CN107196815A - A kind of determination method and apparatus of the difference of flow analysis ability - Google Patents
A kind of determination method and apparatus of the difference of flow analysis ability Download PDFInfo
- Publication number
- CN107196815A CN107196815A CN201610143797.XA CN201610143797A CN107196815A CN 107196815 A CN107196815 A CN 107196815A CN 201610143797 A CN201610143797 A CN 201610143797A CN 107196815 A CN107196815 A CN 107196815A
- Authority
- CN
- China
- Prior art keywords
- equipment
- dpi
- flow analysis
- dpi equipment
- coordination
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/11—Identifying congestion
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/06—Generation of reports
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
- H04L43/0882—Utilisation of link capacity
Abstract
The application is related to communication technical field, disclose a kind of determination method and apparatus of the difference of flow analysis ability, it is specially a kind of several DPI equipment collaborations work scene under, the determination method of the difference of flow analysis ability, and for the coordination equipment for the flow analysis ability for analyzing some deep message detection DPI equipment, the flow analysis information that different DPI equipment are reported is obtained using equipment is coordinated, so as to know the difference of the flow analysis ability of each DPI equipment, know correct flow analysis result, improve the ability to work of whole system when DPI cooperates.
Description
Technical field
The application is related to communication technical field, more particularly to a kind of determination method of the difference of flow analysis ability
And equipment.
Background technology
Several, which are often serially disposed, under the overall background of lean operation, on carrier network possesses flow
Deep message detection (the English of recognition capability：Deep Packet Inspection, referred to as：DPI) equipment,
Different applications are supported upwards.
There is larger difference in the flow analysis ability of itself due to a variety of causes in these DPI equipment.On
A variety of causes is stated to be exemplified below：Different DPI equipment is come from different producers, connect using different networks
Enter mode, tieed up using different flow identification technologies, with different evolution tendencies, with different upgradings
Shield cycle etc..
Flow analysis ability just because of each DPI equipment has differences, when the work of multiple DPI equipment collaborations
When, different DPI equipment flow analysis results may be inconsistent, causes the acquisition side of flow analysis result
(such as staff) can not accept or reject different flow analysis results, also just can not correctly obtain stub network
Flow application situation.
At present, it is very big to the difficulty coordinated between the flow analysis ability of multiple DPI equipment.Usual root
Similar statistics object in multiple bordereaus exported according to upper layer application system is contrasted, due to multiple industry
It is engaged in form including the data source from multiple DPI equipment, so as to find the flow of different DPI equipment
The difference of analysis result.
But, the side of this difference that different DPI equipment flow analysis abilities are reversely derived according to bordereau
Formula has many not enough., will not be specifically designed for DPI equipment because upper layer application system, which is laid particular emphasis on, applies itself
The Quality Design forms of flow analysis data carry out contrast verification, therefore the mode coverage of this contrast
It is very limited amount of.In addition, bordereau is often to be presented and design to reach certain business, may
Obtained by a variety of processing modes such as filtering, screening, convergence, polymerization, algorithms, therefore this contrast
The contrast precision of mode is very limited amount of.
In summary, in the environment of the work of multiple DPI equipment collaborations, due to the stream of different DPI equipment
When the flow analysis result that amount analysis ability is had nothing in common with each other and obtained is inconsistent, it is impossible to accurately know different
The difference of the flow analysis ability of DPI equipment, and then correct flow analysis result can not be known, influence
The ability to work of whole system when DPI cooperates.
The content of the invention
The embodiment of the present application provides a kind of flow analysis coordination approach and equipment, to solve multiple DPI equipment
During collaborative work, it is impossible to the problem of accurately knowing the difference of flow analysis ability of different DPI equipment.
The concrete technical scheme that the embodiment of the present application is provided is as follows：
First aspect there is provided a kind of determination method of the difference of flow analysis ability, including：If for analyzing
The coordination equipment of the flow analysis ability of dry DPI equipment notifies flow analysis information to some DPI equipment
Report content；It is described coordinate equipment notify the flow analysis information report content after, receive institute
State the flow analysis information that content is reported comprising described in that some DPI equipment are reported；The coordination equipment interconnection
The flow analysis information that some DIP equipment received are reported is analyzed, and obtains some DPI
The difference of the flow analysis ability of the DPI equipment of each in equipment；The equipment of coordinating is by the described some of acquisition
The difference of the flow analysis ability of each DPI equipment is exported in DPI equipment.Pass through the embodiment of the present application
The scheme of offer, when multiple DPI equipment collaborations work, coordination equipment collects these DPI equipment and passes through inspection
The flow analysis information that measurement of discharge is obtained, coordinating equipment can be obtained by analyzing the flow analysis information collected
The difference of the flow analysis ability of these DPI equipment, and in the flow analysis capacity variance of different DPI equipment
Alerted in the case of larger or analysis result is shown, application system can be made targeted in time
Progress handle.And application system can also select correct flow analysis information by analysis result, this
The ability to work of whole system when sample can improve the work of DPI equipment collaborations.
With reference in a first aspect, in the first possible implementation of first aspect, the flow analysis is believed
What is ceased reports content at least to include：Between at the beginning of to flow detection, the end time；The application association identified
Discuss unique ID, application protocol description；The uplink traffic size of statistics, downlink traffic size, number of users.
With reference to the first possible realization of first aspect, in second of possible implementation of first aspect
In, the flow information reports the content can be expanded.
With reference to first aspect and first aspect the first any of to second possible implementation,
In the third possible implementation of first aspect, in addition to：The coordination equipment receives described respectively
The Time Calculation granularity itself supported that some DPI equipment are reported；And according to each DPI received
The Time Calculation granularity that equipment itself is supported, the statistics time interval being pre-configured with reference to the coordination equipment,
Determine the report cycle of the flow analysis information；The coordination equipment notifies institute to some DPI equipment
State the report cycle of flow analysis information.
With reference to the first or second of possible implementation of first aspect, the 4th kind in first aspect can
In the implementation of energy, the flow analysis that some DPI equipment that the coordination equipment interconnection is received are reported
Information is analyzed, and obtains the difference of the flow analysis ability of some DPI equipment, including：The association
Equipment is adjusted to carry out statistical content of each DPI equipment in some DPI equipment within the same period
The judgement of proximity and the contrast of waveform variation tendency, the uplink traffic that the statistical content includes statistics are big
Small, downlink traffic size and number of users, judge the first DPI equipment in some DPI equipment and
Gap between uplink traffic size, downlink traffic size or number of users that 2nd DPI equipment is counted respectively
More than given threshold；What described each DPI equipment for coordinating equipment in some DPI equipment was reported
Application protocol ID and the application protocol description that may recognize that within the same period, judge some DPI
Corresponding relation between the protocol library of each DPI equipment in equipment, and judge some DPI
The application protocol description that the DPI equipment of the first DPI equipment None- identified the 2nd in equipment can be recognized.
With reference to first aspect and first aspect the first any of to the 4th kind of possible implementation,
In the 5th kind of possible implementation of first aspect, the equipment of coordinating is by some DPI of acquisition
The difference of the flow analysis ability of equipment is exported, including：The equipment of coordinating is by the described some of acquisition
The difference of the flow analysis ability of DPI equipment is exported in local output or to other equipment.
Second aspect there is provided a kind of determination method of flow analysis ability, including：DPI equipment, which is received, to be coordinated
The flow analysis information that equipment is notified reports content, and the coordination equipment is used for analysis bag and contains the DPI
The flow analysis ability of some DPI equipment of equipment；The DPI equipment will include the stream for reporting content
Amount analysis information reporting gives the coordination equipment.So by DPI equipment by the flow recognition capability of itself to
Coordinate equipment to report so that multiple DPI equipment unified coordination and administration can be known multiple by coordinating equipment
The difference of the flow analysis ability of DPI equipment.
With reference to second aspect, in the first possible implementation of second aspect, the flow analysis letter
What is ceased reports content to include：Between at the beginning of to flow detection, the end time；The application protocol identified is only
One mark ID, application protocol description；The uplink traffic size of statistics, downlink traffic size, number of users.
With reference to the first possible implementation of second aspect or second aspect, at second of second aspect
In possible implementation, in addition to：The DPI equipment to it is described coordination equipment report itself support when
Between calculate granularity；The DPI equipment receive it is described coordinate the flow analysis information that equipment is notified report week
Phase；The DPI equipment periodically reports flow analysis according to the report cycle to the coordination equipment
Information.
The third aspect coordinates equipment there is provided one kind, and the coordination equipment, which has, realizes above-mentioned first aspect and first
The first of aspect coordinates equipment behavior into the design of any of the 5th kind of possible implementation method
Function.The function can be realized by hardware, and corresponding software can also be performed by hardware and is realized.
The hardware or software include one or more modules corresponding with above-mentioned functions.
Fourth aspect is there is provided a kind of DPI equipment, and the DPI equipment, which has, realizes above-mentioned second aspect and second
The first of aspect coordinates equipment behavior into the design of any of second possible implementation method
Function.The function can be realized by hardware, and corresponding software can also be performed by hardware and is realized.
The hardware or software include one or more modules corresponding with above-mentioned functions.
5th aspect coordinates equipment there is provided one kind, the structure of the coordination equipment include transceiver, processor and
Bus, the processor is used to call batch processing so that the coordination equipment is performed such as first aspect and the
Method described in any one of the first of one side into the 5th kind of possible implementation.
6th aspect there is provided a kind of DPI equipment, the structure of the DPI equipment include transceiver, processor and
Bus, the processor is used to call batch processing so that the DPI performs such as second aspect and second party
The first of face is to the method described in any of second possible implementation.
7th aspect is there is provided a kind of computer-readable storage medium, for saving as the coordination described in above-mentioned aspect
Computer software instructions used in equipment, it, which is included, is used to perform the program designed by above-mentioned aspect.
Eighth aspect is there is provided a kind of computer-readable storage medium, for saving as the DPI described in above-mentioned aspect
Computer software instructions used in equipment, it, which is included, is used to perform the program designed by above-mentioned aspect.
The scheme that the embodiment of the present application is provided is by coordinating the flows of the multiple DPI equipment of equipment coordination united analysis
Analysis ability, can accurately know the difference of the flow analysis ability of each DPI equipment, know correct
Flow analysis result, improves the ability to work of whole system when DPI cooperates.
Brief description of the drawings
Fig. 1 is application system Organization Chart in the embodiment of the present application；
Fig. 2 is the determination method flow diagram of the difference of flow analysis ability in the embodiment of the present application；
Fig. 3 shows for a kind of determination method of the difference of application scenarios down-off analysis ability in the embodiment of the present application
It is intended to；
Fig. 4 is one of structure chart of coordination equipment in the embodiment of the present application；
Fig. 5 is one of structure chart of DPI equipment in the embodiment of the present application；
Fig. 6 is the two of the structure chart of coordination equipment in the embodiment of the present application；
Fig. 7 is the two of the structure chart of DPI equipment in the embodiment of the present application.
Embodiment
In order that the purpose, technical scheme and advantage of the application are clearer, below in conjunction with accompanying drawing to this Shen
It please be described in further detail, it is clear that described embodiment is only some embodiments of the present application,
Rather than whole embodiments.Based on the embodiment in the application, those of ordinary skill in the art are not doing
Go out all other embodiment obtained under the premise of creative work, belong to the scope of the application protection.
The DPI equipment being related in the embodiment of the present application refers to the network element for including the module with DPI abilities, base
Tend to different DPI abilities in different application scenarios DPI equipment, for example, flow monitoring, strategy control
System, network analysis, marketing support etc., describe, DPI abilities are referred to as convenience in the embodiment of the present application
Flow analysis ability, it includes the various analysis ability that DPI equipment possesses.
The embodiment of the present application is applied to dispose the network scenarios of several DPI equipment collaborations work.
For example, operator may introduce multiple different manufacturers at the initial stage made the transition to lean operation
DPI equipment, the flow analysis ability of the DPI equipment of this multiple different manufacturers is not quite similar；In another example, fortune
The existing some DPI equipment of business's existing network are sought, each DPI equipment is based respectively on different applied field as described above
Scape is built, and the flow analysis ability of this some DPI equipment is also not quite similar.
And, it is necessary to by the flow analysis energy of each DPI equipment in the application scenes developed based on operator
Power is analyzed, and realizes data fusion, in order to ensure fusion after the quality of data, and quickly find it is different
The normal quality of data is simultaneously alerted, timely to be handled, and one kind is provided in the embodiment of the present application some
Under the scene of individual DPI equipment collaborations work, the determination method of the difference of flow analysis ability, and for analyzing
The coordination equipment of the flow analysis ability of some deep message detection DPI equipment, is obtained not using equipment is coordinated
The flow analysis information reported with DPI equipment, so as to know the difference of the flow analysis ability of each DPI equipment
It is different.
As shown in figure 1, being the application system Organization Chart in the embodiment of the present application.Operator deployment several
DPI equipment, is represented with DPI-A, DPI-B, DPI-C, DPI-D, DPI-E respectively, and these DPI are set
The standby flow to stub network is identified, support upwards different application (such as using 1, using 2,
Using 3, using 4).
Implementation preferred in the embodiment of the present application is elaborated below in conjunction with accompanying drawing.
As shown in fig.2, the determination method of the difference for the flow analysis ability that the embodiment of the present application is provided is as follows
It is described.
Step 201：Coordinate equipment and report content to some DPI equipment notice flow analysis information.
The flow analysis information refers to DPI equipment by recognizing network traffics, and the network traffics to identification are entered
The information of row analytic statistics；
The flow analysis information reports content at least to include：Between at the beginning of to flow detection, at the end of
Between；The application protocol unique ID that identifies, application protocol description；The uplink traffic size of statistics, under
Row uninterrupted, number of users.
Because the flow analysis ability of each DPI equipment is different, therefore DPI equipment can be to coordinating in equipment
The content of the flow analysis information of report is also different, here in order to the flow analysis energy to different DPI equipment
Power has the analysis of a transverse direction, to each DPI equipment notify flow analysis information report content be each
DPI equipment as the basic analysis ability that possesses obtained by.
Certainly, in the embodiment of the present application, coordinate equipment can be by understanding in each DPI can report in advance
Hold, report content to be expanded on the basic content of above-mentioned setting flow analysis information.
Preferably, in the embodiment of the present application, coordinating equipment and also being analyzed to some DPI equipment transmitted traffics
The report cycle of information.Report cycle is determined as follows.
Because the Time Calculation granularity that different DPI equipment itself is supported is different, therefore coordination equipment first has to
Know the Time Calculation granularity that each DPI equipment itself is supported.Then：
1) DPI equipment reports the Time Calculation granularity itself supported very much to coordination equipment.
One of supported Time Calculation granularity of DPI equipment such as 1 minute, 5 minutes, 10 minutes,
One or more in 15 minutes, 1 hour, 1 day etc..
2) coordinate equipment and receive the Time Calculation granularity itself supported that some DPI equipment are reported respectively,
The Time Calculation granularity supported according to each DPI equipment received itself, it is advance with reference to the coordination equipment
The statistics time interval of configuration, determines the report cycle of the flow analysis information.
3) it is described to coordinate the report cycle that equipment notifies the flow analysis information to some DPI equipment.
It should be noted that the report cycle that coordination equipment is sent to each DPI equipment is probably identical,
It is also likely to be different.
Above-mentioned the 2) be partly a report cycle negotiations process, coordinating equipment itself may also match somebody with somebody in advance
Put the statistics time interval of preferential support, such as, and the statistics time interval of preferential support 1 hour.Coordinate
Between the Time Calculation granularity that equipment is supported according to each DPI equipment, the timing statisticses preferentially supported with reference to itself
Every negotiating a suitable report cycle.Such as, the Time Calculation granularity of the DPI-A supports in Fig. 1 is
1 minute, 1 hour；The Time Calculation granularity that DPI-B is supported is 5 minutes, 1 hour；What DPI-C was supported
Time Calculation granularity is 10 minutes, 1 hour；DPI-D support Time Calculation granularity for 15 minutes, 1
Hour；The Time Calculation granularity that DPI-E is supported is 1 minute, 15 minutes.Then coordinate equipment find DPI-A,
DPI-B, DPI-C and DPI-D can support the Time Calculation granularity of 1 hour, and coordinate equipment itself
Do not include 1 in the statistics time interval of preferential support 1 hour, the Time Calculation granularity that only DPI-E is supported
Hour, then it is 1 small that consulting device, which sends report cycle to DPI-A, DPI-B, DPI-C and DPI-D,
When, it is 15 minutes to the DPI-E report cycles sent.And it is follow-up according to the DPI-E flow reported point
Between at the beginning of analysing in information and the end time, and the flow analysis information that other four DPI equipment are reported
In at the beginning of between and the end time, selection DPI-E and other four DPI equipment are in section at the same time
The flow analysis information that (when a length of 1 hour) reports is compared, wherein, in above-mentioned section at the same time
The flow analysis information that interior DPI-E is reported is the common content for the flow analysis information for continuously reporting four times.
Step 202：Reporting after content for the flow analysis information that DPI equipment reception coordination equipment is notified, will
Comprising the flow analysis information reporting for reporting content to the coordination equipment.
Step 203：Coordinate equipment and receive the flow point that content is reported comprising described in that some DPI equipment are reported
Information is analysed, and the flow analysis information reported to some DIP equipment received is analyzed, and is obtained
The difference of the flow analysis ability of each DPI equipment in some DPI equipment.
It should be noted that reporting content expansible due to described in the embodiment of the present application, coordinate equipment to bag
Analysis mode containing the flow analysis information for reporting content will be different, and the application is to each DPI equipment
The analysis mode of the flow analysis information reported is not especially limited, and can arbitrarily obtain the stream of each DPI equipment
The analysis mode for measuring the difference of analysis ability can be with.
Some are only carried out in the embodiment of the present application to analysis mode for example, and analysis side by way of example
Formula, can obtain some differences of the flow analysis ability of some DPI equipment.Such as：
The equipment of coordinating is by each system of DPI equipment within the same period in some DPI equipment
Count content and carry out the judgement of proximity and the contrast of waveform variation tendency, the statistical content includes statistics
Uplink traffic size, downlink traffic size and number of users, judge first in some DPI equipment
Uplink traffic size, downlink traffic size or number of users that DPI equipment and the 2nd DPI equipment are counted respectively
Between gap be more than given threshold；
It is described coordinate that each DPI equipment in some DPI equipment of equipment reports in the same time
Application protocol ID and the application protocol description that may recognize that in section, judge in some DPI equipment
Corresponding relation between the protocol library of each DPI equipment, and judge in some DPI equipment
The application protocol description that the DPI equipment of one DPI equipment None- identified the 2nd can be recognized.
Preferably, in the embodiment of the present application, coordinate equipment in some DPI equipment are obtained every time each
After the difference of the flow analysis ability of DPI equipment, the result of acquisition is being locally stored, one can be so accumulated
The analysis result of section time.When the stream that each DPI equipment is reported in recently received some DPI equipment
After amount analysis information, during analysis, the flow analysis information that this can also be reported and storage
The analysis result of accumulation a period of time is compared, and can obtain the flow analysis ability of each DPI equipment
There is any change, such as, the number of users fluctuation of the DPI-C statistics in Fig. 1 is larger, can be by such case
It is recorded as the abnormal conditions that can be alerted.So, not only can be with the flow analysis of each DPI equipment of lateral comparison
The difference of ability, can also compare flow analysis ability of the same DPI equipment of longitudinal comparison in different times
Difference.
Step 204：Coordinate equipment by the flow of each DPI equipment in some DPI equipment of acquisition point
The difference of analysis ability is exported.
Specifically, the equipment of coordinating is by the difference of the flow analysis ability of some DPI equipment of acquisition
Exported in local output or to other equipment.The way of output can be form form, or alarm shape
Formula.Secondary analysis are carried out on the basis of the result that system maintenance personnel can also export again, are further obtained more
More precisely more rich result in detail.
Based on the method introduced in above-mentioned Fig. 2, below by taking a kind of specific application scenarios as an example, to the application
The method that embodiment is provided is described in further detail.
As shown in figure 3, certain operator deploys service-aware quality (English simultaneously：Service Experience
Quality, abbreviation：SEQ) network element and Service Control Gateway (English：Service Control Gateway,
Abbreviation：SCG) network element, wherein, SEQ network elements and SCG network elements are the system example with DPI functions,
Same application business intelligence (English is supported upwards：Business Intelligence, abbreviation：BI) system
System.Infrastructure network includes wireless network (English：Radio Network), two core network elements
Example：GRS business supports node (English：Serving GPRS Support Node, abbreviation：SGSN)
With Gateway GPRS Support Node (English：Gateway GPRS Support Node, abbreviation：GGSN)、
Internet (English：Internet Network).SEQ network elements gather gn interface data, for network analysis；
SCG network elements gather Gi interface data, for policy control.SEQ network elements and SCG network elements are each to collection
Data be identified and count flow analysis information, and can be by the flow analysis information of statistics to user's
BI systems are reported.Meanwhile, in another dimension, SEQ network elements and SCG network elements receive the system for coordinating equipment
One management, reports content and report cycle, periodically according to the flow analysis information for coordinating equipment transmission
Counted flow analysis information is reported to equipment is coordinated.Coordinating equipment side, coordinating what equipment interconnection was received
The flow analysis information that SEQ network elements and SCG network elements are periodically sent is analyzed, and obtains SEQ network elements
With the difference of the flow analysis ability of SCG network elements, and locally exported in the method for form, or to
The BI systems output at family, and, occur in the flow analysis ability for finding SEQ network elements or SCG network elements
In the case of gross error, alarm is sent to the BI systems of user, or alerted locally.
Based on same inventive concept, as shown in fig.4, the embodiment of the present application provides a kind of coordination equipment
400, it is described to coordinate the flow analysis ability for analyzing some DPI equipment of equipment 400, coordinate equipment 400
Including：Notification unit 401, receiving unit 402, analytic unit 403 and output unit 404.Wherein：
Notification unit 401, for reporting content to some DPI equipment notice flow analysis information；
Receiving unit 402, for notifying that reporting for the flow analysis information is interior in the notification unit 401
After appearance, the flow analysis information that content is reported comprising described in that some DPI equipment are reported is received；
Analytic unit 403, some DIP equipment for being received to the receiving unit 402 are reported
Flow analysis information analyzed, obtain the flow analysis of each DPI equipment in some DPI equipment
The difference of ability；
Output unit 404, for each in some DPI equipment for obtaining the analytic unit 403
The difference of the flow analysis ability of DPI equipment is exported.
Optionally, the flow analysis information reports content at least to include：Between at the beginning of to flow detection,
End time；The application protocol unique ID that identifies, application protocol description；The uplink traffic of statistics is big
Small, downlink traffic size, number of users.
Optionally, the receiving unit 402 is additionally operable to, receive that some DPI equipment report respectively from
The Time Calculation granularity that body is supported；
The coordination equipment 400 also includes：
Determining unit 405, for each DPI equipment itself branch received according to the receiving unit 402
The Time Calculation granularity held, the statistics time interval being pre-configured with reference to the coordination equipment, determines the stream
The report cycle of amount analysis information；
The notification unit 401 is additionally operable to, and notifies that the determining unit 405 is true to some DPI equipment
The report cycle of the fixed flow analysis information.
Optionally, the analytic unit 403 is used for：
Statistical content of each DPI equipment in some DPI equipment within the same period is subjected to phase
The judgement and the contrast of waveform variation tendency of nearly property, the uplink traffic that the statistical content includes statistics are big
Small, downlink traffic size and number of users, judge the first DPI equipment in some DPI equipment and
Gap between uplink traffic size, downlink traffic size or number of users that 2nd DPI equipment is counted respectively
More than given threshold；And
What each DPI equipment in some DPI equipment was reported may recognize that within the same period
Application protocol ID and application protocol description, judge each DPI equipment in some DPI equipment
Protocol library between corresponding relation, and judge the first DPI equipment in some DPI equipment without
Method recognizes the application protocol description that the 2nd DPI equipment can be recognized.
Optionally, the output unit 404 is used for：
By the difference of the flow analysis ability of some DPI equipment of acquisition local output or to other
Equipment is exported.
Based on same inventive concept, as shown in fig.5, the embodiment of the present application additionally provides a kind of DPI equipment
500, including：Receiving unit 501 and transmitting element 502, wherein：
Receiving unit 501, coordinates the content that reports for the flow analysis information that equipment is notified for receiving, described
Coordinating equipment is used for the flow analysis ability of some DPI equipment of the analysis bag containing the DPI equipment 500；
Transmitting element 502, for will coordinate comprising the flow analysis information reporting for reporting content to described
Equipment.
Optionally, the flow analysis information reports content to include：Between at the beginning of to flow detection, tie
The beam time；The application protocol unique ID that identifies, application protocol description；The uplink traffic size of statistics,
Downlink traffic size, number of users.
Optionally, the transmitting element 502 is additionally operable to, and the time itself supported is reported to the coordination equipment
Calculate granularity；
The receiving unit 501 is additionally operable to, and itself is reported to the coordination equipment in the transmitting element 502
After the Time Calculation granularity of support, receive the flow analysis information for coordinating equipment notice reports week
Phase；
The transmitting element 502 is additionally operable to, the report cycle received according to the receiving unit 501,
Periodically flow analysis information is reported to the coordination equipment.
Based on same inventive concept, set as shown in fig.6, the embodiment of the present application additionally provides another coordination
Standby 600, the equipment 600 of coordinating is used to analyze the flow analysis energy that some deep messages detect DPI equipment
Power, the coordination equipment 600 includes transceiver 601, processor 602 and bus 603, transceiver 601
It is connected with processor 602 with bus 603, wherein, the processor 602 is used to call batch processing,
So that the coordination equipment 600 performs method as shown in Figure 2.
Preferably, the coordination equipment 600 also includes memory 604, the memory 604 is used to store
The program that the processor is called.
Processor 602 can be central processing unit (English：Central processing unit, abbreviation：CPU),
Network processing unit (English：Network processor, abbreviation：NP) or CPU and NP combination.
Processor 602 can further include hardware chip.Above-mentioned hardware chip can be special integrated electricity
Road (English：Application-specific integrated circuit, abbreviation：ASIC), programmable logic device
Part (English：Programmable logic device, abbreviation：PLD) or its combination.Above-mentioned PLD can be with
It is CPLD (English：Complex programmable logic device, abbreviation：
CPLD), field programmable gate array (English：Field-programmable gate array, abbreviation：
FPGA), GAL (English：Generic array logic, abbreviation：) or its any group GAL
Close.
Memory 604 can include volatile memory (English：Volatile memory), for example deposit at random
Access to memory (English：Random-access memory, abbreviation：RAM)；Memory 604 can also be wrapped
Include nonvolatile memory (English：Non-volatile memory), such as flash memory (English：flash
Memory), hard disk (English：Hard disk drive, abbreviation：HDD) or solid state hard disc (English：solid-state
Drive, abbreviation：SSD)；Memory 604 can also include the combination of the memory of mentioned kind.
Based on same inventive concept, as shown in fig.7, the embodiment of the present application additionally provides another DPI
Equipment 700, including transceiver 701, processor 702 and bus 703, transceiver 701 and processor 702
It is connected with bus 703, wherein, the processor 702 is used to call batch processing so that the DPI
Equipment 700 performs method as shown in Figure 2.
Preferably, the DPI equipment 700 also includes memory 704, the memory 704 is used to store
The program that the processor 702 is called.
Processor 702 can be central processing unit (English：Central processing unit, abbreviation：CPU),
Network processing unit (English：Network processor, abbreviation：NP) or CPU and NP combination.
Processor 702 can further include hardware chip.Above-mentioned hardware chip can be special integrated electricity
Road (English：Application-specific integrated circuit, abbreviation：ASIC), programmable logic device
Part (English：Programmable logic device, abbreviation：PLD) or its combination.Above-mentioned PLD can be with
It is CPLD (English：Complex programmable logic device, abbreviation：
CPLD), field programmable gate array (English：Field-programmable gate array, abbreviation：
FPGA), GAL (English：Generic array logic, abbreviation：) or its any group GAL
Close.
Memory 704 can include volatile memory (English：Volatile memory), for example deposit at random
Access to memory (English：Random-access memory, abbreviation：RAM)；Memory 704 can also be wrapped
Include nonvolatile memory (English：Non-volatile memory), such as flash memory (English：flash
Memory), hard disk (English：Hard disk drive, abbreviation：HDD) or solid state hard disc (English：solid-state
Drive, abbreviation：SSD)；Memory 704 can also include the combination of the memory of mentioned kind.
It should be understood by those skilled in the art that, embodiments herein can be provided as method, system or meter
Calculation machine program product.Therefore, the application can be using complete hardware embodiment, complete software embodiment or knot
The form of embodiment in terms of conjunction software and hardware.Wherein wrapped one or more moreover, the application can be used
Containing computer usable program code computer-usable storage medium (include but is not limited to magnetic disk storage,
CD-ROM, optical memory etc.) on the form of computer program product implemented.
The application is produced with reference to according to the method, equipment (system) and computer program of the embodiment of the present application
The flow chart and/or block diagram of product is described.It should be understood that can by computer program instructions implementation process figure and
/ or each flow and/or square frame in block diagram and the flow in flow chart and/or block diagram and/
Or the combination of square frame.These computer program instructions can be provided to all-purpose computer, special-purpose computer, insertion
Formula processor or the processor of other programmable data processing devices are to produce a machine so that pass through and calculate
The instruction of the computing device of machine or other programmable data processing devices is produced for realizing in flow chart one
The device for the function of being specified in individual flow or multiple flows and/or one square frame of block diagram or multiple square frames.
These computer program instructions, which may be alternatively stored in, can guide computer or the processing of other programmable datas to set
In the standby computer-readable memory worked in a specific way so that be stored in the computer-readable memory
Instruction produce include the manufacture of command device, the command device realization in one flow or multiple of flow chart
The function of being specified in one square frame of flow and/or block diagram or multiple square frames.
These computer program instructions can be also loaded into computer or other programmable data processing devices, made
Obtain and perform series of operation steps on computer or other programmable devices to produce computer implemented place
Reason, so that the instruction performed on computer or other programmable devices is provided for realizing in flow chart one
The step of function of being specified in flow or multiple flows and/or one square frame of block diagram or multiple square frames.
Although having been described for the preferred embodiment of the application, those skilled in the art once know base
This creative concept, then can make other change and modification to these embodiments.So, appended right will
Ask and be intended to be construed to include preferred embodiment and fall into having altered and changing for the application scope.
Obviously, those skilled in the art can carry out various changes and modification without de- to the embodiment of the present application
From the spirit and scope of the embodiment of the present application.So, if these modifications and variations category of the embodiment of the present application
Within the scope of the application claim and its equivalent technologies, then the application be also intended to comprising these change and
Including modification.
Claims (20)
1. a kind of determination method of the difference of flow analysis ability, it is characterised in that including：
For analyze some deep messages detection DPI equipment flow analysis ability coordination equipment to described
What some DPI equipment notified flow analysis information reports content；
It is described coordinate equipment notify the flow analysis information report content after, receive described some
The flow analysis information that content is reported comprising described in that DPI equipment is reported；
The flow analysis information that some DIP equipment that the coordination equipment interconnection is received are reported is divided
Analysis, obtains the difference of the flow analysis ability of each DPI equipment in some DPI equipment；
The equipment of coordinating is by the flow analysis ability of each DPI equipment in some DPI equipment of acquisition
Difference exported.
2. the method as described in claim 1, it is characterised in that reporting for the flow analysis information is interior
Appearance at least includes：Between at the beginning of to flow detection, the end time；The application protocol unique mark identified
ID, application protocol description；The uplink traffic size of statistics, downlink traffic size, number of users.
3. method as claimed in claim 1 or 2, it is characterised in that also include：
The equipment of coordinating receives the Time Calculation itself the supported grain that some DPI equipment are reported respectively
Degree；And
The Time Calculation granularity supported according to each DPI equipment received itself, with reference to the coordination equipment
The statistics time interval being pre-configured with, determines the report cycle of the flow analysis information；
It is described to coordinate the report cycle that equipment notifies the flow analysis information to some DPI equipment.
4. method as claimed in claim 2, it is characterised in that the institute that the coordination equipment interconnection is received
State the flow analysis information that some DPI equipment report to be analyzed, obtain the flow of some DPI equipment
The difference of analysis ability, including：
The equipment of coordinating is by each system of DPI equipment within the same period in some DPI equipment
Count content and carry out the judgement of proximity and the contrast of waveform variation tendency, the statistical content includes statistics
Uplink traffic size, downlink traffic size and number of users, judge first in some DPI equipment
Uplink traffic size, downlink traffic size or number of users that DPI equipment and the 2nd DPI equipment are counted respectively
Between gap be more than given threshold；
It is described coordinate that each DPI equipment in some DPI equipment of equipment reports in the same time
Application protocol ID and the application protocol description that may recognize that in section, judge in some DPI equipment
Corresponding relation between the protocol library of each DPI equipment, and judge in some DPI equipment
The application protocol description that the DPI equipment of one DPI equipment None- identified the 2nd can be recognized.
5. the method as described in claim any one of 1-4, it is characterised in that the coordination equipment will be obtained
The difference of the flow analysis ability of some DPI equipment obtained is exported, including：
The coordination equipment is by the difference of the flow analysis ability of some DPI equipment of acquisition local
Output is exported to other equipment.
6. a kind of determination method of flow analysis ability, it is characterised in that including：
Deep message detection DPI equipment receive coordinate the flow analysis information that equipment is notified report content, institute
State the flow analysis ability for coordinating equipment for some DPI equipment of the analysis bag containing the DPI equipment；
The DPI equipment will give the coordination equipment comprising the flow analysis information reporting for reporting content.
7. method as claimed in claim 6, it is characterised in that reporting for the flow analysis information is interior
Appearance includes：Between at the beginning of to flow detection, the end time；The application protocol unique ID that identifies,
Application protocol is described；The uplink traffic size of statistics, downlink traffic size, number of users.
8. method as claimed in claims 6 or 7, it is characterised in that also include：
The DPI equipment reports the Time Calculation granularity itself supported to the coordination equipment；
The DPI equipment receives the report cycle for coordinating the flow analysis information that equipment is notified；
The DPI equipment periodically reports flow analysis according to the report cycle to the coordination equipment
Information.
9. one kind coordinates equipment, it is characterised in that the coordination equipment is used to analyze some deep message inspections
The flow analysis ability of DPI equipment is surveyed, including：
Notification unit, for reporting content to some DPI equipment notice flow analysis information；
Receiving unit, for the notification unit notify the flow analysis information report content after,
Receive the flow analysis information that content is reported comprising described in that some DPI equipment are reported；
Analytic unit, the flow that some DIP equipment for being received to the receiving unit are reported point
Analysis information is analyzed, and obtains the difference of the flow analysis ability of each DPI equipment in some DPI equipment
It is different；
Output unit, for each DPI equipment in some DPI equipment for obtaining the analytic unit
The difference of flow analysis ability exported.
10. as claimed in claim 9 coordinate equipment, it is characterised in that the flow analysis information it is upper
Report content at least includes：Between at the beginning of to flow detection, the end time；The application protocol identified is unique
Identify ID, application protocol description；The uplink traffic size of statistics, downlink traffic size, number of users.
11. the coordination equipment as described in claim 9 or 10, it is characterised in that the receiving unit is also
For receiving the Time Calculation granularity itself supported that some DPI equipment are reported respectively；
The coordination equipment also includes：
Determining unit, the time that each DPI equipment itself for being received according to the receiving unit is supported
Granularity is calculated, the statistics time interval being pre-configured with reference to the coordination equipment determines the flow analysis letter
The report cycle of breath；
The notification unit is additionally operable to, and is notified to some DPI equipment described in the determining unit determination
The report cycle of flow analysis information.
12. coordinate equipment as claimed in claim 10, it is characterised in that the analytic unit is used for：
Statistical content of each DPI equipment in some DPI equipment within the same period is subjected to phase
The judgement and the contrast of waveform variation tendency of nearly property, the uplink traffic that the statistical content includes statistics are big
Small, downlink traffic size and number of users, judge the first DPI equipment in some DPI equipment and
Gap between uplink traffic size, downlink traffic size or number of users that 2nd DPI equipment is counted respectively
More than given threshold；And
What each DPI equipment in some DPI equipment was reported may recognize that within the same period
Application protocol ID and application protocol description, judge each DPI equipment in some DPI equipment
Protocol library between corresponding relation, and judge the first DPI equipment in some DPI equipment without
Method recognizes the application protocol description that the 2nd DPI equipment can be recognized.
13. the coordination equipment as described in claim any one of 9-12, it is characterised in that the output list
Member is used for：
By the difference of the flow analysis ability of some DPI equipment of acquisition local output or to other
Equipment is exported.
14. a kind of deep message detects DPI equipment, it is characterised in that including：
Receiving unit, coordinates the flow analysis information that equipment notifies and reports content, the coordination for receiving
Equipment is used for the flow analysis ability of some DPI equipment of the analysis bag containing the DPI equipment；
Transmitting element, for will be set comprising the flow analysis information reporting for reporting content to the coordination
It is standby.
15. DPI equipment as claimed in claim 14, it is characterised in that the flow analysis information
Content is reported to include：Between at the beginning of to flow detection, the end time；The application protocol identified is uniquely marked
Know ID, application protocol description；The uplink traffic size of statistics, downlink traffic size, number of users.
16. the DPI equipment as described in claims 14 or 15, it is characterised in that the transmitting element is also
For reporting the Time Calculation granularity itself supported to the coordination equipment；
The receiving unit is additionally operable to, the transmitting element to it is described coordination equipment report itself support when
Between calculate granularity after, receive it is described coordinate equipment notify flow analysis information report cycle；
The transmitting element is additionally operable to, the report cycle received according to the receiving unit, periodically
Flow analysis information is reported to the coordination equipment.
17. one kind coordinates equipment, it is characterised in that the coordination equipment is used to analyze some deep message inspections
The flow analysis ability of DPI equipment, including transceiver, processor and bus are surveyed, transceiver and processor are equal
It is connected with bus, wherein, the processor is used to call batch processing so that the coordination equipment is performed such as
Method described in claim any one of 1-5.
18. coordinate equipment as claimed in claim 18, it is characterised in that the coordination equipment also includes
Memory, the memory is used to store the program that the processor is called.
19. a kind of deep message detects DPI equipment, it is characterised in that including transceiver, processor and total
Line, transceiver and processor are connected with bus, wherein, the processor is used to call batch processing, makes
Obtain method of the DPI equipment execution as described in claim any one of 6-8.
20. DPI equipment as claimed in claim 19, it is characterised in that the DPI equipment also includes
Memory, the memory is used to store the program that the processor is called.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610143797.XA CN107196815B (en) | 2016-03-14 | 2016-03-14 | Method and equipment for determining difference of flow analysis capacity |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610143797.XA CN107196815B (en) | 2016-03-14 | 2016-03-14 | Method and equipment for determining difference of flow analysis capacity |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107196815A true CN107196815A (en) | 2017-09-22 |
| CN107196815B CN107196815B (en) | 2020-06-16 |
Family
ID=59870618
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610143797.XA Active CN107196815B (en) | 2016-03-14 | 2016-03-14 | Method and equipment for determining difference of flow analysis capacity |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107196815B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111783804A (en) * | 2019-04-04 | 2020-10-16 | 中国移动通信集团上海有限公司 | Abnormal call bill determining method, device, equipment and storage medium |
| CN112039731A (en) * | 2020-11-05 | 2020-12-04 | 武汉绿色网络信息服务有限责任公司 | DPI (deep packet inspection) identification method and device, computer equipment and storage medium |
| CN113572700A (en) * | 2020-04-29 | 2021-10-29 | 厦门网宿有限公司 | Flow detection method, system, device and computer readable storage medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2008046326A1 (en) * | 2006-10-18 | 2008-04-24 | Huawei Technologies Co., Ltd. | A method and system for network service controlling |
| US20080219169A1 (en) * | 2007-03-06 | 2008-09-11 | Chandramouli Sargor | Flexible, Cost-Effective Solution For Peer-To-Peer, Gaming, And Application Traffic Detection & Treatment |
| CN101286937A (en) * | 2008-05-16 | 2008-10-15 | 华为技术有限公司 | Network flow control method, device and system |
| CN101715182A (en) * | 2009-11-30 | 2010-05-26 | 中国移动通信集团浙江有限公司 | Method, system and device for controlling traffic |
| CN101882999A (en) * | 2009-05-08 | 2010-11-10 | 中兴通讯股份有限公司 | Management method and system of business identification network based on deep packet inspection equipment |
| CN103248528A (en) * | 2012-02-10 | 2013-08-14 | 上海戴德网络科技有限公司 | Network flow detecting method based on ant colony optimization and layered DPI (deep packet inspection) |
| CN103684803A (en) * | 2013-12-11 | 2014-03-26 | 中国联合网络通信集团有限公司 | Flow collecting device and system and method for directional flow accounting |
-
2016
- 2016-03-14 CN CN201610143797.XA patent/CN107196815B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2008046326A1 (en) * | 2006-10-18 | 2008-04-24 | Huawei Technologies Co., Ltd. | A method and system for network service controlling |
| US20080219169A1 (en) * | 2007-03-06 | 2008-09-11 | Chandramouli Sargor | Flexible, Cost-Effective Solution For Peer-To-Peer, Gaming, And Application Traffic Detection & Treatment |
| CN101286937A (en) * | 2008-05-16 | 2008-10-15 | 华为技术有限公司 | Network flow control method, device and system |
| CN101882999A (en) * | 2009-05-08 | 2010-11-10 | 中兴通讯股份有限公司 | Management method and system of business identification network based on deep packet inspection equipment |
| CN101715182A (en) * | 2009-11-30 | 2010-05-26 | 中国移动通信集团浙江有限公司 | Method, system and device for controlling traffic |
| CN103248528A (en) * | 2012-02-10 | 2013-08-14 | 上海戴德网络科技有限公司 | Network flow detecting method based on ant colony optimization and layered DPI (deep packet inspection) |
| CN103684803A (en) * | 2013-12-11 | 2014-03-26 | 中国联合网络通信集团有限公司 | Flow collecting device and system and method for directional flow accounting |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111783804A (en) * | 2019-04-04 | 2020-10-16 | 中国移动通信集团上海有限公司 | Abnormal call bill determining method, device, equipment and storage medium |
| CN111783804B (en) * | 2019-04-04 | 2023-11-24 | 中国移动通信集团上海有限公司 | Abnormal ticket determining method, device, equipment and storage medium |
| CN113572700A (en) * | 2020-04-29 | 2021-10-29 | 厦门网宿有限公司 | Flow detection method, system, device and computer readable storage medium |
| CN112039731A (en) * | 2020-11-05 | 2020-12-04 | 武汉绿色网络信息服务有限责任公司 | DPI (deep packet inspection) identification method and device, computer equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107196815B (en) | 2020-06-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109005556B (en) | 4G network quality optimization method and system based on user call ticket | |
| WO2017219855A1 (en) | Root cause locating method and device | |
| CN109347688B (en) | Method and device for positioning fault in wireless local area network | |
| WO2016090961A1 (en) | Method and device for network associations analysis | |
| US10158522B2 (en) | Network monitor and method for event based prediction of radio network outages and their root cause | |
| CN107196815A (en) | A kind of determination method and apparatus of the difference of flow analysis ability | |
| CN107809766B (en) | Method and device for generating machine learning sample for network optimization | |
| CN111479287B (en) | Simulation test method, device, equipment and storage medium for core network of non-independent networking | |
| US20140089040A1 (en) | System and Method for Customer Experience Measurement & Management | |
| CN109542786A (en) | Visual testing method and device | |
| US9936409B2 (en) | Analyzing and classifying signaling sets or calls | |
| CN107231266A (en) | The detection method and device of message passage | |
| CN115038088B (en) | Intelligent network security detection early warning system and method | |
| CN107943697A (en) | Problem distribution method, device, system, server and computer-readable storage medium | |
| CN107491394A (en) | A kind of method for testing and analyzing and device based on digraph identification | |
| CN104038382B (en) | Network monitoring system | |
| CN109587721A (en) | A kind of subzone network coverage evaluating method and device | |
| WO2019149143A1 (en) | Link bandwidth utilization rate acquisition method and device, and terminal | |
| CN108650134A (en) | The method, apparatus and electronic equipment of network failure positioning | |
| CN109963292A (en) | Complain method, apparatus, electronic equipment and the storage medium of prediction | |
| CN115712529A (en) | Edge intelligent equipment testing method, device, equipment and storage medium | |
| CN107517474A (en) | A kind of network analysis optimization method and device | |
| CN104754328B (en) | Distributed video quality diagnosis method | |
| TWI698890B (en) | Cloud management system for capacitor manufacture and method thereof | |
| CN103746753A (en) | Data prediction method based on cognitive wireless network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |