping relations of terminal iidentification and application message can also be stored in into mapping to close
It is database, i.e., the network data message for being reported every time according to management application software obtains every time not exclusively phase
Same terminal iidentification and the mapping relations of application message, and the terminal iidentification that will be obtained every time and application message
Mapping relations are stored in mapping relations database, i.e., set up application cache inventory by index of terminal iidentification, and this is clear
Singly reside permanently internal memory, and by cycle synchronisation to hard disk, realize persistence.
When needing the behavior for certain terminal to be analyzed, according to terminal iidentification to be checked, inquiry is reflected
Relational database is penetrated, the modification information of each application in the corresponding application message of terminal iidentification to be checked is obtained；
According to the modification information that each is applied in application message, determine every in the corresponding terminal of terminal iidentification to be checked
The grade of individual application.
Specifically, the frequency is changed according to the corresponding version number that each is applied of probabilistic algorithm computing terminal mark,
The grade or user for setting up each application use preference pattern.For example：Model can be set to A0, A1, A2
Three Estate；If the grade of certain application is A0, version does not update in setting time such as two weeks, then decline
It is grade A1.
For example, terminal iidentification to be checked is B, then mapping relations database is inquired about, obtain terminal iidentification B
The alteration of the application in corresponding terminal.Never updated to wechat application from relational database query is penetrated,
And there is the situation of unloading, then the grade of wechat is set to A2.
It should be noted that after step 103 determines the application message that includes of management application software, being not limited to
Application software behavioural analysis is carried out for particular terminal mark.The whole network system can also be carried out for application message
Analysis, obtains the behavior model of each application of the whole network user.
Additionally, identification management application software network data message agreement and application before, can with should
Analyzed in units of agreement, protocol metadata, using, using metadata, according to recognition rule, set up deep
Degree identification storehouse.When recognizing the agreement of network data message of management application software and applying, depth is called to know
Other storehouse, match cognization rule obtains the data message of agreement association and the data message of association.Fig. 2
It is a kind of method flow schematic diagram based on DPI identification applications provided in an embodiment of the present invention, including：
Step 201：Network data message is obtained, depth recognition storehouse is called；
Step 202：Traversal protocols rule, identification protocol；
Step 203：Judge whether to recognize agreement, if so, then performing step 204, otherwise perform step 205；
Step 204：The protocol-identifier that acquisition is recognized, continues executing with step 206；
Step 205：Depth recognition storehouse is exited, identity protocol is unidentified.
Step 206：Traversal protocols metadata rule, identification protocol metadata；
Step 207：Protocol metadata is judged whether, if so, then performing step 208, step is otherwise performed
Rapid 209；
Step 208：Protocol metadata is extracted using regular expression, the data message of agreement association is obtained；
Step 209：Identity protocol metadata is sky.
Step 210：Traversal applications rule, identification application；
Step 211：Judge whether to recognize application identities, if so, then performing step 212, otherwise perform step
Rapid 213；
Step 212：The mark of application is obtained, is judged to apply entrance according to data model, and continue executing with step
214；
Step 213：Depth recognition storehouse is exited, mark application is unidentified.
Step 214：Extracted according to regular expression and apply metadata, obtain the data message of the association.
It should be noted that the method based on DPI identification applications provided in an embodiment of the present invention can be by above-mentioned
Step is performed, it is also possible to step 203 to step 209 and step 210 to step 214 executed in parallel, herein
It is not limited.
A kind of method for determining the application that terminal is installed is the embodiment of the invention provides, is obtained eventually in Preset Time
Hold the network data message of the management application software installed；According to default recognition rule, by deep-packet detection
DPI technologies recognize agreement and the application of the network data message, determine data message and the application of agreement association
The data message of association；The data message and the data message of association associated according to the agreement, it is determined that
The application message that the management application software is included.It is provided in an embodiment of the present invention to determine the application that terminal is installed
Method, be capable of complete and accurate ground identification terminal installation application, realize the real-time update of application.
