TWI685231B - Packet classification method - Google Patents

Abstract

The present disclosure provides a packet classification method, comprising: parsing a network data by a first parser to determine whether the network data comprises a data link layer content; parsing the network data by a second parser in response to the network data comprising the data link layer content, to determine whether the network data comprises a network layer content; parsing the network data by a third parser in response to the network data comprising the network layer content, to determine whether the network data comprises a transport layer content; parsing an application type of the network data by a forth parser in response to the network data comprising transport layer content; configuring, by a classifying module, a classifying tag of the network data according to the application type; and storing the network data and the classifying tag in a tag look-up table to provide a network platform managing traffic.

Description

Packet classification method

The present disclosure relates to a network management method, and particularly to a packet classification method for network nodes.

In order to achieve network management in a network environment, packets are generally parsed and packets are classified according to the communication ports of the packets. However, if the packet is encapsulated by an unknown peer-to-peer protocol, or if the packet uses a dynamic communication port or a masqueraded communication port, the packet will be parsed incorrectly, and the packet type will be misjudged. Accordingly, how to accurately identify the packet type according to the content carried in the packet is an urgent problem to be solved.

The summary of the present invention aims to provide a simplified summary of the disclosure so that the reader can have a basic understanding of the disclosure. This summary of the invention is not a complete overview of the disclosure, and it is not intended to point out important/critical elements of embodiments of the invention or to define the scope of the invention.

According to an embodiment of this disclosure, a packet classification method is disclosed, which includes the following steps: parsing a web through a first parser Road data to determine whether the network data contains a data link layer content; when determining that the network data contains the data link layer content, the network data is analyzed by a second parser to determine the network Whether the data contains a network layer content; when it is judged that the network data contains the network layer content, the network data is parsed through a third parser to determine whether the network data contains a transport layer content; The network data includes the content of the transmission layer, analyzes an application type of the network data through a fourth parser; sets a classification label to the network data according to the application type through a classification module; and stores the network The data and the classification label are in a label look-up table to provide a network platform for communication management.

In order to make the above and other objects, features, advantages and embodiments of the disclosure more comprehensible, the attached symbols are described as follows:

100‧‧‧Network node

110‧‧‧Analysis Module

111‧‧‧Firewall module

112‧‧‧Monitoring module

113‧‧‧First profiler

114‧‧‧Second profiler

115‧‧‧The third profiler

116‧‧‧The fourth profiler

117‧‧‧ tag name generator

120‧‧‧ Classification module

121‧‧‧Regional packet filter

122‧‧‧ Layer 7 classifier

123‧‧‧third/fourth classifier

130‧‧‧Network platform

131‧‧‧Front end module

132‧‧‧Service Quality Module

133‧‧‧Routing module

140‧‧‧ database management program

150‧‧‧Domain Name Service Database

160‧‧‧ Classification database

170‧‧‧Routing module

S310~S390‧‧‧Step

The following detailed description, when read in conjunction with the accompanying drawings, will facilitate a better understanding of the present document. It should be noted that, according to the requirements of the practical description, the features in the drawings are not necessarily drawn to scale. In fact, for clarity of discussion, the size of each feature may be arbitrarily increased or decreased.

FIG. 1 shows a schematic diagram of a network node and a functional block of the network node in a network communication environment according to some embodiments of the present disclosure.

FIG. 2 illustrates a functional block diagram of a network node as shown in FIG. 1 performing packet classification according to some embodiments of the present disclosure.

FIG. 3 is a schematic flowchart of a packet classification method according to some embodiments of the present disclosure.

The following disclosure provides many different embodiments or examples to implement different features of the present invention. Specific examples of elements and arrangements are described below to simplify the invention. Of course, these examples are only exemplary and are not intended to be limiting. For example, in the following description, forming the first feature above or on the second feature may include an embodiment in which the first feature and the second feature are formed in direct contact, and may also include the first feature and the second feature. Embodiments in which additional features are formed between features so that the first feature and the features may not be in direct contact. In addition, the present invention may repeat element symbols and/or letters in each example. This repetition is for simplicity and clarity, and does not in itself indicate the relationship between the various embodiments and/or configurations discussed.

Further, for ease of description, spatial relative terms (such as "below", "below", "lower", "above", "higher", and the like) may be used to describe the illustrations in the figures The relationship between an element or feature and another element (or elements) or feature (or features). In addition to the orientation depicted in the figures, spatially relative terms are intended to include different orientations of the device in use or operation. The device can be oriented in other ways (rotated 90 degrees or in other orientations) and therefore the spatially relative descriptors used herein can also be interpreted.

Please refer to FIG. 1, which illustrates a network node 100 and a functional block diagram of the network node 100 in a network communication environment according to some embodiments of the present disclosure. The network node 100 can be set externally A wide area network (WAN) connected to an internal network and/or a local area network (LAN) connected to an internal network. In some embodiments, the network node 100 may be, but not limited to, a router, a gateway, a switch with network layer processing functions, and the like. In other embodiments, the network node 100 may be an edge node disposed on a network edge. It is worth mentioning that this disclosure refers to the second, third, fourth, and seventh layers referring to the Open System Interconnection (OSI) data link layer and network layer. , The transport layer and the application layer are used interchangeably in the embodiment without changing the essential meaning.

As shown in FIG. 1, the network node 100 receives network data from a wide area network WAN or a local area network LAN in a communication network to perform packet classification on the network data.

The network node 100 includes an analysis module 110, a classification module 120, a network platform 130, a domain name service database 150, and a classification database 160. The analysis module 110 is used to analyze the content of the network data and obtain key classification information about the network data. In one embodiment, the analysis module 110 will further query the domain name service database 150 according to the content of the network data, so as to obtain key classification information later.

The classification module 120 is used to generate a classification label corresponding to the network data according to the key classification information, and store the classification label and the corresponding network data in the classification database 160.

The domain name service database 150 may be, but not limited to, a domain name system metadata (domain name system metadata, DNS metadata). In one embodiment, the domain name service database 150 is used to record DNS response messages and classified messages of fully qualified domain names (FQDN). For example, the DNS response message includes the IP address message (A message), the alias message (CNAME message), and the DNS reverse domain name message (PTR message). The classification information of FQDN contains each FQDN and its corresponding classification label.

The network platform 130 is used to access the classification tags in the classification database 160 to control the network data experienced by the network node 100 and the current network status, and execute control for the application type of each network data.

The network node 100 can generate multiple execution procedures through the database management program 140 to read the domain name service database 150 and the classification database 160 to simultaneously perform multiple packet classifications. For example, the database management program 140 simultaneously queries the domain name or FQDN corresponding to the Internet protocol address (IP address) in the classification database 160, and classifies multiple packets at the same time. In some embodiments, the database management program 140 may be, but not limited to, a SQLite3 program.

The network node 100 also includes a routing module 170. The routing module 170 is used to perform router functions. In one embodiment, the routing module 170 includes a network packet management module (not shown) and a conversion module (not shown). The network packet management module is used to manage the packet management and control of the network node 100 regarding the forwarding, blocking, and transmission of network packets. The network packet management module may be, but not limited to, the iptables program, ip6tables program, ipchains program, ipwadm program, etc. of the Linux system. The conversion module is used to perform IP address conversion. The conversion module can be, but not limited to, network address conversion NAT (network address translation, NAT) program. In one embodiment, when the network node 100 receives the network data, the routing module 170 first performs routing processing such as forwarding, blocking, and transmission, and then the analysis module 110 performs the classification process.

Please refer to FIG. 2, which illustrates a functional block diagram of the network node 100 as shown in FIG. 1 performing packet classification according to some embodiments of the present disclosure. As shown in FIG. 2, the parsing module 110 includes a firewall module 111, a listening module 122, a first parser 113, a second parser 114, a third parser 115, a fourth parser 116, and tag name generation器117. When the profiling module 110 processes the network data, in one embodiment, the firewall module 111 starts analyzing the network data, and if certain conditions or rules are passed, the network data analysis is continued by other components. If the network data does not meet the conditions or judgments of any element in the analysis module 110, it means that the network data does not fall within the scope of packet classification, and will be discarded, and the packet classification of the network data is interrupted.

The firewall module 111 is used to execute firewall rules on the network data to determine whether the network data is a junk packet. For example, the network node 100 receives network data from a wide area network WAN. If the firewall module determines that the network data is a denial of service attack packet, such as a SYN packet for SYN Flooding, Internet Control Message Protocol Packets such as ICMP Flooding. Therefore, by allowing these connection packets not initiated by the local network to be blocked at this stage, network data that does not need to be classified can be filtered in advance. The firewall module 111 transmits the network data passing through the firewall rules to the monitoring module Group 122.

The monitoring module 122 is used to execute monitoring rules (sniffer) on network data. For example, the monitoring module 122 directly captures network data, and directly transfers the network data to the first parser 113 without performing mirror copying of the network data. In this way, the performance degradation caused by mirroring network data can be avoided.

The first parser 113 is used to determine whether the network data includes data link layer content. In one embodiment, the first parser 113 is a parser of the data link layer. The first parser 113 decapsulates the network data to determine whether the network data is an Ethernet frame. For example, if the first parser 113 can obtain a media access address (MAC) from the network data, the network data belongs to the Ethernet frame, that is, the network data includes data Link layer content. In another embodiment, the first parser 113 can detect network data according to the Ethernet protocol, not limited to the MAC address. The first parser 113 transmits the network data determined as the Ethernet frame to the second parser 114. In this way, the analysis module 110 will only perform packet classification on network data of the Ethernet type, and network data that does not belong to the Ethernet type will be filtered at this time.

The second parser 114 is used to determine whether the network data includes network layer content. In one embodiment, the second parser 114 is a network layer parser. The second parser 114 decapsulates the network data to determine whether the network data is an Ethernet packet. Examples In other words, if the second parser 114 can obtain the internet protocol address (IP address) from the network data, it is determined that the network data includes network layer content. Then, the second parser 114 will further analyze the source IP address and the target IP address of the content of the network layer, and store these IP addresses to the classification database through the database management program 140 of FIG. 1 160.

In addition, the second parser 114 determines the traffic direction of network data transmission according to the source IP address and the target IP address. For example, if the source IP address belongs to a public IP address and the destination IP address belongs to a private IP address, then the direction of traffic is determined to flow to the internal LAN. Otherwise, it is determined that the direction of the traffic is to the direction of the external wide area network. It is worth mentioning that this method of judgment is only an example, and this disclosure does not limit it. In this way, the parsing module 110 will only classify packets for the network data containing the content of the network layer, and the remaining network data will be filtered at this time. The second parser 114 sends the qualified network packet to the third parser 115.

The third parser 115 is used to determine whether the network data includes transport layer content. In one embodiment, the third parser 115 is a parser for the transport layer. The third parser 115 decapsulates the network data to determine whether the network data is a transmission layer segment. For example, if the third parser 115 can obtain transmission control protocol (TCP) messages or user datagram protocol (UDP) messages from the network data, it is determined Network data is the transport layer segment. Then, if the network data includes TCP messages, the third parser 115 determines the current connection handshake type based on the TCP messages (for example, through SYN, SYN/ACK, ACK, FIN/ACK packets to determine the current TCP connection handshake Stage) and the connection handshake sequence number (for example, extract the seq and ack numbers to determine the current TCP connection stage), and then send the network data to the fourth parser 116. On the other hand, if the network data includes UDP messages, the third parser 115 directly sends the network packet to the fourth parser 116.

In one embodiment, the fourth parser 116 is a parser for the application layer. The fourth parser 116 decapsulates the network data to retrieve the application type of the network data. For example, the application type may be, but not limited to, Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), DNS request/response, fast UDP network connection ( Quick UDP Internet Connections (QUIC), Google Quick UDP Network Connections (GQUIC), Transport Layer Security Protocol (Transport Layer Security), Secure Shell Protocol (Secure Shell, SSL), etc. The fourth parser 116 will obtain corresponding key classification information according to different application types.

In one embodiment, when the fourth parser 116 determines that the application type of the network data is HTTP, it obtains the host data of the network data. When the fourth parser 116 determines that the application type is a DNS request/response, it obtains the domain name service data of the network data. When the fourth profiler 116 determines that the application type is any of QUIC/GUIC, TLS, and SSL Otherwise, the Server Name Indication (SNI) of the network data is obtained. In this embodiment, the key classification information obtained by the fourth parser 116 includes host data, domain name service data, and server name identifier. It is worth mentioning that the above is only an exemplary description of the embodiment, and the present disclosure does not limit these application types and key classification information.

The label name generator 117 is used to generate a classification label corresponding to network data according to any one of host data, network name service data, and server name identifier. In one embodiment, the tag name generator 117 queries a database (such as Wikipedia) according to key classification information to obtain classification tags. For example, assume that the network node 100 receives a DNS request packet and queries the IP: 31.13.87.38 message for the request. After the network node 100 forwards the DNS request message, it receives network data with a DNS response. The application type of the parsing module 110 to parse network data is a DNS response, and this DNS response contains two messages: www.facebook.com CNAME star-z-mini.c10r.facebook.com star-z-mini.c10r.facebook .com A 31.13.87.38 In other words, for the query IP: 31.13.87.38, you will receive two messages: www.facebook.com and star-z-mini.c10r.facebook.com. In fact, both messages represent Facebook's server. The tag name generator 117 queries the two messages, for example, Wikipedia, and obtains the result of facebook. Therefore, the two DNS response messages are set to the same classification label, namely facebook. In other words, the key classification information obtained by the tag name generator 117 through the previous parser is in the data The query in the database can make the original key classification information look different, by labeling the classification label, the multiple key classification information can be classified into the same category.

Referring back to FIG. 2, the classification module 120 includes a regional packet filter 121, a seventh layer classifier 122, and a third/fourth layer classifier 123. In one embodiment, the regional packet filter 121 is used to determine whether the network data belongs to a local area network communication packet (such as ARP, DDSP, DHCP, LLMNR, NetBIOS, etc.) or a protocol that has no positive correlation with the application (such as the SSH protocol , FTP protocol, etc.). If it is determined that the network data belongs to a local network communication packet, the network data is discarded. In this way, it is possible to avoid the classification of network data that is only used for internal agreements or irrelevant to the application, and improve the accuracy of the classification process.

In one embodiment, the seventh layer classifier 122 is used to determine whether the network data includes the seventh layer open system interconnection message. The seventh layer classifier 122 classifies the network data according to the host data and the server name identifier (SNI) when determining that the network data includes the seventh layer open system interconnection message.

In one embodiment, when the third/fourth layer classifier 123 is used to determine that the network data does not contain the seventh layer open system interconnection message, the Internet protocol address and the corresponding Fully qualified domain name (FQDN) data for Internet Protocol addresses.

Please refer to FIG. 2 again. The network platform 130 includes a front-end module 131, a service quality module 132, and a routing module 133. The front-end module 131 receives management commands to execute related packet control procedures. For example, if the management command is a bandwidth control command, the service quality module 132 is operated to perform related bandwidth control to limit or guarantee the bandwidth of the designated traffic. If the management command is a blocking command, the routing module 133 is operated to block the specified traffic to prevent the network node 100 from accessing the malicious domain.

Please refer to FIG. 3, which illustrates a schematic flowchart of a packet classification method according to some embodiments of the present disclosure. Please refer to Figure 2 as well. The process steps of the packet classification method are as follows:

In step S310, the firewall module 111 executes firewall rules to filter network data.

In step S320, the monitoring module 112 monitors the network data that has passed the firewall rules, and sends the network data to the first parser 113.

In step S330, the first parser 113 determines whether the network data includes data link layer content. If it is determined that the network data includes data link layer content, step S340 is executed. If not, go to step S390 to end the packet classification method.

In step S340, the second parser 114 determines whether the network data includes network layer content. If it is determined that the network data includes network layer content, step S350 is executed. If not, go to step S390 to end the packet classification method.

In step S350, the third parser 115 determines whether the network data includes transport layer content. If it is determined that the network data includes the content of the transport layer, step S360 is executed. If not, go to step S390 to end the packet classification method.

In step S360, the fourth parser 116 analyzes the application type of the network data. Next, in step S370, the label name generator 117 sets the classification label to the network data according to the application type.

In step S380, the label name generator 117 stores the network data and the classification label in the label lookup table for the network platform 130 to perform traffic management.

In summary, the network nodes of this disclosure and the packet classification method operating on the network node 100, based on the information of qualified domain names and the tracking and processing of information at various layers of network data, will truly correspond to the same source Messages are given the same category label. In this way, after the subsequent network data enters the network node 100, the type of traffic can be quickly inferred through the classification label.

In addition, the disclosed document does not require pre-training rules, but can directly classify network data or traffic, simplifying the process of packet classification and reducing the computational cost. In addition, by setting up a software router to implement the packet classification method of the disclosed document, the problem of poor performance caused by the network delay to the classification mechanism can be reduced. And, because the classification label is set, the network administrator can know the type of traffic without personally checking the packet content, so that the network administrator can directly focus on the network control and improve the mastery of the overall network traffic status.

The above summarizes the features of several embodiments so that those skilled in the art can better understand the aspect of the present invention. Those skilled in the art should understand that the present invention can be easily used as a basis for designing or modifying other processes and structures in order to carry out the same purposes of the embodiments described herein and /Or achieve the same advantage. Those skilled in the art should also realize that such equivalent structures do not depart from the spirit and scope of the present invention, and that various changes, substitutions, and alterations herein can be made without departing from the spirit and scope of the present invention.

100‧‧‧Network node

110‧‧‧Analysis Module

120‧‧‧ Classification module

130‧‧‧Network platform

140‧‧‧ database management program

150‧‧‧Domain Name Service Database

160‧‧‧ Classification database

170‧‧‧Routing module

Claims (10)

A packet classification method includes: parsing a network data through a first parser to determine whether the network data includes a data link layer content; when determining that the network data includes the data link layer content, through A second parser parses the network data to determine whether the network data includes a network layer content; when determining that the network data includes the network layer content, parses the network data through a third parser To determine whether the network data contains a transport layer content; to determine whether the network data contains the transport layer content, to analyze an application type of the network data through a fourth parser; according to the application through a classification module The type sets a classification label to the network data; and stores the network data and the classification label in a label lookup table to provide a network platform for traffic management. The packet classification method as described in claim 1, wherein before determining whether the network data includes the data link layer content, the method further includes: executing a firewall rule through a firewall module to filter the network data. The packet classification method as described in claim 2, in Before determining whether the network data includes the content of the data link layer, it also includes: executing a monitoring rule on the network data passing through the firewall rule through a monitoring module; and transmitting the network data to the network through the monitoring module The first parser determines whether the network data includes the data link layer content through the first parser. The packet classification method according to claim 1, wherein the step of determining whether the network data includes the content of the data link layer further includes: detecting the network data according to an Ethernet protocol; and if the network data conforms The Ethernet protocol determines that the network data includes the content of the data link layer. The packet classification method according to claim 1, wherein the step of determining whether the network data includes the content of the network layer further includes: detecting the network data according to a network layer protocol; and if the network data conforms to the network The road layer protocol determines that the network data contains the content of the network layer. The packet classification method according to claim 5, wherein the step of determining that the network data includes the content of the network layer further includes: Parsing a source-side Internet protocol address and a target-side Internet protocol address of the network-layer content of the network data; based on the source-side Internet protocol address and the target-side Internet protocol Address, to determine a traffic direction of the network data, where the traffic direction includes a direction toward the wide area network and a direction toward the local area network; and record the source internet protocol address and the destination internet The road agreement address is in a classified database. The packet classification method according to claim 1, wherein the step of determining whether the network data includes the transport layer content further includes: parsing whether the transport layer content of the network data includes a transmission control protocol message and a user data Packet agreement message; when the transport layer content includes the transmission control protocol message, then determine a current connection handshake type and a connection handshake sequence number according to the transmission control protocol message; and when the transmission layer content includes the user data packet Agreement message, then send the network data to the fourth parser. The packet classification method according to claim 1, wherein the step of setting the classification label according to the application type of the network data includes: when the application type is a hypertext transfer protocol request, acquiring host data of the network data ; When the application type is a domain name system request/response, one of the network data is obtained; and when the application type is any of fast UDP network connection, transport layer security protocol, and secure shell protocol One is to obtain a server name identifier of the network data. The packet classification method according to claim 8, wherein the step of setting the classification label according to the application type of the network data further includes: according to any of the host data, the domain name service data, and the server name character One, the classification label is generated by a label name generator; and the corresponding classification label is set to the network data. The packet classification method according to claim 9, wherein after setting the corresponding classification label to the network data, the method further includes: determining that the network data belongs to a regional network through a regional packet filter of the classification module Network communication packet, the network data is discarded; when it is determined that the network data includes a seventh layer open system interconnection message through a layer 7 classifier of the classification module, the host data and the server name are used according to the host data Character classifies the network data; and when a third/fourth layer classifier of the classification module determines that the network data does not contain the seventh layer open system interconnection message, the The domain name service data obtains an Internet protocol address and a fully qualified domain name data corresponding to the Internet protocol address.

Images