CN109995731A - It improves the method, apparatus of caching discharge flow, calculate equipment and storage medium - Google Patents

It improves the method, apparatus of caching discharge flow, calculate equipment and storage medium Download PDF

Info

Publication number
CN109995731A
CN109995731A CN201711491435.0A CN201711491435A CN109995731A CN 109995731 A CN109995731 A CN 109995731A CN 201711491435 A CN201711491435 A CN 201711491435A CN 109995731 A CN109995731 A CN 109995731A
Authority
CN
China
Prior art keywords
host
http
hot spot
caching
ticket
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201711491435.0A
Other languages
Chinese (zh)
Other versions
CN109995731B (en
Inventor
滕野
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Mobile Communications Group Co Ltd
China Mobile Group Liaoning Co Ltd
Original Assignee
China Mobile Communications Group Co Ltd
China Mobile Group Liaoning Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Mobile Communications Group Co Ltd, China Mobile Group Liaoning Co Ltd filed Critical China Mobile Communications Group Co Ltd
Priority to CN201711491435.0A priority Critical patent/CN109995731B/en
Publication of CN109995731A publication Critical patent/CN109995731A/en
Application granted granted Critical
Publication of CN109995731B publication Critical patent/CN109995731B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H04L67/1014—Server selection for load balancing based on the content of a request
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/568—Storing data temporarily at an intermediate stage, e.g. caching
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

The embodiment of the invention discloses a kind of method, apparatus for improving caching discharge flow, calculate equipment and storage medium, method include: it is first-born at full dose user's HTTP ticket based on HTTP message, the full dose user HTTP ticket include from each HTTP message head extract content-length and host；Based on the full dose user HTTP ticket, summation operation is carried out to the content-length under the same host, obtains total content-length of each host；Total content-length is ranked up using host as granularity, determines hot spot flow host；And caching acceleration processing is carried out to the hot spot flow host.It can be captured out by this programme and save big flow domain name, realize the acceleration service to hot spot service.

Description

It improves the method, apparatus of caching discharge flow, calculate equipment and storage medium
Technical field
The present invention relates to internet HTTP technical field more particularly to it is a kind of improve caching discharge flow method, apparatus, Calculate equipment and storage medium.
Background technique
Recently as the development of internet, Internet Users, Internet application type, network bandwidth etc. all show Explosive growth produces tremendous influence to society and people's lives.The five-year China internet traffic increases every year More than 40%, in contrast, although broadband construction is also increasing, the service traffics speed that remote ultra-wide band has increased rises, existing Have the visible growth of bandwidth and future, far from meet big flow continue occupied bandwidth using being gulped down to network bandwidth It bites.
In order to cope with the challenge of internet traffic rapid growth, global mainstream carrier starts to build CDN/Cache net Network, the purpose is to the content of website is published to and is most connect by increasing by one layer of new network architecture in existing Internet The network " edge " of nearly user, allows user to obtain required content nearby, solves the crowded situation of Internet network, mentions High user accesses the response speed of website, solves the institute due to network bandwidth is small, user's amount of access is big, network point distribution is unequal Caused by user access the slow-footed problem of websites response.
In the drainage of Cache network, Local DNS is turned the inquiry of user terminal DNS domain name by DNS Forward mode It is dealt into Cache network, You Qiwei user provides service, improves response speed.For the catenets operation such as China Mobile Quotient, user access type of business and enrich, and need to carry out Cache acceleration to hot spot service.Existing Cache method for running, mainly Using DNS daily record data, the more domain name of user's dns resolution amount is inquired, is added to Cache network, these business domain names is mentioned For accelerating to service.DNS daily record data can only provide user's number of dns resolution difference domain name, run Cache net using this method Network can not accurately capture user's big flow Domain Name Services, and provide acceleration service for user's hot spot service.
In hot spot confirmation, DNS daily record data counts the DNS process of each user, that is, initiates the source IP of user, requests domain Name and parsing address, and these data are counted, the dns resolution number of each domain name can only be calculated.Since user exists It is to be interacted by http protocol with server after initiating dns resolution acquisition server ip, obtains access content, therefore, DNS Parsing number can not represent the business as hot spot service.
Summary of the invention
User's number of dns resolution difference domain name can only be provided for DNS daily record data, can not accurately capture the big stream of user The problem of measuring domain name the embodiment of the invention provides a kind of method, apparatus for improving caching discharge flow, calculates equipment and storage Medium can accurately capture out big flow domain name, realize the acceleration service to hot spot service.
In a first aspect, the embodiment of the invention provides a kind of method for improving caching discharge flow, method includes:
First-born at full dose user's HTTP ticket based on HTTP message, full dose user's HTTP ticket includes from each HTTP message head The content-length and host identification information of extraction；
Based on full dose user's HTTP ticket, summation operation is carried out to the content-length under the same host, obtains each host Total content-length；
Total content-length is ranked up using host as granularity, determines hot spot flow host；And
Caching acceleration processing is carried out to hot spot flow host.
Second aspect, the embodiment of the invention provides a kind of devices for improving caching discharge flow, and device includes: generation mould Block, computing module, determining module and processing module.
Generation module can be first-born at full dose user's HTTP ticket based on HTTP message, wherein full dose user's HTTP ticket Including the content-length and host extracted from each HTTP message head.
Computing module can be based on full dose user HTTP ticket, carry out summation meter to the content-length under the same host It calculates, obtains total content-length of each host.
Determining module can be ranked up total content-length using host as granularity, determine hot spot flow host.
Processing module can carry out caching acceleration processing to hot spot flow host.
The embodiment of the invention provides a kind of calculating equipment for the third aspect, comprising: at least one processor, at least one deposits Reservoir and computer program instructions stored in memory are realized as above when computer program instructions are executed by processor The method for stating first aspect in embodiment.
Fourth aspect, the embodiment of the invention provides a kind of computer readable storage mediums, are stored thereon with computer journey The method such as first aspect in above embodiment is realized in sequence instruction when computer program instructions are executed by processor.
The method, apparatus for improving caching discharge flow, calculating equipment and storage medium provided in an embodiment of the present invention, pass through HTTP message is analyzed, it is accurate to capture big flow domain name, and combine DNS log and analysis can be cached, can accurately it go out for user The caching for saving big flow business carries out acceleration service.
Detailed description of the invention
In order to illustrate the technical solution of the embodiments of the present invention more clearly, will make below to required in the embodiment of the present invention Attached drawing is briefly described, for those of ordinary skill in the art, without creative efforts, also Other drawings may be obtained according to these drawings without any creative labor.
Fig. 1 shows the schematic flow chart of the method according to an embodiment of the invention for improving caching discharge flow.
Fig. 2 shows the schematic diagrames of full dose user HTTP ticket according to an embodiment of the invention.
Fig. 3 shows the schematic diagram of the flow sequence according to an embodiment of the invention to domain name dimension.
Fig. 4 shows the schematic flow chart according to an embodiment of the invention for saving big flow domain name caching out.
