WO2019223553A1 - 一种网络流量识别方法及相关设备 - Google Patents

一种网络流量识别方法及相关设备 Download PDF

Info

Publication number
WO2019223553A1
WO2019223553A1 PCT/CN2019/086375 CN2019086375W WO2019223553A1 WO 2019223553 A1 WO2019223553 A1 WO 2019223553A1 CN 2019086375 W CN2019086375 W CN 2019086375W WO 2019223553 A1 WO2019223553 A1 WO 2019223553A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
slice
data packet
server
characteristic parameter
Prior art date
Application number
PCT/CN2019/086375
Other languages
English (en)
French (fr)
Inventor
邵熠阳
何斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19807078.1A priority Critical patent/EP3780523B1/en
Priority to EP23217842.6A priority patent/EP4362422A3/en
Publication of WO2019223553A1 publication Critical patent/WO2019223553A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2483—Traffic characterised by specific attributes, e.g. priority or QoS involving identification of individual flows
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
    • H04N21/83—Generation or processing of protective or descriptive data associated with content; Content structuring
    • H04N21/845—Structuring of content, e.g. decomposing content into time segments
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
    • H04N21/83—Generation or processing of protective or descriptive data associated with content; Content structuring
    • H04N21/845—Structuring of content, e.g. decomposing content into time segments
    • H04N21/8456—Structuring of content, e.g. decomposing content into time segments by decomposing the content in the time domain, e.g. in time segments

Definitions

  • the present invention relates to the technical field of network traffic identification, and in particular, to a network traffic identification method and related equipment.
  • IPVOD and InternetVideo Internet traffic generated by online video
  • QoS quality of service
  • QoE quality of experience
  • Network traffic classification as one of the basic technologies to enhance the controllability of the network, can help researchers and operation and maintenance personnel understand the traffic and application distribution on the network. It allows network operators to customize the priority of traffic transmission based on information such as application types and is effective. Manage your network and stop cybercrime.
  • operators mainly rely on network traffic classification technology and related products for traffic identification and management.
  • the principle of network traffic classification technology is to analyze the network traffic in an in-depth manner, and present the upper layer of online traffic to identify the specific attributes of different levels of network traffic, usually including application information, service information, and content characteristics.
  • Embodiments of the present invention provide a network traffic identification method and related equipment, so as to improve network traffic identification efficiency and accuracy.
  • an embodiment of the present invention provides a method for identifying network traffic, which may include:
  • the first network session is a data packet set having the same triplet information in a first period of time, the triplet information includes a source address of a client, a destination address of a server, And a transport layer protocol between the client and the server, the transmission mode includes a behavior pattern requested by the client from the server and / or a behavior pattern of the server responding to the client; Determining a characteristic parameter matching the transmission mode; and determining a category to which the first network session belongs according to the characteristic parameter of the first network session and a preset characteristic parameter range.
  • an interaction behavior mode between a client and a server corresponding to a network session is determined, and then a characteristic parameter corresponding to the network session under the determined interaction behavior mode is determined. Finally, according to a comparison result between the characteristic parameter and a preset characteristic parameter range, the type of the network session is determined. Because different interaction behavior modes between the client and the server may have large differences in their corresponding characteristic parameters, the embodiment of the present invention first confirms the transmission mode of the network session, and then specifically determines the transmission mode corresponding to the transmission mode. The characteristic parameters finally accurately identify the type of network session, which improves the identification efficiency and accuracy of network traffic.
  • the method before determining the transmission mode corresponding to the first network session, the method further includes: determining a network session that includes a preset field in network traffic as the first network session.
  • the network session that satisfies the condition is selected as the first network session according to certain conditions from the network traffic before the first network session is determined, which can quickly exclude most network sessions that do not meet the conditions and effectively improve the identification. Identification efficiency for the specified type of network session.
  • the first time period includes a second time period
  • the transmission mode includes a first transmission mode
  • the first network session includes a first network stream
  • the first network stream is A data packet set having the same quintuple information in the second time period
  • the quintuple information includes a source address and a source port of a client, a destination address and a destination port of a server, and the client and the service A transport layer protocol between the peers
  • the first transmission mode includes: during the second time period, the client initiates requests to the server multiple times through the first network stream, and the server Responding to multiple requests from the client through the first network flow.
  • An embodiment of the present invention provides a classification of a transmission mode for a network session in a video traffic identification scenario. In this transmission mode, a video stream is carried by a single network stream, and a client initiates multiple requests to a server. On-demand scene.
  • the characteristic parameter includes a first characteristic parameter of each slice in a video traffic slice, and the first characteristic parameter includes: a size of a slice, an average rate of the slice, and a size of a network packet in the slice.
  • the preset feature parameter range includes a first video feature parameter range; the determining the first network session according to the feature parameter and the preset feature parameter range of the first network session.
  • the category to which it belongs includes: within the second time period, using the uplink data packet sent by the client to the server in the first network flow as a split point, Slicing the downlink data packet sent by the server to the client, the slice does not include the uplink data packet; determining whether the first characteristic parameter of each slice conforms to the first video characteristic parameter range; if If the first characteristic parameters of each slice match, it is determined that the first network session is video traffic.
  • An embodiment of the present invention provides a method for determining a first network session as the first transmission mode, how to obtain a characteristic parameter matched by the first network session, and compare it with a preset video characteristic parameter range to finally determine the first Whether a network session is video traffic.
  • the characteristic parameter includes a first characteristic parameter of each slice in a video traffic slice, and the first characteristic parameter includes: a size of a slice, an average rate of the slice, and a size of a network packet in the slice.
  • the preset feature parameter range includes a first video feature parameter range; the determining the first network session according to the feature parameter and the preset feature parameter range of the first network session.
  • the category to which it belongs includes: periodically detecting, in the second time period, uplink data packets sent by the client to the server in the first network flow; if the uplink data packets meet the With a preset periodic characteristic, the uplink data packet is used as a dividing point to slice the downlink data packet sent by the server to the client in the first network flow, and the slice does not include the Uplink data packet; judging whether the first feature parameter of each slice meets the range of the first video feature parameter; if the first feature parameter of each slice meets Determining that the first network session traffic class for video traffic.
  • An embodiment of the present invention provides another method for determining a characteristic parameter matched by a first network session when determining that the first network session is the foregoing first transmission mode, and comparing with a preset video characteristic parameter range, and finally determining the Whether the first network session is video traffic.
  • the first time period includes a third time period
  • the transmission mode includes a second transmission mode
  • the first network session includes a plurality of second network streams
  • each The second network flow is a data packet set with the same quintuple information in the third time period, and the triplet information of the data packets in the data packet sets corresponding to different second network flows is the same
  • the second The transmission mode includes: during the third time period, the client initiates multiple requests to the server through the plurality of second network streams, and the server passes the plurality of second networks The streams respectively respond to requests corresponding to the clients.
  • An embodiment of the present invention provides another classification of a transmission mode for a network session in a video recognition scenario. In this transmission mode, a video stream is carried by multiple network streams. A client initiates multiple requests to a server through multiple network streams. It is suitable for identifying on-demand scenes of long videos with high real-time requirements.
  • the characteristic parameter includes a second characteristic parameter of each slice in the video traffic slice, and the second characteristic parameter includes at least one of a size of a slice, an average rate of the slice, and a numerical distribution of a size of a network packet in the slice;
  • the preset feature parameter range includes a second video feature parameter range; and determining the category to which the first network session belongs according to the feature parameter and the preset feature parameter range of the first network session includes: In the third time period, the uplink data packets sent by the client to the server in the multiple second network flows are used as the split points, and the server to the corresponding second network flow is sent to the server.
  • An embodiment of the present invention provides a method for determining a characteristic parameter matched by a first network session when determining that the first network session is the above-mentioned second transmission mode, and comparing with a preset video characteristic parameter range, and finally determining the first Whether a network session is a video stream.
  • the characteristic parameter includes a second characteristic parameter of each slice in the video traffic slice, and the second characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice.
  • the preset feature parameter range includes a second video feature parameter range; and determining the first network session according to the feature parameter and the preset feature parameter range of the first network session.
  • the category to which it belongs includes: periodically detecting uplink data packets sent by the client to the server in the plurality of second network flows in the third time period; if the plurality of The uplink data packet of at least one second network flow in the second network flow satisfies a second preset periodicity characteristic, and then the uplink data packet is used as a split point to the server in the corresponding second network flow.
  • An embodiment of the present invention provides another method for determining a characteristic parameter matched by a first network session when determining that the first network session is the foregoing second transmission mode, and comparing with a preset video characteristic parameter range, and finally determining the Whether the first network session is a video stream.
  • the first time period includes a fourth time period
  • the transmission mode includes a third transmission mode
  • the first network session includes a plurality of third network flows, where each The three network flows are data packet sets having the same quintuple information in the fourth time period, and the triplet information of the data packets in the data packet sets corresponding to different third network flows is the same
  • the third The transmission mode includes: within the fourth time period, the client initiates a request to the server through each third network stream of the plurality of third network streams, and the server passes The multiple third network flows respectively respond to requests corresponding to the clients.
  • An embodiment of the present invention provides another classification of a transmission mode for a network session in a video recognition scenario. In this transmission mode, a video stream is carried by multiple network streams. A client only sends a request to a server for each stream, which can be applied to identification. On-demand scenes of short videos with high real-time requirements.
  • the characteristic parameter includes a third characteristic parameter of each slice in the video traffic slice;
  • the third characteristic parameter includes: a peak value of a slice rate, a slice duration, a slice size, and a slice At least one of an average rate and a numerical distribution of a network packet size in a slice;
  • the preset feature parameter range includes a third video feature parameter range;
  • the determining the category to which the first network session belongs according to the characteristic parameter and the preset characteristic parameter range of the first network session includes: dividing each third network flow in the plurality of third network flows.
  • An embodiment of the present invention provides a method for obtaining a characteristic parameter matched by a first network session when the first network session is in the third transmission mode described above, and comparing with a preset video characteristic parameter range, and finally determining the first Whether the network session is a video stream.
  • the first time period includes a fifth time period; the transmission mode includes a fourth transmission mode; the first network session includes a fourth network stream, and the fourth network stream is A set of data packets with the same quintuple information in the fifth time period; the fourth transmission mode includes: during the fifth time period, the client sends data to all parties through the fourth network traffic; The server initiates a request, and the server responds to the request of the client through the fourth network traffic.
  • An embodiment of the present invention provides another classification of a transmission mode for a network session in a video recognition scenario. In this transmission mode, a video stream is carried by a single network stream, and a client only initiates a request to a server, which can be used to identify a live video stream. Scenes.
  • the characteristic parameter includes a fourth characteristic parameter of each slice in the video traffic slice, and the fourth characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a fourth video feature parameter range; and determining the first network session according to the feature parameter and the preset feature parameter range of the first network session
  • the category to which it belongs includes: determining a first data packet in the fourth network flow within the fifth time period, wherein the first data packet is the server-to-server direction in the fourth network flow A data packet smaller than a second data packet in the downlink data packets sent by the client, the second data packet being the largest data packet in the fourth network flow; and the first data packet being a split point pair Slicing the downlink data packet in the fourth network flow, the slice does not include the first data packet; detecting whether the fourth characteristic parameter of each slice matches the fourth video characteristic parameter Range; if are met, it is determined that the video session for
  • An embodiment of the present invention provides a method for determining a first network session as the fourth transmission mode, how to obtain a characteristic parameter matched by the first network session, and compare it with a preset video characteristic parameter range to finally determine the first network session. Whether a network session is a video stream.
  • the characteristic parameter includes a fourth characteristic parameter of each slice in the video traffic slice, and the fourth characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a fourth video feature parameter range; and determining the first network session according to the feature parameter and the preset feature parameter range of the first network session.
  • the category to which it belongs includes: determining the first data packet in the fourth network flow and periodically detecting the first data packet within the fifth time period, wherein the first data packet Is a data packet in the fourth network flow that is smaller than a second data packet in the downlink data packets sent by the server to the client, and the second data packet is the largest data in the fourth network flow Packet; if the first data packet satisfies a third preset periodic characteristic, slice the downlink data packet in the fourth network flow using the first data packet as a split point, and the slice is not Including the first data packet; detecting whether
  • An embodiment of the present invention provides another method for determining a characteristic parameter matched by a first network session when determining that the first network session is the foregoing fourth transmission mode, and comparing with a preset video characteristic parameter range, and finally determining the Whether the first network session is a video stream.
  • an embodiment of the present invention provides a network traffic identification device, which may include:
  • a first determining unit configured to determine a transmission mode corresponding to a first network session, where the first network session is a data packet set having the same triplet information in a first time period, and the triplet information includes a source of a client Address, target address of the server, and a transport layer protocol between the client and the server, the transmission mode includes a behavior mode requested by the client to the server and / or the server response A behavior mode of the client;
  • a matching unit configured to determine a characteristic parameter matching the transmission mode
  • An identifying unit is configured to determine a category to which the first network session belongs according to the characteristic parameter of the first network session and a preset characteristic parameter range.
  • an interaction behavior mode between a client and a server corresponding to a network session is first determined by a first determining unit, and then the determining interaction behavior of the network session is determined by a matching unit.
  • the corresponding characteristic parameter in the mode finally determines the type of the network session according to the comparison result of the characteristic parameter and the preset characteristic parameter range by the recognition unit. Because different interaction behavior modes between the client and the server may have large differences in their corresponding characteristic parameters, the network traffic identification device in the embodiment of the present invention first confirms the transmission mode of the network session, and then the targeted The characteristic parameters corresponding to the transmission mode are determined, and finally the type of the network session is accurately identified, which improves the identification efficiency and accuracy of network traffic.
  • the apparatus further includes:
  • a second determining unit is configured to determine, before determining a transmission mode corresponding to the first network session, a network session that includes a preset field in network traffic as the first network session.
  • the first time period includes a second time period
  • the transmission mode includes a first transmission mode
  • the first network session includes a first network stream
  • the first network stream is A data packet set having the same quintuple information in the second time period, the quintuple information includes a source address and a source port of a client, a destination address and a destination port of a server, and the client and the service Transport layer protocol between the peers;
  • the first transmission mode includes: during the second time period, the client initiates a request to the server through the first network flow multiple times, and the server responds through the first network flow Multiple requests from the client.
  • the characteristic parameter includes a first characteristic parameter of each slice in a video traffic slice, and the first characteristic parameter includes: a size of a slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a first video feature parameter range;
  • the identification unit is specifically configured to:
  • the server to the server in the first network flow is sent to the server.
  • the downlink data packets sent by the client are sliced, and the slices do not include the uplink data packets; determining whether the first feature parameter of each slice conforms to the first video feature parameter range; if the If the first characteristic parameters all meet, it is determined that the first network session is video traffic.
  • the characteristic parameter includes a first characteristic parameter of each slice in a video traffic slice, and the first characteristic parameter includes: a size of a slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a first video feature parameter range;
  • the identification unit is specifically configured to:
  • the second time period periodically detecting an uplink data packet sent by the client to the server in the first network flow; if the uplink data packet satisfies a first preset periodic characteristic , Using the uplink data packet as a split point, slice the downlink data packet sent by the server to the client in the first network flow, and the slice does not include the uplink data packet; Whether the first characteristic parameter of each slice matches the first video characteristic parameter range; if the first characteristic parameter of each slice matches, it is determined that the first network session is video traffic.
  • the first time period includes a third time period
  • the transmission mode includes a second transmission mode
  • the first network session includes a plurality of second network streams, where each The two network flows are data packet sets with the same quintuple information in the third time period, and the triplet information of the data packets in the data packet sets corresponding to different second network flows is the same;
  • the second transmission mode includes: during the third time period, the client initiates multiple requests to the server through the plurality of second network flows, and the server sends the request through the multiple The second network flows respectively respond to requests corresponding to the clients.
  • the characteristic parameter includes a second characteristic parameter of each slice in the video traffic slice, and the second characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a second video feature parameter range;
  • the identification unit is specifically configured to:
  • the server in the corresponding second network flow is divided. Slicing a downlink data packet sent to the client, the slice does not include the uplink data packet; determining whether the second characteristic parameter of each slice of the at least one second network flow meets the second Video feature parameter range; if the second feature parameter of each slice of any one of the at least one second network stream meets the second video feature parameter range, determine the first network Sessions are video traffic.
  • the characteristic parameter includes a second characteristic parameter of each slice in the video traffic slice, and the second characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a second video feature parameter range;
  • the identification unit is specifically configured to:
  • the uplink data packets sent by the client to the server in the plurality of second network flows are periodically detected respectively.
  • the uplink data packet of at least one second network flow satisfies a second preset periodicity characteristic, and the uplink data packet is used as a dividing point to send the server to the client in the corresponding second network flow.
  • Slice the downlink data packets, the slice does not include the uplink data packets; determine whether the second characteristic parameter of each slice of the at least one second network stream conforms to the second video characteristic parameter range; if The second characteristic parameter of each slice of any one of the at least one second network flow conforms to the range of the second video characteristic parameter, and it is determined that the first network session is video traffic.
  • the first time period includes a fourth time period
  • the transmission mode includes a third transmission mode
  • the first network session includes a plurality of third network flows, where each The three network flows are data packet sets having the same quintuple information in the fourth time period, and the triplet information of the data packets in the data packet sets corresponding to different third network flows is the same;
  • the third transmission mode includes: during the fourth time period, the client initiates a request to the server through each third network flow of the plurality of third network flows, and The server responds to requests corresponding to the client through the multiple third network flows, respectively.
  • the characteristic parameter includes a third characteristic parameter of each slice in the video traffic slice;
  • the third characteristic parameter includes: a peak value of a slice rate, a slice duration, a slice size, and a slice At least one of an average rate and a numerical distribution of a network packet size in a slice;
  • the preset feature parameter range includes a third video feature parameter range;
  • the identification unit is specifically configured to:
  • the first time period includes a fifth time period;
  • the transmission mode includes a fourth transmission mode;
  • the first network session includes a fourth network stream, and the fourth network stream is A data packet set with the same five-tuple information in the fifth time period;
  • the fourth transmission mode includes: within the fifth time period, the client initiates a request to the server through the fourth network traffic, and the server responds through the fourth network traffic The client's request.
  • the characteristic parameter includes a fourth characteristic parameter of each slice in the video traffic slice, and the fourth characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a fourth video feature parameter range;
  • the identification unit is specifically configured to:
  • the first data packet is the one sent by the server to the client in the fourth network flow
  • the first network packet is used as a split point to the fourth network flow
  • the characteristic parameter includes a fourth characteristic parameter of each slice in the video traffic slice, and the fourth characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a fourth video feature parameter range;
  • the identification unit is specifically configured to:
  • a data packet in the flow that the server sends to the client is smaller than a second data packet, and the second data packet is the largest data packet in the fourth network flow
  • the first data packet satisfies a third preset periodic characteristic, slice the downlink data packet in the fourth network flow using the first data packet as a split point, and the slice does not include all The first data packet; detecting whether the fourth feature parameter of each slice conforms to the fourth video feature parameter range; and if they all match, determining that the first network session is video traffic.
  • an embodiment of the present invention provides a network device.
  • the network device includes a processor, and the processor is configured to support the network device to implement a corresponding function in the network traffic identification method provided in the first aspect.
  • the network device may further include a memory, which is coupled to the processor and stores program instructions and data necessary for the network device.
  • the network device may further include a communication interface for the network device to communicate with other devices or a communication network.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions used in a processor in a network traffic identification device provided in the second aspect above, which includes instructions for executing the above-mentioned aspects. Designed procedures.
  • an embodiment of the present invention provides a computer program.
  • the computer program includes instructions.
  • the computer program can execute the program executed by a processor in the network traffic identification device in the second aspect. Process.
  • the present application provides a chip system including a processor, which is configured to support a network device to implement the functions involved in the first aspect, for example, to generate or process a method involved in the foregoing network traffic identification method. information.
  • the chip system further includes a memory, and the memory is configured to store program instructions and data necessary for the data sending device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • FIG. 1 is a schematic diagram of a network architecture provided by an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a traffic monitoring device according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a network traffic identification method according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a transmission mode determination process according to an embodiment of the present invention.
  • FIG. 5 is a timing diagram of a first transmission mode according to an embodiment of the present invention.
  • FIG. 6 is a timing diagram of a second transmission mode according to an embodiment of the present invention.
  • FIG. 7 is a timing diagram of a second transmission mode according to an embodiment of the present invention.
  • FIG. 8 is a timing diagram of a fourth transmission mode according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a network traffic identification device according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another network traffic identification device according to an embodiment of the present invention.
  • an embodiment herein means that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the present application.
  • the appearances of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they independent or alternative embodiments that are mutually exclusive with other embodiments. It is clearly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.
  • a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and / or a computer.
  • an application running on a computing device and a computing device can be components.
  • One or more components can reside within a process and / or thread of execution, and a component can be localized on one computer and / or distributed between 2 or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more data packets (e.g., data from two components that interact with another component between a local system, a distributed system, and / or a network, such as the Internet that interacts with other systems through signals) Communicate via local and / or remote processes.
  • data packets e.g., data from two components that interact with another component between a local system, a distributed system, and / or a network, such as the Internet that interacts with other systems through signals
  • IP Internet Protocol
  • VOD Video on Demand
  • the video-on-demand system can be played in real time by streaming media, or it can be played after the content is completely downloaded.
  • Transport layer security protocol (Transport Layer Security, TLS) is a protocol that ensures data confidentiality between communication applications and Internet users.
  • SSH Secure Shell
  • IP protocol network transmission protocol family (a collection of interrelated protocols) by encrypting and authenticating the packets of the IP protocol.
  • SNI Server Name Indication
  • CDN Content Delivery Network
  • Over-The-Top usually refers to the content or service is built on the basic telecommunications services and does not require additional support from network operators.
  • Online video refers to the video watched through the network in a non-download mode, which can specifically include video on demand and live video.
  • Traffic classification Obtain network communication messages through monitoring, grabbing, copying, etc., and analyze, reorganize, and split them to restore their original communication content operations to understand the real-time status of both sides of the network communication.
  • Plain text feature A feature composed of characters or numbers that can be directly parsed in the transmission message, which is different from the encryption feature.
  • Network flow can also be referred to simply as network flow.
  • a set of data packets with the same quintuple in a period of time is called a network flow, where the quintuple contains the source IP address, source port number, and destination of the two communicating parties. IP address, destination port number, and transport layer protocol.
  • a network session is a collection of multiple network flows. Multiple network flows have the same triplet (source address, destination address, and transport layer protocol).
  • Solution 1 The method for identifying traffic based on application characteristics may specifically include the following steps 1 and 2.
  • Step 1 Identify the type of application based on the characteristics of the application and determine whether video traffic may be included in the application.
  • Step 2 Perform service subdivision for applications that may include video traffic, and determine whether the traffic to be identified is video traffic.
  • This solution 1 is generally used for video traffic identification solutions based on application characteristics. At present, it is mainly applicable to identification scenarios of non-encrypted applications and applications using standard encryption protocols. However, there are several disadvantages:
  • Disadvantage 1 Analyze and generate application features one by one, and the labor cost is extremely high.
  • an application-based video traffic recognition method it is necessary to analyze application characteristics to generate application characteristic rules.
  • the analysis and rules of application characteristics generate a lot of manpower, usually including capturing pure traffic of specific applications, analyzing application formats and comparing with other similar applications to determine application characteristics, and describing application characteristic rules based on specific syntax. step.
  • Disadvantage 2 The application update is prone to cause feature changes, resulting in false negatives or false positives.
  • video applications are constantly optimized and updated for their services, so video applications are generally updated frequently.
  • the application update brings uncertainty to the traffic identification. It usually takes at least 1 to 3 days from the feature rule change to cause the recognition failure to regenerate the feature rule to restore the recognition ability. During this period, due to the invalidation of the feature rules, false negatives or false positives will be caused, causing high economic losses to operators.
  • it is necessary to establish a corresponding monitoring mechanism and continuously test the validity of the rule which brings additional overhead to the system.
  • Disadvantage 3 Some encrypted application traffic cannot be segmented as video traffic.
  • feature rules generated based on application features depend on the plaintext features of the application.
  • video applications are gradually transitioning to using encryption protocols for transmission.
  • the mainstream encryption method is TLS.
  • the original application layer information is encrypted, and only part of the plaintext fields used to establish the TLS connection are exposed.
  • the fields with significant application characteristics are mainly Server Name Indication (SNI) and Certificate Name. ).
  • SNI Server Name Indication
  • Certificate Name Certificate Name
  • the identification methods for applications based on the TLS protocol all rely on this part of the plain text field.
  • different services may have the same SNI and Certificate Name. In this case, the different service types cannot be accurately segmented, and as a result, video traffic cannot be accurately identified.
  • Solution 2 The method for identifying traffic based on behavior characteristics may specifically include the following step 1.
  • Step 1 Based on the behavior characteristics of the video service itself, directly identify whether the network traffic is a video stream. Among them, the behavior characteristics of video are usually described by dimensions such as transmission rate, average packet length, and stream duration. However, it is difficult to extract the video traffic of application features, and it is necessary to generate a recognition model based on heuristic rules or machine learning algorithms. Different network services have certain differences in some traffic statistics, such as average packet length, average flow duration, and average rate.
  • the second solution mentioned above is mainly applicable to the identification scenario of applications using private encryption protocols, but it also has the following disadvantages:
  • Disadvantage 1 Most existing behavioral characterization methods rely on full-flow features and are not suitable for online traffic identification services. For example, statistics describing the behavior characteristics of network traffic, including average flow duration, average rate, etc. These characteristics need to cache or count the entire flow information of a network flow, so the results of traffic identification need to be obtained until the end of network flow transmission. Or need network streaming for a long time. However, in some scenarios, for operators, the identification of video traffic is usually used for operators' network optimization and other services. The identification results need to be given in the early stage of network streaming, so the use of full-flow features is not suitable for online traffic identification. Business development.
  • Disadvantage 2 The existing behavioral characterization methods do not accurately describe the behavioral characteristics of video traffic.
  • video applications including pure video applications, embedded video applications, on-demand videos, and live broadcast videos. Looking at a variety of different types of video applications without distinction can easily overwhelm their representative behavioral characteristics, leading to inaccurate feature characterization, which ultimately makes the recognition accuracy rate not high enough to meet actual use requirements.
  • Stable video traffic characteristics (disadvantages 1 and 3 of scheme 1). Video traffic recognition schemes based on application characteristics are currently widely used, partially solving the problem of video traffic recognition.
  • the extraction of each application feature rule relies heavily on manual intervention, when the application feature rule changes, it is often because of the need for manual positioning that the update of the feature rule is not timely, which affects the online traffic identification service.
  • the update of application feature rules is about one week slower than the true change of application features. During this period, someone needs to analyze the application traffic and extract new feature rules, which has a high labor cost. Therefore, it is necessary to propose a stable video traffic feature that can reflect the true characteristics of video services and reduce the impact of application level updates on video traffic recognition.
  • Efficient traffic identification mechanism (disadvantage 1 of scheme 2).
  • Existing behavioral feature-based video traffic recognition schemes rely on full-flow features to describe the behavioral characteristics of network traffic, and are not suitable for operators' real network services.
  • video traffic has a longer duration than other types of services, it can accept relatively long traffic identification time.
  • an efficient video traffic identification mechanism is needed to reduce the time required for video traffic identification.
  • the existing identification schemes cannot meet the actual video traffic identification needs of operators, which severely affects their implementation of video-based customized services. Therefore, the network traffic identification method provided in this application is used to solve the above technical problems.
  • Scenario one allows operators to identify traffic for specific applications and generate preferential packages for specific applications:
  • Scenario two Allows network operators to prioritize the transmission of custom traffic based on application type:
  • Operators can transmit network traffic of a specific application type according to a custom priority to ensure QoS and QoE for application types at that priority. For example, according to a package handled by a user, a higher level of bandwidth guarantee service of a specified application type may be enjoyed, while the guarantee level of other types of applications may be relatively low. Therefore, only when the type of network traffic is accurately identified can targeted quality control be better based on the type of network traffic.
  • Scenario 3 Help researchers and operation and maintenance personnel understand the traffic and application distribution on the network:
  • Effectively distinguishing video, audio, picture, text, download, or other types of traffic distribution on the network can help researchers and operation and maintenance personnel understand the traffic and application distribution on the network for data mining. For example, learn about the hobbies and interests of different regions and users, as well as entertainment, work, study, and life needs.
  • FIG. 1 is a schematic diagram of a network architecture according to an embodiment of the present invention.
  • the client in this application may include the mobile terminal 001, the Internet terminal 002, and related network connection devices in FIG. 1 (the access gateway 003 is taken as an example in FIG.
  • the Internet terminal 002 is connected to the traffic through the access gateway 003
  • Monitoring device 004 mobile terminal 001 can be connected to the traffic monitoring device 004 through the wireless access device (such as a wireless router, base station, etc.) in the Internet terminal 002 and the access gateway 003;
  • the server can include the traffic monitoring in Figure 1 Device 004, data center 005, Internet 006, and related network connection devices (in Figure 1, access gateway 002 and router 007 are taken as examples), traffic monitoring device 004 is connected to the Internet through router 007, and data center 005 is connected to the Internet 002 is connected to the Internet 006. among them
  • Mobile terminal 001 can be a cellular phone, cordless phone, mobile phone, Session Initiation Protocol (SIP) phone, Wireless Local Loop (WLL) station that supports wireless mobile communication video services , Smart bracelet, smart wearable device, MP3 player (Moving Picture Experts Group Audio Layer III, moving picture expert compression standard audio level 3), MP4 (Moving Picture Experts Group audio level 3, moving picture expert compression standard audio level 3) Player, Personal Digital Processing (Personal Digital Assistant, PDA), handheld device with wireless communication function, computing device or other processing device connected to wireless modem, vehicle-mounted device, etc.
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • MP3 player Moving Picture Experts Group Audio Layer III, moving picture expert compression standard audio level 3
  • MP4 Motion Picture Experts Group audio level 3, moving picture expert compression standard audio level 3
  • PDA Personal Digital Processing
  • Mobile terminal 001 can also be a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, an industrial control (industrial control) wireless Terminal, wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety, smart city ( wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • a tablet computer (Pad)
  • a computer with wireless transceiver function a virtual reality (VR) terminal device
  • AR augmented reality
  • industrial control (industrial control) wireless Terminal wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety, smart city ( wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • the Internet terminal is connected to the access gateway through the local network.
  • the access gateway is responsible for connecting the Internet terminal to the Internet.
  • the Internet terminal may include a personal computer (PC) and wireless access devices (such as wireless routers, base stations, etc.) ), Server, Workstation, etc.
  • the traffic monitoring device 004 is a monitoring device provided by the present application, and is configured to process and analyze the network traffic to obtain the identification result of the traffic, so as to execute and implement the related embodiments of the network traffic identification method in the present application.
  • the traffic monitoring device may further perform specific operations such as re-routing, discarding data packets, or limiting the speed of network flows according to user settings and outputting statistical results of traffic recognition.
  • Data Center (IDC) 005 is used to house computer systems and related computing facilities, and can store and provide data for various types of business.
  • the network connection device may include an access gateway 002 and a router 007.
  • the access gateway 007 is used to send user data to the router of the backbone network, and various servers on the Internet (such as the data center 005) also access
  • the gateway 007 is connected to the router of the backbone network.
  • the access gateway in this application serves as the entrance and exit of the network under its jurisdiction.
  • Router 002 is used to connect the traffic monitoring device to the Internet.
  • the network traffic identification method in the present invention can be applied to technical standards (Dynamic, Adaptive Streaming, HTTP, DASH) and dynamic code rate adaptive technology (HTTP, Live Streaming, HLS) formulated by the International Standards Group MPEG based on HTTP adaptive code rate Transmission mechanism.
  • technical standards Dynamic, Adaptive Streaming, HTTP, DASH
  • dynamic code rate adaptive technology HTTP, Live Streaming, HLS
  • FIG. 1 is only an exemplary implementation manner in the embodiment of the present invention, and the network in the embodiment of the present invention includes but is not limited to the above network architecture.
  • an embodiment of the present invention provides a traffic monitoring device 004 applied to the above network architecture.
  • the device 004 may include a management configuration control module 4001, a Symmetrical Multi-Processing (SMP) module 4002, a memory management module 4003, a parsing module 4004, a filtering module 4005, and a service matching logic module 4006. among them,
  • SMP Symmetrical Multi-Processing
  • the management configuration module 4001 is used to manage rules. For example, the administrator of the server can add, delete, modify, and view related rule files based on service requirements (including the network traffic identification service or video traffic identification service in this application).
  • the symmetric multi-processing SMP module 4002 is used to schedule multiple central processing units (Central Processing Units) to process concurrent network traffic in the network in parallel.
  • Central Processing Units Central Processing Units
  • the memory management module 4003 is used for life cycle management of related network flows in the network traffic identification service, including application and release of related variables.
  • the parsing module 4004 is configured to read a data stream (including the first network session in the present application) from the memory, and parse the data stream according to the protocol format of the message, and mainly processes protocols above the transport layer.
  • a filtering module 4005 is used to read rules from the management module, and filter the parsed traffic with rules to provide a shunting function for the service identification module.
  • the first stage of the suspicious traffic filtering function in the network traffic identification method in the present application may be implemented based on the filtering module. For example, a network session that includes a preset field in the network traffic may be determined as the first network according to the filtering module. Conversation.
  • the service matching logic module 4006 is configured to process the determination of the transmission mode of the first network session and the related process of determining the category to which the first network session belongs in the network traffic identification method of the present application. Specifically, it may include behavior recognition (that is, transmission mode recognition), feature recognition, and content recognition. Because the first network session in different situations may correspond to different recognition results, the service matching logic module also needs to provide a state automaton to determine the specific matching results corresponding to the cases where different rules are hit.
  • the structure of the traffic monitoring device in FIG. 2 is only an exemplary implementation in the embodiment of the present invention, and the structure of the traffic monitoring device in the embodiment of the present invention includes but is not limited to the above structure.
  • FIG. 3 is a schematic flowchart of a network traffic identification method according to an embodiment of the present invention.
  • the method can be applied to the network architecture described in FIG. 1 above, where a traffic monitoring device 004 can be used to support and Steps S301 to S305 of the method flow shown in FIG. 3 are performed.
  • the following description will be made from the traffic monitoring device side of the server with reference to FIG. 3.
  • the method may include the following steps S301 to S303, and optionally may further include step S300.
  • Step S301 Determine a transmission mode corresponding to the first network session.
  • the first network session is a data packet set having the same triplet information in the first time period, where the triplet information includes the source address of the client, the destination address of the server, and the client and the server.
  • the data packet set may include uplink data packets and downlink data packets. That is, a set of the source and destination addresses and the same uplink / downlink data packets with the same transmission protocol as the first network session between a client and a server in a continuous period of time.
  • the transmission mode includes the behavior mode that the client requests from the server and / or the behavior mode that the server responds to the client.
  • the requested behavior mode may include the number of times the client requests the server, the time point, and whether it is periodic; the response
  • the behavior mode may include a bearer manner in which the server responds to the client with network traffic, that is, a multi-network stream bearer or a single network stream bearer.
  • FIG. 4 is a schematic diagram of a transmission mode determination process according to an embodiment of the present invention.
  • Traffic monitoring The device 004 can determine the transmission mode corresponding to the network flow through the service matching logic module 4006. Since the data packets in the network flow arrive at the traffic monitoring device 004 in chronological order, and the network monitoring device 004 cannot store the data packets of the network traffic, the judgment of the transmission mode is performed in a streaming manner.
  • the traffic monitoring device 004 For a network flow whose transmission mode is pending, when a data packet arrives at the traffic monitoring device 004, it is first determined whether the data packet is an uplink data packet. If the current data packet is an uplink data packet and multiple uplink data packets have arrived, then It is determined that the behavior mode of the current network stream includes the behavior that the client initiates multiple requests to the server (for example, the first transmission mode or the second transmission mode described later), such as uplink data in the application scenario of video traffic The packet is generally a request data packet initiated by the client.
  • the transmission mode is pending and continue to observe the subsequent data packets; if it is subsequently observed that the data packet is not an uplink data packet, it is a downlink data packet.
  • the behavior mode of the current network flow includes the client only Initiate a request to the server (for example, the fourth transmission mode described later); further, if the current data packet is a downlink data packet and is not full, further determine whether the cumulative length of the current downlink data packet has exceeded the pre- The set threshold. If the cumulative length of the downstream packets exceeds the preset threshold, it can be determined that the behavior pattern of the current network flow includes the behavior that the client initiates a request to the server only (such as the Third transmission mode or fourth transmission mode).
  • non-full packets and full packets in the physical sense are their position in the network flow. Because the network has a maximum upper limit on the size of a single data packet that is allowed to be transmitted, that is, the maximum transmission unit, data blocks that exceed this limit will be divided into multiple data packets for transmission, such as the maximum transmission unit limit of 1000 bytes. Then to transmit a 5600-byte data block, five 1000-byte data packets and one 600-byte data packet are required.
  • the 600-byte data packet is a non-full packet, and its physical meaning is the content of the transmission. Ending, so in this application the non-full packet is used as the segmentation boundary of the slice.
  • the same network session contains multiple network flows suspected of the first / second transmission mode, it is confirmed as the second transmission mode; if it contains only one suspected first / second transmission mode If the network stream in the transmission mode is identified as the first transmission mode; if there are multiple network streams suspected of the third transmission mode in the same network session, it is confirmed as the third transmission mode; if only one network in the third transmission mode is included Flow, when the entire detection process exceeds the maximum detection time (for example, the second time period, the third time period, the fourth time period, or the fifth time period in this application), it is confirmed as the fourth transmission mode.
  • the maximum detection time for example, the second time period, the third time period, the fourth time period, or the fifth time period in this application
  • Step S302 Determine a characteristic parameter matching the transmission mode.
  • the characteristic parameter may be a set composed of multiple parameters, or a set composed of multiple parameter sets. This embodiment of the present invention does not specifically limit this, as long as it can reflect the parameters of the characteristics of the corresponding video type in the corresponding transmission mode.
  • Step S303 Determine a category to which the first network session belongs according to the characteristic parameter of the first network session and a preset characteristic parameter range.
  • the traffic monitoring device calculates a characteristic parameter matched by the transmission mode of the first network session, and compares the calculated characteristic parameter with a preset characteristic parameter range to finally determine the category of the first network session.
  • the preset feature parameter range may be a set of multiple preset feature parameter ranges, or may be a list form or a mapping relationship table, which is not specifically limited in this embodiment of the present invention.
  • the above method steps S301-S303 are applied to video traffic identification, there are some fixed modes in the video playback request and response process.
  • the behavior mode that the client requests from the server and / or the behavior mode that the server responds to the client such as on-demand movies
  • step S304 may be further included:
  • Step S300 Determine a network session including a preset field in the network traffic as the first network session.
  • the traffic monitoring device may first determine the network traffic including a preset field in the network traffic as an object to be identified. That is, before determining the transmission mode of the first network session, the suspicious objects meeting certain conditions are filtered out from all network sessions to reduce the determination range of the transmission mode of the network session.
  • the preset field in the embodiment of the present invention is a plain text field.
  • the network traffic belongs to the iQiyi application; further, in order to reduce the first network session to the video traffic, it can be further verified whether the preset fields of the video file format, such as keywords such as videos, mp4, avi, and ts, are included.
  • the network traffic uses the application of the standard encryption protocol (mainly TLS encryption protocol)
  • it can detect the Service Name Indication (SNI) field or CommonName field in the TLS protocol.
  • SNI Service Name Indication
  • CommonName field CommonName
  • Video-type plaintext feature rule matching can be based on the feature matching function of existing devices to add video-related plaintext feature rules. It should be pointed out here that the plaintext feature rules here are application-independent, that is, they do not include application-level feature rules, and only match rules related to video features. The purpose is to filter traffic and unknown traffic that cannot be broken down into videos.
  • the embodiment of the present invention can be applied to a video traffic recognition mechanism of an operator's online traffic recognition service.
  • a layer-by-layer screening mechanism Through the establishment of a layer-by-layer screening mechanism, the scope of the traffic to be identified is first reduced through the positioning of suspicious traffic, which reduces the subsequent transmission mode division and calculation of the behavior feature matching stage, greatly improves the efficiency of online traffic recognition and matching, and facilitates the subsequent feature matching process Filtered out most non-video traffic and improved the recognition accuracy of online video traffic; then accurately located the video behavior pattern by matching the transmission mode, and finally identified the video traffic based on the characteristics corresponding to the behavior pattern, further increasing the online video traffic Recognition efficiency and accuracy.
  • step S304 specifically how to determine the category to which the first network session belongs according to the characteristic parameters of the first network session and the preset characteristic parameter range will be different according to different judgment results of the transmission mode of the network session.
  • video applications are classified according to behavior patterns, behavior characteristics of various types of video applications are analyzed, and corresponding identification schemes are proposed.
  • the main core point of identifying video traffic is to exclude the uplink data packets and slice the downlink data packets, because, generally, the uplink data packets sent by the client to the server are video requests, but the downlink data packets are very The big possibility is video packets.
  • the dimensions of dividing the video traffic from the interaction between the client and the server include: whether the downlink is transmitted across the network, and whether the uplink is a single request or multiple requests.
  • the above two dimensions are arbitrarily combined to form the following four video transmission behavior modes:
  • the first transmission mode the video stream is carried by a single network stream, and the client makes multiple requests to the server
  • the first transmission mode is specifically: the first network session includes a first network stream carried by a single network stream, and within a second time period, the client initiates requests to the server multiple times through the first network stream, and the server passes the first A network stream responds to multiple requests from clients.
  • the first time period includes a second time period, that is, the second time period may be equal to the first time period, or may be any time period within the first time period.
  • the first network flow is a packet with the same quintuple information in the second time period.
  • the quintuple information includes the source address and source port of the client, the destination address and destination port of the server, and the data between the client and the server. Transport layer protocol.
  • the second time period in the embodiment of the present invention is an initial time period in the first time period. For example, the first time period is 0:00:00 to 00:15:00, and the second time period is 00:00:00 to 00:00:30.
  • the characteristic parameters matched with the first transmission mode include: the first characteristic parameter of each slice in the video traffic slice, the first characteristic parameter includes: the size of the slice, the average rate of the slice, and the value of the network packet size in the slice At least one of a distribution; the preset feature parameter range includes a first video feature parameter range. That is, when the embodiments of the present invention are applied to video traffic recognition scenarios, the corresponding feature parameters are also feature parameters related to video.
  • FIG. 5 is a timing diagram of a first transmission mode according to an embodiment of the present invention. As shown in Figure 5:
  • the uplink data packet is the request data initiated by the user from the client to the server, for example, it may be a video slice playback request initiated by the client to the server periodically in the background.
  • video service providers widely use adaptive bit rate (ABR) technology to transmit video content.
  • ABR adaptive bit rate
  • the video content viewed by users is not transmitted as a complete file, but is transmitted to the user side in the form of video fragments. Video fragments can be requested by the user side or pushed by the service side.
  • the length of video content corresponding to each video segment is generally the same.
  • the network traffic transmitted by each video segment is basically similar, which is reflected in the characteristics of network traffic That is periodicity. Therefore, in the embodiment of the present invention, periodic detection is used as a pre-filter to filter network flows that enter the detection stage.
  • the principle of detection related to periodicity described later is the same and will not be described again.
  • the uplink data packet satisfies the first preset periodicity characteristic, that is, the uplink data packet is sent periodically, then the uplink data packet is used as a dividing point to the server in the first network flow.
  • the downlink data packets sent to the client are sliced, where the slice does not include the uplink data packets, because the uplink data packets are likely to be requests rather than video traffic, so judging the downlink data packets can determine the network session more quickly and efficiently. Whether it is video traffic.
  • slice 1 includes slice 1 and slice 2 in FIG. 5.
  • the downlink data packet is data that the server sends back to the client through the first network flow, for example, video data that may be ordered by the user.
  • the embodiment of the present invention further provides no detection of uplink data packets, that is, directly above.
  • a scheme for slicing a row data packet as a split point For example, in the second time period, an uplink data packet sent by the client to the server in the first network flow is used as a split point to In the first network flow, the downlink data packet sent by the server to the client is sliced, and the slice does not include the uplink data packet. This application does not specifically limit this.
  • the first feature parameter and the first video feature parameter range may be a behavior feature description method established in combination with a video transmission mode, and based on the behavior feature rule automatically generated by a certain algorithm, for example, generated by a certain machine learning algorithm Or calculated according to some artificial preset algorithm, which is not specifically limited in this embodiment of the present invention.
  • the first feature parameter of each slice may be the same or different.
  • the feature parameter range included in the first video feature parameter range may have only the same range for different network slices, or may have different ranges. This embodiment of the present invention does not specifically limit this.
  • the second transmission described later For the corresponding relationships among the slices, the first feature parameter, and the first video feature parameter range in the mode, the third transmission mode, and the fourth transmission mode, reference may also be made to the foregoing description, and details are not described later.
  • each slice needs to satisfy its corresponding part in the first video characteristic parameter range, respectively, to determine whether the first network session is video traffic.
  • the traffic monitoring device periodically detects the uplink data packet after the packet is continuously received for a period of time. If the periodicity of the uplink data packet is significant, the data packet of the upper line is the split point for the downlink. Packet slicing, detecting whether the statistical characteristics of each slice conform to video characteristics, and finally determining whether the network session is video traffic.
  • the second transmission mode the video stream is carried by multiple network streams, and the client makes multiple requests to the server
  • the second transmission mode is specifically: the first network session includes multiple second network flows, and within the third time period, the client sends multiple requests to the server through the multiple second network flows, respectively, and the server And responding to requests corresponding to the clients through the multiple second network flows.
  • the first time period includes a third time period, that is, the third time period may be equal to the first time period, or may be any time period within the first time period.
  • Each second network flow is a data packet set with the same quintuple information in the third time period, and the triplet information of the data packets in the data packet sets corresponding to different second network flows is the same.
  • the fourth time period in the embodiment of the present invention is an initial time period in the first time period.
  • the first time period is 00:00:00 to 00:30:00
  • the second time period is from 00:00:00 to 00:00:50.
  • the characteristic parameters matched with the above-mentioned second transmission mode include: the second characteristic parameter of each slice in the video traffic slice, and the second characteristic parameter includes: the size of the slice, the average rate of the slice, and the value of the net packet size in the slice At least one of a distribution; the preset feature parameter range includes a second video feature parameter range.
  • FIG. 6 is a timing diagram of a second transmission mode according to an embodiment of the present invention. As shown in Figure 6:
  • the uplink data packet refers to multiple requests for data initiated by the user from the client to the server, for example, it may be a high-definition video on demand request.
  • the multiple second network flows may be initiated at the same time or at different times. As shown in FIG. 6, only the second network flows 3 and 4 are simultaneously engraved. Initiated, it is not initiated at the same time between 1, 2 and 3 and 4. Therefore, during the detection of a plurality of second network flows by the traffic monitoring device, the detection can actually be started at different times, that is, the detection is started at the time when each second network flow actually initiates a request.
  • the uplink data packet of at least one second network flow among the plurality of second network flows meets a second preset periodicity characteristic
  • the uplink data packet is used as a split point for the corresponding second network.
  • the downstream data packet sent by the server to the client in the stream is sliced, and the slice does not include the uplink data packet, because the uplink data packet is likely to be a request rather than video traffic, so judging the downlink data packet can be more Quickly and efficiently determine whether a network session is video traffic. For example, in the four second network flows in FIG. 6, only the second network flow 4 meets the first and second preset periodic characteristics after detection. Then, only the downlink data packets in the second network flow 4 are sliced. After the slice, slice 1 and slice 2 in FIG. 6 are included.
  • the downlink data packet is data that the server sends back to the client through the second network stream 4, for example, high-definition video data that may be requested by the user.
  • second network flows 1, 2 and 3 that do not meet the conditions may be other related service information of the second network flows that meet the conditions, such as barrage data, advertisements, chat windows, etc.
  • the embodiment of the present invention further provides no detection of the uplink data packet, that is, directly above A scheme for slicing a row data packet as a segmentation point.
  • an uplink data packet sent by the client to the server in the plurality of second network flows is used as a segmentation point.
  • the second characteristic parameter of each slice of any one of the at least one second network flow meets the range of the second video characteristic parameter, determine that the first network session is video traffic . If it is determined that both slice 1 and slice 2 in the second network stream 4 satisfy the second video characteristic parameter range, it is determined that the second network session is video traffic. It can be understood that when there are multiple second network flows that meet the above conditions, the second network session that is the first to meet the conditions can be determined in time to determine that the second network session is video traffic without further judgment.
  • the identification process of the first network session may be terminated to save network overhead.
  • the third transmission mode the video stream is carried by multiple network streams, and the client sends a request to the server only once per stream
  • the third transmission mode is specifically: the first network session includes multiple third network flows, and in the fourth time period, the client initiates the service to the server through each of the third network flows in the third network flow. Request, and the server responds to the request corresponding to the client through multiple third network flows, respectively.
  • the first time period includes the fourth time period, that is, the fourth time period may be equal to the first time period, or may be any time period within the first time period; each third network flow is in the fourth time period.
  • a data packet set with the same internal quintuple information, and the triplet information of the data packets in the data packet sets corresponding to different third network flows is the same.
  • the fourth time period in the embodiment of the present invention is an initial time period in the first time period.
  • the first time period is from 00:00:00 to 00:00:00
  • the fourth time period can be from 00:00:00 to 00:00:20.
  • the characteristic parameters matched with the third transmission mode include: the third characteristic parameter of each slice in the video traffic slice; the third characteristic parameter includes: the peak value of the slice rate, the duration of the slice, the size of the slice, and the average of the slice At least one of a numerical distribution of a rate and a size of a network packet in a slice; the preset feature parameter range includes a third video feature parameter range.
  • FIG. 7 is a timing diagram of a second transmission mode according to an embodiment of the present invention. As shown in Figure 7:
  • the third characteristic parameter of each slice is consistent, it is determined that the first network session is video traffic. That is, when slice 1, slice 2, slice 3, and slice 4 all meet the conditions, the first network session can be determined to be video traffic.
  • the fourth transmission mode video stream single network stream bearer, the client only sends a request to the server
  • the third transmission mode is specifically: the first network session includes a fourth network flow, and within the fifth time period, the client initiates a request to the server through the fourth network traffic, for example, the dark gray part in FIG. 8 , The server can respond to the client's request through the fourth network traffic, for example, it can be the live video data fed back from the server to the client.
  • the first time period includes a fifth time period, and the fourth network flow is a data packet set with the same quintuple information in the fifth time period;
  • the feature parameters matched with the fourth transmission mode include: a fourth feature parameter of each slice in the video traffic slice, and the fourth feature parameter includes: a size of the slice, an average rate of the slice, and a numerical value of a network packet size in the slice At least one of distributions; the preset feature parameter range includes a fourth video feature parameter range.
  • FIG. 8 is a timing diagram of a fourth transmission mode according to an embodiment of the present invention. As shown in Figure 8:
  • the first data packet is the fourth
  • the downlink data packet sent by the server to the client in the network flow is smaller than the second data packet
  • the second data packet is the largest data packet in the fourth network flow.
  • the first data packet is the non-full packet in the white portion of the fourth network flow in FIG. 8
  • the second data packet is the full packet portion in the light gray portion in FIG. 8.
  • the meaning of full packet means that the size of the current data packet has reached the maximum amount of data that can be carried by the network link corresponding to the network flow.
  • a non-full packet is a data packet that has not reached the maximum amount of data. Usually the physical meaning of a non-full packet It is the end of the transmission content, so non-full packets can be used as the slice boundary.
  • the embodiment of the present invention further provides no detection of uplink data packets, that is, directly above.
  • a first data packet in the fourth network flow is determined, where the first data packet is the fourth network.
  • the data packets smaller than the second data packet, and the second data packet is the largest data packet in the fourth network flow;
  • a data packet is a segmentation point for slicing the downlink data packet in the fourth network flow, and the slice does not include the first data packet.
  • the traffic monitoring device judges the full packet size corresponding to the transmission link of the network flow after continuously injecting packets for a period of time, filters out downlink non-full packets, and Packets are periodically detected. If the periodicity of the downlink non-full packets is significant, the downlink data packets are sliced according to the time of the non-full packets, and the statistical characteristics of the slices and the entire network flow are checked for video characteristics.
  • the corresponding identification schemes under the above four transmission modes clearly decouple the division of the transmission modes of different video scenes.
  • the transmission mode is different. Based on this, the video application is further subdivided, so that the behavior characteristics of the video in each scene are more focused.
  • the embodiments of the present invention are improved in terms of recognition processes and rules.
  • the video traffic characteristics of different transmission modes are analyzed for stable video traffic characteristics, and these characteristics will not be caused by application updates or application characteristics. This change is affected. That is to say, the interaction behavior mode between the client and the server of the video application under different transmission modes will basically not change. Therefore, stable video traffic characteristics can be formed.
  • the combination of transmission mode identification and characteristic parameters in the transmission mode can more quickly and accurately identify video traffic, that is, to provide an efficient traffic identification mechanism.
  • the present application overcomes the shortcomings of application-by-application analysis in the existing identification technology, the application characteristics are easy to change, some scenes cannot be subdivided, they are not suitable for online traffic identification services, and the identification is inaccurate.
  • this application can achieve high video traffic recognition accuracy for the following situations, and solves the problem that the video scene cannot be accurately identified: transmitting the video stream using a private protocol; transmitting the video stream using an encryption protocol; However, it contains multiple scenarios; it is difficult to distinguish between video streams and single network stream feature information.
  • This application can improve response speed and save manpower analysis costs for the following situations: video applications are frequently updated and application features change significantly; the number of applications to be identified is large, and only video scenes need to be identified.
  • the network traffic identification method in this application can be applied to UGW-related products of the unified packet gateway, for example, UGW to support operators in developing video-related billing packages, or UGW products to refine QoE / QoS for video traffic.
  • the full traffic feature is not applied, but according to different The characteristics of the transmission mode selectively intercept some features early in the network stream transmission.
  • this application can be naturally extended to this type of traffic recognition environment, and the core of its identification still belongs to this application. protected range.
  • the network traffic identification method in this application can be applied to the operator's billing and policy control scenarios, and also used in video key quality indicators (KQI) scenarios.
  • KQI video key quality indicators
  • the selected features are similar to some features in the video KQI scene, so it can be further expanded on the basis of this application, combining the business requirements of the video KQI scene to complete the customized business logic. More broadly, any scenario that needs to identify video traffic can be applied to the solution provided by this application.
  • FIG. 9 is a schematic structural diagram of a network traffic identification device according to an embodiment of the present invention.
  • the network traffic identification device 10 may include a first determination unit 101, a matching unit 102, and an identification unit 103. A detailed description is as follows.
  • a first determining unit 101 is configured to determine a transmission mode corresponding to a first network session, where the first network session is a data packet set having the same triplet information in a first period of time, and the triplet information includes a client's A source address, a destination address of the server, and a transport layer protocol between the client and the server, the transmission mode includes a behavior mode requested by the client to the server and / or the server Responding to the behavior mode of the client;
  • a matching unit 102 configured to determine a characteristic parameter matching the transmission mode
  • the identifying unit 103 is configured to determine a category to which the first network session belongs according to the characteristic parameter of the first network session and a preset characteristic parameter range.
  • the apparatus further includes:
  • the second determining unit 104 is configured to determine, before determining a transmission mode corresponding to the first network session, a network session including a preset field in network traffic as the first network session.
  • the first time period includes a second time period
  • the transmission mode includes a first transmission mode
  • the first network session includes a first network stream
  • the first network stream is A data packet set having the same quintuple information in the second time period, the quintuple information includes a source address and a source port of a client, a destination address and a destination port of a server, and the client and the service Transport layer protocol between the peers;
  • the first transmission mode includes: during the second time period, the client initiates a request to the server through the first network flow multiple times, and the server responds through the first network flow Multiple requests from the client.
  • the characteristic parameter includes a first characteristic parameter of each slice in a video traffic slice, and the first characteristic parameter includes: a size of a slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a first video feature parameter range;
  • the identification unit 104 is specifically configured to:
  • the server to the server in the first network flow is sent to the server.
  • the downlink data packets sent by the client are sliced, and the slices do not include the uplink data packets; determining whether the first feature parameter of each slice conforms to the first video feature parameter range; if the If the first characteristic parameters all meet, it is determined that the first network session is video traffic.
  • the characteristic parameter includes a first characteristic parameter of each slice in a video traffic slice, and the first characteristic parameter includes: a size of a slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a first video feature parameter range;
  • the identification unit 104 is specifically configured to:
  • the second time period periodically detecting an uplink data packet sent by the client to the server in the first network flow; if the uplink data packet satisfies a first preset periodic characteristic , Using the uplink data packet as a split point, slice the downlink data packet sent by the server to the client in the first network flow, and the slice does not include the uplink data packet; Whether the first characteristic parameter of each slice matches the first video characteristic parameter range; if the first characteristic parameter of each slice matches, it is determined that the first network session is video traffic.
  • the first time period includes a third time period
  • the transmission mode includes a second transmission mode
  • the first network session includes a plurality of second network streams, where each The two network flows are data packet sets with the same quintuple information in the third time period, and the triplet information of the data packets in the data packet sets corresponding to different second network flows is the same;
  • the second transmission mode includes: during the third time period, the client initiates multiple requests to the server through the plurality of second network flows, and the server sends the request through the multiple The second network flows respectively respond to requests corresponding to the clients.
  • the characteristic parameter includes a second characteristic parameter of each slice in the video traffic slice, and the second characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a second video feature parameter range;
  • the identification unit 104 is specifically configured to:
  • the server in the corresponding second network flow is divided. Slicing a downlink data packet sent to the client, the slice does not include the uplink data packet; determining whether the second characteristic parameter of each slice of the at least one second network flow meets the second Video feature parameter range; if the second feature parameter of each slice of any one of the at least one second network stream meets the second video feature parameter range, determine the first network Sessions are video traffic.
  • the characteristic parameter includes a second characteristic parameter of each slice in the video traffic slice, and the second characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a second video feature parameter range;
  • the identification unit 104 is specifically configured to:
  • the uplink data packets sent by the client to the server in the plurality of second network flows are periodically detected respectively.
  • the uplink data packet of at least one second network flow satisfies a second preset periodicity characteristic, and the uplink data packet is used as a dividing point to send the server to the client in the corresponding second network flow.
  • Slice the downlink data packets, the slice does not include the uplink data packets; determine whether the second characteristic parameter of each slice of the at least one second network stream conforms to the second video characteristic parameter range; if The second characteristic parameter of each slice of any one of the at least one second network flow conforms to the range of the second video characteristic parameter, and it is determined that the first network session is video traffic.
  • the first time period includes a fourth time period
  • the transmission mode includes a third transmission mode
  • the first network session includes a plurality of third network flows, where each The three network flows are data packet sets having the same quintuple information in the fourth time period, and the triplet information of the data packets in the data packet sets corresponding to different third network flows is the same;
  • the third transmission mode includes: during the fourth time period, the client initiates a request to the server through each third network flow of the plurality of third network flows, and The server responds to requests corresponding to the client through the multiple third network flows, respectively.
  • the characteristic parameter includes a third characteristic parameter of each slice in the video traffic slice;
  • the third characteristic parameter includes: a peak value of a slice rate, a slice duration, a slice size, and a slice At least one of an average rate and a numerical distribution of a network packet size in a slice;
  • the preset feature parameter range includes a third video feature parameter range;
  • the identification unit 104 is specifically configured to:
  • the first time period includes a fifth time period;
  • the transmission mode includes a fourth transmission mode;
  • the first network session includes a fourth network stream, and the fourth network stream is A data packet set with the same five-tuple information in the fifth time period;
  • the fourth transmission mode includes: within the fifth time period, the client initiates a request to the server through the fourth network traffic, and the server responds through the fourth network traffic The client's request.
  • the characteristic parameter includes a fourth characteristic parameter of each slice in the video traffic slice, and the fourth characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a fourth video feature parameter range;
  • the identification unit 104 is specifically configured to:
  • the first data packet is the one sent by the server to the client in the fourth network flow
  • the first network packet is used as a split point to the fourth network flow
  • the characteristic parameter includes a fourth characteristic parameter of each slice in the video traffic slice, and the fourth characteristic parameter includes: a size of the slice, an average rate of the slice, and a size of a network packet in the slice. At least one of a numerical distribution; the preset feature parameter range includes a fourth video feature parameter range;
  • the identification unit is specifically configured to:
  • a data packet in the flow that the server sends to the client is smaller than a second data packet, and the second data packet is the largest data packet in the fourth network flow
  • the first data packet satisfies a third preset periodic characteristic, slice the downlink data packet in the fourth network flow using the first data packet as a split point, and the slice does not include all The first data packet; detecting whether the fourth feature parameter of each slice conforms to the fourth video feature parameter range; and if they all match, determining that the first network session is video traffic.
  • FIG. 10 is a schematic structural diagram of another network traffic identification device according to an embodiment of the present invention.
  • the device 20 includes at least one processor 201, at least one memory 202, and at least one communication interface 203.
  • the device may also include common components such as antennas, which are not described in detail here.
  • the processor 201 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above program programs.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication interface 203 is configured to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Core Network, Wireless Local Area Networks (WLAN), and the like.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the memory 202 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions
  • the dynamic storage device can also be Electrically Erasable Programmable Read-Only Memory (EEPROM), Compact Disc (Read-Only Memory, CD-ROM) or other optical disk storage, optical disk storage (Including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by a computer Any other media accessed, but not limited to this.
  • the memory may exist independently and be connected to the processor through a bus. The memory can also be integrated with the processor.
  • the memory 202 is configured to store application program code that executes the foregoing solutions, and is controlled and executed by the processor 201.
  • the processor 201 is configured to execute application program code stored in the memory 202.
  • the code stored in the memory 202 may execute the network traffic identification method provided in FIG. 3 above, such as determining a transmission mode corresponding to a first network session, where the first network session is a data packet set having the same triplet information in the first time period.
  • the triplet information includes a source address of a client, a destination address of a server, and a transport layer protocol between the client and the server, and the transmission mode includes a request from the client to the server And / or the server responds to the behavior of the client; determine a characteristic parameter that matches the transmission mode; and determine the characteristic parameter according to the characteristic parameter of the first network session and a preset characteristic parameter range.
  • the category to which the first web session belongs such as determining a transmission mode corresponding to a first network session, where the first network session is a data packet set having the same triplet information in the first time period.
  • the triplet information includes a source address of a client, a destination address of a server, and a transport layer protocol between the client and the server, and
  • the disclosed device may be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the above units is only a logical function division.
  • multiple units or components may be combined or integrated.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, the indirect coupling or communication connection of the device or unit, and may be electrical or other forms.
  • the units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objective of the solution of this embodiment.
  • the functional units in the embodiments of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit.
  • the above integrated unit may be implemented in the form of hardware or in the form of software functional unit.
  • the technical solution of the present application is essentially a part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium It includes several instructions to enable a computer device (which may be a personal computer, a server, or a network device, and specifically a processor in the computer device) to perform all or part of the steps of the foregoing method in each embodiment of the present application.
  • a computer device which may be a personal computer, a server, or a network device, and specifically a processor in the computer device
  • the foregoing storage medium may include: a U disk, a mobile hard disk, a magnetic disk, an optical disk, a read-only memory (abbreviation: ROM), or a random access memory (Random Access Memory, abbreviation: RAM).
  • ROM read-only memory
  • RAM random access memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种网络流量识别方法及相关设备，该方法可包括：确定第一网络会话对应的传输模式，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，所述三元组信息包括客户端的源地址、服务端的目标地址、以及所述客户端和所述服务端之间的传输层协议，所述传输模式包括所述客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式；确定与所述传输模式匹配的特征参数；根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。采用本发明实施例可以提升网络流量的识别效率。

Description

一种网络流量识别方法及相关设备 技术领域
本发明涉及网络流量识别技术领域，尤其涉及一种网络流量识别方法及相关设备。
背景技术
随着移动互联网的发展，视频已经成为人们沟通与娱乐的主要承载形式，而高清化、多屏化、交互化、社交化、实时化也正成为消费者视频消费的主要需求。目前，互联网中在线视频流量是占比最大的部分，根据最近的预测报告显示，到2021年，在线视频(IP VOD与Internet Video)所产生的互联网流量将会占到互联网总流量的82％。
大量的视频业务为运营商带来丰厚的利润的同时，也在挑战运营商经营视频业务的能力。通常来说，评价运营商服务质量(Quality of Service，QoS)的重要指标包括带宽、时延、网络稳定性等相关指标，而视频业务质量的优劣正是和这几项指标强相关。因此，对于广大普通用户而言，通过视频业务质量的好坏来评价运营商网络服务质量水到渠成。目前，视频服务的体验质量(Quality of Experience，QoE)已经成为评价运营商QoS的事实标准。
视频流量的识别与管理能力是衡量运营商网络服务质量的重要指标，为了更好地管理网络，运营商需要准确地识别域内的视频流量。网络流量分类作为增强网络可控性的基础技术之一，可以帮助研究人员和运维人员了解网络上的流量及应用分布，允许网络运营商基于应用类型等信息自定义流量的传输优先级，有效地管理网络并且阻止网络犯罪行为的发生。目前，运营商主要依赖网络流量分类技术及其相关产品进行流量识别与管理。网络流量分类技术的原理是通过对网络流量的深入分析，向上层呈在线流量识别络流量不同层级的特定属性，通常包括应用信息、服务信息、内容特性等。
然而，现有技术中，应用市场中相关的视频应用数量及种类极多，且普遍更新频繁，部分视频类应用甚至逐步开始加密。这些特点给视频流量分类问题带来了巨大的困难，因此如何提供一种有效的视频流量分类方案，提高分类的性能和准确率，是亟待解决的问题。
发明内容
本发明实施例提供一种网络流量识别方法及相关设备，以提升网络流量识别效率和准确率。
第一方面，本发明实施例提供了一种网络流量识别方法，可包括：
确定第一网络会话对应的传输模式，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，所述三元组信息包括客户端的源地址、服务端的目标地址、以及所述客户端和所述服务端之间的传输层协议，所述传输模式包括所述客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式；确定与所述传输模式匹配的特征参数；根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。本发明实施例通过在网络流量的识别方法中，首先确定网络会话所对应的客户端和服务端之间的交互行为模式，然后再确定该网络会话在确定的交互行为模式下对应的特征参数，最终根据该特征参数与预设的特征参数范围的比对结果，确定该网络会话 的所属类型。由于客户端和服务端之间不同的交互行为模式其对应的部分特征参数可能相差较大，因此，本发明实施例通过首先确认网络会话的传输模式，再有针对性的确定该传输模式对应的特征参数，最终精准的识别网络会话的类型，提升了网络流量的识别效率和准确率。
在一种可能的实现方式中，所述确定第一网络会话对应的传输模式之前，还包括；将网络流量中包含预设字段的网络会话确定为所述第一网络会话。本发明实施例通过在确定第一网络会话之前，从网络流量中按照一定条件，筛选出满足条件的网络会话为第一网络会话，可以快速排除大部分不满足条件的网络会话，有效提升了识别指定类型的网络会话的识别效率。
在一种可能的实现方式中，所述第一时间段包括第二时间段；所述传输模式包括第一传输模式，所述第一网络会话包括第一网络流，所述第一网络流为在所述第二时间段内五元组信息相同的数据包集合，所述五元组信息包括客户端的源地址和源端口、服务端的目标地址和目标端口、以及所述客户端和所述服务端之间的传输层协议；所述第一传输模式包括：在所述第二时间段内，所述客户端通过所述第一网络流多次向所述服务端发起请求，所述服务端通过所述第一网络流响应所述客户端的多次请求。本发明实施例提供了一种应用于视频流量识别场景中针对网络会话的传输模式的分类，该传输模式下视频流单网络流承载，客户端向服务器发起多次请求，可以适用于识别长视频的点播场景。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：在所述第二时间段内，以所述第一网络流中所述客户端向所述服务端发送的上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断每个切片的所述第一特征参数是否符合所述第一视频特征参数范围；若所述每个切片的所述第一特征参数均符合，则确定所述第一网络会话为视频流量。本发明实施例提供了一种当确定第一网络会话为上述第一传输模式时，如何获取第一网络会话所匹配的特征参数，并与预设视频特征参数范围进行比对，最终确定该第一网络会话是否为视频流量的方案。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：在所述第二时间段内，对所述第一网络流中所述客户端向所述服务端发送的上行数据包进行周期性检测；若所述上行数据包满足第一预设周期性特征，则以所述上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断每个切片的所述第一特征参数是否符合所述第一视频特征参数范围；若所述每个切片的所述第一特征参数均符合，则确定所述第一网络会话的流量类别为视频流量。本发明实施例提供了另一种当确定第一网络会话为上述第一传输模式时， 如何获取第一网络会话所匹配的特征参数，并与预设视频特征参数范围进行比对，最终确定该第一网络会话是否为视频流量。
在一种可能的实现方式中，所述第一时间段包括第三时间段；所述传输模式包括第二传输模式；所述第一网络会话包括多个第二网络流，其中，每一个第二网络流为在所述第三时间段内五元组信息相同的数据包集合，且不同第二网络流对应的数据包集合中的数据包的所述三元组信息相同；所述第二传输模式包括：在所述第三时间段内，所述客户端通过所述多个第二网络流分别多次向所述服务端发起请求，且所述服务端通过所述多个第二网络流分别响应所述客户端对应的请求。本发明实施例提供了另一种应用于视频识别场景中针对网络会话的传输模式的分类，该传输模式下视频流多网络流承载，客户端通过多网络流分别多次向服务器发起请求，可以适用于识别实时性要求高的长视频的点播场景。
所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：在所述第三时间段内，分别以所述多个第二网络流中所述客户端向所述服务端发送的上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断所述至少一个第二网络流的每个切片的所述第二特征参数是否符合所述第二视频特征参数范围；若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。本发明实施例提供了一种当确定第一网络会话为上述第二传输模式时，如何获取第一网络会话所匹配的特征参数，并与预设视频特征参数范围进行比对，最终确定该第一网络会话是否为视频流的方案。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：在所述第三时间段内，分别对所述多个第二网络流中所述客户端向所述服务端发送的上行数据包进行周期性检测；若所述多个第二网络流中的至少一个第二网络流的所述上行数据包满足第二预设周期性特征，则以所述上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断所述至少一个第二网络流的每个切片的所述第二特征参数是否符合所述第二视频特征参数范围；若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。本发明实施例提供了另一种当确定第一网络会话为上述第二传输模式时，如何获取第一网络会话所匹配的特征参数，并与预设视频特征参数范围进行比对，最终确定该第一网络会话是否为视频流的方案。
在一种可能的实现方式中，所述第一时间段包括第四时间段；所述传输模式包括第三传输模式；所述第一网络会话包括多个第三网络流，其中，每一个第三网络流为在所述第 四时间段内五元组信息相同的数据包集合，且不同第三网络流对应的数据包集合中的数据包的所述三元组信息相同；所述第三传输模式包括：在所述第四时间段内，所述客户端通过所述多个第三网络流中的每个第三网络流分别向所述服务端发起一次请求，且所述服务端通过所述多个第三网络流分别响应所述客户端对应的请求。本发明实施例提供了又一种应用于视频识别场景中针对网络会话的传输模式的分类，该传输模式下视频流多网络流承载，客户端每流仅向服务器发起一次请求，可以适用于识别实时性要求高的短视频的点播场景。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第三特征参数；所述第三特征参数包括：切片的速率峰值、切片的时长、切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第三视频特征参数范围；
所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：将所述多个第三网络流中的每一个第三网络流中所述服务端发送给所述客户端的下行数据包作为一个切片；判断每个切片的所述第三特征参数是否符合所述第三视频特征参数范围；若所述每个切片的所述第三特征参数均符合，则确定所述第一网络会话为视频流量。本发明实施例提供了一种当第一网络会话为上述第三传输模式时，如何获取第一网络会话所匹配的特征参数，并与预设视频特征参数范围进行比对，最终确定该第一网络会话是否为视频流。
在一种可能的实现方式中，所述第一时间段包括第五时间段；所述传输模式包括第四传输模式；所述第一网络会话包括第四网络流，所述第四网络流为在所述第五时间段内所述五元组信息相同的数据包集合；所述第四传输模式包括：在所述第五时间段内，所述客户端通过所述第四网络流量向所述服务端发起一次请求，且所述服务端通过所述第四网络流量响应所述客户端的请求。本发明实施例提供了又一种应用于视频识别场景中针对网络会话的传输模式的分类，该传输模式下视频流单网络流承载，客户端仅向服务器发起一次请求，可以适用于识别视频直播场景。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：在所述第五时间段内，确定所述第四网络流中的第一数据包，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；若均符合，则确定所述第一网络会话为视频流量。本发明实施例提供了一种当确定第一网络会话为上述第四传输模式时，如何获取第一网络会话所匹配的特征参数，并与预设视频特征参数范围进行比对，最终确定该第一网络会话是否为视频流的方案。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第四特征参 数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：在所述第五时间段内，确定所述第四网络流中的第一数据包，并对所述第一数据包进行周期性检测，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；若所述第一数据包满足第三预设周期性特征，则以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；若均符合，则确定所述第一网络会话的流量类别为视频流量。本发明实施例提供了另一种当确定第一网络会话为上述第四传输模式时，如何获取第一网络会话所匹配的特征参数，并与预设视频特征参数范围进行比对，最终确定该第一网络会话是否为视频流的方案。
第二方面，本发明实施例提供了一种网络流量识别装置，可包括：
第一确定单元，用于确定第一网络会话对应的传输模式，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，所述三元组信息包括客户端的源地址、服务端的目标地址、以及所述客户端和所述服务端之间的传输层协议，所述传输模式包括所述客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式；
匹配单元，用于确定与所述传输模式匹配的特征参数；
识别单元，用于根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。
本发明实施例通过在网络流量识别装置中，首先通过第一确定单元确定网络会话所对应的客户端和服务端之间的交互行为模式，然后再通过匹配单元确定该网络会话在确定的交互行为模式下对应的特征参数，最终通过识别单元根据该特征参数与预设的特征参数范围的比对结果，确定该网络会话的所属类型。由于客户端和服务端之间不同的交互行为模式其对应的部分特征参数可能相差较大，因此，本发明实施例中的网络流量识别装置通过首先确认网络会话的传输模式，再有针对性的确定该传输模式对应的特征参数，最终精准的识别网络会话的类型，提升了网络流量的识别效率和准确率。
在一种可能的实现方式中，所述装置还包括；
第二确定单元，用于确定第一网络会话对应的传输模式之前，将网络流量中包含预设字段的网络会话确定为所述第一网络会话。
在一种可能的实现方式中，所述第一时间段包括第二时间段；所述传输模式包括第一传输模式，所述第一网络会话包括第一网络流，所述第一网络流为在所述第二时间段内五元组信息相同的数据包集合，所述五元组信息包括客户端的源地址和源端口、服务端的目标地址和目标端口、以及所述客户端和所述服务端之间的传输层协议；
所述第一传输模式包括：在所述第二时间段内，所述客户端通过所述第一网络流多次向所述服务端发起请求，所述服务端通过所述第一网络流响应所述客户端的多次请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第一特征参 数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；
所述识别单元，具体用于：
在所述第二时间段内，以所述第一网络流中所述客户端向所述服务端发送的上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断每个切片的所述第一特征参数是否符合所述第一视频特征参数范围；若所述每个切片的所述第一特征参数均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；
所述识别单元，具体用于：
在所述第二时间段内，对所述第一网络流中所述客户端向所述服务端发送的上行数据包进行周期性检测；若所述上行数据包满足第一预设周期性特征，则以所述上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断每个切片的所述第一特征参数是否符合所述第一视频特征参数范围；若所述每个切片的所述第一特征参数均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述第一时间段包括第三时间段；所述传输模式包括第二传输模式；所述第一网络会话包括多个第二网络流，其中，每一个第二网络流为在所述第三时间段内五元组信息相同的数据包集合，且不同第二网络流对应的数据包集合中的数据包的所述三元组信息相同；
所述第二传输模式包括：在所述第三时间段内，所述客户端通过所述多个第二网络流分别多次向所述服务端发起请求，且所述服务端通过所述多个第二网络流分别响应所述客户端对应的请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；
所述识别单元，具体用于：
在所述第三时间段内，分别以所述多个第二网络流中所述客户端向所述服务端发送的上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断所述至少一个第二网络流的每个切片的所述第二特征参数是否符合所述第二视频特征参数范围；若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；
所述识别单元，具体用于：
在所述第三时间段内，分别对所述多个第二网络流中所述客户端向所述服务端发送的上行数据包进行周期性检测；若所述多个第二网络流中的至少一个第二网络流的所述上行数据包满足第二预设周期性特征，则以所述上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断所述至少一个第二网络流的每个切片的所述第二特征参数是否符合所述第二视频特征参数范围；若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述第一时间段包括第四时间段；所述传输模式包括第三传输模式；所述第一网络会话包括多个第三网络流，其中，每一个第三网络流为在所述第四时间段内五元组信息相同的数据包集合，且不同第三网络流对应的数据包集合中的数据包的所述三元组信息相同；
所述第三传输模式包括：在所述第四时间段内，所述客户端通过所述多个第三网络流中的每个第三网络流分别向所述服务端发起一次请求，且所述服务端通过所述多个第三网络流分别响应所述客户端对应的请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第三特征参数；所述第三特征参数包括：切片的速率峰值、切片的时长、切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第三视频特征参数范围；
所述识别单元，具体用于：
将所述多个第三网络流中的每一个第三网络流中所述服务端发送给所述客户端的下行数据包作为一个切片；判断每个切片的所述第三特征参数是否符合所述第三视频特征参数范围；若所述每个切片的所述第三特征参数均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述第一时间段包括第五时间段；所述传输模式包括第四传输模式；所述第一网络会话包括第四网络流，所述第四网络流为在所述第五时间段内所述五元组信息相同的数据包集合；
所述第四传输模式包括：在所述第五时间段内，所述客户端通过所述第四网络流量向所述服务端发起一次请求，且所述服务端通过所述第四网络流量响应所述客户端的请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；
所述识别单元，具体用于：
在所述第五时间段内，确定所述第四网络流中的第一数据包，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；若均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；
所述识别单元，具体用于：
在所述第五时间段内，确定所述第四网络流中的第一数据包，并对所述第一数据包进行周期性检测，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；
若所述第一数据包满足第三预设周期性特征，则以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；若均符合，则确定所述第一网络会话为视频流量。
第三方面，本发明实施例提供一种网络设备，该网络设备中包括处理器，处理器被配置为支持该网络设备实现第一方面提供的网络流量识别方法中相应的功能。该网络设备还可以包括存储器，存储器用于与处理器耦合，其保存该网络设备必要的程序指令和数据。该网络设备还可以包括通信接口，用于该网络设备与其他设备或通信网络通信。
第四方面，本发明实施例提供一种计算机存储介质，用于储存为上述第二方面提供的一种网络流量识别装置中的处理器中所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第五方面，本发明实施例提供了一种计算机程序，该计算机程序包括指令，当该计算机程序被计算机执行时，使得计算机可以执行上述第二方面中的网络流量识别装置中的处理器所执行的流程。
第六方面，本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持网络设备实现上述第一方面中所涉及的功能，例如，生成或处理上述网络流量识别方法中所涉及的信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存数据发送设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
附图说明
为了更清楚地说明本发明实施例或背景技术中的技术方案，下面将对本发明实施例或背景技术中所需要使用的附图进行说明。
图1是本发明实施例提供的一种网络构架示意图。
图2是本发明实施例提供的一种流量监控设备的结构示意图。
图3是本发明实施例提供的一种网络流量识别方法的流程示意图。
图4是本发明实施例提供的一种传输模式判断流程示意图。
图5是本发明实施例提供的一种第一传输模式时序示意图。
图6是本发明实施例提供的一种第二传输模式时序示意图。
图7是本发明实施例提供的一种第二传输模式时序示意图。
图8是本发明实施例提供的一种第四传输模式时序示意图。
图9是本发明实施例提供的一种网络流量识别装置的结构示意图。
图10是本发明实施例提供的另一种网络流量识别装置的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例进行描述。
本申请的说明书和权利要求书及所述附图中的术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在2个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
首先，对本申请中的部分用语进行解释说明，以便于本领域技术人员理解。
(1)网际协议(Internet Protocol，IP)，是在TCP/IP协议中网络层的主要协议，任务是仅仅根据源主机和目的主机的地址传送数据。
(2)视频点播(Video on Demand，VOD)，是一套可以让用户通过网络选择自己想要看的视频内容的系统。用户选定内容后，视频点播系统可以用流媒体的方式进行即时播放，也可以将内容完全下载后再进行播放。
(3)传输层安全协议(Transport Layer Security，TLS)，是确保在通信应用程序与互联网用户间提供数据保密性的协议。
(4)安全壳(Secure Shell，SSH)为一项创建在应用层和传输层基础上的安全协议，为计算机上的Shell(壳层)提供安全的传输和使用环境。
(5)互联网安全协议(Internet Protocol Security，IPSec)，是一个协议组合，透过对IP协议的分组进行加密和认证来保护IP协议的网络传输协议族(一些相互关联的协议的集合)。
(6)服务端名称指示(Server Name Indication，SNI)，是一个扩展的TLS计算机联网协议，在该协议下，在握手过程开始时通过客户端告诉它正在连接的服务端的主机名称。
(7)内容分发网络(Content Delivery Network，CDN)，指一种通过互联网互相连接的电脑网络系统，利用最靠近每位用户的服务端，更快、更可靠地将音乐、图片、视频、应用程序及其他文件发送给用户，来提供高性能、可扩展性及低成本的网络内容传递给用户。
(8)过顶服务(Over-The-Top，OTT)，通常是指内容或服务建构在基础电信服务之上从而不需要网络运营商额外的支持。
(9)在线视频，泛指通过网络以非下载方式观看的视频，具体可以包括视频点播与视频直播。
(10)流量分类：通过监听、抓取、拷贝等手段获取网络通信报文，并对其进行解析、重组、切分等，还原其原本通信内容的操作，以了解网络通信双方的即时状态。
(11)明文特征：传输报文中能够被直接解析得到的字符或数字组成的特征，区别于加密特征。
(12)网络流，也可简称为网流，在一段时间内具有相同五元组的数据包的集合称为一条网络流，其中五元组包含通信双方的源IP地址、源端口号、目的IP地址、目的端口号以及传输层协议。
(13)网络会话，是多条网络流的集合，多条网络流具有相同的三元组(源地址，目的地址，传输层协议)。
首先，分析并提出本申请所具体要解决的技术问题。在现有技术中，关于网络流量识别(以视频流量识别为例)的技术，包括如下方案一和方案二：
方案一：基于应用特征的流量识别方法，具体可以包括如下步骤1和步骤2。
步骤1、基于应用特征识别出应用类型并判断该应用内是否可能包括视频流量。
步骤2、针对可能包括视频流量的应用进一步做服务细分，判断待识别流量是否为视频流量。
该方案一通常用于基于应用特征的视频流量识别方案，目前主要适用于非加密应用以及采用标准加密协议的应用的识别场景。但存在以下多个缺点：
缺点1：逐个应用分析生成应用特征，人力成本极高。如上所述，在使用基于应用的视频流量识别方法时，需要分析应用特点进而生成应用特征规则。目前应用特征的分析与规则生成大量依赖人力，通常包括抓取特定应用的纯净流量、分析应用格式并与其它类似应用比对确定应用特征、基于特定语法描述应用特征规则等几个完全依赖人力的步骤。
缺点2：应用更新易导致特征变化，造成漏报或误报。如上所述，视频应用为了向用户提供更好的体验，不断的对其业务进行优化更新，因此使得视频类应用普遍更新频繁。应用的更新为流量识别带来了不确定性，从特征规则变化导致识别失效，至重新生成特征规则恢复识别能力，通常最少需要1天到3天的时间。在此期间，由于特征规则失效，会造成漏报或误报，给运营商带来高额的经济损失。此外，为了能尽快定位到失效的应用特征规则，还需要建立相应的监测机制，不断测试规则的有效性，给系统带来了额外的开销。
缺点3：部分加密应用流量无法细分是否为视频流量。如上所述，基于应用特点生成的特征规则依赖应用的明文特征。当前视频类应用逐步过渡至使用加密协议传输，目前主流的加密方式是采用TLS协议。在TLS协议中，原始的应用层信息被加密，仅暴露部分用于建立TLS连接的明文字段，其中具有显著应用特点的字段主要为服务名称指示(Server Name Indication，SNI)和证书名称(Certificate Name)。目前针对基于TLS协议的应用的识别方法均依赖这部分明文字段，然而对于部分包含多种服务的应用，其不同服务可能具有相同的SNI和Certificate Name。在这种情况下，无法准确细分不同的服务类型，因此会导致无法准确的识别视频流量。
方案二：基于行为特征的流量识别方法，具体可以包括如下步骤1。
步骤1、基于视频服务自身的行为特点，直接识别网络流量是否为视频流。其中，视频的行为特点通常由传输速率、平均包长度、流持续时间等维度描述。而难以提取应用特征的视频流量，则需要基于启发式规则或机器学习算法生成识别模型。不同的网络服务在一些流量的统计量上具有一定的差异性，例如平均包长度、平均流持续时间、平均速率等。
上述方案二目前主要适用于采用私有加密协议的应用的识别场景，但是也存在以下多个缺点：
缺点1：现有的行为特征描述方法大多依赖全流特征，不适合在线流量识别业务。例如，描述网络流量行为特征的统计量，包括平均流持续时间、平均速率等，这些特征需要缓存或统计一条网络流的全流信息，因此流量识别的结果需要等到网络流传输结束才可得到，或需要网络流传输较长的一段时间。然而，在一些场景中，对于运营商来说，视频流量的识别通常用于运营商的网络优化等业务，需要在网络流传输的早期给出识别结果，因此使用全流特征不适合在线流量识别业务的开展。
缺点2：现有的行为特征描述方法对视频流量的行为特点刻画不准确。由于视频类应用种类繁多，包括纯视频类应用和内嵌视频类应用、点播类视频和直播类视频等多种类型。未加区分地看待多种不同类型的视频应用，容易淹没其具有代表性的行为特点，导致特征刻画不准确，最终使得识别的准确率不高，无法满足实际的使用要求。
为了解决当前视频流量识别技术不满足实际业务需求的问题，达到准确识别在线视频流量从而提高运营商视频服务能力的目标，综合考虑现有技术存在的缺点，本申请实际要解决的技术问题包括如下几方面：
1、稳定的视频流量特征(方案一的缺点1和3)。基于应用特征的视频流量识别方案目前广泛应用，部分解决了视频流量的识别问题。然而，由于每种应用特征规则的提取严重依赖人工介入，因此当应用特征规则发生变化时，往往由于需要人工定位，导致特征规则的更新不及时，使得在线流量识别业务受到影响。一般情况下，应用特征规则的更新慢于应用特征的真实变化约一周左右，期间需要专人分析应用的流量，提取新的特征规则，人力成本较高。因此，需要提出一种稳定的视频流量特征，能够反应视频业务真实的特点，降低应用级别更新对视频流量识别的影响。
2、精确的视频场景定位(方案一的缺点2、方案二的缺点2)。基于应用特征的视频流量识别方案目前主要适用于非加密应用以及采用标准加密协议的应用的识别场景，基于行为特征的视频流量识别方案目前主要适用于采用私有加密协议的应用的识别场景。然而， 在实际业务中，无法提前预知待识别流量为何种类型，无法灵活判断。当前业界普遍使用基于应用特征的识别方案，然而，在加密场景下，以及部分复杂的非加密场景下，由于内容分发网络(Content Delivery Network，CDN)的广泛使用、应用内部复杂的服务调用逻辑等原因，导致包含多种不同类型服务的应用的流量难以准确区分。因此，需要一种精确的视频场景定位能力，直击真实的视频流量特点，提高视频流量识别的准确率。
3、高效的流量识别机制(方案二的缺点1)。现有的基于行为特征的视频流量识别方案主要依赖全流特征描述网络流量的行为特点，并不适用于运营商真实的网络业务。虽然视频流量相比于其它类型的业务来说，流持续时间较长，因此可以接受相对较长的流量识别时间，然而，对于运营商来说，为了达到优化视频业务的目的，所需的识别时间越短越好。因此，需要一种高效的视频流量识别机制，降低视频流量识别所需的时间。
综上所述，现有的识别方案无法满足运营商实际的视频流量识别需求，严重影响其开展基于视频的定制化服务。因此，在本申请提供的网络流量识别方法用于解决上述技术问题。
为了便于理解本发明实施例，以下示例性列举本申请中网络流量识别方法所应用的场景，可以包括如下三个场景：
场景一，允许运营商针对特定应用的流量进行识别，生成针对特定应用的优惠套餐：
为了更好的推广视频业务，增大营收，运营商通常有选择地针对视频业务推出特定的业务套餐。常见的套餐类型包括不限应用的视频套餐和特定应用的视频套餐等。不限应用的视频套餐，是指用户在办理该套餐后，在观看互联网视频时，不再额外收取流量费用；特定应用的视频套餐，是指用户在办理该套餐后，使用该指定的视频应用时不再额外收取流量费用，此外，其它视频应用的带宽保障级别可能会相对较低，以此保护运营商的网络。因此，当前运营商为了在视频领域增收，需要依赖网络流量分类技术，识别并管理视频流量。
场景二，允许网络运营商基于应用类型等自定义流量的传输优先级：
运营商可以按照自定义的优先级传输指定应用类型的网络流量，以保证该优先级下应用类型的QoS和QoE。例如，会根据用户所办理的某个套餐的中，享受指定应用类型的较高级别的带宽保障服务，而其它类型的应用的保障级别可能会相对较低。因此，只有准确的识别出来了网络流量的类型，才能更好地基于该网络流量的类型进行针对性的质量控制。
场景三，帮助研究人员和运维人员了解网络上的流量及应用分布：
有效的区分网络上的视频、音频、图片、文字、下载或者其它类型的流量分布，可以帮助研究人员和运维人员了解网络上的流量及应用分布，以进行数据挖掘。例如，了解不同地区、不同用户的兴趣爱好，和娱乐、工作、学习以及生活需求等。
可以理解的是，上述三种应用场景的只是本发明实施例中的几种示例性的实施方式，本发明实施例中的应用场景包括但不仅限于以上应用场景。
基于上述提出的技术问题以及本申请中对应的应用场景，也为了便于理解本发明实施例，下面先对本发明实施例所基于的其中一种网络架构进行描述。请参阅图1，图1是本 发明实施例提供的一种网络构架示意图。本申请中的客户端可以包括图1中的移动终端001、互联网终端002和相关网络连接设备(图1中以接入网关003为例)，其中，互联网终端002通过接入网关003连接到流量监控设备004，移动终端001则可以通过互联网终端002中的无线接入设备(如无线路由器、基站等)再通过接入网关003连接到流量监控设备004；服务端可以包括图1中的流量监控设备004、数据中心005、互联网006以及相关的网络连接设备(图1中以接入网关002和路由器007为例)，流量监控设备004通过路由器007连接到互联网，数据中心005则通过接入网关002连接到互联网006。其中
移动终端001，可以是支持无线移动通信视频业务的蜂窝电话、无绳电话、智能手机(mobile phone)、会话启动协议(Session Initiation Protocol，SIP)电话、无线本地环路(Wireless Local Loop，WLL)站、智能手环、智能穿戴设备、MP3播放器(Moving Picture Experts Group Audio Layer III，动态影像专家压缩标准音频层面3)、MP4(Moving Picture Experts Group Audio Layer IV，动态影像专家压缩标准音频层面3)播放器、个人数字处理(Personal Digital Assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备等。移动终端001还可以是平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(Virtual Reality，VR)终端设备、增强现实(Augmented Reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。
互联网终端005，互联网终端通过本地网络连到接入网关，接入网关负责将互联网终端连接至互联网，互联网终端可包括个人电脑(Personal Computer，PC)，无线接入设备(如无线路由器、基站等)、服务器(Server)，工作站(Workstation)等。
流量监控设备004，为本申请提供的监控设备，用于通过对网络流量进行处理分析，得到流量的识别结果，以执行并实现本申请中的网络流量识别方法的相关实施例。可选地，流量监控设备还可以根据用户设置、输出流量识别的统计结果，或按照识别结果对数据包进行重新路由、丢弃，或者对网络流进行限速等具体操作。
数据中心(Internet Data Center，IDC)005，用于安置计算机系统及相关计算设施，可以存储并提供各种类型业务的数据。
网络连接设备，可包括接入网关002和路由器007，其中，接入网关007用于将用户数据发送到骨干网的路由器上，互联网上的各种服务端(如数据中心005)也通过接入网关007连入骨干网的路由器。并且，本申请中的接入网关作为所辖网络的出入口，除了内外网络之间的协议转换等工作外，还需要与流量监控设备连接，并负责网络的计费、管理、报表等。路由器002则用于将流量监控设备连接至互联网。
本发明中的网络流量识别方法可以适用于基于HTTP的自适应码率的国际标准组MPEG制定的技术标准(Dynamic Adaptive Streaming over HTTP，DASH)和动态码率自适应技术(HTTP Live Streaming，HLS)传输机制。
可以理解的是，图1中的网络架构只是本发明实施例中的一种示例性的实施方式，本发明实施例中的网络包括但不仅限于以上网络架构。
基于上述网络架构，本发明实施例提供一种应用于上述网络架构中的流量监控设备004，请参见图2，图2是本发明实施例提供的一种流量监控设备的结构示意图，该流量监控设备004可包括管理配置控制模块4001、对称多处理(Symmetrical Multi-Processing，SMP)模块4002、内存管理模块4003、解析模块4004、过滤模块4005以及业务匹配逻辑模块4006。其中，
管理配置模块4001，用于负责规则的管理，例如服务端的管理者可以业务需求(包括本申请中的网络流量识别业务或者视频流量识别业务)增加、删除、修改、查看相关的规则文件。
对称多处理SMP模块4002，用于调度多中央处理器(Central Processing Unit，CPU)并行处理网络中的并发网络流量。
内存管理模块4003，用于网络流量识别业务中相关网络流的生命周期管理，包括相关变量的申请和释放等。
解析模块4004，用于从内存中读取数据流(包括本申请中的第一网络会话)，并按照报文的协议格式解析，主要处理传输层以上的协议。
过滤模块4005，用于从管理模块读入规则，将解析过后的流量用规则进行过滤，为业务识别模块提供分流的功能。并可以基于该过滤模块实现本申请中的网络流量识别方法中的第一阶段可疑流量过滤功能，例如，可以根据该过滤模块将网络流量中包含预设字段的网络会话确定为所述第一网络会话。
业务匹配逻辑模块4006，用于处理本申请的网络流量识别方法中第一网络会话的传输模式的确定，以及第一网络会话所属的类别的确定的相关过程。具体可以包括行为识别(即传输模式识别)、特征识别和内容识别等。由于不同情况下的第一网络会话的可能对应不同的识别结果，因此，业务匹配逻辑模块中还需要提供一个状态自动机判断命中不同规则的情况下，分别对应的具体匹配结果。
可以理解的是，图2中的流量监控设备的结构只是本发明实施例中的一种示例性的实施方式，本发明实施例中的流量监控设备的结构包括但不仅限于以上结构。
基于图1提供的网络架构，以及图2提供的流量监控设备的结构，结合本申请中提供的网络流量识别方法，对本申请中提出的技术问题进行具体分析和解决。
参见图3，图3是本发明实施例提供的一种网络流量识别方法的流程示意图，该方法可应用于上述图1中所述的网络架构中，其中的流量监控设备004可以用于支持并执行图3中所示的方法流程步骤S301-步骤S305。下面将结合附图3从服务端的流量监控设备侧进行描述。该方法可以包括以下步骤S301-步骤S303，可选的还可以包括步骤S300。
步骤S301：确定第一网络会话对应的传输模式。
具体地，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，其中，三元组信息包括客户端的源地址、服务端的目标地址、以及客户端和服务端之间的传输层协议，数据包集合则可以包括上行数据包和下行数据包。也即是将一段连续的时间段内客户端和服务端之间的源地址和目标地址以及传输协议相同的上行/下行数据包的集合作为第一网络会话。传输模式则包括客户端向服务端请求的行为模式和/或服务端响应客户端的 行为模式，其中，请求的行为模式可以包括客户端向服务端请求的次数、时间点以及是否为周期性；响应的行为模式可以包括服务端向客户端响应网络流量的承载方式，即是多网络流承载还是单网络流承载。
而关于流量监控设备具体如何确定第一网络会话对应的请求的行为模式和/或响应的行为模式，可以参见图4，图4为本发明实施例提供的一种传输模式判断流程示意图，流量监控设备004可通过业务匹配逻辑模块4006判断网络流对应的传输模式。由于网络流中的数据包是按时间先后顺序依次到达流量监控设备004的，并且网络监控设备004无法存储网络流量的数据包，因此，传输模式的判断是流式进行的。
对于传输模式待定的网络流，当数据包到达流量监控设备004时，首先判断该数据包是否为上行数据包，如果当前数据包为上行数据包，且已有多个上行数据包到达，则可判断出当前网络流的行为模式中包含了客户端向服务端发起了多次请求的行为(例如后述的第一传输模式或第二传输模式)，比如，在视频流量的应用场景中上行数据包一般为客户端发起的请求数据包。
如果当前数据包为上行数据包，且仅有当前数据包为上行数据包，则传输模式待定，继续观察后续数据包；如果后续观察到数据包不是上行数据包，即为下行数据包，若当前已超过允许的最大检测时间(例如为本申请中的第二时间段、第三时间段、第四时间段或第五时间段)，则判断出当前网络流的行为模式中包含了客户端仅向服务端发起一次请求的行为(例如后述的第四传输模式)；进一步地，如果当前数据包为下行数据包且为非满包，则进一步判断当前下行数据包的累积长度是否已超过预先设定的阈值，如果下行到达的数据包的累计长度超过了预先设定的阈值，则可判断当前网络流的行为模式中包含了客户端仅向服务端发起一次请求的行为(例如后述的第三传输模式或第四传输模式)。
需要说明的是，非满包和满包在物理意义上的主要区别是其在网络流中的位置。由于网络对于其上允许传输的单个数据包大小是有最大上限的，即最大传输单元，超过该限制的数据块会被分割为多个数据包共同传输，例如最大传输单元限制为1000字节，那么传输一段5600字节的数据块，需要使用5个1000字节的数据包，和一个600字节的数据包，这里600字节的数据包就是非满包，它的物理意义是传输内容的结尾，所以在本申请中用非满包来作为切片的分割边界。
以上示例的流程中，需要注意的是，由于该流程讨论的是网络流级别(五元组信息相同)的传输模式检测，因此无法区分第一传输模式的网络流与第二传输模式的网络流，也无法确认疑似的第三传输模式。在网络会话(三元组信息相同)级别，如果同一网络会话下包含多个疑似第一/第二传输模式的网络流，则确认为第二传输模式；如果仅包含一个疑似第一/第二传输模式的网络流，则确认为第一传输模式；如果同一网络会话下包含多个疑似第三传输模式的网络流，则确认为第三传输模式；如果仅包含一个疑似第三传输模式的网络流，则当整个检测流程超过最大检测时间时(例如为本申请中的第二时间段、第三时间段、第四时间段或第五时间段)，确认为第四传输模式。
步骤S302：确定与所述传输模式匹配的特征参数。
具体地，本发明实施例中，根据不同的传输模式的特点匹配有不同的更为聚焦的特征参数，以更精准的识别出对应传输模式下的网络流量的所属类别。可以理解的是，该特征 参数可以是多个参数构成的集合，也可以是多个参数集合构成的集合。本发明实施例对此不作具体限定，只要可以体现对应传输模式下的相应视频类型的特征的参数即可。
步骤S303：根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。
具体地，流量监控设备计算第一网络会话的传输模式所匹配的特征参数，并将计算确定的特征参数与预设特征参数范围进行比对，以最终确定第一网络会话的类别。其中，预设特征参数范围可以是多个预设特征参数范围组成的集合，也可以是列表形式或映射关系表等，本发明实施例对此不作具体限定。
可选地，当上述方法步骤S301-S303应用于视频流量识别时，由于在视频的播放请求以及响应过程中，是有一些固定的模式。在客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式中，例如点播电影，通常用户可能只会点击一次播放按钮，但由于现有的在线视频播放机制，实际上客户端的后台可能会周期性向服务端请求视频的分片，即会通过客户端多次向服务器发起请求，而服务端则可以通过单网络流或者多网络流的方式向客户端进行视频数据包的多次反馈；而对于直播视频，用户可能仅会通过客户端向服务端发起一次请求，而考虑到直播的流畅性，服务端则通常通过单网络流向客户端进行视频数据的反馈；对于小视频而言，用户可能会在很短的时间段内连续点击观看完多个小视频，所以用户每个网络流仅向服务端发起一次请求，因此一个时间段内多个小视频则会有多次请求，而服务端则会通过相对应的多个网络流反馈不同的请求。因此，当确定了视频所对应的传输模式之后，再根据该传输模式下的视频网络流的特有的特征来识别网络会话是否为视频流量，识别效率和准确率则会大大提升。
可选地，在上述步骤S301执行之前，还可以包括以下步骤S304：
步骤S300：将网络流量中包含预设字段的网络会话确定为所述第一网络会话。
具体地，流量监控设备在识别网络会话之前，可以先将网络流量中包含有预设字段的网络流量确定为需要识别的对象。即在确定第一网络会话的传输模式之前，先从所有的网络会话中筛选出满足一定条件的可疑对象，以缩小网络会话的传输模式的确定范围。可选地，本发明实施例中的预设字段为明文字段。结合本申请中提出的应用场景一中，假设运营商的某个优惠套餐为针对爱奇艺的免流量VIP套餐，那么上述步骤S300中的预设字段中则可以包含iqiyi.com，首先判断出该网络流量属于爱奇艺应用；进一步地，为了将第一网络会话缩小在视频流量中，可以进一步验证是否包含视频文件格式的预设字段例如videos、mp4、avi、ts等关键字。需要说明的是，当网络流量采用标准加密协议(主要是指TLS加密协议)的应用时，则可以通过检测TLS协议中存在的服务名称指示(Server Name Indication，SNI)字段或公用名CommonName字段，判断流量的应用类型，以及是否属于视频服务。例如，通过TLS协议中SNI字段的值中包含googlevideo可判断该流量属于应用Youtube。
本方法步骤可以用于匹配视频类明文特征规则，视频类明文特征规则匹配可以基于现有装置的特征匹配功能，增加与视频相关的明文特征规则。此处需要指出的是，这里的明文特征规则是与应用无关的，即不包含应用级别的特征规则，仅匹配与视频特点相关的规则。其目的是筛选无法细分为视频的流量及未知流量。
本发明实施例，可以适用于运营商在线流量识别业务的视频流量识别机制。通过建立 逐层筛选的机制，首先通过可疑流量定位缩小待识别流量范围，降低了后续传输模式的划分以及行为特征匹配阶段的计算量，大幅度提高在线流量识别匹配效率，并且为后续特征匹配过程筛选掉了大部分非视频流量，提升了在线视频流量的识别准确率；然后通过传输模式的匹配精确定位视频行为模式，最后基于该行为模式对应的特征识别视频流量，进一步地提高了在线视频流量的识别效率和准确率。
在上述步骤S304中，具体如何根据第一网络会话的特征参数以及预设特征参数范围确定第一网络会话所属的类别，会依据网络会话的传输模式的判断结果不同而不同。通过对视频应用的深入分析，本发明实施例中将视频应用按行为模式归类，分析各类视频应用的行为特点，并提出相应的识别方案。其中关于识别视频流量的主要核心点就是要排除掉上行数据包从而对下行数据包进行切片划分，因为，一般情况下，客户端向服务端发送的上行数据包为视频请求，但是下行数据包很大可能性是视频数据包。可选地，从客户端和服务端之间的交互行为对视频流量的划分维度包括：下行是否跨网络流传输、上行是一次请求还是多次请求。其中，上述两个维度任意组合，形成以下四种视频传输行为模式：
1、第一传输模式：视频流单网络流承载，客户端多次向服务端发起请求
(1)第一传输模式以及与其匹配的特征参数
第一传输模式具体为：第一网络会话包括单网络流承载的第一网络流，在第二时间段内，客户端通过所述第一网络流多次向服务端发起请求，服务端通过第一网络流响应客户端的多次请求。其中，第一时间段包括第二时间段，即第二时间段可以等于第一时间段，也可以为第一时间段内的任意一个时间段。第一网络流为在第二时间段内五元组信息相同的数据包，五元组信息包括客户端的源地址和源端口、服务端的目标地址和目标端口、以及客户端和服务端之间的传输层协议。可选地，本发明实施例中的第二时间段为第一时间段中的初始的一段时间。例如第一时间段为00:00:00～00:15:00，第二时间段为00:00:00～00:00:30。
与上述第一传输模式所匹配的特征参数包括：视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围。即本发明实施例应用于视频流量识别场景时，相对应的特征参数也均是与视频相关的特征参数。
(2)当确定为第一传输模式后，确定第一网络会话所属类别
参见图5，图5为本发明实施例提供的一种第一传输模式时序示意图。如图5所示：
①可选地，在第二时间段内，对所述第一网络流中所述客户端向所述服务端发送的上行数据包(图5中深灰色部分)进行周期性检测，例如每2s检测一次，该上行数据包即为用户通过客户端向服务端发起的请求数据，例如，可能为客户端在后台周期性向服务端发起的视频切片播放请求。当前视频服务提供商广泛采用自适应码率(Adaptive Bit Rate,ABR)技术传输视频内容，用户观看的视频内容并非作为一个完整的文件，而是以视频分片的方式陆续传输至用户侧。视频分片可以由用户侧请求，或者由服务侧推送。在同一次视频会话中，每个视频分片对应的视频内容时长一般是相同的，在网络状况相对稳定的前提下，传输每个视频分片的网络流量基本相似，体现在网络流量上的特点即为周期性，因此本发 明实施例中以周期性检测作为前置手段过滤进入检测阶段的网络流，后述与周期性相关的检测原理相同，不再赘述。
②若所述上行数据包满足第一预设周期性特征，即上行数据包为周期性发送的，那么则以所述上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，其中，切片不包括上行数据包，因为上行数据包很大的可能是请求而非视频流量，因此判断下行数据包可以更快速高效的确定网络会话是否为视频流量。例如，切片之后包括图5中的切片1和切片2。下行数据包也即是服务端通过第一网流反馈给客户端的数据，例如，可能为用户点播的视频数据。需要说明的是，针对上述以满足第一预设周期性特征的上行数据包为分割点进行切片的方案，可选地，本发明实施例还提供对上行数据包不进行任何检测，即直接以上行数据包为分割点进行切片的方案，例如，在所述第二时间段内，以所述第一网络流中所述客户端向所述服务端发送的上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包。本申请对此不作具体限定。
③判断每个切片的所述第一特征参数是否符合所述第一视频特征参数范围，即分别判断切片1和切片2的{切片的大小，切片的平均速率，切片中网包大小的数值}中的至少一种(即可能是多种组合，也可能是其中一种，本发明实施例对此不作具体限定)是否满足第一视频特征参数范围。第一特征参数以及第一视频特征参数范围可以是结合视频传输模式建立的行为特征描述方法，并在此基础上通过某种算法自动生成的行为特征规则，例如，根据某种机器学习算法生成的，或者根据某种人工预设算法计算得到的，本发明实施例对此不作具体限定。
可选地，由于第一切片和第二切片在时间上是有先后顺序的，因此每个切片的第一特征参数可以相同也可以不同。那么对应的，第一视频特征参数范围中所包括的特征参数范围可以针对不同的网络切片只有同一个范围，也可以有不同的范围，本发明实施例对此不作具体限定，后述第二传输模式、第三传输模式和第四传输模式中的切片、第一特征参数以及第一视频特征参数范围之间的对应关系也可以参考上述描述，后续不再赘述。
④若所述每个切片的所述第一特征参数均符合，则确定所述第一网络会话为视频流量。即需要每个切片需要分别满足第一视频特征参数范围中其对应的部分才能确定该第一网络会话是否为视频流量。
综上，在上述第一传输模式中，流量监控设备在持续进包一段时间后，对上行数据包进行周期性检测，如果上行数据包的周期性显著，则以上行数据包为分割点对下行数据包切片，检测每一个切片的统计特征是否符合视频特性，最终确定网络会话是否为视频流量。
2、第二传输模式：视频流多网络流承载，客户端多次向服务端发起请求
(1)第二传输模式以及与其匹配的特征参数
则第二传输模式具体为：第一网络会话包括多个第二网络流，在所述第三时间段内，客户端通过多个第二网络流分别多次向服务端发起请求，且服务端通过所述多个第二网络流分别响应客户端对应的请求。其中，所述第一时间段包括第三时间段，即第三时间段可以等于第一时间段，也可以为第一时间段内的任意一个时间段。每一个第二网络流为在第 三时间段内五元组信息相同的数据包集合，且不同第二网络流对应的数据包集合中的数据包的三元组信息相同。可选地，本发明实施例中的第四时间段为第一时间段中的初始的一段时间。例如第一时间段为00:00:00～00:30:00，第二时间段则为00:00:00～00:00:50。
与上述第二传输模式所匹配的特征参数包括：视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围。
(2)当确定为第二传输模式后，确定第一网络会话所属类别
参见图6，图6为本发明实施例提供的一种第二传输模式时序示意图。如图6所：
①在所述第三时间段内，分别对所述多个第二网络流中所述客户端向所述服务端发送的上行数据包(图6中的深灰色部分)进行周期性检测，该上行数据包即为用户通过客户端向服务端发起的多次请求数据，例如，可能为高清视频点播请求。需要说明的是，所述多个第二个网络流可以是在相同时刻同时发起的，也可以是不同时刻发起的，如图6中所示，只有第二网络流3和4是同时刻刻发起的，1、2和3与4之间均不是相同时刻发起的。因此在流量监控设备分别对多个第二网络流进行检测期间，实际上是可以在不同的时刻开始检测的，也即是根据每个第二网络流实际发起请求的时刻开始检测的。
②若所述多个第二网络流中的至少一个第二网络流的所述上行数据包满足第二预设周期性特征，则以所述上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，其中，切片不包括上行数据包，因为上行数据包很大的可能是请求而非视频流量，因此判断下行数据包可以更快速高效的确定网络会话是否为视频流量。例如，图6中的四个第二网络流，经过检测只有第二网络流4满足第一第二预设周期性特征，那么，则只针对该第二网络流4中的下行数据包进行切片，切片之后包括图6中的切片1和切片2。其中，下行数据包也即是服务端通过第二网络流4反馈给客户端的数据，例如，可能为用户点播的高清视频数据。需要说明的是，其它不满足条件的第二网络流1、2和3有可能是满足条件的第二网络流的其它与相关服务信息，如弹幕数据、广告、聊天窗口等。需要说明的是，针对上述以满足第二预设周期性特征的上行数据包为分割点进行切片的方案，可选地，本发明实施例还提供对上行数据包不进行任何检测，即直接以上行数据包为分割点进行切片的方案，例如，在所述第三时间段内，分别以所述多个第二网络流中所述客户端向所述服务端发送的上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包，本发明实施例对此不作具体限定。
③判断所述至少一个第二网络流的每个切片的所述第二特征参数是否符合所述第二视频特征参数范围。如图6所示，判断第二网络流4中的切片1和切片2是否满足都满足第二视频特征参数范围。
④若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。若判断出第二网络流4中的切片1和切片2都满足第二视频特征参数范围，则判断为该第二网络会话为视频流量。可以理解的是，当有多个第二网络流均满足上述条件时，在时间上最先判断出一个满足条件的第二网络流即可确定第二网络会话为视频流量，而无需继续判断。
需要说明的是，为了提升流量监控设备的效率，当第一网络会话中任意一条第二网络流被识别为视频流量后，可终止对第一网络会话的识别流程，以节省网络开销。
3、第三传输模式：视频流多网络流承载，客户端每流仅向服务端发起一次请求
(1)第三传输模式以及与其匹配的特征参数
则第三传输模式具体为：第一网络会话包括多个第三网络流，在第四时间段内，客户端通过多个第三网络流中的每个第三网络流分别向服务端发起一次请求，且服务端通过多个第三网络流分别响应客户端对应的请求。其中，第一时间段包括第四时间段，即第四时间段可以等于第一时间段，也可以为第一时间段内的任意一个时间段；每一个第三网络流为在第四时间段内五元组信息相同的数据包集合，且不同第三网络流对应的数据包集合中的数据包的所述三元组信息相同。可选地，本发明实施例中的第四时间段为第一时间段中的初始的一段时间。例如第一时间段为00:00:00～00:05:00，第四时间段可以为00:00:00～00:00:20。
与上述第三传输模式所匹配的特征参数包括：视频流量切片中每个切片的第三特征参数；所述第三特征参数包括：切片的速率峰值、切片的时长、切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第三视频特征参数范围。
(2)当确定为第三传输模式后，确定第一网络会话所属类别
参见图7，图7为本发明实施例提供的一种第二传输模式时序示意图。如图7所：
①将所述多个第三网络流中的每一个第三网络流中所述服务端发送给所述客户端的下行数据包作为一个切片，其中，切片不包括上行数据包，因为上行数据包很大的可能是请求而非视频流量，因此判断下行数据包可以更快速高效的确定网络会话是否为视频流量。例如为图7中的切片1、切片2、切片3和切片4。
②判断每个切片的所述第三特征参数是否符合所述第三视频特征参数范围。即判断切片1、切片2、切片3和切片4各自对应的第三网络特征参数是否满足其在第三视频特征参数范围参数范围。
③若所述每个切片的所述第三特征参数均符合，则确定所述第一网络会话为视频流量。即当切片1、切片2、切片3和切片4均满足条件时，才能确定第一网络会话为视频流量。
4、第四传输模式：视频流单网络流承载，客户端仅向服务端发起一次请求
(1)第当确定为第四传输模式后，确定第一网络会话所属类别
则第三传输模式具体为：第一网络会话包括第四网络流，在所述第五时间段内，客户端通过第四网络流量向服务端发起一次请求，例如为图8中的深灰色部分，可以为且服务端通过第四网络流量响应客户端的请求，例如可以为服务端向客户端反馈的直播视频数据。其中，所述第一时间段包括第五时间段，所述第四网络流为在所述第五时间段内所述五元组信息相同的数据包集合；
与上述第四传输模式所匹配的特征参数包括：视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布 中的至少一种；所述预设特征参数范围包括第四视频特征参数范围。
(2)当确定传输模式为第四传输模式后，如何确定第一网络会话所属的类别
参见图8，图8为本发明实施例提供的一种第四传输模式时序示意图。如图8所：
①在所述第五时间段内，确定所述第四网络流中的第一数据包，并对所述第一数据包进行周期性检测，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包。例如，第一数据包为图8中的第四网络流中的白色部分即为非满包，第二数据包则为满包部分为图8中的浅灰色部分。满包的含义是指当前数据包的大小达到了该网络流对应的网络链路所能承载的最大数据量，非满包即未达到该最大数据量的数据包，通常非满包的物理意义是传输内容的结尾，所以可以用非满包来作为切片的分割边界。
②若所述第一数据包满足第三预设周期性特征，则以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，即得到了可能为服务端发送给客户端的下行视频流量。其中，切片不包括上行数据包，因为上行数据包很大的可能是请求而非视频流量，因此判断下行数据包可以更快速高效的确定网络会话是否为视频流量。需要说明的是，针对上述以满足第一预设周期性特征的上行数据包为分割点进行切片的方案，可选地，本发明实施例还提供对上行数据包不进行任何检测，即直接以上行数据包为分割点进行切片的方案，例如，在所述第五时间段内，确定所述第四网络流中的第一数据包，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包。
③检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；
④若均符合，则确定所述第一网络会话为视频流量。
综上所述，在上述第四传输模式中，流量监控设备在持续进包一段时间后，判断该该网络流对应传输链路的满包大小，筛选出下行非满包，并对下行非满包进行周期性检测，如果下行非满包的周期性显著，则按下行非满包的时间对下行数据包切片，检测切片及整个网络流的统计特征是否符合视频特性。
上述四种传输模式下对应的识别方案，清晰解耦不同视频场景的传输模式的划分方式，通过深入分析主流视频类应用的特点，包括视频协议、视频类型等，提出不同视频场景之间存在的传输模式差异，据此对视频类应用进一步细分，使得每一种场景下的视频的行为特点更加聚焦。本发明实施例相比于现有技术，改进之处体现在识别流程和识别规则方面。
针对本申请前述提出的实际要解决的三个技术问题，本实施例中针对不同的传输模式的视频流量，分析其较为稳定的视频流量特征，并且这些特征不会因为应用的更新或者应用的特征该发生变化而受到影响。即不同传输模式下的视频应用其客户端和服务端之间的交互行为模式基本不会发生变化。因此可以形成稳定的视频流量特征。
本实施例中针对在加密场景下，以及部分复杂的非加密场景下，无需识别其内部加密部分，只根据宏观上的客户端和服务端之间的交互行为。则可以精确的定位视频场景。
本实施例中结合传输模式识别以及在该传输模式下的特征参数，可以更快速准确的识别视频流量，即提供高效的流量识别机制。
综上，本申请克服了现有识别技术中存在的逐个应用分析、应用特征易变化、部分场景无法细分、不适用于在线流量识别业务以及识别不准确等缺点。
需要说明的是，本申请对于以下情况能够达到较高的视频流量识别精度，解决了无法精确识别视频场景的问题：使用私有协议传输视频流；使用加密协议传输视频流；所属应用使用明文协议，但包含多种场景；难以区分视频流、单网络流特征信息不足的情况。
本申请对于以下情况能够提高响应速度，节约人力分析成本：视频应用更新换代频繁，应用特征变化明显；待识别应用数量繁多，且仅需识别至视频场景。
本申请中的网络流量识别方法可以应用于统一分组网关UGW相关产品，例如，应用于UGW以支撑运营商开展视频相关计费套餐，或者应用于UGW产品以精细化视频流量QoE/QoS。
需要说明的是，在主干核心网的高速环境中，对流量识别需要的报文数量有较大限制，因此本发明实施例在阐述的过程中，并没有应用全流量特征，而是根据不同的传输模式特点有选择地在网络流传输的早期截取了部分特征。但是如果硬件技术进步或者某些适合全流分析的业务场景的能够支持这种全流的特征学习方式，本申请能够自然的扩展到这种流量识别环境中，其识别的核心依然属于本申请的保护范围。
还需要说明的是，本申请中的网络流量识别方法除了可应用于运营商的计费和策略控制场景，还以用于视频关键质量指标(Key Quality Indicators，KQI)场景中，由于本申请中选取的特征与视频KQI场景中的部分特征相似，因此可以在本申请的基础上进一步拓展，结合视频KQI场景的业务需求，完成定制化的业务逻辑。更广泛的，任何需要识别视频流量的场景，都可以适用本申请提供的方案。
上述详细阐述了本发明实施例的方法，下面提供了本发明实施例的相关装置。
请参见图9，图9是本发明实施例提供的一种网络流量识别装置的结构示意图，该网络流量识别装置10可以包括第一确定单元101、匹配单元102和识别单元103，其中，各个单元的详细描述如下。
第一确定单元101，用于确定第一网络会话对应的传输模式，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，所述三元组信息包括客户端的源地址、服务端的目标地址、以及所述客户端和所述服务端之间的传输层协议，所述传输模式包括所述客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式；
匹配单元102，用于确定与所述传输模式匹配的特征参数；
识别单元103，用于根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。
在一种可能的实现方式中，所述装置还包括；
第二确定单元104，用于确定第一网络会话对应的传输模式之前，将网络流量中包含预设字段的网络会话确定为所述第一网络会话。
在一种可能的实现方式中，所述第一时间段包括第二时间段；所述传输模式包括第一传输模式，所述第一网络会话包括第一网络流，所述第一网络流为在所述第二时间段内五元组信息相同的数据包集合，所述五元组信息包括客户端的源地址和源端口、服务端的目 标地址和目标端口、以及所述客户端和所述服务端之间的传输层协议；
所述第一传输模式包括：在所述第二时间段内，所述客户端通过所述第一网络流多次向所述服务端发起请求，所述服务端通过所述第一网络流响应所述客户端的多次请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；
识别单元104，具体用于：
在所述第二时间段内，以所述第一网络流中所述客户端向所述服务端发送的上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断每个切片的所述第一特征参数是否符合所述第一视频特征参数范围；若所述每个切片的所述第一特征参数均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；
识别单元104，具体用于：
在所述第二时间段内，对所述第一网络流中所述客户端向所述服务端发送的上行数据包进行周期性检测；若所述上行数据包满足第一预设周期性特征，则以所述上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断每个切片的所述第一特征参数是否符合所述第一视频特征参数范围；若所述每个切片的所述第一特征参数均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述第一时间段包括第三时间段；所述传输模式包括第二传输模式；所述第一网络会话包括多个第二网络流，其中，每一个第二网络流为在所述第三时间段内五元组信息相同的数据包集合，且不同第二网络流对应的数据包集合中的数据包的所述三元组信息相同；
所述第二传输模式包括：在所述第三时间段内，所述客户端通过所述多个第二网络流分别多次向所述服务端发起请求，且所述服务端通过所述多个第二网络流分别响应所述客户端对应的请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；
识别单元104，具体用于：
在所述第三时间段内，分别以所述多个第二网络流中所述客户端向所述服务端发送的上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断所述至少一个第二网络流的每个切片的所述第二特征参数是否符合所述第二视频特征参数范围；若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围， 确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；
识别单元104，具体用于：
在所述第三时间段内，分别对所述多个第二网络流中所述客户端向所述服务端发送的上行数据包进行周期性检测；若所述多个第二网络流中的至少一个第二网络流的所述上行数据包满足第二预设周期性特征，则以所述上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；判断所述至少一个第二网络流的每个切片的所述第二特征参数是否符合所述第二视频特征参数范围；若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述第一时间段包括第四时间段；所述传输模式包括第三传输模式；所述第一网络会话包括多个第三网络流，其中，每一个第三网络流为在所述第四时间段内五元组信息相同的数据包集合，且不同第三网络流对应的数据包集合中的数据包的所述三元组信息相同；
所述第三传输模式包括：在所述第四时间段内，所述客户端通过所述多个第三网络流中的每个第三网络流分别向所述服务端发起一次请求，且所述服务端通过所述多个第三网络流分别响应所述客户端对应的请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第三特征参数；所述第三特征参数包括：切片的速率峰值、切片的时长、切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第三视频特征参数范围；
识别单元104，具体用于：
将所述多个第三网络流中的每一个第三网络流中所述服务端发送给所述客户端的下行数据包作为一个切片；判断每个切片的所述第三特征参数是否符合所述第三视频特征参数范围；若所述每个切片的所述第三特征参数均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述第一时间段包括第五时间段；所述传输模式包括第四传输模式；所述第一网络会话包括第四网络流，所述第四网络流为在所述第五时间段内所述五元组信息相同的数据包集合；
所述第四传输模式包括：在所述第五时间段内，所述客户端通过所述第四网络流量向所述服务端发起一次请求，且所述服务端通过所述第四网络流量响应所述客户端的请求。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；
识别单元104，具体用于：
在所述第五时间段内，确定所述第四网络流中的第一数据包，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据 包，所述最第二数据包为所述第四网络流中最大的数据包；以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；若均符合，则确定所述第一网络会话为视频流量。
在一种可能的实现方式中，所述特征参数包括视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；
所述识别单元，具体用于：
在所述第五时间段内，确定所述第四网络流中的第一数据包，并对所述第一数据包进行周期性检测，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；
若所述第一数据包满足第三预设周期性特征，则以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；若均符合，则确定所述第一网络会话为视频流量。
需要说明的是，本发明实施例中所描述的网络流量识别装置10中各功能单元的功能可参见上述图3中所述的方法实施例中步骤S300-步骤S303的相关描述，此处不再赘述。
如图10所示，图10是本发明实施例提供的另一种网络流量识别装置的结构示意图，该装置20包括至少一个处理器201，至少一个存储器202、至少一个通信接口203。此外，该设备还可以包括天线等通用部件，在此不再详述。
处理器201可以是通用中央处理器(CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制以上方案程序执行的集成电路。
通信接口203，用于与其他设备或通信网络通信，如以太网，无线接入网(RAN)，核心网，无线局域网(Wireless Local Area Networks，WLAN)等。
存储器202可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，所述存储器202用于存储执行以上方案的应用程序代码，并由处理器201来控制执行。所述处理器201用于执行所述存储器202中存储的应用程序代码。
存储器202存储的代码可执行以上图3提供的网络流量识别方法，比如确定第一网络 会话对应的传输模式，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，所述三元组信息包括客户端的源地址、服务端的目标地址、以及所述客户端和所述服务端之间的传输层协议，所述传输模式包括所述客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式；确定与所述传输模式匹配的特征参数；根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。
需要说明的是，本发明实施例中所描述的网络流量识别装置20中各功能单元的功能可参见上述图3中所述的方法实施例中的步骤S300-步骤S303相关描述，此处不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可能可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以为个人计算机、服务端或者网络设备等，具体可以是计算机设备中的处理器)执行本申请各个实施例上述方法的全部或部分步骤。其中，而前述的存储介质可包括：U盘、移动硬盘、磁碟、光盘、只读存储器(Read-Only Memory，缩写：ROM)或者随机存取存储器(Random Access Memory，缩写：RAM)等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (24)

  1. 一种网络流量识别方法，其特征在于，包括：
    确定第一网络会话对应的传输模式，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，所述三元组信息包括客户端的源地址、服务端的目标地址、以及所述客户端和所述服务端之间的传输层协议，所述传输模式包括所述客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式；
    确定与所述传输模式匹配的特征参数；
    根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。
  2. 如权利要求1所述的方法，其特征在于，所述确定第一网络会话对应的传输模式之前，还包括；
    将网络流量中包含预设字段的网络会话确定为所述第一网络会话。
  3. 如权利要求1或2所述的方法，其特征在于，所述第一时间段包括第二时间段；所述传输模式包括第一传输模式，所述第一网络会话包括第一网络流，所述第一网络流为在所述第二时间段内五元组信息相同的数据包集合，所述五元组信息包括客户端的源地址和源端口、服务端的目标地址和目标端口、以及所述客户端和所述服务端之间的传输层协议；
    所述第一传输模式包括：在所述第二时间段内，所述客户端通过所述第一网络流多次向所述服务端发起请求，所述服务端通过所述第一网络流响应所述客户端的多次请求。
  4. 如权利要求3所述的方法，其特征在于，所述特征参数包括视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；
    所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：
    在所述第二时间段内，以所述第一网络流中所述客户端向所述服务端发送的上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；
    若所述每个切片的所述第一特征参数均符合所述第一视频特征参数范围，则确定所述第一网络会话为视频流量。
  5. 如权利要求1-4任意一项所述的方法，其特征在于，所述第一时间段包括第三时间段；所述传输模式包括第二传输模式；所述第一网络会话包括多个第二网络流，其中，每个第二网络流为在所述第三时间段内五元组信息相同的数据包集合，且不同第二网络流对应的数据包集合中的数据包的所述三元组信息相同；
    所述第二传输模式包括：在所述第三时间段内，所述客户端通过所述多个第二网络流 分别多次向所述服务端发起请求，且所述服务端通过所述多个第二网络流分别响应所述客户端对应的请求。
  6. 如权利要求5所述的方法，其特征在于，所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；
    所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：
    在所述第三时间段内，分别以所述多个第二网络流中所述客户端向所述服务端发送的上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；
    若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。
  7. 如权利要求1-6任意一项所述的方法，其特征在于，所述第一时间段包括第四时间段；所述传输模式包括第三传输模式；所述第一网络会话包括多个第三网络流，其中，每一个第三网络流为在所述第四时间段内五元组信息相同的数据包集合，且不同第三网络流对应的数据包集合中的数据包的所述三元组信息相同；
    所述第三传输模式包括：在所述第四时间段内，所述客户端通过所述多个第三网络流中的每个第三网络流分别向所述服务端发起一次请求，且所述服务端通过所述多个第三网络流分别响应所述客户端对应的请求。
  8. 如权利要求7所述的方法，其特征在于，所述特征参数包括视频流量切片中每个切片的第三特征参数；所述第三特征参数包括：切片的速率峰值、切片的时长、切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第三视频特征参数范围；
    所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：
    将所述多个第三网络流中的每一个第三网络流中所述服务端发送给所述客户端的下行数据包作为一个切片；
    若所述每个切片的所述第三特征参数均符合所述第三视频特征参数范围，则确定所述第一网络会话为视频流量。
  9. 如权利要求1-8任意一项所述的方法，其特征在于，所述第一时间段包括第五时间段；所述传输模式包括第四传输模式；所述第一网络会话包括第四网络流，所述第四网络流为在所述第五时间段内所述五元组信息相同的数据包集合；
    所述第四传输模式包括：在所述第五时间段内，所述客户端通过所述第四网络流量向所述服务端发起一次请求，且所述服务端通过所述第四网络流量响应所述客户端的请求。
  10. 如权利要求9所述的方法，其特征在于，所述特征参数包括视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；
    所述根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别，包括：
    在所述第五时间段内，确定所述第四网络流中的第一数据包，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；
    以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；
    检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；
    若均符合，则确定所述第一网络会话为视频流量。
  11. 一种网络流量识别装置，其特征在于，包括：
    第一确定单元，用于确定第一网络会话对应的传输模式，所述第一网络会话为在第一时间段内三元组信息相同的数据包集合，所述三元组信息包括客户端的源地址、服务端的目标地址、以及所述客户端和所述服务端之间的传输层协议，所述传输模式包括所述客户端向所述服务端请求的行为模式和/或所述服务端响应所述客户端的行为模式；
    匹配单元，用于确定与所述传输模式匹配的特征参数；
    识别单元，用于根据所述第一网络会话的所述特征参数以及预设特征参数范围确定所述第一网络会话所属的类别。
  12. 如权利要求11所述的装置，其特征在于，所述装置还包括；
    第二确定单元，用于确定第一网络会话对应的传输模式之前，将网络流量中包含预设字段的网络会话确定为所述第一网络会话。
  13. 如权利要求11或12所述的装置，其特征在于，所述第一时间段包括第二时间段；所述传输模式包括第一传输模式，所述第一网络会话包括第一网络流，所述第一网络流为在所述第二时间段内五元组信息相同的数据包集合，所述五元组信息包括客户端的源地址和源端口、服务端的目标地址和目标端口、以及所述客户端和所述服务端之间的传输层协议；
    所述第一传输模式包括：在所述第二时间段内，所述客户端通过所述第一网络流多次向所述服务端发起请求，所述服务端通过所述第一网络流响应所述客户端的多次请求。
  14. 如权利要求13所述的装置，其特征在于，所述特征参数包括视频流量切片中每个切片的第一特征参数，所述第一特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第一视频特征参数范围；
    所述识别单元，具体用于：
    在所述第二时间段内，以所述第一网络流中所述客户端向所述服务端发送的上行数据包为分割点，对所述第一网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；若所述每个切片的所述第一特征参数均符合所述第一视频特征参数范围，则确定所述第一网络会话为视频流量。
  15. 如权利要求11-14任意一项所述的装置，其特征在于，所述第一时间段包括第三时间段；所述传输模式包括第二传输模式；所述第一网络会话包括多个第二网络流，其中，每一个第二网络流为在所述第三时间段内五元组信息相同的数据包集合，且不同第二网络流对应的数据包集合中的数据包的所述三元组信息相同；
    所述第二传输模式包括：在所述第三时间段内，所述客户端通过所述多个第二网络流分别多次向所述服务端发起请求，且所述服务端通过所述多个第二网络流分别响应所述客户端对应的请求。
  16. 如权利要求15所述的装置，其特征在于，所述特征参数包括视频流量切片中每个切片的第二特征参数，所述第二特征参数包括：切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第二视频特征参数范围；
    所述识别单元，具体用于：
    在所述第三时间段内，分别以所述多个第二网络流中所述客户端向所述服务端发送的上行数据包为分割点，对相应的第二网络流中所述服务端向所述客户端发送的下行数据包进行切片，所述切片不包括所述上行数据包；若所述至少一个第二网络流中的任意一个第二网络流的每个切片的所述第二特征参数均符合所述第二视频特征参数范围，确定所述第一网络会话为视频流量。
  17. 如权利要求11-16任意一项所述的装置，其特征在于，所述第一时间段包括第四时间段；所述传输模式包括第三传输模式；所述第一网络会话包括多个第三网络流，其中，每一个第三网络流为在所述第四时间段内五元组信息相同的数据包集合，且不同第三网络流对应的数据包集合中的数据包的所述三元组信息相同；
    所述第三传输模式包括：在所述第四时间段内，所述客户端通过所述多个第三网络流中的每个第三网络流分别向所述服务端发起一次请求，且所述服务端通过所述多个第三网络流分别响应所述客户端对应的请求。
  18. 如权利要求17所述的装置，其特征在于，所述特征参数包括视频流量切片中每个切片的第三特征参数；所述第三特征参数包括：切片的速率峰值、切片的时长、切片的大小、切片的平均速率和切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第三视频特征参数范围；
    所述识别单元，具体用于：
    将所述多个第三网络流中的每一个第三网络流中所述服务端发送给所述客户端的下行 数据包作为一个切片；若所述每个切片的所述第三特征参数均符合所述第三视频特征参数范围，则确定所述第一网络会话为视频流量。
  19. 如权利要求11-18任意一项所述的装置，其特征在于，所述第一时间段包括第五时间段；所述传输模式包括第四传输模式；所述第一网络会话包括第四网络流，所述第四网络流为在所述第五时间段内所述五元组信息相同的数据包集合；
    所述第四传输模式包括：在所述第五时间段内，所述客户端通过所述第四网络流量向所述服务端发起一次请求，且所述服务端通过所述第四网络流量响应所述客户端的请求。
  20. 如权利要求19所述的装置，其特征在于，所述特征参数包括视频流量切片中每个切片的第四特征参数，所述第四特征参数包括：切片的大小、切片的平均速率、切片中网包大小的数值分布中的至少一种；所述预设特征参数范围包括第四视频特征参数范围；
    所述识别单元，具体用于：
    在所述第五时间段内，确定所述第四网络流中的第一数据包，其中，所述第一数据包为所述第四网络流中所述服务端向所述客户端发送的下行数据包中小于第二数据包的数据包，所述最第二数据包为所述第四网络流中最大的数据包；以所述第一数据包为分割点对所述第四网络流中的所述下行数据包进行切片，所述切片不包括所述第一数据包；检测每个切片的所述第四特征参数是否符合所述第四视频特征参数范围；若均符合，则确定所述第一网络会话为视频流量。
  21. 一种服务设备，其特征在于，包括处理器、存储器以及通信接口，其中，所述存储器用于存储信息发送程序代码，所述处理器用于调用所述网络流量识别程序代码来执行权利要求1至10任一项所述的方法。
  22. 一种芯片系统，其特征在于，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述接口电路和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行时，权利要求1-10中任意一项所述的方法得以实现。
  23. 一种计算机存储介质，其特征在于，所述计算机存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述权利要求1-10任意一项所述的方法。
  24. 一种计算机程序，其特征在于，所述计算机程序包括指令，当所述计算机程序被计算机执行时，使得所述计算机执行如权利要求1-10中任意一项所述的方法。
PCT/CN2019/086375 2018-05-22 2019-05-10 一种网络流量识别方法及相关设备 WO2019223553A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19807078.1A EP3780523B1 (en) 2018-05-22 2019-05-10 Network traffic identification method and related device
EP23217842.6A EP4362422A3 (en) 2018-05-22 2019-05-10 Network traffic identification method and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810498713.3A CN110519177B (zh) 2018-05-22 2018-05-22 一种网络流量识别方法及相关设备
CN201810498713.3 2018-05-22

Publications (1)

Publication Number Publication Date
WO2019223553A1 true WO2019223553A1 (zh) 2019-11-28

Family

ID=68616187

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/086375 WO2019223553A1 (zh) 2018-05-22 2019-05-10 一种网络流量识别方法及相关设备

Country Status (3)

Country Link
EP (2) EP4362422A3 (zh)
CN (2) CN114422451A (zh)
WO (1) WO2019223553A1 (zh)

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111356014A (zh) * 2020-02-18 2020-06-30 南京中新赛克科技有限责任公司 一种基于自动化学习的Youtube视频识别匹配方法
CN113328906A (zh) * 2021-04-22 2021-08-31 成都欧珀通信科技有限公司 一种流量实时监控方法、装置、存储介质及电子设备
CN113438503A (zh) * 2021-05-28 2021-09-24 曙光网络科技有限公司 视频文件还原方法、装置、计算机设备和存储介质
CN113595930A (zh) * 2020-04-30 2021-11-02 华为技术有限公司 流量识别方法和流量识别设备
CN113630418A (zh) * 2021-08-16 2021-11-09 杭州安恒信息安全技术有限公司 一种网络服务识别方法、装置、设备及介质
CN113949653A (zh) * 2021-10-18 2022-01-18 中铁二院工程集团有限责任公司 一种基于深度学习的加密协议识别方法及系统
CN114173146A (zh) * 2021-12-10 2022-03-11 北京达佳互联信息技术有限公司 流量配置方法、装置、服务器及存储介质
CN114449569A (zh) * 2020-11-02 2022-05-06 中国移动通信集团广东有限公司 用户流量使用量处理方法、网络设备及业务处理系统
CN114765634A (zh) * 2021-01-13 2022-07-19 腾讯科技（深圳）有限公司 网络协议识别方法、装置、电子设备及可读存储介质
CN114979073A (zh) * 2021-08-30 2022-08-30 中移互联网有限公司 地址信息获取系统、方法、电子设备及存储介质
CN115174625A (zh) * 2022-07-06 2022-10-11 中国联合网络通信集团有限公司 远程医疗数据传输方法和装置
CN117077030A (zh) * 2023-10-16 2023-11-17 易停车物联网科技(成都)有限公司 一种面向生成模型的少样本视频流分类方法及系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113055420B (zh) * 2019-12-27 2023-07-25 中国移动通信集团陕西有限公司 Https业务识别方法、装置及计算设备
US11711279B2 (en) * 2021-10-26 2023-07-25 Juniper Networks, Inc. Application records using session information
CN115150285A (zh) * 2022-06-24 2022-10-04 阿里云计算有限公司 网络拓扑关系确定方法、网络系统、设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102164049A (zh) * 2011-04-28 2011-08-24 中国人民解放军信息工程大学 加密流量的普适识别方法
CN103475537A (zh) * 2013-08-30 2013-12-25 华为技术有限公司 一种报文特征提取方法和装置
US20150120909A1 (en) * 2013-10-30 2015-04-30 Cisco Technology, Inc. Dns-assisted application identification

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2618524A1 (en) * 2012-01-02 2013-07-24 Alcatel Lucent Method for providing QoS management in a packet-based transport network
CN103582512B (zh) * 2013-02-04 2017-04-19 华为技术有限公司 特征提取装置、网络流量识别方法、装置和系统
CN104052639B (zh) * 2014-07-02 2017-03-22 山东大学 基于支持向量机的实时多应用网络流量识别方法
US9961001B2 (en) * 2015-03-17 2018-05-01 Telefonaktiebolaget L M Ericsson (Publ) System and method for categorizing packet flows in a network
GB2552220B (en) * 2016-07-15 2018-09-05 Openwave Mobility Inc A method for detecting a live adaptive BIT rate stream

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102164049A (zh) * 2011-04-28 2011-08-24 中国人民解放军信息工程大学 加密流量的普适识别方法
CN103475537A (zh) * 2013-08-30 2013-12-25 华为技术有限公司 一种报文特征提取方法和装置
US20150120909A1 (en) * 2013-10-30 2015-04-30 Cisco Technology, Inc. Dns-assisted application identification

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3780523A4 *

Cited By (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111356014A (zh) * 2020-02-18 2020-06-30 南京中新赛克科技有限责任公司 一种基于自动化学习的Youtube视频识别匹配方法
CN113595930A (zh) * 2020-04-30 2021-11-02 华为技术有限公司 流量识别方法和流量识别设备
CN114449569B (zh) * 2020-11-02 2024-01-16 中国移动通信集团广东有限公司 用户流量使用量处理方法、网络设备及业务处理系统
CN114449569A (zh) * 2020-11-02 2022-05-06 中国移动通信集团广东有限公司 用户流量使用量处理方法、网络设备及业务处理系统
CN114765634A (zh) * 2021-01-13 2022-07-19 腾讯科技（深圳）有限公司 网络协议识别方法、装置、电子设备及可读存储介质
CN114765634B (zh) * 2021-01-13 2023-12-12 腾讯科技（深圳）有限公司 网络协议识别方法、装置、电子设备及可读存储介质
CN113328906A (zh) * 2021-04-22 2021-08-31 成都欧珀通信科技有限公司 一种流量实时监控方法、装置、存储介质及电子设备
CN113328906B (zh) * 2021-04-22 2023-01-06 成都欧珀通信科技有限公司 一种流量实时监控方法、装置、存储介质及电子设备
CN113438503A (zh) * 2021-05-28 2021-09-24 曙光网络科技有限公司 视频文件还原方法、装置、计算机设备和存储介质
CN113630418A (zh) * 2021-08-16 2021-11-09 杭州安恒信息安全技术有限公司 一种网络服务识别方法、装置、设备及介质
CN114979073B (zh) * 2021-08-30 2023-09-05 中移互联网有限公司 地址信息获取系统、方法、电子设备及存储介质
CN114979073A (zh) * 2021-08-30 2022-08-30 中移互联网有限公司 地址信息获取系统、方法、电子设备及存储介质
CN113949653A (zh) * 2021-10-18 2022-01-18 中铁二院工程集团有限责任公司 一种基于深度学习的加密协议识别方法及系统
CN113949653B (zh) * 2021-10-18 2023-07-07 中铁二院工程集团有限责任公司 一种基于深度学习的加密协议识别方法及系统
CN114173146A (zh) * 2021-12-10 2022-03-11 北京达佳互联信息技术有限公司 流量配置方法、装置、服务器及存储介质
CN114173146B (zh) * 2021-12-10 2024-01-19 北京达佳互联信息技术有限公司 流量配置方法、装置、服务器及存储介质
CN115174625A (zh) * 2022-07-06 2022-10-11 中国联合网络通信集团有限公司 远程医疗数据传输方法和装置
CN115174625B (zh) * 2022-07-06 2024-02-13 中国联合网络通信集团有限公司 远程医疗数据传输方法和装置
CN117077030A (zh) * 2023-10-16 2023-11-17 易停车物联网科技(成都)有限公司 一种面向生成模型的少样本视频流分类方法及系统
CN117077030B (zh) * 2023-10-16 2024-01-26 易停车物联网科技(成都)有限公司 一种面向生成模型的少样本视频流分类方法及系统

Also Published As

Publication number Publication date
EP3780523A4 (en) 2021-04-28
EP3780523B1 (en) 2024-01-24
CN114422451A (zh) 2022-04-29
EP4362422A2 (en) 2024-05-01
EP3780523A1 (en) 2021-02-17
CN110519177A (zh) 2019-11-29
CN110519177B (zh) 2022-01-21
EP4362422A3 (en) 2024-07-10

Similar Documents

Publication Publication Date Title
WO2019223553A1 (zh) 一种网络流量识别方法及相关设备
US10063606B2 (en) Systems and methods for using client-side video buffer occupancy for enhanced quality of experience in a communication network
US9158769B2 (en) Systems and methods for network content delivery
US9549010B2 (en) Method and apparatus for media session identification, tracking, and analysis
US9621606B2 (en) Real-time video detector
EP2530870A1 (en) Systems and methods for measuring quality of expeience for media streaming
CN106972985B (zh) 加速dpi设备数据处理与转发的方法和dpi设备
US20150067185A1 (en) Server-side systems and methods for reporting stream data
WO2020052110A1 (zh) 业务质量监控方法、装置及系统
CN107612912B (zh) 一种设置播放参数的方法和装置
WO2023005701A1 (zh) 数据通信方法及装置、电子设备、存储介质
EP3993329A1 (en) Network data scheduling method and edge node
CN110113306A (zh) 分发数据的方法和网络设备
WO2023061060A1 (zh) 音视频码流的调度方法、系统、介质及电子装置
CN110572698B (zh) 一种统计巡检和监控播放记录的方法、装置、设备、介质
CN110061979B (zh) 一种业务对象的检测方法和装置
CN111224889A (zh) 一种数据传输的方法和装置
Zhang et al. Intelligent video ingestion for real-time traffic monitoring
Liu et al. Doom: a training-free, real-time video flow identification method for encrypted traffic
CA2742038C (en) Systems and methods for measuring quality of experience for media streaming
Mushtaq et al. Quality of experience paradigm in multimedia services: application to OTT video streaming and VoIP services
Madanapalli et al. Assisting delay and bandwidth sensitive applications in a self-driving network
Feng-Hui et al. QoE issues of OTT services over 5G network
WO2021190050A1 (zh) 监控业务的方法、装置和系统
WO2020244283A1 (zh) 一种视频业务处理方法、系统及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19807078

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019807078

Country of ref document: EP

Effective date: 20201026

NENP Non-entry into the national phase

Ref country code: DE