WO2009089701A1

WO2009089701A1 - Method and system for packet inspection

Info

Publication number: WO2009089701A1
Application number: PCT/CN2008/072525
Authority: WO
Inventors: Peilin Yang; Rong ZOU
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2008-01-16
Filing date: 2008-09-25
Publication date: 2009-07-23
Also published as: CN101488946A

Abstract

A method and a system for packet inspection are provided. Wherein a method includes: inspecting a received data packet according to an inspection policy; transmitting the data packet when the data packet satisfies the inspection policy; determining whether the data packet should be copied according to a configuration policy, if yes, copying the data packet and inspecting the copied data packet according to a deep inspection policy. Another method includes: inspecting a received data packet according to an inspection policy; copying the data packet and inspecting the copied data packet if the data packet satisfies the inspection policy; determining whether the data packet should be transmitted, if yes, transmitting the data packet. Therefore, the requirement of runtime service is satisfied. It is avoided that DPI/DFI inspection device becomes a bottleneck of packet transmission. Function of apperceiving and controlling service by network operator is realized.

Description

4艮Detection method and system

Technical field

The embodiments of the present invention relate to network security technologies, and in particular, to a packet detection method and system. Background technique

With the continuous development of IP technology, IP broadband services have become a bright spot. IP networks are gradually carrying a single Internet service to carry data, voice, video, large customer lines, 3G, Next Generation Network (hereinafter referred to as NGN). IP Multimedia Subsystem (IP Multimedia Subsystem, hereinafter referred to as IMS), Internet Protocol Television (hereinafter referred to as IPTV), and other operational-level multi-service transformation. In the process of transformation, IP networks are safe and reliable. There will also be fundamental changes in the quality of business and business services.

With the continuous development of network technology, various new applications emerge in an endless stream, such as peer-to-peer (Peer to Peer, P2P), online games, Internet TV and other emerging services, occupying most of the Internet bandwidth, from the current domestic statistics In view of the fact, P2P cross-domain traffic occupies 80% of the bandwidth in the trunk line. In China's broadband unlimited monthly subscription fee mode, most of the bandwidth of the network is occupied by a small number of users, and these users do not pay the corresponding cost overhead. However, it affects the network quality of most other users, causing different degrees of congestion on the network and greatly reducing the user experience of other applications. At the same time, computer networks are being attacked and intruded more and more, causing huge losses to users and operators, and correspondingly lower profitability. Although the firewall mitigates some of the attacks, ordinary firewalls are overwhelmed by the spread and attacks of viruses hiding in the IP packet payload. In recent years, the development trend of cyber attacks has gradually turned to high-level applications. According to analysis, more than 70% of current cyber attacks are concentrated in the application layer, and the number is on the rise. Because of this, content security has become the most critical issue in information security today.

The main reason for the above phenomenon is that the operator lacks an effective control and zone for the user. By means of the means, the operator does not know what the user is doing on the Internet, nor does it provide a different quality of service and service level guarantee for different users. It is impossible to implement packet detection and service identification, which increases the operator's operating cost and reduces Customer satisfaction. Therefore, how to implement packet detection and service identification, perceive network applications, provide network service control and management tools, and build a harmonious network that can operate and manage is very necessary.

A new technology means deep packet inspection (Deep Packet Inspection, hereinafter referred to as DPI) and Deep/Dynamic Flow Inspection (DFI), which can sense network applications and provide operators with operators. Provides means of network control and management. The so-called "depth" is compared with the detection level of ordinary messages. The normal message detection only detects the content below the 4th layer of the IP packet, including the source address, the destination address, the source port, the destination port, and the service type, and the DPI. In addition to detecting the previous layers, /DFI also adds application layer detection, which can identify various applications and their contents, and control and manage them.

The following two DPI/DFI message detection schemes are proposed in the prior art:

As shown in FIG. 1 , it is a schematic diagram of a system for performing DPI detection in a series manner in the prior art. In the network, a DPI/DFI detection device is located between an aggregation layer and an access layer, and may also be deployed in an aggregation layer and an IP. /Multiprotocol Label Switch (hereinafter referred to as MPLS). Between the backbone networks, all packets entering or accessing the access network need to be detected by the DPI/DFI detection device. Only the detection policy is met. The message is allowed to enter or be sent out of the network.

As shown in FIG. 2, it is a schematic diagram of a system for performing DPI detection in parallel in the prior art. In the network, the DPI/DFI detection device is hanged beside the network access server (hereinafter referred to as NAS). It can also be hanged next to other network devices according to the actual situation of the network. All packets entering or accessing the access network need to pass through the NAS. The NAS copies the packets to the DPI/DFI detection device for detection. During the detection process of the /DFI detection device, the packet continues to enter the access network or is sent from the access network, and is not affected. When the DPI/DFI detection device recognizes the illegal service, it drops into the access network through the NAS or leaves. A packet of an illegal service that accesses the network. Summary of the invention

The embodiment of the invention provides a packet detection method and system, which can detect packets in a hierarchical manner, can meet the requirements of real-time services, and prevent the DPI/DFI detection device from becoming a bottleneck for message forwarding.

The embodiment of the invention provides a packet detection method, including:

Detecting the received data message according to the detection policy;

And when the data packet meets the detection policy, forwarding the data packet;

Determining whether to copy the data packet according to the configuration policy, and if yes, copying the data packet, and detecting the copied data packet according to the deep detection policy.

The embodiment of the invention further provides a packet detection method, including:

Detecting the received data message according to the detection policy;

And when the data packet meets the detection policy, copying the data packet, and detecting the copied data packet according to the deep-level detection policy;

Determining whether to forward the data packet according to the configuration policy, and if yes, forwarding the data packet. The embodiment of the invention further provides a packet detection method, including:

Detecting the received data message according to the detection policy;

When the data packet satisfies the detection policy, it is determined according to the configuration policy whether the data packet needs to be copied, and if so, the data packet is copied, and the copied data packet is detected according to the deep-level detection policy.

The embodiment of the invention provides a message detection system, including:

a detecting module, configured to detect the received data packet according to the detection policy;

a forwarding module, configured to forward the data packet when the data packet meets the detection policy;

a determining module, configured to determine, according to the configuration policy, whether to copy the data packet; a copying module, configured to: when it is determined that the data packet needs to be copied, copy the data packet; and the deep layer detecting module is configured to detect the copied data packet according to the deep layer detection policy.

The embodiment of the invention further provides a message detection system, including:

a copying module, configured to: when the data packet meets the detection policy, copy the data packet;

a deep detection module, configured to detect a copied data packet according to a deep-level detection policy; and a determining module, configured to determine, according to the configuration policy, whether to forward the data packet;

And a forwarding module, configured to forward the data packet when determining to forward the data packet.

a determining module, configured to determine, according to the configuration policy, whether to copy the data packet when the data packet meets the detection policy;

a copying module, configured to: when it is determined that the data packet needs to be copied, copy the data packet; and the deep-level detection module is configured to detect the copied data packet according to the deep-level detection policy.

The method and system for detecting a packet according to the embodiment of the present invention firstly detects a data packet according to the detection policy, and further detects the data packet according to the deep-layer policy, thereby implementing hierarchical detection of the data packet, and solving the data packet detection and fast. The balance between data packet forwarding performance meets the requirements of real-time services, which avoids the DPI/DFI detection device becoming the bottleneck of packet forwarding, and realizes the network operator's perception and control functions. DRAWINGS

1 is a schematic diagram of a system for performing DPI detection in a series manner in the prior art; FIG. 2 is a schematic diagram of a system for performing DPI detection in a parallel manner in the prior art; FIG. 3 is a schematic diagram of a network architecture according to an embodiment of the present invention;

4 is a flowchart of a message detecting method according to an embodiment of the present invention; FIG. 5 is a flowchart of a packet detecting method according to Embodiment 2 of the present invention;

6 is a flowchart of a method for detecting a packet according to Embodiment 3 of the present invention;

7 is a schematic diagram of a message detection system according to an embodiment of the present invention;

8 is a schematic diagram of a message detecting system according to Embodiment 2 of the present invention;

FIG. 9 is a schematic diagram of an NGN network architecture based on data packet detection according to an embodiment of the present invention; FIG. 10 is a schematic diagram of a packet detection system according to Embodiment 3 of the present invention. detailed description

In the process of implementing the embodiments of the present invention, the inventor has found that the above two solutions have at least the following problems: The DPI detection scheme is performed in series, and all the packets pass the DPI/DFI detection device, resulting in the DPI/DFI detection device. It becomes the bottleneck of packet forwarding, which causes transmission delay, especially for real-time services. At the same time, the detection policy is not flexible, and it is impossible to deploy detection policies according to network conditions and dynamic requirements.方案The DPI detection scheme is implemented in parallel. Because the DPI/DFI detection device is connected to the network, the real-time control capability of the service is weak, which reduces the control effect. At the same time, the detection strategy is not flexible, and the detection cannot be deployed according to the network conditions and dynamic requirements. Strategy.

The technical solutions of the embodiments of the present invention are further described in detail below with reference to the accompanying drawings and embodiments.

As shown in FIG. 3, it is a schematic diagram of a network architecture according to an embodiment of the present invention. The network includes a user terminal, an access network, a NAS, an internal measurement and control module, and an IP/MPLS backbone network, where the NAS includes a flow detection module. The method is configured to detect a data packet according to the detection policy, and the content detection and control module is configured to detect the data packet according to the deep detection policy.

As shown in FIG. 4, which is a flowchart of a message detection method according to an embodiment of the present invention, before the step of the embodiment is performed, the content detection and control module pre-configures the detection policy and the deep-level detection policy, and specifically includes the following steps:

Step 1. Detect the received data packet according to the detection policy. The NAS receives the data packet, and the flow detection module detects the data packet according to the detection policy.

Step 2: When the data packet meets the detection policy, determine whether the data packet needs to be copied according to the configuration policy, and if yes, perform step 3;

The configuration policy can be a policy configured by the operator according to the network operation. The pre-configuration determines whether the deep detection is required when the data packet meets the detection policy.

Step 3. Copy the data packet.

Step 4: Detecting the copied data packet according to the deep-level detection strategy; specifically, the content detection and control module detects the copied data packet according to the deep-level detection strategy.

In this embodiment, the packet detection and related policies are distributed to different functional entities, and the packets are detected at different levels, which solves the problem of balance between data packet detection and fast data packet forwarding performance, and satisfies the real-time service. The requirement avoids the DPI/DFI detection device becoming the bottleneck of packet forwarding, and can control and manage the service flow, and realize the network operator's perception and control function for the service.

As shown in FIG. 5, it is a flowchart of a method for detecting a message according to Embodiment 2 of the present invention. Before performing the steps of this embodiment, the content detection and control module pre-configures the detection policy and the deep-level detection strategy. Specifically, the content detection and control module configures a deep-level detection policy internally according to the needs of the operation, and configures the NAS for the NAS. Detection strategy. Taking the voice service as an example, the detection policy can be a quintuple (source address, sink address, source port, sink port, and protocol type) and a traffic characteristic model (such as packet length, connection rate, transmission byte amount, packet interval, etc.) Taking the IPTV service flow as an example, the detection strategy can be a five-tuple and a service agreement basic feature word strategy.

This embodiment specifically includes the following steps:

Step 1 01: The NAS receives the data packet.

Step 1 02: The flow detection module detects the data packet according to the detection policy, and if the data packet does not satisfy the detection policy, step 106 is performed; otherwise, step 103 is performed;

Step 1 03: Forward the data packet according to the normal process, determine whether to copy the data packet according to the configuration policy, and if yes, perform step 104;

The configuration policy may be a policy configured by the operator according to network operation conditions, and the The configuration determines whether further deep detection is required when the data packet meets the detection policy. Step 104: The data packet is copied, and the content detection and control module detects the copied data packet according to the deep-level detection policy. If the data packet meets the deep-level detection policy, step 105 is performed; otherwise, step 106 is performed;

Step 105: Processing the next data packet, and ending;

Step 106: Send an alarm notification to discard the data packet.

When the data packet does not satisfy the detection policy, for example, the flow detection module detects a data packet that is not normally transmitted by the quintuple; or, when the user uses the voice service, the flow detection module detects that the packet length of the data packet is 400 bytes (usually the packet length of the voice service data packet is about 150 bytes), and the duration is very long, indicating that the data packet is not a voice service packet; or, when the user watches the IPTV service stream, the flow detection The module detects the real-time transport protocol (Rea lt ime Transpor t Protocol, hereinafter referred to as RTP) service protocol basic feature word, but the feature word of other services; the stream detection module can write the data packet In the blacklist, the flow detection module may send an alarm notification to the NAS, and the NAS directly discards the data packet. Alternatively, the flow detection module reduces the priority of the data packet, and during the processing of the data packet, the priority is prioritized. The data packets of the highest level will be processed first.

When the data packet does not satisfy the deep detection policy, the internal detection and control module sends an alarm notification to the NAS; the NAS discards the data packet according to the alarm notification; for example, when the user watches the IPTV service flow, the internal detection and the The control module detects that the IPTV service stream to which the packet belongs has no copyright or is an illegal service flow packet, and notifies the NAS to discard the data packet sent from the quintuple.

Further, the content detection and control module may further classify the data packet according to the result of the deep detection policy detection, and perform traffic management on the data packet, where the traffic management may include management and scheduling of the data packet queue, and Supervision and shaping of data packet traffic.

In this embodiment, the packet detection and related policies are distributed to different functional entities, and the packets are detected at different levels, which solves the problem of balance between data packet detection and fast data packet forwarding performance, and satisfies the real-time service. The need to avoid the DPI/DFI detection device becomes the bottleneck of packet forwarding. It can also control and manage the service flow, and realize the network operator's perception and control functions. As shown in FIG. 6 , which is a flowchart of a packet detection method according to Embodiment 3 of the present invention, before performing the steps in this embodiment, a detection policy and a deep detection strategy need to be configured. Specifically, the content detection and control module is operated according to the operation. It is necessary to configure a deep detection policy inside it and configure a detection policy for the NAS. Taking the voice service as an example, the detection policy can be a quintuple (source address, sink address, source port, sink port, and protocol type) and a traffic characteristic model (such as packet length, connection rate, transmission byte amount, packet interval, etc.) Taking the IPTV service flow as an example, the detection strategy can be a five-tuple and a service agreement basic feature word strategy.

This embodiment specifically includes the following steps:

Step 201: The NAS receives the data packet.

Step 202: The flow detection module detects the data packet according to the detection policy. If the data packet does not satisfy the detection policy, step 206 is performed; otherwise, step 203 is performed;

Step 203: Copy the data packet, and the content detection and control module detects the copied data packet according to the deep-level detection policy. If the data packet satisfies the deep-level detection policy, step 204 is performed;

Step 204: Determine, according to the configuration policy, whether to forward the data packet, and if yes, perform the step.

205;

The configuration policy may be a policy configured by the operator according to the network operation, and may be configured to determine whether the data packet needs to be forwarded when the data packet satisfies the detection policy, or may be determined by using the result of the deep-level detection policy, for example, The configuration policy can be set to: When the data packet meets the deep detection policy, the data packet is forwarded.

Step 205: Forward the data packet, and end;

Step 206: Send an alarm notification, discard the data packet, and end.

When the data packet does not satisfy the detection policy, for example, the flow detection module detects a data packet that is not normally transmitted by the quintuple; or, when the user uses the voice service, the flow detection module detects that the packet length of the data packet is 400 bytes (usually the voice service data packet has a packet length of about 150 bytes) The above, and the duration is very long, indicating that the data packet is not a voice service packet; or, when the user views the IPTV service stream, the stream detection module detects the basic feature word of the RTP service protocol that is not required for the IPTV, but other services. The stream detection module can write the data packet to the blacklist. Further, the stream detection module can send an alarm notification to the NAS, and the NAS directly discards the data packet. Alternatively, the stream detection module reduces the data. Priority of the packet. During the processing of the data packet, the data packet with the highest priority will be processed first.

As shown in FIG. 7, a schematic diagram of a packet detection system according to an embodiment of the present invention includes: a detection module 1 configured to detect a received data packet according to a detection policy; and a determination module 2 configured to: when the data packet satisfies When detecting the policy, determining whether to copy the data packet according to the configuration policy; the copying module 3 is configured to: when determining that the data packet needs to be copied, copying the data packet; and the deep detection module 4 is configured to detect the replication according to the deep detection policy. Data message.

As shown in FIG. 8, a schematic diagram of a packet detection system according to a second embodiment of the present invention includes: a detection module 11 configured to detect a received data packet according to a detection policy; and a forwarding module 12 configured to be used as the datagram When the file satisfies the detection policy, the data packet is forwarded; the determining module 13 is configured to determine whether to copy the data packet according to the configuration policy; and the copying module 14 is configured to: when determining that the data packet needs to be restored When the data message is processed, the data message is copied; the deep level detecting module 15 is configured to detect the copied data message according to the deep level detection policy.

The embodiment may further include: a configuration module 16 configured to configure the detection policy and the deep-level detection policy; the alarm module 17 is configured to: when the data packet does not satisfy the detection policy, or when When the copied data packet does not satisfy the deep detection policy, the alarm notification is sent; the processing module 18 is configured to: when the data packet does not satisfy the detection policy, write the data packet into the blacklist;

The processing module may include a discarding module, configured to discard the data packet in the blacklist according to the alarm notification, and may further include a priority module, configured to reduce the priority of the data packet in the blacklist. level.

As shown in FIG. 9 , a schematic diagram of an NGN network architecture based on data packet detection according to an embodiment of the present invention, where a detection module is located at a network transmission layer, and in a device that accesses a network and an IP/MPLS backbone network, is subjected to a deep detection module. The control mainly performs basic identification on data packets, and reports various traffic information to the deep detection module. The deep detection module is located at the network control layer of the network transport layer, and further may be part of the network attachment control system and/or the resource admission control system, or may be used as an internal measurement and control system alone in the network control layer, independent of Current network attachment control systems and resource admission control systems. The deep detection module is mainly used for deep detection and content identification of data packets; configuring detection strategies for detection modules in the NAS; providing control functions for the detection modules; providing traffic management control, and optimizing reports according to network needs The file is forwarded to ensure the quality of service of the data packet.

This embodiment solves the problem of balance between packet detection and fast data forwarding performance. It not only satisfies the requirements of real-time services, but also prevents DPI/DFI detection equipment from becoming a bottleneck for packet forwarding, and can control and manage service flows. , realizes the network operator's perception and control functions for the business.

As shown in FIG. 10, a schematic diagram of a packet detection system according to a third embodiment of the present invention includes: a detection module 21, configured to detect a received data packet according to a detection policy; and a replication module 22, configured to: when the datagram is used When the text satisfies the detection policy, the data packet is copied; the deep detection module 23, The determining module 24 is configured to determine whether to forward the data packet according to the configuration policy, and the forwarding module 25 is configured to: when determining to forward the data packet, forward the Data message.

The embodiment may further include: a configuration module 26, configured to configure the detection policy and the deep-level detection policy; and an alarm module 27, configured to: when the data packet does not satisfy the detection policy, or when When the copied data packet does not satisfy the deep detection policy, the alarm notification is sent; the processing module 28 is configured to: when the data packet does not satisfy the detection policy, write the data packet into the blacklist.

In this embodiment, the detection module 21 can be located in the network transmission layer, and the deep level detection module 23 is located in the network control layer, which is the same as described in the message detection system of the first embodiment of the present invention.

It is not limited thereto; although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or some of the technologies. The features are equivalent to the equivalents of the technical solutions of the embodiments of the embodiments of the present invention.

Claims

Rights request

A text detection method, characterized by comprising:

Detecting the received data message according to the detection policy;

Determining whether to copy the data packet according to the configuration policy, and if yes, copying the data packet, and detecting the copied data packet according to the deep-level detection policy.

The packet detection method according to claim 1, wherein before the detecting the received data message according to the detection policy, the method further comprises: configuring the detection policy and the deep level detection policy.

The method for detecting a packet according to claim 1, further comprising: when the data packet does not satisfy the detection policy, writing the data packet to a blacklist.

The packet detection method according to claim 3, further comprising: sending an alarm notification to discard the data message in the blacklist after the data packet is written in the blacklist.

The method for detecting a packet according to claim 3, further comprising: reducing the priority of the data packet in the blacklist after the data packet is written in the blacklist.

The method for detecting a packet according to claim 1, wherein after the detecting the copied data packet according to the deep-level detection policy, the method further comprises: when the copied data packet does not satisfy the deep-level detection strategy At the time, an alert notification is sent.

The method for detecting a packet according to any one of claims 1 to 6, further comprising: after detecting the copied data packet according to the deep layer detection policy, further comprising: according to the result of the deep layer detection policy detection, The data packet is classified, and traffic management is performed on the data packet.

The packet detection method according to claim 7, wherein the traffic management includes management and scheduling of data packet queues, and supervision and shaping of data packet traffic.

The packet detection method according to claim 6, wherein after the sending the alarm notification, the method further comprises: discarding the data packet according to the alarm notification.

The packet detection method according to claim 9, wherein the detecting the received data message according to the detection policy is specifically: according to a quintuple and a traffic characteristic model policy, or a quintuple and a service protocol The basic feature word policy detects the received data message.

The packet detection method according to claim 10, wherein the discarding data packet is specifically: discarding a data packet sent from the quintuple.

12. A packet detection method, comprising:

Detecting the received data message according to the detection policy;

Determining whether to forward the data packet according to the configuration policy, and if yes, forwarding the data packet.

The method for detecting a packet according to claim 12, further comprising: configuring the detection policy and the deep detection policy before detecting the received data message according to the detection policy.

The packet detection method according to claim 12, further comprising: when the data packet does not satisfy the detection policy, writing the data packet to a blacklist.

The packet detection method according to claim 14, wherein after the data packet is written into the blacklist, the method further includes: sending an alarm notification, discarding the data packet in the blacklist.

The method for detecting a packet according to claim 14, further comprising: reducing the priority of the data packet in the blacklist after the data packet is written in the blacklist.

The method for detecting a packet according to claim 12, wherein after the detecting the copied data packet according to the deep-level detection policy, the method further comprises: when the copied data packet does not satisfy the deep-level detection strategy At the time, an alert notification is sent.

The method for detecting a packet according to any one of claims 12-17, wherein after detecting the copied data packet according to the deep layer detection policy, the method further comprises: according to the result of the deep layer detection policy detection, Sorting the data packet, and performing traffic management on the data packet Reason.

The packet detection method according to claim 18, wherein the traffic management includes management and scheduling of data packet queues, and supervision and shaping of data packet traffic.

The packet detection method according to claim 17, wherein after the sending the alarm notification, the method further comprises: discarding the data packet according to the alarm notification.

The packet detection method according to claim 20, wherein the detecting the received data message according to the detection policy is specifically: according to a quintuple and a traffic characteristic model policy, or a quintuple and a service protocol The basic feature word policy detects the received data message.

The method for detecting a packet according to claim 21, wherein the discarding data packet is specifically: discarding a data packet sent from the quintuple.

23. A packet detection method, comprising:

Detecting the received data message according to the detection policy;

24. A talent detection system, characterized by comprising:

a determining module, configured to determine, according to the configuration policy, whether to copy the data packet;

The packet detection system of claim 24, further comprising: a configuration module, configured to configure the detection policy and the deep level detection policy.

The packet detection system according to claim 25, further comprising: an alarm module, configured to: when the data message does not satisfy the detection policy, or when the copied data When the packet does not satisfy the deep detection policy, an alarm notification is sent.

The packet detection system according to claim 26, further comprising: a processing module, configured to: when the data packet does not satisfy the detection policy, write the data packet into a blacklist .

The packet detection system according to claim 27, wherein the processing module includes a discarding module, configured to discard the data packet in the blacklist according to the alarm notification.

The packet detection system according to claim 27, wherein the processing module includes a priority module, configured to reduce a priority of the data packet in the blacklist.

The message detecting system according to any one of claims 24 to 29, wherein the detecting module is located at a network transport layer.

The packet detection system according to claim 30, wherein the deep level detection module is located at a network control layer.

32. A talent detection system, comprising:

The packet detection system of claim 32, further comprising: a configuration module, configured to configure the detection policy and the deep level detection policy.

The packet detection system according to claim 33, further comprising: an alarm module, configured to: when the data message does not satisfy the detection policy, or when the copied data message is not satisfied Send an alarm notification when the policy is deeply detected.

The packet detection system according to claim 34, further comprising: a processing module, configured to: when the data packet does not satisfy the detection policy, write the data packet to black In the list.

The packet detection system according to claim 35, wherein the processing module includes a discarding module, configured to discard the data packet in the blacklist according to the alarm notification.

The packet detection system according to claim 35, wherein the processing module includes a priority module, configured to reduce a priority of a data packet in the blacklist.

38. The message detection system of any of claims 32-37, wherein the detection module is located at a network transport layer.

39. The message detection system according to claim 38, wherein the deep level detection module is located at a network control layer.

40. A talent detection system, comprising: