CN109639655A - A kind of intelligent depth resolution system and analytic method - Google Patents
A kind of intelligent depth resolution system and analytic method Download PDFInfo
- Publication number
- CN109639655A CN109639655A CN201811453846.5A CN201811453846A CN109639655A CN 109639655 A CN109639655 A CN 109639655A CN 201811453846 A CN201811453846 A CN 201811453846A CN 109639655 A CN109639655 A CN 109639655A
- Authority
- CN
- China
- Prior art keywords
- neural network
- feature
- message
- module
- unit
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
- H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2483—Traffic characterised by specific attributes, e.g. priority or QoS involving identification of individual flows
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- General Health & Medical Sciences (AREA)
- General Physics & Mathematics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Biomedical Technology (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Biophysics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present invention discloses a kind of intelligent depth resolution system, which includes: packet parsing module, deep message parsing module, using feature database management module, neural network depth recognition module and application message output module；The packet parsing module parses the data received, and parsing the data pack load is plaintext or cipher text；When parsing the data pack load is plaintext, the deep message parsing module reads from application feature database management module and applies feature database, carries out deep analysis to the data pack load, obtains application layer message；When parsing the data pack load is ciphertext, the neural network depth recognition module is identified and is parsed to the data pack load using neural network algorithm, and the message information of the data parsed and feature are encapsulated and exported；The present invention transplants the form of feature database and neural network capacity factor from existing on-line intelligence deep analysis system, promotes the recognition capability of new log equipment.
Description
Technical field
The invention belongs to technical field of communication network, and in particular to a kind of intelligent depth resolution system and analytic method.
Background technique
Deep analysis equipment is a kind of to be directed to different network application layer load based on its feature database and make deep analysis simultaneously
The system for exporting its content and user's Flow Behavior plays very important effect in network safety filed.
With the rapid development of internet technology, network application is continuously increased and changes, deep analysis equipment feature database
It must constantly update and upgrade, continually changing application layer data and user's Flow Behavior could be coped with；In addition, as internet is pacified
Full development has more and more used encrypted transmission using data, and the extraction of characteristic information is increasingly difficult, so that existing depth
Analyzing device faces feature database maintenance cost height and as encryption applies ratio data increasingly to increase, traditional characteristic qurush grade mould
The problem of formula can not be coped with.
Summary of the invention
Goal of the invention: in order to solve problems in the prior art, the present invention provides a kind of intelligent depth resolution system.
Summary of the invention: the intelligent depth resolution system includes: packet parsing module, deep message parsing module, answers
With feature database management module, neural network depth recognition module and application message output module；The packet parsing module pair
The data received are parsed, and parsing the data pack load is plaintext or cipher text；
When parsing the data pack load is plaintext, the deep message parsing module is from using feature database management module
It reads and applies feature database, deep analysis is carried out to the data pack load, obtains application layer message；
When parsing the data pack load is ciphertext, the neural network depth recognition module utilizes neural network algorithm
The data pack load is identified and parsed, and the message information of the data parsed and feature are encapsulated and exported；
The application message output module is parsed according to deep message parsing module or neural network depth recognition module
Application message, complete information classification, encapsulation and output.
Further, the application feature database management module includes: feature lead-out unit, feature input unit and using feature
Library inquiry unit；The feature lead-out unit exports existing system feature database, is conveniently transplanted to other smart machines；The feature
Input unit, which receives the message characteristic information from neural network depth recognition module or imports in batches, comes from other intelligent depths
The feature database of analyzing device, and further add or modify existing feature database；The application feature database query unit is depth report
Literary parsing module provides the inquiry of feature database.
Further, the neural network depth recognition module includes neural network depth recognition unit, node parameter importing
Unit, learning training unit, node parameter lead-out unit and feature output unit；The neural network depth recognition unit utilizes
Neural network algorithm parses the application message of outgoing packet, which is exported and gives application message output module, and exports
Identify the application feature of message to feature output unit；The node parameter import unit reads the ability configuration that administrator provides
File, the layer and specified node specify to entire neural network carry out parameter setting and adjustment；The learning training unit pair
The learning training of neural network algorithm；The parameter of the node parameter lead-out unit export each node of neural network algorithm is to matching
Set file；The feature output unit encapsulates and exports to have come using feature according to the format defined using feature database management module
Kind current signature library.
The present invention gives a kind of analytic method of intelligent depth resolution system, includes the following steps:
(1) packet parsing module receives data, is tentatively identified to the message in data flow, identifies that the data are to add
Ciphertext data stream or non-encrypted data stream；If it is non-encrypted data stream, which is exported and is parsed to deep message
Module carries out application layer message identification and extraction；If it is encrypting traffic, which is exported and gives neural network depth
Degree recognition unit is parsed；
(2) deep message parsing module is using the inquiry for carrying out feature database using feature database management module, according to inquiring
Feature the application layer message of non-encrypted data stream is identified and is extracted；If the non-encrypted data stream is unrecognized, will not
The data flow of identification is exported to be parsed to deep neural network recognition unit；
(3) neural network depth recognition unit is fluent to the encrypting traffic or unrecognized non-encrypted data that receive
It is parsed and is identified with neural network algorithm；
(4) what application message output module reception deep message parsing module and neural network depth recognition unit exported answers
With information, application message is assembled, and is exported after carrying out transmission encapsulation to log server or big data server；
(5) feature output unit receives characteristic information and the encapsulation of neural network depth recognition unit output, and will encapsulation
Characteristic information afterwards is sent to feature input unit；
(6) feature input unit obtains the characteristic information of feature output unit output and updates current signature library.
Further, in step (3), neural network depth recognition unit need to be to received encrypting traffic or unrecognized
Non-encrypted data stream in message carry out intelligence sample, extract sample information and be input to the input terminal of neural network input layer,
It is parsed and is identified using neural network algorithm.
It further,, will if encrypting traffic or unrecognized non-encrypted data stream are identified successfully in step (3)
Application message issues the processing of application message output module, and assembled characteristic information is exported and gives feature output unit；As added
Ciphertext data stream or unrecognized non-encrypted data stream are unrecognized, and unidentified data flow is pressed the sample mode of configuration by system,
Unidentified data flow is completely or partially packaged and is output to log server, remains offline analysis.
Further, by according to unidentified data flow analyzed under online as a result, formulate neural metwork training study number
According to being trained by learning training training unit to neural network.
It applies message the utility model has the advantages that the present invention is grabbed in existing deep analysis equipment by manual or automatic chemical industry tool, divide
Analysis application message simultaneously improves the mode of feature database and is promoted to the mode of autonomous learning and capacity upgrade, can be by from existing online
The form that feature database and neural network capacity factor are transplanted in intelligent depth resolution system, promotes rapidly the identification of new log equipment
Ability.When equipment on-line works, encryption or unknown protocol message, and gradual perfection are identified by neural network depth recognition module
Its feature database；In addition, carrying out the post analysis under line according to the unidentified message that the system exports, study instruction can be made
Practice data, training is oriented to deep neural network node online, promotes neural network depth recognition module to unknown protocol
With the recognition capability of encryption message, the feature database maintenance cost of deep analysis equipment is greatly reduced, deep analysis is improved and sets
The real-time update ability of standby feature database.
Detailed description of the invention
Fig. 1 is the block diagram of intelligent depth resolution system of the invention；
Fig. 2 is the data interaction flow chart of intelligent deep analysis system of the invention.
Specific embodiment
Intelligent depth resolution system of the invention is described further with reference to the accompanying drawing.
Fig. 1 is the block diagram of intelligent depth resolution system of the invention, as shown in Figure 1, the system comprises: packet parsing mould
Block 100, deep message parsing module 200, using feature database management module 300, neural network depth recognition module 400, application
Message output module 500.
The packet parsing module 100 makees Preliminary Analysis to the network flow received, according to protocol type Preliminary Analysis
Current data payload package is plaintext or ciphertext out, such as the load of HTTPS message is ciphertext.
When parsing current data payload package is plaintext, the deep message parsing module 200, which calls, applies feature database
The query interface of management module 300, which is read, applies feature database, the feature according to defined in feature database to the load of network flow into
Row deep analysis obtains the user information of flow application layer；It is described to be responsible for looking into for feature database using feature database management module 300
It askes, addition, modification, delete, batch imports and batch exports；
When parsing current data payload package is ciphertext, the neural network depth recognition module 400 utilizes nerve net
Network algorithm completes the identification and parsing, the feature encapsulation and output of analytic message, each layer neurode ginseng of neural network of message
The functions such as several maintenances；The application message output module 500 is known according to deep message parsing module 200 or neural network depth
The application message that other module 400 parses completes information classification, encapsulation and output.
Wherein, the management and read-write being mainly responsible for using feature database management module 300 to feature database.The module includes
Feature lead-out unit 301, feature input unit 302 and application feature database query unit 303.The feature lead-out unit 301 can
To export existing equipment feature database, it is conveniently transplanted to other smart machines；The feature input unit 302 is responsible for receiving from mind
Message characteristic information or batch through network depth identification module import the feature database from other intelligent depth analyzing devices, so
Further add or modify afterwards existing feature database；The application feature database query unit 303 is that deep message parsing module 200 mentions
For feature database query function.
The neural network depth recognition module 400 includes neural network depth recognition unit 401, node parameter importing list
Member 402, learning training unit 403, node parameter lead-out unit 404 and feature output unit 405；The neural network depth is known
The application message is exported and is exported to application message using the application message of neural network algorithm parsing outgoing packet by other unit 401
Module 500, output have identified the application feature of message to feature output unit 405；The node parameter import unit 402 passes through
Management interface reads the capabilities profile that adjusted or other intelligent depth resolution systems that administrator provides provide, to whole
The specified layer of a neural network and specified node carry out parameter setting and adjustment, can be with by this data memory transplanting mode
Greatly shorten the on-line study time of current device；The learning training unit 403 is responsible for the data flow according to user's typing, stream
Parsing result and training parameter completion are measured to the learning training of neural network algorithm.Training parameter includes but is not limited to encrypt identification
The parameters such as the training modes such as training, unknown protocol recognition training and the scale of training；The node parameter lead-out unit 404 is negative
Duty, to configuration file, is obtained according to the parameter of the system definition format export each node of neural network algorithm for administrator；It is described
Feature output unit 405 is responsible for encapsulating and exporting according to the format defined using feature database management module working as using feature to improve
Preceding feature database.
Fig. 2 is the process of analysis figure of intelligent depth resolution system proposed by the present invention, comprising the following steps:
S1. the packet parsing module 100 receives data, which can be network flow, to the message in data flow into
The preliminary identification of row, being gone out according to message protocol type identification is encrypting traffic or non-encrypted data stream.If it is non-encrypted number
According to stream, which is exported and carries out application layer message identification and extraction to deep message parsing module 200；If it is
The encrypting traffic is exported and is parsed to neural network depth recognition unit 401 by encrypting traffic.
S2. deep message parsing module 200 using using feature database management module 300 carry out feature database inquiry, according to
The feature inquired is identified and is extracted to the application layer message of non-encrypted data stream；If the non-encrypted data stream is not known
Not, unidentified data flow is exported and is parsed to deep neural network recognition unit 401.
S3. neural network depth recognition unit 401 is to the encrypting traffic or unrecognized non-encrypted data received
Fluently is parsed and identified with neural network algorithm.It needs to carry out letter to the message received in data flow before parsing and identification
Breath sampling.Sample information is not limited to: link layer information such as source MAC, purpose MAC information, IP layers of information such as source IP, destination IP letter,
The information such as protocol fields, length, transport layer source port number, destination slogan information and sampling of payload segment etc..
Using all of above extraction information as the input of neural network input layer, recognition result is finally obtained.Such as data
The information such as Host, Apply Names, the type of action of stream.
If identified successfully, application message is issued into application message output module 500 and is handled, and assembled feature is believed
Breath output is to feature output unit 405.
If identification is failed, unidentified data flow is pressed the sample mode of configuration by system, and unidentified data flow is whole
Or part is packaged and is output to log server, remains offline analysis.After this partial data stream analyzes result under line, it can make
The learning data to neural metwork training is made, for example, the information such as data flow and analysis result.Then training data is passed through into
It practises training training unit 403 to be trained neural network, further to promote neural network recognization ability.
S4. application message output module 500 receives deep message parsing module 200 and neural network depth recognition unit
The application message of 401 outputs, application message is assembled, then sent according to such as TLV or JSON format that user requires
Output is to log server or big data server after encapsulation.
S5. feature output unit 405 receives the characteristic information and encapsulation that neural network depth recognition unit 401 exports, so
The characteristic information after encapsulation is sent to feature input unit 302 afterwards.
S6. feature input unit 302 obtains the characteristic information of the output of feature output unit 405 and updates current signature library.
The present invention proposes a kind of intelligent depth analysis system and method for supporting autonomous learning and capacity upgrade.The system
The identification and parsing to encryption message and unidentified message, and the report that will identify that can be completed based on neural network algorithm with method
Literary information is sophisticated in equipment feature database with the format that application feature database requires, and has accomplished the self-perfection of feature database, while institute
It states system and completes autonomous learning and capability improving by the modes such as analogue data and ability parameter injection.
Claims (7)
1. a kind of intelligent depth resolution system, it is characterised in that: the system includes: packet parsing module, deep message parsing mould
Block, using feature database management module, neural network depth recognition module and application message output module；The packet parsing mould
Block parses the data received, and parsing the data pack load is plaintext or cipher text；
When parsing the data pack load is plaintext, the deep message parsing module is read from application feature database management module
Using feature database, deep analysis is carried out to the data pack load, obtains application layer message；
When parsing the data pack load is ciphertext, the neural network depth recognition module is using neural network algorithm to this
Data pack load is identified and is parsed, and the message information of the data parsed and feature are encapsulated and exported；
The application message output module is answered according to what deep message parsing module or neural network depth recognition module parsed
With information, information classification, encapsulation and output are completed.
2. intelligent depth resolution system according to claim 1, it is characterised in that: the application feature database management module packet
It includes: feature lead-out unit, feature input unit and application feature database query unit；The feature lead-out unit exports existing system
Feature database is conveniently transplanted to other smart machines；The feature input unit is received from neural network depth recognition module
Message characteristic information or batch import the feature database from other intelligent depth analyzing devices, and further add or modify and is existing
Feature database；It is described to provide the inquiry of feature database using feature database query unit for deep message parsing module.
3. intelligent depth resolution system according to claim 1, it is characterised in that: the neural network depth recognition module
Including neural network depth recognition unit, node parameter import unit, learning training unit, node parameter lead-out unit and feature
Output unit；The neural network depth recognition unit is answered this using the application message of neural network algorithm parsing outgoing packet
It is exported with information and gives application message output module, and exported and identified the application feature of message to feature output unit；The section
Point parameter import unit reads the capabilities profile that administrator provides, the layer and specified node specify to entire neural network
Carry out parameter setting and adjustment；Learning training of the learning training unit to neural network algorithm；The node parameter export
Unit exports the parameter of each node of neural network algorithm to configuration file；The feature output unit is according to using feature depositary management
The format of reason module definition, which is encapsulated and exported using feature, improves current signature library.
4. the analytic method of intelligent depth resolution system described in claim 1-3, characterized by the following steps:
(1) packet parsing module receives data, is tentatively identified to the message in data flow, identifies that the data are encryption numbers
According to stream or non-encrypted data stream；If it is non-encrypted data stream, which is exported and gives deep message parsing module
Carry out application layer message identification and extraction；If it is encrypting traffic, which is exported and is known to neural network depth
Other unit is parsed；
(2) deep message parsing module is using the inquiry for carrying out feature database using feature database management module, according to the spy inquired
Sign is identified and is extracted to the application layer message of non-encrypted data stream；If the non-encrypted data stream is unrecognized, will be unidentified
Data flow export and parsed to deep neural network recognition unit；
(3) neural network depth recognition unit fluently uses mind to the encrypting traffic or unrecognized non-encrypted data that receive
It is parsed and is identified through network algorithm；
(4) application message output module receives the application letter of deep message parsing module and the output of neural network depth recognition unit
Breath, application message is assembled, and is exported after carrying out transmission encapsulation to log server or big data server；
(5) feature output unit receives characteristic information and the encapsulation of neural network depth recognition unit output, and will be after encapsulation
Characteristic information is sent to feature input unit；
(6) feature input unit obtains the characteristic information of feature output unit output and updates current signature library.
5. the analytic method of intelligent depth resolution system according to claim 4, it is characterised in that: in step (3), mind
Through network depth recognition unit letter need to be carried out to the message in received encrypting traffic or unrecognized non-encrypted data stream
Breath sampling is extracted the input terminal that sample information is input to neural network input layer, is parsed and known using neural network algorithm
Not.
6. the analytic method of intelligent depth resolution system according to claim 4, it is characterised in that: in step (3), such as
Encrypting traffic or unrecognized non-encrypted data stream are identified successfully, and application message is issued at application message output module
Reason, and assembled characteristic information is exported and gives feature output unit；Such as encrypting traffic or unrecognized non-encrypted data
Flow unrecognized, unidentified data flow by the sample mode of configuration, unidentified data flow is completely or partially packaged defeated by system
Log server is arrived out, remains offline analysis.
7. the analytic method of intelligent depth resolution system according to claim 6, it is characterised in that: will be according to unidentified number
According to being analyzed under flowing online as a result, the learning data of neural metwork training is formulated, by learning training training unit to nerve
Network is trained.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811453846.5A CN109639655A (en) | 2018-11-30 | 2018-11-30 | A kind of intelligent depth resolution system and analytic method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811453846.5A CN109639655A (en) | 2018-11-30 | 2018-11-30 | A kind of intelligent depth resolution system and analytic method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109639655A true CN109639655A (en) | 2019-04-16 |
Family
ID=66070394
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811453846.5A Pending CN109639655A (en) | 2018-11-30 | 2018-11-30 | A kind of intelligent depth resolution system and analytic method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109639655A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110445800A (en) * | 2019-08-15 | 2019-11-12 | 上海寰创通信科技股份有限公司 | A kind of deep message resolution system based on self study |
| CN110782014A (en) * | 2019-10-23 | 2020-02-11 | 新华三信息安全技术有限公司 | Neural network increment learning method and device |
| CN110781950A (en) * | 2019-10-23 | 2020-02-11 | 新华三信息安全技术有限公司 | Message processing method and device |
| CN112350846A (en) * | 2019-08-07 | 2021-02-09 | 杭州木链物联网科技有限公司 | Asset learning method, device, equipment and storage medium for intelligent substation |
| CN114157501A (en) * | 2021-12-08 | 2022-03-08 | 北京天融信网络安全技术有限公司 | Parameter analysis method and device based on Tianri database |
| CN114338126A (en) * | 2021-12-24 | 2022-04-12 | 武汉思普崚技术有限公司 | Network application identification method and device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102394827A (en) * | 2011-11-09 | 2012-03-28 | 浙江万里学院 | Hierarchical classification method for internet flow |
| CN103312565A (en) * | 2013-06-28 | 2013-09-18 | 南京邮电大学 | Independent learning based peer-to-peer (P2P) network flow identification method |
| US20170324758A1 (en) * | 2015-05-07 | 2017-11-09 | Cyber-Ark Software Ltd. | Detecting and reacting to malicious activity in decrypted application data |
-
2018
- 2018-11-30 CN CN201811453846.5A patent/CN109639655A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102394827A (en) * | 2011-11-09 | 2012-03-28 | 浙江万里学院 | Hierarchical classification method for internet flow |
| CN103312565A (en) * | 2013-06-28 | 2013-09-18 | 南京邮电大学 | Independent learning based peer-to-peer (P2P) network flow identification method |
| US20170324758A1 (en) * | 2015-05-07 | 2017-11-09 | Cyber-Ark Software Ltd. | Detecting and reacting to malicious activity in decrypted application data |
Non-Patent Citations (2)
| Title |
|---|
| 孙雅妮: "基于特征学习的网络入侵检测技术研究", 《中国优秀硕士学位论文全文数据库（信息科技辑）》 * |
| 桑寅等: "基于DPI和机器学习方法传输层检测的P2P流量识别模型", 《电子测量技术》 * |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112350846A (en) * | 2019-08-07 | 2021-02-09 | 杭州木链物联网科技有限公司 | Asset learning method, device, equipment and storage medium for intelligent substation |
| CN112350846B (en) * | 2019-08-07 | 2024-01-09 | 浙江木链物联网科技有限公司 | Asset learning method, device and equipment of intelligent substation and storage medium |
| CN110445800A (en) * | 2019-08-15 | 2019-11-12 | 上海寰创通信科技股份有限公司 | A kind of deep message resolution system based on self study |
| CN110445800B (en) * | 2019-08-15 | 2022-06-14 | 上海寰创通信科技股份有限公司 | Self-learning-based deep packet parsing system |
| CN110782014A (en) * | 2019-10-23 | 2020-02-11 | 新华三信息安全技术有限公司 | Neural network increment learning method and device |
| CN110781950A (en) * | 2019-10-23 | 2020-02-11 | 新华三信息安全技术有限公司 | Message processing method and device |
| CN110781950B (en) * | 2019-10-23 | 2023-06-30 | 新华三信息安全技术有限公司 | Message processing method and device |
| CN114157501A (en) * | 2021-12-08 | 2022-03-08 | 北京天融信网络安全技术有限公司 | Parameter analysis method and device based on Tianri database |
| CN114157501B (en) * | 2021-12-08 | 2024-01-23 | 北京天融信网络安全技术有限公司 | Parameter analysis method and device based on TianRui database |
| CN114338126A (en) * | 2021-12-24 | 2022-04-12 | 武汉思普崚技术有限公司 | Network application identification method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109639655A (en) | A kind of intelligent depth resolution system and analytic method | |
| CN110012029B (en) | Method and system for distinguishing encrypted and non-encrypted compressed flow | |
| CN106789259A (en) | A kind of LoRa core network systems and implementation method | |
| CN101741908B (en) | Identification method for application layer protocol characteristic | |
| CN110197234A (en) | A kind of encryption traffic classification method based on binary channels convolutional neural networks | |
| CN104283918B (en) | A kind of WLAN terminal type acquisition methods and system | |
| CN108768986A (en) | A kind of encryption traffic classification method and server, computer readable storage medium | |
| CN103200133A (en) | Flow identification method based on network flow gravitation cluster | |
| CN101753622B (en) | Method for extracting characteristics of application layer protocols | |
| CN105302885A (en) | Full-text data extraction method and device | |
| CN106055452A (en) | Method and apparatus for creating switch log template | |
| CN111181930A (en) | DDoS attack detection method, device, computer equipment and storage medium | |
| CN104298782A (en) | Method for analyzing active access behaviors of internet users | |
| CN113810489A (en) | Industrial internet control system and method | |
| Wang et al. | A smart automated signature extraction scheme for mobile phone number in human-centered smart home systems | |
| CN101426008B (en) | Audit method and system based on back display | |
| CN106789416A (en) | The recognition methods of industrial control system specialized protocol and system | |
| CN107360062A (en) | Verification method, system and the DPI equipment of DPI equipment recognition results | |
| CN116827721A (en) | Edge computing gateway based on quantum security and application method | |
| CN115333915B (en) | Heterogeneous host-oriented network management and control system | |
| CN109492655B (en) | Feature extraction method and device and terminal | |
| CN105610665B (en) | A kind of VPN agreement suitable for mobile device | |
| CN107026739B (en) | Note signature authentication method and device | |
| Zhang et al. | Encrypted network traffic classification: A data driven approach | |
| CN108121288A (en) | Car networking big data system, docking system and method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190416 |
|
| RJ01 | Rejection of invention patent application after publication |