WO2014187238A1

WO2014187238A1 - Application type identification method and network device

Info

Publication number: WO2014187238A1
Application number: PCT/CN2014/076914
Authority: WO
Inventors: 陈浩; 都林
Original assignee: 华为技术有限公司
Priority date: 2013-05-24
Filing date: 2014-05-07
Publication date: 2014-11-27
Also published as: CN103297270A

Abstract

Disclosed in an embodiment of the present invention are an application type identification method and network device, the method comprising: extracting the first server address information from the first data packet of a received data stream; matching the first server address information with server application information, the server application information storing a corresponding relationship between the server address information and an application type therein; and when the first server address information is matched in the server application information, identifying the application type corresponding to the first server address information as the application type of the data stream. The embodiment of the present invention establishes server application information, so that upon receipt of a data packet, the server address information of the data packet is matched with the server application information, without keyword extraction or rule matching, thus quickly identifying the application type of a data stream of the data packet, and improving the efficiency of identifying the application type of a packet.

Description

Application type identification method and network device The application claims to be submitted to the Chinese Patent Office on May 24, 2013, the application number is 201310198561. 2. The priority of the Chinese patent application entitled "application type identification method and network device" is The entire contents are incorporated herein by reference. TECHNICAL FIELD The present invention relates to the field of network communication technologies, and in particular, to an application type identification method and a network device. BACKGROUND OF THE INVENTION Deep Packet Inspection (DPI) technology is an application layer-based traffic detection and control technology. Network devices can use the DPI technology to identify Internet Protocol (IP) packets, and IP packets. The text usually consists of IP quintuple and application layer data. The network device can detect and analyze the source IP address, destination IP address, source port number, destination port number, and transport layer protocol in the quintuple, and can The application layer data of the IP packet is analyzed to identify the specific application of the IP packet.

In the prior art, when the application of the packet is identified, the keyword information needs to be extracted from the application layer data of the packet, the keyword information is matched with the rule in the rule database, and the packet is identified according to the matching result. Applications. However, due to the large number of rules recorded in the rule database and the need to run a matching algorithm in the keyword information matching process, the processing process is slow and consumes a large amount of processing resources, resulting in inefficient application type identification. Summary of the invention

The application type identification method and the network device are provided in the embodiment of the present invention to solve the problem that the application layer protocol type identification efficiency in the prior art is not high.

In order to solve the above technical problem, the embodiment of the present invention discloses the following technical solutions:

In a first aspect, an application type identification method is provided, where the method includes:

Extracting first server address information from the first data packet of the received data stream;

Matching the first server address information with the server application information, where the server application information stores a correspondence between the server address information and the application type;

When the first server address information is matched from the server application information, the application type corresponding to the first server address information is identified as an application type of the data stream. With reference to the first aspect, in a first possible implementation manner of the first aspect, before the extracting the first server address information from the first data packet of the received data stream, the method further includes:

Obtaining the server application information by identifying data packets of different data streams;

The server application information is saved to a server information database.

With the first possible implementation of the first aspect, in a second possible implementation manner of the first aspect, the obtaining, by using the data packet of the different data streams, the server application information, includes:

Determining that a transmission control protocol TCP data message is received;

When the application layer protocol of the TCP data packet is a hypertext transfer protocol (HTTP), and the TCP data packet includes a uniform resource locator URL address, the TCP data packet is identified as a WEB application for accessing the network WEB server. Message

Obtaining a destination address of the TCP data packet as server address information;

The URL address is analyzed to obtain an application type of the WEB server corresponding to the URL address.

With reference to the first possible implementation of the first aspect, or the second possible implementation of the first aspect, in a third possible implementation manner of the first aspect, the method further includes:

When the first server address information is not matched from the server application information, the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs.

Saving the first server application information to the server information database.

With reference to the first aspect, or the first possible implementation of the first aspect, or the second possible implementation of the first aspect, or the third possible implementation of the first aspect, in the first aspect In the four possible implementation manners, the first server address information is extracted from the first data packet of the received data stream, specifically: the quintuple information of the first data packet from the received data stream And extracting a destination internet protocol IP address and a destination port number of the first data packet.

In a second aspect, a network device is provided, where the network device includes:

An extracting unit, configured to extract first server address information from a first data packet of the received data stream; a matching unit, configured to match the first server address information extracted by the extracting unit with server application information The server application information stores a correspondence between the server address information and the application type; the identification unit is configured to: when the matching unit matches the first server address information from the server application information, The application type corresponding to the first server address information is identified as the application type of the data stream.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the device further includes: The obtaining unit is configured to obtain the server application information by identifying the data packet of the different data streams, and the saving unit is configured to save the server application information obtained by the obtaining unit to the server information database. With reference to the first possible implementation of the second aspect, in a second possible implementation manner of the second aspect, the obtaining unit includes:

a TCP data packet determining subunit, configured to determine that a TCP data packet is received;

a WEB application message identification subunit, configured to: when the application layer protocol of the TCP data packet is HTTP,

When the TCP data packet includes the URL address, the TCP data packet is identified as a WEB application packet that accesses the WEB server.

The address information obtaining sub-unit is configured to obtain the destination address of the TCP data packet as the server address information, and the application type analysis sub-unit, configured to analyze the URL address to obtain an application type of the WEB server corresponding to the URL address.

With reference to the first possible implementation of the second aspect, or the second possible implementation of the second aspect, in a third possible implementation manner of the second aspect, the obtaining unit is further used to When the matching unit does not match the first server address information from the server application information, the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs;

The saving unit is further configured to save the first server application information obtained by the obtaining unit to the server information database.

With reference to the second aspect, or the first possible implementation of the second aspect, or the second possible implementation of the second aspect, or the third possible implementation of the second aspect, in the second aspect In the four possible implementation manners, the extracting unit is specifically configured to extract, from the quintuple information of the first data packet of the received data stream, a destination IP address and a destination port number of the first data packet. .

In a third aspect, a network device is provided, where the network device includes: a bus, and a memory, a network interface, and a processor connected through the bus, where

The memory is configured to save server application information;

The network interface is configured to receive a first data packet of a data stream;

The processor is configured to extract first server address information from the first data packet, match the first server address information with the server application information, and save the server address in the server application information Corresponding relationship between the information and the application type, when the first server address information is matched from the server application information, the application type corresponding to the first server address information is identified as the application type of the data flow.

In conjunction with the third aspect, in a first possible implementation manner of the third aspect, the processor is further configured to pass Identifying data packets of different data streams, obtaining server application information, and saving the server application information to a server information database in the memory.

With reference to the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, the processor is specifically configured to determine that the TCP data packet is received, when the TCP data packet is received. When the application layer protocol is HTTP, and the TCP data packet includes the URL address, the TCP data packet is identified as a WEB application packet that accesses the WEB server, and the destination address of the TCP data packet is obtained as a server address. Information, and analyzing the URL address to obtain an application type of the WEB server corresponding to the URL address.

With reference to the first possible implementation of the third aspect, or the second possible implementation of the third aspect, in a third possible implementation manner of the third aspect, the processor is further used when When the server information is matched to the first server address information, the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs, and the first server is obtained. Server application information is saved to the server information database.

With reference to the third aspect, or the first possible implementation of the third aspect, or the second possible implementation of the third aspect, or the third possible implementation of the third aspect, in the third aspect In the four possible implementation manners, the processor is specifically configured to extract, from the quintuple information of the first data packet, a destination IP address and a destination port number of the first data packet.

In the embodiment of the present invention, the first server address information is extracted from the first data packet of the received data stream, and the first server address information is matched with the server application information, and the first server is matched from the server application information. When the address information is used, the application type corresponding to the first server address information is identified as the application type of the data stream. In the embodiment of the present invention, the server application information is established, so that when the data packet is received, no keyword extraction and rule matching are needed, but the server address information of the data packet is matched with the server application information, thereby quickly identifying The application type of the data stream to which the data packet belongs is improved, and the application type identification efficiency of the message is improved. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the prior art description will be briefly described below, and it is obvious that it is common in the art. For the technicians, other drawings can be obtained based on these drawings without paying for creative labor.

FIG. 1A is a schematic diagram of an application scenario according to an embodiment of the present invention; IB is a flowchart of an embodiment of an application type identification method according to the present invention;

2 is a flow chart of another embodiment of an application type identification method according to the present invention;

3 is a flow chart of another embodiment of an application type identification method according to the present invention;

4 is a block diagram of an embodiment of a network device of the present invention;

Figure 5 is a block diagram of another embodiment of a network device of the present invention;

6 is a block diagram of another embodiment of a network device of the present invention. The above described objects, features and advantages of the embodiments of the present invention will become more apparent and understood. The technical solution is described in further detail.

FIG. 1A is a schematic diagram of an application scenario according to an embodiment of the present invention:

In FIG. 1A, the terminal accesses the network device through the network, and the network device is connected to the server. The terminal can be specifically a personal computer or a mobile phone; the network device can be specifically a gateway device, a routing device, a firewall device, etc.; the server can be specifically a TOB application server. In this embodiment, the network device can save the correspondence between the server address information and the application type through the database. When the terminal needs to access the application on the server, the network device sends the data stream to the network device, and the network device can send the server address in the data stream packet. The information is matched with the database, and the application type of the data stream is directly identified, that is, the application type of the application on the server to be accessed by the data stream is obtained.

Referring to FIG. 1B, it is a flowchart of an embodiment of an application type identification method according to the present invention. The embodiment describes a process of identifying a data packet application from a network device side:

Step 101: Extract the first server address information from the first data packet of the received data stream. In this embodiment, each data packet of the data stream carries five-tuple information, where the quintuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol, and the transport layer protocol mainly includes Transmit ssion Control Protocol (TCP) and User Datagram Protocol (UDP). In this embodiment, the network device that receives the data packet may specifically refer to a gateway device, a routing device, a firewall device, and the like.

The network device may extract the destination IP address and the destination port number of the first data packet from the received quintuple information of the first data packet, and use the extracted information as the first server address information. The first data packet of the data stream in this embodiment may be the first packet of the data stream, or may belong to the data stream. Other data messages except the first message.

Step 102: Match the first server address information with the server application information, where the server application information stores the correspondence between the server address information and the application type.

In the embodiment of the present invention, the server application information may be information obtained by the network device after identifying the data packets that access different TOB servers before identifying the first data packet. The server application information stores the correspondence between the server address information and the application type. The server address information may include the IP address and port number of the TOB server, and the application type mainly refers to the types of applications that the TOB server can provide, for example, video application, social Application, Peer to Peer (P2P) service application, etc. In this embodiment, by establishing server application information, the application type of the data stream to which the TOB application message accessing the TOB server belongs can be quickly matched and identified.

Step 103: When the first server address information is matched from the server application information, the application type corresponding to the first server address information is identified as the application type of the data stream to which the first data packet belongs.

In this embodiment, since the server application information stores the correspondence between the server address information and the application type, when the first server address information of the first data packet is found from the server application information, the first server address information is used. The corresponding application type can be directly identified as the application type of the data stream to which the first data message belongs.

It can be seen from the foregoing embodiment that the server application information is established in this embodiment, so that when the data packet is received, no keyword extraction and rule matching are needed, but the server address information of the data packet and the server application information are used. Matching, thereby quickly identifying the application type of the data stream to which the data message belongs, and improving the application type identification efficiency of the message.

Referring to FIG. 2, it is a flowchart of another embodiment of an application type identification method according to the present invention. The embodiment describes in detail a process of establishing server application information before applying data type identification to a data packet:

Step 201: Determine that a TCP data packet is received.

In this embodiment, each data packet carries quintuple information, and the quintuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol, and the transport layer protocol mainly includes TCP and UDP. . In this embodiment, the network device that receives the data packet may specifically refer to a gateway device, a routing device, a firewall device, and the like. When receiving the data packet, the network device may determine whether to receive the TCP data packet according to the transport layer protocol in the quintuple information of the data packet. In this embodiment, since the first packet of each data stream does not generally include application data, when the application of the data stream is identified, it is determined that the received TCP data packet is usually the first packet of the data stream. Follow-up message. Step 202: Determine whether the TCP data packet is a TOB application message, and if yes, execute step 203; otherwise, end the current process.

After the network device identifies the TCP data packet, it further identifies whether the TCP data packet is a TOB application packet. The condition for identifying the TOB application message may include: the application layer protocol of the TCP data message is a Hypertext Transfer Protocol (HTTP), and the TCP data message includes a Uniform Resource Locator (URL). When the address is obtained, the TCP data packet can be identified as a TOB application packet that accesses the WEB server.

Step 203: Obtain a destination address of the TCP data packet as server address information.

When the TCP data packet is identified as a TOB application packet, the destination device to be accessed by the TCP data packet is a TOB server, and the network device extracts the destination IP address from the quintuple information of the TCP data packet. The destination port number, the destination IP address and the destination port number are the server address information of the TOB server.

Step 204: Analyze the URL address of the TCP data packet to obtain the application type of the TOB server corresponding to the URL address.

The URL address is the webpage address, and the URL address of the TCP data packet reflects the webpage address of the application on the TOB server to be accessed by the TCP data packet. The application type of the TOB server can be obtained by analyzing the webpage address, and the application type can be Including video applications, social applications, peer-to-peer applications, and more. For example, if the URL address of the TCP data message is "www.tv. ***.com", then by analyzing the keyword "tv" contained in the URL address, it can be determined that the TCP data message is to be accessed on the TOB server. The application type of the app is a video app. In this embodiment, a TOB server has an IP address, and a TOB server may have more than one application, and each application may correspond to a port number, that is, an IP address and a port number may correspond to a TOB server. An application.

Step 205: Save the correspondence between the server address information and the application type as the server application information to the server information database, and end the current process.

Saving the correspondence between the server address information of the TOB server obtained in step 203 and the application type of the TOB server to the server information database, and for the subsequent access to the data packet of the same TOB server, by searching the server information database, The application type of the data stream to which the data message belongs is quickly identified.

As can be seen from the foregoing embodiment, the embodiment establishes the server application information by identifying the TOB application message, so that the network device can quickly identify the WEB application of the subsequently received data message, thereby improving the application type identification efficiency of the message. FIG. 3 is a flowchart of another embodiment of an application type identification method according to the present invention. The embodiment identifies the application of the received data packet based on the server application information saved in the embodiment shown in FIG. 2: Step 301: The network device receives the first data packet of the data stream.

In this embodiment, the network device that receives the data packet may specifically refer to a gateway device, a routing device, a firewall device, and the like. Preferably, the first data packet of the data stream may be the first packet of the data stream.

Step 302: Extract the destination IP address and the destination port number from the quintuple information of the first data packet. In this embodiment, each data packet carries quintuple information, and the quintuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol, and the transport layer protocol mainly includes TCP and UDP. . The network device may extract the destination IP address and the destination port number of the first data packet from the quintuple information of the first data packet, and use the extracted information as the first server address information of the first data packet. .

Step 303: Match the destination IP address and the destination port number with the server application information saved in the server information database.

As can be seen from the embodiment shown in Fig. 2, in the server application information of the server information database, the correspondence between the server address information and the application type is saved. In this embodiment, the destination IP address and the destination port number of the first data packet extracted in step 302 are matched with the saved server application information, so as to determine whether the destination address can be found from the server address information of the server application information. IP address and destination port number.

Step 304: Determine whether the destination IP address and the destination port number are matched from the server application information. If yes, go to step 305; otherwise, go to step 306.

Step 305: Identify the application type corresponding to the destination IP address and the destination port number as the application type of the data stream to which the first data packet belongs, and end the current process.

When the destination IP address and the destination port number of the first data packet are matched from the server application information, the application type corresponding to the destination IP address and the destination port number is directly identified as the application of the data stream to which the first data packet belongs. Types of.

Step 306: Determine whether the subsequent packet of the data stream to which the first data packet belongs is a TOB application packet, and if yes, execute step 307; otherwise, end the current process.

When the destination IP address and the destination port number of the first data packet are not matched, the data stream to which the first data packet belongs is a data stream that is not recognized by the network device, and the network device receives the data stream. After the subsequent packet of the data stream, it is determined whether the subsequent packet is a WEB application packet, so as to further identify the application of the data stream. The condition for identifying the TOB application message may include: when the application layer protocol of the TCP data packet is HTTP, and the TCP data packet includes the URL address, the TCP data packet may be identified as a TOB application report that accesses the TOB server. Text.

Step 307: Analyze the application type of the TOB server corresponding to the URL address included in the subsequent message.

When the subsequent packet is identified as a TOB application packet, the destination device to which the first data packet belongs is a WEB server, and the destination IP address and the destination port number of the subsequent packet are the TOB server. Server address information; and, by analyzing the URL, an application type of the TOB server may be obtained, and the application type may include a video application, a social application, a peer-to-peer service application, and the like. For the process of identifying the subsequent packets in this step, refer to the description of the embodiment of FIG. 2, that is, the data stream to which the first data packet belongs is used as a new data stream to identify the application type, and the recognition result is saved, and the specific process is not described again.

When it is identified that the subsequent packet is not a WEB application packet, the network device may identify the application of the data stream to which the first data packet belongs according to the identification method in the prior art, which is not described in this embodiment.

Step 308: Save the correspondence between the destination IP address and the destination port number of the subsequent packet and the application type as the server application information to the server information database, and end the current process.

Saving the correspondence between the server address information of the TOB server obtained in step 307 and the application type of the TOB server to the server information database, and the subsequent network device receives the same application as the data stream to which the first data packet belongs. When the data packet of the data stream is used, the network device can quickly identify the application type of the data stream by searching the server information database.

Corresponding to the embodiment of the application type identifying method of the present invention, the present invention also provides an embodiment of a network device that performs the application type identifying method.

Referring to FIG. 4, it is a block diagram of an embodiment of a network device according to the present invention:

The network device includes: an extracting unit 410, a matching unit 420, and an identifying unit 430.

The extracting unit 410 is configured to extract first server address information from the first data packet of the received data stream;

The matching unit 420 is configured to match the first server address information extracted by the extracting unit 410 with server application information, where the server application information stores the server address information and the application type. Correspondence relationship

The identifying unit 430 is configured to identify, when the matching unit 420 matches the first server address information from the server application information, an application type corresponding to the first server address information as the data stream. App types.

Optionally, the extracting unit 410 is specifically configured to extract, from the quintuple information of the received first data packet, a destination IP address and a destination port number of the first data packet.

Referring to FIG. 5, it is a block diagram of another embodiment of a network device according to the present invention:

The network device includes: an obtaining unit 510, a saving unit 520, an extracting unit 530, a matching unit 540, and an identifying unit 550.

The obtaining unit 510 is configured to obtain the server application information by identifying data packets of different data streams.

The saving unit 520 is configured to save the server application information obtained by the obtaining unit 510 to a server information database;

The extracting unit 530 is configured to extract first server address information from the first data packet of the received data stream;

The matching unit 540 is configured to match the first server address information extracted by the extracting unit 530 with the server application information, where the server application information stores a correspondence between the server address information and the application type.

The identifying unit 550 is configured to identify, when the matching unit 540 matches the first server address information from the server application information, an application type corresponding to the first server address information as the first data. The application type of the data stream to which the message belongs.

In an optional implementation:

The obtaining unit 510 may include (not shown in FIG. 5): a TCP data packet determining subunit, configured to determine that a TCP data packet is received; and a TOB application message identifying subunit, configured to be used as the TCP datagram When the application layer protocol of the text is HTTP, and the TCP data packet includes the URL address, the TCP data packet is identified as a TOB application packet for accessing the WEB server; and the address information obtaining subunit is configured to acquire the TCP The destination address of the data packet is used as server address information. The application type analysis sub-unit is configured to analyze the URL address to obtain an application type of the TOB server corresponding to the URL address.

In another alternative implementation:

The obtaining unit 510 may be further configured to: when the matching unit does not use the server application information When the first server address information is configured, the first server application information is obtained by identifying a subsequent packet of the data stream to which the first data packet belongs;

The saving unit 520 is further configured to save the first server application information obtained by the obtaining unit 510 to the server information database.

In another alternative implementation:

The extracting unit 530 may be specifically configured to extract a destination IP address and a destination port number of the first data packet from the quintuple information of the first data packet of the received data stream.

Referring to FIG. 6, a block diagram of another embodiment of a network device according to the present invention:

The network device includes: a bus 610, and a memory 620, a network interface 630, and a processor 640 connected by the bus 610.

The memory 620 is configured to save server application information.

The network interface 630 is configured to receive a first data packet of the data stream.

The processor 640 is configured to extract first server address information from the first data packet, match the first server address information with the server application information, and save the server in the server application information. Corresponding relationship between the address information and the application type, when the first server address information is matched from the server application information, identifying an application type corresponding to the first server address information as an application type of the data flow .

In an optional implementation:

The processor 640 is further configured to: obtain server application information by identifying data packets of different data streams, and save the server application information to a server information database in the memory.

In another alternative implementation:

The processor 640 may be specifically configured to determine that the TCP data packet is received. When the application layer protocol of the TCP data packet is HTTP, and the TCP data packet includes a URL address, the TCP data is identified. The message is a TOB application message that accesses the TOB server, obtains a destination address of the TCP data packet as server address information, and analyzes the URL address to obtain an application type of the TOB server corresponding to the URL address.

In another alternative implementation:

The processor 640 is further configured to: after the first server address information is not matched from the server application information, identify, by obtaining, a subsequent packet of the data stream to which the first data packet belongs First server application information, and saving the first server application information to the server information data Library.

In another alternative implementation:

The processor 640 is specifically configured to extract a destination IP address and a destination port number of the first data packet from the quintuple information of the first data packet.

It can be seen from the foregoing embodiment that the first server address information is extracted from the first data packet of the received data stream, the first server address information is matched with the server application information, and the first server is matched from the server application information. In the address information, the application type corresponding to the first server address information is identified as the application type of the data stream to which the first data message belongs. In the embodiment of the present invention, the server application information is established, so that when the data packet is received, no keyword extraction and rule matching are needed, but the server address information of the data packet is matched with the server application information, thereby quickly identifying The application type of the data stream to which the data packet belongs is improved, and the application type identification efficiency of the message is improved.

Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution in the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, and the computer software product may be stored in a storage medium, such as a ROM/RAM. , a diskette, an optical disk, etc., comprising instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or in certain portions of the embodiments.

The various embodiments in the present specification are described in a progressive manner, and the same or similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment. The embodiments of the present invention described above are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Rights request

1. An application type identification method, characterized in that the method includes:

Extract the first server address information from the first data packet of the received data stream;

Match the first server address information with server application information, and the server application information stores the corresponding relationship between the server address information and the application type;

When the first server address information is matched from the server application information, the application type corresponding to the first server address information is identified as the application type of the data flow.

2. The method according to claim 1, characterized in that, before extracting the first server address information from the first data message of the received data stream, the method further includes:

Obtain the server application information by identifying data packets of different data streams;

Save the server application information to a server information database.

3. The method of claim 2, wherein the server application information is obtained by identifying data packets of different data streams, including:

Confirm receipt of Transmission Control Protocol TCP data message;

When the application layer protocol of the TCP data message is Hypertext Transfer Protocol HTTP, and the TCP data message contains a uniform resource locator URL address, the TCP data message is identified as a WEB application accessing the network WEB server. message;

Obtain the destination address of the TCP data message as server address information; and

Analyze the URL address to obtain the application type of the WEB server corresponding to the URL address.

4. The method according to claim 2 or 3, characterized in that the method further includes:

When the first server address information is not matched from the server application information, the first server application information is obtained by identifying subsequent messages of the data flow to which the first data message belongs;

Save the first server application information to the server information database.

5. The method according to any one of claims 1 to 4, characterized in that: extracting the first server address information from the first data message of the received data stream, specifically: extracting the first server address information from the received data The destination Internet Protocol IP address and destination port number of the first data message are extracted from the five-tuple information of the first data message of the flow.

6. A network device, characterized in that, the network device includes:

An extraction unit, configured to extract the first server address information from the first data packet of the received data stream; A matching unit, configured to match the first server address information extracted by the extraction unit with the server application information , the server application information stores the corresponding relationship between the server address information and the application type; the identification unit is used to match the first server address information with the matching unit when the matching unit matches the first server address information from the server application information. The application type corresponding to the first server address information is identified as the application type of the data flow.

7. The network device according to claim 6, characterized in that the device further includes:

The obtaining unit is used to obtain the server application information by identifying data packets of different data streams; the saving unit is used to save the server application information obtained by the obtaining unit to the server information database.

8. The network device according to claim 7, characterized in that the obtaining unit includes:

TCP data message determination subunit, used to determine receipt of the TCP data message;

WEB application message identification subunit, used to identify the TCP data message as a WEB accessing the WEB server when the application layer protocol of the TCP data message is HTTP and the TCP data message contains a URL address. Application message; Address information acquisition subunit, used to obtain the destination address of the TCP data message as server address information; Application type analysis subunit, used to analyze the URL address to obtain the WEB server corresponding to the URL address application type.

9. The network device according to claim 7 or 8, characterized in that,

The obtaining unit is also configured to identify subsequent messages of the data flow to which the first data message belongs when the matching unit does not match the first server address information from the server application information. , obtain the application information of the first server;

The saving unit is also configured to save the first server application information obtained by the obtaining unit to the server information database.

10. The network device according to any one of claims 6 to 9, characterized in that,

The extraction unit is specifically configured to extract the five-tuple information of the first data message of the received data stream. Describe the destination IP address and destination port number of the first data message.