CN110278128B - WeChat payment data cleaning method - Google Patents

Abstract

The invention belongs to the technical field of wireless communication, and discloses a data cleaning method for WeChat payment. Firstly, establishing an IP address library of a WeChat payment server, reducing the information capturing range and reducing the data volume to be analyzed; then, capturing IP data flow in an IP address base by using a packet capturing tool at an S1-U interface of the LTE core network; cleaning according to the signaling quantity of the TCP data stream; selecting port 443 to transmit the TCP data stream because the wechat payment uses https encryption protocol, and the https protocol uses port 443; determining the data length of the http post signaling; and determining the data length of the http 200ok signaling corresponding to the http post. According to the invention, the relevant characteristics of the micro-signaling payment are summarized by establishing the micro-signaling payment IP address library and researching the micro-signaling payment signaling, and the captured data is screened according to the characteristics, so that effective data is screened out, the analysis data volume is reduced, the analysis efficiency is improved, and the hardware cost is reduced.

Description

WeChat payment data cleaning method

Technical Field

The invention belongs to the technical field of wireless communication, and relates to a data cleaning method applicable to 4G and 5G cashless payment, in particular to a data cleaning method for WeChat payment.

Background

At present, China has stepped into the society of cashless payment, and it is estimated that the amount of cashless payment in China will exceed the United states by 2021, becoming the first worldwide. Among them, payment by WeChat is a main consumption mode, so that each large operator pays more and more attention to the optimization of payment perception. However, the daily data volume in the mobile communication network is particularly large, taking Jiangsu telecom as an example, the data volume of the S1-U interface per day reaches the scale of 2000T, and if data cleaning is not performed, the data volume is too large, so that effective analysis processing cannot be performed on the data volume, or the data volume needs to be completed only by high hardware configuration, and the investment cost is too high. Moreover, the amount of data is such that the video data occupies a larger proportion, resulting in a reduced share of useful data. In addition, with such a large amount of data, it is difficult to store the data without performing data cleansing.

For the sake of understanding the concept of the present invention, a brief description will now be made of a 4G mobile communication network. The structure of the 4G mobile communication network is shown in fig. 1, wherein an Evolved Node B, referred to as eNB, is the name of a base station in lte (long Term evolution). Compared with the Node B in the existing 3G, the method integrates the functions of part of RNC, and reduces the protocol level during communication. The functions of the eNB include: RRM function; IP header compression and user data stream encryption; MME selection when UE is attached; scheduling transmission of paging information; scheduling transmission of broadcast information; and setting and providing measurements of the eNB, etc. SAE is a short writing of System Architecture Evolution, in 4G, LTE mainly studies the long term Evolution technology of 3GPP radio access network, an upgraded LTE Advanced will eventually meet the requirements of international telecommunication union on 4G System, SAE is a long term Evolution of core network, and defines an all-IP Packet core network epc (evolved Packet core), and the System is characterized in that only Packet domain but no circuit domain, based on the all-IP structure, control and bearer separation and network structure flattening, wherein the System mainly includes MME, SGW, PGW, PCRF network elements, wherein SGW is SAE Gateway, and the user plane function of SGSN network element in the original 3G network is sometimes written as S-GW.

The number of users paying by using the WeChat is increased, and the number of times of use of each person per day is counted to be 1-4. However, along with the above, the complaint amount of the WeChat payment with poor perception is more and more, and the optimization investment of three operators (mobile, telecom and Unicom) in China on the WeChat payment with poor perception is more and more. When operators summarize and analyze complaints related to WeChat payment, the fact that the poor perception of part of WeChat payment is not completely caused by the problems of a wireless network is found, and the abnormity of the WeChat payment server is also the main reason of the poor perception of WeChat payment.

When the perception of the WeChat payment is poor, the ordinary user usually cannot complain to the WeChat technology provider, and the first reaction of the user is often caused by the problem of the network of the operator and only complains to the operator. At present, operators have few means for analyzing the WeChat payment perception difference, the number of core networks of the operators is super large, for example, Jiangsu telecom, the data volume of an S1-U interface reaches 2000T every day, if data cleaning is not carried out, the data volume is too large, so that effective analysis processing cannot be carried out on the data volume, or the data volume can be completed only by needing very high hardware configuration, and the investment cost is too high. Meanwhile, unless the operator cooperates with the technical provider of the wechat, the signaling related to the wechat payment cannot be accurately identified on the core network side of the LTE, and the related perception of the wechat payment behavior cannot be analyzed, such as: failure to pay, card on payment, etc.

Disclosure of Invention

The invention aims to provide a WeChat payment data cleaning method aiming at the defects of the data cleaning technology, which can screen the captured data according to characteristics, screen out effective data, reduce the analysis data volume, improve the analysis efficiency and reduce the hardware cost.

In order to achieve the purpose, the technical scheme adopted by the invention is a WeChat payment data cleaning method, which specifically comprises the following steps:

s1: an IP address library of the WeChat payment server is established, the information capturing range is narrowed, and the data volume needing to be analyzed is reduced;

s2: capturing IP data flow in an IP address base by using a packet capturing tool at an S1-U interface of the LTE core network;

s3: cleaning according to the signaling quantity of the TCP data stream;

s4: selecting port 443 to transmit the TCP data stream because the wechat payment uses https encryption protocol, and the https protocol uses port 443;

s5: determining the data length of the http post signaling;

s6: and determining the data length of the http 200ok signaling corresponding to the http post.

Preferably, the bale plucker is tcpdump, but other bale pluckers may be selected.

In step 3, the signaling number of a single TCP data stream is greater than 1, otherwise, effective analysis cannot be performed.

In step 5, the data length of the http post signaling is larger than 300bytes, and the signaling mainly aims to verify the accuracy of the WeChat payment password and confirm or transmit payment amount by the information of the payee.

In step 6, the data length of the http 200ok signaling corresponding to the http post is greater than 100 bytes.

Compared with the prior art, the invention has the beneficial effects that:

1, establishing a WeChat payment IP address library by accurately identifying WeChat payment signaling at a mobile phone end;

2, only collecting data of the payment IP address during information collection, and reducing information capture amount;

3, according to the signaling behavior characteristics of the WeChat payment, cleaning the data which is obviously not the payment;

4, the IP address library for WeChat payment does not need to be completed to the utmost extent because the payment data is huge and the payment is carried out

Drawings

Fig. 1 is a structure diagram of a 4G mobile communication network;

fig. 2 is a flowchart of WeChat payment data cleansing.

Detailed Description

The present invention will be described in further detail with reference to the accompanying drawings and examples.

According to the invention, the relevant characteristics of the micro-signaling payment are summarized by establishing the micro-signaling payment IP address library and researching the micro-signaling payment signaling, and the captured data is screened according to the characteristics, so that effective data is screened out, the analysis data volume is reduced, the analysis efficiency is improved, and the hardware cost is reduced.

Because the WeChat payment information is encrypted and transmitted by http + mmtls (https), the key information cannot be checked through http, but the main signaling for payment during code scanning is as follows:

for 1 code scan payment, 3 sets of http signaling are required, and no code scan signaling is required (code scan requires 2 additional sets of http).

The first http (authen) performs authentication to confirm that the password is correct.

And the second group of http (f2fsucpage) performs WeChat account verification, pushes a face-to-face success page, and supposedly confirms the account information of the merchant.

And the third group of http (f2 fpaycount) performs transfer amount transmission confirmation, which literally means face-to-face payment confirmation, and transmits the payment amount.

Each http transmission also consists of 3 majority: TCP three-way handshake + http transmission + TCP four-way waving, that is, the payment behavior of the WeChat is short connection, the connection needs to be established every time the information is transmitted, and the connection is released after the transmission is finished, so that the load of the server is reduced.

The WeChat payment data cleaning flow chart is shown in FIG. 2:

the first step is as follows: establishing a WeChat payment IP address library

At present, the micro-message payment can not be directly and accurately identified through signaling, and the IP address of the micro-message payment is counted and integrated into a payment IP database through accurately identifying the payment signaling on a mobile phone side.

The mobile phone terminal for collecting the WeChat payment firstly unloads all irrelevant APPs, and because some APPs have behaviors of background access to the network, the identification of the payment IP address is influenced.

Installing share software on the mobile phone, capturing TCP/IP signaling, inputting sum and password after the mobile phone successfully scans the password, and keeping the last password not to be input. Starting sharp software to start packet capturing, inputting the last bit of the password after the interval of 20s, and stopping packet capturing after payment is successful.

According to the operation, the computer opens the signaling analysis, about 20s is the time node of payment, and the corresponding IP address is the IP address of the WeChat payment.

And repeating the above operations to collect IP addresses related to payment, wherein 15 payment IP addresses are arranged currently. The second step is that: WeChat payment signaling capture

The TCPDUMP is installed on the grabbing signaling server, only 15 pieces of information of the payment IP addresses are grabbed at an s1-u interface, the information grabbing amount is reduced, the difficulty of subsequent data analysis is reduced, and the hardware cost is reduced.

The s1-u interface belongs to the interface between ENB and SAE Gateway, and all data of user accessing network passes through the interface.

The third step: payment information cleansing

Although the first step has been to locate the payment IP address, the server to which the IP address corresponds may be configured with other functions. That is, the information interaction between the mobile phone and the IP address is not necessarily all information of the wechat payment.

The number of signaling of one TCP data stream is more than 1;

adopting http protocol data flow;

the port number of one party is 443;

the length of the http post data packet is larger than 300 bytes;

the length of 200ok corresponding to the http post data packet is larger than 100 bytes;

the tcp data stream satisfying the above condition is an effective WeChat Payment data stream.

Note: the IP address that initiates the TCP triple handshake is the handset IP address.

Note: a TCP data flow refers to a data flow in which the source IP and the destination IP are the same and the port numbers are the same.

Experiments show that after the cleaning method is adopted, the data volume paid by WeChat in Jiangsu telecommunication province is about 4T, the calculation amount is greatly reduced, and the processing time is greatly shortened.

The above description of the specific embodiments is not intended to limit the present invention, and any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims (3)

1. A WeChat payment data cleaning method is characterized by comprising the following steps:

s1: an IP address library of the WeChat payment server is established, the information capturing range is narrowed, and the data volume needing to be analyzed is reduced;

s2: capturing IP data flow in an IP address base by using a packet capturing tool at an S1-U interface of the LTE core network;

s3: cleaning according to the signaling quantity of the TCP data stream;

s4: selecting port 443 to transmit the TCP data stream;

s5: determining the data length of the http post signaling, wherein the data length is more than 300 bytes;

s6: and determining the data length of the http 200ok signaling corresponding to the http post, wherein the data length is greater than 100 bytes.

2. The WeChat payment data cleansing method of claim 1, wherein the bale plucking tool in step 2 is tcpdump.

3. The WeChat payment data cleansing method of claim 1, wherein in step 3, the signaling number of a single TCP data stream is greater than 1.

Images