TWI514823B - A traffic classification system based on message size sequence and method thereof - Google Patents

Description

Network traffic identification system based on message length sequence and method thereof

The present invention relates to a network traffic classification technique, and more particularly to a network traffic identification system and method for analyzing packet attributes based on a sequence of message lengths.

With the rapid development of the Internet, various web applications are required to transmit, transmit, or communicate over the Internet. In the process of transferring data through the network application, the data will be divided into multiple packets. Since there are many harmful garbage packets on the current network, it is very important to effectively identify the traffic content to ensure the security of data transmission.

For network applications included in network traffic, since the packet contains an IP address and a port, an early connection can be used in the packet identification (well-known). The port method determines, that is, pre-plans the port number, and regulates different network applications to use different port numbers. For example, port 80 is used for http protocol, but many communication softwares also use port 80. , making it impossible to identify the web application to which the packet belongs by using the port number. Moreover, the harmful seals on many existing networks The packet is a technique of randomly configuring port randomization, so that the use of the aforementioned method cannot effectively identify a harmful packet. In addition, in order to solve the packet identification problem, another "package content feature value" comparison method is widely used today, that is, by comparing the specific content of the packet content to identify the packet, for example, antivirus software It can compare whether the content of the packet is equivalent to the keyword in the database to determine whether to exclude it. However, more and more web applications use packet encryption technology, which makes it impossible to use the above method to parse the content of the packet. At the same time, some malicious programs can use it. The method of masquerading the content of the packet is intended to avoid the detection of the content feature value. Therefore, the problem of misinterpretation or missed may occur, and the method of detecting the content of the packet has a problem of infringing personal privacy. Other considerations, including such transport layer behavior characteristics comparison methods, need to collect enough transport layer information to obtain the correct judgment ability, and also lead to long judgment time.

Therefore, how to overcome the existing network traffic classification technology, especially in the absence of infringement of personal privacy and without the influence of packet encryption technology, providing effective network traffic identification has become a problem that is currently being solved.

In view of the above disadvantages of the prior art, the object of the present invention is to provide a network traffic identification system based on a message length sequence and a method thereof for determining the size of a packet and the order to determine the network application to which the traffic belongs.

To achieve the foregoing and other objects, the present invention provides a network traffic identification system based on a message length sequence, which includes: a database, a traffic collection module, a traffic teardown module, an identification module, and a decision module. The database is pre-stored with a common sub-sequence set corresponding to the length of various web applications. The traffic collection module is configured to collect network traffic, and the traffic disassembly module is configured to disassemble the network traffic into multiple connections according to the traffic information, and extract multiple packets in each connection. Transmitting direction and length to generate a sequence of length characteristics corresponding to each of the links by the plurality of packets, wherein the identification module is configured to share a subsequence with a length of the length feature sequence and various network applications in the database And determining, by the set of the shared subsequences of the length, obtaining the highest degree of similarity with the length feature sequence, and finally determining, by the determining module, the connection to the known network according to the number of the highest similarity obtained by the identification module. Road application or unknown web application.

In an embodiment, the traffic teardown module removes a packet whose packet length is the maximum transmission unit and a packet whose payload length is zero from the plurality of packets of the connection.

In another embodiment, the message length sequence based network traffic identification system further includes an application representative set generation module. The application represents a collection generation module that uses known network traffic for training, and uses the traffic disassembly module to disassemble known network traffic to generate a sequence of length characteristics of each connection, and in groups of two The method calculates the longest length shared subsequence of any two connections, and collects the longest length shared subsequences calculated by the various combinations to generate a common subsequence set corresponding to the length of the application.

The invention also provides a network traffic identification method based on a message length sequence, which comprises: providing a common sub-sequence set corresponding to various network application programs; collecting network traffic and disassembling the network traffic into a plurality of connections, Obtaining a transmission direction and a length of a plurality of packets in each of the connections to generate a sequence of length characteristics corresponding to each of the links; Sharing a subset of sub-sequences with the lengths of the various network applications, such that the one with the highest degree of similarity to the length feature sequence is obtained from the set of shared sub-sequences of the length; and the number of the highest similarity of the subset of the shared sub-sequences according to the length Determine if the connection is a known web application or an unknown web application.

In an embodiment, before extracting the transmission direction and the length of the plurality of packets in each connection, the method further includes removing a packet whose packet length is the maximum transmission unit from the plurality of packets of the connection, and the packet content length is zero. The package.

In yet another embodiment, the length shared subsequence set is trained by using known network traffic prior to identification, including: disassembling the known network traffic into a plurality of connections, and extracting each of the connections The direction and length of the plurality of packets in the line are generated to generate a sequence of length characteristics corresponding to each of the links, and the length feature sequence of each of the lines calculates the longest length common subsequence of the two lines in a pairwise manner And collecting the longest length shared subsequence calculated by various combinations to generate a set of shared subsequences of the length.

Compared with the prior art, the network length identification system based on the message length sequence and the method thereof can be used for detecting a network application that is encrypted or deliberately concealing communication protocols and communication contents, thereby providing a network Road managers get sufficient information to perform flow control. Compared with the traditional traffic detection method, whether it is the recognition of the recognized connection method used by the general network application or the comparison of the feature values of the package content, it is not only easy to misjudge and the judgment time is long, but the present invention is The way to extract the behavior characteristics of the transport layer can be based on the characteristics of the network application behavior, rather than analyzing the characteristics of the packet content, so that the encryption can be The protocol's web application detects and eliminates the need to parse the contents of the package without infringing on the privacy of the individual. Therefore, the present invention can solve the problem that the traditional network application that encrypts the communication or deliberately hides the package cannot be detected. .

1‧‧‧flow chart

11‧‧‧First stage

110~113‧‧‧ Process

12‧‧‧ second stage

120~123‧‧‧Process

2, 3‧‧‧Network traffic identification system based on message length sequence

21, 31‧‧ ‧ database

22, 32‧‧‧Flow collection module

23, 33‧‧‧Flow Disassembly Module

24, 34‧‧‧ Identification Module

25, 35‧‧‧ Determination module

36‧‧‧Application Representation Collection Generation Module

100‧‧‧Network traffic

200‧‧‧ Known network traffic

S601~S604‧‧‧Steps

1 is a flow chart showing the training and classification of the network length identification system based on the message length sequence of the present invention; FIG. 2 is a diagram showing the network flow identification system based on the message length sequence of the present invention in the classification stage. System architecture diagram; FIG. 3 is a system architecture diagram of the network length identification system based on the message length sequence of the present invention in the training phase; FIG. 4 is a diagram showing the network traffic identification system based on the message length sequence of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 5 is a schematic diagram showing an embodiment of a recognition process of a message length sequence based network traffic identification system of the present invention; and FIG. 6 is a diagram illustrating network length identification based on a message length sequence of the present invention. Step diagram of the method.

The embodiments of the present invention are described below by way of specific examples, and those skilled in the art can readily understand other features and functions of the present invention from the disclosure herein. The invention may also be embodied or applied by other different embodiments.

Referring to Figure 1, there is shown a flow chart of the training and classification of the network traffic identification system based on the message length sequence of the present invention. As shown The flow chart 1 shows that the present invention can be divided into a first stage 11 and a second stage 12. In order to obtain the network application connection behavior characteristic data as a identification basis, the present invention needs to be pre-trained to obtain various network applications. The connection behavior characteristics data, and through the characteristics of the connection behavior to determine the network application of the package.

The first stage 11 represents the training phase. First, in the process 110, a network application is tracked to complete a traffic collection. In order to analyze the behavior characteristics of each network application, the present invention uses a set of "network application traffic collection technology" in a Executing the network application to be collected on the host, limiting the network application and the nickname used by it, so that only the network application's network traffic can pass through the host network interface, and the network traffic is in and out. The traffic recording technology is used to record the required traffic for analysis, that is, the process 110 is to collect the traffic of the network application, and collect enough network traffic (the integrity of the network traffic will affect the judgment accurately). Sex). Therefore, a web application is trained to record packets passing through the host for analysis of the connection behavior of the web application.

Then in the process 111, the flow characterizing of each connection is taken to disassemble the recorded network traffic into multiple flows, although only one network is trained at a time during the training phase. Application, but the web application will have different connection behavior under different objects, which will result in different packet sequences. Therefore, the network traffic will be classified according to the delivery object, for example, based on the IP address, it will be different. The traffic of the delivery object is separated to avoid mixing the traffic of multiple delivery objects. Incorrect judgment.