Based on same inventive concept, the embodiment of the present invention also provides a kind of dress for determining the application that terminal is installed
Put.As shown in figure 3, being a kind of apparatus structure for determining the application that terminal is installed provided in an embodiment of the present invention
Schematic diagram, including：
Acquiring unit 301：Network data report for obtaining the management application software that terminal is installed in Preset Time
Text；
Recognition unit 302：For according to default recognition rule, being recognized by deep-packet detection DPI technologies described
The agreement of network data message and application, determine the data message of agreement association and the data message of association；
Determining unit 303：For the data message and the data message of association that are associated according to the agreement,
Determine the application message that the management application software is included.
Optionally, the determining unit 303, is additionally operable to：
The network data message is parsed according to default communication protocol, the management application software association is obtained
Terminal iidentification；
The application message included according to the management application software and the management application software associated terminal are identified,
Determine the mapping relations of the terminal iidentification and the application message.
Optionally, the determining unit 303, is additionally operable to：
The terminal iidentification is stored in mapping relations database with the mapping relations of the application message；
According to terminal iidentification to be checked, the mapping relations database is inquired about, obtain the end to be checked
The modification information of each application in the corresponding application message of end mark；
According to the modification information that each is applied in the application message, the terminal iidentification pair to be checked is determined
The grade of each application in the terminal answered.
Optionally, the default communication protocol is general packet radio service technology tunnel protocol GTP, institute
State application message include it is following in it is part or all of：
The mark of application, the mark of agreement, using entrance, using action.
Optionally, the recognition unit 302, specifically for：
According to the agreement that confirmation is recognized, identification protocol metadata；Confirming to recognize the agreement unit
After data, the protocol metadata is extracted according to regular expression, obtain the data message of the agreement association；
According to the application that confirmation is recognized, the mark of the application is obtained；According to the mark of the application,
The corresponding application metadata of mark of the application is recognized, and the first number of the application is extracted according to regular expression
According to the data message of the acquisition association.
A kind of device for determining the application that terminal is installed is the embodiment of the invention provides, is obtained eventually in Preset Time
Hold the network data message of the management application software installed；According to default recognition rule, by deep-packet detection
DPI technologies recognize agreement and the application of the network data message, determine data message and the application of agreement association
The data message of association；The data message and the data message of association associated according to the agreement, it is determined that
The application message that the management application software is included.It is provided in an embodiment of the present invention to determine the application that terminal is installed
Device, be capable of complete and accurate ground identification terminal installation application, realize the real-time update of application.
The device of the application installed to a kind of determination terminal provided in an embodiment of the present invention with the aspect applied below
It is described in detail, such as Fig. 4 is a kind of device for determining the application that terminal is installed provided in an embodiment of the present invention
Schematic diagram, including DPI data collection layers 401 and fusion sensing layer 402.Wherein, acquiring unit 301 is located at
DPI data collection layers 401, recognition unit 302 is located at DPI data collection layers 401, determining unit 303
In DPI data collection layers 401 and fusion sensing layer 402.
Specifically, DPI data collection layers 401 are used for the network data of the management application software for obtaining terminal installation
Message, and according to default recognition rule, agreement and the application of network data message are recognized by DPI technologies,
Determine the data message of agreement association and the data message of association；And the data message associated according to agreement
With the data message of association, the application message that management application software is included is determined.
Further, the agreement that DPI data collection layers 401 are recognized according to confirmation, identification protocol metadata；
After confirming to recognize protocol metadata, protocol metadata is extracted according to regular expression, obtain agreement association
Data message；According to the application that confirmation is recognized, the mark of application is obtained；According to the mark of application, know
The corresponding application metadata of mark do not applied, and metadata is applied according to regular expression extraction, obtaining should
With the data message of association.
Further, agreement is the rule of data transfer, for example, HTTP (Hyper Text Transfer Protocol,
HTTP), FTP (File Transfer Protocol, FTP)；Protocol metadata is
Constitute agreement basic element, the grammer, semanteme, sequential including agreement etc..Applied to constitute using metadata
Basic element, such as trade name of Taobao's shopping cart, Taobao's application of Android application market etc..In identification
Agreement, protocol metadata, using, using metadata after, with TLV (Type-length-value, type
- Length Value) form encapsulation of data message, and be uploaded to fusion sensing layer 402.
Fusion sensing layer 402 is used to parse network data message according to communication protocol, obtains management application software
The terminal iidentification of association；And the application message that is included according to management application software and management application software association are eventually
End mark, determines the mapping relations of terminal iidentification and application message.
Further, with the mapping relations of application message can also be stored in terminal iidentification by fusion sensing layer 402
Mapping relations database；According to terminal iidentification to be checked, mapping relations database is inquired about, obtained to be checked
The corresponding application message of terminal iidentification in each application modification information；According to each application in application message
Modification information, determine the grade of each application in the corresponding terminal of terminal iidentification to be checked.
As shown in figure 5, be a kind of structural representation for merging sensing layer 402 provided in an embodiment of the present invention,
Including terminal recognition area 501, history buffer area 502, application level area 503 and application-specific area 504.
Terminal recognition area 501, for the GTP tunnel information by signaling side and data side GTP tunnel information
Reflexless terminal identifies, and obtains the mapping relations of terminal iidentification and application message.
History buffer area 502, for the mapping relations of terminal iidentification and application message to be stored in into mapping relations data
Storehouse, i.e., the network data message for being reported every time according to management application software obtains end incomplete same every time
End identifies the mapping relations with application message, and the terminal iidentification that will be obtained every time is closed with the mapping of application message
System is stored in history buffer area 502, i.e., set up application cache inventory by index of terminal iidentification, and the inventory resides permanently interior
Deposit, and by cycle synchronisation to hard disk, realize persistence.
Application level area 503, for according to the corresponding version number that each is applied of probabilistic algorithm computing terminal mark
The change frequency, the grade or user for setting up each application uses preference pattern.For example：Model can be set to
A0, A1, A2 Three Estate；If the grade of certain application is A0, version does not have in setting time such as two weeks
Update, then drop to grade A1.
Application-specific area 504, for the application for storing conventional application and delete.
The present invention is with reference to method according to embodiments of the present invention, equipment (system) and computer program product
Flow chart and/or block diagram describe.It should be understood that can by computer program instructions realize flow chart and/
Or flow in each flow and/or square frame and flow chart and/or block diagram in block diagram and/or
The combination of square frame.These computer program instructions to all-purpose computer, special-purpose computer, embedded can be provided
The processor of processor or other programmable data processing devices is producing a machine so that by computer
Or the instruction of the computing device of other programmable data processing devices is produced for realizing in one stream of flow chart
The system of the function of being specified in journey or multiple one square frame of flow and/or block diagram or multiple square frames.
These computer program instructions may be alternatively stored in can guide computer or other programmable data processing devices
In the computer-readable memory for working in a specific way so that storage is in the computer-readable memory
Instruction is produced includes the manufacture of instruction system, and the instruction system is realized in one flow of flow chart or multiple streams
The function of being specified in one square frame of journey and/or block diagram or multiple square frames.
These computer program instructions can be also loaded into computer or other programmable data processing devices, made
Obtain and series of operation steps performed on computer or other programmable devices to produce computer implemented treatment,
So as to the instruction performed on computer or other programmable devices is provided for realizing in one flow of flow chart
Or specified in multiple one square frame of flow and/or block diagram or multiple square frames function the step of.
, but those skilled in the art once know base although preferred embodiments of the present invention have been described
This creative concept, then can make other change and modification to these embodiments.So, appended right will
Ask and be intended to be construed to include preferred embodiment and fall into having altered and changing for the scope of the invention.
Obviously, those skilled in the art can carry out various changes and modification without deviating from this hair to the present invention
Bright spirit and scope.So, if it is of the invention these modification and modification belong to the claims in the present invention and
Within the scope of its equivalent technologies, then the present invention is also intended to comprising these changes and modification.
Claims (10)
1. it is a kind of determine terminal install application method, it is characterised in that including：
The network data message of the management application software that terminal is installed is obtained in Preset Time；
According to default recognition rule, the association of the network data message is recognized by deep-packet detection DPI technologies
Negotiate peace and apply, determine the data message of agreement association and the data message of association；
The data message and the data message of association associated according to the agreement, determine the management application
The application message that software kit contains.
2. the method for claim 1, it is characterised in that the determination management application software
Comprising application message after, also include：
The network data message is parsed according to default communication protocol, the management application software association is obtained
Terminal iidentification；
The application message included according to the management application software and the management application software associated terminal mark
Know, determine the mapping relations of the terminal iidentification and the application message.
3. method as claimed in claim 2, it is characterised in that described according to the management application software
Comprising application message and the management application software associated terminal mark, determine the terminal iidentification with it is described
After the mapping relations of application message, also include：
The terminal iidentification is stored in mapping relations database with the mapping relations of the application message；
According to terminal iidentification to be checked, the mapping relations database is inquired about, obtain the end to be checked
The modification information of each application in the corresponding application message of end mark；
According to the modification information that each is applied in the application message, the terminal iidentification pair to be checked is determined
The grade of each application in the terminal answered.
4. method as claimed in claim 2, it is characterised in that the default communication protocol is general
Packet wireless service technology tunnel protocol GTP, the application message include it is following in it is part or all of：
The mark of application, the mark of agreement, using entrance, using action.
5. the method for claim 1, it is characterised in that the basis presets recognition rule, leads to
Agreement and application that deep-packet detection DPI technologies recognize the network data message are crossed, agreement association is determined
The data message of data message and association, including：
According to the agreement that confirmation is recognized, identification protocol metadata；Confirming to recognize the agreement unit
After data, the protocol metadata is extracted according to regular expression, obtain the data message of the agreement association；
According to the application that confirmation is recognized, the mark of the application is obtained；According to the mark of the application,
The corresponding application metadata of mark of the application is recognized, and the first number of the application is extracted according to regular expression
According to the data message of the acquisition association.
6. it is a kind of determine terminal install application device, it is characterised in that including：
Acquiring unit：Network data message for obtaining the management application software that terminal is installed in Preset Time；
Recognition unit：For according to default recognition rule, the net being recognized by deep-packet detection DPI technologies
The agreement of network data message and application, determine the data message of agreement association and the data message of association；
Determining unit：For the data message and the data message of association that are associated according to the agreement, really
The application message that the fixed management application software is included.
7. device as claimed in claim 6, it is characterised in that the determining unit, is additionally operable to：
The network data message is parsed according to default communication protocol, the management application software association is obtained
Terminal iidentification；
The application message included according to the management application software and the management application software associated terminal mark
Know, determine the mapping relations of the terminal iidentification and the application message.
8. device as claimed in claim 7, it is characterised in that the determining unit, is additionally operable to：
The terminal iidentification is stored in mapping relations database with the mapping relations of the application message；
According to terminal iidentification to be checked, the mapping relations database is inquired about, obtain the end to be checked
The modification information of each application in the corresponding application message of end mark；
According to the modification information that each is applied in the application message, the terminal iidentification pair to be checked is determined
The grade of each application in the terminal answered.
9. device as claimed in claim 7, it is characterised in that the default communication protocol is general
Packet wireless service technology tunnel protocol GTP, the application message include it is following in it is part or all of：
The mark of application, the mark of agreement, using entrance, using action.
10. device as claimed in claim 6, it is characterised in that the recognition unit, specifically for：
According to the agreement that confirmation is recognized, identification protocol metadata；Confirming to recognize the agreement unit
After data, the protocol metadata is extracted according to regular expression, obtain the data message of the agreement association；
According to the application that confirmation is recognized, the mark of the application is obtained；According to the mark of the application,
The corresponding application metadata of mark of the application is recognized, and the first number of the application is extracted according to regular expression
According to the data message of the acquisition association.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201511032156.9A CN106936663B (en) | 2015-12-31 | 2015-12-31 | Method and device for determining application installed in terminal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201511032156.9A CN106936663B (en) | 2015-12-31 | 2015-12-31 | Method and device for determining application installed in terminal |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106936663A true CN106936663A (en) | 2017-07-07 |
| CN106936663B CN106936663B (en) | 2020-02-21 |
Family
ID=59444862
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201511032156.9A Active CN106936663B (en) | 2015-12-31 | 2015-12-31 | Method and device for determining application installed in terminal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106936663B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112764837A (en) * | 2021-01-29 | 2021-05-07 | 腾讯科技（深圳）有限公司 | Data reporting method, device, storage medium and terminal |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070202873A1 (en) * | 2006-02-17 | 2007-08-30 | Cisco Technology, Inc. | Optimal home agent allocation |
| CN102938789A (en) * | 2012-11-19 | 2013-02-20 | 江苏省公用信息有限公司 | Download combination analysis method and device for mobile internet mobile phone applications |
| CN103414766A (en) * | 2013-07-29 | 2013-11-27 | 北京小米科技有限责任公司 | Method, device and terminal equipment for installing application |
| CN104935478A (en) * | 2015-06-19 | 2015-09-23 | 上海斐讯数据通信技术有限公司 | Intelligent terminal depth perception method and system thereof |
-
2015
- 2015-12-31 CN CN201511032156.9A patent/CN106936663B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070202873A1 (en) * | 2006-02-17 | 2007-08-30 | Cisco Technology, Inc. | Optimal home agent allocation |
| CN102938789A (en) * | 2012-11-19 | 2013-02-20 | 江苏省公用信息有限公司 | Download combination analysis method and device for mobile internet mobile phone applications |
| CN103414766A (en) * | 2013-07-29 | 2013-11-27 | 北京小米科技有限责任公司 | Method, device and terminal equipment for installing application |
| CN104935478A (en) * | 2015-06-19 | 2015-09-23 | 上海斐讯数据通信技术有限公司 | Intelligent terminal depth perception method and system thereof |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112764837A (en) * | 2021-01-29 | 2021-05-07 | 腾讯科技（深圳）有限公司 | Data reporting method, device, storage medium and terminal |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106936663B (en) | 2020-02-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8797901B2 (en) | Method and its devices of network TCP traffic online identification using features in the head of the data flow | |
| CN110113345A (en) | A method of the assets based on Internet of Things flow are found automatically | |
| CN103763154B (en) | A kind of network flow detection method | |
| CN103905261B (en) | Protocol characteristic storehouse online updating method and system | |
| CN103297270A (en) | Application type recognition method and network equipment | |
| WO2019137195A1 (en) | Method and apparatus for obtaining service data | |
| CN109450733B (en) | Network terminal equipment identification method and system based on machine learning | |
| CN110460488B (en) | Service flow identification method and device, and model generation method and device | |
| CN106998262A (en) | A kind of System and method for for recognizing Internet user | |
| CN109271793A (en) | Internet of Things cloud platform device class recognition methods and system | |
| CN109299742A (en) | Method, apparatus, equipment and the storage medium of automatic discovery unknown network stream | |
| CN102984161B (en) | The recognition methods of a kind of reliable website and device | |
| CN107547290A (en) | Flow rate testing methods and device | |
| CN109905873B (en) | Network account correlation method based on characteristic identification information | |
| CN101184000A (en) | Packet sampling and application signature based internet application flux identifying method | |
| CN104333483A (en) | Identification method, system and identification device for internet application flow | |
| CN106789242A (en) | A kind of identification application intellectual analysis engine based on mobile phone client software behavioral characteristics storehouse | |
| CN110020161B (en) | Data processing method, log processing method and terminal | |
| CN109962789A (en) | Method and apparatus based on network data construction working application label system | |
| CN104333461A (en) | Identification method, system and identification device for internet application flow | |
| CN106452859A (en) | Automatic cell phone number characteristic keyword extraction method under fixed network WiFi environment | |
| CN105516173A (en) | Network application layer protocol identification method and system | |
| CN108429802B (en) | Internet of things equipment information acquisition method and device | |
| CN110034970A (en) | The network equipment distinguishes method of discrimination and device | |
| CN104113880B (en) | Method of data flow control and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |