CN110337115B

CN110337115B - Method for judging WeChat payment perception based on TCP (Transmission control protocol)

Info

Publication number: CN110337115B
Application number: CN201910612696.6A
Authority: CN
Inventors: 朱伟; 朱斌; 张峰; 马传项; 王海飞; 朱艳斌
Original assignee: China Communication Technology Co Ltd
Current assignee: China Communication Technology Co Ltd
Priority date: 2019-07-05
Filing date: 2019-07-05
Publication date: 2022-08-23
Anticipated expiration: 2039-07-05
Also published as: CN110337115A

Abstract

The invention discloses a method for judging WeChat payment perception based on a TCP protocol, which comprises the steps of grabbing WeChat payment signaling at an S1-U interface of an LTE core network, storing data, cleaning a TCP data stream, and judging whether TCP three-way handshake is successful or not, wherein if TCP three-way handshake fails, the judgment is directly failed. And then judging the time delay condition of TCP three-way handshake, the time interval of multiple retransmissions of the same data packet, the statistics of the DUPACK time difference of the same data packet, the time delay condition of data flow, [ RST ] time delay condition, the condition caused by abnormal FIN and whether the user perception difference occurs. The method for evaluating the WeChat mobile payment perception based on the TCP protocol comprises a plurality of algorithm judging processes, the payment perception is judged to be poor as long as one condition is met, the plurality of algorithms can increase the reliability, and the problem can be found even if the signaling is incomplete.

Description

Method for judging WeChat payment perception based on TCP (Transmission control protocol)

Technical Field

The invention relates to a mobile payment technology in the field of mobile communication, in particular to a method for evaluating mobile payment perception based on a TCP (transmission control protocol), and particularly relates to a method for judging WeChat payment perception.

Background

With the rapid growth of mobile internet services, the role of service awareness analysis in mobile network maintenance and optimization is more and more important, and the reasons are mainly two aspects: firstly, the explosive growth of OTT services increases the complexity of the services; secondly, the competition is intensified due to the change of market situation. However, the original KPI index is based on the evaluation of "performance of the device itself" and "quality of network operation", and with the increase of OTT services, the original index system has been unable to accurately distinguish the quality of specific services.

In order to evaluate user perception more accurately, an operator builds a system based on a DPI (deep Packet inspection) technology to evaluate the internet perception of a user, wherein DPI is a deep detection technology based on a data Packet, can perform deep detection on different network application layer loads (such as HTTP, DNS and the like), and determines the validity of a message by detecting the payload of the message. The DPI system should support the identification of the following traffic data flows: instant messaging, news, reading, micro-blogging, navigation, maps, video, music, application stores, gaming, payment, animation, mailboxes, P2P services, VoIP services, finance, security disinfection, and the like.

The operators have already implemented the evaluation of the perception of the main website access by using the DPI system, but currently, the mobile internet era has entered, the traffic of the user accessing the website is significantly reduced, and on the other hand, the traffic of the mobile phone APP is suddenly increased, such as: hot applications such as WeChat, microblog, headline, tremble, Payment treasures, and the like.

The DPI can identify various types of instant messaging service data flows, but cannot subdivide services, that is, cannot identify which services are payment services. Hot APP and the like all adopt private encryption protocols to transmit key information, so that DPI cannot accurately identify the behavior of a user, and a DPI system is not good at evaluating mobile payment perception, so that mobile payment perception cannot be evaluated. In view of the large proportion of WeChat payment in mobile payment, it is necessary to deeply research a method for determining WeChat payment perception based on TCP protocol.

The micro-message payment information is encrypted and transmitted by http + mmtls (https), key information cannot be checked through http, but the main signaling for code scanning payment is 3 groups of http signaling required for 1 time of code scanning payment, and no signaling for code scanning is contained (the code scanning requires 2 additional groups of http).

The first http (authen) performs authentication to confirm that the password is correct.

And (3) carrying out WeChat account verification on the second group of http (f2fsucpage), and pushing a face-to-face success page, wherein the confirmation of the account information of the merchant is presumed.

And the third group of http (f2 fpaycount) performs transfer amount transmission confirmation, which literally means face-to-face payment confirmation, and transmits the payment amount.

The transmission of each set of http consists of 3 majority: TCP three-way handshake, http transmission and TCP four-way waving are performed, namely, payment behaviors of WeChat are short connection, connection needs to be established every time information is transmitted, and connection is released after transmission is finished, so that load of a server is reduced.

Because the http protocol packet header is complex and has high processing complexity, and the tcp protocol packet header has fixed length and simple processing, only the data packet related to the tcp protocol needs to be extracted. Based on the main signaling condition of the micro-signaling code scanning payment, no method for effectively judging the micro-signaling payment perception based on the TCP (transmission control protocol) is found at present.

Disclosure of Invention

The invention aims to solve the problem that the existing DPI system cannot evaluate the WeChat payment perception of a mobile phone user, so that a network short board can be accurately and quickly found, the optimization direction is indicated, an operator is helped to improve the network service quality, and the user satisfaction degree is improved.

To this end, the invention provides a method for judging WeChat payment perception based on a TCP protocol, which specifically comprises the following steps:

the first step is as follows: capturing a WeChat payment signaling at an S1-U interface of an LTE core network, and storing data;

the second step is that: the TCP data stream is cleaned, and the data stream needing to be processed is reduced;

the third step: judging whether the TCP three-way handshake is successful or not, if the TCP three-way handshake is failed, directly judging that the TCP three-way handshake is failed, and if the TCP three-way handshake is successful, switching to the next step for judgment;

the fourth step: judging the TCP three-way handshake delay condition, and if the TCP three-way handshake delay condition is higher than a set threshold, judging that the payment is stuck;

the fifth step: judging the time interval of multiple retransmissions of the same data packet, based on the time difference from the first transmission to the last transmission, and if the time interval is higher than a set threshold, judging that the payment is stuck;

and a sixth step: the DUP ACK time difference statistics of the same data packet is judged, the DUP ACK indicates which sequence number the message is lost, the time difference from the first time to the last time is taken as the standard, and if the time difference is higher than a set threshold, the payment is judged to be blocked;

the seventh step: judging the time delay condition of a data stream, adopting the time difference between the first signaling and the last signaling of TCP three-way handshake, and judging that the payment is stuck if the time delay condition is higher than a set threshold;

eighth step: judging [ RST ] time delay condition, [ RST ] represents reset and is used for closing abnormal connection, in the same TCP data stream, the time difference between the last [ RST ] and the latest data packet before the first [ RST ] is within a threshold, and if the time difference is higher than the set threshold, judging that the payment is blocked;

the ninth step: in the same TCP data flow, before the first FIN, if no data is transmitted within the same direction threshold time, the failure caused by the abnormal FIN is judged, if the failure is higher than the set threshold, the payment is judged to be blocked;

the tenth step: in the same TCP data flow, if poor user perception occurs, the mobile phone side is about to prompt that payment fails, and if the user perception is higher than a set threshold, the payment is judged to be blocked;

the fourth step to the tenth step are not in sequence, and can be judged at the same time.

In step three, in the same TCP data flow, the TCP three-way handshake includes three signaling: the time difference between [ SYN ], [ SYN, ACK ] and [ ACK ], [ SYN ] and [ ACK ] is defined as TCP three-way handshake delay, and the delay is defined as the perception difference caused by the large TCP three-way handshake delay above 3 s.

The relation between [ SYN ], [ SYN, ACK ] and [ ACK ] is as follows: seq +1 of [ SYN ] is [ SYN, ACK ] is [ ACK ] is Seq of [ ACK ].

In the fourth step to the tenth step, the threshold value can be set by self.

Preferably, in the fifth step, the time interval of the multiple retransmissions is based on a time difference between the first transmission and the last transmission.

Preferably, in step eight, the threshold is 2 seconds.

Preferably, in step nine, the threshold is 5 seconds.

In the tenth step, the user perception difference is the situation that the FIN initiated by the server and the FIN responded by the mobile phone extend beyond a set threshold or only the FIN initiated by the server but no mobile phone responds.

Compared with the prior art, the invention has the beneficial effects that:

the method for evaluating the WeChat mobile payment perception based on the TCP protocol comprises a plurality of algorithm judging processes, the payment perception is judged to be poor as long as one condition is met, the plurality of algorithms can increase the reliability, and the problem can be found even if signaling insufficiency occurs.

2, the invention only processes TCP data packet, because the size of TCP data packet header is fixed, the data is put into storage simply. The HTTP data packet can be evaluated and sensed more accurately, but the HTTP data packet head is changed dynamically, and the data storage is complex.

3, the invention only processes TCP data packets, is suitable for all application perception evaluations adopting TCP protocols and has wider application range.

Drawings

Fig. 1 is a flow chart of the processing of the WeChat Payment perception algorithm of the present invention.

Detailed Description

The present invention will be described in detail with reference to the accompanying drawings.

The WeChat payment perception algorithm processing flow of the invention is shown in figure 1, and comprises the following steps:

the first step is as follows: and capturing the WeChat payment signaling at an S1-U interface of the LTE core network, and storing data.

The second step is that: the TCP data flow effectiveness is cleaned, the data flow needing to be processed is reduced, and the efficiency is improved.

The third step: and judging whether the TCP three-way handshake is successful or not, directly judging that the TCP three-way handshake is failed, and judging whether the TCP three-way handshake is successful or not to the next step.

The fourth step: if the TCP three-way handshake delay judgment is higher than the set threshold, the judgment is that the payment is stuck, and the threshold value can be set by self.

The fifth step: and (4) judging the time interval of multiple retransmissions of the same data packet by taking the time difference from the first transmission to the last transmission as the standard, if the time difference is higher than a set threshold, judging that the data packet is a payment card, and setting the threshold value by self.

And a sixth step: and (4) counting the time difference of the DUP ACK of the same data packet, wherein the DUP ACK indicates which sequence number the message is lost, and if the time difference from the first time to the last time is higher than a set threshold, the judgment is that the message is blocked, and the threshold value can be set by self.

The seventh step: and (3) judging the time delay of one data stream, namely judging that the data stream is a payment card pause if the time difference between the first signaling and the last signaling of the TCP three-way handshake is higher than a set threshold, and setting the threshold value by self.

Eighth step: RST delay decision, [ RST ] indicates reset for abnormal connection closure. In the same TCP data stream, the time difference between the last [ RST ] and the latest packet before the first [ RST ] is more than 2 s. If the threshold value is higher than the set threshold value, the payment is judged to be blocked, and the threshold value can be set by self.

The ninth step: in the same TCP data flow, no data is transmitted in the same direction for 5s before the first FIN, and it is determined as a failure due to an abnormal FIN. If the threshold value is higher than the established threshold value, the payment is judged to be card-pause, and the threshold value can be established by self.

The tenth step: in the same TCP data flow, the FIN initiated by the server and the FIN responded by the mobile phone are prolonged to be more than 2s, or only the FIN initiated by the server and the FIN not responded by the mobile phone are defined as poor user perception, at this moment, the mobile phone side prompts payment failure, and the core network side actually has paid successfully. If the threshold value is higher than the established threshold value, the payment is judged to be card-pause, and the threshold value can be established by self.

The fourth step to the tenth step are not in sequence, and judgment can be carried out simultaneously.

The several algorithms involved therein are explained as follows:

TCP data flow definition: within 100s, Stream indexes are the same and are defined as the same TCP data Stream.

1. Payment card algorithm

(1) TCP three-way handshake delay evaluation algorithm:

in the same TCP data flow, the TCP three-way handshake includes three signaling: [ SYN ], [ SYN, ACK ] and [ ACK ]. The time difference between [ SYN ] and [ ACK ] is defined as TCP three-way handshake delay, and the delay is defined as the perception difference caused by the large TCP three-way handshake delay above 3 s.

The relationship between [ SYN ], [ SYN, ACK ] and [ ACK ]: seq +1 of [ SYN ] is [ SYN, ACK ] is [ ACK ] is Seq of [ ACK ].

Note 1: if [ SYN ] is lost, the flag bit is replaced with [ SYN, ACK ], that is, the packet with SYN ═ 1 in the first Flags is used as the flag bit.

Note 2: the [ ACK ] received after FIN is not processed.

(2) Transmission delay evaluation algorithm

Host message retransmission is the most basic error recovery function of TCP and its purpose is to prevent message loss. There are many possible factors for packet loss, including application failure, routing device overload, or temporary service outages. The packet level speed is high and usually the packet loss is temporary, so it is important that TCP can detect and recover the packet loss.

In the same TCP data stream, the number of the Lenth and the number of the Seq are the same as the (ACK number), and the data transmission directions are the same, so that the data packets are regarded as the same data packet. If the time difference between the first packet and the last packet exceeds 2s, the transmission is abnormal due to retransmission.

Note 1: the flag contains SYN 1 or FIN 1, and is discarded without being decided.

Note 2: the TCP Retransmission after FIN is not processed and is directly discarded.

(3) DUP ACK delay evaluation algorithm

In the same TCP data flow, if the time delay between the original data packet and the last retransmission exceeds 2s, the transmission is abnormal due to packet loss.

The repeated ACK refers to a type of TCP message sent when the receiver receives the out-of-order message. TCP uses the sequence number and acknowledgement number of the header to effectively ensure that data is received and reassembled in the order sent.

The IP address pair, the port pair, the Seq number and the ACK number are the same, and if the time delay between the original [ ACK ] packet and the last retransmission [ TCP DUP ACK ] exceeds 2s, the transmission is abnormal caused by packet loss retransmission.

ACK in Flags is 1 and len is 0, which is [ TCP DUP ACK ]. If SYN is 1 or FIN is 1 in Flags, the process is skipped and not processed.

Note 1: the TCP DUP ACK after FIN is not processed and is discarded directly.

Note 2: at present, the original packet cannot be accurately identified, and only the time delay between DUP ACK packets can be calculated.

(4) Data flow delay evaluation algorithm

In the same TCP data flow, the time delay between the first signaling and the last signaling is more than 5 s.

Note: SYN deletion, replacement with SYN ACK

(5) [ RST ] time delay evaluation algorithm

[ RST ] indicates reset for closure of the exception connection. Firstly, when RST packets are sent to close connection, the packets in the buffer area are directly discarded without waiting for the packets in the buffer area to be sent out, and RST is sent. And secondly, after the receiving end receives the RST packet, the receiving end does not need to send ACK packet confirmation.

When to send the RST packet:

firstly, a SYN establishing connection reaches a certain port, but no monitored service exists on the port;

TCP receives a section of a connection which does not exist at all;

and thirdly, when the request is overtime, the SO _ RCVTIMEO option of setsockopt is used for setting the overtime time of recv, and when the received data is overtime, the RST packet is sent.

In the same TCP data stream, the time difference between the last [ RST ] and the latest packet before the first [ RST ] is more than 2s, and the transmission abnormity caused by [ RST ] is defined.

Note: the [ RST ] after FIN is skipped directly without algorithmic processing.

2. Payment failure algorithm

(6): TCP three-way handshake failure

And if the same TCP data stream does not have corresponding [ ACK ], determining that the TCP three-way handshake fails. Multiple three-way handshake failures exist in 2s, and only 1 three-way handshake failure is determined.

The TCP three-way handshake contains three pieces of signaling: [ SYN ], [ SYN, ACK ] and [ ACK ]. The time difference between [ SYN ] and [ ACK ] is defined as TCP three-way handshake delay, and the delay is defined as perception difference caused by large TCP three-way handshake delay above 3 s.

The relationship of [ SYN ], [ SYN, ACK ] and [ ACK ]: seq +1 of [ SYN ] is [ SYN, ACK ] is [ ACK ] is Seq of [ ACK ].

Note 1: the [ SYN ] is lost and replaced by [ SYN, ACK ], that is, the packet with SYN ═ 1 in the first Flags is used as the flag bit.

Note 2: the [ ACK ] received after FIN is not processed.

(7): abnormal FIN failure

In the same TCP data flow, no data is transmitted in the same direction 5s before the first FIN, and it is determined that the failure is caused by the abnormal FIN.

Note: other FINs are not processed

[ TCP Previous segment not captured ], how to accurately distinguish without capturing the Previous segment of TCP?

The reason analysis of the TCP Previous segment not captured means that the message is not captured and lost.

3. Payment perception difference algorithm

(8): FIN and FIN algorithm

In the same TCP data flow, the FIN initiated by the server and the FIN responded by the mobile phone are prolonged to be more than 2s, or only the FIN initiated by the server and the FIN not responded by the mobile phone are defined as poor user perception, at this moment, the mobile phone side prompts payment failure, and the core network side actually has paid successfully.

Note: the same data flow refers to a data flow with the same source IP address, target IP address, source port number and target port number. Through verification, the accuracy of the algorithm can reach 89%, the perception condition of mobile payment can be evaluated, and an operator can relate to other databases according to the result output by statistics, such as information of a cell, a user, longitude and latitude and the like, and formulate an accurate optimization strategy.

The above-mentioned embodiments only express several embodiments of the present invention, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention.

Claims

1. A method for judging WeChat payment perception based on a TCP (Transmission control protocol) protocol is characterized by comprising the following steps of:

the fifth step: judging the time interval of multiple retransmissions of the same data packet, and if the time interval is higher than a set threshold, judging that the data packet is a payment card;

and a sixth step: the statistics of the time difference of the DUPACK of the same data packet is judged, the DUPACK indicates which serial number the message is lost, the time difference from the first time to the last time is taken as the standard, and if the time difference is higher than a set threshold, the judgment is that the message is blocked;

the seventh step: judging the time delay condition of a data stream, adopting the time difference between the first signaling and the last signaling of TCP three-way handshake, and if the time difference is higher than a set threshold, judging that the payment is stuck;

the eighth step: judging [ RST ] time delay condition, [ RST ] represents reset and is used for closing abnormal connection, in the same TCP data stream, the time difference between the last [ RST ] and the latest data packet before the first [ RST ] is within a threshold, and if the time difference is higher than the set threshold, judging that the payment is blocked;

the tenth step: in the same TCP data stream, if poor user perception occurs, at the moment, the mobile phone side is prompted to fail to pay, and if the perception is higher than a set threshold, the payment is judged to be blocked;

2. The method for determining WeChat payment awareness based on TCP protocol as claimed in claim 1, wherein: in step three, in the same TCP data stream, the TCP three-way handshake includes three signaling: the time difference between [ SYN ], [ SYN, ACK ] and [ ACK ], [ SYN ] and [ ACK ] is defined as TCP three-way handshake delay, and the delay is defined as the perception difference caused by the large TCP three-way handshake delay above 3 s.

3. The method for determining WeChat payment awareness based on TCP protocol of claim 2, wherein the relationship between [ SYN ], [ SYN, ACK ] and [ ACK ] is: seq +1 of [ SYN ] is [ SYN, ACK ] is [ ACK ] is Seq of [ ACK ].

4. The method for determining WeChat payment awareness based on TCP protocol as claimed in claim 1, wherein: in the fourth to tenth steps, the threshold can be set by self.

5. The method for determining WeChat payment awareness based on TCP protocol as claimed in claim 1, wherein: in the fifth step, the time interval of the multiple retransmissions is based on the time difference between the first transmission and the last transmission.

6. The method for determining WeChat Payment awareness based on TCP protocol according to claim 1, wherein: in the eighth step, the threshold is 2 seconds.

7. The method for determining WeChat payment awareness based on TCP protocol as claimed in claim 1, wherein: in the ninth step, the threshold is 5 seconds.

8. The method for determining WeChat Payment awareness based on TCP protocol according to claim 1, wherein: in the tenth step, the user perception difference is that the time delay between the FIN initiated by the server and the FIN responded by the mobile phone exceeds a set threshold or only the FIN initiated by the server but no mobile phone responds.