WO2022078104A1 - 网络流量分析方法、装置、电子设备和存储介质 - Google Patents

网络流量分析方法、装置、电子设备和存储介质 Download PDF

Info

Publication number
WO2022078104A1
WO2022078104A1 PCT/CN2021/116357 CN2021116357W WO2022078104A1 WO 2022078104 A1 WO2022078104 A1 WO 2022078104A1 CN 2021116357 W CN2021116357 W CN 2021116357W WO 2022078104 A1 WO2022078104 A1 WO 2022078104A1
Authority
WO
WIPO (PCT)
Prior art keywords
quintuple
network traffic
data packets
rule
card
Prior art date
Application number
PCT/CN2021/116357
Other languages
English (en)
French (fr)
Inventor
闫小龙
万月亮
火一莽
Original Assignee
北京锐安科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京锐安科技有限公司 filed Critical 北京锐安科技有限公司
Publication of WO2022078104A1 publication Critical patent/WO2022078104A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/14—Arrangements for monitoring or testing data switching networks using software, i.e. software packages
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present application relates to data transmission technology, for example, to a network traffic analysis method, apparatus, electronic device and storage medium.
  • DPI network traffic analysis deep packet inspection
  • DNS Domain Name System
  • IP Internet Protocol
  • quintuple rule matching and broadband number rule matching
  • broadband number and quintuple correspondence maintenance
  • uniform resource locator Uniform Resource Locator, URL
  • the above multiple DPI service cards need to perform all the above analysis tasks when processing a network traffic analysis task.
  • This method can be well implemented for a small number of network traffic analysis tasks, but for a large number of network traffic analysis tasks, due to The processing capacity of multiple DPI service cards is limited, and more DPI service cards need to be deployed.
  • the number of service card slots in the chassis is limited, and it is impossible to linearly expand the network traffic analysis system, so it is impossible to analyze a large number of network traffic tasks. to be processed.
  • the present application provides a method, apparatus, electronic device and storage medium for analyzing network traffic, so as to efficiently analyze a large amount of network traffic.
  • a network traffic analysis method is provided, which is applied to an accelerator card, including:
  • a network traffic analysis method is also provided, which is applied to the DPI service card, including:
  • Receive batches of data packets parse the batches of data packets, and obtain DNS domain names, session information and IP addresses of the batches of data packets;
  • a network traffic analysis system comprising: an accelerator card, and at least one DPI service card physically connected to the accelerator card;
  • the accelerator card is configured to receive batches of data packets and batch quintuple rules that require network traffic analysis; based on the data packets and the quintuple rules, determine the target data packets that need to add identification characters ; Based on the five-tuple rule, add identification characters to the target data message, and output the target data message after adding the identification characters to at least one DPI service card;
  • the at least one DPI service card is configured to generate quintuple rules corresponding to batches of data packets, send the quintuple rules corresponding to batches of data packets to the accelerator card, and receive the added identification sent by the accelerator card.
  • the identification characters in the data message are identified, and the data message with the identification characters is processed.
  • a network traffic analysis device the device is set in the acceleration card, including:
  • an information receiving module configured to receive batches of data messages and quintuple rules that require network traffic analysis in batches, wherein the quintuple rules are generated by the DPI service card based on the received data messages;
  • a target data message determination module configured to determine a target data message to which identification characters need to be added based on the data message and the quintuple rule
  • the identification character adding module is configured to add identification characters to the target data message based on the five-tuple rule, and output the target data message after adding the identification character to at least one DPI service card, so that the at least one DPI service card A DPI service card processes the target data message after adding identification characters.
  • a network traffic analysis device the device is set in at least one DPI service card, including:
  • a parsing module configured to receive batches of data packets, parse the batches of data packets, and obtain DNS domain names, session information and IP addresses of the batches of data packets;
  • the quintuple rule determination module is configured to determine, based on the DNS domain name, session information and IP address, quintuple rules corresponding to the data packets in batches, and send the quintuple rules to the accelerator card, so as to The acceleration card is made to match the five-tuple rule, and based on the five-tuple rule, an identification character is added to the data packet.
  • An electronic device comprising:
  • processors one or more processors
  • storage means arranged to store one or more programs
  • the one or more processors When the one or more programs are executed by the one or more processors, the one or more processors implement the network traffic analysis method described in any one of the embodiments of the application.
  • a storage medium containing computer-executable instructions is also provided, and when executed by a computer processor, the computer-executable instructions are used to execute the network traffic analysis method described in any one of the embodiments of this application.
  • Embodiment 1 is a flowchart of a method for analyzing network traffic in Embodiment 1 of the present application;
  • FIG. 2 is a schematic diagram of the execution of network traffic analysis in Embodiment 1 of the present application.
  • FIG. 3 is a schematic diagram of the execution of the network traffic analysis of the present application in Embodiment 1 of the present application;
  • FIG. 5 is a schematic structural diagram of a network traffic analysis system in Embodiment 3 of the present application.
  • FIG. 6 is a schematic structural diagram of a network traffic analysis device in Embodiment 4 of the present application.
  • FIG. 7 is a schematic structural diagram of an apparatus for analyzing network traffic in Embodiment 5 of the present application.
  • FIG. 8 is a schematic structural diagram of an electronic device in Embodiment 6 of the present application.
  • Embodiment 1 is a flowchart of a method for analyzing network traffic provided in Embodiment 1 of the present application. This embodiment is applied to an accelerator card and is applicable to a situation in which a large amount of network traffic is analyzed.
  • the method can be executed by a network traffic analyzing device.
  • the apparatus for analyzing network traffic can be implemented by software and/or hardware, and the apparatus for analyzing network traffic can be configured on an electronic computing device, and includes the following steps.
  • the acceleration card receives batches of data packets, and the data packets include quintuple information of the data packets.
  • the acceleration card also receives a quintuple rule sent by the at least one DPI service card and needs to be analyzed for network traffic, where the quintuple rule is generated by the at least one DPI service card based on the received data message.
  • the five-tuple rule here may be a batch of five-tuple rules sent by one DPI service card, or may be a batch of five-tuple rules sent by multiple DPI service cards.
  • this command is sent to the accelerator card by at least one DPI service card, and is informed to the accelerator card through the five-tuple rule sent by at least one DPI service card that needs to be analyzed for network traffic.
  • S120 Determine, based on the data message and the quintuple rule, a target data message to which identification characters need to be added.
  • the target data packet may be a data packet to which identification characters need to be added. Because when the accelerator card receives data packets, some packets do not require subsequent DPI service cards to perform subsequent network traffic analysis. It may be that at least one subsequent DPI service card does not perform subsequent network traffic analysis on the packets. The data packets that need to be analyzed in subsequent network traffic are regarded as the target data packets.
  • the data packet includes quintuple information (second quintuple information) of the data packet.
  • the quintuple rule also includes quintuple information (first quintuple information) of the data packet to be analyzed for network traffic.
  • determining the target data message to which identification characters need to be added based on the data message and the quintuple rule may be: extracting the second quintuple information in the data message, and the quintuple rule.
  • the first quintuple information compare the first quintuple information and the second quintuple information, and if the comparison is successful, use the data message corresponding to the second quintuple information as the target data to which identification characters need to be added message.
  • the first quintuple information here may be quintuple information of the data packet contained in the data packet received by the acceleration card.
  • the second quintuple information here may be the quintuple information of the data packets that need the DPI service card to perform subsequent network traffic analysis and contained in the quintuple rules sent by at least one DPI service card received by the acceleration card.
  • the accelerator card After receiving the data packet and the quintuple rule, the accelerator card extracts the second quintuple information from the data packet, extracts the first quintuple information from the quintuple rule, and compares the first quintuple information. The information and the second quintuple information, if the first quintuple information and the second quintuple information are consistent, it indicates that the data packet received by the accelerator card is a data packet that needs to add identification characters, that is, a target data packet.
  • the hash table structure and the ternary content addressable memory (tcam) module can be used respectively, and the hash table structure can be used to realize the comparison.
  • the comparison with the use of the tcam module belongs to related technologies, and will not be described here.
  • the method used to realize the comparison of the first quintuple information and the second quintuple information can be set according to user requirements, which is not limited here.
  • the acceleration card of the embodiment of the present application is optimized for operations such as query and update of the hash table structure, and the processing efficiency is higher, and the storage rule capacity of the acceleration card is also larger.
  • a separate accelerator card is used to complete the quintuple rule matching and mask quintuple rule matching process in network traffic analysis, which saves the processing process of subsequent DPI service cards and improves the efficiency of network traffic analysis of data packets. .
  • the batches of data packets are distributed to at least one DPI service card (for example, the data packets may be distributed evenly, or the data may be distributed unevenly).
  • message which is not limited here
  • at least one DPI service card matches the quintuple information in the quintuple rule for network traffic analysis to be performed by the DPI service card according to the received data message. Then, perform subsequent processing and analysis on the successfully matched data packets.
  • each DPI service card needs to perform the entire operation process of network traffic analysis, including the matching of quintuple rules and mask quintuple rules, as well as the subsequent processing and analysis process, so that the processing of each DPI service card
  • the capacity is limited, and when the amount of data packets that need to be analyzed for network traffic is huge, the number of DPI service cards cannot be increased due to the limitation of the number of card slots, which affects the processing efficiency of data packets.
  • the batch of data packets is sent to the accelerator card, and the accelerator card, according to the received data packets, and the following at least one DPI
  • the service card needs to match the quintuple information in the quintuple rule for network traffic analysis. After the matching is successful, it sends the successfully matched data packet to at least one DPI service card for subsequent processing and analysis.
  • the subsequent network traffic analysis process performed by at least one DPI service card in the embodiment of the present application after receiving the data packet with the quintuple rule matching successfully is not the core point of the present application, and will not be introduced in the embodiment of the present application.
  • an identification character can be added to the target data packet, and the identification character is used to make the DPI service card identify the subsequent request. Which data packets are used for network traffic analysis.
  • the target data packet with the identification character added is sent to at least one DPI service card, so that the at least one DPI service card can recognize the identification character, and the target data packet with the identification character added is sent to the at least one DPI service card.
  • the data packet is subjected to subsequent analysis and processing.
  • the target data packet with identification characters added to at least one DPI service card When sending the target data packet with identification characters added to at least one DPI service card, it also sends the data packet without identification characters to at least one DPI service card.
  • the identification characters in the data packets can be identified, and subsequent analysis and processing are performed on the target data packets with identification characters, but the data packets without identification characters are not analyzed and processed.
  • At least one DPI service card may carry the service card ID of at least one DPI service card when sending the quintuple rules to the accelerator card, so that the target data message can be sent to the corresponding DPI service card subsequently.
  • At least one DPI service card receives the target data message, it can also be received arbitrarily, which is not limited here.
  • adding identification characters to the target data message based on the quintuple rule and the target data message may be: adding preset specific session information in the quintuple rule as a tail to the target data message.
  • the tail of the suffix add the start and end identification characters at the beginning of the suffix and the end of the suffix.
  • preset specific session information is included in the five-tuple rule.
  • the preset specific session information may be preset to facilitate adding identification characters.
  • the preset specific session information in the quintuple rule is added as a tail to the tail of the target data packet, that is, the preset specific session information is added to the tail of the target data packet, and the start position and end position of the tail correspond to Add start and end identification characters. In this way, the purpose of adding identification characters to the target data message can be achieved.
  • identification characters are added to the data packets that require the DPI service card to perform network traffic analysis, so that the DPI service card can identify the data packets that require subsequent network traffic analysis, and perform subsequent network traffic analysis on the data packets. , which improves the efficiency of network traffic analysis on data packets.
  • the technical solutions of the embodiments of the present application by receiving batches of data packets and batch quintuple rules that require network traffic analysis, determine the target data packets to which identification characters need to be added based on the data packets and the quintuple rules, based on The five-tuple rule is to add identification characters to the target data packets, and output the target data packets after adding the identification characters to at least one DPI service card, so that at least one DPI service card can identify the target data packets after adding the identification characters.
  • a separate accelerator card is used to complete the process of matching quintuple rules and mask quintuple rules in network traffic analysis, which saves the subsequent processing process of at least one DPI business card, and improves the ability to deal with large amounts of data. Efficiency of packet network traffic analysis.
  • FIG. 4 is a flowchart of the method for analyzing network traffic provided in Embodiment 2 of the present application.
  • the embodiment of the present application is applied to at least one DPI service card, and may be combined with multiple optional solutions in the foregoing embodiment.
  • the embodiments of the present application may be applicable to the case of analyzing a large amount of network traffic, the method may be performed by a network traffic analysis device, and the network traffic analysis device may be implemented by software and/or hardware, and the network traffic analysis device may be configured in On the electronic computing device, the following steps are included.
  • the method of the embodiment of the present application includes the following steps.
  • S210 Receive batches of data packets, parse the batches of data packets, and obtain DNS domain names, session information, and IP addresses of the batches of data packets.
  • At least one DPI service card receives batches of data packets, parses each data packet, and obtains the DNS domain name, session information and IP address of each data packet.
  • S220 Determine the quintuple rules corresponding to the batches of data packets based on the DNS domain name, session information and IP address, and send the quintuple rules to the acceleration card, so that the acceleration card based on the quintuple rules, in the data packets Add identifying characters to the text.
  • the five-tuple rule corresponding to each data packet can be determined, and according to the DNS domain name, session information and IP address of each data packet.
  • the IP address and the determination of the quintuple rule corresponding to each data packet belong to the related art, which will not be described here.
  • the quintuple rules of the batches of data packets are sent to the accelerator card, and the quintuple rules include preset specific session information, so that the accelerator card can
  • the five-tuple rule is matched, and based on the preset specific session information in the five-tuple rule, the identification character is added to the data packet to which the identification character needs to be added, and the data sent by the received accelerator card after the identification character is added is added. message is processed.
  • the acceleration card matches the quintuple rules, and according to the quintuple rules, the process of adding identification characters to the data packets to be subjected to network traffic analysis is the same as that in the above-mentioned first embodiment, and will not be described here.
  • the quintuple rule corresponding to the data packet is obtained, so that the subsequent DPI service card can identify the network traffic analysis to be performed based on the preset specific session information in the quintuple rule. data message.
  • the method further includes: receiving a data packet returned by the acceleration card, and identifying the identification character in the data packet, and for all the identification characters with identification characters.
  • the data packets are processed.
  • the DPI service card identifies the identification character in the data packet, and processes the data packet with the identification character.
  • the DPI service card can recognize the identification characters, and perform the subsequent network traffic analysis process on the data packets with the identification characters, so that the network traffic analysis process performed by the accelerator card does not need to be performed, which relieves the pressure on at least one DPI service card. , it does not need to deploy more DPI service cards, and achieves the effect of efficiently analyzing a large amount of network traffic.
  • the quintuple rules corresponding to the data message are obtained.
  • the subsequent network traffic analysis process for data packets does not require the network traffic analysis process performed by the accelerator card, which relieves the pressure of at least one DPI service card, and does not need to deploy more DPI service cards. The effect of analyzing a large amount of network traffic.
  • FIG. 5 is a schematic structural diagram of a network traffic analysis system according to Embodiment 3 of the present application. As shown in FIG. 5 , the system includes an accelerator card 31 and at least one DPI service card 32 physically connected to the accelerator card 31 .
  • the accelerator card 31 is set to receive batches of data packets and batches of quintuple rules that need to be analyzed for network traffic; based on the data packets and the quintuple rules, determine the target data packets that need to add identification characters; Based on the five-tuple rule, add identification characters to the target data message, and output the target data message after adding the identification characters to at least one DPI service card 32;
  • At least one DPI service card 32 is configured to generate a quintuple rule corresponding to batches of data packets, send the quintuple rules corresponding to batches of data packets to the accelerator card, and receive the added identification characters sent by the accelerator card. After the data message, the identification characters in the data message are identified, and the data message with the identification characters is processed.
  • At least one DPI service card is set to receive batches of data packets, parse the batches of data packets, and obtain DNS domain names, session information and IP addresses of the batches of data packets; information and IP address, and determine the five-tuple rule corresponding to the batch of data packets.
  • Both the accelerator card and the at least one DPI service card in the embodiment of the present application are inserted into the card slot of the chassis.
  • the network traffic analysis system provided by the embodiment of the present application can execute the network traffic analysis method provided by any embodiment of the present application, and has functional modules and effects corresponding to the execution method.
  • FIG. 6 is a schematic structural diagram of an apparatus for analyzing network traffic provided in Embodiment 4 of the present application.
  • the apparatus for analyzing network traffic in this embodiment of the present application corresponds to the method for analyzing network traffic in Embodiment 1 above.
  • the device is set in an accelerator card, such as As shown in FIG. 6 , the device includes: an information receiving module 41 , a target data message determining module 42 and an identification character adding module 43 .
  • the information receiving module 41 is configured to receive batches of data packets and quintuple rules that require network traffic analysis in batches, wherein the quintuple rules are generated by the DPI service card based on the received data packets of;
  • the target data message determination module 42 is configured to determine, based on the data message and the quintuple rule, a target data message to which identification characters need to be added;
  • the identification character adding module 43 is configured to add identification characters to the target data message based on the five-tuple rule, and output the target data message after adding the identification characters to at least one DPI service card, so that the At least one DPI service card processes the target data message after adding identification characters.
  • the quintuple rule includes: first quintuple information
  • the data packet includes: second quintuple information corresponding to the data packet.
  • the target data message determination module 42 is set to:
  • the five-tuple rule further includes: preset specific session information.
  • the identification character adding module 43 includes:
  • an information adding unit configured to add the preset specific session information in the five-tuple rule as a tail to the tail of the target data message
  • the starting and ending identification character adding unit is set to add the starting and ending identification characters at the start position of the tail tag and the end position of the tail tag respectively.
  • the network traffic analysis apparatus provided by the embodiment of the present application can execute the network traffic analysis method provided by the first embodiment of the present application, and has functional modules and effects corresponding to the execution method.
  • FIG. 7 is a schematic structural diagram of an apparatus for analyzing network traffic provided in Embodiment 5 of the present application.
  • the apparatus for analyzing network traffic in this embodiment of the present application corresponds to the method for analyzing network traffic in Embodiment 2 above, and the device is provided on at least one DPI service card 7 , the apparatus includes: a parsing module 51 and a quintuple rule determining module 52 .
  • the parsing module 51 is configured to receive batches of data packets, parse the batches of data packets, and obtain DNS domain names, session information and IP addresses of the batches of data packets;
  • the quintuple rule determination module 52 is configured to determine the quintuple rule corresponding to the batch of data packets based on the DNS domain name, session information and IP address, and send the quintuple rule to the accelerator card , so that the accelerator card matches the quintuple rule, and adds identification characters to the data message based on the quintuple rule.
  • the device further includes:
  • the identification character recognition module is configured to receive the data message returned by the acceleration card, identify the identification character in the data message, and process the data message with the identification character.
  • the network traffic analysis apparatus provided by the embodiment of the present application can execute the network traffic analysis method provided by the second embodiment of the present application, and has functional modules and effects corresponding to the execution method.
  • FIG. 8 is a schematic structural diagram of an electronic device according to Embodiment 6 of the present application.
  • the electronic device includes a processor 70, a memory 71, an input device 72, and an output device 73;
  • the number can be one or more, and one processor 70 is taken as an example in FIG. 8; the processor 70, memory 71, input device 72 and output device 73 in the electronic device can be connected by a bus or in other ways. Take bus connection as an example.
  • the memory 71 can be configured to store software programs, computer-executable programs and modules, such as program instructions/modules corresponding to the network traffic analysis method in the embodiments of the present application (for example, the information receiving module 41, The target data message determination module 42 and the identification character addition module 43, and/or the parsing module 51 and the quintuple rule determination module 52).
  • the processor 70 executes various functional applications and data processing of the electronic device by running the software programs, instructions and modules stored in the memory 71, ie, implements the above-mentioned network traffic analysis method.
  • the memory 71 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created according to the use of the terminal, and the like.
  • the memory 71 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device.
  • memory 71 may include memory located remotely from processor 70, which may be connected to the electronic device through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
  • the input device 72 may be configured to receive input numerical or character information, and to generate key signal input related to user settings and function control of the electronic device.
  • the output device 73 may include a display device such as a display screen.
  • Embodiment 7 of the present application further provides a storage medium containing computer-executable instructions, where the computer-executable instructions are used to execute a network traffic analysis method when executed by a computer processor.
  • a storage medium containing computer-executable instructions provided by an embodiment of the present application the computer-executable instructions are not limited to the above method operations, and can also perform related operations in the network traffic analysis method provided by any embodiment of the present application .
  • the present application can be implemented by means of software and general hardware, and can also be implemented by hardware.
  • the technical solution of the present application can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a floppy disk of a computer, a read-only memory (Read-Only Memory, ROM), a random access memory ( Random Access Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including multiple instructions to make a computer electronic device (which may be a personal computer, server, or network device, etc.) method described.
  • a computer electronic device which may be a personal computer, server, or network device, etc.
  • the multiple units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, multiple functional units
  • the names are only for the convenience of distinguishing from each other, and are not used to limit the protection scope of this application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种网络流量分析方法。所述网络流量分析方法包括：接收批量的数据报文和批量需进行网络流量分析的五元组规则，其中，所述五元组规则是至少一个深度报文检测DPI业务卡基于接收的所述数据报文所生成的；基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡，以使所述至少一个DPI业务卡对添加标识字符后的目标数据报文进行处理。

Description

网络流量分析方法、装置、电子设备和存储介质
本申请要求在2020年10月16日提交中国专利局、申请号为202011112363.6的中国专利申请的优先权，该申请的全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据传输技术，例如涉及一种网络流量分析方法、装置、电子设备和存储介质。
背景技术
随着全球大数据以及人工智能技术的高速发展，对于网络性能需求越来越高，从原来的百兆、千兆的吞吐量迅速增长到现在的10吉字节(Gigabyte，G)、25G甚至100G、200G等等吞吐量，如何高效处理高吞吐量的数据是亟待解决的问题。
相关技术中，对网络流量的分析是依据网络流量分析深度报文检测(Deep Packet Inspection，DPI)系统来实现，在该系统中存在多个DPI业务卡，当接收到网络流量分析任务时，多个DPI业务卡对分配的网络流量分析任务进行分析，分析涉及域名系统(Domain Name System，DNS)域名解析、记录互联网协议(Internet Protocol，IP)地址表、五元组规则匹配、宽带号规则匹配、宽带号和五元组的对应关系维护、统一资源定位系统(Uniform Resource Locator，URL)解析和规则匹配等，需要进行报文内容解析，并做大量运算。
上述的多个DPI业务卡当对一个网络流量分析任务进行处理时，需要进行上述所有的分析工作，这种方式对于少量的网络流量分析任务可很好实施，但对于大量网络流量分析任务，由于多个DPI业务卡的处理能力有限，则需要部署更多的DPI业务卡，但机框业务卡槽位数目有限，不可能一直线性扩大网络流量分析系统，这样就无法对大量的网络流量分析任务进行处理。
发明内容
本申请提供一种网络流量分析方法、装置、电子设备和存储介质，以实现高效对大量网络流量进行分析。
提供了一种网络流量分析方法，该方法应用于加速卡，包括：
接收批量的数据报文和批量需进行网络流量分析的五元组规则，其中，所述五元组规则是至少一个DPI业务卡基于接收的所述数据报文所生成的；
基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；
基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡，以使所述至少一个DPI业务卡对添加标识字符后的目标数据报文进行处理。
还提供了一种网络流量分析方法，该方法应用于DPI业务卡，包括：
接收批量的数据报文，对所述批量的数据报文进行解析，获取所述批量的数据报文的DNS域名、会话信息和IP地址；
基于所述DNS域名、会话信息和IP地址，确定所述批量的数据报文对应的五元组规则，并将所述五元组规则发送至加速卡中，以使所述加速卡基于所述五元组规则，在数据报文中添加标识字符。
还提供了一种网络流量分析系统，该系统包括：加速卡，以及与所述加速卡物理连接的至少一个DPI业务卡；
所述加速卡，设置为接收批量的数据报文和批量需进行网络流量分析的五元组规则；基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡；
所述至少一个DPI业务卡，设置为生成批量的数据报文对应的五元组规则，将批量的数据报文对应的五元组规则发送至所述加速卡，以及接收加速卡发送的添加标识字符后的数据报文，识别所述数据报文中的标识字符，并对具有标识字符的数据报文进行处理。
还提供了一种网络流量分析装置，该装置设置于加速卡中，包括：
信息接收模块，设置为接收批量的数据报文和批量需进行网络流量分析的五元组规则，其中，所述五元组规则是DPI业务卡基于接收的所述数据报文所生成的；
目标数据报文确定模块，设置为基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；
标识字符添加模块，设置为基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡，以使所述至少一个DPI业务卡对添加标识字符后的目标数据报文进行处理。
还提供了一种网络流量分析装置，该装置设置于至少一个DPI业务卡中，包括：
解析模块，设置为接收批量的数据报文，对批量所述数据报文进行解析，获取批量所述数据报文的DNS域名、会话信息和IP地址；
五元组规则确定模块，设置为基于所述DNS域名、会话信息和IP地址，确定批量所述数据报文对应的五元组规则，并将所述五元组规则发送至加速卡中，以使所述加速卡对所述五元组规则进行匹配，以及基于所述五元组规则，在数据报文中添加标识字符。
还提供了一种电子设备，该电子设备包括：
一个或多个处理器；
存储装置，设置为存储一个或多个程序；
当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现申请实施例中任一所述的网络流量分析方法。
还提供了一种包含计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器执行时用于执行本申请实施例中任一所述的网络流量分析方法。
附图说明
图1是本申请实施例一中的网络流量分析方法的流程图；
图2是本申请实施例一中的网络流量分析的执行示意图；
图3是本申请实施例一中的本申请的网络流量分析的执行示意图；
图4是本申请实施例二中的网络流量分析方法的流程图；
图5是本申请实施例三中的网络流量分析系统的结构示意图；
图6是本申请实施例四中的网络流量分析装置的结构示意图；
图7是本申请实施例五中的网络流量分析装置的结构示意图；
图8是本申请实施例六中的一种电子设备的结构示意图。
具体实施方式
下面结合附图和实施例对本申请进行说明。此处所描述的实施例仅仅用于解释本申请，而非对本申请的限定。为了便于描述，附图中仅示出了与本申请相关的部分而非全部结构。
实施例一
图1为本申请实施例一提供的网络流量分析方法的流程图，本实施例应用于加速卡，可适用于对大量网络流量进行分析的情况，该方法可以由网络流量分析装置来执行，该网络流量分析装置可以由软件和/或硬件来实现，该网络流量分析装置可以配置在电子计算设备上，包括如下步骤。
S110、接收批量的数据报文和批量需进行网络流量分析的五元组规则，其中，五元组规则是至少一个DPI业务卡基于接收的数据报文所生成的。
示例性的，加速卡接收批量的数据报文，在数据报文中包括该数据报文的五元组信息。
加速卡还接收至少一个DPI业务卡发送的需进行网络流量分析的五元组规则，这里的五元组规则是至少一个DPI业务卡基于接收的数据报文所生成的。
这里的五元组规则可以是一个DPI业务卡发送的批量的五元组规则，也可以是多个DPI业务卡发送的批量的五元组规则。
要对哪些数据报文进行网络流量分析，这个指令是至少一个DPI业务卡发送给加速卡的，是通过至少一个DPI业务卡发送的需进行网络流量分析的五元组规则来告知加速卡的。
S120、基于数据报文和五元组规则，确定需添加标识字符的目标数据报文。
示例性的，目标数据报文可以是需要进行添加标识字符的数据报文。因为当加速卡接收到数据报文后，有些报文是不需后续的DPI业务卡进行后续的网络流量分析的，可以是后续的至少一个DPI业务卡不对该报文进行后续的网络流量分析，将需进行后续网络流量分析的数据报文作为目标数据报文。
可选的，在数据报文中包括该数据报文的五元组信息(第二五元组信息)。在五元组规则中也包含有要进行网络流量分析的数据报文的五元组信息(第一五元组信息)。
可选的，所述基于数据报文和五元组规则，确定需添加标识字符的目标数据报文，可以是：提取数据报文中的第二五元组信息，以及五元组规则中的第一五元组信息；比对第一五元组信息和第二五元组信息，若比对成功，则将第二五元组信息所对应的数据报文作为需添加标识字符的目标数据报文。
示例性的，这里的第一五元组信息可以是加速卡接收的数据报文中包含的数据报文的五元组信息。
这里的第二五元组信息可以是加速卡接收的至少一个DPI业务卡发送的五元组规则中包含的需DPI业务卡进行后续的网络流量分析的数据报文的五元组 信息。
当加速卡接收到数据报文和五元组规则后，分别从数据报文中提取第二五元组信息，从五元组规则中提取第一五元组信息，比对第一五元组信息和第二五元组信息，若第一五元组信息和第二五元组信息一致，则说明加速卡接收的数据报文为需要添加标识字符的数据报文，即目标数据报文。
在实现第一五元组信息和第二五元组信息比对时，可分别采用哈希表结构和三态内容寻址存储器(ternary content addressable memory，tcam)模块实现，利用哈希表结构实现和利用tcam模块实现比对均属于相关技术，这里不做说明。采用何种方式来实现第一五元组信息和第二五元组信息的比对，可根据用户需求自行设定，这里不做限定。
本申请实施例的加速卡对于哈希表结构的查询、更新等操作进行了优化，处理效率更高，该加速卡的存储的规则容量也较大。
利用一个单独的加速卡来完成网络流量分析中的五元组规则匹配和掩码五元组规则匹配的过程，节省了后续DPI业务卡的处理过程，提高了数据报文的网络流量分析的效率。
参考图2的网络流量分析的执行示意图，当接收到批量的数据报文后，将批量的数据报文分发给至少一个DPI业务卡(例如，可以平均分配数据报文，也可以不平均分配数据报文，这里不做限定)，至少一个DPI业务卡根据接收到的数据报文，与该DPI业务卡要进行网络流量分析的五元组规则中的五元组信息进行匹配，匹配成功后，再对匹配成功的数据报文进行后续的处理分析。这样每个DPI业务卡都要执行一遍网络流量分析的整个操作过程，包括五元组规则匹配和掩码五元组规则匹配的过程，以及后续的处理分析过程，这样每个DPI业务卡的处理能力有限，且当需要进行网络流量分析的数据报文的数据量巨大时，由于卡槽数量的限制，也无法增加DPI业务卡的数量，进而影响数据报文的处理效率。
参考图3的本申请的网络流量分析的执行示意图，当接收到批量的数据报文后，将批量的数据报文发送给加速卡，加速卡根据接收到的数据报文，与后面至少一个DPI业务卡要进行网络流量分析的五元组规则中的五元组信息进行匹配，匹配成功后，再将匹配成功的数据报文发送给至少一个DPI业务卡进行后续的处理分析过程。
本申请实施例中的至少一个DPI业务卡在接收到五元组规则匹配成功的数据报文后进行的后续网络流量分析过程不是本申请的核心要点，在本申请实施例中不做介绍。
S130、基于五元组规则，对目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡，以使至少一个DPI业务卡对添加标识字符后的目标数据报文进行处理。
示例性的，当确定了目标数据报文后，根据五元组规则中的预设的特定会话信息，可对目标数据报文添加标识字符，该标识字符用于使DPI业务卡识别出来后续要进行网络流量分析的是哪些数据报文。
当对目标数据报文添加标识字符后，将添加了标识字符的目标数据报文发送给至少一个DPI业务卡，以使至少一个DPI业务卡可识别该标识字符，并对添加有标识字符的目标数据报文进行后续的分析处理。
在将添加了标识字符的目标数据报文发送给至少一个DPI业务卡时，同时也会将未添加标识字符的数据报文发送给至少一个DPI业务卡，当至少一个DPI业务卡接收到数据报文后，可识别数据报文中的标识字符，对具有标识字符的目标数据报文进行后续的分析处理，而不分析处理未有标识字符的数据报文。
至少一个DPI业务卡在向加速卡发送五元组规则时，可携带有至少一个DPI业务卡的业务卡ID，这样以便后续可将目标数据报文发送给对应的DPI业务卡。至少一个DPI业务卡在接收目标数据报文时，也可以是任意接收，这里不做限定。
可选的，所述基于五元组规则和目标数据报文，对目标数据报文添加标识字符，可以是：将五元组规则中的预设特定会话信息作为尾标添加至目标数据报文的尾部；在尾标的开始位置和尾标的末尾位置分别添加起止标识字符。
示例性的，在五元组规则中包含有预设特定会话信息。该预设特定会话信息可以是预先设置的，以便于添加标识字符。
将五元组规则中的预设特定会话信息作为尾标添加至目标数据报文的尾部，即将预设特定会话信息添加到目标数据报文的尾部，在该尾部的开始位置和末尾位置分别对应添加起止标识字符。这样即可实现对目标数据报文添加标识字符的目的。
这样在后续需DPI业务卡进行网络流量分析的数据报文中添加标识字符，以便DPI业务卡可识别出需进行后续网络流量分析的数据报文，以对该数据报文进行后续的网络流量分析，提高了数据报文进行网络流量分析的效率。
本申请实施例的技术方案，通过接收批量的数据报文和批量需进行网络流量分析的五元组规则，基于数据报文和五元组规则，确定需添加标识字符的目标数据报文，基于五元组规则，对目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡，以使至少一个DPI业务卡 对添加标识字符后的目标数据报文进行处理，这样利用一个单独的加速卡来完成网络流量分析中的五元组规则匹配和掩码五元组规则匹配的过程，节省了后续至少一个DPI业务卡的处理过程，提高了对大量数据报文的网络流量分析的效率。
实施例二
图4为本申请实施例二提供的网络流量分析方法的流程图，本申请实施例应用于至少一个DPI业务卡，可与上述实施例中多个可选方案可以结合。本申请实施例可适用于对大量网络流量进行分析的情况，该方法可以由网络流量分析装置来执行，该网络流量分析装置可以由软件和/或硬件来实现，该网络流量分析装置可以配置在电子计算设备上，包括如下步骤。
如图4所示，本申请实施例的方法包括如下步骤。
S210、接收批量的数据报文，对批量的数据报文进行解析，获取批量的数据报文的DNS域名、会话信息和IP地址。
示例性的，至少一个DPI业务卡接收批量的数据报文，对每个数据报文进行解析，可得到每个数据报文的DNS域名、会话信息和IP地址。
S220、基于DNS域名、会话信息和IP地址，确定批量的数据报文对应的五元组规则，并将五元组规则发送至加速卡中，以使加速卡基于五元组规则，在数据报文中添加标识字符。
示例性的，根据解析出的每个数据报文的DNS域名、会话信息和IP地址，可确定每个数据报文对应的五元组规则，根据每个数据报文的DNS域名、会话信息和IP地址，确定每个数据报文对应的五元组规则属于相关技术，这里不做描述。
当确定了批量的数据报文的五元组规则后，将批量的数据报文的五元组规则发送至加速卡中，在五元组规则中包含预设特定会话信息，以使加速卡对五元组规则进行匹配，以及基于五元组规则中的预设特定会话信息，在需添加标识字符的数据报文中添加标识字符，并对接收的加速卡发送的添加了标识字符后的数据报文进行处理。
加速卡对五元组规则进行匹配，以及根据五元组规则，在需进行网络流量分析的数据报文中添加标识字符的过程与上述实施例一中的一致，这里不做描述。
通过对接收的数据报文进行解析，得到数据报文对应的五元组规则，以便 后续DPI业务卡可基于该五元组规则中的预设特定会话信息来识别出要进行后续网络流量分析的数据报文。
可选的，在所述将五元组规则发送至加速卡中后，所述方法还包括：接收加速卡返回的数据报文，并识别数据报文中的标识字符，对具有标识字符的所述数据报文进行处理。
示例性的，DPI业务卡在接收到加速卡发送的数据报文后，识别数据报文中的标识字符，并对具有标识字符的数据报文进行处理。
这样DPI业务卡可识别标识字符，并对具有标识字符的数据报文进行后续的网络流量分析过程，就不需执行加速卡所执行的网络流量分析过程，这样缓解了至少一个DPI业务卡的压力，不需部署较多的DPI业务卡，达到了高效对大量网络流量进行分析的效果。
本申请实施例的技术方案，通过对接收的数据报文进行解析，得到数据报文对应的五元组规则，同时DPI业务卡可识别出具有标识字符的数据报文，并对具有标识字符的数据报文进行后续的网络流量分析过程，就不需进行加速卡所进行的网络流量分析过程，这样缓解了至少一个DPI业务卡的压力，不需部署较多的DPI业务卡，达到了高效对大量网络流量进行分析的效果。
实施例三
图5为本申请实施例三提供的网络流量分析系统的结构示意图，如图5所示，该系统包括加速卡31，以及与加速卡31物理连接的至少一个DPI业务卡32。
加速卡31，设置为接收批量的数据报文和批量需进行网络流量分析的五元组规则；基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡32；
至少一个DPI业务卡32，设置为生成批量的数据报文对应的五元组规则，将批量的数据报文对应的五元组规则发送至所述加速卡，以及接收加速卡发送的添加标识字符后的数据报文，识别所述数据报文中的标识字符，并对具有标识字符的数据报文进行处理。
至少一个DPI业务卡是设置为接收批量的数据报文，对批量所述数据报文进行解析，获取所述批量的数据报文的DNS域名、会话信息和IP地址；基于所述DNS域名、会话信息和IP地址，确定所述批量的数据报文对应的五元组规则。
本申请实施例中的加速卡和至少一个DPI业务卡均插在机框的卡槽中。
本申请实施例所提供的网络流量分析系统可执行本申请任意实施例所提供的网络流量分析方法，具备执行方法相应的功能模块和效果。
实施例四
图6为本申请实施例四提供的网络流量分析装置的结构示意图，本申请实施例的网络流量分析装置与上述实施例一中的网络流量分析方法相对应，该装置设置于加速卡中，如图6所示，该装置包括：信息接收模块41、目标数据报文确定模块42和标识字符添加模块43。
其中，信息接收模块41，设置为接收批量的数据报文和批量需进行网络流量分析的五元组规则，其中，所述五元组规则是DPI业务卡基于接收的所述数据报文所生成的；
目标数据报文确定模块42，设置为基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；
标识字符添加模块43，设置为基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加标识字符后的目标数据报文输出给至少一个DPI业务卡，以使所述至少一个DPI业务卡对添加标识字符后的目标数据报文进行处理。
可选的，所述五元组规则包括：第一五元组信息，所述数据报文中包括：所述数据报文对应的第二五元组信息。
在上述实施例的技术方案的基础上，目标数据报文确定模块42是设置为：
提取所述数据报文中的第二五元组信息，以及所述五元组规则中的第一五元组信息；比对所述第一五元组信息和所述第二五元组信息，若比对成功，则将所述第二五元组信息所对应的数据报文作为需添加标识字符的目标数据报文。
可选的，所述五元组规则中还包括：预设特定会话信息。
在上述实施例的技术方案的基础上，标识字符添加模块43包括：
信息添加单元，设置为将所述五元组规则中的预设特定会话信息作为尾标添加至所述目标数据报文的尾部；
起止标识字符添加单元，设置为在所述尾标的开始位置和所述尾标的末尾位置分别添加起止标识字符。
本申请实施例所提供的网络流量分析装置可执行本申请实施例一所提供的 网络流量分析方法，具备执行方法相应的功能模块和效果。
实施例五
图7为本申请实施例五提供的网络流量分析装置的结构示意图，本申请实施例的网络流量分析装置与上述实施例二中的网络流量分析方法相对应，该装置设置于至少一个DPI业务卡中，如图7所示，该装置包括：解析模块51和五元组规则确定模块52。
其中，解析模块51，设置为接收批量的数据报文，对所述批量的数据报文进行解析，获取所述批量的数据报文的DNS域名、会话信息和IP地址；
五元组规则确定模块52，设置为基于所述DNS域名、会话信息和IP地址，确定所述批量的数据报文对应的五元组规则，并将所述五元组规则发送至加速卡中，以使所述加速卡对所述五元组规则进行匹配，以及基于所述五元组规则，在数据报文中添加标识字符。
在上述实施例的技术方案的基础上，该装置还包括：
标识字符识别模块，设置为接收加速卡返回的数据报文，并识别所述数据报文中的标识字符，对具有所述标识字符的所述数据报文进行处理。
本申请实施例所提供的网络流量分析装置可执行本申请实施例二所提供的网络流量分析方法，具备执行方法相应的功能模块和效果。
实施例六
图8为本申请实施例六提供的一种电子设备的结构示意图，如图8所示，该电子设备包括处理器70、存储器71、输入装置72和输出装置73；电子设备中处理器70的数量可以是一个或多个，图8中以一个处理器70为例；电子设备中的处理器70、存储器71、输入装置72和输出装置73可以通过总线或其他方式连接，图8中以通过总线连接为例。
存储器71作为一种计算机可读存储介质，可设置为存储软件程序、计算机可执行程序以及模块，如本申请实施例中的网络流量分析方法对应的程序指令/模块(例如，信息接收模块41、目标数据报文确定模块42和标识字符添加模块43，和/或，解析模块51和五元组规则确定模块52)。处理器70通过运行存储在存储器71中的软件程序、指令以及模块，从而执行电子设备的多种功能应用以及数据处理，即实现上述的网络流量分析方法。
存储器71可包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据终端的使用所创 建的数据等。此外，存储器71可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实例中，存储器71可包括相对于处理器70远程设置的存储器，这些远程存储器可以通过网络连接至电子设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
输入装置72可设置为接收输入的数字或字符信息，以及产生与电子设备的用户设置以及功能控制有关的键信号输入。输出装置73可包括显示屏等显示设备。
实施例七
本申请实施例七还提供一种包含计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器执行时用于执行一种网络流量分析方法。
本申请实施例所提供的一种包含计算机可执行指令的存储介质，计算机可执行指令不限于如上所述的方法操作，还可以执行本申请任意实施例所提供的网络流量分析方法中的相关操作。
本申请可借助软件及通用硬件来实现，也可以通过硬件实现。本申请的技术方案可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如计算机的软盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、闪存(FLASH)、硬盘或光盘等，包括多个指令用以使得一台计算机电子设备(可以是个人计算机，服务器，或者网络设备等)执行本申请多个实施例所述的方法。
上述网络流量分析装置的实施例中，所包括的多个单元和模块只是按照功能逻辑进行划分的，但并不局限于上述的划分，只要能够实现相应的功能即可；另外，多个功能单元的名称也只是为了便于相互区分，并不用于限制本申请的保护范围。

Claims (10)

  1. 一种网络流量分析方法，应用于加速卡，包括：
    接收批量的数据报文和批量需进行网络流量分析的五元组规则，其中，所述五元组规则是至少一个深度报文检测DPI业务卡基于接收的所述数据报文所生成的；
    基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；
    基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加所述标识字符后的目标数据报文输出给所述至少一个DPI业务卡，以使所述至少一个DPI业务卡对添加所述标识字符后的目标数据报文进行处理。
  2. 根据权利要求1所述的方法，其中，所述五元组规则包括：第一五元组信息，所述数据报文中包括：所述数据报文对应的第二五元组信息；
    所述基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文，包括：
    提取所述数据报文中的第二五元组信息，以及所述五元组规则中的第一五元组信息；
    比对所述第一五元组信息和所述第二五元组信息，在比对成功的情况下，将所述第二五元组信息所对应的数据报文作为所述需添加标识字符的目标数据报文。
  3. 根据权利要求1所述的方法，其中，所述五元组规则中包括：预设特定会话信息；
    所述基于所述五元组规则，对所述目标数据报文添加标识字符，包括：
    将所述五元组规则中的预设特定会话信息作为尾标添加至所述目标数据报文的尾部；
    在所述尾标的开始位置和所述尾标的末尾位置分别添加起止标识字符。
  4. 一种网络流量分析方法，应用于深度报文检测DPI业务卡，包括：
    接收批量的数据报文，对所述批量的数据报文进行解析，获取所述批量的数据报文的域名系统DNS域名、会话信息和互联网协议IP地址；
    基于所述DNS域名、所述会话信息和所述IP地址，确定所述批量的数据报文对应的五元组规则，并将所述五元组规则发送至加速卡中，以使所述加速卡基于所述五元组规则，在数据报文中添加标识字符。
  5. 根据权利要求4所述的方法，其中，在所述将所述五元组规则发送至加 速卡中后，所述方法还包括：
    接收所述加速卡返回的数据报文，并识别所述数据报文中的标识字符，对具有所述标识字符的所述数据报文进行处理。
  6. 一种网络流量分析系统，包括：加速卡，以及与所述加速卡物理连接的至少一个深度报文检测DPI业务卡；
    所述加速卡，设置为接收批量的数据报文和批量需进行网络流量分析的五元组规则；基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加所述标识字符后的目标数据报文输出给所述至少一个DPI业务卡；
    所述至少一个DPI业务卡，设置为生成批量的数据报文对应的五元组规则，将所述批量的数据报文对应的五元组规则发送至所述加速卡，以及接收所述加速卡发送的添加所述标识字符后的数据报文，识别所述数据报文中的标识字符，并对具有所述标识字符的数据报文进行处理。
  7. 一种网络流量分析装置，包括：
    信息接收模块，设置为接收批量的数据报文和批量需进行网络流量分析的五元组规则，其中，所述五元组规则是至少一个深度报文检测DPI业务卡基于接收的所述数据报文所生成的；
    目标数据报文确定模块，设置为基于所述数据报文和所述五元组规则，确定需添加标识字符的目标数据报文；
    标识字符添加模块，设置为基于所述五元组规则，对所述目标数据报文添加标识字符，并将添加所述标识字符后的目标数据报文输出给所述至少一个DPI业务卡，以使所述至少一个DPI业务卡对添加所述标识字符后的目标数据报文进行处理。
  8. 一种网络流量分析装置，包括：
    解析模块，设置为接收批量的数据报文，对所述批量的数据报文进行解析，获取所述批量的数据报文的域名系统DNS域名、会话信息和互联网协议IP地址；
    五元组规则确定模块，设置为基于所述DNS域名、所述会话信息和所述IP地址，确定所述批量的数据报文对应的五元组规则，并将所述五元组规则发送至加速卡中，以使所述加速卡对所述五元组规则进行匹配，以及基于所述五元组规则，在数据报文中添加标识字符。
  9. 一种电子设备，包括：
    一个或多个处理器；
    存储装置，设置为存储一个或多个程序；
    当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现以下至少之一：如权利要求1-3中任一项所述的网络流量分析方法，或，如权利要求4-5中任一项所述的网络流量分析方法。
  10. 一种包含计算机可执行指令的存储介质，其中，所述计算机可执行指令在由计算机处理器执行时用于执行以下至少之一：如权利要求1-3中任一项所述的网络流量分析方法，或，如权利要求4-5中任一项所述的网络流量分析方法。
PCT/CN2021/116357 2020-10-16 2021-09-03 网络流量分析方法、装置、电子设备和存储介质 WO2022078104A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011112363.6A CN112272123B (zh) 2020-10-16 2020-10-16 网络流量分析方法、系统、装置、电子设备和存储介质
CN202011112363.6 2020-10-16

Publications (1)

Publication Number Publication Date
WO2022078104A1 true WO2022078104A1 (zh) 2022-04-21

Family

ID=74338347

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/116357 WO2022078104A1 (zh) 2020-10-16 2021-09-03 网络流量分析方法、装置、电子设备和存储介质

Country Status (2)

Country Link
CN (1) CN112272123B (zh)
WO (1) WO2022078104A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115065641A (zh) * 2022-06-09 2022-09-16 深圳市东晟数据有限公司 汇聚分流系统
CN115484217A (zh) * 2022-09-06 2022-12-16 燕山大学 基于正交架构一体化的高效动态收敛机制实现方法和系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112272123B (zh) * 2020-10-16 2022-04-15 北京锐安科技有限公司 网络流量分析方法、系统、装置、电子设备和存储介质
CN112953841B (zh) * 2021-02-20 2022-05-27 杭州迪普信息技术有限公司 报文分流方法及系统
CN115225544A (zh) * 2022-07-19 2022-10-21 武汉思普崚技术有限公司 一种网络流量统计和监测方法、装置、电子设备及介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101399749A (zh) * 2007-09-27 2009-04-01 华为技术有限公司 一种报文过滤的方法、系统和设备
CN104717101A (zh) * 2013-12-13 2015-06-17 中国电信股份有限公司 深度包检测方法和系统
CN108259371A (zh) * 2016-12-28 2018-07-06 亿阳信通股份有限公司 一种基于流处理的网络流量数据解析方法和装置
CN109391520A (zh) * 2017-08-10 2019-02-26 中国移动通信有限公司研究院 基于融合型家庭网关的深度报文检测方法、装置和系统
US20200128429A1 (en) * 2009-04-02 2020-04-23 Telefonaktiebolaget Lm Ericsson (Publ) Techniques for Handling Network Traffic
CN112272123A (zh) * 2020-10-16 2021-01-26 北京锐安科技有限公司 网络流量分析方法、装置、电子设备和存储介质

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8270413B2 (en) * 2005-11-28 2012-09-18 Cisco Technology, Inc. Method and apparatus for self-learning of VPNS from combination of unidirectional tunnels in MPLS/VPN networks
EP2437470A1 (en) * 2010-09-30 2012-04-04 British Telecommunications Public Limited Company Network element and method for deriving quality of service data from a distributed hierarchical naming system
US9060308B2 (en) * 2013-01-11 2015-06-16 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Avoiding network address translation in a mobile data network
CN103795709B (zh) * 2013-12-27 2017-01-18 北京天融信软件有限公司 一种网络安全检测方法和系统
CN104156389B (zh) * 2014-07-04 2017-12-26 重庆邮电大学 基于Hadoop平台的深度包检测系统及方法
US9832140B2 (en) * 2015-02-20 2017-11-28 Saisei Networks, Pte Ltd. System and method for characterizing network traffic
CN104780080B (zh) * 2015-04-13 2018-09-25 苏州迈科网络安全技术股份有限公司 深度报文检测方法及系统
CN106209506B (zh) * 2016-06-30 2019-10-25 瑞斯康达科技发展股份有限公司 一种虚拟化深度包检测流量分析方法及系统
CN109995731B (zh) * 2017-12-30 2021-11-30 中国移动通信集团辽宁有限公司 提高缓存吐出流量的方法、装置、计算设备及存储介质
CN107948022B (zh) * 2018-01-11 2021-04-30 北京安博通科技股份有限公司 一种对等网络流量的识别方法及识别装置
CN109167796B (zh) * 2018-09-30 2020-05-19 浙江大学 一种基于工业scada系统的深度包检测平台
CN109768936B (zh) * 2018-11-30 2022-11-08 南京中新赛克科技有限责任公司 一种精细化分流系统及分流方法
CN109639593B (zh) * 2018-12-24 2022-08-12 南京中孚信息技术有限公司 一种深度报文分析系统的升级方法及装置
CN110768875A (zh) * 2019-12-27 2020-02-07 北京安博通科技股份有限公司 一种基于dns学习的应用识别方法及系统
CN111130946B (zh) * 2019-12-30 2022-03-25 联想(北京)有限公司 一种深度报文识别的加速方法、装置和存储介质
CN111277570A (zh) * 2020-01-10 2020-06-12 中电长城网际系统应用有限公司 数据的安全监测方法和装置、电子设备、可读介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101399749A (zh) * 2007-09-27 2009-04-01 华为技术有限公司 一种报文过滤的方法、系统和设备
US20200128429A1 (en) * 2009-04-02 2020-04-23 Telefonaktiebolaget Lm Ericsson (Publ) Techniques for Handling Network Traffic
CN104717101A (zh) * 2013-12-13 2015-06-17 中国电信股份有限公司 深度包检测方法和系统
CN108259371A (zh) * 2016-12-28 2018-07-06 亿阳信通股份有限公司 一种基于流处理的网络流量数据解析方法和装置
CN109391520A (zh) * 2017-08-10 2019-02-26 中国移动通信有限公司研究院 基于融合型家庭网关的深度报文检测方法、装置和系统
CN112272123A (zh) * 2020-10-16 2021-01-26 北京锐安科技有限公司 网络流量分析方法、装置、电子设备和存储介质

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115065641A (zh) * 2022-06-09 2022-09-16 深圳市东晟数据有限公司 汇聚分流系统
CN115484217A (zh) * 2022-09-06 2022-12-16 燕山大学 基于正交架构一体化的高效动态收敛机制实现方法和系统
CN115484217B (zh) * 2022-09-06 2024-01-05 燕山大学 基于正交架构一体化的高效动态收敛机制实现方法和系统

Also Published As

Publication number Publication date
CN112272123B (zh) 2022-04-15
CN112272123A (zh) 2021-01-26

Similar Documents

Publication Publication Date Title
WO2022078104A1 (zh) 网络流量分析方法、装置、电子设备和存储介质
CN110113345B (zh) 一种基于物联网流量的资产自动发现的方法
CN106936791B (zh) 拦截恶意网址访问的方法和装置
EP2482517B1 (en) Method, apparatus and system for protocol identification
CN112600852B (zh) 漏洞攻击处理方法、装置、设备及存储介质
US11824834B1 (en) Distributed firewall that learns from traffic patterns to prevent attacks
CN111817984B (zh) 消息发送方法、装置、设备及存储介质
CN111866030B (zh) 一种拟态边缘网关的工业协议识别装置及方法
CN113316926A (zh) 域名处理方法、装置、电子设备以及存储介质
CN113360301B (zh) 一种消息传输系统及方法
CN112583797B (zh) 多协议数据处理方法、装置、设备及计算机可读存储介质
CN111510353A (zh) 在线设备的检测方法、装置、设备及计算机可读存储介质
CN111901396B (zh) 一种资源请求响应方法、重定向服务器及决策分发服务器
CN113825129A (zh) 一种5g网络环境下工业互联网资产测绘方法
CN112929376A (zh) 一种流量数据的处理方法、装置、计算机设备和存储介质
CN111294288A (zh) 一种流量识别方法、装置、应用程序接口网关和存储介质
CN111680303A (zh) 漏洞扫描方法、装置、存储介质及电子设备
CN114050917B (zh) 音频数据的处理方法、装置、终端、服务器及存储介质
CN111741010A (zh) 一种基于代理的Docker操作请求处理方法、装置及计算设备
CN108650274B (zh) 一种网络入侵检测方法及系统
CN107483508B (zh) 报文过滤方法、装置、设备及存储介质
CN112989315B (zh) 物联网终端的指纹生成方法、装置、设备和可读存储介质
CN115314319A (zh) 一种网络资产识别方法、装置、电子设备及存储介质
CN114301872A (zh) 基于域名的访问方法及装置、电子设备、存储介质
CN114143385A (zh) 一种网络流量数据的识别方法、装置、设备和介质

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21879150

Country of ref document: EP

Kind code of ref document: A1