WO2017113900A1 - 网络流量中的应用信息的识别方法和装置 - Google Patents

网络流量中的应用信息的识别方法和装置 Download PDF

Info

Publication number
WO2017113900A1
WO2017113900A1 PCT/CN2016/099891 CN2016099891W WO2017113900A1 WO 2017113900 A1 WO2017113900 A1 WO 2017113900A1 CN 2016099891 W CN2016099891 W CN 2016099891W WO 2017113900 A1 WO2017113900 A1 WO 2017113900A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
record
data stream
identification
terminal device
Prior art date
Application number
PCT/CN2016/099891
Other languages
English (en)
French (fr)
Inventor
李有永
熊鹰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16880693.3A priority Critical patent/EP3297213B1/en
Priority to EP18200601.5A priority patent/EP3496338B1/en
Priority to JP2018502243A priority patent/JP6599538B2/ja
Priority to ES16880693T priority patent/ES2746351T3/es
Publication of WO2017113900A1 publication Critical patent/WO2017113900A1/zh
Priority to US15/839,329 priority patent/US11582188B2/en
Priority to US16/737,373 priority patent/US11855967B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/028—Capturing of monitoring data by filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
    • H04L63/302—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information gathering intelligence information for situation awareness or reconnaissance
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/06—Generation of reports
    • H04L43/062—Generation of reports related to network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2475—Traffic characterised by specific attributes, e.g. priority or QoS for supporting traffic characterised by the type of applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/10—Flow control between communication endpoints
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services

Definitions

  • the present invention relates to the field of computer and network communication technologies, and in particular, to a method for identifying application information in network traffic and an apparatus for identifying application information in network traffic.
  • the network security device includes a security gateway, a firewall, and a Deep Packet Inspection (DPI) device, and has a packet forwarding function for traffic analysis and management functions.
  • DPI Deep Packet Inspection
  • Traffic identification technology is divided into protocol identification technology and application identification technology.
  • protocol identification technology refers to the network security device determining the type of protocol to which each data flow flows through the device, and further determining the proportion of data flows of different protocol types in the total traffic.
  • Application in this application refers to application software that provides specific functions and has network access and message processing capabilities. After running such an application software on a terminal device, the network interface on the terminal device can be opened, a connection is established with another terminal device in the network through the opened interface, and a series of packets are transmitted through the established connection, and then passed. Processing the received message provides the user with a specific function. For example, web browser Internet Explorer (IE), instant messaging software Tencent QQ, File Transfer Protocal (FTP) client FileZilla, etc.
  • IE Internet Explorer
  • FTP File Transfer Protocal
  • HTTP Hypertext Transfer Protocol
  • the application Since the application is running on the protocol, in other words, the same protocol can run many different applications, such as peer-to-peer (P2P) clients, and the web browser is based on Hypertext Transfer Protocol (HyperText). Transfer Protocol, HTTP) protocol to achieve. in case Only based on the HTTP protocol for traffic identification and management, it is impossible to distinguish whether a data stream is sent by a P2P client or sent by a web browser. If the application identification technology can distinguish which data flow of the HTTP protocol is sent, then it can be known whether the user is engaged in work-related webpage access activities or online games that are not related to work, thereby blocking online games. The traffic caused. Therefore, compared with the traditional protocol identification technology, more sophisticated management control effects can be obtained by applying the identification technology.
  • Existing application recognition technologies mainly include feature-based recognition technology, heuristic recognition technology, and association recognition technology.
  • the feature-based identification technology refers to the application of the message format design, such as a unique keyword or a fixed-position field content, to identify an application that sends the message. For example, after receiving the packet, the network security device searches whether the packet carries the keyword “PPLiveVA”. If the keyword “PPLiveVA” is carried, it indicates that the application is a network television PPTV.
  • the heuristic identification technology refers to the phenomenon that the length of the message sent by an application, the appearance of characters in the content of the message, the interaction rule of the communication parties, and the interval of sending the message are obtained. A statistically significant rule is applied to distinguish the application of the transmitted message by this rule. Heuristic recognition technology has a certain recognition effect on encrypted messages or messages sent using private undisclosed protocols. However, since the rule acquisition method is obtained through statistical analysis, there is a problem that the false negative rate and the false positive rate are high.
  • the association identification technology matches the IP address, the port number, and the protocol identifier of the packet with the association identification rule including the correspondence between the IP address, the port number, the protocol identifier, and the application, and identifies the application for sending the packet.
  • the features and rules that the existing application identification technology relies on are analyzed by manually analyzing a large number of collected messages.
  • the network security device manufacturer or a third-party organization that cooperates with the network security device manufacturer uploads an update rule base including features and rules to the upgrade website, and the network security device obtains an update rule base from the upgrade website, thereby ensuring the network security device.
  • Recognition ability Even if the rule base is not upgraded in time and the accuracy of the heuristic identification technology is not high, the existing application identification technology still cannot identify a considerable proportion of network traffic, or a considerable proportion of network traffic is incorrectly identified.
  • the embodiment of the present application provides a method for identifying application information in network traffic, which is used to improve the recognition effect of the application identification technology.
  • the first aspect provides a method for identifying application information in network traffic, where the method is performed by a terminal device, where a first correspondence table in the terminal device is stored in the terminal in a recorded manner.
  • the second correspondence table storing, in a record manner, a second correspondence between the identifier of the application and the identifier of the process created by the application, the data
  • the identifier of the flow is a five-tuple consisting of a source address, a source port, a destination address, a destination port, and a protocol identifier.
  • the method includes:
  • the terminal device finds, in the first correspondence table, a first record that stores an identifier of the first data stream, and acquires an identifier of a process in the first record.
  • the terminal device finds, in the second correspondence table, a second record that stores an identifier of a process in the first record, and acquires an identifier of the application from the second record;
  • the terminal device searches for the locally saved correspondence table according to the identifier of the data flow sent by the network security device, and then feeds back the identifier of the application to the network security device, thereby assisting network security.
  • the device determines the application identification result of the data stream.
  • the terminal device can obtain and update the first correspondence table in the following manner to ensure the real-time performance of the first correspondence table and reduce the occupied storage space.
  • the terminal device obtains the first correspondence table by using the following steps:
  • the terminal device obtains an identifier of at least one process running in the terminal device by using an interface provided by the operating system;
  • the terminal device obtains the first correspondence table by using the following steps:
  • the terminal device obtains an event of the operating system creation process by using a hook function
  • the acquiring, by the terminal device, the first correspondence table further includes:
  • the terminal device obtains an event that the operating system exits the process by using a hook function
  • the record in the first correspondence table further includes a last activity time of the data stream; the method further includes:
  • the method further includes:
  • the method further includes:
  • the message status identifier is FIN, deleting the record in the first correspondence table that includes the identifier of the data stream to which the message belongs.
  • the method further includes:
  • the terminal device After the terminal device captures the packet transmitted by the process through the interface of the operating system, the terminal device obtains and stores the complete data stream that is subsequently transmitted by the process.
  • a terminal device comprising a memory, a processor, and a network interface, wherein the memory, the processor, and the network interface communicate with each other through a bus;
  • the memory stores a program code, a first correspondence table, and a second correspondence table, where the first correspondence table stores, in a record manner, a correspondence between an identifier of a process running in the terminal and an identifier of a data flow established by the process
  • the second correspondence table stores, in a record manner, a second correspondence between the identifier of the application and the identifier of the process created by the application, where the identifier of the data stream is a source address, a source port, a destination address, a destination port, and a five-tuple composed of agreement identifiers;
  • the network interface is configured to receive an identifier of the first data stream sent by the network security device
  • the processor reads the program code stored in the memory and executes:
  • the first correspondence table the first record that holds the identifier of the first data stream is found, and the identifier of the process in the first record is obtained; in the second correspondence table, the save is found. a second record having an identifier of the process in the first record, and obtaining an identifier of the application from the second record;
  • the network interface is further configured to send, to the network security device, an identifier of an application acquired by the processor.
  • the processor is further configured to obtain the first correspondence table by: obtaining, by using an interface provided by an operating system, an identifier of at least one process running in the terminal device; for each process obtained And the identifier of the data stream created by the process is obtained by the terminal device, and a record including the identifier of the process and the identifier of the data stream is generated; and the record is saved in the first correspondence table.
  • the processor is further configured to obtain the first correspondence table by:
  • the record in the first correspondence table further includes a last activity time of the data stream
  • the processor is further configured to determine an expired record in the first correspondence table, where the expired record refers to a record in which a time interval between a last active time and a current time of the included data stream exceeds a predetermined time interval; The expired record.
  • the terminal device obtains a packet transmitted by the terminal device by using a hook function
  • the terminal device obtains a packet transmitted by the terminal device by using a hook function
  • the message status identifier is FIN, deleting the record in the first correspondence table that includes the identifier of the data stream to which the message belongs.
  • a network security device including a memory, a processor, and a network interface, wherein the memory, the processor, and the network interface communicate with each other through a bus;
  • the network interface is configured to receive a first data stream
  • the processor is configured to read program code stored in the memory, and execute:
  • the identifier of the first data stream is obtained, where the identifier of the data stream is a source address, a source port, a destination address, a destination port, and a protocol identifier. Transmitting, by the network interface, the identifier of the data stream to the terminal device according to the source address or the destination address in the identifier of the first data stream, where the address of the terminal device is the first data stream Source or destination address in the identifier;
  • the network interface is further configured to receive an identifier of the application that is sent by the terminal device, and determine that the identifier of the received application is an identifier of an application that sends the first data stream.
  • the network security device provided by the embodiment of the present application can identify more applications through interaction with the terminal device, thereby reducing the proportion of unidentified traffic in the total traffic, and improving the recognition effect of the network traffic.
  • a fourth aspect provides an identification system for application information in network traffic, which is characterized by comprising a network security device and a terminal device, wherein:
  • the network security device is configured to receive a first data stream, and obtain a label of the first data stream
  • the identifier of the data stream is a quintuple consisting of a source address, a source port, a destination address, a destination port, and a protocol identifier; and according to the source address or the destination address in the identifier of the first data stream,
  • the terminal device sends an identifier of the data stream, where the address of the terminal device is a source address or a destination address in the identifier of the first data stream, and receives an identifier of an application sent by the terminal device, and determines the received identifier.
  • the identifier of the application is an identifier of an application that sends the first data stream;
  • the terminal device stores a first correspondence table and a second correspondence table, where the first correspondence table stores a correspondence between an identifier of a process running in the terminal and an identifier of a data flow established by the process, and a second The correspondence table stores a second correspondence between the identifier of the application and the identifier of the process created by the application, where the identifier of the data stream is a quintuple composed of a source address, a source port, a destination address, a destination port, and a protocol identifier.
  • the terminal device is configured to receive an identifier of the first data stream that is sent by the network security device, and in the first correspondence table, find the first record that holds the identifier of the first data stream, and obtain the first An identifier of the process in the record; in the second correspondence table, finding a second record in which the identifier of the process in the first record is saved, and obtaining an identifier of the application from the second record;
  • the network security device sends the identity of the application.
  • the network security device determines the application identification result of the data flow according to the feedback of the terminal device. Compared with the prior art, the above system can identify more applications through the interaction between the network security device and the terminal device, thereby reducing the proportion of unidentified traffic in the total traffic and improving the identification of network traffic. effect.
  • the network security device may also generate new association rules according to the feedback of the terminal.
  • the network security device is further configured to generate a first association identification rule and a second association identification rule, where the first association identification rule includes an identifier of the application and a destination address of the first data stream a triplet composed of a destination port and a protocol number, where the second association identification rule includes an identifier of the application and a triplet composed of a source address, a source port, and a protocol number of the first data stream;
  • Receiving a second data stream acquiring at least one of a destination triplet and a source triplet of the second data stream, where a destination triplet of the second data stream is a destination address of the second data stream a triplet composed of a destination port and a protocol number, where the source triplet of the second data stream is a triplet composed of a source address, a source port, and a protocol number of the second data stream;
  • the fifth aspect provides a method for identifying application information in network traffic, including:
  • the first identification record includes an identifier of the first data stream and an identifier of the application, where the identifier of the data stream is a source address, a source port, a destination address, a destination port, and a five-tuple composed of agreement identifiers;
  • the second identification record includes an identifier of the second data stream and an identifier of the process
  • each record in the correspondence table stores an identifier of the application and the application
  • the identifier of the created process that is, the correspondence between the identifier of the application and the identifier of the process is saved by the record in the corresponding table;
  • the identifier of the first data stream included in the first identification record is the same as the identifier of the second data stream included in the second identification record, querying whether the first associated record exists in the correspondence table, The identifier of the application in the first identification record and the identifier of the process included in the second identification record are saved in the first association record;
  • the first identification record is determined to be an error identification record.
  • the data processing device can identify the error identification record of the network security device that is difficult to find by the technology by comparing the identification records of the terminal device and the network security device, and improve the network. The recognition effect of traffic.
  • the method further includes:
  • the data processing device may also notify the network security device to delete the association identification rule that caused the misidentification.
  • the first identification record further includes an identifier of the identification manner, where the identification manner includes association identification, feature recognition, and heuristic recognition;
  • the method further includes:
  • the data processing device may also notify the network security device to generate a correct association identification rule.
  • the method further includes:
  • the second associated record exists, generating a third association rule and a fourth association rule, where the third association rule includes an identifier of the application in the second associated record and a destination address of the first data stream, a triplet composed of a destination port and a protocol number, where the fourth association rule includes an identifier of an application in the second association record and a triplet composed of a source address, a source port, and a protocol number of the first data stream;
  • it also includes:
  • the third identification record comprising an identifier of the third data stream and an unidentified identifier, the unidentified identifier being used to indicate that the network security device does not recognize the sending the Application of three data streams;
  • the identifier of the third data stream included in the third identification record is the same as the identifier of the fourth data stream included in the fourth identification record, query whether there is a second associated record in the correspondence table.
  • the identifier of the process included in the fourth identification record is stored in the third associated record;
  • the third associated record exists, generating a fifth association identification rule and a sixth association identification rule, where the fifth association identification rule includes an identifier of the application included in the third associated record and the third data a triplet composed of a destination address, a destination port, and a protocol number of the stream, where the sixth association identification rule includes an identifier of the application included in the third associated record and the third data a triple consisting of the source address, source port, and protocol number of the stream;
  • it also includes:
  • the third identification record comprising an identifier of the third data stream and an unidentified identifier, the unidentified identifier being used to indicate that the network security device does not recognize the sending the Application of three data streams;
  • the identifier of the third data stream included in the third identification record is the same as the identifier of the fourth data stream included in the fourth identification record, query whether there is a third associated record in the correspondence table.
  • the identifier of the process included in the fourth identification record is stored in the third associated record;
  • the identifier of the application included in the third associated record and the identifier of the third data stream are sent to the network security device.
  • the sixth aspect provides a method for identifying application information in network traffic, including:
  • the first identification record includes an identifier of the first data stream, an identifier of the application, and an identifier of the identification manner, where the identifier of the data stream is a source address, a source port, and a destination.
  • a five-tuple consisting of an address, a destination port, and a protocol identifier, the identification manner including association identification, feature recognition, and heuristic recognition;
  • the identifier of the first data stream included in the first identification record is the same as the identifier of the second data stream included in the second identification record, querying whether the first associated record exists in the correspondence table, The identifier of the application in the first identification record and the identifier of the process included in the second identification record are saved in the first association record;
  • the identifier of the identification manner in the first identification record is an identifier of the association identification manner
  • sending a notification message to the network security device where the notification message is used to notify the
  • the network security device deletes the first association identification rule or the second association identification rule, where the first association rule includes a triplet composed of a destination address, a destination port, and a protocol number of the first data stream, and the second association
  • the identification rule includes a source address of the first data stream, A triple consisting of a source port and a protocol number.
  • the data processing device may also notify the network security device to delete the file to prevent the subsequent error identification record from being caused by the association rule. Misidentified association identification rules.
  • a data processing device comprising a memory, a processor, and a network interface, wherein the memory, the processor, and the network interface communicate with each other through a bus;
  • the memory stores program code
  • the network interface is configured to receive a first identification record from the network security device, where the first identification record includes an identifier of the first data stream and an identifier of the application, where the identifier of the data stream is a source address and a source port. a five-tuple consisting of a destination address, a destination port, and a protocol identifier;
  • the second identification record comprising an identifier of the second data stream and an identifier of the process, each record in the correspondence table holding an identifier of the application and the application The ID of the created process;
  • the processor reads the program code stored in the memory and executes:
  • the identifier of the first data stream included in the first identification record is the same as the identifier of the second data stream included in the second identification record, querying whether the first associated record exists in the correspondence table, The identifier of the application in the first identification record and the identifier of the process included in the second identification record are saved in the first association record;
  • the first identification record is determined to be an error identification record.
  • the first identification record further includes an identifier of the identification manner, where the identification manner includes association identification, feature recognition, and heuristic recognition;
  • the network interface is further configured to: if the identifier of the identification manner in the first identification record is an identifier of an association identification manner, send a notification message to the network security device when the first association record does not exist, The notification message is used to notify the network security device to delete the first association identification rule or the second association identification rule, where the first association rule includes three components consisting of a destination address, a destination port, and a protocol number of the first data stream. a tuple, the second association identification rule including a triple consisting of a source address, a source port, and a protocol number of the first data stream.
  • the network interface is further configured to receive a third identification record from the network security device, where the third identification record includes an identifier of the third data stream and an unidentified identifier, the unidentified identifier Identifying that the network security device does not recognize an application that sends the third data stream;
  • the processor is further configured to determine whether the identifier of the third data stream included in the third identification record is the same as the identifier of the fourth data stream included in the fourth identification record, and then in the correspondence table Query whether there is a second associated record, where the identifier of the process included in the fourth identification record is saved in the third associated record;
  • the third associated record exists, generating a fifth association identification rule and a sixth association identification rule, where the fifth association identification rule includes an identifier of the application included in the third associated record and the third data a triplet composed of a destination address, a destination port, and a protocol number, where the sixth association identification rule includes an identifier of an application included in the third association record and a source address and a source port of the third data stream. a triple consisting of a protocol number;
  • the network interface is further configured to send the fifth association identification rule and the sixth association identification rule to the network security device.
  • the network interface is further configured to receive a third identification record from the network security device, where the third identification record includes an identifier of the third data stream and an unidentified identifier, where the unidentified identifier is used for characterization
  • the network security device does not identify an application that sends the third data stream;
  • the processor is further configured to determine whether an identifier of the third data stream included in the third identification record is the same as an identifier of the fourth data stream included in the fourth identification record, if the third identification record If the identifier of the third data stream included in the fourth identifier is the same as the identifier of the fourth data stream included in the fourth identifier, the third table record is queried in the corresponding table, and the third associated record is saved. There is an identifier of a process included in the fourth identification record;
  • the network interface is further configured to: if the processor determines that the third associated record exists, send the identifier of the application included in the third associated record and the identifier of the third data stream to the network security device.
  • the data processing device provided by the embodiment of the present application can identify the error identification record of the network security device that is difficult to find by the technology by comparing the identification records of the terminal device and the network security device, and improve the recognition effect of the network traffic.
  • the eighth aspect provides an identification system for application information in network traffic, including a data processing device, a terminal device, and a network security device, where:
  • the network security device is configured to receive a first data stream, determine an identifier of an application that sends the first data stream, and generate a first identification record, where the first identification record includes an identifier of the first data stream An identifier of the application, where the identifier of the data flow is a five-tuple consisting of a source address, a source port, a destination address, a destination port, and a protocol identifier, and sending the first identification record to the data processing device;
  • the terminal device is configured to acquire an identifier of a process on the terminal device and an identifier of a second data stream created by the process, to generate a second identification record, where the second identification record includes an identifier of the second data stream and An identifier of the process; and obtaining the correspondence table, each record in the correspondence table storing an identifier of an application and an identifier of a process created by the application; and sending the second identification record and corresponding to the data processing device table;
  • the data processing device is configured to receive a first identification record from the network security device; receive a second identification record and a correspondence table from the terminal device; if the first identification record includes a first The identifier of the data stream is the same as the identifier of the second data stream included in the second identification record, and the first table record is queried whether the first associated record exists in the first associated record.
  • the data processing device in the identification system of the application information in the network traffic provided by the embodiment of the present application can identify the error identification record of the network security device that is difficult to find by the technology by comparing the identification records of the terminal device and the network security device, and improve the network. The recognition effect of traffic.
  • FIG. 1A is a schematic diagram of an application information identification system in network traffic according to an embodiment of the present disclosure
  • FIG. 1B is another system for identifying application information in network traffic according to an embodiment of the present disclosure.
  • FIG. 2 is a flowchart of a method for identifying application information in network traffic according to an embodiment of the present application
  • 3A is a flowchart of obtaining a first correspondence table according to an embodiment of the present application.
  • FIG. 3B is a flowchart of updating a first correspondence table according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a terminal device according to an embodiment of the present application.
  • FIG. 5B is a schematic structural diagram of another terminal device according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a network security device according to an embodiment of the present application.
  • FIG. 6B is a schematic structural diagram of another network security device according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of another system for identifying application information in network traffic according to an embodiment of the present disclosure.
  • FIG. 8A is an interaction diagram of a method for identifying application information in network traffic according to an embodiment of the present disclosure
  • FIG. 8B is an interaction diagram of another method for identifying application information in network traffic according to an embodiment of the present disclosure.
  • FIG. 9A is a schematic structural diagram of a data processing device according to an embodiment of the present application.
  • FIG. 9B is a schematic structural diagram of another data processing device according to an embodiment of the present disclosure.
  • the “data flow” in this application refers to a series of packets transmitted between two terminal devices determined by a source address, a source port, a destination address, a destination port, and a protocol type within a certain period of time.
  • the terminal device in the present application may be a device having a network access function and a running application software capability, such as a portable computer, a server, and a mobile terminal.
  • the identifier of a data flow refers to a five-tuple consisting of a source address, a source port, a destination address, a destination port, and a protocol.
  • the application identification technology refers to the network security device determining which application software in a terminal device is sent by a network device.
  • the method for identifying application information in the network traffic provided by the embodiment of the present application can identify the data flow that cannot be identified by the existing application identification technology through the interaction between the network security device and the terminal device, thereby reducing the unrecognized network.
  • the proportion of traffic in the total network traffic improve the success rate of application identification; or identify some false recognition results, thereby reducing the false positive rate, High application identification accuracy.
  • FIGS. 1A and 1B are schematic diagrams of an identification system for application information in network traffic provided by an embodiment of the present application.
  • the terminal device 110 and the network security device 120 are included in the system.
  • the network security device 120 is deployed in two ways.
  • the first type is a direct path deployment mode as shown in FIG. 1A.
  • the network security device 120 is a device with a message forwarding function.
  • the terminal device 110 may be a personal computer or a server located in a local area network.
  • the network security device 120 is Firewall device in the LAN.
  • the terminal device 110 may also be a personal computer or server located in the Internet, and the network security device 120 is a security gateway.
  • this deployment mode after the network security device 120 obtains the data flow flowing through the network security device 120, it determines the application in the terminal device that sends the data flow.
  • this process is also referred to simply as the network security device 120 identifies the application of the data stream flowing through the network security device 120. Further, the network security device 120 stores a security policy. After the network security device 120 obtains the application identification result of the data flow, the network security device 120 determines a subsequent processing manner of the data flow according to the security policy, for example, blocking the data flow or forwarding the data flow.
  • the security policy for example, blocking the data flow or forwarding the data flow.
  • the second type is the bypass deployment mode as shown in FIG. 1B.
  • the network security device 120 is a bypass device with traffic statistics function, and is used for counting the proportion of traffic of various applications in the total traffic, and Further obtain ranking information for various applications.
  • the network security device 120 receives the mirrored data stream sent by the packet forwarding device, identifies the application of the mirrored data stream, updates the statistical record according to the identification result, and periodically outputs the statistical result.
  • the network security device 120 needs to perform message interaction with the terminal device 110.
  • the functions of the network security device 120 and the terminal device 110 will be described below.
  • the functions of the network security device 120 and the terminal device 110 may be implemented by one of the network security device 120 and the terminal device 110 respectively.
  • the following functions of the network security device 120 are recognized by the application in the network security device 120.
  • the function of the terminal device 110 is implemented by a module in the terminal device 110.
  • the network security device 120 is configured to receive the first data stream, obtain an identifier of the first data stream, and send the data stream to the terminal device 110 according to the source address or the destination address in the identifier of the first data stream.
  • An identifier wherein the address of the terminal device 110 is a source in the identifier of the first data stream Address or destination address.
  • a security policy is stored in the network security device 120.
  • a security policy is a pre-configured rule that allows a particular data stream to be forwarded or a specific data stream to be forwarded. For example, “permit Web browsing (WB)-default deny all” means that only the data stream sent by the web browser is allowed to be forwarded, and the data stream sent by other applications is prohibited. “deny QQ deny P2P-default permit all” means that only the data stream sent by the instant messaging software QQ and P2P client software is prohibited from being forwarded, and the data stream sent by other applications is allowed to be forwarded.
  • security policies that are configured to allow certain data flows to be forwarded such security policies include the identity of the application that is allowed to be forwarded.
  • the security policy only allows forwarding of the data stream sent by the web browser, that is, the application identifier that is only allowed to be forwarded is the identifier WB of the web browser, and then the network security device 120 recognizes the data stream after receiving the data stream.
  • the identifier of the application is WB
  • the data stream is forwarded. If the identifier of the application that sends the data stream is identified as the identifier P2P of the P2P client, not the WB, the data stream is blocked.
  • the network security device 120 When receiving the message in the first data stream, the network security device 120 first identifies the first data stream by using an existing application identification technology such as a feature-based recognition technology, a heuristic recognition technology, or an association recognition technology.
  • an existing application identification technology such as a feature-based recognition technology, a heuristic recognition technology, or an association recognition technology.
  • the security policy configured to allow a specific data flow to be forwarded as an example, if the identification result can be obtained, it is determined whether the security policy includes the identifier of the identified application, and if the identifier of the identified application is included, forwarding the first The message in the data stream; otherwise, if the identifier of the identified application is not included, the message in the first data stream is blocked. If the network security device 120 cannot obtain the identification result according to the above existing application identification technology, that is, the identifier of the application that sends the first data stream cannot be determined, the identifier of the first data stream is obtained, and the identifier of the first data stream is used.
  • the terminal device identified by the source address sends the identifier of the first data stream, or sends the identifier of the first data stream to the terminal device identified by the destination address in the identifier of the first data stream, so as to obtain the interaction with the terminal device.
  • the identifier of the application returned by the terminal device thereby determining that the identifier of the application that sends the first data stream is the identifier of the application returned by the terminal device.
  • the network security device can not only send the identifier of the first data stream or the identifier of the first data stream to the terminal device identified by the source address in the identifier of the first data stream when the identification result cannot be obtained.
  • the terminal device identified by the destination address in the middle sends the identifier of the first data stream.
  • Network security devices can also improve the accuracy of identification, such as when using correlation recognition technology
  • the application identification when an association identification rule is matched for the first time, in order to confirm the accuracy of the association identification rule, the identifier of the first data stream is sent to the terminal device, and the identifier and the application of the application returned by the terminal device are The recognition results obtained by the association identification rule are compared, and if they are the same, it is confirmed that the association identification rule is accurate.
  • the terminal device 110 is configured to obtain a first correspondence table and a second correspondence table, where each record in the first correspondence table stores an identifier of a process running in the terminal device 110 and an identifier of a data flow established by the process,
  • the identifier of the data flow is a five-tuple composed of a source address, a source port, a destination address, a destination port, and a protocol identifier.
  • Each record in the second correspondence table stores an identifier of an application and an identifier of a process created by the application.
  • an application refers to application software. After the OS runs an application, at least one process is created, and each process completes a relatively independent function. That is, one application corresponds to at least one process.
  • a process can only be created and used by one application. Only a very small number of system processes are used by multiple applications. This application does not consider this situation. Such a process is not included in the first correspondence table and the first Two correspondence tables.
  • Sogou Input Method For example, after an application called Sogou Input Method runs, it creates a process called “SogouCloud.exe” and a process called “SogouSmartInfo.exe”, where the process named “SogouCloud.exe” Used to obtain updated font library from the web server, display column icon and other information, named “SogouSmartInfo.exe” is used to obtain intelligent association rules from the web server, for predicting the words that the user will spell according to the words that the user has spelled. Improve input efficiency.
  • SogouCloud.exe Used to obtain updated font library from the web server, display column icon and other information, named “SogouSmartInfo.exe” is used to obtain intelligent association rules from the web server, for predicting the words that the user will spell according to the words that the user has spelled. Improve input efficiency.
  • the terminal device 110 receives the identifier of the first data stream sent by the network security device.
  • the first correspondence table the first record that holds the identifier of the first data stream is found, and the identifier of the process in the first record is obtained; the terminal device searches in the second correspondence table. And to obtain a second record of the identifier of the process in the first record, obtain an identifier of the application from the second record, and send the identifier of the application to the network security device.
  • the network security device in this embodiment may be the network security device 120 in FIG. 1A or FIG. 1B.
  • the network security device discovers an unidentified data stream. Specifically, when the network security device performs application identification on the data stream, the network security device receives at least one packet of the data stream. For each of these messages, the message is forwarded after selectively caching the features according to the rules.
  • the last packet indicating that the data stream is about to end for example, when the packet status is marked as FIN, or after receiving and forwarding a set number of packets in a data stream, it cannot be identified by the existing application.
  • the technology identifies the application that sent the data stream and determines that the data stream is an unidentified data stream.
  • Step 202 The network security device acquires the identifier of the unidentified data stream.
  • the network security device obtains the quintuple of the packet by the parsed packet of the unidentified data stream, that is, the source IP address, the source port, the destination IP address, the destination port, and the protocol type, and the quintuple is unrecognized.
  • the identity of the data stream For example, the obtained quintuple information is "tcp 192.168.1.211:3020-201.6.8.30:6682".
  • the network security device encapsulates the identifier of the data stream "tcp 192.168.1.211:3020-201.6.8.30:6682" in a message P1, and sends a message P1 to the terminal device.
  • the network security device may send the identifier of the data stream “tcp 192.168.1.211:3020-201.6.8.30:6682” to the terminal device with the IP address 192.168.1.211, or the identifier of the data stream “tcp 192.168. 1.211:3020-201.6.8.30:6682” is sent to the terminal device whose IP address is 201.6.8.30, or the identifier of the data stream "tcp 192.168.1.211:3020-201.6.8.30:6682” is sent to the IP address 192.168.1.211.
  • the terminal device with the IP address of 192.168.1.211 and the terminal device with the IP address of 201.6.8.30 can perform similar processing steps.
  • the terminal device with the IP address of 192.168.1.211 is used as an example for the sake of brevity. .
  • Step 204 The terminal device receives the packet P1 sent by the network security device, and parses the packet P1 to obtain the identifier “tcp 192.168.1.211:3020-201.6.8.30:6682” of the data stream carried in the packet P1.
  • Step 205 The terminal device searches for the record of the identifier “tcp 192.168.1.211:3020-201.6.8.30:6682” in which the data stream is saved in the first correspondence table, and if found, performs step 206, if not found, terminates deal with.
  • Step 206 The terminal device obtains the identifier “tcp” from the found record that holds the identifier “tcp 192.168.1.211:3020-201.6.8.30:6682” of the data stream. 192.168.1.211:3020-201.6.8.30:6682"
  • the terminal device stores two correspondence tables, where each record in the first correspondence table stores an identifier of a process running in the terminal device and an identifier of a data flow established by the process. Each record in the second correspondence table holds an identifier of an application and an identifier of a process created by the application.
  • the terminal device can also use a correspondence table to store the identifier of the application, the identifier of the process created by the application, and the correspondence between the identifiers of the data flows established by the process. This application is only for the convenience of the subsequent description.
  • the correspondence between the identifier of the process and the identifier of the data flow established by the process is saved in the first correspondence table, and the correspondence between the identifier of the application and the identifier of the process created by the application is saved in the The second correspondence table.
  • the identifier of the application is saved in the first column
  • the identifier of the process created by the application is saved in the second column
  • the identifier of the data stream established by the process is saved in the third column.
  • the process of searching for the first correspondence table in the subsequent embodiments of the present application is equivalent to searching in the first column and the second column in the summarized correspondence table
  • the process of searching for the second correspondence table in the subsequent embodiment is equivalent to the summary. Look in the second and third columns of the corresponding table.
  • the first correspondence table saved in the terminal device is shown in Table 1.
  • the process in which the terminal device obtains the first correspondence table will be described in detail later with reference to the flowchart.
  • the terminal device finds the identifier "tcp" containing the data stream in Table 1.
  • the record of 192.168.1.211:3020-201.6.8.30:6682" is the first line record, and then the identifier SogouCloud.exe of the process in the first line record is obtained.
  • Step 207 The terminal device searches the second correspondence table for the record of the identifier SogouCloud.exe in which the process is saved, and if found, performs step 208, and if not found, terminates the process.
  • Step 208 The terminal device acquires an identifier of the application corresponding to the process identifier SogouCloud.exe from the found record of the identifier SogouCloud.exe in which the process is saved.
  • the identifier may be the name of the application, "Sogou input method.”
  • the second correspondence table saved in the terminal device is shown in Table 2.
  • the second correspondence table can be collected by the software vendor of the agent, and the R&D designer can know which processes are opened after the application software is run by changing the installation package of the application software or the running process list of the application software, thereby obtaining the application identification and process.
  • the corresponding relationship of the logo In fact, in order to reduce the storage space of the terminal device and improve the execution efficiency, the software vendor does not need to collect the correspondence between all the application identifiers and the process identifiers, and only needs to collect common network traffic, and the application identification process is prone to false negatives and errors. It is ok to report the progress of the application of the report.
  • the Agent in the terminal device can be obtained periodically from the software vendor's upgrade website.
  • the terminal device finds the record containing the process identifier SogouCloud.exe in Table 2 as the first line record, and then obtains the name of the application in the first line record, "Sogou input method".
  • the identifier of the application can be in many forms. For the sake of description, it is more intuitive. In this embodiment, the name of the application is directly used to represent the identifier of the application. In practical applications, in order to facilitate maintenance, software vendors often assign a number to each application according to a predetermined allocation rule, and use the number to represent the application identifier.
  • Step 209 The terminal device encapsulates the name of the found application, "Sogou input method", into a message P2, and sends a message P2 to the network security device.
  • the terminal device may encapsulate the identifier of the data stream and the identifier of the application determined for the data stream in the same packet and send the message to the network security device.
  • the terminal device encapsulates the identifier of the data stream "tcp 192.168.1.211:3020-201.6.8.30:6682" and the name of the application "Sogou input method" into the packet P2 and sends it to the network security device.
  • Step 210 The network security device receives the packet P2 sent by the terminal device, and parses the packet P2, and obtains the identifier of the data stream carried by the packet P2, "tcp 192.168.1.211:3020-201.6.8.30:6682" and the name of the application. "sogou Input".
  • Step 211 The network security device finds a corresponding record in the flow table according to the identifier of the data flow carried in the P2, and fills in the name of the application carried in the P2 as the identification result.
  • the network security device maintains a flow table, and each record in the flow table corresponds to a data flow, and records information about the data flow, such as status, recognition result, and the like. In this step, the network security device obtains an identification record "tcp 192.168.1.211:3020-201.6.8.30:6682 Sogou input method".
  • the network security device may generate an association identification rule in order to reduce multiple interactions between the subsequent network security device and the terminal device for the same identified data flow.
  • Step 212 The network security device generates a first association identification rule and a second association identification rule, where the first association identification rule includes an identifier of the application and is composed of a destination address, a destination port, and a protocol number of the first data stream. a triplet, the second association identification rule including an identifier of the application and a triple consisting of a source address, a source port, and a protocol number of the first data stream.
  • the subsequent network security device When the subsequent network security device receives another data stream, such as the second data stream. If at least one of the destination triplet and the source triplet of the second data stream is consistent with the triplet included in any one of the first association identification rule and the second association identification rule, And determining, by the identifier of the application that sends the second data stream, an identifier of the application included in the any one of the association identification rules.
  • the first association rule is “tcp 201.6.8.30:6682 Sogou input method”
  • the second association rule is “tcp 192.168.1.211:3020 Sogou input method”.
  • the network security device After the other terminal device sends the second data stream, the network security device extracts the identifier of the second data stream according to the packet P3 as "tcp" when receiving the packet P3 in the second data stream. 192.168.1.100:3020-201.6.8.30:6682", the destination triplet of the second data stream is "tcp 201.6.8.30:6682". Due to the purpose of the second data stream, the triplet and the first of the first association rules If the tuples are the same, the network security device can directly determine, according to the first association rule, that the application of the second data stream is the “sogou input method”, and does not need to interact with the terminal device again.
  • the network security device when receiving the data flow, acquires the identifier of the data flow, and sends the identifier of the data flow to the terminal device.
  • the terminal device queries the identifier of the process corresponding to the identifier of the unidentified data stream in the stored first correspondence table, and queries the application identifier, the application identifier and the unidentified data in the second correspondence table.
  • the network security device determines the application identification result of the data stream according to the feedback of the terminal device.
  • the terminal device in the foregoing embodiment may obtain the first correspondence table shown in Table 1 by:
  • step 31 the terminal device obtains a process list.
  • the terminal device obtains a list of processes running on the terminal device through an interface provided by an operating system (OS) running on the terminal device.
  • OS operating system
  • the "process” in this application refers to an instance of a running program, which is a running activity of a program with a certain independent function with respect to a certain data set. It is the basic unit of OS dynamic execution. In the traditional OS, the process is both a basic resource allocation unit and a basic execution unit.
  • API Application Programming Interface
  • command-line command provider or operator to get a list of processes running on the terminal device, for example by calling the "ps" command in the Linux operating system.
  • step 32 the terminal device obtains an identifier of the data flow created by each process.
  • the terminal device obtains the currently active connection established by the process through the open port through the interface provided by the OS.
  • the connection opened by the process can be traversed by the "/proc" virtual file system.
  • the GetExtendedTcpTable function can obtain the correspondence between all TCP data streams and processes.
  • the GetExtendedUdpTable function can obtain the correspondence between all UDP data streams and processes.
  • Step 33 The terminal device generates, for the identifier of each process obtained, a record including an identifier of the process and an identifier of the data stream, and saves the record in the first correspondence table. Thereby obtaining the first correspondence table.
  • the OS system may create a process or exit the process at any time according to the usage of the user, in order to update and maintain the first correspondence table in real time, thereby improving the identifier of the unidentified data stream generated by the terminal device according to the network security device, and searching The probability of the corresponding application, the terminal device monitors the state of the process by a hook function, thereby updating the record in the first correspondence table.
  • FIG. 3B is a flowchart of a first correspondence table update process provided by this embodiment.
  • Steps 31 to 33 in Fig. 3B are similar to Fig. 3A, and the description will not be repeated here for the sake of brevity.
  • Step 34 The terminal device obtains an event of the operating system creation process by using a hook function.
  • the hook function is part of the Windows message processing mechanism. By setting a "hook", the Agent or other application can filter all messages and events at the system level and access messages that are normally inaccessible.
  • the essence of the hook function is a program for processing system messages. The hook function is hooked into the system through system calls.
  • Step 35 The terminal device obtains the identifier of the newly created process from the event of creating the process.
  • the terminal device obtains the currently active connection established by the newly created process by opening the port through the interface provided by the OS. Take each currently active connection as a data stream and the active connected quintuple as the identity of the data stream.
  • Step 36 The terminal device obtains an identifier of the data flow created by the newly created process, and generates a record that includes the identifier of the newly created process and the identifier of the data flow created by the newly created process; and saves the record.
  • the terminal device obtains an identifier of the data flow created by the newly created process, and generates a record that includes the identifier of the newly created process and the identifier of the data flow created by the newly created process; and saves the record.
  • the first correspondence table In the first correspondence table.
  • Step 37 The terminal device obtains an event that the operating system exits the process by using a hook function.
  • Step 38 The terminal device obtains an identifier of the exit process from an event of the exit process, and deletes, from the first correspondence table, a record that includes the identifier of the exit process.
  • the terminal device may also use a hook function.
  • the number of network messages is monitored to update the records in the first correspondence table, and the data creation time and the last activity time information are added to each record. It can be seen from the following steps in this embodiment that the last active time of the data stream can be used to aging the records in the first correspondence table, and the data flow establishment time can be used for analysis of other purposes. As shown in steps 39 to 315.
  • Step 39 The terminal device obtains the transmitted packet by using a hook function, and the specific transmitted packet may be a sent packet or a received packet. To further reduce the amount of subsequent data processing, only packets whose protocol type is Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) can be captured.
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • Step 310 The terminal device parses the obtained packet from the obtained packet to obtain the identifier of the packet and the identifier of the data stream to which the packet belongs.
  • the status identifier in this embodiment refers to the status identifier of the four-layer protocol, and the four-layer protocol can be obtained from the protocol field of the IP header of the packet, such as TCP and UDP.
  • the status identifier of the TCP may be obtained from the flags field of the TCP header of the packet, and the status identifier may be FIN, RST, or the like.
  • a more detailed description of the message status indicator can be found in the RFC document, such as RFC 793.
  • the terminal device extracts the quintuple from the obtained packet, and uses the extracted quintuple as the identifier of the data stream to which the packet belongs.
  • Step 311 The terminal device determines whether the packet status identifier of the packet is FIN. If it is FIN, step 312 is performed. If the packet status identifier is not FIN, step 313 is performed.
  • Step 312 If the message status identifier is FIN, delete the record in the first correspondence table that includes the identifier of the data stream to which the message belongs, and the process ends.
  • Step 313 The terminal device searches for the record including the identifier of the data stream in the first correspondence table shown in Table 1 according to the identifier of the obtained data stream. If the record is found, it indicates that the message belongs to an established data stream, and step 314 is executed. If the record is not found, the message belongs to a newly established data stream, and step 315 is performed.
  • step 314 the terminal device updates the last active time of the data stream to the current time in the found record.
  • deleting the expired record according to the last active time of the data stream, and deleting the record according to the message status identifier FIN are two alternative and recordable deletion methods.
  • a TCP message P4 is obtained by the hook function, and the quintuple extracted from the message P4 is "tcp 192.168.1.211:6122-168.3.56.120:1138".
  • the record found in Table 1 containing the quintuple "tcp 192.168.1.211:6122-168.3.56.120:1138” is the ninth record, the ninth record The last activity time in the record is updated to the current time 21:00:3456, and the updated first correspondence table is shown in Table 3.
  • Step 315 The terminal device refreshes the first correspondence table, and finds, in the refreshed first correspondence table, the record that includes the identifier of the data stream obtained in step 310, and sets the setup time and the last active time of the data stream in the record. For the current time.
  • the terminal device obtains a TCP packet P5 through the hook function, and the quintuple extracted from the packet P5 is "tcp 192.168.1.211:6123-168.3.56.120:1138".
  • the record containing the quintuple "tcp 192.168.1.211:6123-168.3.56.120:1138” is not found in Table 1, and the first correspondence table is refreshed, as shown in Table 4, and the quintuple is found in Table 4.
  • "tcp 192.168.1.211:6123-168.3.56.120:1138” is the 10th record, setting the setup time and the last activity time in the 10th record to the current time 21:01:3456, the updated first The correspondence table is shown in Table 4.
  • the terminal device may periodically delete the expired record according to the last active time of the data flow in the first correspondence table, where the expired record refers to the last active time and The time interval between the current time exceeds the record corresponding to the data stream of the predetermined time, that is, the data stream with no active time for a long time, and the corresponding record:
  • the terminal device determines whether the predetermined time determined according to the detection period arrives, and if yes, performs a timing clear task, that is, for each record in the first correspondence table as shown in Table 4, determining the last active time of the data stream and the current time Whether the time interval exceeds the set threshold, if it is exceeded, the record is deleted; if not, the process returns to step 301.
  • first sub-flow consisting of steps 31 to 33 in FIG. 3B
  • second sub-flow consisting of steps 34-36
  • third sub-process consisting of steps 37-38
  • steps 39-315 The fourth sub-processes that are composed are mutually independent and can be selectively executed. For example, only the first sub-process and the second sub-flow may be executed, or only the first sub-process and the third sub-flow may be executed.
  • the solution provided by the embodiment is adopted, the proportion of the unrecognized traffic in the total traffic can be greatly reduced by the interaction between the network security device and the terminal device.
  • the solution provided in this embodiment requires interaction between the network security device and the terminal device. Compared with the manner in which the network security device of the prior art performs application identification according to the locally stored rules, the required delay is longer and needs to be consumed. Certain network transmission resources. If it is possible to obtain multiple complete data streams sent by a process that sends a data stream that the network security device does not recognize, then it is possible to obtain the rules by manual analysis. For feature-based identification rules or heuristic identification rules obtained by manual analysis, it is important to obtain multiple complete data streams sent by the same application.
  • the complete data flow refers to the communication between the two parties from the connection establishment negotiation phase.
  • the first message until the connection disconnects all packets between the last message sent.
  • existing network security devices are out of storage space. And performance considerations, and can not cache multiple messages of the data stream, such as existing feature-based recognition technology or heuristic recognition technology, often only extract features from the received messages, and then extract the extracted features. Cache and forward the message. It is relatively difficult to capture a complete unidentified data stream by the packet capture technology on the existing terminal device because it is impossible to determine which data stream to grab and to accurately locate the start and end of an unidentified data stream.
  • the present application provides a solution shown in FIG. 4, which can capture all the packets of the data stream sent by one process in a targeted manner without occupying a large amount of resources in the terminal device.
  • FIG. 4 is based on FIG. 2.
  • the terminal device receives the message P1 sent by the network device, and determines that the creation identifier is “tcp 192.168.1.211:3020-201.6.8.30:6682”. After the identification of the process of the data stream is SogouCloud.exe, it also includes:
  • Step 401 The terminal device sets a packet collection identifier for the process SogouCloud.exe in the first correspondence table shown in Table 1.
  • the packet collection identifier is used by the terminal device to obtain and store a complete data stream subsequently transmitted by the process after the packet transmitted by the process is captured by the interface of the operating system.
  • the role of the message collection identifier will be described later in conjunction with a specific example.
  • the first correspondence table after setting the packet collection identifier is as shown in Table 5.
  • the packet collection identifier is “1” for illustration.
  • the setting packet collection identifier corresponding to all the process identifiers is “0”, and after step 206, the packet corresponding to the process identifier in the found record is obtained.
  • the acquisition ID is updated to "1".
  • step 206 it is possible to distinguish the process identifiers in the found records from the previously different identifiers.
  • Step 49 The terminal device obtains the transmitted packet by using a hook function, and the specific transmitted packet may be a sent packet or a received packet. This step is similar to step 39 in FIG. 3B and will not be described again here.
  • Step 410 The terminal device extracts the data flow identifier from the obtained packet. Specifically, the terminal device extracts a five-tuple from the obtained message.
  • Step 411 The terminal device searches for the record including the identifier of the data stream in the first correspondence table shown in Table 5 according to the identifier of the obtained data stream. If found, the record can be updated as shown in step 314 of Figure 3B. If the record is not found, the message belongs to a newly established data stream, and the terminal device refreshes the first correspondence table, and the record corresponding to the identifier of the data stream obtained in step 310 is found in the refreshed first correspondence table.
  • the terminal device obtains a TCP packet P6 through the hook function, and the quintuple extracted from the packet P6 is "tcp 192.168.1.211:3011-201.6.8.30:6682".
  • the record containing the quintuple “tcp 192.168.1.211:3011-168.3.56.120:1138” is not found, and the first correspondence table is refreshed, as shown in Table 6, and the quintuple is found in Table 6.
  • tcp 192.168.1.211:3011-201.6.8.30:6682 is the first record.
  • a record containing the identifier of the data stream is obtained, and the identifier of the included process is obtained from the record.
  • the obtained process identifier is SogouCloud.exe.
  • Step 420 The terminal device determines whether the process identifier SogouCloud.exe in the first record is set with the message collection identifier. If the packet collection identifier is set, go to step 421. If not set The text collection logo ends.
  • Step 421 The terminal device clears the packet collection identifier, and starts to perform packet capture for the process identified as SogouCloud.exe.
  • the terminal device clears the packet collection identifier in the table 6 to obtain the table 7.
  • the purpose of clearing the packet collection identifier is to avoid long-term packet capture for a process.
  • the terminal device determines whether the packet capture operation for the same process exceeds the set capture time interval. If it exceeds, the packet capture is performed. If not, the packet is skipped. After this step, the packet capture flag is not cleared and the packet capture is not performed temporarily, and the processing ends.
  • the terminal device saves the packet capture result for subsequent manual analysis.
  • the terminal device may perform packet capture according to a preset packet capture policy, for example, capturing a data packet transmitted by the process within a predetermined time period, ending the packet capture, or capturing the process transmission. After the packet reaches the predetermined amount of data, the packet capture ends.
  • the updating method of the first correspondence table shown in FIG. 3B and the packet capturing method shown in FIG. 4 may be performed separately or in combination.
  • the foregoing packet capture method provided in this embodiment can obtain multiple complete data flows for a specific process in the terminal device, so as to obtain a feature-based identification rule or a heuristic recognition rule by manual analysis, and the obtained rule After being applied to a network security device, the effect of application recognition can be improved.
  • the embodiment of the present application further provides a terminal device, as shown in FIG. 5A, the terminal device includes a memory 510, a processor 520, and a network interface 530.
  • the memory 510, the processor 520, and the network interface 530 are mutually connected by a bus 540. Communication.
  • Memory 510 includes, but is not limited to, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), or portable read only memory (CD-ROM).
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read only memory
  • CD-ROM portable read only memory
  • the processor 520 may be one or more central processing units (CPUs). In the case that the processor 520 is a CPU, the CPU may be a single core CPU or a multi-core CPU.
  • the network interface 530 can be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or a Gigabit Ethernet (GE) interface.
  • the network interface 530 can also be a wireless interface. If the terminal device is a personal computer, the network interface 530 may be the wired interface described above or may be an IEEE 802.11b-based Wireless Fidelity (WiFi) module. If the terminal device is a mobile terminal such as a mobile phone, the network interface 530 may be a hardware module composed of a baseband chip and a radio frequency antenna.
  • the memory 510 is configured to store the program code, the first correspondence table, and the second correspondence table.
  • First correspondence table For the definition of the second correspondence table, refer to the description in the above embodiment, and the description is not repeated here.
  • the network interface 530 is configured to receive an identifier of the first data stream sent by the network security device.
  • the processor 520 reads the program code stored in the memory 510 and executes:
  • the first record that holds the identifier of the first data stream is found, and the identifier of the process in the first record is obtained; in the second correspondence table, the save is found.
  • the network interface 530 is further configured to send, to the network security device, an identifier of the application acquired by the processor 520.
  • the processor 520 may obtain the first correspondence table and update the first correspondence table by using the methods of FIGS. 3A, 3B and related descriptions described above.
  • processor 520 may employ the method of FIG. 4 and related descriptions to obtain a message of the complete data stream.
  • the embodiment of the present application further provides a terminal device, as shown in FIG. 5B.
  • the terminal device includes a storage module 560, a receiving module 570, a processing module 580, and a sending module 590.
  • these modules are relatively independent logic modules, which may be generated by the CPU in the terminal device after reading and storing the software code in the storage, or by hardware components. specifically:
  • the storage module 560 is configured to store a first correspondence table and a second correspondence table, where the first correspondence table stores a correspondence between an identifier of a process running in the terminal and an identifier of a data flow established by the process, and a second correspondence table A second correspondence between the identifier of the application and the identifier of the process created by the application is saved, where the identifier of the data stream is a five-tuple composed of a source address, a source port, a destination address, a destination port, and a protocol identifier.
  • the receiving module 570 is configured to receive an identifier of the first data stream sent by the network security device.
  • the processing module 580 is configured to: in the first correspondence table stored by the storage module 560, find a first record that holds the identifier of the first data stream, and obtain an identifier of a process in the first record; In the second correspondence table, a second record that stores an identifier of a process in the first record is found, and an identifier of the application is obtained from the second record.
  • the sending module 590 is configured to send an identifier of the application to the network security device.
  • the processing module 580 can obtain the first correspondence table and update the first correspondence table by using the methods of FIGS. 3A, 3B and related descriptions described above.
  • the processing module 580 can obtain the complete number using the method of FIG. 4 and related descriptions. According to the flow of the message.
  • the terminal device provided in Figures 5A and 5B can be used as the terminal device 110 in Figure 1A or 1B.
  • the terminal device After receiving the identifier of the data stream sent by the network security device, the terminal device provided by the embodiment of the present application finds the identifier of the application according to the first correspondence table and the second correspondence table saved by the terminal device, and sends the identifier of the found application.
  • the terminal device After receiving the identifier of the data stream sent by the network security device, the terminal device provided by the embodiment of the present application finds the identifier of the application according to the first correspondence table and the second correspondence table saved by the terminal device, and sends the identifier of the found application.
  • the embodiment of the present application further provides a network security device.
  • the network security device includes a memory 610, a processor 620, and a network interface 630.
  • the memory 610, the processor 620, and the network interface 630 pass through a bus. 640 communicate with each other.
  • Memory 610 includes, but is not limited to, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), or portable read only memory (CD-ROM).
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read only memory
  • CD-ROM portable read only memory
  • the processor 620 may be one or more central processing units (CPUs).
  • the processor 520 is a CPU
  • the CPU may be a single-core CPU or a multi-core CPU.
  • the network interface 630 may be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or a Gigabit Ethernet (GE) interface.
  • the network interface 630 may also be a wireless interface.
  • the network interface 630 is configured to receive the first data stream.
  • the processor 620 is configured to obtain an identifier of the first data stream, where the identifier of the data stream is a five-tuple consisting of a source address, a source port, a destination address, a destination port, and a protocol identifier.
  • the network interface 630 is further configured to send, according to the source address or the destination address in the identifier of the first data stream, the identifier of the data stream, where the address of the terminal device is in the identifier of the first data stream Source address or destination address.
  • the processor 620 instructs the network interface 630 to send the identifier of the data stream to the terminal device when the application that sends the first data stream cannot be identified by using the existing application identification technology.
  • the network interface 630 is further configured to receive an identifier of an application sent by the terminal device.
  • the processor 620 is further configured to determine that the identifier of the application received by the network interface 630 is a sending station. An identifier of an application of the first data stream is obtained, thereby obtaining an application identification result of the first data stream.
  • the embodiment of the present application further provides a network security device, as shown in FIG. 6B.
  • the network security device includes a receiving module 660, a processing module 670, and a transmitting module 680. It should be noted that these modules are relatively independent logic modules, which may be generated by the CPU in the terminal device after reading and storing the software code in the storage, or by hardware components. specifically:
  • the receiving module 660 is configured to receive the first data stream.
  • the processing module 670 is configured to obtain an identifier of the first data stream, where the identifier of the data stream is a five-tuple composed of a source address, a source port, a destination address, a destination port, and a protocol identifier.
  • the sending module 680 is configured to send, according to the source address or the destination address in the identifier of the first data stream, an identifier of the data stream, where the address of the terminal device is a source in the identifier of the first data stream Address or destination address.
  • the processing module 670 when the existing application identification technology fails to identify the application that sends the first data stream, instructs the sending module 680 to send the identifier of the data stream to the terminal device.
  • the receiving module 660 is further configured to receive an identifier of the application sent by the terminal device.
  • the processing module 670 is further configured to determine that the identifier of the application received by the network interface 660 is an identifier of an application that sends the first data stream, thereby obtaining an application identification result of the first data stream.
  • the network security device provided in Figures 6A and 6B can be used as the network security device 120 of Figure 1A or 1B. 6A and 6B, the interaction process between the network security device and the terminal device is described with reference to FIG. 2 and related description.
  • the identifier of the data flow is sent to the terminal device, and the identifier of the application sent by the terminal device is received, and the received identifier is received.
  • the identifier of the application is used as an identifier of the application that sends the data stream, thereby obtaining an application recognition result of the data stream.
  • FIG. 7 is a schematic diagram of an identification system for application information in network traffic provided by an embodiment of the present application.
  • the system includes a terminal device 710, a network security device 720, and a data processing device 730.
  • a data processing device 730 is added as compared to the identification system shown in Figures 1A and 1B.
  • the data processing device 730 can be integrated into the network security device 720 or the terminal device as a logic module. In the standby device 710, it can also be deployed as a separate physical device, as long as it can ensure communication with the terminal device 710 and the network security device 720, respectively.
  • the purpose of discovering the network security device error recognition result is to test the recognition effect of the network security device on the to-be-identified application by using only the traffic generated by the application to be identified and not mixed with other applications. Moreover, it is impossible to estimate the recognition effect in the case of mixed traffic.
  • the main purpose of adding the data processing device 730 in this embodiment is to comprehensively analyze the information from the terminal device 710 and the information from the network security device 720, thereby identifying the error recognition result of the network security device 720.
  • the terminal device 710 has certain similarities with the terminal device 110 in the first embodiment
  • the network security device 720 has similarities with the network security device 120 in the first embodiment.
  • the differences from the first embodiment will be described in detail, and a brief description can be made with reference to the similar contents in the first embodiment.
  • the network security device 720 is configured to receive a first data stream, determine an identifier of an application that sends the first data stream, and generate a first identification record, where the first identification record includes An identifier of the first data stream and an identifier of the application, where the identifier of the data stream is a quintuple consisting of a source address, a source port, a destination address, a destination port, and a protocol identifier, and the method is sent to the processing device The first identification record.
  • the network security device 720 can identify the first data stream by using an existing application identification technology such as a feature-based recognition technology, a heuristic recognition technology, or an association recognition technology, thereby determining an identifier of an application that sends the first data stream.
  • the terminal device 710 is configured to acquire an identifier of a process on the terminal device and an identifier of the second data stream created by the process, to generate a second identification record, where the second identification record includes an identifier of the second data stream.
  • An identifier of the process and obtaining a correspondence table, each record in the correspondence table storing an identifier of an application and an identifier of a process created by the application; and sending the second identification record and the correspondence table to the data processing device.
  • the correspondence table in this embodiment is the second correspondence table in the first embodiment. In this embodiment, in order to maintain consistency with the naming of each corresponding table in the first embodiment, the name of the second correspondence table is retained.
  • the second identification record in this embodiment may be one of the records in the first correspondence table in the first embodiment.
  • the terminal device 710 may obtain After the first correspondence table, the first correspondence table is sent to the data processing device 730 as a whole file, and one or more records in the first correspondence table may be selectively selected. It is sent to the data processing device 730, which is not limited here.
  • the data processing device 730 is configured to receive a first identification record from the network security device 720; receive a second identification record and a correspondence table from the terminal device 710. If the identifier of the first data stream included in the first identification record is the same as the identifier of the second data stream included in the second identification record, query whether there is a first associated record in the corresponding table, and the first associated record stores the first An identification of the application applied in the record and an identification of the process included in the second identification record. If the first associated record does not exist, it is determined that the first identified record is an incorrectly identified record.
  • the identifier of the process included in the second identification record may also be sent to the terminal device 710, so that the terminal device 710 sets the identifier of the process. Capture packets, and subsequently capture multiple complete data streams sent by the process represented by the identifier of the process for manual analysis. For details of the packet capture process, refer to FIG. 4 and related descriptions of Embodiment 1, and the description thereof will not be repeated here.
  • the network security device may be The identifier of the identification mode is added to the first identification record sent to the data processing device, and after confirming that the error recognition result is caused by the association identification rule, the data processing device notifies the network security device to delete the corresponding association identification rule, thereby avoiding subsequent occurrence of the same The result of the error recognition caused by the cause. specifically:
  • the first identification record from the network security device 720 also includes an identification of the identification method, including association identification, feature recognition, and heuristic recognition.
  • the association identification mode means that the network security device 720 identifies the application for sending the packet according to the correspondence between the IP address, the port number, and the application of the packet. For example, the network security device 720 can obtain the IP address and port number used by the data channel to be established by parsing the control packet in the FTP control channel, and add the obtained IP address and port number to the FTP client in the association table. End name, such as the correspondence of FileZilla. After receiving the subsequent packet, the association table searches for the IP address and port number carried in the packet. If the IP address and port number of the packet are in the association table, the packet is carried in the association table. The file address corresponding to the IP address and port number is FileZilla as the application that sends the message.
  • the first identification record further includes the identification of the identification mode
  • the first identification record may also be And sending the notification message to the network security device, where the notification message is used to notify the network security device to delete the first association identification rule, where the identifier of the other mode is an identifier of the association identification manner, where the first association identification rule includes the The identifier of the first data stream included in the first identification record.
  • the data processing device receives the first identification record from the network security device and the second identification record and the correspondence table from the terminal device, if the The identifier of the first data stream included in the identification record is the same as the identifier of the second data stream included in the second identification record, and the first table record is queried whether the first associated record exists.
  • the identifier of the application in the first identification record and the identifier of the process included in the second identification record are saved, and if the first associated record does not exist, the first identification record is determined to be an error identification record.
  • the data processing device can identify the error identification record of the network security device that is difficult to find by the technology, and improve the recognition effect of the network traffic.
  • the terminal device in this embodiment may be the terminal device 710 in FIG. 7
  • the network security device may be the network security device 720 in FIG. 7
  • the data processing device may be the data processing device 730 in FIG.
  • FIG. 8A describes the identification method provided by this embodiment in a manner of a detailed time series interaction diagram.
  • Step 801 After receiving the packet P10 in the first data stream, the network security device performs application identification on the first data stream based on the association identification technology, and obtains a recognition result, that is, the first identification record “tcp 192.168.1.211:3020-201.6 .8.30:6682 Storm video A”.
  • the first identification record may be obtained by the network security device after the first data stream is received, and the first data stream is identified by a rule obtained by using a feature-based recognition technology, a heuristic or the like, or an association recognition technology.
  • the network security device can use various existing identification technologies to identify the message until the recognition result is obtained. For example, the network security device first uses the feature-based rule to identify the message. When the recognition result cannot be obtained, the message is When the feature in the feature is inconsistent with the rule in any feature-based rule, the heuristic rule is used to identify the message. When the matching result cannot be obtained, the association recognition rule is used to identify the message again.
  • the network security device first uses the feature-based rule to identify the message, and the matching result can be obtained, the identification record is generated, and the process ends.
  • the order in which the network security device selects the identification technology is not particularly limited.
  • the first identification record is identified by the network security device according to the first association identification rule, and the first association identification rule is “tcp 201.6.8.30:6682 storm video”.
  • the network security device After receiving the packet P10, the network security device obtains the destination triplet and the source triplet from the packet, and matches the destination triplet or the source triplet with the first association identification rule, if the destination triplet or If any one of the source triplets is consistent with the triplet in the first association identification rule, it is determined that the first data stream to which the packet P10 belongs is sent by the storm video in the terminal device.
  • the identifier of the association identification mode is A
  • the identifier of the feature recognition mode is B
  • the identifier of the heuristic recognition technology is C.
  • Step 802 The network security device carries the first identification record "tcp 192.168.1.211:3020-201.6.8.30:6682 Storm Video A" in the message P11, and sends P11 to the data processing device.
  • Step 803 After receiving the packet P11, the data processing device parses the packet P11, and obtains the first identification record “tcp 192.168.1.211:3020-201.6.8.30:6682 storm video A” carried in the packet P11.
  • Step 804 the data processing device receives the second identification record "tcp 192.168.1.211:3020-201.6.8.30:6682SogouCloud.exe" and the second correspondence table from the terminal device.
  • the second identification record and the second correspondence table may be separately sent.
  • the second correspondence table is sent after the agent initialization in the terminal device is completed, or the agent in the terminal device detects that the second correspondence table shown in Table 2 in the first embodiment is changed.
  • the second identification record may be in the first correspondence table sent by the terminal device. one record.
  • the data processing device may also extract the quintuple and send the quintuple to the terminal device, indicating that the terminal device will include the first correspondence table of the quintuple.
  • the record in is returned to the data processing device.
  • the specific manner in which the terminal device sends the second identification record to the data processing device is not limited herein.
  • Step 805 The data processing device determines that the identifier of the first data stream included in the first identification record is the same as the identifier of the second data stream included in the second identification record.
  • a correspondence table is sent to the data processing device as an overall file package, and the data processing device queries the entire file package according to the five-tuple in the first identification record to include a five-tuple tcp 192.168.1.211:3020-201.6.
  • the record of 8.30:6682 is used as the second identification record.
  • the data processing device compares with at least one identification record received from the terminal device in the predetermined time period to determine the existence.
  • An identification record, the identifier of the data stream carried by the identifier is the same as the identifier of the data stream included in the first identification record, and the identification record is used as the second identification record.
  • Step 806 The data processing device queries, in the second correspondence table, whether there is a first associated record, where the identifier of the application in the first identification record and the identifier of the process included in the second identification record are saved in the first associated record.
  • the first identification record is the correct identification record, and continues to process the next identification record sent by the network security device; otherwise, the first identification record is an incorrect identification record.
  • the data processing device determines whether there is an associated record in the second correspondence table, where the associated record stores the application identifier “storm video” in the first identification record and the process identifier “SogouCloud.exe” in the second identification record.
  • the associated record stores the application identifier “storm video” in the first identification record and the process identifier “SogouCloud.exe” in the second identification record.
  • the second association table shown in Table 2 there is no record containing both "storm video” and "SogouCloud.exe”.
  • the data processing device determines that the identification record from the network security device is an erroneous identification record, at least one of the sub-flows consisting of steps 807, 810 or steps 808 to 809 may be performed.
  • the sub-flows composed of steps 807, 810 or steps 808 to 809 are optional, and are not particularly limited in the order of execution.
  • Step 807 The data processing device sends a packet P12 carrying the identifier SogouCloud.exe of the process included in the second identification record to the terminal device, so that the terminal device sets a packet capture flag for the identifier of the process, and subsequently captures the process.
  • the complete data stream sent by the process represented by the identifier is manually analyzed.
  • Step 808 The data processing device determines whether the identifier of the identification mode carried in the first identification record is an identifier of the association identification manner. If the identifier of the identification manner carried in the first identification record is an identifier of the association identification manner, step 809 is performed. Otherwise, this process ends.
  • Step 809 The data processing device sends a notification message P13 to the network security device, where the notification message is used to notify the network security device to delete the first association identification rule “tcp 201.6.8.30:6682 Storm video.”
  • the notification message may carry an identifier of the data stream in the first identification record and a deletion instruction, such as “201.6.8.30:6682D”, where D is a deletion instruction.
  • step 810 the data processing device also counts the number of times of the error recognition record, and increments the number of current error recognition records by one after each determination of the error recognition record.
  • the number of times the current record is correctly recognized may also be incremented by one.
  • the false alarm rate in the predetermined time period can be calculated.
  • the data processing device can also periodically output the error recognition record and the false alarm rate through an output interface such as a display or a printer for analysis by the manager.
  • Step 811 After receiving the notification message P13, the network security device deletes the first association identification rule “tcp 201.6.8.30:6682 storm video” or the second association rule “tcp 192.168.1.211:3020 storm video”.
  • the correct association identification rule may also be generated for the network security device.
  • the correct association identification rule may also be generated for the network security device.
  • the data processing device queries, in the correspondence table, whether there is a second associated record, where the identifier of the process included in the second identification record is saved in the second associated record. If there is a second associated record, step 813 is performed, otherwise the process ends.
  • Step 813 The data processing device generates a third association rule or a fourth association rule, where the third association rule includes an identifier of the application in the second association record, and a destination address, a destination port, and the first data stream.
  • the third association rule includes an identifier of the application in the second association record, and a destination address, a destination port, and the first data stream.
  • a triple consisting of a protocol number the fourth association rule including an identifier of an application in the second associated record and a triple consisting of a source address, a source port, and a protocol number of the first data stream.
  • the first row record in the second correspondence table shown in Table 2 includes "SogouCloud.exe”, and the identifier of the application included in the first row record is "Sogou input method”.
  • the generated third association rule is "tcp 201.6.8.30:6682 Sogou input method"
  • the fourth association rule is "tcp 192.168.1.211:3020 Sogou input method”.
  • Step 814 The data processing device sends the third association identification rule or the fourth association identification rule to the network security device.
  • Figure 8B depicts another flow diagram of a method of identification performed by a data processing device. It can be understood that on the basis of FIG. 8A, steps 821 to 829 in FIG. 8B are descriptions of the other two identification records transmitted by the data processing device for the network security device and the terminal device.
  • Step 821 After receiving the packet P20 in the third data stream, the network security device performs application identification on the third data stream based on the existing feature-based identification technology, and cannot obtain the recognition result, and generates a third identification record “tcp 192.168”. .1.211:6120-168.3.56.120:1138Unidentified", wherein Unidentified is an unidentified identifier for characterizing that the network security device does not recognize an application that sent the third data stream.
  • Step 822 The network security device carries the third identification record "tcp 192.168.1.211:6120-168.3.56.120:1138Unidentified" in the message P21, and sends P21 to the data processing device.
  • Step 823 the data processing device receives the message P21, and obtains the third identification record "tcp 192.168.1.211:6120-168.3.56.120:1138Unidentified" carried from the message P21.
  • Step 824 the data processing device receives the fourth identification record "tcp 192.168.1.211: 6120-168.3.56.120: 1138kxescore.exe" from the terminal device.
  • Step 825 The data processing device determines that the identifier of the third data stream included in the third identification record is the same as the identifier of the fourth data stream included in the fourth identification record.
  • Step 826 The data processing device queries, in the second correspondence table, whether there is a third associated record, where the identifier of the process included in the fourth identification record is saved in the third associated record.
  • the sub-flow consisting of steps 827 to 828 or the sub-process consisting of steps 829 to 830 may be selected.
  • the third record in Table 2 contains "kxescore.exe”.
  • Step 827 the data processing device generates a fifth association identification rule or a sixth association identification rule, where the fifth association identification rule includes an identifier of an application included in the sixth association record and a destination address of the third data stream. And a triplet composed of a destination port and a protocol number, where the fifth association identification rule includes an identifier of an application included in the third association record, and is composed of a source address, a source port, and a protocol number of the third data stream. The triplet.
  • the fifth association identification rule is “tcp 168.3.56.120: 1138 Huawei security guard”
  • the sixth association identification rule is “tcp 192.168.1.211: 6120 Huawei security guard”.
  • Step 828 The data processing device sends a fifth association identification rule or a sixth association identification rule to the network security device.
  • Step 829 The data processing device carries the identifier of the third data stream and the identifier of the application included in the third association record in the packet P22 and sends the identifier to the network security device.
  • Step 830 After receiving the packet P22, the network security device generates a fifth association identification rule or a sixth association identification rule according to the packet P22.
  • the fifth association identification rule includes a triplet composed of an identifier of the application carried in the packet P22 and a destination address, a destination port, and a protocol number of the third data stream carried in the packet P122.
  • the sixth association identification rule includes an identifier of the application carried by the packet P22 and a triple consisting of a source address, a source port, and a protocol number of the third data stream.
  • step 212 in FIG. 2 in the first embodiment step 813 in FIG. 8A in the second embodiment, step 827 to step 828 in FIG. 8B, or identification according to steps 829 to 830
  • the method of generating a new association identification rule is recorded.
  • the association identification rule may be generated according to the identification records with multiple commonalities, instead of generating an identification record. Association identification rules.
  • a temporary association identification rule is generated and stored, and a count value is set for each temporary association identification rule, as shown in Table 8.
  • the data processing device sets a threshold, for example 10, when the count value of one of the records in Table 8 is exceeded.
  • a threshold for example 10
  • the temporary association identification rule is universal, and the temporary association identification rule is used as a formal association identification rule that can be used by the network security device to perform application identification on the subsequently received data stream.
  • the data processing device receives the first identification record from the network security device and the second identification record and correspondence table from the terminal device, if the The identifier of the first data stream included in the identification record is the same as the identifier of the second data stream included in the second identification record, and the corresponding table is queried whether the identifier of the application in the first identification record is saved and The associated record of the identification of the process included in the second identification record, if not present, determines that the first identification record is an error identification record.
  • the error recognition record of the network security device can be found, and the effect of application recognition is improved.
  • the embodiment of the present application further provides a data processing device.
  • the data processing device includes a memory 910, a processor 920, and a network interface 930.
  • the memory 910, the processor 920, and the network interface 930 pass through a bus. 940 communicate with each other.
  • Memory 910 includes, but is not limited to, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), or portable read only memory (CD-ROM).
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read only memory
  • CD-ROM portable read only memory
  • the processor 920 may be one or more central processing units (CPUs). In the case that the processor 920 is a CPU, the CPU may be a single core CPU or a multi-core CPU.
  • the network interface 930 may be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or a Gigabit Ethernet (GE) interface.
  • the network interface 930 may also be a wireless interface.
  • the network interface 930 is configured to receive a first identification record from the network security device, where the first identification record includes an identifier of the first data stream and an identifier of the application. Receiving a second identification record and a correspondence table from the terminal device, the second identification record comprising an identifier of the second data stream and an identifier of the process, each record in the correspondence table holding an identifier of the application and the application The ID of the created process.
  • the processor 920 reads the program code stored in the memory 910 and executes:
  • the first associated record stores an identifier of the application in the first identification record and an identifier of the process included in the second identification record; if the first associated record does not exist, determining that the first identification record is an error Identify the record.
  • the network interface 930 is further configured to: if the identifier of the identification manner in the first identification record is an identifier of an association identification manner, send the identifier to the network security device when the first association record does not exist a notification message, the notification message is used to notify the network security device to delete the first association identification rule or the second association identification rule, where the first association rule includes a destination address, a destination port, and a protocol by the first data stream A triple composed of numbers, the second association identification rule including a triple consisting of a source address, a source port, and a protocol number of the first data stream.
  • the data processing device may also interact with the network security device and the terminal device to identify that there is a traffic that cannot be identified by the technology.
  • the network interface 930 is further configured to receive a third identification record from the network security device, where The third identification record includes an identifier of the third data stream and an unidentified identifier, the unidentified identifier is used to indicate that the network security device does not recognize the application that sends the third data stream; and receives the fourth from the terminal device Identifying a record, the fourth identification record comprising an identification of the fourth data stream and an identification of the process.
  • the processor 920 is further configured to determine whether an identifier of the third data stream included in the third identification record is the same as an identifier of the fourth data stream included in the fourth identification record, if the third identifier is If the identifier of the third data stream included in the record is the same as the identifier of the fourth data stream included in the fourth identification record, query whether there is a third associated record in the corresponding table, where the third associated record is in the third associated record. Saving an identifier of a process included in the fourth identification record;
  • the network interface 930 is further configured to: if the processor determines that the third associated record exists, send an identifier of an application included in the third associated record and an identifier of the third data stream to the network safety equipment.
  • the embodiment of the present application also provides a data processing device, as shown in FIG. 9B.
  • the terminal device includes a receiving module 970 and a processing module 980. It should be noted that these modules are relatively independent logic modules, which may be generated by the CPU in the terminal device after reading and storing the software code in the storage, or by hardware components.
  • the receiving module 970 is configured to receive a first identification record from the network security device, where the first identification record includes an identifier of the first data stream and an identifier of the application. Receiving a second from the terminal device Identifying a record and a correspondence table, the second identification record comprising an identifier of the second data stream and an identifier of the process, each record in the correspondence table holding an identifier of an application and an identifier of a process created by the application.
  • the processing module 980 is configured to: if the identifier of the first data stream included in the first identification record received by the receiving module 970 is the same as the identifier of the second data stream included in the second identification record, query whether there is a first Correlation record, the identifier of the first identification record and the identifier of the process included in the second identification record are saved in the first associated record; if the first associated record does not exist, the first identification record is determined to be an error identification record.
  • the data processing device shown in FIG. 9B further includes a sending module 990, configured to: if the identifier of the identification manner in the first identification record is an identifier of an association identification manner, the first associated record does not exist And sending, to the network security device, a notification message, where the notification message is used to notify the network security device to delete the first association identification rule or the second association identification rule, where the first association rule includes the first data A triple consisting of a destination address, a destination port, and a protocol number of the stream, and the second association identification rule includes a triplet composed of a source address, a source port, and a protocol number of the first data stream.
  • a sending module 990 configured to: if the identifier of the identification manner in the first identification record is an identifier of an association identification manner, the first associated record does not exist And sending, to the network security device, a notification message, where the notification message is used to notify the network security device to delete the first association identification rule or the second association identification rule, where the first association rule includes the first
  • the data processing device can also interact with the network security device and the terminal device to identify that traffic that cannot be identified by the technology occurs.
  • the receiving module 970 is further configured to receive a third identification record from the network security device, where the third The identification record includes an identifier of the third data stream and an unidentified identifier, the unidentified identifier is used to indicate that the network security device does not recognize the application that sends the third data stream; and receives the fourth identification record from the terminal device
  • the fourth identification record includes an identifier of the fourth data stream and an identifier of the process.
  • the processing module 980 is further configured to determine whether an identifier of the third data stream included in the third identification record is the same as an identifier of the fourth data stream included in the fourth identification record, if the third identifier is If the identifier of the third data stream included in the record is the same as the identifier of the fourth data stream included in the fourth identification record, query whether there is a third associated record in the corresponding table, where the third associated record is in the third associated record. The identifier of the process included in the fourth identification record is saved.
  • the sending module 990 is further configured to: if the processing module 980 determines that the third associated record exists, send the identifier of the application included in the third associated record and the identifier of the third data stream to the network security device.
  • the data processing device provided in Figures 9A and 9B can be used as the data processing device in Figure 7 730.
  • FIGS. 8A, 8B and related descriptions please refer to FIGS. 8A, 8B and related descriptions, and will not be repeated here.
  • the data processing device receives a first identification record from the network security device and a second identification record and a correspondence table from the terminal device, if the identifier of the first data stream included in the first identification record And the identifier of the second data stream included in the second identification record is the same, and the association table is queried whether there is an association that stores the identifier of the application included in the first identification record and the identifier of the process included in the second identification record. Recording, if not present, determining that the first identification record is an error identification record. Through the above process, the error recognition record of the network security device can be found, and the effect of application recognition is improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Technology Law (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种网络流量中的应用信息的识别方法和装置，用以改善应用识别技术的识别效果。该方法由终端设备执行，终端设备中的第一对应表保存有终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表保存有应用的标识和应用创建的进程的标识的第二对应关系，该方法包括：接收网络安全设备发送的第一数据流的标识；在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；向所述网络安全设备发送所述应用的标识。

Description

网络流量中的应用信息的识别方法和装置
本申请要求于2015年12月28日提交中国专利局、申请号为201511000809.5、发明名称为“网络流量中的应用信息的识别方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机及网络通信技术领域，尤其涉及一种网络流量中的应用信息的识别方法及一种网络流量中的应用信息的识别装置。
背景技术
随着互联网技术的快速发展，基于互联网技术实现的包括服务，游戏在内各种应用也日益丰富。为了满足企业或网络监管部门的各种需求，如为了实现对用户上网行为的管理控制，或者通过流量统计对当前热门应用进行排名，使得流量识别成为了网络安全设备的一项基本功能。其中网络安全设备包括安全网关、防火墙、深度报文检测(Deep Packet Inspection，DPI)设备等具有流量分析和管理功能的报文转发功能的设备。
流量识别技术分为协议识别技术和应用识别技术。顾名思义，协议识别技术是指网络安全设备确定流经本设备的流量中各数据流所属的协议类型，并进一步可以确定不同协议类型的数据流在总流量中所占的比例。
本申请中的“应用”是指提供特定功能、且具有网络访问和报文处理能力的应用软件。当这类应用软件在一个终端设备上运行之后，能够开启终端设备上的网络接口，通过开启的接口与网络中的另一终端设备建立连接，并通过建立的连接传输一系列报文，继而通过对接收到的报文进行处理向用户提供特定的功能。例如，网络浏览器Internet Explorer(IE)，即时通信软件腾讯QQ，文件传输协议(File Transfer Protocal，FTP)客户端FileZilla等。
由于应用是运行在协议之上的，换句话说，同一种协议上可以运行多种不同的应用，例如点对点(peer to peer，P2P)客户端，网页浏览器都是基于超文本传输协议(HyperText Transfer Protocol，HTTP)协议来实现的。如果 只是基于HTTP协议进行流量识别和管控，那么无法区分一个数据流是P2P客户端发送的，还是网络浏览器发送的。如果能够通过应用识别技术区分出HTTP协议的数据流是哪种应用发送的，那么就可以知晓用户正在进行的是与工作相关的网页访问活动，还是与工作无关的网络游戏，进而阻断网络游戏造成的流量。因此与传统的协议识别技术相比，通过应用识别技术可以获得更为精细的管理控制效果。
现有应用识别技术主要包括基于特征的识别技术、启发式识别技术、关联识别技术。
其中，基于特征的识别技术是指通过应用所特有的报文格式设计上的特征，如特有的关键字、或者固定位置的字段内容来识别发送该报文的应用。例如，网络安全设备接收到报文后，查找该报文中是否携带关键字“PPLiveVA”，如果携带有关键字“PPLiveVA”，则说明发送该报文是应用是网络电视PPTV。
启发式识别技术是指通过分析一种应用所发送的报文长度、报文内容中字符的出现规律、通信双方的交互规律、报文的发送间隔的等现象，获得能够将这种应用与其他应用相区分的统计学意义上的规则，通过这种规则来识别发送报文的应用。启发式识别技术对经过加密的报文、或者使用私有未公开协议发送的报文有一定的识别效果。然而由于规则获取方式是通过统计分析而得到的，因此存在漏报率和误报率较高的问题。
关联识别技术是指将报文的IP地址、端口号和协议标识，与包含有IP地址、端口号、协议标识与应用的对应关系的关联识别规则进行匹配，对发送报文的应用进行识别。
现有应用识别技术所依赖的特征、规则都是由人工对收集到的大量报文进行分析得到的。网络安全设备厂商、或与网络安全设备厂商合作的第三方机构将包括特征、规则在内的更新规则库上传至升级网站，网络安全设备从升级网站中获取更新规则库，从而保证网络安全设备的识别能力。然而即便如此，由于规则库升级不及时、启发式识别技术识别精确性不高等因素，现有应用识别技术仍然无法识别出相当比例的网络流量，或者存在相当比例的网络流量得到错误的识别结果。
发明内容
本申请实施例提供一种网络流量中的应用信息的识别方法，用以改善应用识别技术的识别效果。
本申请实施例提供的技术方案如下：
第一方面，提供了一种网络流量中的应用信息的识别方法，所述方法由终端设备执行，其特征在于，所述终端设备中的第一对应表以记录的方式保存有所述终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表以记录的方式保存有应用的标识和所述应用创建的进程的标识的第二对应关系，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，
所述方法包括：
接收网络安全设备发送的第一数据流的标识；
所述终端设备在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；
所述终端设备在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；
向所述网络安全设备发送所述应用的标识。
本申请实施例提供的网络流量中的应用信息的识别方法，终端设备根据网络安全设备发送的数据流的标识，查找本地保存的对应表后，向网络安全设备反馈应用的标识，从而协助网络安全设备确定数据流的应用识别结果。相比于现有技术，上述系统通过网络安全设备和终端设备之间的交互，能够识别出更多的应用，从而降低了未识别流量在总流量中所占的比例，改善了网络流量的识别效果。
终端设备可以通过以下方式来获得和更新第一对应表，以保证第一对应表的实时性，减少占用的存储空间。
可选地，所述终端设备通过以下步骤获得所述第一对应表：
所述终端设备通过操作系统提供的接口，获得所述终端设备中运行的至少一个进程的标识；
针对获得的每个进程的标识，所述终端设备获得该进程创建的数据流的标识，生成一个包含所述进程的标识和所述数据流的标识的记录；并将所述 记录保存在所述第一对应表中。
可选地，所述终端设备通过以下步骤获得所述第一对应表：
所述终端设备通过钩子函数获得所述操作系统创建进程的事件；
从所述创建进程的事件中获得新创建的进程的标识；
获得该新创建进程创建的数据流的标识，生成一个包含所述新创建进程的标识和所述新创建进程创建的所述数据流的标识的记录；并将所述记录保存在所述第一对应表中；
所述终端设备获取第一对应表，还包括：
所述终端设备通过钩子函数获得所述操作系统退出进程的事件；
从所述退出进程的事件中获得退出进程的标识，从所述第一对应表中删除包含所述退出进程的标识的记录。
可选地，所述第一对应表中的记录还包含数据流的最后活动时间；所述方法还包括：
所述终端设备确定所述第一对应表中的过期记录，所述过期记录是指包括的数据流的最后活动时间和当前时间之间的时间间隔超过预定时间间隔的记录；
删除所述过期记录。
可选地，所述终端设备获取所述第一对应表之后，还包括：
所述终端设备通过钩子函数获得所述终端设备传输的报文；
从获得的报文中获得报文所属数据流的标识；
将所述第一对应表中包含所述报文所属数据流的标识的记录中数据流的最后活动时间更新为当前时间。
可选地，所述终端设备获取所述第一对应表之后，还包括：
所述终端设备通过钩子函数获得所述终端设备传输的报文；
从获得的报文中获得报文状态标识和报文所属数据流的标识；
如果所述报文状态标识为FIN，则删除所述第一对应表中包含所述报文所属数据流的标识的记录。
为了获得完整的数据流，以便进行规制提取等后续分析，可选地，所述获取所述第一记录中的进程的标识之后，还包括：
为所述进程的标识设置报文采集标识，所述报文采集标识用于指示所述 终端设备在通过操作系统的接口捕获所述进程传输的报文后，获得并存储所述进程后续传输的完整数据流。
第二方面，提供了一种终端设备，所述终端设备包括存储器、处理器和网络接口，所述存储器、处理器和网络接口通过总线相互通信；
所述存储器存储程序代码、第一对应表和第二对应表，所述第一对应表以记录的方式保存有所述终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表以记录的方式保存有应用的标识和所述应用创建的进程的标识的第二对应关系，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；
所述网络接口，用于接收网络安全设备发送的第一数据流的标识；
所述处理器读取所述存储器中存储的程序代码，执行：
在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；
所述网络接口，还用于向所述网络安全设备发送所述处理器获取的应用的标识。
可选地，所述处理器，还用于通过以下操作获得所述第一对应表：通过操作系统提供的接口，获得所述终端设备中运行的至少一个进程的标识；针对获得的每个进程的标识，所述终端设备获得该进程创建的数据流的标识，生成一个包含所述进程的标识和所述数据流的标识的记录；并将所述记录保存在所述第一对应表中。
可选地，所述处理器，还用于通过以下操作获得所述第一对应表：
通过钩子函数获得所述操作系统创建进程的事件；从所述创建进程的事件中获得新创建的进程的标识；获得该新创建进程创建的数据流的标识，生成一个包含所述新创建进程的标识和所述新创建进程创建的所述数据流的标识的记录；并将所述记录保存在所述第一对应表中；以及
通过钩子函数获得所述操作系统退出进程的事件；从所述退出进程的事件中获得退出进程的标识，从所述第一对应表中删除包含所述退出进程的标识的记录。
可选地，所述第一对应表中的记录还包含数据流的最后活动时间；
所述处理器，还用于确定所述第一对应表中的过期记录，所述过期记录是指包括的数据流的最后活动时间和当前时间之间的时间间隔超过预定时间间隔的记录；删除所述过期记录。
可选地，所述处理器，还用于获取所述第一对应表之后，所述终端设备通过钩子函数获得所述终端设备传输的报文；
从获得的报文中获得报文所属数据流的标识；
将所述第一对应表中包含所述报文所属数据流的标识的记录中数据流的最后活动时间更新为当前时间。
可选地，所述处理器，还用于获取所述第一对应表之后，所述终端设备通过钩子函数获得所述终端设备传输的报文；
从获得的报文中获得报文状态标识和报文所属数据流的标识；
如果所述报文状态标识为FIN，则删除所述第一对应表中包含所述报文所属数据流的标识的记录。
第三方面，提供了一种网络安全设备，包括存储器、处理器和网络接口，所述存储器、处理器和网络接口通过总线相互通信；
所述网络接口，用于接收第一数据流；
所述处理器，用于读取所述存储器中存储的程序代码，执行：
如果无法识别出发送所述第一数据流的应用，则获取所述第一数据流的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；指示所述网络接口根据所述第一数据流的标识中的源地址或目的地址，向终端设备发送所述数据流的标识，所述终端设备的地址为所述第一数据流的标识中的源地址或目的地址；
所述网络接口，还用于接收所述终端设备发送的应用的标识，确定接收到的所述应用的标识为发送所述第一数据流的应用的标识。
本申请实施例提供的网络安全设备通过与终端设备之间的交互，能够识别出更多的应用，从而降低了未识别流量在总流量中所占的比例，改善了网络流量的识别效果。
第四方面，提供了一种网络流量中的应用信息的识别系统，其特征在于，包括网络安全设备和终端设备，其中：
所述网络安全设备，用于接收第一数据流，并获取所述第一数据流的标 识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；根据所述第一数据流的标识中的源地址或目的地址，向所述终端设备发送所述数据流的标识，所述终端设备的地址为所述第一数据流的标识中的源地址或目的地址；接收所述终端设备发送的应用的标识，确定接收到的所述应用的标识为发送所述第一数据流的应用的标识；
所述终端设备，存储有第一对应表和第二对应表，所述第一对应表保存有所述终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表保存有应用的标识和所述应用创建的进程的标识的第二对应关系，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，
所述终端设备用于接收网络安全设备发送的第一数据流的标识；在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；向所述网络安全设备发送所述应用的标识。
本申请实施例提供的网络流量中的应用信息的识别系统中，网络安全设备根据终端设备的反馈，确定数据流的应用识别结果。相比于现有技术，上述系统通过网络安全设备和终端设备之间的交互，能够识别出更多的应用，从而降低了未识别流量在总流量中所占的比例，改善了网络流量的识别效果。
为了提高网络安全设备中后续数据流的识别成功率，网络安全设备还可以根据终端的反馈生成新的关联规制，
可选地，所述网络安全设备，还用于生成第一关联识别规则和第二关联识别规则，所述第一关联识别规则包含所述应用的标识和由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包含所述应用的标识和由所述第一数据流的源地址、源端口和协议号组成的三元组；
接收第二数据流，获取所述第二数据流的目的三元组和源三元组中的至少一个，所述第二数据流的目的三元组为由所述第二数据流的目的地址、目的端口和协议号组成的三元组，所述第二数据流的源三元组为所述第二数据流的源地址、源端口和协议号组成的三元组；
如果所述获取的三元组与所述第一关联识别规则和所述第二关联识别规则中任意一个关联识别规则包含的三元组一致，则确定发送所述第二数据流的应用的标识为所述任意一个关联识别规则包含的应用的标识。
第五方面，提供了一种网络流量中的应用信息的识别方法，包括：
接收来自于网络安全设备的第一识别记录，所述第一识别记录包含第一数据流的标识和应用的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；
接收来自于终端设备的第二识别记录和对应表，所述第二识别记录包含第二数据流的标识和进程的标识，所述对应表中的每条记录保存一个应用的标识与所述应用创建的进程的标识，也就是说通过对应表中的记录保存应用的标识与进程的标识之间的对应关系；
如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；
如果不存在所述第一关联记录，确定所述第一识别记录为错误识别记录。
本申请实施例提供的网络流量中的应用信息的识别方法，数据处理设备通过比较终端设备和网络安全设备的识别记录，能够识别出现有技术难以发现的网络安全设备的错误识别记录，改善了网络流量的识别效果。
可选地，如果不存在所述第一关联记录，所述方法还包括：
向所述终端设备发送所述第二识别记录中包含的进程的标识，以使所述终端设备为所述进程的标识设置报文采集标识，所述报文采集标识于指示所述终端设备在通过操作系统的接口捕获所述进程传输的报文后，获得并存储所述进程后续传输的完整数据流。
在发现错误识别记录后，为了避免后续由于关联规则造成相同的错误识别记录，数据处理设备还可以通知网络安全设备删除造成错误识别的关联识别规则。
可选地，所述第一识别记录中还包含识别方式的标识，所述识别方式包括关联识别、特征识别和启发式识别；
如果所述第一识别纪录中识别方式的标识为关联识别方式的标识，则在 不存在所述第一关联记录时，所述方法还包括：
向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则或第二关联识别规则，所述第一关联规则包括由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包括由所述第一数据流的源地址、源端口和协议号组成的三元组。
在发现错误识别记录后，为了提高后续识别的成功率，数据处理设备还可以通知网络安全设备生成正确的关联识别规则。
可选地，如果不存在所述第一关联记录，所述方法还包括：
在所述对应表中查询是否存在第二关联记录，所述第二关联记录中保存有第二识别记录中包含的进程的标识，以及与之相应的应用的标识；
如果存在所述第二关联记录，生成第三关联规则和第四关联规则，所述第三关联规则包括所述第二关联记录中的应用的标识和由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第四关联规则包括第二关联记录中的应用的标识和由所述第一数据流的源地址、源端口和协议号组成的三元组；
向所述网络安全设备发送所述第三关联识别规则和第四关联识别规则。
可选地，还包括：
接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；
接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第二关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
如果存在所述第三关联记录，则生成第五关联识别规则和第六关联识别规则，所述第五关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的目的地址、目的端口和协议号组成的三元组，所述第六关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据 流的源地址、源端口和协议号组成的三元组；
向所述网络安全设备发送所述第五关联识别规则和第六关联识别规则。
可选地，还包括：
接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；
接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第三关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
如果存在所述第三关联记录，将所述第三关联记录中包含的应用的标识和所述第三数据流的标识发送给所述网络安全设备。
第六方面，提供了一种网络流量中的应用信息的识别方法，包括：
接收来自于网络安全设备的第一识别记录，所述第一识别记录包含第一数据流的标识、应用的标识和识别方式的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，所述识别方式包括关联识别、特征识别和启发式识别；
接收来自于终端设备的第二识别记录和对应表，所述第二识别记录包含第二数据流的标识和进程的标识，所述对应表中的每条记录保存一个应用的标识与所述应用创建的进程的标识的对应关系；
如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；
如果所述第一识别纪录中识别方式的标识为关联识别方式的标识，则在不存在所述第一关联记录时，向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则或第二关联识别规则，所述第一关联规则包括由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包括由所述第一数据流的源地址、 源端口和协议号组成的三元组。
本申请实施例提供的网络流量中的应用信息的识别方法，数据处理设备在发现错误识别记录后，为了避免后续由于关联规则造成相同的错误识别记录，数据处理设备还可以通知网络安全设备删除造成错误识别的关联识别规则。
第七方面，提供了一种数据处理设备，所述处理设备包括存储器、处理器和网络接口，所述存储器、处理器和网络接口通过总线相互通信；
所述存储器存储程序代码；
所述网络接口，用于接收来自于网络安全设备的第一识别记录，所述第一识别记录包含第一数据流的标识和应用的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；
接收来自于终端设备的第二识别记录和对应表，所述第二识别记录包含第二数据流的标识和进程的标识，所述对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识；
所述处理器读取所述存储器中存储的程序代码，执行：
如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；
如果不存在所述第一关联记录，确定所述第一识别记录为错误识别记录。
可选地，所述第一识别纪录中还包含识别方式的标识，所述识别方式包括关联识别、特征识别和启发式识别；
所述网络接口，还用于如果所述第一识别纪录中识别方式的标识为关联识别方式的标识，则在不存在所述第一关联记录时，向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则或第二关联识别规则，所述第一关联规则包括由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包括由所述第一数据流的源地址、源端口和协议号组成的三元组。
可选地，所述网络接口，还用于接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标 识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；
接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
所述处理器，还用于确定所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识是否相同，则在所述对应表中查询是否存在第二关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
如果存在所述第三关联记录，则生成第五关联识别规则和第六关联识别规则，所述第五关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的目的地址、目的端口和协议号组成的三元组，所述第六关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的源地址、源端口和协议号组成的三元组；
所述网络接口，还用于向所述网络安全设备发送所述第五关联识别规则和第六关联识别规则。
可选地，所述网络接口，还用于接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；
接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
所述处理器，还用于确定所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识是否相同，如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第三关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
所述网络接口，还用于如果所述处理器确定存在所述第三关联记录，将所述第三关联记录中包含的应用的标识和所述第三数据流的标识发送给所述网络安全设备。
本申请实施例提供的数据处理设备通过比较终端设备和网络安全设备的识别记录，能够识别出现有技术难以发现的网络安全设备的错误识别记录，改善了网络流量的识别效果。
第八方面，提供了一种网络流量中的应用信息的识别系统，包括数据处理设备、终端设备和网络安全设备，其中：
所述网络安全设备，用于接收第一数据流，确定发送所述第一数据流的应用的标识后，生成第一识别记录，所述第一识别记录包含所述第一数据流的标识和所述应用的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，向所述数据处理设备发送所述第一识别记录；
所述终端设备，用于获取所述终端设备上的进程的标识以及所述进程创建的第二数据流的标识，生成第二识别记录，所述第二识别记录包含第二数据流的标识和进程的标识；以及获取所述对应表，所述对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识；向所述数据处理设备发送所述第二识别记录和对应表；
所述数据处理设备，用于接收来自于所述网络安全设备的第一识别记录；接收来自于所述终端设备的第二识别记录和对应表；如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；如果不存在所述第一关联记录，则确定所述第一识别记录为错误识别记录。
本申请实施例提供的网络流量中的应用信息的识别系统中数据处理设备通过比较终端设备和网络安全设备的识别记录，能够识别出现有技术难以发现的网络安全设备的错误识别记录，改善了网络流量的识别效果。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1A为本申请实施例提供的一种网络流量中的应用信息的识别系统的示意图；
图1B为本申请实施例提供的另一种网络流量中的应用信息的识别系统 的示意图；
图2为本申请实施例提供的网络流量中的应用信息的识别方法的流程图；
图3A为本申请实施例提供的获取第一对应表的流程图；
图3B为本申请实施例提供的更新第一对应表的流程图；
图4为本申请实施例提供的获取完整数据流的流程图；
图5A为本申请实施例提供的一种终端设备的结构示意图；
图5B为本申请实施例提供的另一种终端设备的结构示意图；
图6A为本申请实施例提供的一种网络安全设备的结构示意图；
图6B为本申请实施例提供的另一种网络安全设备的结构示意图；
图7为本申请实施例提供的另一种网络流量中的应用信息的识别系统的示意图；
图8A为本申请实施例提供的一种网络流量中的应用信息的识别方法的交互图；
图8B为本申请实施例提供的另一种网络流量中的应用信息的识别方法的交互图；
图9A为本申请实施例提供的一种数据处理设备的结构示意图；
图9B为本申请实施例提供的另一种数据处理设备的结构示意图。
具体实施方式
本申请中的“数据流”是指由源地址、源端口、目的地址、目的端口和协议类型确定出的两个终端设备之间在一定时间段内传输的一系列报文。本申请中的终端设备可以是便携式计算机、服务器、移动终端等具有网络接入功能和运行应用软件能力的设备。数据流的标识是指由源地址、源端口、目的地址、目的端口和协议组成的五元组。
应用识别技术是指网络安全设备确定一条数据流是由终端设备中的哪个应用软件发送的。
本申请实施例提供的网络流量中的应用信息的识别方法，通过网络安全设备与终端设备之间的交互，能够识别出一些现有应用识别技术无法识别出的数据流，从而降低无法识别的网络流量在总网络流量中所占的比例，提高应用识别的成功率；或者识别出一些错误的识别结果，从而降低误报率，提 高应用识别的准确性。
实施例一
附图1A和1B是本申请实施例提供的网络流量中的应用信息的识别系统的示意图。该系统中包括终端设备110和网络安全设备120。
网络安全设备120有两种部署方式。第一种是如附图1A所示的直路部署方式，网络安全设备120是一种具有报文转发功能的设备，例如终端设备110可以是位于局域网中的个人计算机或服务器，网络安全设备120是局域网中的防火墙设备。终端设备110也可以是位于互联网中的个人计算机或服务器，网络安全设备120是安全网关。在这种部署方式中，网络安全设备120得到流经该网络安全设备120的数据流后，确定发送该数据流的终端设备中的应用。在本申请后续描述中，这一过程也被简称为网络安全设备120对流经该网络安全设备120的数据流的应用进行识别。进一步地，网络安全设备120中存储有安全策略，当网络安全设备120获得数据流的应用识别结果后，根据安全策略决定对数据流的后续处理方式，例如阻断数据流还是转发数据流。详细过程将在后面的实施例中结合实例进行介绍。
第二种是如附图1B所示的旁路部署方式，网络安全设备120是一个具有流量统计功能的旁路设备，用于对各种应用的流量在总流量中的比例进行统计，并可以进一步得到各种应用的排名信息。网络安全设备120接收报文转发设备发送的镜像数据流，对镜像数据流的应用进行识别，根据识别结果更新统计记录，定期输出统计结果。
无论是附图1A所示的直路部署方式，还是附图1B所示的旁路部署方式，网络安全设备120都需要与终端设备110进行消息交互。下面就网络安全设备120和终端设备110的功能进行介绍。网络安全设备120和终端设备110的功能可以是分别由网络安全设备120和终端设备110中的一个软件模块来实现的，例如网络安全设备120的下述功能是由网络安全设备120中的应用识别模块实现的，终端设备110的功能是由终端设备110中的代理(Agent)实现的。
网络安全设备120，用于接收第一数据流，并获取所述第一数据流的标识，根据所述第一数据流的标识中的源地址或目的地址，向终端设备110发送所述数据流的标识，其中终端设备110的地址为所述第一数据流的标识中的源 地址或目的地址。接收终端设备110发送的应用的标识，确定接收到的所述应用的标识为发送第一数据流的应用的标识。
可选地，网络安全设备120中存储有安全策略。安全策略是预先配置的关于允许特定数据流被转发，或者禁止特定数据流被转发的规则。例如“permit Web browsing(WB)-default deny all”表示只允许转发网络浏览器发送的数据流，禁止其他应用发送的数据流。“deny QQ deny P2P-default permit all”表示只禁止转发即时通讯软件QQ和P2P客户端软件发送的数据流，允许转发其他应用发送的数据流。对于被配置为允许某些数据流被转发的安全策略而言，这类安全策略包含允许转发的应用的标识。例如，安全策略只允许转发网络浏览器发送的数据流，即只允许转发的应用标识是网络浏览器的标识WB，那么当网络安全设备120接收到一个数据流后，如果识别出发送数据流的应用的标识是WB时，转发该数据流，如果识别出发送数据流的应用的标识是P2P客户端的标识P2P，不是WB，阻断该数据流。
网络安全设备120在接收到的第一数据流中的报文时，先采用基于特征的识别技术、启发式识别技术，或关联识别技术等现有应用识别技术对第一数据流进行识别。
以被配置为允许特定数据流被转发的安全策略为例，如果能够得到识别结果，则判断安全策略是否包含识别出的应用的标识，如果包含识别出的应用的标识，则转发所述第一数据流中的报文；否则如果未包含识别出的应用的标识，则阻断所述第一数据流中的报文。网络安全设备120如果根据上述现有的应用识别技术无法得到识别结果，即无法确定发送所述第一数据流的应用的标识，则获取第一数据流的标识，向第一数据流的标识中的源地址所标识的终端设备发送第一数据流的标识，或者向第一数据流的标识中的目的地址所标识的终端设备发送第一数据流的标识，以便通过与终端设备的交互，得到终端设备返回的应用的标识，从而确定发送所述第一数据流的应用的标识为终端设备返回的应用的标识。
需要指出的是，网络安全设备不仅仅可以在无法得到识别结果时，向第一数据流的标识中的源地址所标识的终端设备发送第一数据流的标识，或者向第一数据流的标识中的目的地址所标识的终端设备发送第一数据流的标识。网络安全设备还可以为了提高识别的准确性，例如当采用关联识别技术 进行应用识别时，当一条关联识别规则第一次被匹配到时，为了确认该关联识别规则的准确性，向终端设备发送第一数据流的标识，将终端设备后续返回的应用的标识与根据关联识别规则得到的识别结果进行比较，如果相同，则确认该关联识别规则是准确的。
终端设备110，用于获取第一对应表和第二对应表，所述第一对应表中的每条记录保存终端设备110中运行的一个进程的标识和所述进程建立的数据流的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组。
所述第二对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识。在本实施例中，一个应用是指应用软件，OS运行一个应用之后，会创建至少一个进程，每个进程完成一个相对独立的功能。也就是说，一个应用对应至少一个进程。通常而言，一个进程只能被一个应用所创建和使用，只有极少数的系统进程会被多个应用使用，本申请不考虑这种情况，这样的进程不被收录到第一对应表和第二对应表中。
例如，一种名为“搜狗输入法”的应用运行之后，会创建一个名为“SogouCloud.exe”的进程和一个名为“SogouSmartInfo.exe”的进程，其中名为“SogouCloud.exe”的进程用于从网络服务器获得更新的字体库，显示栏图标等信息，名为“SogouSmartInfo.exe”用于从网络服务器获得智能联想规则，用于根据用户已拼写出的词预测用户将要拼写的词，提升输入效率。
每个进程运行后，根据程序代码的设计，有可能不创建数据流，也可能创建一个或多个数据流。也就是说，一个进程可以对应一个数据流或多个数据流。
终端设备110接收网络安全设备发送的第一数据流的标识。在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；终端设备在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；向所述网络安全设备发送所述应用的标识。
下面将参照附图2结合一个具体实例，对本发明提供的网络流量中的应用信息的识别方法进行描述。本实施例中的网络安全设备可以是附图1A或附图1B中的网络安全设备120。
步骤201，网络安全设备发现一条未识别的数据流。具体地，网络安全设备在对数据流进行应用识别时，接收该数据流的至少一个报文。对于其中的每个报文，在根据规则选择性缓存其中的特征之后，将该报文转发出去。当接收到表示数据流即将结束的最后一个报文时，例如报文状态标识为FIN的报文时，或者接收并转发一个数据流中设定数量的报文后，还无法通过现有应用识别技术识别出发送该数据流的应用，则确定该数据流为未识别数据流。
步骤202，网络安全设备获取上述未识别数据流的标识。网络安全设备通过解析已缓存的未识别数据流的报文，获得报文的五元组，即源IP地址，源端口，目的IP地址，目的端口和协议类型，将该五元组作为未识别数据流的标识。例如获得的五元组信息为“tcp 192.168.1.211:3020-201.6.8.30:6682”。
步骤203，网络安全设备将数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”封装在一个报文P1中，向所述终端设备发送报文P1。
可选地，网络安全设备可以将数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”发送给IP地址为192.168.1.211的终端设备，也可以将数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”发送给IP地址为201.6.8.30的终端设备，或者将数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”发送给IP地址为192.168.1.211的终端设备和IP地址为201.6.8.30的终端设备。
由于IP地址为192.168.1.211的终端设备和IP地址为201.6.8.30的终端设备可以执行类似的处理步骤，为了简明起见，本实施例后续仅以IP地址为192.168.1.211的终端设备为例进行说明。
步骤204，终端设备接收网络安全设备发送的报文P1，对报文P1进行解析，得到报文P1携带的数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”。
步骤205，终端设备在第一对应表中，查找保存有数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”的记录，如果查找到，执行步骤206，如果没有查找到，终止处理。
步骤206，终端设备从查找到的保存有数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”的记录中，获取与该数据流的标识“tcp  192.168.1.211:3020-201.6.8.30:6682”对应的进程的标识SogouCloud.exe。
终端设备中保存有两个对应表，其中第一对应表中的每条记录保存所述终端设备中运行的一个进程的标识和所述进程建立的数据流的标识。第二对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识。显然，终端设备也可以用一个对应表来存储应用的标识、应用创建的进程的标识、以及进程建立的数据流的标识三者的对应关系。本申请仅仅是为了后续描述上的简便，将进程的标识和进程建立的数据流的标识的对应关系保存在第一对应表中，将应用的标识和应用创建的进程的标识的对应关系保存在第二对应表中。当使用一个汇总的对应表保存上述对应关系时，将应用的标识保存在第一列，应用创建的进程的标识保存在第二列，进程建立的数据流的标识保存在第三列。本申请后续实施例中查找第一对应表的过程，相当于在汇总的对应表中的第一列和第二列中查找，后续实施例中查找第二对应表的过程，相当于在汇总的对应表的第二列和第三列中查找。
终端设备中保存的第一对应表如表1所示。终端设备获得第一对应表的过程将在后面结合流程图进行详细描述。
表1
Figure PCTCN2016099891-appb-000001
终端设备在表1中查找到包含数据流的标识“tcp  192.168.1.211:3020-201.6.8.30:6682”的记录是第1行记录，进而获得第1行记录中的进程的标识SogouCloud.exe。
步骤207，终端设备在第二对应表中，查找保存有进程的标识SogouCloud.exe的记录，如果查找到，执行步骤208，如果没有查找到，终止处理。
步骤208，终端设备从查找到的保存有进程的标识SogouCloud.exe的记录中获取与进程标识SogouCloud.exe对应的应用的标识。在本实施例中，标识可以是该应用的名称“搜狗输入法”。
终端设备中保存的第二对应表如表2所示。第二对应表可以由Agent的软件厂商来收集，研发设计人员可以通过对应用软件的安装包或应用软件运行后进程列表的变化来知晓应用软件运行后开启了哪些进程，从而得到应用标识和进程标识的对应关系。事实上，为了减少终端设备的存储空间，提高执行效率，软件厂商也不需要搜集所有应用标识和进程标识的对应关系，只需要收集常见的、网络流量的应用识别过程中易产生漏报和误报的应用开启了哪些进程的信息就可以了。终端设备中的Agent可以定期从软件厂商的升级网站中得到。
表2
Figure PCTCN2016099891-appb-000002
终端设备在表2中查找到包含进程的标识SogouCloud.exe的记录是第1行记录，进而获得第1行记录中的应用的名称“搜狗输入法”。应用的标识可以有很多形式，为了描述地更加直观，本实施例中直接用应用的名称来代表应用的标识。在实际应用中，软件厂商为了便于维护，往往会按照预定的分配规则，给每个应用分配一个编号，用编号来代表应用的标识。
步骤209，终端设备将查找到的应用的名称“搜狗输入法”封装到一个报文P2中，向网络安全设备发送报文P2。
由于网络安全设备和终端设备之间有可能并发地进行多次交互，用以对 多个不同数据流的应用进行识别，为了网络安全设备处理简便起见，终端设备可以将数据流的标识和针对该数据流确定出的应用的标识封装在同一个报文中发送给网络安全设备，在本实例中终端设备将数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”和应用的名称“搜狗输入法”封装到报文P2中，发送给网络安全设备。
步骤210，网络安全设备接收终端设备发送的报文P2，对报文P2进行解析，得到报文P2携带的数据流的标识“tcp 192.168.1.211:3020-201.6.8.30:6682”和应用的名称“搜狗输入法”。
步骤211，网络安全设备根据P2中携带的数据流的标识，在流表中找到相应的记录，将P2中携带的应用的名称作为识别结果填入表中。
网络安全设备会维护一个流表，流表中的每条记录对应一条数据流，记录了数据流的相关信息，例如状态、识别结果等等。在本步骤中，网络安全设备得到了一条识别记录“tcp 192.168.1.211:3020-201.6.8.30:6682搜狗输入法”。
可选地，在步骤211网络安全设备得到识别记录之后，为了减少后续网络安全设备与终端设备为同一标识的数据流进行的多次交互，网络安全设备可以生成关联识别规则。
步骤212，网络安全设备生成第一关联识别规则和第二关联识别规则，所述第一关联识别规则包含所述应用的标识和由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包含所述应用的标识和由所述第一数据流的源地址、源端口和协议号组成的三元组。
后续网络安全设备接收到另一数据流时，例如第二数据流。如果所述第二数据流的目的三元组和源三元组中的至少一个与所述第一关联识别规则和所述第二关联识别规则中任意一个关联识别规则包含的三元组一致，则确定发送所述第二数据流的应用的标识为所述任意一个关联识别规则包含的应用的标识。
本实施例中，第一关联规则为“tcp 201.6.8.30:6682搜狗输入法”，第二关联规则为“tcp 192.168.1.211:3020搜狗输入法”。
后续另一终端设备发送了第二数据流，网络安全设备在接收到第二数据流中的报文P3时，根据报文P3提取第二数据流的标识为“tcp  192.168.1.100:3020-201.6.8.30:6682”，第二数据流的目的三元组是“tcp 201.6.8.30:6682”。由于第二数据流的目的三元组与第一关联规则中的三元组相同，则网络安全设备可以直接根据第一关联规则确定第二数据流的应用为“搜狗输入法”，无需与终端设备再次进行交互。
本申请实施例提供的网络流量中的应用信息的识别系统中，网络安全设备在接收到一个数据流时，获取该数据流的标识，向所述终端设备发送该数据流的标识。终端设备在存储的第一对应表中，查询到所述未识别数据流的标识对应的进程的标识；在所述第二对应表中查询到应用标识，所述应用标识与所述未识别数据流的标识对应的进程的标识对应；向所述网络安全设备发送所述查询到的应用标识。网络安全设备根据终端设备的反馈，确定上述数据流的应用识别结果。相比于现有技术，上述系统通过网络安全设备和终端设备之间的交互，能够识别出更多的应用，从而降低了未识别流量在总流量中所占的比例，改善了网络流量的识别效果。
参照附图3A，上述实施例中的终端设备可以通过以下方式来获得表1所示的第一对应表：
步骤31,终端设备获得进程列表。
终端设备通过终端设备上运行的操作系统(operating system，OS)提供的接口，获得终端设备上运行的进程列表。本申请中的“进程”是指正在运行的程序的实例，是一个具有一定独立功能的程序关于某个数据集合的一次运行活动。它是OS动态执行的基本单元，在传统的OS中，进程既是基本的资源分配单元，也是基本的执行单元。
大多数OS都会提供应用编程接口(Application Programming Interface，API)或命令行命令供应用程序或操作人员得到终端设备上运行的进程列表，例如通过调用Linux操作系统中的“ps”命令可以得到正在运行的进程列表，通过调用Windows操作系统中的EnumProcesses函数可以得到正在运行的进程列表。
步骤32，终端设备获得每个进程创建的数据流的标识。
对于进程列表中的每一个进程，终端设备通过OS提供的接口，获得该进程通过开启端口所建立的当前活动的连接。例如，在Linux操作系统中可以通过“/proc”虚拟文件系统遍历进程打开的连接。在Windows操作系统中通过 GetExtendedTcpTable函数可以获取到所有TCP数据流与进程的对应关系，通过GetExtendedUdpTable函数可以获取到所有UDP数据流与进程的对应关系。
将每个当前活动的连接作为一条数据流，将活动的连接的五元组作为数据流的标识。
步骤33，终端设备针对获得的每个进程的标识，生成一个包含所述进程的标识与所述数据流的标识的记录；并将所述记录保存在所述第一对应表中。从而得到第一对应表。
可选地，由于OS系统根据用户的使用情况，随时可能创建进程或退出进程，为了实时更新和维护第一对应表，从而提高终端设备根据网络安全设备发生的未识别的数据流的标识，查找到对应的应用的概率，终端设备通过钩子函数来监控进程的状态，从而更新第一对应表中的记录。附图3B是本实施例提供的第一对应表更新过程的流程图。
附图3B中的步骤31～步骤33与附图3A类似，为了简明起见，在这里不再展开描述。
步骤34，终端设备通过钩子函数获得所述操作系统创建进程的事件。
钩子函数是Windows消息处理机制的一部分，通过设置“钩子”，Agent或其他应用程序可以在系统级对所有消息、事件进行过滤，访问在正常情况下无法访问的消息。钩子函数的本质是一段用以处理系统消息的程序，通过系统调用，把钩子函数挂入系统。
步骤35，终端设备从创建进程的事件中获得新创建的进程的标识。终端设备通过OS提供的接口，获得该新创建的进程通过开启端口所建立的当前活动的连接。将每个当前活动的连接作为一条数据流，将活动的连接的五元组作为数据流的标识。
步骤36，终端设备获得该新创建进程创建的数据流的标识，生成一个包含所述新创建进程的标识和所述新创建进程创建的所述数据流的标识的记录；并将所述记录保存在所述第一对应表中。
步骤37，终端设备通过钩子函数获得所述操作系统退出进程的事件。
步骤38，终端设备从退出进程的事件中获得退出进程的标识，从所述第一对应表中删除包含所述退出进程的标识的记录。
可选地，为了实时更新和维护第一对应表，终端设备还可以通过钩子函 数来监控网络报文，从而更新第一对应表中的记录，在每条记录中增加数据流的建立时间和最后活动时间信息。从本实施例后面的步骤可以看出，数据流的最后活动时间可以用于对第一对应表中的记录进行老化，数据流的建立时间可以用于其他目的的分析。如步骤39～步骤315所示。
步骤39，终端设备通过钩子函数获得传输的报文，具体的传输的报文可以是发送的报文或接收的报文。为了进一步减少后续数据处理量，可以只捕获协议类型为传输控制协议(Transmission Control Protocol，TCP)或用户数据报协议(User Datagram Protocol，UDP)的报文。
步骤310，终端设备从获得的报文中解析得到报文状态标识和报文所属数据流的标识。具体地，本实施例中状态标识是指四层协议的状态标识，四层协议可以从报文的IP头的protocol字段获取，例如TCP、UDP。TCP的状态标识可以从报文的TCP头的flags字段获得，状态标识可以为FIN、RST等。更详细的报文状态标识的说明可以参考RFC文档，例如RFC 793。
终端设备从获得的报文中提取五元组，将提取的五元组作为报文所属数据流的标识。
步骤311，终端设备判断报文的报文状态标识是否为FIN，如果为FIN，则执行步骤312，如果报文状态标识不是FIN，则执行步骤313。
步骤312，如果所述报文状态标识为FIN，则将所述第一对应表中包含所述报文所属数据流的标识的记录删除，处理结束。
步骤313，终端设备根据获得的数据流的标识，在表1所示的第一对应表中查找包含该数据流的标识的记录。如果查找到记录，说明是该报文属于一条已建立的数据流，执行步骤314，如果未查找到记录，说明该报文属于一条新建立的数据流，执行步骤315。
步骤314，终端设备将查找到的记录中，数据流的最后活动时间更新为当前时间。
事实上，根据数据流的最后活动时间来进行删除过期记录，以及根据报文状态标识FIN来删除记录是两种可以并存的、可选择性的记录删除方式。
例如，通过钩子函数获得了一个TCP报文P4，从报文P4中提取的五元组是“tcp 192.168.1.211:6122-168.3.56.120:1138”。在表1中查找到包含五元组“tcp 192.168.1.211:6122-168.3.56.120:1138”的记录是第9条记录，将第9条 记录中的最后活动时间更新为当前时间21:00:3456，更新后的第一对应表如表3所示。
表3
Figure PCTCN2016099891-appb-000003
步骤315，终端设备刷新第一对应表，在刷新后的第一对应表中查找到包含步骤310中获得的数据流的标识的记录，将该记录中的数据流的建立时间和最后活动时间设置为当前时间。
对于大多数OS而言，无法根据一个五元组直接查找到创建该五元组所标识的数据流的进程，这时OS系统需要重新刷新进程列表，针对刷新后的进程列表中的每个进程，重新获得该进程建立的所有连接，从而得到刷新后的第 一对应表，然后根据步骤310中获得的数据流的标识，在刷新后的第一对应表中查找到包含步骤310中获得的数据流的标识的记录。
例如，终端设备通过钩子函数获得了一个TCP报文P5，从报文P5中提取的五元组是“tcp 192.168.1.211:6123-168.3.56.120:1138”。在表1中未查找到包含五元组“tcp 192.168.1.211:6123-168.3.56.120:1138”的记录，刷新第一对应表，如表4所示，在表4中查找到包含五元组“tcp 192.168.1.211:6123-168.3.56.120:1138”的是第10条记录，将第10条记录中的建立时间和最后活动时间均设置为当前时间21:01:3456，更新后的第一对应表如表4所示。
表4
Figure PCTCN2016099891-appb-000004
Figure PCTCN2016099891-appb-000005
可选地，为了节约中的终端设备中第一对应表占用的存储空间，终端设备可以定时根据第一对应表中的数据流的最后活动时间，删除过期记录，过期记录是指最后活动时间和当前时间之间的时间间隔超过预定时间的数据流对应的记录，即长时间没有活动的数据流，对应的记录：
终端设备判断根据检测周期确定的预定时间是否到达，若到达则执行定时清除任务，即针对如表4所示第一对应表中的每条记录，判断数据流的最后活动时间与当前时间之间的时间间隔是否超过设定阈值，若超过，则删除该条记录；若未到达，则返回执行步骤301。
需要说明的是，附图3B中步骤31～步骤33组成的第一子流程，步骤34～步骤36组成的第二子流程，步骤37～步骤38组成的第三子流程，步骤39～步骤315组成的第四子流程之间是相互无依赖关系的、可以选择性执行的。例如可以只执行第一子流程和第二子流程，也可以只执行第一子流程和第三子流程。
可选地，虽然采用本实施例提供的方案，通过网络安全设备与终端设备之间的交互，可以大大降低无法识别的流量在总流量中所占的比例。但是本实施例提供的方案需要网络安全设备和终端设备之间进行交互，与现有技术网络安全设备根据本地存储的规则进行应用识别的方式相比，所需要的延时较长，也需要消耗一定的网络传输资源。如果能够得到发送网络安全设备无法识别的数据流的进程发送的多个完整的数据流，那么就有可能可以通过人工分析得到规则。对于通过人工分析获得基于特征的识别规则，或启发式识别规则而言，获得同一个应用发送的多个完整的数据流至关重要，完整的数据流是指从连接建立协商阶段通信双方发送的第一个报文，直至连接断开发送的最后一个报文之间的所有数据包。然而现有网络安全设备出于存储空间 和性能的考虑，并不能缓存数据流的多个报文，例如现有的基于特征的识别技术或启发式识别技术，往往也只是从接收到的报文中提取特征后，对提取的特征进行缓存，而对报文进行转发。现有终端设备上的抓包技术抓取一个完整的未识别数据流是相对困难的，因为无法确定要抓取哪一个数据流，以及难以准确定位一个未识别数据流的开始和结束。如果为了抓取一个未识别数据流，保存终端设备相当长时间内发送和接收的所有报文，将极大占用终端设备的存储资源和处理资源。而如果采用抽样抓包的技术，虽然节省了资源，但是会漏掉数据流中的大部分数据包，造成规则提取困难或不准确。对于这个问题，本申请提供了附图4所示的一种方案，能够有针对性的抓取一个进程发送的数据流的全部报文，同时不会占用终端设备中的大量资源。
可选地，附图4在附图2的基础上，在步骤206，终端设备接收到网络设备发送的报文P1，并确定创建标识为“tcp 192.168.1.211:3020-201.6.8.30:6682”的数据流的进程的标识是SogouCloud.exe之后，还包括：
步骤401，终端设备在表1所示第一对应表中为进程SogouCloud.exe设置报文采集标识。报文采集标识用于所述终端设备在通过操作系统的接口捕获所述进程传输的报文后，获得并存储所述进程后续传输的完整数据流。后面将结合具体例子，对报文采集标识的作用进行说明。设置报文采集标识之后的第一对应表如表5所示。
表5
Figure PCTCN2016099891-appb-000006
Figure PCTCN2016099891-appb-000007
在本实施例中，以报文采集标识为“1”进行举例说明。在具体实施过程中，可以在最初生成第一对应表时，为所有进程标识对应的设置报文采集标识为“0”，在步骤206之后，将查找到的记录中的进程标识对应的报文采集标识更新为“1”。当然也可以采用其他的设置方式，总之只要能够在步骤206之后，为查找到的记录中的进程标识设置与此前不同的标识进行区分即可。
步骤49，终端设备通过钩子函数获得传输的报文，具体的传输的报文可以是发送的报文或接收的报文。该步骤与附图3B中的步骤39类似，在这里不再赘述。
步骤410，终端设备从获得的报文中提取数据流标识。具体地，终端设备从获得的报文中提取五元组。
步骤411，终端设备根据获得的数据流的标识，在表5所示的第一对应表中查找包含该数据流的标识的记录。如果查找到，可以如附图3B中的步骤314所示更新记录。如果未查找到记录，说明该报文属于一条新建立的数据流，终端设备刷新第一对应表，在刷新后的第一对应表中查找到包含步骤310中获得的数据流的标识的记录。
例如，终端设备通过钩子函数获得了一个TCP报文P6，从报文P6中提取的五元组是“tcp 192.168.1.211:3011-201.6.8.30:6682”。在表5中未查找到包含五元组“tcp 192.168.1.211:3011-168.3.56.120:1138的记录”，刷新第一对应表，如表6所示，在表6中查找到包含五元组“tcp  192.168.1.211:3011-201.6.8.30:6682”的是第1条记录。
表6
Figure PCTCN2016099891-appb-000008
无论是否在第一对应表中查找到包含该数据流的标识的记录，在步骤411之后，都可以得到一条包含有该数据流的标识的记录，从该记录中获取包含的进程的标识，在本实施例中，获取的进程标识是SogouCloud.exe。
步骤420，终端设备判断第1条记录中的进程标识SogouCloud.exe是否被设置了报文采集标识。若设置了报文采集标识，则执行步骤421。若未设置报 文采集标识，则结束。
步骤421，终端设备清除报文采集标识，并开始针对标识为SogouCloud.exe的进程进行抓包。
在本实施例中终端设备清除表6中的报文采集标识，得到表7，清除报文采集标识的目的是为了避免针对一个进程进行长时间抓包。
表7
Figure PCTCN2016099891-appb-000009
可选地，为了进一步避免长时间的对同一个进程进行抓包，可以设置一 个抓包时间间隔，在执行步骤421之前终端设备判断距离上一次针对同一个进程进行抓包的动作是否超过了设定的抓包时间间隔，若超过，则进行抓包，若未超过则跳过本步骤，即暂不清除抓包标记且暂不执行抓包，结束本次处理。
步骤422，终端设备保存抓包结果，以便后续进行人工分析。终端设备在具体实施针对一个特定进程抓包时，可以根据预设的抓包策略进行抓包，例如，捕获该进程在预定时间段内传输的数据包后结束抓包，或者捕获该进程传输的数据包达到预定的数据量后结束抓包。
在这里需要说明的是附图3B所示的第一对应表的更新方法和附图4所示的抓包方法可以单独执行，也可以相结合执行。
本实施例提供的上述抓包方法，能够在终端设备中获得关于特定进程的多个完整的数据流，以供后续通过人工分析得到基于特征的识别规则，或启发式识别规则，将得到的规则应用于网络安全设备后，可以改善应用识别的效果。
本申请实施例还提供了一种终端设备，如附图5A所示，该终端设备包括存储器510、处理器520和网络接口530，所述存储器510、处理器520和网络接口530通过总线540相互通信。
存储器510包括但不限于是随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或者快闪存储器)、或便携式只读存储器(CD-ROM)。
处理器520可以是一个或多个中央处理器(Central Processing Unit，简称CPU)，在处理器520是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
网络接口530可以是有线接口，例如光纤分布式数据接口(Fiber Distributed Data Interface，简称FDDI)、千兆以太网(Gigabit Ethernet，简称GE)接口；网络接口530也可以是无线接口。如果终端设备是个人计算机，网络接口530可以是上述有线接口也可以是基于IEEE 802.11b的无线局域网(Wireless Fidelity，WiFi)模块。如果终端设备是手机等移动终端，网络接口530可以是由基带芯片和射频天线组成的硬件模块。
存储器510用于存储程序代码、第一对应表和第二对应表。第一对应表 和第二对应表的定义请参见上述实施例中的描述，这里不再重复。
网络接口530，用于接收网络安全设备发送的第一数据流的标识。
所述处理器520读取所述存储器510中存储的程序代码，执行：
在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识。
所述网络接口530，还用于向网络安全设备发送处理器520获取的应用的标识。
可选地，处理器520可以采用上述附图3A、3B及相关描述的方法来获得第一对应表，以及更新第一对应表。
可选地，处理器520可以采用附图4及相关描述的方法来获得完整数据流的报文。
本申请实施例还提供了一种终端设备，如附图5B所示。该终端设备包括存储模块560、接收模块570、处理模块580和发送模块590。需要说明的是这些模块为功能相对独立的逻辑模块，既可以是终端设备中的CPU读取存储中的软件代码并运行后生成的，也可以是由硬件组件来实现的。具体地：
存储模块560，用于存储第一对应表和第二对应表，第一对应表保存有所述终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表保存有应用的标识和所述应用创建的进程的标识的第二对应关系，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组。
接收模块570，用于接收网络安全设备发送的第一数据流的标识。
处理模块580，用于在存储模块560存储的所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识。
发送模块590，用于向所述网络安全设备发送所述应用的标识。
可选地，处理模块580可以采用上述附图3A、3B及相关描述的方法来获得第一对应表，以及更新第一对应表。
可选地，处理模块580可以采用附图4及相关描述的方法来获得完整数 据流的报文。
附图5A和5B所提供的终端设备可以作为附图1A或1B中的终端设备110。
本申请实施例提供的终端设备接收到网络安全设备发送的数据流的标识后，根据终端设备保存的第一对应表和第二对应表，查找到应用的标识，将查找到的应用的标识发送给网络安全设备。通过网络安全设备和终端设备之间的交互，能够识别出更多的应用，从而降低了未识别流量在总流量中所占的比例，改善了网络流量的识别效果。
本申请实施例还提供了一种网络安全设备，如附图6A所示，该网络安全设备包括存储器610、处理器620和网络接口630，所述存储器610、处理器620和网络接口630通过总线640相互通信。
存储器610包括但不限于是随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或者快闪存储器)、或便携式只读存储器(CD-ROM)。
处理器620可以是一个或多个中央处理器(Central Processing Unit，简称CPU)，在处理器520是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
网络接口630可以是有线接口，例如光纤分布式数据接口(Fiber Distributed Data Interface，简称FDDI)、千兆以太网(Gigabit Ethernet，简称GE)接口；网络接口630也可以是无线接口。
网络接口630，用于接收第一数据流。
处理器620，用于获取第一数据流的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组。
网络接口630，还用于根据第一数据流的标识中的源地址或目的地址，向终端设备发送所述数据流的标识，所述终端设备的地址为所述第一数据流的标识中的源地址或目的地址。
可选地，处理器620在采用现有应用识别技术无法识别出发送第一数据流的应用时，指示网络接口630向所述终端设备发送所述数据流的标识。
所述网络接口630，还用于接收终端设备发送的应用的标识。
处理器620，还用于确定网络接口630接收到的所述应用的标识为发送所 述第一数据流的应用的标识，从而得到第一数据流的应用识别结果。
本申请实施例还提供了一种网络安全设备，如附图6B所示。该网络安全设备包括接收模块660、处理模块670、和发送模块680。需要说明的是这些模块为功能相对独立的逻辑模块，既可以是终端设备中的CPU读取存储中的软件代码并运行后生成的，也可以是由硬件组件来实现的。具体地：
接收模块660，用于接收第一数据流。
处理模块670，用于获取第一数据流的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组。
发送模块680，用于根据第一数据流的标识中的源地址或目的地址，向终端设备发送所述数据流的标识，所述终端设备的地址为所述第一数据流的标识中的源地址或目的地址。
可选地，处理模块670在采用现有应用识别技术无法识别出发送所述第一数据流的应用时，指示发送模块680向终端设备发送所述数据流的标识。
接收模块660，还用于收终端设备发送的应用的标识。
处理模块670，还用于确定网络接口660接收到的应用的标识为发送所述第一数据流的应用的标识，从而得到第一数据流的应用识别结果。
附图6A和6B所提供的网络安全设备可以作为附图1A或1B中的网络安全设备120。附图6A和6B所提供的网络安全设备与终端设备的交互过程请参照附图2及相关描述。
本申请实施例提供的网络安全设备在采用现有应用识别技术无法识别出发送数据流的应用时，向终端设备发送数据流的标识，接收终端设备发送的应用的标识，将接收到的所述应用的标识作为发送数据流的应用的标识，从而得到数据流的应用识别结果。通过网络安全设备和终端设备之间的交互，能够识别出更多的应用，从而降低了未识别流量在总流量中所占的比例，改善了网络流量的识别效果。
实施例二
附图7是本申请实施例提供的网络流量中的应用信息的识别系统的示意图。该系统中包括终端设备710、网络安全设备720和数据处理设备730。与附图1A和附图1B所示的识别系统相比，增加了一个数据处理设备730。数据处理设备730可以作为一个逻辑模块，集成于网络安全设备720或终端设 备710中，也可以作为一个独立的实体设备单独部署，只要保证能够分别与终端设备710和网络安全设备720进行通信即可。
现有技术要实现发现网络安全设备错误识别结果这一目的，只能使用仅包含待识别应用产生的、没有混杂其他应用的流量，对网络安全设备对该待识别应用的识别效果进行测试。而且无法估算混杂流量情况下的识别效果。
本实施例中增加数据处理设备730的主要目的在于通过对来自于终端设备710的信息和来自于网络安全设备720的信息进行综合分析，从而识别出网络安全设备720的错误识别结果。
首先需要说明的是，终端设备710与实施例一中的终端设备110有一定类似之处，网络安全设备720与实施一中的网络安全设备120也有一定类似之处，为了简明起见，在本实施例中着重对与实施例一中的不同之处进行详述，对于可以参照实施例一中类似的内容简单描述。
在附图7所示的识别系统中，网络安全设备720，用于接收第一数据流，确定发送第一数据流的应用的标识后，生成第一识别记录，所述第一识别记录包含所述第一数据流的标识与所述应用的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，向所述处理设备发送所述第一识别记录。其中，网络安全设备720可以采用基于特征的识别技术、启发式识别技术，或关联识别技术等现有应用识别技术对第一数据流进行识别，从而确定发送第一数据流的应用的标识。
所述终端设备710，用于获取本终端设备上的进程的标识以及所述进程创建的第二数据流的标识，生成第二识别记录，所述第二识别记录包含第二数据流的标识与进程的标识；以及获取对应表，所述对应表中的每条记录保存一个应用的标识与所述应用创建的进程的标识；向所述数据处理设备发送所述第二识别记录和对应表。容易理解，本实施例中的对应表即为实施例一中的第二对应表。在本实施例中为了保持与实施例一中各对应表命名的一致性，仍保留第二对应表的名称。
本实施例中的第二识别记录可以是实施例一中第一对应表中的一条记录，终端设备710获得第一对应表的过程请参见实施例一中的相关内容，终端设备710可以在获得第一对应表后，将第一对应表作为一个文件整体发送给数据处理设备730，也可以选择性地将第一对应表中的一条记录或多条记录 发送给数据处理设备730，在这里不进行限制。
数据处理设备730，用于接收来自于网络安全设备720的第一识别记录；接收来自于终端设备710的第二识别记录和对应表。如果第一识别记录中包含的第一数据流的标识与第二识别记录中包含的第二数据流的标识相同，在对应表中查询是否存在第一关联记录，第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识。如果不存在第一关联记录，则确定第一识别记录为错误识别记录。
可选地，在数据处理设备730确定第一识别记录为错误识别记录之后，还可以向终端设备710发送所述第二识别记录中包含的进程的标识，以便终端设备710为该进程的标识设置抓包标记，后续抓取该进程的标识所代表的进程发送的多个完整的数据流，进行人工分析。具体抓包过程请参考实施例一附图4及相关描述，在这里不再重复。
可选地，为了减少后续网络安全设备因为同一关联识别规则导致重复地向数据处理设备发送相同的错误识别记录，造成占用数据处理设备与网络安全设备之间的传输资源，可以网络安全设备可以在发送给数据处理设备的第一识别记录中增加识别方式的标识，数据处理设备当确认错误识别结果是由于关联识别规则导致的之后，通知网络安全设备删除相应的关联识别规则，从而避免后续出现相同原因造成的错误识别结果。具体地：
来自于网络安全设备720的第一识别记录还包含识别方式的标识，所述识别方式包括关联识别、特征识别和启发式识别。
关联识别方式是指网络安全设备720根据报文的IP地址、端口号与应用的对应关系，对发送报文的应用进行识别。例如，网络安全设备720通过对FTP控制通道中的控制报文进行解析，可以得到即将建立的数据通道所使用的IP地址和端口号，在关联表中添加获得的IP地址和端口号与FTP客户端名称，例如FileZilla的对应关系。接收到后续报文后，在关联表中查询是否存在该报文携带的IP地址和端口号，如果关联表中存在该报文携带的IP地址和端口号，则将关联表中该报文携带的IP地址和端口号对应的FileZilla作为发送该报文的应用。
在第一识别记录还包含识别方式的标识的情况下，在数据处理设备730确定第一识别记录为错误设备记录之后，还可以如果所述第一识别纪录中识 别方式的标识为关联识别方式的标识，则向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则，所述第一关联识别规则包含所述第一识别记录包含的第一数据流的标识。
在本申请实施例提供的网络流量中的应用信息的识别系统中，数据处理设备接收来自于网络安全设备的第一识别记录和来自于终端设备的第二识别记录和对应表，如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识，如果不存在所述第一关联记录，确定所述第一识别记录为错误识别记录。数据处理设备通过比较终端设备和网络安全设备的识别记录，能够识别出现有技术难以发现的网络安全设备的错误识别记录，改善了网络流量的识别效果。
下面将参照附图8A和附图8B结合一个具体实例，对本实施例提供的网络流量中的应用信息的识别方法进行描述。本实施例中的终端设备可以是附图7中的终端设备710，网络安全设备可以是附图7中的网络安全设备720，数据处理设备可以是附图7中的数据处理设备730。
附图8A以详细时序交互图的方式对本实施例提供的识别方法进行描述。
步骤801，网络安全设备接收到第一数据流中的报文P10后，基于关联识别技术对第一数据流进行应用识别，得到识别结果，即第一识别记录“tcp 192.168.1.211:3020-201.6.8.30:6682暴风影音A”。
第一识别记录可以是网络安全设备接收到第一数据流后，采用基于特征的识别技术、启发式等识别技术、或关联识别技术得到的规则对第一数据流进行识别后得到的。网络安全设备可以依次采用各种现有识别技术对报文进行识别，直到能够得到识别结果，例如网络安全设备先采用基于特征的规则对报文进行识别，当无法得到识别结果时，即报文中的特征与任何一个基于特征的规则中的规则均不一致时，采用启发式规则对报文进行识别，当无法得到匹配结果时，再次尝试利用关联识别规则对报文进行识别。当然，如果网络安全设备先采用基于特征的规则对报文进行识别，就能够得到匹配结果，则生成识别记录，处理结束。网络安全设备选择识别技术时的顺序没有特别限定。
在本实施例中，第一识别记录是网络安全设备根据第一关联识别规则识别出的，第一关联识别规则为“tcp 201.6.8.30:6682暴风影音”。网络安全设备在接收到报文P10后，从报文中获得目的三元组和源三元组，将目的三元组或源三元组与第一关联识别规则匹配，如果目的三元组或源三元组中的任意一个与第一关联识别规则中的三元组一致，则确定报文P10所属的第一数据流是终端设备中的暴风影音发送的。
本实施例中，关联识别方式的标识是A，基于特征的识别方式的标识是B、启发式识别技术的标识是C。
步骤802，网络安全设备将第一识别记录“tcp 192.168.1.211:3020-201.6.8.30:6682暴风影音A”携带在报文P11中，向数据处理设备发送P11。
步骤803，数据处理设备接收到报文P11后对报文P11进行解析，得到报文P11携带的第一识别记录“tcp 192.168.1.211:3020-201.6.8.30:6682暴风影音A”。
步骤804，数据处理设备接收来自于终端设备的第二识别记录“tcp 192.168.1.211:3020-201.6.8.30:6682SogouCloud.exe”和第二对应表。
需要说明的是，第二识别记录和第二对应表可以是分别发送的。例如，第二对应表是在终端设备中的Agent初始化完成之后发送的，或者终端设备中的Agent检测到实施例一中表2所示的第二对应表发生变化后发送的。
如果终端设备被配置为定期将维护的实施例一中表1所示的第一对应表作为一个整体文件包发送给数据处理设备，第二识别记录可以是终端设备发送的第一对应表中的一条记录。
数据处理设备也可以在接收到来自于网络安全设备的第一识别记录后，提取其中的五元组，将五元组发送给终端设备，指示终端设备将包含该五元组的第一对应表中的记录返回给数据处理设备。
终端设备向数据处理设备发送第二识别记录的具体方式在这里不进行限定。
步骤805，数据处理设备确定所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同。
具体地，如果终端设备被配置为定期将维护的实施例一中表1所示的第 一对应表作为一个整体文件包发送给数据处理设备，则数据处理设备根据第一识别记录中的五元组，从整体文件包中查询到一个包含五元组tcp 192.168.1.211:3020-201.6.8.30:6682的记录作为第二识别记录。
如果终端设备单独发送第二识别记录，则数据处理设备接收到网络安全设备发送的第一识别记录后，与此前预定时间段内接收到的来自于终端设备的至少一个识别记录进行比较，确定存在一个识别记录，其携带的数据流的标识与第一识别记录中包含的数据流的标识相同，则将该识别记录作为第二识别记录。
步骤806，数据处理设备在第二对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识。
如果存在，说明第一识别记录是正确的识别记录，继续处理网络安全设备发送的下一条识别记录；否则说明第一识别记录是错误的识别记录。
具体地，数据处理设备确定第二对应表中是否存在一条关联记录，该关联记录中保存有第一识别记录中的应用标识“暴风影音”与第二识别记录中的进程标识“SogouCloud.exe”的关联记录，在本实施例中，表2所示的第二关联表中并不存在同时包含“暴风影音”和“SogouCloud.exe”的记录。
如果数据处理设备确定出一条来自于网络安全设备的识别记录是错误的识别记录，可以执行步骤807，810或步骤808～步骤809组成的子流程中的至少一个。换句话说，步骤807，810或步骤808～步骤809组成的子流程均是可选地，而且在执行顺序上也没有特别限定。
步骤807，数据处理设备向终端设备发送携带有所述第二识别记录中包含的进程的标识SogouCloud.exe的报文P12，以便终端设备为该进程的标识设置抓包标记，后续抓取该进程的标识所代表的进程发送的多个完整的数据流，进行人工分析。具体抓包过程请参照附图4中步骤49至步骤422的描述。
步骤808，数据处理设备判断第一识别记录中携带的识别方式的标识是否为关联识别方式的标识，如果第一识别记录中携带的识别方式的标识是关联识别方式的标识，则执行步骤809，否则结束本次处理。
步骤809，数据处理设备向所述网络安全设备发送通知消息P13，所述通知消息用于通知所述网络安全设备删除第一关联识别规则“tcp  201.6.8.30:6682暴风影音”。
具体地，通知消息中可以携带第一识别记录中的数据流的标识和一个删除指令，例如“201.6.8.30:6682D”，其中D为删除指令。
步骤810，数据处理设备还统计错误识别记录的次数，在每次确定出一次错误识别记录后，对当前错误识别记录的次数加1。
可选地，数据处理设备在步骤806中确定是正确的识别记录的情况下，也可以对当前正确识别记录的次数加1。这样根据错误识别记录的次数和正确识别记录的次数，就可以计算出预定时间段内的误报率。
数据处理设备还可以通过输出接口，例如显示器，或打印机，定期将错误识别记录和误报率输出，以供管理人员分析。
步骤811，网络安全设备接收到通知消息P13后，删除第一关联识别规则“tcp 201.6.8.30:6682暴风影音”或第二关联规则“tcp 192.168.1.211:3020暴风影音”。
可选地，在步骤806，数据处理设备确定第一识别记录是错误的识别记录之后，还可以为网络安全设备生成正确的关联识别规则。以便于提高网络安全设备后续识别的效果，具体地，
812，数据处理设备在所述对应表中查询是否存在第二关联记录，所述第二关联记录中保存有第二识别记录中包含的进程的标识。如果存在第二关联记录，执行步骤813，否则处理结束。
步骤813，数据处理设备生成第三关联规则或第四关联规则，所述第三关联规则包括所述第二关联记录中的应用的标识和由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第四关联规则包括第二关联记录中的应用的标识和由所述第一数据流的源地址、源端口和协议号组成的三元组。
在本实例中，表2所示的第二对应表中的第1行记录包括“SogouCloud.exe”，第1行记录中包含的应用的标识是“搜狗输入法”。
生成的第三关联规则是“tcp 201.6.8.30:6682搜狗输入法”，第四关联规则是“tcp 192.168.1.211:3020搜狗输入法”。
步骤814，数据处理设备向所述网络安全设备发送所述第三关联识别规则或第四关联识别规则。
附图8B描述的是数据处理设备执行的识别方法的另一流程图。可以理解在附图8A的基础上，附图8B中的步骤821～步骤829是数据处理设备针对网络安全设备和终端设备发送的另外两条识别记录进行的描述。
步骤821，网络安全设备接收到第三数据流中的报文P20后，基于现有基于特征的识别技术对第三数据流进行应用识别，无法得到识别结果，则生成第三识别记录“tcp 192.168.1.211:6120-168.3.56.120:1138Unidentified”，其中Unidentified是未识别标识，用于表征所述网络安全设备未识别出发送所述第三数据流的应用。
步骤822，网络安全设备将第三识别记录“tcp 192.168.1.211:6120-168.3.56.120:1138Unidentified”携带在报文P21中，向数据处理设备发送P21。
步骤823，数据处理设备接收到报文P21，从报文P21中获取携带的第三识别记录“tcp 192.168.1.211:6120-168.3.56.120:1138Unidentified”。
步骤824，数据处理设备接收来自于终端设备的第四识别记录“tcp 192.168.1.211:6120-168.3.56.120:1138kxescore.exe”。
这里假设如表2所示的第二对应表已保存在数据处理设备中。
步骤825，数据处理设备确定所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同。
步骤826，数据处理设备在第二对应表中查询是否存在第三关联记录，所述第三关联记录中保存有第四识别记录中包含的进程的标识。
如果存在第二关联记录，可以择一选择执行步骤827～步骤828组成的子流程，或者步骤829～步骤830组成的子流程。
在本实施例中，表2中的第3条记录包含“kxescore.exe”。
步骤827，数据处理设备生成第五关联识别规则或第六关联识别规则，所述第五关联识别规则包含所述第六关联记录中包含的应用的标识和由所述第三数据流的目的地址、目的端口和协议号组成的三元组，所述第五关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的源地址、源端口和协议号组成的三元组。
在本实施例中，第五关联识别规则为“tcp 168.3.56.120:1138华为安全卫士”，第六关联识别规则为“tcp 192.168.1.211:6120华为安全卫士”。
步骤828，数据处理设备向网络安全设备发送第五关联识别规则或第六关联识别规则。
步骤829，数据处理设备将所述第三数据流的标识和所述第三关联记录中包含的应用的标识携带在报文P22中发送给所述网络安全设备。
步骤830，网络安全设备接收到报文P22后，根据报文P22生成第五关联识别规则或第六关联识别规则。
所述第五关联识别规则包含报文P22中携带的应用的标识和由报文P122中携带的第三数据流的目的地址、目的端口和协议号组成的三元组。第六关联识别规则包含报文P22携带的应用的标识和由所述第三数据流的源地址、源端口和协议号组成的三元组。
这里需要指出的是，如实施例一中附图2中步骤212，以及实施例二中附图8A步骤813，附图8B中步骤827～步骤828，或步骤829～步骤830所示的根据识别记录生成新的关联识别规则的方式，在具体实施时为了减少后续因为关联规则生成的误识别的几率，可以根据多条存在共性的识别记录生成关联识别规则，而不是得到一条识别记录就立即生成关联识别规则。
举例来说，数据处理设备在步骤826确定出一条正确的识别记录时，生成临时关联识别规则并存储，并为每条临时关联识别规则设置一个计数值，如表8所示。
表8
Figure PCTCN2016099891-appb-000010
当后续数据处理设备再次执行附图8B所示的流程，生成其他临时关联识别规则时，在表8中存储临时关联识别规则时，先查找表8中是否已存在相同的临时关联识别规则，若存在，则将该临时关联识别规则对应的计数值加1，如果不存在，则在表8中新添加一条记录，将计数值设置为1。
数据处理设备设置一个阈值，例如10，当表8中的一条记录的计数值超 过该阈值后，表明该临时关联识别规则具有普遍性，再将该临时关联识别规则作为可以用于网络安全设备对后续接收到的数据流进行应用识别的正式的关联识别规则。
在本申请实施例提供的网络流量中的应用信息的识别方法中，数据处理设备接收来自于网络安全设备的第一识别记录和来自于终端设备的第二识别记录和对应表，如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识的关联记录，如果不存在，确定所述第一识别记录为错误识别记录。通过上述过程，能够发现网络安全设备的错误识别记录，改善应用识别的效果。
本申请实施例还提供了一种数据处理设备，如附图9A所示，该数据处理设备包括存储器910、处理器920和网络接口930，所述存储器910、处理器920和网络接口930通过总线940相互通信。
存储器910包括但不限于是随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或者快闪存储器)、或便携式只读存储器(CD-ROM)。
处理器920可以是一个或多个中央处理器(Central Processing Unit，简称CPU)，在处理器920是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
网络接口930可以是有线接口，例如光纤分布式数据接口(Fiber Distributed Data Interface，简称FDDI)、千兆以太网(Gigabit Ethernet，简称GE)接口；网络接口930也可以是无线接口。
网络接口930，用于接收来自于网络安全设备的第一识别记录，所述第一识别记录包含第一数据流的标识和应用的标识。接收来自于终端设备的第二识别记录和对应表，所述第二识别记录包含第二数据流的标识和进程的标识，所述对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识。
所述处理器920读取所述存储器910中存储的程序代码，执行：
如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记 录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；如果不存在所述第一关联记录，确定所述第一识别记录为错误识别记录。
可选地，所述网络接口930还用于如果所述第一识别纪录中识别方式的标识为关联识别方式的标识，则在不存在所述第一关联记录时，向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则或第二关联识别规则，所述第一关联规则包括由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包括由所述第一数据流的源地址、源端口和协议号组成的三元组。
数据处理设备还可以与网络安全设备和终端设备交互，识别出现有技术无法识别出的流量，可选地，所述网络接口930还用于接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识。
所述处理器920，还用于确定所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识是否相同，如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第三关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
所述网络接口930，还用于如果所述处理器确定存在所述第三关联记录，将所述第三关联记录中包含的应用的标识和所述第三数据流的标识发送给所述网络安全设备。
本申请实施例还提供了一种数据处理设备，如附图9B所示。该终端设备包括接收模块970、处理模块980。需要说明的是这些模块为功能相对独立的逻辑模块，既可以是终端设备中的CPU读取存储中的软件代码并运行后生成的，也可以是由硬件组件来实现的。
具体地：
接收模块970，用于接收来自于网络安全设备的第一识别记录，所述第一识别记录包含第一数据流的标识和应用的标识。接收来自于终端设备的第二 识别记录和对应表，所述第二识别记录包含第二数据流的标识和进程的标识，所述对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识。
处理模块980，用于如果接收模块970接收的第一识别记录中包含的第一数据流的标识与第二识别记录中包含的第二数据流的标识相同，在对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；如果不存在第一关联记录，确定第一识别记录为错误识别记录。
可选地，附图9B所示的数据处理设备还包括发送模块990，用于如果所述第一识别纪录中识别方式的标识为关联识别方式的标识，则在不存在所述第一关联记录时，向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则或第二关联识别规则，所述第一关联规则包括由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包括由所述第一数据流的源地址、源端口和协议号组成的三元组。
数据处理设备还可以与网络安全设备和终端设备交互，识别出现有技术无法识别出的流量，可选地，接收模块970还用于接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识。
所述处理模块980，还用于确定所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识是否相同，如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第三关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识。
所述发送模块990，还用于如果处理模块980确定存在所述第三关联记录，将所述第三关联记录中包含的应用的标识和所述第三数据流的标识发送给所述网络安全设备。
附图9A和9B所提供的数据处理设备可以作为附图7中的数据处理设备 730。
数据处理设备的其他附加功能，以及与网络安全设备和终端设备的详细交互过程请参照附图8A、8B以及相关描述，在这里不再重复。
本申请实施例提供的数据处理设备接收来自于网络安全设备的第一识别记录和来自于终端设备的第二识别记录和对应表，如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识的关联记录，如果不存在，确定所述第一识别记录为错误识别记录。通过上述过程，能够发现网络安全设备的错误识别记录，改善应用识别的效果。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (26)

  1. 一种网络流量中的应用信息的识别方法，所述方法由终端设备执行，其特征在于，所述终端设备中的第一对应表以记录的方式保存有所述终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表以记录的方式保存有应用的标识和所述应用创建的进程的标识的第二对应关系，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，
    所述方法包括：
    接收网络安全设备发送的第一数据流的标识；
    在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；
    在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；
    向所述网络安全设备发送所述应用的标识。
  2. 根据权利要求1所述的方法，其特征在于，所述终端设备通过以下步骤获得所述第一对应表：
    所述终端设备通过操作系统提供的接口，获得所述终端设备中运行的至少一个进程的标识；
    针对获得的每个进程的标识，所述终端设备获得该进程创建的数据流的标识，生成一个包含所述进程的标识和所述数据流的标识的记录；并将所述记录保存在所述第一对应表中。
  3. 根据权利要求1或2所述的方法，其特征在于，所述终端设备通过以下步骤获得所述第一对应表：
    所述终端设备通过钩子函数获得所述操作系统创建进程的事件；
    从所述创建进程的事件中获得新创建的进程的标识；
    获得该新创建进程创建的数据流的标识，生成一个包含所述新创建进程 的标识和所述新创建进程创建的所述数据流的标识的记录；并将所述记录保存在所述第一对应表中；
    所述终端设备获取第一对应表，还包括：
    所述终端设备通过钩子函数获得所述操作系统退出进程的事件；
    从所述退出进程的事件中获得退出进程的标识，从所述第一对应表中删除包含所述退出进程的标识的记录。
  4. 根据权利要求1至3所述的方法，其特征在于，所述第一对应表中的记录还包含数据流的最后活动时间；所述方法还包括：
    所述终端设备确定所述第一对应表中的过期记录，所述过期记录是指包括的数据流的最后活动时间和当前时间之间的时间间隔超过预定时间间隔的记录；
    删除所述过期记录。
  5. 根据权利要求4所述的方法，其特征在于，所述终端设备获取所述第一对应表之后，还包括：
    所述终端设备通过钩子函数获得所述终端设备传输的报文；
    从获得的报文中获得报文所属数据流的标识；
    将所述第一对应表中包含所述报文所属数据流的标识的记录中数据流的最后活动时间更新为当前时间。
  6. 根据权利要求1至3任一所述的方法，其特征在于，所述终端设备获取所述第一对应表之后，还包括：
    所述终端设备通过钩子函数获得所述终端设备传输的报文；
    从获得的报文中获得报文状态标识和报文所属数据流的标识；
    如果所述报文状态标识为FIN，则删除所述第一对应表中包含所述报文所属数据流的标识的记录。
  7. 根据权利要求1至6中任一所述的方法，其特征在于，所述获取所述第一记录中的进程的标识之后，还包括：
    为所述进程的标识设置报文采集标识，所述报文采集标识用于指示所述 终端设备在通过操作系统的接口捕获所述进程传输的报文后，获得并存储所述进程后续传输的完整数据流。
  8. 一种终端设备，其特征在于，所述终端设备包括存储器、处理器和网络接口，所述存储器、处理器和网络接口通过总线相互通信；
    所述存储器用于存储程序代码、第一对应表和第二对应表，所述第一对应表以记录的方式保存有所述终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表以记录的方式保存有应用的标识和所述应用创建的进程的标识的第二对应关系，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；
    所述网络接口，用于接收网络安全设备发送的第一数据流的标识；
    所述处理器读取所述存储器中存储的程序代码，执行：
    在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；
    所述网络接口，还用于向所述网络安全设备发送所述处理器获取的应用的标识。
  9. 根据权利要求8所述的终端设备，其特征在于，
    所述处理器，还用于通过以下操作获得所述第一对应表：通过操作系统提供的接口，获得所述终端设备中运行的至少一个进程的标识；针对获得的每个进程的标识，所述终端设备获得该进程创建的数据流的标识，生成一个包含所述进程的标识和所述数据流的标识的记录；并将所述记录保存在所述第一对应表中。
  10. 根据权利要求8或9所述的终端设备，其特征在于，
    所述处理器，还用于通过以下操作获得所述第一对应表：
    通过钩子函数获得所述操作系统创建进程的事件；从所述创建进程的事件中获得新创建的进程的标识；获得该新创建进程创建的数据流的标识，生成一个包含所述新创建进程的标识和所述新创建进程创建的所述数据流的标 识的记录；并将所述记录保存在所述第一对应表中；以及
    通过钩子函数获得所述操作系统退出进程的事件；从所述退出进程的事件中获得退出进程的标识，从所述第一对应表中删除包含所述退出进程的标识的记录。
  11. 根据权利要求8至10中任一所述的终端设备，其特征在于，所述第一对应表中的记录还包含数据流的最后活动时间；
    所述处理器，还用于确定所述第一对应表中的过期记录，所述过期记录是指包括的数据流的最后活动时间和当前时间之间的时间间隔超过预定时间间隔的记录；删除所述过期记录。
  12. 根据权利要求11所述的终端设备，其特征在于，
    所述处理器，还用于获取所述第一对应表之后，所述终端设备通过钩子函数获得所述终端设备传输的报文；
    从获得的报文中获得报文所属数据流的标识；
    将所述第一对应表中包含所述报文所属数据流的标识的记录中数据流的最后活动时间更新为当前时间。
  13. 根据权利要求根据权利要求8至10中任一所述的终端设备，其特征在于，
    所述处理器，还用于获取所述第一对应表之后，所述终端设备通过钩子函数获得所述终端设备传输的报文；
    从获得的报文中获得报文状态标识和报文所属数据流的标识；
    如果所述报文状态标识为FIN，则删除所述第一对应表中包含所述报文所属数据流的标识的记录。
  14. 一种网络流量中的应用信息的识别系统，其特征在于，包括网络安全设备和终端设备，其中：
    所述网络安全设备，用于接收第一数据流，并获取所述第一数据流的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；根据所述第一数据流的标识中的源地址或目的地址，向所 述终端设备发送所述数据流的标识，所述终端设备的地址为所述第一数据流的标识中的源地址或目的地址；接收所述终端设备发送的应用的标识，确定接收到的所述应用的标识为发送所述第一数据流的应用的标识；
    所述终端设备，存储有第一对应表和第二对应表，所述第一对应表以记录的方式保存有所述终端中运行的进程的标识和所述进程建立的数据流的标识的对应关系，第二对应表以记录的方式保存有应用的标识和所述应用创建的进程的标识的第二对应关系，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，
    所述终端设备用于接收网络安全设备发送的第一数据流的标识；在所述第一对应表中，查找到保存有所述第一数据流的标识的第一记录，获取所述第一记录中的进程的标识；在所述第二对应表中，查找到保存有所述第一记录中的进程的标识的第二记录，从所述第二记录中获取应用的标识；向所述网络安全设备发送所述应用的标识。
  15. 根据权利要求14所述的识别系统，其特征在于，
    所述网络安全设备，还用于生成第一关联识别规则和第二关联识别规则，所述第一关联识别规则包含所述应用的标识和由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包含所述应用的标识和由所述第一数据流的源地址、源端口和协议号组成的三元组；
    接收第二数据流，获取所述第二数据流的目的三元组和源三元组中的至少一个，所述第二数据流的目的三元组为由所述第二数据流的目的地址、目的端口和协议号组成的三元组，所述第二数据流的源三元组为所述第二数据流的源地址、源端口和协议号组成的三元组；
    如果所述获取的三元组与所述第一关联识别规则和所述第二关联识别规则中任意一个关联识别规则包含的三元组一致，则确定发送所述第二数据流的应用的标识为所述任意一个关联识别规则包含的应用的标识。
  16. 一种网络流量中的应用信息的识别方法，其特征在于，包括：
    接收来自于网络安全设备的第一识别记录，所述第一识别记录包含第一 数据流的标识和应用的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；
    接收来自于终端设备的第二识别记录和对应表，所述第二识别记录包含第二数据流的标识和进程的标识，所述对应表中的每条记录保存一个应用的标识与所述应用创建的进程的标识；
    如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；
    如果不存在所述第一关联记录，确定所述第一识别记录为错误识别记录。
  17. 根据权利要求16所述的识别方法，其特征在于，如果不存在所述第一关联记录，所述方法还包括：
    向所述终端设备发送所述第二识别记录中包含的进程的标识，以使所述终端设备为所述进程的标识设置报文采集标识，所述报文采集标识于指示所述终端设备在通过操作系统的接口捕获所述进程传输的报文后，获得并存储所述进程后续传输的完整数据流。
  18. 根据权利要求16或17所述的识别方法，其特征在于，所述第一识别记录中还包含识别方式的标识，所述识别方式包括关联识别、特征识别和启发式识别；
    如果所述第一识别纪录中识别方式的标识为关联识别方式的标识，则在不存在所述第一关联记录时，所述方法还包括：
    向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则或第二关联识别规则，所述第一关联规则包括由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包括由所述第一数据流的源地址、源端口和协议号组成的三元组。
  19. 根据权利要求16所述的识别方法，其特征在于，如果不存在所述第 一关联记录，所述方法还包括：
    在所述对应表中查询是否存在第二关联记录，所述第二关联记录中保存有第二识别记录中包含的进程的标识，以及与之相应的应用的标识；
    如果存在所述第二关联记录，生成第三关联规则和第四关联规则，所述第三关联规则包括所述第二关联记录中的应用的标识和由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第四关联规则包括第二关联记录中的应用的标识和由所述第一数据流的源地址、源端口和协议号组成的三元组；
    向所述网络安全设备发送所述第三关联识别规则和第四关联识别规则。
  20. 根据权利要求16至19中任一所述的识别方法，其特征在于，还包括：
    接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；
    接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
    如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第三关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
    如果存在所述第三关联记录，则生成第五关联识别规则和第六关联识别规则，所述第五关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的目的地址、目的端口和协议号组成的三元组，所述第六关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的源地址、源端口和协议号组成的三元组；
    向所述网络安全设备发送所述第五关联识别规则和第六关联识别规则。
  21. 根据权利要求16至19中任一所述的识别方法，其特征在于，还包括：
    接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；
    接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
    如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第三关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
    如果存在所述第三关联记录，将所述第三关联记录中包含的应用的标识和所述第三数据流的标识发送给所述网络安全设备。
  22. 一种数据处理设备，其特征在于，所述处理设备包括存储器、处理器和网络接口，所述存储器、处理器和网络接口通过总线相互通信；
    所述存储器存储程序代码；
    所述网络接口，用于接收来自于网络安全设备的第一识别记录，所述第一识别记录包含第一数据流的标识和应用的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组；
    接收来自于终端设备的第二识别记录和对应表，所述第二识别记录包含第二数据流的标识和进程的标识，所述对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识；
    所述处理器读取所述存储器中存储的程序代码，执行：
    如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；
    如果不存在所述第一关联记录，确定所述第一识别记录为错误识别记录。
  23. 根据权利要求22所述的数据处理设备，其特征在于，
    所述第一识别纪录中还包含识别方式的标识，所述识别方式包括关联识 别、特征识别和启发式识别；
    所述网络接口，还用于如果所述第一识别纪录中识别方式的标识为关联识别方式的标识，则在不存在所述第一关联记录时，向所述网络安全设备发送通知消息，所述通知消息用于通知所述网络安全设备删除第一关联识别规则或第二关联识别规则，所述第一关联规则包括由所述第一数据流的目的地址、目的端口和协议号组成的三元组，所述第二关联识别规则包括由所述第一数据流的源地址、源端口和协议号组成的三元组。
  24. 根据权利要求22所述的数据处理设备，其特征在于，
    所述网络接口，还用于接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表征所述网络安全设备未识别出发送所述第三数据流的应用；
    接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
    所述处理器，还用于确定所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识是否相同，则在所述对应表中查询是否存在第二关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
    如果存在所述第三关联记录，则生成第五关联识别规则和第六关联识别规则，所述第五关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的目的地址、目的端口和协议号组成的三元组，所述第六关联识别规则包含所述第三关联记录中包含的应用的标识和由所述第三数据流的源地址、源端口和协议号组成的三元组；
    所述网络接口，还用于向所述网络安全设备发送所述第五关联识别规则和第六关联识别规则。
  25. 根据权利要求22所述的数据处理设备，其特征在于，
    所述网络接口，还用于接收来自于网络安全设备的第三识别记录，所述第三识别记录包含第三数据流的标识和未识别标识，所述未识别标识用于表 征所述网络安全设备未识别出发送所述第三数据流的应用；
    接收来自于终端设备的第四识别记录，所述第四识别记录包含第四数据流的标识和进程的标识；
    所述处理器，还用于确定所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识是否相同，如果所述第三识别记录中包含的第三数据流的标识与所述第四识别记录中包含的第四数据流的标识相同，则在所述对应表中查询是否存在第三关联记录，所述第三关联记录中保存有所述第四识别记录中包含的进程的标识；
    所述网络接口，还用于如果所述处理器确定存在所述第三关联记录，将所述第三关联记录中包含的应用的标识和所述第三数据流的标识发送给所述网络安全设备。
  26. 一种网络流量中的应用信息的识别系统，其特征在于，包括数据处理设备、终端设备和网络安全设备，其中：
    所述网络安全设备，用于接收第一数据流，确定发送所述第一数据流的应用的标识后，生成第一识别记录，所述第一识别记录包含所述第一数据流的标识和所述应用的标识，所述数据流的标识为由源地址、源端口、目的地址、目的端口和协议标识组成的五元组，向所述数据处理设备发送所述第一识别记录；
    所述终端设备，用于获取所述终端设备上的进程的标识以及所述进程创建的第二数据流的标识，生成第二识别记录，所述第二识别记录包含第二数据流的标识和进程的标识；以及获取所述对应表，所述对应表中的每条记录保存一个应用的标识和所述应用创建的进程的标识；向所述数据处理设备发送所述第二识别记录和对应表；
    所述数据处理设备，用于接收来自于所述网络安全设备的第一识别记录；接收来自于所述终端设备的第二识别记录和对应表；如果所述第一识别记录中包含的第一数据流的标识与所述第二识别记录中包含的第二数据流的标识相同，在所述对应表中查询是否存在第一关联记录，所述第一关联记录中保存有第一识别记录中应用的标识和第二识别记录中包含的进程的标识；如果不存在所述第一关联记录，则确定所述第一识别记录为错误识别记录。
PCT/CN2016/099891 2015-12-28 2016-09-23 网络流量中的应用信息的识别方法和装置 WO2017113900A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
EP16880693.3A EP3297213B1 (en) 2015-12-28 2016-09-23 Method and apparatus for identifying application information in network traffic
EP18200601.5A EP3496338B1 (en) 2015-12-28 2016-09-23 Method for identifying application information in network traffic, and apparatus
JP2018502243A JP6599538B2 (ja) 2015-12-28 2016-09-23 ネットワークトラフィックにおけるアプリケーション情報を識別するための方法および装置
ES16880693T ES2746351T3 (es) 2015-12-28 2016-09-23 Método y aparato para identificar información de aplicación en tráfico de red
US15/839,329 US11582188B2 (en) 2015-12-28 2017-12-12 Method for identifying application information in network traffic, and apparatus
US16/737,373 US11855967B2 (en) 2015-12-28 2020-01-08 Method for identifying application information in network traffic, and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201511000809.5 2015-12-28
CN201511000809.5A CN106921637B (zh) 2015-12-28 2015-12-28 网络流量中的应用信息的识别方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/839,329 Continuation US11582188B2 (en) 2015-12-28 2017-12-12 Method for identifying application information in network traffic, and apparatus

Publications (1)

Publication Number Publication Date
WO2017113900A1 true WO2017113900A1 (zh) 2017-07-06

Family

ID=59224582

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/099891 WO2017113900A1 (zh) 2015-12-28 2016-09-23 网络流量中的应用信息的识别方法和装置

Country Status (6)

Country Link
US (2) US11582188B2 (zh)
EP (2) EP3297213B1 (zh)
JP (1) JP6599538B2 (zh)
CN (1) CN106921637B (zh)
ES (2) ES2880369T3 (zh)
WO (1) WO2017113900A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111988320A (zh) * 2020-08-21 2020-11-24 深信服科技股份有限公司 一种应用识别方法、装置、系统、设备和介质
US11381544B2 (en) * 2020-05-12 2022-07-05 Huawei Technologies Co., Ltd. Service type determining method and related device

Families Citing this family (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10033693B2 (en) 2013-10-01 2018-07-24 Nicira, Inc. Distributed identity-based firewalls
US9891940B2 (en) 2014-12-29 2018-02-13 Nicira, Inc. Introspection method and apparatus for network access filtering
US10324746B2 (en) 2015-11-03 2019-06-18 Nicira, Inc. Extended context delivery for context-based authorization
CN106921637B (zh) 2015-12-28 2020-02-14 华为技术有限公司 网络流量中的应用信息的识别方法和装置
US10938837B2 (en) 2016-08-30 2021-03-02 Nicira, Inc. Isolated network stack to manage security for virtual machines
US10609160B2 (en) 2016-12-06 2020-03-31 Nicira, Inc. Performing context-rich attribute-based services on a host
US10812451B2 (en) * 2016-12-22 2020-10-20 Nicira, Inc. Performing appID based firewall services on a host
US10805332B2 (en) 2017-07-25 2020-10-13 Nicira, Inc. Context engine model
US10581960B2 (en) 2016-12-22 2020-03-03 Nicira, Inc. Performing context-rich attribute-based load balancing on a host
US10803173B2 (en) * 2016-12-22 2020-10-13 Nicira, Inc. Performing context-rich attribute-based process control services on a host
US11032246B2 (en) 2016-12-22 2021-06-08 Nicira, Inc. Context based firewall services for data message flows for multiple concurrent users on one machine
US10802858B2 (en) * 2016-12-22 2020-10-13 Nicira, Inc. Collecting and processing contextual attributes on a host
CN107483411B (zh) * 2017-07-25 2020-01-31 中国联合网络通信集团有限公司 业务识别方法及系统
US10778651B2 (en) 2017-11-15 2020-09-15 Nicira, Inc. Performing context-rich attribute-based encryption on a host
CN108282414B (zh) * 2017-12-29 2020-05-29 网宿科技股份有限公司 一种数据流的引导方法、服务器和系统
US10958622B2 (en) * 2018-01-10 2021-03-23 Cisco Technology, Inc. Hierarchical security group identifiers
US10862773B2 (en) 2018-01-26 2020-12-08 Nicira, Inc. Performing services on data messages associated with endpoint machines
US10802893B2 (en) 2018-01-26 2020-10-13 Nicira, Inc. Performing process control services on endpoint machines
CN108400909B (zh) * 2018-02-12 2020-10-02 腾讯科技（深圳）有限公司 一种流量统计方法、装置、终端设备和存储介质
US10635346B2 (en) * 2018-06-11 2020-04-28 Western Digital Technologies, Inc. Self-trimming of data stored in non-volatile memory using data storage controller
CN108900430B (zh) * 2018-06-15 2021-12-24 杭州迪普科技股份有限公司 一种网络流量阻断的方法及装置
CN109005227A (zh) * 2018-07-28 2018-12-14 安徽捷兴信息安全技术有限公司 一种手机网络包与手机应用的对应方法及装置
CN109194756A (zh) * 2018-09-12 2019-01-11 网宿科技股份有限公司 应用程序特征信息提取方法及装置
US11552874B1 (en) * 2019-01-18 2023-01-10 Keysight Technologies, Inc. Methods, systems and computer readable media for proactive network testing
CN110096363B (zh) * 2019-04-29 2021-11-30 亚信科技（成都）有限公司 一种网络事件与进程的关联方法及装置
US11023896B2 (en) * 2019-06-20 2021-06-01 Coupang, Corp. Systems and methods for real-time processing of data streams
CN110347047B (zh) * 2019-06-21 2022-09-09 深圳绿米联创科技有限公司 设备删除的方法、装置、系统、电子设备以及存储介质
CN112583767A (zh) * 2019-09-29 2021-03-30 北京安云世纪科技有限公司 流量统计方法及装置
CN110891025B (zh) * 2019-10-31 2022-04-05 上海众链科技有限公司 获取应用程序对端目的地址的系统和方法
US11539718B2 (en) 2020-01-10 2022-12-27 Vmware, Inc. Efficiently performing intrusion detection
CN111147523A (zh) * 2020-02-09 2020-05-12 福建奇点时空数字科技有限公司 一种基于服务伪装探测技术的综合性应用协议识别方法
CN115349269A (zh) * 2020-03-31 2022-11-15 瑞典爱立信有限公司 用于订阅网络功能的变化通知的方法及装置
CN111786964B (zh) * 2020-06-12 2022-09-30 深信服科技股份有限公司 网络安全检测方法、终端及网络安全设备
US11108728B1 (en) 2020-07-24 2021-08-31 Vmware, Inc. Fast distribution of port identifiers for rule processing
US11336541B2 (en) * 2020-09-14 2022-05-17 Charter Communications Operating, Llc Real-time enrichment for deep packet inspection
WO2022083509A1 (zh) * 2020-10-19 2022-04-28 华为技术有限公司 一种数据流识别方法以及装置
CN113746692A (zh) * 2021-07-21 2021-12-03 网宿科技股份有限公司 网络流量统计的方法、电子设备及存储介质
CN113923013A (zh) * 2021-09-30 2022-01-11 深信服科技股份有限公司 一种应用识别管理方法及系统
CN115277502B (zh) * 2022-06-17 2023-10-10 广州根链国际网络研究院有限公司 一种针对APP应用的自动化测量IPv6流量的方法

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101873640A (zh) * 2010-05-27 2010-10-27 华为终端有限公司 流量处理方法、装置和移动终端
CN102026151A (zh) * 2009-09-16 2011-04-20 中国移动通信集团公司 一种基于进程监测的服务推送方法、装置和系统
CN102195816A (zh) * 2011-05-24 2011-09-21 北京网康科技有限公司 一种未识别流量信息反馈的方法及其设备
CN102201982A (zh) * 2011-04-29 2011-09-28 北京网康科技有限公司 一种应用识别方法及其设备
CN103095604A (zh) * 2013-01-04 2013-05-08 海信集团有限公司 识别家庭网络具体应用的系统及方法
US8520538B2 (en) * 2010-02-25 2013-08-27 Clearwire Ip Holdings Llc Method and system for managing traffic in a wireless communication system
CN103746768A (zh) * 2013-10-08 2014-04-23 北京神州绿盟信息安全科技股份有限公司 一种数据包的识别方法及设备
CN105812188A (zh) * 2016-04-25 2016-07-27 北京网康科技有限公司 流量识别方法及装置

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9240945B2 (en) * 2008-03-19 2016-01-19 Citrix Systems, Inc. Access, priority and bandwidth management based on application identity
US8606911B2 (en) * 2009-03-02 2013-12-10 Headwater Partners I Llc Flow tagging for service policy implementation
CN102098272B (zh) * 2009-12-10 2014-02-19 华为技术有限公司 一种协议识别的方法、装置和系统
US8190564B2 (en) * 2010-02-25 2012-05-29 Ebay, Inc. Temporary session data storage
US8612612B1 (en) * 2011-09-28 2013-12-17 Juniper Networks, Inc. Dynamic policy control for application flow processing in a network device
CN103384213B (zh) * 2011-12-31 2017-07-21 华为数字技术（成都）有限公司 一种检测规则优化配置方法及设备
US20130238782A1 (en) * 2012-03-09 2013-09-12 Alcatel-Lucent Usa Inc. Method and apparatus for identifying an application associated with an ip flow using dns data
US9258313B1 (en) * 2012-09-28 2016-02-09 Juniper Networks, Inc. Distributed application awareness
US9185015B2 (en) * 2013-02-19 2015-11-10 Broadcom Corporation Application aware elephant flow identification
US10015102B2 (en) * 2013-04-11 2018-07-03 Qualcomm Incorporated Application traffic pairing
JP6081386B2 (ja) * 2014-01-30 2017-02-15 日本電信電話株式会社 情報共有装置、情報共有方法、および、情報共有プログラム
US9680739B2 (en) 2014-01-31 2017-06-13 The University Of Tokyo Information transmission system, information communication apparatus, and information transmission apparatus
CN103916294B (zh) 2014-04-29 2018-05-04 华为技术有限公司 协议类型的识别方法和装置
US10033747B1 (en) * 2015-09-29 2018-07-24 Fireeye, Inc. System and method for detecting interpreter-based exploit attacks
CN106921637B (zh) 2015-12-28 2020-02-14 华为技术有限公司 网络流量中的应用信息的识别方法和装置

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026151A (zh) * 2009-09-16 2011-04-20 中国移动通信集团公司 一种基于进程监测的服务推送方法、装置和系统
US8520538B2 (en) * 2010-02-25 2013-08-27 Clearwire Ip Holdings Llc Method and system for managing traffic in a wireless communication system
CN101873640A (zh) * 2010-05-27 2010-10-27 华为终端有限公司 流量处理方法、装置和移动终端
CN102201982A (zh) * 2011-04-29 2011-09-28 北京网康科技有限公司 一种应用识别方法及其设备
CN102195816A (zh) * 2011-05-24 2011-09-21 北京网康科技有限公司 一种未识别流量信息反馈的方法及其设备
CN103095604A (zh) * 2013-01-04 2013-05-08 海信集团有限公司 识别家庭网络具体应用的系统及方法
CN103746768A (zh) * 2013-10-08 2014-04-23 北京神州绿盟信息安全科技股份有限公司 一种数据包的识别方法及设备
CN105812188A (zh) * 2016-04-25 2016-07-27 北京网康科技有限公司 流量识别方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3297213A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11381544B2 (en) * 2020-05-12 2022-07-05 Huawei Technologies Co., Ltd. Service type determining method and related device
CN111988320A (zh) * 2020-08-21 2020-11-24 深信服科技股份有限公司 一种应用识别方法、装置、系统、设备和介质
CN111988320B (zh) * 2020-08-21 2023-05-12 深信服科技股份有限公司 一种应用识别方法、装置、系统、设备和介质

Also Published As

Publication number Publication date
US20180103011A1 (en) 2018-04-12
US20200145380A1 (en) 2020-05-07
US11582188B2 (en) 2023-02-14
CN106921637B (zh) 2020-02-14
ES2746351T3 (es) 2020-03-05
EP3297213B1 (en) 2019-07-17
EP3496338B1 (en) 2021-05-26
JP6599538B2 (ja) 2019-10-30
US11855967B2 (en) 2023-12-26
EP3297213A1 (en) 2018-03-21
EP3496338A1 (en) 2019-06-12
JP2018531527A (ja) 2018-10-25
CN106921637A (zh) 2017-07-04
ES2880369T3 (es) 2021-11-24
EP3297213A4 (en) 2018-05-30

Similar Documents

Publication Publication Date Title
WO2017113900A1 (zh) 网络流量中的应用信息的识别方法和装置
JP2018531527A6 (ja) ネットワークトラフィックにおけるアプリケーション情報を識別するための方法および装置
EP3229407B1 (en) Application signature generation and distribution
US9787581B2 (en) Secure data flow open information analytics
CN102739457B (zh) 一种基于dpi和svm技术的网络流量识别方法
US20140219101A1 (en) Feature Extraction Apparatus, and Network Traffic Identification Method, Apparatus, and System
US9660833B2 (en) Application identification in records of network flows
US8694630B1 (en) Self-learning classifier for internet traffic
CN102724317A (zh) 一种网络数据流量分类方法和装置
US10264004B2 (en) System and method for connection fingerprint generation and stepping-stone traceback based on netflow
US10116538B2 (en) Attributing network address translation device processed traffic to individual hosts
CN105635073B (zh) 访问控制方法、装置和网络接入设备
WO2020228527A1 (zh) 数据流的分类方法和报文转发设备
EP3096492B1 (en) Page push method and system
CN105939304B (zh) 一种隧道报文解析方法及装置
KR102397346B1 (ko) 데이터 트래픽을 모니터링하기 위한 방법, 장치 및 시스템
US10419351B1 (en) System and method for extracting signatures from controlled execution of applications and application codes retrieved from an application source
EP2605480B1 (en) Apparatus and method for HTTP analysis
CN112311717B (zh) 网络数据恢复方法、装置、存储介质和计算机设备
Tung et al. VoIP packets filtering for mobile instant messaging using N-gram models
CN115941525A (zh) 基于上网行为分析技术的用户跟踪方法及系统
JP2018207436A (ja) トラヒック制御装置、方法、およびプログラム
Yi et al. Research of P2P Traffic Real-Time Monitoring Technology Based on DPI

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16880693

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2016880693

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2018502243

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE