TWI650986B - Superspreader determination method and system thereof - Google Patents

Abstract

A method and system for judging a super-distributor is used to determine a source address of a super-spreader. According to the source address and the destination address of the data packet, the source data comparison source table is formed, and the source destination comparison data table is used to determine that the destination address does not correspond to the source address and the quantity is less than the preset value and the data packet is not determined. When repeated, the same number of short codes is accumulated according to the same source address. When it is determined that the same number of short codes is greater than the basic number, it is determined that the same number of source addresses corresponding to the short code are the super-spreader source address.

Description

Super disseminator's judgment method and system thereof

The invention relates to a method for judging a super-distributor and a system thereof, in particular to a method and system for judging a super-distributor for screening a data packet by a source purpose comparison data table and a bloom filter.

Since the popularity of personal computers in the 1980s, the transmission of information has become more convenient, faster and cheaper. In order to find a faster way to communicate, people have developed the Internet that people use today. The development of the Internet has led to the development of various types of Internet software. Instant messaging software and e-mails enable people in two places to communicate in a short period of time. Thus breaking through the limits of geography, distance, and ideology, so that people can access a variety of ideas and culture. Among them, the Internet enables information to be delivered to the purpose in an instant.

However, in today's information-rich era, some information disseminators use the convenience and speed of information dissemination to transmit large amounts of information to a large number of different destinations. Therefore, we call these people who transmit a large amount of data to a large number of different destinations as super-distributors. (Superspreader). Among them, these super-distributors may include advertisers or hackers. In order to make the advertising information known to the public, the advertising company will pass the advertising information to the public through email or instant message. However, modern people receive a lot of information every day because of the development of information transmission. Therefore, under normal circumstances, the advertising information transmitted by the advertising industry will be regarded as spam by people, which not only takes up storage space, but also wastes time to browse the information content.

In addition, hackers will pass viruses, worms, Trojans or other malicious programs to a large number of Internet users in order to steal people's personal data or other purposes. After a network user has inadvertently received and activated these viruses, worms, Trojans or other malicious programs, personal data or personal computer programs may be stolen due to these viruses, worms, Trojans or other malicious programs. Destroy and suffer irreparable damage.

In order to detect the source address of these super-spreaders, the security company will store each received data packet through a large-capacity database and analyze the source and destination addresses of these packets one by one to judge The source address of the super-spreader. However, since the super-spreader will transmit a large number of packets, it is necessary to continuously purchase a hard disk or other storage module to store the data packets, and it is necessary to purchase a hardware with better computing power for parsing and judgment, so that a large amount of expenditure is required. Overhead.

In view of the prior art, it is necessary to continuously purchase hard Discs or other storage modules store data packets, and need to purchase hardware with better computing power for parsing and judgment, thus requiring a large amount of overhead.

The present invention solves the problems of the prior art, and the necessary technical means adopted is to provide a method for judging a super-distributor. The method of judging by the super-distributor is used to determine the source address of a super-spreader. First, receiving a plurality of data packets, and parsing a plurality of source addresses respectively corresponding to the data packets and a plurality of destination addresses respectively corresponding to the data packets. Then, each source address and each destination address are converted into a plurality of destination short codes, and each source address is converted into a plurality of first source short codes.

Thereafter, a source data comparison reference table is formed, and the short code of the destination corresponding to each data packet and the first source short code are stored in the source purpose comparison data table. Then, one of the data packets is defined as a data judgment packet, and the first source short code stored in the source data comparison data table is defined as a judgment source short code, and the short object is determined. The code does not correspond to whether the number of the source short codes is less than a predetermined number of preset values.

When the judgment result is yes, it is determined according to the data to determine whether the packet source address and the judgment packet destination address judgment data determine whether the packet is repeated. When the judgment result is no, the source address of the judgment packet of the data judgment packet is converted into a second source short code, and the second source short code is recorded in a quantity accumulated data.

Repeating the above steps, so that the quantity accumulated data is stored with a plurality of second source short codes, and the plurality of second sources are short. The same code is accumulated into the same number of short codes, and the source address of the judgment packet corresponding to the same one of the plurality of second source short codes is determined as the source address of the super-spreader according to the same number of short codes.

On the basis of the above-mentioned necessary technical means, one of the sub-technical means derived from the above-mentioned method for judging the super-distributor is to determine the source of the judgment packet corresponding to the same of the plurality of second-source short codes according to the same number of short codes. When the address is determined to be the source address of the super-spreader, the judging packet source address corresponding to the same one of the plurality of second source short codes is judged to be super when judging that the same number of short codes is greater than a basic number. The source address of the distributor.

Based on the above-mentioned necessary technical means, one of the subsidiary technical means derived from the above-mentioned method of judging the super-distributor is to convert each source address and each destination address into a plurality of destination short codes, and convert each source address. When a plurality of first source short codes are formed, each source address and each destination address are converted into a destination short code via a first hash function, and each source address is converted by a second hash function. Short code for the first source.

On the basis of the above-mentioned necessary technical means, one of the subsidiary technical means derived from the above-mentioned method of judging the super-distributor is to convert the source address of the judgment packet of the data judgment packet into a second source short code, which is via a third The hash function converts the source address of the judgment packet of the data judgment packet into the second source short code.

On the basis of the above-mentioned necessary technical means, one of the subsidiary technical means derived from the above-mentioned super-distributor's judgment method is to judge the source address of the packet and judge the purpose of the packet in accordance with the data judgment packet. When the address judgment data determines whether the packet is repeated, the source address of the judgment packet corresponding to the data judgment packet and the destination address of the judgment packet are first parsed. Then, the Bulong filter module determines whether the packet is repeated by determining the source address of the packet and determining the destination address of the packet according to the data. Among them, the Bloom filter module is a Bloom filter.

On the basis of the above-mentioned necessary technical means, one of the sub-technical methods derived from the above-mentioned method of judging the super-distributor is to determine the source address of the packet and the destination of the packet by judging the packet according to the data by a Bloom filter module. When the address judgment data determines whether the packet is repeated, the address of the judgment packet source address and the destination address of the judgment packet are converted into a filter short code set through a plurality of filter hash functions, and the filter short code set includes a plurality of filter hash functions. Filter short codes. The quantity cumulative data is a quantity accumulation table. Then, the filtered short code set data generated according to the at least one pre-stored filtered short code set is compared with the filtered short code set to determine whether the filtered short code set is repeated. Thereby, judging the source address of the packet and determining the destination address of the packet to determine whether the packet is repeated.

Based on the above-mentioned necessary technical means, one of the auxiliary technical means derived from the above-mentioned method for judging the super-distributor is to convert the address of the judgment packet source address and the judgment packet destination address into a filter-containing short code via a plurality of filtering hash functions. When filtering the short code set, the packet source address and the judgment packet destination address are converted into the filtering short code by the filter hash function.

The present invention solves the problems of the prior art and adopts The necessary technical means provide a judgment system for the super-distributor. The super-distributor's judgment system is used to determine a super-spreader source address, and includes a packet parsing module, a computing module, a storage module and a judging module. The packet parsing module is configured to receive a plurality of data packets, and parse a plurality of source addresses corresponding to the data packets and a plurality of destination addresses respectively corresponding to the data packets.

The computing module is electrically connected to the packet parsing module, and is configured to convert each source address and each destination address into a plurality of destination short codes, and convert each source address into a plurality of first source short codes. The storage module is electrically connected to the computing module, and is provided with a source purpose comparison data table for storing the short code of the destination corresponding to each data packet and the first source short code in the source purpose comparison data table.

The judging module is electrically connected to the storage module, and is provided with a preset number for defining one of the data packets as a data judging packet, and storing the first source short code stored in the source data comparison table. The data corresponding to the data judgment packet is defined as a judgment source short code, and it is determined whether the destination short code does not correspond to the number of the determination source short codes is less than the preset number.

Wherein, when it is determined that the destination short code does not correspond to the number of the determined source short codes is less than the preset number, and one of the corresponding packets is determined according to the data, the source address of the packet is determined, and the address of the judgment packet is determined by the address judgment data. When present, the source address of the judgment packet of the data judgment packet is converted into a second source short code, and the second source short code is recorded in a quantity accumulation data, so that the quantity accumulation data is stored with a plurality of second source short codes. And the above multiple second source short code phases The same person accumulates the same number of short codes, and judges the source address of the judgment packet corresponding to the same one of the plurality of second source short codes as the source address of the super-spreader according to the same number of short codes of the quantity accumulated data.

Based on the above-mentioned necessary technical means, one of the affiliated technical means derived from the above-mentioned super-distributor's judgment system is a super-distributor's judgment system, which further includes a judgment packet analysis module, a judgment packet operation module, a bloom filter module. A judging packet storage module and a judging packet judging module. The judging packet parsing module is electrically connected to the judging module, and is configured to parse the source address of the judging packet corresponding to the data judging packet and the destination address of the judging packet.

The determining packet computing module is electrically connected to the determining packet parsing module, and is configured to convert the determining packet source address and the determining packet destination address into a filtered short code set. The filtered short code set contains a plurality of filtered short codes. The Bloom filter module is electrically connected to the determining packet computing module, and is provided with a filtered short code set data generated according to at least one pre-stored filtered short code set, which is used to compare the filtered short code set data with the filtered short code set. Correct.

Determining that the packet storage module is electrically connected to the judging packet computing module, and is provided with a quantity accumulating data, which is used to determine that the data judging packet is not repeated when the Bron filter module compares the filtering short code set without repeated occurrence By judging the packet computing module, the source address of the judgment packet of the data judgment packet is converted into the second source short code, and the second source short code is recorded in the judgment quantity accumulation data of the packet storage module, so as to make the quantity accumulated data A plurality of second source short codes are stored, and the same of the plurality of second source short codes are accumulated into the same number of short codes.

Determining that the packet judging module is electrically connected to the judging packet storage module and is provided with a basic quantity for judging that the same number of the short codes is greater than the basic number, and determining the corresponding packet corresponding to the same of the plurality of second source short codes The source address is judged to be the source address of the super-spreader.

As described above, the method and system for judging the super-distributor provided by the present invention perform preliminary screening of the data packet through the source-specific comparison data table, so that the destination short code does not correspond to the number of the judgment source short code. A data less than a predetermined number of predetermined values is judged to be filtered out. Then, the data of the same source address and the destination address is filtered by the Bloom filter module, and the same source of the second source short code is accumulated into the quantity accumulated data. By judging the data, it is judged whether the source address of the packet is the source address of the super-spreader.

Compared with the prior art, the method and system for judging the super-distributor provided by the present invention only records the first source short code and the destination short code converted into the source address and the destination address of the data packet in the source. The purpose is to compare the duplicates in the second source short code converted into the source address of the judgment packet selected by the Bloom filter module into a quantity accumulation data. Therefore, the storage space required to store a large number of data packets is eliminated. In this way, there is no need to purchase a hard disk or other storage module to store data packets, and it is not necessary to purchase hardware with better computing power for parsing and judgment, thereby solving the problem that a large amount of overhead is required.

1‧‧‧Super disseminator's judgment system

11‧‧‧Packet Analysis Module

12‧‧‧ Computing Module

121‧‧‧First hash function unit

122‧‧‧Secondary function unit

13‧‧‧ Storage Module

14‧‧‧Judgement module

15‧‧‧Determining packet parsing module

16‧‧‧Determining the packet computing module

161‧‧‧Filtering the hash function unit

162‧‧‧ third hash function unit

17‧‧‧Bron filter module

18‧‧‧Determination of packet storage module

19‧‧‧Determination of packet judgment module

2‧‧‧Processing wafer

3‧‧‧Software

D1‧‧‧Source purpose comparison data sheet

D2‧‧‧Filter short code collection data

D3‧‧‧Quantitative data

V1‧‧‧ quantity preset

V2‧‧‧Basic quantity

The first figure shows a block diagram of the judging system of the super-distributor provided by the preferred embodiment of the present invention; the second graph A to the second C shows the judging method of the super-spreader provided by the preferred embodiment of the present invention. FIG. 3 is a schematic diagram showing a source of comparison of the source of the method for judging the super-distributor provided by the preferred embodiment of the present invention; and a fourth diagram showing the super-distribution provided by the preferred embodiment of the present invention. A schematic diagram of the cumulative amount of data for the method of judgment.

Please refer to the first figure, which is a block diagram showing the judging system of the super-distributor provided by the preferred embodiment of the present invention. As shown, the preferred embodiment of the present invention provides a judging system 1 for a super-distributor. The judging system 1 of the super-distributor includes a packet parsing module 11, a computing module 12, a storage module 13, a judging module 14, a judging packet parsing module 15, a judging packet computing module 16, and a The Bloom filter module 17, a judging packet storage module 18 and a judging packet judging module 19. In this embodiment, the super-distributor's judgment system 1 is applied to a router. In other embodiments, it can be applied to various network devices, and is particularly suitable for a network with low memory capacity or low computing power. Road equipment, but not limited to this.

In this embodiment, the packet parsing module 11, the computing module 12, the storage module 13 and the judging module 14 are located on a processing chip 2, such as a field programmable logic gate array (Field Programmable). Gate Array; FPGA) chip, but not limited to other embodiments. In addition, in the embodiment, the determination packet parsing module 15, the judging packet computing module 16, the Bloom filter module 17, the judging packet storage module 18, and the judging packet judging module 19 are written in a software program 3, However, it is not limited to this in other embodiments.

The computing module 12 is electrically connected to the packet parsing module 11 and includes a first hash function unit 121 and a second hash function unit 122. The storage module 13 is electrically connected to the computing module 12 and is provided with a source purpose comparison data table D1. The storage module 13 is, for example, a block random access memory (BRAM), but is not limited thereto. The determining module 14 is electrically connected to the storage module 13 and is provided with a predetermined number of values V1.

The determination packet analysis module 15 is electrically connected to the determination module 14 . The judging packet computing module 16 is electrically connected to the judging packet parsing module 15 and includes a plurality of filtering hash function computing units 161 (only one of which is labeled here) and a third hash function computing unit 162.

The Bloom filter module 17 is electrically connected to the judging packet computing module 16 and is provided with a filtered short code set data D2 generated according to at least one pre-stored filtered short code set. In this embodiment, the Bloom filter module 17 is a Bloom Filter. The packet storage module 18 is electrically connected to the judging packet computing module 16 and is provided with a quantity of accumulated data D3. In the embodiment, the quantity accumulation data D3 is a quantity accumulation table, but it is not limited thereto in other embodiments. The determination packet determination module 19 is electrically connected to the determination packet storage module 18 and is provided with a base quantity V2.

Please refer to FIG. 1 to FIG. 2C together. FIG. 2A to FIG. 2C are flowcharts showing a method for judging the super-distributor provided by the preferred embodiment of the present invention. As shown in the figure, a plurality of data packets are received first, and the packet resolution module 11 parses a plurality of source addresses corresponding to the data packets and a plurality of destination addresses respectively corresponding to the data packets (ie, step S1). .

Please refer to FIG. 1 , FIG. 2A and FIG. 3 together. FIG. 3 is a schematic diagram showing the source of the comparison data table of the method for judging the super-distributor provided by the preferred embodiment of the present invention. As shown in the figure, each source address and each destination address are converted into a destination short code by the first hash function operation unit 121 of the operation module 12. The destination short code is a hash value converted by the first hash function. Each source address is converted to a first source short code by a second hash function operation unit 122 of the computing module 12. The first source short code is a hash value converted by the second hash function (ie, step S2).

Then, the destination short code corresponding to the data packet and the first source short code are stored in the source destination comparison data table D1 of the storage module 13 (ie, step S3). In the present embodiment, the first hash function operation unit 121 calculates 10 destination short codes, and the destination short codes are 5869, fd11, 555a, e154, e5f1, 44d6, a47b, e4a6, e5dd, and eee4, respectively. The second hash function operation unit 122 calculates ten first source short codes. The first source short codes are 1a2b, 5d1e, 6dd9, c232, F127, 365c, 52af, fe24, 4dd1, and C21d, respectively, but are not limited thereto in other embodiments. Before the packet is received, in the source purpose comparison data table D1, The field corresponding to the destination short code and the first source short code is 0.

Then, one of the data packets is defined as a data judgment packet, and the first source short code corresponding to the data judgment packet stored in the source destination comparison data table D1 is defined as a judgment source short code. In this embodiment, after the destination short code and the first source short code are stored in the source destination comparison data table D1, the destination short code is compared with the field corresponding to the judgment source short code defined by the first source short code. Fill in as 1.

The determining module 14 determines whether the destination short code does not correspond to the number of the determined source short codes is less than a predetermined number of preset values V1 (ie, step S4). In the embodiment, the preset value V1 is 3, but it is not limited thereto in other embodiments.

If it is determined that the destination short code does not correspond to the number of the determined source short codes is not less than the quantity preset value V1, it may be known that the source address corresponding to the source short code is not the super-spreader source address (ie, step S41), Because the number of destination addresses transmitted from the data packet sent by the source address corresponding to the source short code does not exceed the preset value V1, it does not meet the condition of the super-spreader source address. In this way, the data judgment packet is selected as the first stage of screening.

For example, in the source destination comparison data table D1, when the 5d1e of the first source short code is defined as the judgment source short code, the number of short codes that do not correspond to the 5d1e of the judgment source short code is 6 (six 0). Since the number of short codes (6) that are not corresponding to the 5d1e of the source short code is greater than the preset value V1(3), it can be known that the source address corresponding to the source short code is not the source address of the super-spreader. .

Please refer to the first picture and the second picture B together. As shown When the determining module 14 determines that the destination short code does not correspond to the number of the determined source short codes is less than the quantity preset value V1, it is determined that the packet parsing module 15 parses out one of the data determining packets to determine the source of the packet. The address and the address of the judgment packet are determined (ie, step S51).

For example, in the source destination comparison data table D1, when 1a2b and c21d of the first source short code are defined as the judgment source short code, the number of short codes of the destination 1a2b that does not correspond to the judgment source short code is 2 ( Two 0), the number of short codes that do not correspond to the c21d of the source short code is 1 (one 0).

Since the number of the short codes of the destinations 1a2b and c21d that are not corresponding to the source short code is less than the preset value V1, the address corresponding to the source of the data packet and the address of the judgment packet are parsed. Wherein, the source address corresponding to the source short code can be obtained by searching the hash table of the second function. In the present embodiment, it is assumed that the source address of the source short code 1a2b is two, and the source address of the source short code c21d is one.

Then, by determining a plurality of filtering hash function operation units 161 (only one of which is labeled here) of the packet computing module 16, the packet determining source address and the determining packet destination address are converted into a plurality of filtering short codes, thereby forming A plurality of filtered short code sets formed by filtering the short codes (step S521). The plurality of filtering short codes are converted into hash values by a plurality of different filtering hash functions.

Then, the filtered short code set data D2 of the Bloom filter module 17 is compared with the filtered short code set, and the filtered short code is determined. Whether the set matches the pre-stored filtered short code set of the filtered short code set data D2, thereby determining whether the filtered short code set is repeated. (Step S522).

In short, the data of the judgment packet originating from the previous judgment packet and the destination address of the judgment packet are converted into a plurality of hash values by the plurality of different filter hash functions to form a pre-stored filter short code set, and The filtered short code set data D2 is stored in the form of a pre-stored filtered short code set.

When it is judged whether the source address of the judgment packet of the data judgment packet and the address of the judgment packet are duplicated, the comparison of the filter short code set corresponding to the data judgment packet and the pre-stored filter short code set of the filter short code set data D2 are compared. By judging the data, judging the source address of the packet and determining whether the destination address of the packet is duplicated. Thereby, the storage space required for storing the judgment data packet is saved.

When it is determined that the filtered short code set is repeated, the source address of the judgment packet and the destination address of the judgment packet are discarded, because it is not necessary to calculate the duplicate data to determine the source address of the packet and the destination address of the packet. (and step S5221).

Please refer to FIG. 2C and FIG. 4 together. FIG. 4 is a schematic diagram showing the cumulative amount of data of the method for judging the super-distributor provided by the preferred embodiment of the present invention. As shown in the figure, when it is determined that the filtered short code set is not repeatedly generated, the third hash function operation unit 162 of the packet computing module 16 determines that the source address of the data packet of the data judgment packet is converted into a second source. The code is recorded in the second source short code to determine the quantity accumulated data D3 of the packet storage module 18.

The second source short code is a hash value converted into a source address of the judgment packet of the data judgment packet via a third hash function. Thereafter, the above steps are continually repeated, so that the quantity cumulative data D3 stores a plurality of second source short codes, and the same of the second source short codes is accumulated into a short code of the same number (ie, step S6).

For example, the two source addresses corresponding to the source code short code 1a2b are formed into the second source short codes of 456a and 89a4 by the operation of the third hash function operation unit 162, respectively. In addition, the source address corresponding to the source code short code c21d is formed as the second source short code of ee66 by the operation of the third hash function operation unit 162. Next, the second source short code 456a, 89a4 and ee66 are recorded in the quantity cumulative data D3, and the same ones of the second source short codes are accumulated into one short code same number. Among them, the 456a of the second source short code is accumulated 6 times, the 89a4 of the second source short code is accumulated 2 times, the 456a of the second source short code is accumulated 6 times, and the ee66 of the second source short code is accumulated 9 times.

Finally, it is judged by the judgment packet judging module 19 whether the same number of short codes is greater than a basic number V2 (ie, step S71). When it is determined that the same number of short codes is not greater than the basic number V2, the judging packet source address non-super-spreader source address corresponding to the same one of the second source short codes may be determined (ie, step S711). When it is determined that the same number of short codes is greater than the base quantity V2, the judgment packet source address corresponding to the same one of the second source short codes is determined as the super-spreader source address (ie, step S72).

For example, if the base quantity V2 is set to 5, it is determined that the packet determination module 19 can determine the 456a and ee66 of the second source short code. The same number of short codes exceeds the base quantity V2. After querying the hash table of the third hash function, it can be known that the source short code corresponding to the 456a and ee66 of the second source short code is the super-spreader source address. In addition, the judgment packet judging module 19 can judge that the same number of short codes of the 89a4 of the second source short code does not exceed the basic number V2. After querying the hash table of the third hash function, it can be known that the source short code corresponding to 89a4 of the second source short code is not the super-spreader source address.

Incidentally, in this embodiment, the destination short code, the first source short code, the filtered short code, and the second source short code are all mashed values of hexadecimal English letters mixed with Arabic numerals, but in other embodiments The destination short code, the first source short code, the filtered short code and the second source short code may be a hash value of only Arabic numerals or a hash value of only English letters, but in other embodiments, this is not limit.

In summary, in the method and system for judging the super-distributor provided by the preferred embodiment of the present invention, the source address and the destination address of each data packet are first parsed, and according to the source address and the destination address. The address is hashed to form a destination short code and a first source short code. Then, according to the source destination comparison data table formed by the destination short code and the first source short code, the first source short code transmitted to the corresponding plurality of destination short codes and defined as the source short code is screened out.

Then, the filtering source function is performed on the source address corresponding to the source short code, so that the Bulong filtering module filters out the judgment data packet whose source address and destination address are not duplicated. Then, the same number of short codes of the second source are accumulated to the same number of short codes, and the data judgment packet is judged by comparing the same number of short codes with the basic quantity. Whether the source address is a super-spreader source address.

Compared with the prior art, the method and system for judging the super-distributor provided by the preferred embodiment of the present invention only need to store the first source short code and the destination short code according to each data packet to form a source-specific reference data table. And storing the accumulated amount of data formed according to the same number of short codes of the short codes of the second source. Therefore, there is no need to store data packets by a large storage space, thereby saving a large amount of overhead for purchasing hard disks, other storage modules, or hardware with better computing power.

The features and spirit of the present invention will be more apparent from the detailed description of the preferred embodiments. On the contrary, the intention is to cover various modifications and equivalents within the scope of the invention as claimed.

Claims (11)

A super-distributor judgment method is used for judging a Superspreader source address, and includes the following steps: (a) receiving a plurality of data packets, and parsing a plurality of data packets respectively corresponding to the data packets The source address and the plurality of destination addresses respectively corresponding to the data packets; (b) converting each of the source addresses and the destination addresses into a destination short code via a first hash function calculation, And converting each of the source addresses into a first source short code by using a second hash function; (c) forming a source destination comparison data table, and using the short codes of the destinations corresponding to the data packets The first source short codes are stored in the source purpose comparison data table; (d) one of the data packets is defined as a data judgment packet, and the first one stored in the source purpose comparison data table is stored The source short code corresponding to the data determines that the packetizer is defined as a judgment source short code, and determines whether the short codes of the destinations do not correspond to the number of the short codes of the judgment source is less than a predetermined number; (e) when the step (d) When the judgment result is yes, determining, according to the data, the source address of the packet and the address of the judgment packet to determine whether the data packet is repeated; (f) when the judgment result of the step (e) is no And converting the source address of the judgment packet of the data judgment packet into a second source short code, and recording the second source short code in a quantity accumulated data; (g) repeating the steps (a) to (f), wherein the quantity accumulated data is stored with a plurality of the second source short codes, and the same of the plurality of the second source short codes is accumulated into one The short codes are the same number, and the judgment packet source address corresponding to the same plurality of the second source short codes is determined as the super-spreader source address according to the same number of the short codes. The method for judging a super-distributor according to claim 1, wherein in the step (g), when the same number of the short codes is greater than a basic quantity, the plurality of the second sources are short. The source address of the judgment packet corresponding to the same code is determined as the source address of the super-spreader. The method for judging a super-distributor according to claim 1, wherein in the step (b), each of the source addresses and each of the objects are performed via a first hash function. The address is converted into short codes of the destinations, and each of the source addresses is converted into the first source short codes via a second hash function. The method for judging a super-distributor according to claim 1, wherein in the step (f), the source address of the judgment packet of the data judgment packet is converted into the first Two source short codes. Such as the super-distributor described in item 1 of the patent application scope a determining method, wherein, in the step (e), the method further comprises the following steps: (e1) parsing the source address of the determining packet corresponding to the data determining packet and the destination address of the determining packet; and (e2) borrowing The Bron filter module determines, according to the data, the source address of the judgment packet corresponding to the packet and the destination address of the judgment packet to determine whether the data is repeated. The method for judging a super-distributor according to claim 5, wherein the Bloom filter module is a Bloom Filter. The method for judging a super-distributor according to claim 5, wherein in the step (e2), the method further comprises the following steps: (e21) via the source address of the judgment packet and the destination address of the judgment packet Converting a plurality of filtering hash functions into a filtered short code set, the filtering short code set comprising a plurality of filtering short codes converted by each of the filtering hash functions; and (e22) separating the short code sets according to at least one pre-stored filtering The generated filtered short code set data is compared with the filtered short code set to determine whether the filtered short code set is repeated. The method for judging a super-distributor according to claim 7 , wherein in the step (e21), the determining packet source address and the determining packet destination address are converted into the destination address of the determining packet by the filtering hash function These filter short codes. The method for judging a super-distributor as described in claim 1 of the patent application, wherein the quantity-accumulated data is a quantity accumulation table. A super-distributor judgment system is used for judging a super-spreader source address, and includes: a packet parsing module for receiving a plurality of data packets, and parsing a plurality of corresponding data respectively The source address of the packet and the plurality of destination addresses respectively corresponding to the data packets; an operation module electrically connected to the packet parsing module for using the source addresses and the respective destinations The address is converted into a short code by a calculation of a first hash function, and each of the source addresses is converted into a first source short code by a second hash function; a storage module is electrically connected to The computing module has a source-specific comparison data table for storing the short codes of the destinations corresponding to the data packets and the first source short codes in the source-specific comparison data table; The module is electrically connected to the storage module, and is provided with a preset value for defining one of the data packets as a data judgment packet, and storing the source object in the comparison data table. The first source short code corresponding to the data determines that the packetizer is defined as a judgment source short code, and determines whether the number of the short codes that do not correspond to the judgment source short code is less than the preset number; Wherein, when it is determined that the short codes of the destinations do not correspond to the number of the short codes of the judgment source, the number is less than the preset value, and the packet is determined according to the data. Corresponding to determining the source address of the packet and determining the destination address of the packet to determine that the data is not repeated, the source address of the judgment packet of the data judgment packet is converted into a second source short code, and the first The two source short codes are recorded in a quantity of accumulated data, so that the quantity accumulated data stores a plurality of the second source short codes, and the same number of the plurality of the second source short codes are accumulated into a short code of the same quantity. And determining, according to the same quantity of the short code of the quantity accumulation data, the judgment packet source address corresponding to the same one of the plurality of the second source short codes as the super-spreader source address. The judging system of the super-distributor as described in claim 10, further comprising: a judging packet parsing module electrically connected to the judging module, configured to parse the judgment corresponding to the data judging packet The source address of the packet and the address of the determining packet; a determining packet computing module is electrically connected to the determining packet parsing module, and is configured to convert the source address of the determining packet and the destination address of the determining packet into a filtering a short code set, the filter short code set includes a plurality of filter short codes; a Bron filter module is electrically connected to the judgment packet operation module, and is provided with a set according to at least one pre-stored filter short code set. Filtering the short code set data for comparing the filtered short code set data with the filtered short code set; and determining the packet storage module electrically connected to the determining packet computing module, and having the quantity accumulated Data for the Bloom filter module Comparing that the filtered short code set is not repeated and determining that the data is not repeatedly displayed, the determining the packet computing module converts the source address of the determining packet to the second source by the determining packet computing module And storing the second source short code in the quantity accumulation data of the judgment packet storage module, so that the quantity accumulation data stores a plurality of the second source short codes, and the plurality of the second source sources are The same number of short codes is accumulated for the same number of short codes; and a judgment packet judgment module is electrically connected to the judgment packet storage module and is provided with a basic quantity for determining that the same number of the short codes is greater than the basis In the case of quantity, the source address of the judgment packet corresponding to the same one of the plurality of second source short codes is determined as the source address of the super-spreader.