In the process 112, the longest shared subsequence in each flow is developed. To put it simply, the subsequences represented by each flow can be obtained. Then, the longest one of the common subsequences can be found for each different traffic, and the common subsequence can be used to represent the network application in training. When a certain network traffic has a similar longest shared subsequence, there is a chance to determine that the network traffic may belong to the network application corresponding to the longest shared subsequence.

In the process 113, it is to find a set of representative length feature sequences of the network application, that is, to find a set of common sub-sequences of the length of each sub-sequence of the network application in different traffic. In the previous process 112, a plurality of longest shared subsequences may be obtained. Therefore, in the process 113, the longest shared subsequences are grouped together, and the set represents the trained web application.

Then, the second stage 12 is entered, and the second stage 12 is the actual classification stage, that is, the length shared sub-sequence set representing the various network applications obtained by the first stage 11 is used as a reference for comparison with the real network traffic. By comparing the similarity gap between the sub-sequence sets and the length of the sub-sequences representing the length of each web application, it is inferred which network application the captured network connection belongs to.

First, in the process 120 and the process 121, the actual network traffic is also collected and traffic decomposition is performed. The traffic is also disassembled into multiple pieces according to the IP address as a resolution basis. Connect, so that each object's network traffic can be separated to facilitate later Identification of the packet sequence.

Next, in the process 122, the network traffic is classified to achieve the purpose of flow classification. Briefly, the packet sequence of the network traffic obtained by the process 121 is compared with the various sub-sequence sets representing the length of the different network applications obtained in the first stage 11, thereby finding the closest network. The packet sequence of the traffic.

Finally, in the process 123, the network application that is obtained by using the packet sequence of the network traffic to be determined by the previous process 122 is found to be the closest to the network application, and the obtained network traffic can be obtained. The web application to which it belongs.

From the above, you can find out the connection behavior of the web application through training, and then compare it with the new network connection that you can retrieve later to determine the network application of the new network connection. . Need to explain, the above is only a description of the operation flow of a single web application comparison. Therefore, if multiple web applications need to be compared, it is only necessary to operate the process multiple times for different web applications. can.

Referring to FIG. 2, it is a system architecture diagram of the network length identification system based on the message length sequence of the present invention in the classification stage. As shown in the figure, the network traffic identification system 2 based on the message length sequence mainly describes the network traffic identification performed in the second phase of FIG. 1 , wherein the network traffic identification system 2 based on the message length sequence includes The database 21, the flow collection module 22, the flow disassembly module 23, the identification module 24, and the determination module 25.

The database 21 is for pre-storing the length of various web applications. A collection of shared subsequences. As described above, the length common subsequence set is used to represent a certain network application, so that before the identification, a training set can be used to obtain a common subsequence set representing the length of each web application. More details will follow.

The traffic collection module 22 is configured to collect network traffic 100, that is, to collect network traffic 100 through a network device, the network traffic 100 may be mixed with packets of multiple network applications, or belong to the same network application. Packages that communicate with different objects but are collected and then disassembled for comparison.

The traffic disassembly module 23 is configured to disassemble the network traffic 100 collected by the traffic collection module 22 into a plurality of connections according to the traffic information, that is, disassemble according to different delivery objects, and the foregoing traffic information may be a source. IP address, source nickname, destination IP, destination nickname, and transport protocol, etc., thereby disassembling into multiple connections, and then taking the transmission direction and length of the plurality of packets in each connection to The plurality of packets of the connection result in a message size sequence corresponding to the connection.

More specifically, when disassembled into multiple connections, each connection is a packet transmission with a single object. Taking one of the connections as an example, multiple packets in the same connection are sequentially arranged. And finding the transmission direction and length of the packets, wherein the transmission direction can be positive for the connection initiator of the connection, and vice versa, and finally, the multiple packets in the connection are used to generate the length corresponding to the connection. The sequence of features can be combined as a sequence of packets representing the connection.

In addition, in the specific implementation, the flow dismantling module 23 is connected to each line. The packet in which the packet length is the maximum transmission unit and the packet whose packet content length is zero are removed from the plurality of packets. Since the network packet is captured, the obtained packet is not necessarily useful for finding the packet sequence of the network application. For example, the packet can be divided into a packet with a control message and a data message. The packet of (data message) will be transmitted in the largest packet mode (to shorten the delivery time) after the server and the user are connected, that is, the size of the packet used to carry the data message will reach the size. The maximum transmission length, so that the difference cannot be seen by the packets. In contrast, the packet with the control message may be a message with an account password, and thus the packet size may vary due to the connection process. Therefore, the traffic disassembly module 23 first removes the packet of the length of each connection, and the packet length is the maximum transmission unit and the content of the packet is zero, so as to improve the availability of the subsequent packet sequence establishment.

The identification module 24 is configured to compare the length feature sequence of a connection obtained by the traffic disassembly module 23 with a length common subsequence set of various network applications prestored in the database 21, thereby The highest commonality between the length and the length of the feature sequence is found in the set of length shared subsequences, that is, the higher the similarity, the closer the network connection behavior characteristics are.

Finally, the decision module 25 determines whether the connection belongs to a known web application or belongs to an unknown web application according to the number of similarities obtained by the identification module 24. Specifically, when the identification module 24 performs identification, more than one length feature sequence and desire may not be found or found. The length characteristic sequence of the identified connection is similar. In this case, if the number is zero or more than one, the connection is determined to be an unknown network application, and if the most similar number is only one, the connection may be determined. Is a known web application.

In a specific implementation, the length feature sequence formed by the plurality of packets in the traffic is numerically defined according to the transmission direction and length of each packet in the plurality of packets, and the values are sequentially arranged. As mentioned above, the direction of transmission can be positive or negative, and the size of the packet can be given a numerical definition. For example, if a packet is from the originating end to the receiving end and the packet size is 20 KB, a value of +20 can be given. Therefore, the length feature sequence can be defined by the values given by the plurality of packets according to the direction of their transmission and the length of the packet, and the defined sequence can be used for subsequent similarity judgment.

Referring to FIG. 3, it is a system architecture diagram of the network length identification system based on the message length sequence of the present invention in the training phase. As shown in the figure, the network traffic identification system 3 based on the message length sequence includes, in addition to the database 31, the traffic collection module 32, the traffic disassembly module 33, the identification module 34, and the determination module 35, In the training phase, an application representative set generation module 36 for generating a set of representative length feature sequences for each web application.

It should be noted that, in the training phase, the identification module 34 and the determination module 35 need not operate. In addition, the data received by the network traffic identification system 3 based on the message length sequence is aware of the network to which the packet belongs. Why is the application known for network traffic 200, and not the network traffic 100 that does not know the network application to which the packet belongs. Therefore, the identification module 34 and The decision module 35 is not required to operate during the training phase, and the network traffic 100 is not required to be provided.

The application representative collection generation module 36 is trained by using the known network traffic 200, and the known network traffic is disassembled through the traffic disassembly module 33 to generate a length characteristic sequence of each connection, and then The length characteristic sequences of the lines calculate the longest length subsequence of the two lines in a pairwise manner, and collect the longest length common subsequence calculated by various combinations to generate the length. A collection of shared subsequences. From the above, in order to know the possible packet sequence of various network applications, the application representative set generation module 36 is used to find a common sub-sequence set of various lengths corresponding to different network applications.

Specifically, the known network traffic 200 is also collected by the traffic collection module 32. The known network traffic 200 herein refers to packet collection only for a single network application, and then transmitted to the traffic teardown module. Group 33, the traffic disassembly module 33 also disassembles the known network traffic 200 into a plurality of connections, and may also be based on the foregoing traffic information, such as source IP address, source nickname, destination IP, destination. After the nickname and the transmission protocol, etc., the transmission direction and length of the plurality of packets in each connection are retrieved, so that the plurality of packets of the connection are generated to generate a length characteristic sequence corresponding to the connection, and the traffic collection module The function of the 32 and the flow disassembly module 33 is the same as that of the flow collection module 22 and the flow disassembly module 23 in FIG.

Then, the sequence of length features generated by the different connections is transmitted to the application representative set generation module 36, and the application representative set generation module 36 will be in groups of two or two, that is, a set of two wires. To calculate two The longest length of the connection shares a subsequence, that is, the longest of the shared subsequences in the two connections, and then, after collecting the longest common subsequences calculated by the various combinations (either of the two groups), This length shares a set of subsequences. It can be seen that the length shared subsequence set is a possible set containing packets transmitted by the web application.

In addition, in the foregoing calculation process, if a sequence of a short length is found to exist in a common sub-sequence of a long length, that is, the shorter sequence has been included by other common sub-sequences of a longer length, Those who have a shorter length and who have been included in other shared subsequences are not required to be a member of the length shared subsequence set.

Referring to Figure 4, there is shown a schematic diagram of a training process embodiment of a message length sequence based network traffic identification system of the present invention. The figure mainly illustrates how to find the longest length shared subsequence. As shown in the figure, the possible packet sequence of a connection feature of a network application is 1-2-3-4-5. During the training process, the length characteristic sequence of the A connection is 1-2-3- 4, and the length characteristic sequence of the B connection is 2-3-4-5. Thereafter, the application representative set generation module 36 of FIG. 3 performs calculations in groups of two to find two connections. The longest length between the lines shares a subsequence, which in this example is 2-3-4.

It can be seen from the above that the collected network traffic is disassembled into a plurality of links, and then the longest length common subsequence is calculated in groups of two, and finally, a plurality of longest length common subsequences are obtained, that is, The application of the diagram 3 represents a set of shared sub-sequences of the corresponding network application generated by the collection generation module 36. In addition, if there is a group of the longest lengths found together When the sequence is, for example, 3-4, the longest length shared subsequence (3-4) may be included in the longest length shared subsequence (2-3-4) obtained by the A line and the B line in the figure, and thus includes The longest length shared subsequence of 3-4 is not required to be added to the length shared subsequence set.

Referring to FIG. 5, which is a schematic diagram of an embodiment of an identification process of a network traffic identification system based on a message length sequence of the present invention, that is, FIG. 5 mainly illustrates how to identify similarities between length feature sequences. After training a network application, a possible packet sequence in the length shared subsequence set obtained is 1-2-3-4-5. To facilitate the similarity comparison, the packet direction and the packet may be used according to the packet direction and the packet. The length size is given a numerical definition. As shown, the possible packet sequence can be defined as a value of +10-10+15-10+20 in sequence, wherein numbers 10, 15, 20, etc. are only examples of packet sizes.

After that, in the new network traffic identification process, the network traffic will also be split into multiple connections. Among them, there is a connection sequence of packets, as in case 1, which contains 2-3-4-5 packets. Sequence, and get the value of -10+15-10+20 according to the direction and size of the packet. Compared with the possible packet sequence (1-2-3-4-5), there are four packets in the sequence that match and the values are equal. That is to say, the connection of Case 1 is similar to the possible packet sequence.

Consider the case 2, the other connection contains a packet sequence of 1-2-3-4-5, and the value of +10-8+16-10+19 is obtained according to the direction and size of the packet, and the possible packet sequence (1) -2-3-4-5) In comparison, there are five packet sequences in the sequence, but the values are similar to the packet sequence (+10-10+15-10+20), so the similarity between the two is also high. The difference in the above values mainly indicates the difference in the size of the packet. However, if the sign is the same, the direction of the transfer is the same, but the seal is the same. The packet size can be tolerated with the given error value (as appropriate) to avoid possible false positives due to small differences in packets.

If the similarity between Case 1 and Case 2 is considered, Case 2 itself has more than one packet in comparison with Case 1. Furthermore, if the value of Case 2 is also within the tolerable range, then the similarity of Case 2 can be determined to be high. In case 1.

The present invention does not consider the sequential time for the captured packet, and only considers the order in which the packets appear. After the sender sends out several packets, the receiving end temporarily stores the packets in the temporary storage area, and then determines whether the packet is present. The pre-stored packet sequence is similar to the sequence in which the packets are collected. In short, the packet sequence is incorrect (unlike a possible packet sequence of a web application) to determine that the packet is not a network application, only When the order needs to conform to the packet order defined in the database, it will be further considered whether the packet sizes are similar.

The above is to avoid misidentification of packets in different orders, because in the same network application, different packet sequences represent different application meanings, for example, the training sequence is 1-2-3, if the new network traffic is disassembled If the sequence of the outgoing packets is 3-1-2, the two cannot be considered to have high similarity because they have the same size. Furthermore, in the past, when judging the similarity level, only considering whether the packets are similar (possibly the number of packets or the contents of the packet), the two connections having the same size but different ordering may be similar, but more The arrangement of the packets is different, and may still be generated by different network applications. Therefore, the present invention considers the order of the packets correctly to improve the accuracy of the judgment.

Referring to Figure 6, it is a description of the message length sequence based on the present invention. Step diagram of the network traffic identification method. As shown in the figure, in step S601, a length common subsequence set corresponding to various network applications is provided. The length common subsequence set described herein can be obtained through pre-training, and the length shared subsequence set is used to represent Many possible collections of packet sequences for web applications. Next, the process goes to step S602.

In step S602, the network traffic is collected and the network traffic is disassembled into a plurality of connections, and the transmission direction and length of the plurality of packets in each connection are extracted to generate a length characteristic sequence corresponding to each connection. . In this step, the collected network traffic is disassembled according to the traffic information to disassemble the network traffic into multiple connections, wherein the traffic information may include the source IP address, the source nickname, and the destination. The IP address, destination nickname, and transmission protocol can also be used to distinguish the information of the delivery object.

In addition, before extracting the transmission direction and length of the plurality of packets in each connection, removing the packet whose packet length is the maximum transmission unit and the packet whose packet content length is zero, the plurality of packets of each connection are removed. If the length of the packet is the largest or the content is zero, it cannot be a member of the packet sequence. Because the packets cannot provide the identification effect, it is easy to confuse the judgment. Therefore, before using the length feature sequence, the useless packets need to be removed. Next, the process goes to step S603.

In step S603, the subsequence set is shared with the length feature sequence and the lengths of the various network applications, so that the similarity with the length feature sequence is obtained from the length common subsequence set. In this step, the length feature sequence of each connection obtained in step S602 is compared with a preset common subsequence set of various network applications. Finding the best match by sharing the sequence of sub-sequences by the length of various network applications. In the comparison described above, the order of the sequence, the number and the size of the packet sequence to be considered, the sequence of the packet sequence is It refers to the order of useful packets in the connection. If there is obvious difference in arrangement, there is no need to compare them. Then, the number and size of the packets are used to judge the similarity.

For example, a numerical definition can be given by using the direction and length of each packet in the plurality of packets, and the values are sequentially arranged to produce a sequence of length features representing the links. Use the sign and the value to indicate the direction and size as shown in the previous figure, and give appropriate tolerance values if necessary to avoid misjudgment caused by the small size of the packet size. Next, the process goes to step S604.

In step S604, the connection is determined to be a known network application or an unknown network application according to the number of shared sub-sequence sets of the length. In this step, after the length feature sequence of any connection is aligned with the length shared subsequence set, one or more length feature sequences with the highest similarity may be found. Therefore, if only one similarity is the highest, then Determining that the connection belongs to the network application corresponding to the length feature sequence of the common subsequence set of the length. Otherwise, if there is more than one, it is impossible to determine the network application to which the connection belongs, so it is determined that Unknown web app.

In another embodiment, step S601 of the present invention provides a set of shared subsequences corresponding to lengths of various network applications, and the set of shared subsequences of the length is obtained through pre-training. Specifically, the length shared subsequence set is trained in advance using known network traffic, and includes: disassembling the known network traffic into a plurality of connections, and extracting each of the connections The transmission direction and the length of the plurality of packets, thereby obtaining a sequence of length characteristics corresponding to each of the links, and then calculating the longest length between the two links in a pairwise manner by the length characteristic sequence of each of the links The sub-sequences are shared, and finally, the longest-length shared sub-sequences calculated by various combinations are collected to obtain a set of length-shared sub-sequences.

The training process of the above-mentioned length shared sub-sequence set is performed by training one network application at a time, and calculating a packet sequence shared between a plurality of connections as a representative of the network application. In this way, when the connection of the new network traffic is disconnected and has a high similarity with any longest shared subsequence in the length common subsequence set, it can be determined that the connection belongs to a certain type of network. application.

In summary, the network traffic identification system based on the message length sequence and the method thereof are provided by using the specific layer length sequence of the network application as the network for identifying the network traffic. The basis of the application, when identifying, the sequence of the length of the connection behavior extracted by the network application in the transport layer behavior is used as a representative feature of the connection, and the known various network applications represent the length feature sequence. Do similarity comparisons and use the most similar web application as the last attribution. Compared with the prior art, the traditional network application traffic detection and identification technology mostly uses the known connection used by the network application or the comparison method of the feature values of the package content, so the present invention overcomes the practice. Two shortcomings of the technology: (1) unable to detect web applications using dynamic connections, and (2) packet content can not be identified by packet content feature value if encrypted by the web application. Therefore, the present invention solves the present There are problems that cannot be identified by the contents of the packet and problems that cannot be recognized using the dynamic link, and an identification mechanism that can be used as an online gateway is provided.

The above-described embodiments are merely illustrative of the principles of the invention and its effects, and are not intended to limit the invention. Modifications and variations of the above-described embodiments can be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention should be as set forth in the scope of the claims described below.

2‧‧‧Network traffic identification system based on message length sequence

21‧‧‧Database

22‧‧‧Flow collection module

23‧‧‧Flow Disassembly Module

24‧‧‧ Identification Module

25‧‧‧Determining module

100‧‧‧Network traffic

Claims (10)

A network traffic identification system based on a sequence of message lengths includes: a database for pre-storing a set of length shared sub-sequences corresponding to various network applications; a traffic collection module for collecting network traffic; The demodulation module is configured to disassemble the network traffic into a plurality of connections according to the traffic information, and capture the transmission direction and length of the plurality of packets in each connection, so as to generate corresponding links by the plurality of packets. a length characteristic sequence of the line; the identification module is configured to share the subsequence set with the length of the length feature sequence and the length of the various network applications in the database, to obtain the sum of the subsequence sets of the length The length of the feature sequence is the highest degree of similarity; and the determining module determines whether the connection is a known network application or an unknown network application according to the number of the highest similarity obtained by the identification module. The network traffic identification system based on the message length sequence described in claim 1, wherein the traffic teardown module removes the packet and the packet whose packet length is the maximum transmission unit from the plurality of packets of the connection. A packet with a zero content length. The network traffic identification system based on the message length sequence described in claim 1, wherein the length feature sequence is numerically defined according to the transmission direction and length of each packet in the plurality of packets, and sequentially Arrange the values produced by the values. The network traffic identification system based on the message length sequence described in claim 1, wherein the traffic information includes a source IP address, a source nickname, a destination IP, a destination nickname, and a transport protocol. The network traffic identification system based on the message length sequence described in claim 1 further includes an application representative set generation module, which uses known network traffic for training through the traffic teardown module. Disassembling the known network traffic to generate a length feature sequence of each connection, calculating the longest length common subsequence of the two connections in a pairwise manner, and collecting The longest length of the various combinations is shared by a subsequence to produce a set of shared subsequences of that length. A network traffic identification method based on a sequence of message lengths includes: providing a common sub-sequence set corresponding to lengths of various network applications; collecting network traffic and disassembling the network traffic into a plurality of connections, and extracting each The direction and length of the plurality of packets in the connection to generate a sequence of length characteristics corresponding to each of the links; sharing the sequence of sub-sequences with the length of the sequence of features and the length of the various network applications for sharing by the length The subsequence set obtains the highest degree of similarity to the length feature sequence; and determines the connection as a known web application or an unknown web application according to the number of shared subsequence sets of the length. The method for identifying a network traffic based on a message length sequence according to claim 6 of the patent application, wherein the plurality of packets in the connection are captured Before the transmission direction and the length of the transmission, the packet including the packet of the maximum transmission unit and the packet with the length of the packet content is removed from the plurality of packets of the connection. The network traffic identification method based on the message length sequence described in claim 6 wherein the length feature sequence is numerically defined according to the transmission direction and length of each packet in the plurality of packets, and sequentially Arrange the values produced by the values. The network traffic identification method based on the message length sequence described in claim 6 is characterized in that the network traffic is disassembled into a plurality of connection systems, including a source IP address, a source nickname, a destination IP, Destination nickname and transport protocol to disassemble the network traffic. The method for identifying a network traffic based on a message length sequence according to claim 6, wherein the length shared subsequence set is trained by using known network traffic before the identification, including: the known network The traffic is disassembled into a plurality of connections, and the transmission direction and length of the plurality of packets in each connection are extracted to generate a sequence of length characteristics corresponding to each connection, and the length characteristic sequence of each connection is two. The two sets of methods calculate the longest length common subsequence of the two links, and collect the longest length common subsequence calculated by various combinations to generate the common subsequence set of the length.