Fig. 5 shows caching discharge improvement effect schematic diagram according to an embodiment of the invention.
Fig. 6 shows the schematic block diagram of the device according to an embodiment of the invention for improving caching discharge flow.
Fig. 7 shows the hardware structural diagram provided in an embodiment of the present invention for calculating equipment.
Specific embodiment
The feature and exemplary embodiment of various aspects of the invention is described more fully below, in order to make mesh of the invention , technical solution and advantage be more clearly understood, with reference to the accompanying drawings and embodiments, the present invention is further retouched in detail It states.It should be understood that specific embodiment described herein is only configured to explain the present invention, it is not configured as limiting the present invention. To those skilled in the art, the present invention can be real in the case where not needing some details in these details It applies.Below the description of embodiment is used for the purpose of better understanding the present invention to provide by showing example of the invention.
It should be noted that, in this document, relational terms such as first and second and the like are used merely to a reality Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment Intrinsic element.In the absence of more restrictions, the element limited by sentence " including ... ", it is not excluded that including There is also other identical elements in the process, method, article or equipment of element.
This motion captures big flow domain name using the field in http protocol, and combines DNS log and can cache analysis, Caching acceleration processing is carried out to the host in caching white list.Fig. 1 shows raising caching according to an embodiment of the invention and spits The schematic flow chart of the method for outflow.
As shown in Figure 1, in the step s 100 can be first-born at full dose user's HTTP ticket based on HTTP message, wherein complete Amount user HTTP ticket includes the content-length and host identification information extracted from each HTTP message head.
Wherein, content-length refers to the removing unexpected content-length of header in message.HTTP message include uplink message i.e. Request message and downlink message, that is, response message, HTTP request message include requesting method, request URL, http protocol and version, Heading and message body, http response message include message protocol and version, status code and state description, head response and response Body.Wherein, HTTP message head includes Cache-Control (buffer control), Content-Type (body type), Content- Length (the solid data size of URL resource) Content-Charset (text coding), Port (port), Host (host clothes Business device) etc., the field informations such as content-length Content-Length and host Host can be extracted from HTTP message head, generated Full dose user's HTTP ticket, the record letter of the HTTP access request of whole users in full dose user HTTP ticket i.e. some region Breath.Wherein, host can be IP: port numbers are also possible to domain name.
An embodiment according to the present invention can obtain the HTTP message of user by parsing deep analysis message data.
Wherein, DPI deep analysis message carries out identification parsing by the uplink and downlink data packet to user, can complete to use Parsing, protocol identification and the content recognition of user data message obtain the valuable information such as purpose URL.And it can be based on knowledge Other type of business or the keyword match being resolved to control rule.
An embodiment according to the present invention can identify user's HTTP message by probe device.For example, can use serial Probe device TMA (tower amplifier) on Metropolitan Area Network (MAN) outbound carries out message identification.
The corresponding heading of the HTTP message of successfully resolved can be imported bill record collection system by an embodiment according to the present invention System, to generate full dose user's HTTP ticket, will parse unsuccessful HTTP message and is attributed to junk data.
Wherein, ticket collection system can be using C# language and FTP downloading and realize, can acquire port number in real time According to.
HTTP message after identification can be transferred to bill record collection clothes by Port Mirroring by an embodiment according to the present invention It is engaged in device, to realize the convergence of request message and response message.
Wherein, Port Mirroring is that the message duplication portion of designated port (source port), vlan (source vlan) or CPU are arrived it Its port (destination port), destination port can be connected with data monitoring equipment, can analyze using data monitoring equipment multiple The convergence of request message and response message may be implemented in the message for making destination port.It can also carry out network monitoring and failure It excludes, for example, the port B is the mirror image of the port A, then can obtain the port A by common some tools on the port B Network packet can analyze whether the port A has Abnormal network traffic by the data packet of capture.
An embodiment according to the present invention, can will with the data flow ID of each user's HTTP access process be row, with from The field extracted in HTTP message head is the tables of data of column as full dose user's HTTP ticket.Wherein, in HTTP access process It requests and responds, and carry out the read-write operation of data on network, can be completed using data flow.
Wherein, HTTP ticket is after being handled based on internet full dose data, and the signaling procedure and business of generation transmit The session level of process records in detail, contains all internet informations of user, may include five-tuple information, HTTP message information Deng.
Fig. 2 shows the schematic diagrames of full dose user HTTP ticket according to an embodiment of the invention.As shown in Fig. 2, can be with The fields such as website name, Host, PORT, URL sum are extracted, to data caused by HTTP process of same Client-initiated Stream, can be named as ID=1, sequentially list the data flow to users all in some region, and generating with data flow ID is row, mention The HTTP field taken is the tables of data of column.
As shown in Figure 1, it can be based on full dose user HTTP ticket in step s 200, it is long to the content under the same host Degree carries out summation operation, obtains total content-length of each host.
For example, HTTP ticket can be uploaded to data processing system by granularity of day by way of FTP, by not Belong to the content-length under the same host field with data flow ID and carry out summation operation, obtains total content of each host Length can be used as the foundation of flow sequence.
Total content-length can be ranked up using host as granularity in step S300, determine hot spot flow host.Fig. 3 Show the schematic diagram of the flow sequence according to an embodiment of the invention to domain name dimension.
An embodiment according to the present invention can carry out descending arrangement to total content-length, using top n host as hot spot stream Host is measured, N is to cache host number in conjunction with what cache network service capabilities evaluated.
For example, N can design the ratio of the average connection number of connection number and each domain name according to network service capabilities for system Value, choosing topN host is hot spot flow host.
Caching acceleration processing can be carried out to hot spot flow host in step S400.
An embodiment according to the present invention can determine that this province of each hot spot flow host leads, by this province in conjunction with DNS log Caching white list is added in the hot spot flow host that rate is less than predetermined threshold, this province is led the hot spot flow master not less than predetermined threshold Caching blacklist is added in machine, carries out caching acceleration processing to the host in caching white list.
Wherein, this province leads the ratio that can be the number occupancy family dns resolution total degree that User DN S is resolved to inside the province.
For example, judge the ownership of hot spot flow host, lead if this province >=50% if host be attributed to inside the province；If this province leads < 50% host is attributed to outside the province.Since Cache does not have acceleration effect to resource inside the province, if host is resource inside the province Caching blacklist is added, caching white list is added if host is resource outside the province.
An embodiment according to the present invention can extract port from each HTTP message head, according to port information, judge hot spot The hot spot flow host that the ratio that port is 80 is 100% is added and caches white list by the cacheability of flow host, and/ Or caching blacklist is added in the hot spot flow host that the ratio that port is 80 is not 100%.
For example, since Cache network only services the resource of port=80, if the ratio of the port=80 under the host is 100%, then caching white list is added, caching blacklist is otherwise added.
Fig. 4 shows the schematic flow chart according to an embodiment of the invention for saving big flow domain name caching out.Such as Fig. 4 institute Show, using DPI data capture user's uplink and downlink message, the pairing HTTP message head of acquisition success imported into ticket collection system, Unsuccessful pairing HTTP message head will be captured as junk data.The field for needing to retain in HTTP message head is mentioned It takes, including content-length/host/cache-control/port etc., unsuccessful HTTP message will be extracted as rubbish Rubbish data.Hot spot flow host is obtained, summation operation can be carried out to the content-length belonged under the same host, obtained It sorts to by the flow of granularity of host, can accurately capture hot spot flow host, non-hot flow host is not handled.It is right The parsing ownership of host makes a decision, and caching blacklist is then added if resource inside the province, and the white name of caching is then added if resource outside the province It is single.The cacheability of host is judged, if the ratio of the port=80 under the host is 100%, the white name of caching is added It is single, caching blacklist is otherwise added.
Fig. 5 shows caching discharge improvement effect schematic diagram according to an embodiment of the invention.It can be seen that passing through raising Discharge-amount is cached, buffer memory rate is improved.
Fig. 6 shows the schematic block diagram of the device according to an embodiment of the invention for improving caching discharge flow. As shown in fig. 6, the device 600 may include: generation module 610, computing module 620, determining module 630 and processing module 640.
Generation module 610 can be first-born at full dose user's HTTP ticket based on HTTP message, wherein full dose user HTTP words It singly include the content-length and host extracted from each HTTP message head.
Computing module 620 can be based on full dose user HTTP ticket, sum to the content-length under the same host It calculates, obtains total content-length of each host.
Determining module 630 can be ranked up total content-length using host as granularity, determine hot spot flow host.
Processing module 640 can carry out caching acceleration processing to hot spot flow host.
An embodiment according to the present invention, processing module 640 may include:
Determination unit can determine that this province of each hot spot flow host leads in conjunction with DNS log.
First ownership unit will for this province to be led to the hot spot flow host addition caching white list less than predetermined threshold This province leads the hot spot flow host addition caching blacklist not less than predetermined threshold；
Processing unit can carry out caching acceleration processing to the host in caching white list.
An embodiment according to the present invention, processing module 640 can also include:
Judging unit, for judging the cacheability of hot spot flow host, the hot spot for being 100% by the ratio that port is 80 Caching white list is added in flow host, and/or the hot spot flow host that the ratio that port is 80 is not 100% is added and is delayed Deposit blacklist.
An embodiment according to the present invention, generation module 610 may include:
Resolution unit can parse deep analysis message data, to obtain the HTTP message of user.
The corresponding heading of the HTTP message of successfully resolved can be imported ticket collection system, to generate by import unit Full dose user's HTTP ticket.
Second ownership unit, can will parse unsuccessful HTTP message and be attributed to junk data.
Wherein, resolution unit may include recognition unit, can identify user's HTTP message by probe device.
Import unit may include transmission unit, the HTTP message after identification can be transferred to ticket by Port Mirroring In acquisition server, to realize the convergence of request message and response message.
An embodiment according to the present invention, determining module 630 may include:
Sequencing unit can carry out descending arrangement to total content-length, and using top n host as hot spot flow host, N is Host number is cached in conjunction with what cache network service capabilities evaluated.
To sum up, the technical solution of the disclosure extracts the content-length/host/ in http protocol by DPI system Cache-control/port core field, sums to the content-length for the different resource for belonging to same host, Big flow domain name can be captured.DNS log and analysis system can be cached by combining, can accurately capture out save flow domain name and The domain name for being suitble to caching system to accelerate realizes the acceleration service to hot spot service.
In addition, the method in conjunction with the raising caching discharge flow of Fig. 1 embodiment of the present invention described can be by calculating equipment To realize.Fig. 7 shows the hardware structural diagram provided in an embodiment of the present invention for calculating equipment.
Calculating equipment may include processor 701 and the memory 702 for being stored with computer program instructions.
Specifically, above-mentioned processor 701 may include central processing unit (CPU) or specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured to implement implementation of the present invention One or more integrated circuits of example.
Memory 702 may include the mass storage for data or instruction.For example it rather than limits, memory 702 may include hard disk drive (Hard Disk Drive, HDD), floppy disk drive, flash memory, CD, magneto-optic disk, tape or logical With the combination of universal serial bus (Universal Serial Bus, USB) driver or two or more the above.It is closing In the case where suitable, memory 702 may include the medium of removable or non-removable (or fixed).In a suitable case, it stores Device 702 can be inside or outside data processing equipment.In a particular embodiment, memory 702 is nonvolatile solid state storage Device.In a particular embodiment, memory 702 includes read-only memory (ROM).In a suitable case, which can be mask ROM, programming ROM (PROM), erasable PROM (EPROM), the electric erasable PROM (EEPROM), electrically-alterable ROM of programming (EAROM) or the combination of flash memory or two or more the above.
Processor 701 is by reading and executing the computer program instructions stored in memory 702, to realize above-mentioned implementation Any one method for improving caching discharge flow in example.
In one example, calculating equipment may also include communication interface 703 and bus 710.Wherein, as shown in fig. 7, processing Device 701, memory 702, communication interface 703 connect by bus 710 and complete mutual communication.
Communication interface 703 is mainly used for realizing in the embodiment of the present invention between each module, device, unit and/or equipment Communication.
Bus 710 includes hardware, software or both, and the component for calculating equipment is coupled to each other together.For example and It is unrestricted, bus may include accelerated graphics port (AGP) or other graphics bus, enhancing Industry Standard Architecture (EISA) bus, Front side bus (FSB), super transmission (HT) interconnection, the interconnection of Industry Standard Architecture (ISA) bus, infinite bandwidth, low pin count (LPC) Bus, memory bus, micro- channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) Bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association part (VLB) bus or other suitable buses Or the combination of two or more the above.In a suitable case, bus 710 may include one or more buses.To the greatest extent Specific bus has been described and illustrated in the pipe embodiment of the present invention, but the present invention considers any suitable bus or interconnection.
In addition, in conjunction with the method for the raising caching discharge flow in above-described embodiment, the embodiment of the present invention can provide one kind Computer readable storage medium is realized.Computer program instructions are stored on the computer readable storage medium；The computer Any one method for improving caching discharge flow in above-described embodiment is realized when program instruction is executed by processor.
It should be clear that the invention is not limited to specific configuration described above and shown in figure and processing. For brevity, it is omitted here the detailed description to known method.In the above-described embodiments, several tools have been described and illustrated The step of body, is as example.But method process of the invention is not limited to described and illustrated specific steps, this field Technical staff can be variously modified, modification and addition after understanding spirit of the invention, or suitable between changing the step Sequence.
Functional block shown in structures described above block diagram can be implemented as hardware, software, firmware or their group It closes.When realizing in hardware, it may, for example, be electronic circuit, specific integrated circuit (ASIC), firmware appropriate, insert Part, function card etc..When being realized with software mode, element of the invention is used to execute program or the generation of required task Code section.Perhaps code segment can store in machine readable media program or the data-signal by carrying in carrier wave is passing Defeated medium or communication links are sent." machine readable media " may include any medium for capableing of storage or transmission information. The example of machine readable media includes electronic circuit, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), soft Disk, CD-ROM, CD, hard disk, fiber medium, radio frequency (RF) link, etc..Code segment can be via such as internet, inline The computer network of net etc. is downloaded.
It should also be noted that, the exemplary embodiment referred in the present invention, is retouched based on a series of step or device State certain methods or system.But the present invention is not limited to the sequence of above-mentioned steps, that is to say, that can be according in embodiment The sequence referred to executes step, may also be distinct from that the sequence in embodiment or several steps are performed simultaneously.
The above description is merely a specific embodiment, it is apparent to those skilled in the art that, For convenience of description and succinctly, the system, module of foregoing description and the specific work process of unit can refer to preceding method Corresponding process in embodiment, details are not described herein.It should be understood that scope of protection of the present invention is not limited thereto, it is any to be familiar with Those skilled in the art in the technical scope disclosed by the present invention, can readily occur in various equivalent modifications or substitutions, These modifications or substitutions should be covered by the protection scope of the present invention.

Claims (12)

1. a kind of method for improving caching discharge flow, which is characterized in that the described method includes:
First-born at full dose user's HTTP ticket based on HTTP message, the full dose user HTTP ticket includes from each HTTP message head The content-length and server identification information of extraction；
Based on the full dose user HTTP ticket, summation operation is carried out to the content-length belonged under the same host, is obtained each Total content-length of host；
Total content-length is ranked up using host as granularity, determines hot spot flow host；
Caching acceleration processing is carried out to the hot spot flow host.
2. the method according to claim 1, wherein described carry out at caching acceleration the hot spot flow host Reason includes:
In conjunction with DNS log, determine that this province of each hot spot flow host leads；
Described province is led into the hot spot flow host addition caching white list less than predetermined threshold；
Described province is led into the hot spot flow host addition caching blacklist not less than predetermined threshold；
Caching acceleration processing is carried out to the host in the caching white list.
3. according to the method described in claim 2, it is characterized in that,
Described province, which leads, is resolved to the ratio that number inside the province occupies family dns resolution total degree for User DN S.
4. according to the method described in claim 2, it is characterized in that, the full dose user HTTP ticket further includes reporting from each HTTP The port that literary head extracts, it is described that the step of caching accelerates processing is carried out to hot spot flow host further include:
The hot spot flow host that the ratio that port is 80 is 100% is added the cacheability for judging the hot spot flow host White list is cached, and/or caching blacklist is added in the hot spot flow host that the ratio that port is 80 is not 100%.
5. the method according to claim 1, wherein described first-born at full dose user HTTP words based on HTTP message Single step includes:
Deep analysis message data is parsed, to obtain the HTTP message of user；
The corresponding heading of the HTTP message of successfully resolved is imported into ticket collection system, to generate the full dose user HTTP ticket；And
The unsuccessful HTTP message will be parsed and be attributed to junk data.
6. according to the method described in claim 5, it is characterized in that, the parsing deep analysis message data, to obtain user HTTP message the step of include:
User's HTTP message is identified by probe device.
7. according to the method described in claim 5, it is characterized in that, the corresponding report of the HTTP message by successfully resolved Literary head imports the step of ticket collection system and includes:
The HTTP message after identification is transferred in bill record collection server by Port Mirroring, with realize request message and The convergence of response message.
8. the method according to claim 1, wherein
The full dose user HTTP ticket is with the data flow ID of each user's HTTP access process for row, with from the HTTP The field extracted in heading is the tables of data of column.
9. the method according to claim 1, wherein described carry out total content-length using host as granularity Sequence determines that the step of hot spot flow host includes:
Descending arrangement is carried out to total content-length；
Using top n host as hot spot flow host, N is to cache host number in conjunction with what cache network service capabilities evaluated Amount.
10. a kind of device for improving caching discharge flow, which is characterized in that described device includes:
Generation module, for first-born at full dose user's HTTP ticket based on HTTP message, the full dose user HTTP ticket includes The content-length and host extracted from each HTTP message head；
Computing module carries out summation meter to the content-length under the same host for being based on the full dose user HTTP ticket It calculates, obtains total content-length of each host；
Determining module determines hot spot flow host for being ranked up using host as granularity to total content-length；And
Processing module, for carrying out caching acceleration processing to the hot spot flow host.
11. a kind of calculating equipment characterized by comprising at least one processor, at least one processor and be stored in institute The computer program instructions in memory are stated, are realized when the computer program instructions are executed by the processor as right is wanted Seek the described in any item methods of 1-9.
12. a kind of computer readable storage medium, is stored thereon with computer program instructions, which is characterized in that when the calculating Machine program instruction realizes method as claimed in any one of claims 1-9 wherein when being executed by processor.
CN201711491435.0A 2017-12-30 2017-12-30 Method and device for improving cache spitting flow, computing equipment and storage medium Active CN109995731B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201711491435.0A CN109995731B (en) 2017-12-30 2017-12-30 Method and device for improving cache spitting flow, computing equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201711491435.0A CN109995731B (en) 2017-12-30 2017-12-30 Method and device for improving cache spitting flow, computing equipment and storage medium

Publications (2)

Publication Number Publication Date
CN109995731A true CN109995731A (en) 2019-07-09
CN109995731B CN109995731B (en) 2021-11-30

Family

ID=67111039

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201711491435.0A Active CN109995731B (en) 2017-12-30 2017-12-30 Method and device for improving cache spitting flow, computing equipment and storage medium

Country Status (1)

Country Link
CN (1) CN109995731B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112272123A (en) * 2020-10-16 2021-01-26 北京锐安科技有限公司 Network traffic analysis method and device, electronic equipment and storage medium

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103338249A (en) * 2013-06-26 2013-10-02 优视科技有限公司 Cache method and device
CN103841045A (en) * 2012-11-22 2014-06-04 中国移动通信集团公司 Internet cache processing method, content detection subsystem and Cache system
CN105975433A (en) * 2016-06-30 2016-09-28 瑞斯康达科技发展股份有限公司 Message processing method and device
CN106302784A (en) * 2016-08-27 2017-01-04 浪潮(北京)电子信息产业有限公司 A kind of method and apparatus improving caching speed
CN106487846A (en) * 2015-08-28 2017-03-08 中国电信股份有限公司 The white list updating method of caching system, acquisition and analysis device and caching system
US20170187583A1 (en) * 2015-12-29 2017-06-29 Digital River, Inc. SLA Compliance Determination with Real User Monitoring

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103841045A (en) * 2012-11-22 2014-06-04 中国移动通信集团公司 Internet cache processing method, content detection subsystem and Cache system
CN103338249A (en) * 2013-06-26 2013-10-02 优视科技有限公司 Cache method and device
CN106487846A (en) * 2015-08-28 2017-03-08 中国电信股份有限公司 The white list updating method of caching system, acquisition and analysis device and caching system
US20170187583A1 (en) * 2015-12-29 2017-06-29 Digital River, Inc. SLA Compliance Determination with Real User Monitoring
CN105975433A (en) * 2016-06-30 2016-09-28 瑞斯康达科技发展股份有限公司 Message processing method and device
CN106302784A (en) * 2016-08-27 2017-01-04 浪潮(北京)电子信息产业有限公司 A kind of method and apparatus improving caching speed

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112272123A (en) * 2020-10-16 2021-01-26 北京锐安科技有限公司 Network traffic analysis method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN109995731B (en) 2021-11-30

Similar Documents

Publication Publication Date Title
CN109951500B (en) Network attack detection method and device
CN108737333B (en) Data detection method and device
WO2017107780A1 (en) Method, device and system for recognizing illegitimate proxy for charging fraud
US9456050B1 (en) Browser optimization through user history analysis
US9426046B2 (en) Web page download time analysis
CN107360162B (en) Network application protection method and device
CN103179132A (en) Method and device for detecting and defending CC (challenge collapsar)
CN108011752A (en) Fault locating analysis method and device, computer-readable recording medium
CN108023868B (en) Malicious resource address detection method and device
CN104391979A (en) Malicious web crawler recognition method and device
CN108206769B (en) Method, apparatus, device and medium for filtering network quality alarms
CN107770132A (en) A kind of method and device detected to algorithm generation domain name
CN109982068B (en) Method, apparatus, device and medium for evaluating quality of synthesized video
CN104219230A (en) Method and device for identifying malicious websites
CN110020161B (en) Data processing method, log processing method and terminal
CN108322354B (en) Method and device for identifying running-stealing flow account
CN111355817B (en) Domain name resolution method, device, security server and medium
CN108809769A (en) A kind of method and electronic equipment of detection IPv6 liveness
CN109981389A (en) Phone number recognition methods, device, equipment and medium
CN106411819A (en) Method and apparatus for recognizing proxy Internet protocol address
CN109995731A (en) It improves the method, apparatus of caching discharge flow, calculate equipment and storage medium
US10084876B2 (en) System and method for conditional analysis of network traffic
CN109995886A (en) Domain name recognition methods, device, equipment and medium
KR101560820B1 (en) Appratus and Method for Signature-Based Application Identification
CN113709265A (en) Method, device and system for identifying domain name and computer readable storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant