WO2022127196A1 - 应用识别方法、装置、设备及存储介质 - Google Patents

应用识别方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2022127196A1
WO2022127196A1 PCT/CN2021/115879 CN2021115879W WO2022127196A1 WO 2022127196 A1 WO2022127196 A1 WO 2022127196A1 CN 2021115879 W CN2021115879 W CN 2021115879W WO 2022127196 A1 WO2022127196 A1 WO 2022127196A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
target
feature data
data
network traffic
Prior art date
Application number
PCT/CN2021/115879
Other languages
English (en)
French (fr)
Inventor
田慧萌
万月亮
火一莽
Original Assignee
北京锐安科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京锐安科技有限公司 filed Critical 北京锐安科技有限公司
Publication of WO2022127196A1 publication Critical patent/WO2022127196A1/zh

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing data switching networks
    • H04L43/08Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876Network utilisation, e.g. volume of load or congestion level
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/22Indexing; Data structures therefor; Storage structures
    • G06F16/2228Indexing structures
    • G06F16/2255Hash tables

Definitions

  • the present application relates to the field of data processing, for example, to an application identification method, apparatus, device and storage medium.
  • HTTP Hyper Text Transfer Protocol
  • HTTPS Hyper Text Transfer Protocol over SecureSocket Layer
  • the present application provides an application identification method, device, device and storage medium, so as to realize enhancement of identification of a large number of applications, improvement of efficiency, comprehensive identification and high accuracy.
  • App identification methods are provided, including:
  • An application identification feature library is searched according to the target feature data, and a target application corresponding to the target feature data is identified.
  • an application identification device comprising:
  • a first obtaining module configured to obtain target network traffic data sent by the target terminal
  • an analysis module configured to analyze the target network traffic data to obtain target feature data
  • the identification module is configured to search an application identification feature library according to the target feature data, and identify the target application corresponding to the target feature data.
  • a computer device including a memory, a processor, and a computer program stored in the memory and running on the processor, and when the processor executes the computer program, any one of the embodiments of the present application is implemented. application identification method.
  • a computer-readable storage medium which stores a computer program, and when the computer program is executed by a processor, implements the application identification method described in any of the embodiments of the present application.
  • Embodiment 1 is a flowchart of an application identification method in Embodiment 1 of the present application.
  • FIG. 2 is a flowchart of an application identification method in Embodiment 2 of the present application.
  • Fig. 2a is a flow chart of an automatic packet capture process in the second embodiment of the present application.
  • Fig. 2b is the overall topology scheme diagram of application identification in the second embodiment of the present application.
  • Embodiment 3 is a schematic structural diagram of an application identification device in Embodiment 3 of the present application.
  • FIG. 4 is a schematic structural diagram of a computer device in Embodiment 4 of the present application.
  • Embodiment 1 is a flowchart of an application identification method provided in Embodiment 1 of the present application. This embodiment is applicable to the case of identifying an application corresponding to network traffic data sent by a terminal.
  • the apparatus may be implemented in software and/or hardware. As shown in FIG. 1 , the method includes the following steps.
  • S110 Acquire target network traffic data sent by the target terminal.
  • the target terminal may be any terminal device capable of loading applications, such as a mobile phone, a tablet, and a computer.
  • the target network traffic data sent by the target terminal refers to the network traffic data generated by the target terminal in the process of using the application.
  • the target feature data is the feature data in the HTTP protocol message or the HTTPS protocol message of the APP that can be used to identify the application.
  • the target network traffic data sent by the target terminal is analyzed, and the target feature data in the network traffic data is extracted to identify the application corresponding to the target feature data.
  • S130 Search an application identification feature library according to the target feature data, and determine a target application corresponding to the target feature data.
  • the application identification feature library may be a pre-established database containing feature data of all applications before the application is identified. Wherein, the embodiment of the present application does not limit the data storage manner of the application identification feature library.
  • the application identification feature database is searched. If the target feature data matches the feature data contained in the application identification feature database, The information determines the target application corresponding to the target feature data.
  • target feature data corresponding to the target network traffic data is obtained by parsing the target network traffic data sent by the target terminal, and the application identification feature library is searched according to the target feature data, thereby determining the target application, which can realize the detection of massive applications.
  • the recognition is enhanced, the efficiency is improved, the recognition is comprehensive, and the accuracy is high.
  • the implementation process is simple and easy to adapt to the rapid changes of APP in the Internet age.
  • target feature data corresponding to the target network traffic data is obtained by parsing the target network traffic data sent by the target terminal, and an application identification feature library is searched according to the target feature data, thereby determining the corresponding target application, and the method for enhancing application identification can only be It is time-consuming and labor-intensive to analyze a limited number of APPs and support them by writing templates. It is difficult to keep up with the speed of APP changes, and it is difficult to cover the problems of enough APPs to achieve enhanced identification of massive applications, improved efficiency, and comprehensive and accurate identification. High performance, simple implementation process and easy to adapt to the ever-changing changes of APP in the Internet age.
  • FIG. 2 is a flowchart of an application identification method in Embodiment 2 of the present application. This embodiment is described based on the above-mentioned embodiment.
  • the target feature data includes: a target host header (HOST) and/or target server name indication (Server Name Indication, SNI).
  • Searching for an application identification feature library according to the target feature data, and determining a target application corresponding to the target feature data includes: searching an application identification feature library according to the target HOST, and determining a target application identifier (Identifier, ID) corresponding to the target HOST ) and the target application name, or search an application identification feature library according to the target SNI, and determine the target application ID and target application name corresponding to the target SNI.
  • ID target application identifier
  • the method of this embodiment includes the following steps.
  • S210 Acquire target network traffic data sent by the target terminal.
  • S220 Analyze the target network traffic data to obtain target feature data, where the target feature data includes: target HOST and/or target SNI.
  • the target network traffic data is parsed to obtain HTTP protocol packets and/or HTTPS protocol packets, the target HOST is extracted from the HTTP protocol packets, and the target SNI is extracted from the HTTPS protocol packets.
  • the network traffic data generated in the process of using the APP may include only HTTP protocol packets, only HTTPS protocol packets, or may include HTTP protocol packets and HTTPS protocol packets.
  • the application identification feature library is a database that is pre-established before the application is identified and used to store the feature data of the application and the application ID and application name corresponding to the feature data.
  • the data storage manner of the application identification feature library may be any database table manner, which is not limited in this embodiment of the present application.
  • the application identification feature library is searched according to the target HOST to determine the target application ID and target application name corresponding to the target HOST; if the network traffic data corresponding to the APP contains Only include the HTTPS protocol message, search the application identification feature library according to the target SNI, and determine the target application ID and target application name corresponding to the target SNI; if the network traffic data corresponding to the APP includes the HTTP protocol message and the HTTPS protocol message. text, search the application identification feature library according to the target HOST, and determine the target application ID and target application name corresponding to the target HOST, or search the application identification feature library according to the target SNI, and determine the target corresponding to the target SNI. App ID and target app name.
  • the method before acquiring the target network traffic data sent by the target terminal, the method further includes:
  • the network traffic data generated by each application is saved as a PCAP file, wherein the PCAP file carries the application ID and application name corresponding to the network traffic data.
  • the above-mentioned application is installed through the simulator, the network traffic data generated during the running of the application is obtained, and saved as a PCAP file, which is also called an automatic packet capture process.
  • the steps of the automatic packet capture process can be as follows step.
  • the first step is to open the emulator.
  • Step 2 Install the app package on the emulator by executing the installation tool, wherein the installation tool can be an Android Debug Bridge (Android Debug Bridge, ADB) Android tool and other installation tools that can implement APP installation.
  • the installation tool can be an Android Debug Bridge (Android Debug Bridge, ADB) Android tool and other installation tools that can implement APP installation.
  • Step 3 Execute the packet capture tool program and pass in the application ID as a parameter, and wait for the APP to start.
  • the packet capture tool can be a tool such as tcpdump that can capture network traffic packets.
  • Step 4 Start the application and perform common operations such as browsing pages on the APP.
  • the AppCrawle tool for automatically traversing the APP pages can be executed to simulate the normal behavior of the user to the APP. Operation, waiting for AppCrawler to complete execution.
  • the fifth step after obtaining the network traffic data generated by each application during the operation, export the network traffic data, and save the network traffic data as a PCAP file.
  • the way to export the network traffic data can be to use the tcpdump-dump command or other commands. Or tools to export the network traffic data generated during the use of the APP.
  • the application ID and application name corresponding to the network traffic data are carried in the PCAP file, and the way of carrying the application ID and application name may be naming the PCAP file according to the application ID, application name and version information or saving the application ID in the PCAP file. , application name and version information, so as to determine the application information according to the data in the PCAP file.
  • the crawler technology can be used to obtain the installation packages of the massive applications.
  • the steps are: deploying the python crawler script on the server, Start the scheduled task, execute the crawler script, and grab the download addresses of the APPs on the leaderboards of several large application markets; start the download script, download the APPs one by one according to the collected download addresses, and call the Android Developer Toolkit after the download is complete.
  • the decompilation tool AXMLPrinter2 parses the APP installation package, extracts the application ID, application name and version information, and can rename the installation package according to the rule of application name + application ID.
  • the method further includes:
  • the first feature data, and the application ID and application name corresponding to the first feature data are stored in an application identification feature library.
  • the candidate feature data is obtained by parsing HTTP protocol packets and HTTPS protocol packets.
  • the first feature data corresponding to each application ID is determined according to the candidate feature data, and the application ID and application name corresponding to the candidate feature data, and the first feature data, the application ID corresponding to the first feature data and the The application name is stored in the application identification signature library.
  • the first feature data, as well as the application ID and application name corresponding to the first feature data, are stored in the application identification feature database in the following manner: the candidate feature data of each application and the corresponding The application ID and application name are stored in the first file, the candidate feature data in the first file corresponding to each application is read, and a candidate global hash table is established. Select the first feature data corresponding to each application ID according to the candidate global hash table, and store the first feature data in the application identification feature library.
  • the method of storing the first feature data, and the application ID and application name corresponding to the first feature data in the application identification feature library can also be according to the candidate feature data of each application, and the corresponding candidate feature data.
  • the application ID and application name build a candidate global hash table. Select the first feature data corresponding to each application ID according to the candidate global hash table, and store the first feature data in the application identification feature library.
  • the candidate feature data may include: a candidate HOST and a candidate SNI, the candidate HOST is obtained by parsing the HTTP protocol message, and the candidate SNI is obtained by parsing the HTTPS protocol message.
  • Each application may contain multiple candidate HOSTs or multiple candidate SNIs, or may simultaneously include multiple candidate HOSTs and multiple candidate SNIs.
  • All candidate feature data extracted from each PCAP file, and the application ID and application name corresponding to the candidate feature data are stored in the first file, and the format of the first file is as follows:
  • the application ID is the unique identifier of the application, which can be in the format of com.example.myapp; most of the appnames have only one, but there may be cases where the same application uses different application names in different application markets. It is separated by commas; there may be multiple HOSTs and SNIs, which are separated by commas.
  • determine the first feature data corresponding to each application ID according to the candidate feature data, and the application ID and application name corresponding to the candidate feature data including:
  • the first feature data corresponding to each application ID is selected through the candidate global hash table.
  • the first characteristic data is characteristic data unique to each application compared with other applications, and can be used to identify IDs and application names of different applications.
  • the first feature data, and the application ID and application name corresponding to the first feature data are stored in an application identification feature library.
  • the method of storing the first feature data and the application ID and application name corresponding to the first feature data in the application identification feature library may be: storing the first feature data and the application corresponding to the first feature data
  • the ID and application name are stored in a second file, and the second file may be a mapping file.
  • the first feature data includes: a globally unique HOST and/or a globally unique SNI.
  • the first feature data may include: globally unique HOST and/or globally unique SNI, then storing the first feature data and the application ID and application name corresponding to the first feature data in the application identification feature library may be: If the first feature data is a globally unique HOST, the globally unique HOST, as well as the application ID and application name corresponding to the globally unique HOST are stored in the application identification feature database; if the first feature data is a globally unique SNI, the globally unique SNI, And the application ID and application name corresponding to the globally unique SNI are stored in the application identification signature database; if the first feature data is a globally unique HOST and a globally unique SNI, the globally unique HOST and the application ID and application name corresponding to the globally unique HOST are stored and store the globally unique SNI and the application ID and application name corresponding to the globally unique SNI in the application identification feature database.
  • the first feature data and the corresponding application ID and application name of the first feature data are stored in the second file, and the data in the second file is stored in an Extensible Markup Language (Extensible Markup Language, XML) format, such as:
  • the steps in this embodiment are: the application identification system in this embodiment needs one server for application analysis, one high-performance server for application identification, and one offloading device running on the current network , a database server.
  • the application analysis server needs to be able to access the Internet.
  • the application server sends the final analysis result, that is, the mapping file in xml format, to the application identification server, and the application identification server reloads the mapping file, performs application identification and structured output data on the accessed data, and transmits it to the database server.
  • the implementation process includes the following steps.
  • the application analysis server needs to deploy the automatic packet capture and storage program, the PCAP file parsing program, and the collision analysis program. One-click installation and deployment by script.
  • Database server construction Build a database server according to the data scale. If the data scale is small, mysql and oracle can be used; if the data volume is large, a distributed storage system (Hadoop Distributed File System, HDFS) needs to be built.
  • HDFS Hadoop Distributed File System
  • the distribution device performs mirroring of the current network data traffic.
  • FIG. 3 is a schematic structural diagram of an application identification device according to Embodiment 3 of the present application. This embodiment can be applied to the situation of identifying the application corresponding to the network traffic data sent by the terminal.
  • the device can be implemented in software and/or hardware, and the device can be integrated into any device that provides the function of application identification, as shown in Figure 3
  • the device for application identification includes: a first acquisition module 310 , a parsing module 320 and an identification module 330 .
  • the first obtaining module 310 is configured to obtain target network traffic data sent by the target terminal;
  • the parsing module 320 is configured to parse the target network traffic data to obtain target feature data
  • the identification module 330 is configured to search an application identification feature library according to the target feature data, and determine a target application corresponding to the target feature data.
  • the target feature data includes: target HOST and/or target SNI;
  • the identification module 330 is set to:
  • Target application name Search the application identification feature library according to the target HOST, and determine the target application ID and target application name corresponding to the target HOST, or search the application identification feature library according to the target SNI, and determine the target application ID and the target application ID corresponding to the target SNI.
  • Target application name Search the application identification feature library according to the target HOST, and determine the target application ID and target application name corresponding to the target HOST, or search the application identification feature library according to the target SNI, and determine the target application ID and the target application ID corresponding to the target SNI.
  • Target application name Search the application identification feature library according to the target HOST, and determine the target application ID and target application name corresponding to the target HOST, or search the application identification feature library according to the target SNI, and determine the target application ID and the target application ID corresponding to the target SNI.
  • the device further includes:
  • the installation module is set to install at least one application through the simulator before acquiring the target network traffic data sent by the target terminal;
  • the second acquisition module is configured to acquire network traffic data generated by each application during operation
  • the saving module is configured to save the network traffic data generated by each application as a PCAP file, wherein the PCAP file carries an application ID and an application name corresponding to the network traffic data.
  • the device further includes:
  • Obtaining module be set to after the network traffic data that each application produces is saved as PCAP file, parse described PCAP file to obtain candidate feature data, and the corresponding application ID and application name of described candidate feature data;
  • a determination module configured to determine the first feature data corresponding to each application ID according to the candidate feature data, and the application ID and the application name corresponding to the candidate feature data;
  • the storage module is configured to store the first feature data and the application ID and application name corresponding to the first feature data in an application identification feature library.
  • the determining module is set to:
  • the first feature data corresponding to each application ID is selected through the candidate global hash table.
  • the first feature data includes: a globally unique HOST or a globally unique SNI.
  • the above product can execute the method provided by any embodiment of the present application, and has functional modules and effects corresponding to the execution method.
  • the application name and application ID of the target application can be determined by analyzing the network traffic data of the target application, obtaining the target feature data corresponding to the target application, and querying the application identification feature database according to the target feature data, thereby determining the application name and application ID of the target application.
  • the identification of massive applications is enhanced, the efficiency is improved, the identification is comprehensive, and the accuracy is high.
  • the implementation process is simple and easy to adapt to the rapid changes of APP in the network era.
  • FIG. 4 is a schematic structural diagram of a computer device in Embodiment 4 of the present application.
  • FIG. 4 shows a block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present application.
  • the computer device 12 shown in FIG. 4 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present application.
  • computer device 12 takes the form of a general-purpose computing device.
  • Components of computer device 12 may include, but are not limited to, one or more processors or processing units 16 , system memory 28 , and a bus 18 connecting various system components including system memory 28 and processing unit 16 .
  • Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of a variety of bus structures.
  • these architectures include, but are not limited to, Industry Subversive Alliance (ISA) bus, Micro Channel Architecture (MCA) bus, enhanced ISA bus, Video Electronics Standards Association (Video Electronics Standards Association) Association, VESA) local bus and Peripheral Component Interconnect (PCI) bus.
  • ISA Industry Subversive Alliance
  • MCA Micro Channel Architecture
  • VESA Video Electronics Standards Association
  • PCI Peripheral Component Interconnect
  • Computer device 12 includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 12, including both volatile and nonvolatile media, removable and non-removable media.
  • System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and/or cache memory (cache 32).
  • Computer device 12 may include other removable/non-removable, volatile/non-volatile computer system storage media.
  • storage system 34 may be used to read and write to non-removable, non-volatile magnetic media (not shown in FIG. 4, commonly referred to as a "hard drive").
  • System memory 28 may include at least one program product having a set (eg, at least one) of program modules configured to perform the functions of various embodiments of the present application.
  • a program/utility 40 having a set (at least one) of program modules 42, which may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other Program modules and program data, each or a combination of these examples may include implementations of a network environment.
  • Program modules 42 generally perform the functions and/or methods of the embodiments described herein.
  • Computer device 12 may also communicate with one or more external devices 14 (eg, keyboard, pointing device, display 24, etc.), may also communicate with one or more devices that enable a user to interact with computer device 12, and/or communicate with Any device (eg, network card, modem, etc.) that enables the computer device 12 to communicate with one or more other computing devices. Such communication may take place through an input/output (I/O) interface 22 .
  • the display 24 does not exist as an independent entity, but is embedded in the mirror surface. When the display surface of the display 24 is not displayed, the display surface of the display 24 and the mirror surface are visually integrated.
  • computer device 12 may communicate with one or more networks (eg, Local Area Network (LAN), Wide Area Network (WAN), and/or public networks such as the Internet) through network adapter 20.
  • network adapter 20 communicates with other modules of computer device 12 via bus 18 .
  • other hardware and/or software modules may be used in conjunction with computer device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, Redundant Arrays of Independent Drives , RAID) systems, tape drives, and data backup storage systems.
  • the processing unit 16 executes a variety of functional applications and data processing by running the programs stored in the system memory 28, for example, implementing the application identification method provided by the embodiments of the present application: acquiring the target network traffic data sent by the target terminal; The target network traffic data is analyzed to obtain target feature data; an application identification feature library is searched according to the target feature data, and a target application corresponding to the target feature data is determined.
  • the fifth embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, implements the application identification methods provided by all the application embodiments of the present application: obtaining the target network traffic sent by the target terminal data; analyze the target network traffic data to obtain target feature data; search an application identification feature library according to the target feature data, and determine the target application corresponding to the target feature data.
  • the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium.
  • the computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above.
  • Computer readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, RAM, Read-Only Memory (ROM), Erasable Programmable Read-Only Memory (Erasable Programmable Read-Only Memory) Only Memory, EPROM), flash memory, optical fiber, portable CD-ROM, optical storage devices, magnetic storage devices, or any suitable combination of the above.
  • a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
  • a computer-readable signal medium may include a propagated data signal in baseband or as part of a carrier wave, with computer-readable program code embodied thereon. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • a computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device .
  • Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber cable, radio frequency (RF), etc., or any suitable combination of the foregoing.
  • suitable medium including but not limited to wireless, wire, optical fiber cable, radio frequency (RF), etc., or any suitable combination of the foregoing.
  • Computer program code for carrying out the operations of the present application may be written in one or more programming languages, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional A procedural programming language, such as the "C" language or similar programming language.
  • the program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server.
  • the remote computer may be connected to the user's computer through any kind of network, including a LAN or WAN, or may be connected to an external computer (eg, using an Internet service provider to connect through the Internet).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Environmental & Geological Engineering (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Stored Programmes (AREA)

Abstract

本申请公开了一种应用识别方法、装置、设备及存储介质。该应用识别方法包括:获取目标终端发送的目标网络流量数据;对所述目标网络流量数据进行解析得到目标特征数据;根据所述目标特征数据查找应用识别特征库,确定所述目标特征数据对应的目标应用。

Description

应用识别方法、装置、设备及存储介质
本申请要求在2020年12月16日提交中国专利局、申请号为202011490933.5的中国专利申请的优先权,该申请的全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据处理领域,例如涉及一种应用识别方法、装置、设备及存储介质。
背景技术
随着移动互联网的发展壮大,多类应用(Application,APP)层出不穷。当前APP应用总量约为三百万,月均上下架的APP为十万数量级别。在众多APP产生的海量数据流量中反向识别出海量数据流量对应的应用,成为一个繁重的工作。
大部分APP采用了超文本传输协议(Hyper Text Transfer Protocol,HTTP)或超文本传输安全协议(Hyper Text Transfer Protocol over SecureSocket Layer,HTTPS)进行通信。
增强应用识别的方法是投入大量人力对有限数量APP进行分析,然后通过编写模板的方式进行支持。这种方法不仅费时费力,而且难以跟上APP的变化速度,也难以覆盖足够多的APP。
发明内容
本申请提供一种应用识别方法、装置、设备及存储介质,以实现能够对海量应用的识别增强,效率提升且识别全面、准确性高。
提供了应用识别方法,包括:
获取目标终端发送的目标网络流量数据;
对所述目标网络流量数据进行解析得到目标特征数据;
根据所述目标特征数据查找应用识别特征库,识别所述目标特征数据对应的目标应用。
还提供了应用识别装置,该装置包括:
第一获取模块,设置为获取目标终端发送的目标网络流量数据;
解析模块,设置为对所述目标网络流量数据进行解析得到目标特征数据;
识别模块,设置为根据所述目标特征数据查找应用识别特征库,识别所述目标特征数据对应的目标应用。
还提供了一种计算机设备,包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序,所述处理器执行所述计算机程序时实现如本申请实施例中任一所述的应用识别方法。
还提供了一种计算机可读存储介质,存储有计算机程序,该计算机程序被处理器执行时实现如本申请实施例中任一所述的应用识别方法。
附图说明
图1是本申请实施例一中的一种应用识别方法的流程图;
图2是本申请实施例二中的一种应用识别方法的流程图;
图2a是本申请实施例二中的一种自动抓包过程的流程图;
图2b是本申请实施例二中的应用识别的整体拓扑方案图;
图3是本申请实施例三中的一种应用识别装置的结构示意图;
图4是本申请实施例四中的一种计算机设备的结构示意图。
具体实施方式
下面结合附图和实施例对本申请进行说明。此处所描述的实施例仅仅用于解释本申请,而非对本申请的限定。为了便于描述,附图中仅示出了与本申请相关的部分而非全部结构。
相似的标号和字母在下面的附图中表示类似项,因此,一旦一项在一个附图中被定义,则在随后的附图中不需要对该项进行定义和解释。同时,在本申请的描述中,术语“第一”、“第二”等仅用于区分描述,而不能理解为指示或暗示相对重要性。
实施例一
图1为本申请实施例一提供的一种应用识别方法的流程图,本实施例可适用于识别终端发送的网络流量数据对应的应用的情况,该方法可以由本申请实施例中的应用识别装置来执行,该装置可采用软件和/或硬件的方式实现,如图 1所示,该方法包括如下步骤。
S110,获取目标终端发送的目标网络流量数据。
所述目标终端可以是手机、平板和电脑等任何能够装载应用的终端设备。
所述目标终端发送的目标网络流量数据是指目标终端在使用应用的过程中产生的网络流量数据。
获取用户在目标终端上使用应用的过程中发送的网络流量数据。
S120,对所述目标网络流量数据进行解析得到目标特征数据。
目标特征数据是APP的HTTP协议报文或HTTPS协议报文中可以用于识别应用的特征数据。
对目标终端发送的目标网络流量数据进行解析,提取网络流量数据中的目标特征数据,用以识别目标特征数据对应的应用。
S130,根据所述目标特征数据查找应用识别特征库,确定所述目标特征数据对应的目标应用。
应用识别特征库可以为在识别应用前预先建立的包含所有应用的特征数据的数据库。其中,本申请实施例对应用识别特征库的数据存储方式不作限制。
根据从HTTP协议报文或HTTPS协议报文中提取的目标特征数据查找应用识别特征库,若目标特征数据与应用识别特征库中包含的特征数据匹配,则根据应用识别特征库中包含的目标应用信息确定所述目标特征数据对应的目标应用。
本实施例的技术方案,通过解析目标终端发送的目标网络流量数据得到目标网络流量数据对应的目标特征数据,并根据目标特征数据查找应用识别特征库,从而确定目标应用,能够实现对海量应用的识别增强,效率提升且识别全面、准确性高,实现过程简单且易适应网络时代APP日新月异的变化。
本实施例通过解析目标终端发送的目标网络流量数据得到目标网络流量数据对应的目标特征数据,并根据目标特征数据查找应用识别特征库,从而确定相应的目标应用,解决增强应用识别的方法只能对有限数量APP进行分析并通过编写模板的方式进行支持费时费力,难以跟上APP的变化速度,也难以覆盖足够多的APP的问题,实现对海量应用的识别增强,效率提升且识别全面、准确性高,实现过程简单且易适应网络时代APP日新月异的变化。
实施例二
图2为本申请实施例二中的一种应用识别方法的流程图,本实施例以上述实施例为基础进行说明,在本实施例中,所述目标特征数据包括:目标主机头(HOST)和/或目标服务器名称指示(Server Name Indication,SNI)。根据所述目标特征数据查找应用识别特征库,确定所述目标特征数据对应的目标应用,包括:根据所述目标HOST查找应用识别特征库,确定所述目标HOST对应的目标应用标识(Identifier,ID)和目标应用名称,或者,根据所述目标SNI查找应用识别特征库,确定所述目标SNI对应的目标应用ID和目标应用名称。
如图2所示,本实施例的方法包括如下步骤。
S210,获取目标终端发送的目标网络流量数据。
S220,对所述目标网络流量数据进行解析得到目标特征数据,所述目标特征数据包括:目标HOST和/或目标SNI。
对目标网络流量数据进行解析得到HTTP协议报文和/或HTTPS协议报文,从HTTP协议报文中提取目标HOST,从HTTPS协议报文提取目标SNI。
在使用APP的过程中产生的网络流量数据可以只包含HTTP协议报文,也可以只包含HTTPS协议报文,或者可以包含HTTP协议报文和HTTPS协议报文。
S230,根据所述目标HOST查找应用识别特征库,确定所述目标HOST对应的目标应用ID和目标应用名称,或者,根据所述目标SNI查找应用识别特征库,确定所述目标SNI对应的目标应用ID和目标应用名称。
应用识别特征库为在识别应用前预先建立的用于存储应用的特征数据以及特征数据对应的应用ID和应用名称的数据库。其中,应用识别特征库的数据存储方式可以为任一种数据库表方式,本申请实施例对此不作限制。
若APP对应的网络流量数据中只包括HTTP协议报文,则根据所述目标HOST查找应用识别特征库,确定所述目标HOST对应的目标应用ID和目标应用名称;若APP对应的网络流量数据中只包括HTTPS协议报文,根据所述目标SNI查找应用识别特征库,确定所述目标SNI对应的目标应用ID和目标应用名称;若APP对应的网络流量数据中包括HTTP协议报文和HTTPS协议报文,则根据所述目标HOST查找应用识别特征库,确定所述目标HOST对应的目标应用ID和目标应用名称,或者,根据所述目标SNI查找应用识别特征库,确定所述目标SNI对应的目标应用ID和目标应用名称。
可选的,在获取目标终端发送的目标网络流量数据之前,还包括:
通过模拟器安装至少一个应用;
获取每个应用在运行期间产生的网络流量数据;
将每个应用产生的网络流量数据保存为PCAP文件,其中,所述PCAP文件携带所述网络流量数据对应的应用ID和应用名称。
如图2a所示,上述通过模拟器安装应用,获取所述应用在运行期间产生的网络流量数据,并保存为PCAP文件也称为自动抓包过程,所述自动抓包过程的步骤可以为以下步骤。
第一步,打开模拟器。
第二步:通过执行安装工具,将app包安装到模拟器上,其中,安装工具可以为Android调试桥(Android Debug Bridge,ADB)安卓工具等可以实现安装APP的安装工具。
第三步:执行抓包工具程序并传入应用ID作为参数,等待APP启动,其中,抓包工具可以为tcpdump等可以实现抓取网络流量数据包的工具。
第四步:启动应用,对APP进行浏览页面等常用操作,为了实现自动高效的获取APP使用过程中产生的流量数据包,可以执行用于自动遍历APP页面的AppCrawle工具,模拟用户对APP的正常操作,等待AppCrawler执行完成。
第五步,在获取每个应用在运行期间产生的网络流量数据之后,导出网络流量数据,并将网络流量数据保存为PCAP文件,导出网络流量数据的方式可以为使用tcpdump-dump命令或者其他命令或工具导出APP使用过程中产生的网络流量数据。在所述PCAP文件中携带所述网络流量数据对应的应用ID和应用名称,携带应用ID和应用名称的方式可以为按照应用ID、应用名称和版本信息命名PCAP文件或者在PCAP文件中保存应用ID、应用名称和版本信息,以实现根据PCAP文件中的数据确定应用信息。
重复上述步骤,直至将每个应用产生的网络流量数据保存为PCAP文件。
为了高效地获取到海量应用和所述应用产生的网络数据流量的对应关系,以建立应用识别特征库,可以采用爬虫技术获取海量应用的安装包,步骤为:将python爬虫脚本部署到服务器上,开启定时任务,执行爬虫脚本,抓取多个大的应用市场的排行榜的APP的下载地址;启动下载脚本,根据收集的下载地址,逐个下载APP,下载完成后,调用安卓开发者工具包的反编译工具AXMLPrinter2解析APP安装包,提取应用ID、应用名称和版本信息,并且可以按照应用名称+应用ID的规则重新命名安装包。
可选的,在将每个应用产生的网络流量数据保存为PCAP文件之后,所述方法还包括:
解析所述PCAP文件得到候选特征数据,以及所述候选特征数据对应的应用ID和应用名称;
根据所述候选特征数据,以及所述候选特征数据对应的应用ID和应用名称确定每个应用ID对应的第一特征数据;
将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库。
在将每个应用产生的网络流量数据保存为PCAP文件之后,解析所述PCAP文件或PCAP文件名称得到应用ID、应用名称;并对每个PCAP文件解析得到HTTP协议报文和HTTPS协议报文,对HTTP协议报文和HTTPS协议报文解析得到候选特征数据。根据候选特征数据,以及所述候选特征数据对应的应用ID和应用名称确定每个应用ID对应的第一特征数据,将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库。
将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库的方式可以为:将每个应用的候选特征数据,以及所述候选特征数据对应的应用ID和应用名称存储至第一文件中,读取每个应用对应的第一文件中的候选特征数据,建立候选全局哈希表。根据候选全局哈希表选取每个应用ID对应的第一特征数据,将所述第一特征数据存储至应用识别特征库中。将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库的方式还可以为根据每个应用的候选特征数据,以及所述候选特征数据对应的应用ID和应用名称建立候选全局哈希表。根据候选全局哈希表选取每个应用ID对应的第一特征数据,将所述第一特征数据存储至应用识别特征库中。
示例性的,候选特征数据可以包括:候选HOST和候选SNI,对HTTP协议报文解析得到候选HOST,对HTTPS协议报文解析得到候选SNI。每个应用可以包含多个候选HOST或者多个候选SNI,也可以同时包括多个候选HOST和多个候选SNI。
将每个PCAP文件提取的所有候选特征数据,及候选特征数据对应的应用ID和应用名保存至第一文件中,第一文件的格式如下:
[应用ID];
Appname=name1,name2;
host=host1,host2;
sni=sni1,sni2;
其中,应用ID是应用的唯一标识,可以是com.example.myapp格式;appname大部分是只有一个的,但也可能存在同一个应用在不同的应用市场使用不同应用名的情况,如果有多个则采用逗号进行分隔;HOST和SNI均可能有多个,采用逗号进行分隔。
可选的,根据所述候选特征数据,以及所述候选特征数据对应的应用ID和应用名称确定每个应用ID对应的第一特征数据,包括:
获取所有应用对应的候选特征数据;
根据所有应用对应的候选特征数据建立候选全局哈希表;
通过所述候选全局哈希表选取每个应用ID对应的第一特征数据。
第一特征数据为每个应用与其他应用相比独有的特征数据,可以用以识别不同的应用的ID和应用名称。
获取所有应用对应的候选特征数据并生成候选全局哈希表,通过候选全局哈希表中包含的应用ID和候选特征数据,筛选出每个应用ID对应的第一特征数据,作为识别该应用的特征。将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库。
将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库的方式可以为:将所述第一特征数据以及所述第一特征数据对应的应用ID和应用名称保存至第二文件中,所述第二文件可以为映射文件,通过将所述第二文件中的第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库;也可以为将所述第一特征数据以及所述第一特征数据对应的应用ID和应用名称直接存储至应用识别特征库。
可选的,所述第一特征数据包括:全局唯一HOST和/或全局唯一SNI。
示例性的,第一特征数据可以包括:全局唯一HOST和/或全局唯一SNI,那么将第一特征数据以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库可以为:若第一特征数据为全局唯一HOST,则将全局唯一HOST,以及全局唯一HOST对应的应用ID和应用名称存储至应用识别特征库;若第一特征数据为全局唯一SNI,则将全局唯一SNI,以及全局唯一SNI对应的应用ID和应用名称存储至应用识别特征库;若第一特征数据为全局唯一HOST和全局唯一SNI,则将全局唯一HOST,以及全局唯一HOST对应的应用ID和应用名称存储至应用识别特征库,且,将全局唯一SNI,以及全局唯一SNI对应的应用ID和应用名称存储至应用识别特征库。
将所述第一特征数据以及所述第一特征数据对应的应用ID和应用名称保存至第二文件中,第二文件中数据存储采用可扩展标记语言(Extensible Markup  Language,XML)格式,例如:
<sni servername="sname1"appname="name1"appid="id1">;
<sni servername="sname2"appname="name1"appid="id2">;
<sni servername="sname3"appname="name2"appid="id3">;
<host servername="sname4"appname="name2"appid="id4">;
<host servername="sname5"appname="name3"appid="id5">;
如图2b所示,本实施例的步骤为:本实施例中应用识别系统需要用于应用分析的服务器一台,用于应用识别的高性能服务器一台,现网在运行的分流设备一台,数据库服务器一台。其中,应用分析服务器需要能够访问互联网。应用服务器进行自动分析后将最终分析结果即xml格式的映射文件发送给应用识别服务器,应用识别服务器重新加载该映射文件,对接入的数据进行应用识别、结构化输出数据,传入数据库服务器。实施过程包括如下步骤。
(1)应用分析服务器搭建:应用分析服务器上需要部署自动抓包存包程序、PCAP文件解析程序、碰撞分析程序。由脚本进行一键安装部署。
(2)应用识别服务器搭建:应用识别服务器上需要部署应用识别程序,同时安装数据搬运程序,可使用文件传输协议(File Transfer Protocol,FTP)进行搬运。
(3)数据库服务器搭建:根据数据规模搭建数据库服务器,如果数据规模小,可以使用mysql、oracle;如果数据量较大,则需要搭建分布式存储系统(Hadoop Distributed File System,HDFS)。
(4)数据分流,由分流设备进行现网数据流量镜像。
(5)启动应用分析程序,分析完成后,通过FTP将分析结果发送给应用识别服务器。
(6)启动应用识别程序,对接入流量进行应用识别后进行结构化输出,并通过FTP传输给数据库服务器,供业务系统分析。
本实施例的技术方案,通过解析目标应用的网络流量数据,获取目标应用对应的目标特征数据,根据所述目标特征数据查询应用识别特征库,从而确定目标应用的应用名称和应用ID,能够实现对海量应用的识别增强,效率提升且识别全面、准确性高,实现过程简单且易适应网络时代APP日新月异的变化。
实施例三
图3为本申请实施例三提供的一种应用识别装置的结构示意图。本实施例可适用于识别终端发送的网络流量数据对应的应用的情况,该装置可采用软件和/或硬件的方式实现,该装置可集成在任何提供应用识别的功能的设备中,如图3所示,所述应用识别的装置包括:第一获取模块310、解析模块320和识别模块330。
第一获取模块310,设置为获取目标终端发送的目标网络流量数据;
解析模块320,设置为对所述目标网络流量数据进行解析得到目标特征数据;
识别模块330,设置为根据所述目标特征数据查找应用识别特征库,确定所述目标特征数据对应的目标应用。
可选的,所述目标特征数据包括:目标HOST和/或目标SNI;
所述识别模块330,是设置为:
根据所述目标HOST查找应用识别特征库,确定所述目标HOST对应的目标应用ID和目标应用名称,或者,根据所述目标SNI查找应用识别特征库,确定所述目标SNI对应的目标应用ID和目标应用名称。
可选的,所述装置还包括:
安装模块,设置为在获取目标终端发送的目标网络流量数据之前,通过模拟器安装至少一个应用;
第二获取模块,设置为获取每个应用在运行期间产生的网络流量数据;
保存模块,设置为将每个应用产生的网络流量数据保存为PCAP文件,其中,所述PCAP文件携带所述网络流量数据对应的应用ID和应用名称。
可选的,所述装置还包括:
获得模块,设置为在将每个应用产生的网络流量数据保存为PCAP文件之后,解析所述PCAP文件得到候选特征数据,以及所述候选特征数据对应的应用ID和应用名称;
确定模块,设置为根据所述候选特征数据,以及所述候选特征数据对应的应用ID和应用名称确定每个应用ID对应的第一特征数据;
存储模块,设置为将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至应用识别特征库。
可选的,所述确定模块,是设置为:
获取所有应用对应的候选特征数据;
根据所有应用对应的候选特征数据建立候选全局哈希表;
通过所述候选全局哈希表选取每个应用ID对应的第一特征数据。
可选的,所述第一特征数据包括:全局唯一HOST或者全局唯一SNI。
上述产品可执行本申请任意实施例所提供的方法,具备执行方法相应的功能模块和效果。
本实施例的技术方案,通过解析目标应用的网络流量数据,获取目标应用对应的目标特征数据,根据所述目标特征数据查询应用识别特征库,从而确定目标应用的应用名称和应用ID,能够实现对海量应用的识别增强,效率提升且识别全面、准确性高,实现过程简单且易适应网络时代APP日新月异的变化。
实施例四
图4为本申请实施例四中的一种计算机设备的结构示意图。图4示出了适于用来实现本申请实施方式的示例性计算机设备12的框图。图4显示的计算机设备12仅仅是一个示例,不应对本申请实施例的功能和使用范围带来任何限制。
如图4所示,计算机设备12以通用计算设备的形式表现。计算机设备12的组件可以包括但不限于:一个或者多个处理器或者处理单元16,系统存储器28,连接不同系统组件(包括系统存储器28和处理单元16)的总线18。
总线18表示几类总线结构中的一种或多种,包括存储器总线或者存储器控制器,外围总线,图形加速端口,处理器或者使用多种总线结构中的任意总线结构的局域总线。举例来说,这些体系结构包括但不限于工业标准体系结构(Industry Subversive Alliance,ISA)总线,微通道体系结构(Micro Channel Architecture,MCA)总线,增强型ISA总线、视频电子标准协会(Video Electronics Standards Association,VESA)局域总线以及外围组件互连(Peripheral Component Interconnect,PCI)总线。
计算机设备12包括多种计算机系统可读介质。这些介质可以是任何能够被计算机设备12访问的可用介质,包括易失性和非易失性介质,可移动的和不可移动的介质。
系统存储器28可以包括易失性存储器形式的计算机系统可读介质,例如随机存取存储器(Random Access Memory,RAM)30和/或高速缓存存储器(高速缓存32)。计算机设备12可以包括其它可移动/不可移动的、易失性/非易失性计算机系统存储介质。仅作为举例,存储系统34可以用于读写不可移动的、非易失性磁介质(图4未显示,通常称为“硬盘驱动器”)。尽管图4中未示出,可 以提供用于对可移动非易失性磁盘(例如“软盘”)读写的磁盘驱动器,以及对可移动非易失性光盘(例如紧凑磁盘只读存储器(Compact Disc Read Only Memory,CD-ROM),数字多功能盘只读存储器(Digital Video Disk Read Only Memory,DVD-ROM)或者其它光介质)读写的光盘驱动器。在这些情况下,每个驱动器可以通过一个或者多个数据介质接口与总线18相连。系统存储器28可以包括至少一个程序产品,该程序产品具有一组(例如至少一个)程序模块,这些程序模块被配置以执行本申请多个实施例的功能。
具有一组(至少一个)程序模块42的程序/实用工具40,可以存储在例如系统存储器28中,这样的程序模块42包括——但不限于——操作系统、一个或者多个应用程序、其它程序模块以及程序数据,这些示例中的每一个或一种组合中可能包括网络环境的实现。程序模块42通常执行本申请所描述的实施例中的功能和/或方法。
计算机设备12也可以与一个或多个外部设备14(例如键盘、指向设备、显示器24等)通信,还可与一个或者多个使得用户能与该计算机设备12交互的设备通信,和/或与使得该计算机设备12能与一个或多个其它计算设备进行通信的任何设备(例如网卡,调制解调器等等)通信。这种通信可以通过输入/输出(Input/Output,I/O)接口22进行。另外,本实施例中的计算机设备12,显示器24不是作为独立个体存在,而是嵌入镜面中,在显示器24的显示面不予显示时,显示器24的显示面与镜面从视觉上融为一体。并且,计算机设备12还可以通过网络适配器20与一个或者多个网络(例如局域网(Local Area Network,LAN),广域网(Wide Area Network,WAN)和/或公共网络,例如因特网)通信。如图所示,网络适配器20通过总线18与计算机设备12的其它模块通信。尽管图中未示出,可以结合计算机设备12使用其它硬件和/或软件模块,包括但不限于:微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、磁盘阵列(Redundant Arrays of Independent Drives,RAID)系统、磁带驱动器以及数据备份存储系统等。
处理单元16通过运行存储在系统存储器28中的程序,从而执行多种功能应用以及数据处理,例如实现本申请实施例所提供的应用识别方法:获取目标终端发送的目标网络流量数据;对所述目标网络流量数据进行解析得到目标特征数据;根据所述目标特征数据查找应用识别特征库,确定所述目标特征数据对应的目标应用。
实施例五
本申请实施例五提供了一种计算机可读存储介质,存储有计算机程序,该 计算机程序被处理器执行时实现如本申请所有申请实施例提供的应用识别方法:获取目标终端发送的目标网络流量数据;对所述目标网络流量数据进行解析得到目标特征数据;根据所述目标特征数据查找应用识别特征库,确定所述目标特征数据对应的目标应用。
可以采用一个或多个计算机可读的介质的任意组合。计算机可读介质可以是计算机可读信号介质或者计算机可读存储介质。计算机可读存储介质例如可以是但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件,或者任意以上的组合。计算机可读存储介质包括:具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、RAM、只读存储器(Read-Only Memory,ROM)、可擦式可编程只读存储器(Erasable Programmable Read-Only Memory,EPROM)、闪存、光纤、便携式CD-ROM、光存储器件、磁存储器件、或者上述的任意合适的组合。在本文件中,计算机可读存储介质可以是任何包含或存储程序的有形介质,该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
计算机可读的信号介质可以包括在基带中或者作为载波一部分传播的数据信号,其中承载了计算机可读的程序代码。这种传播的数据信号可以采用多种形式,包括但不限于电磁信号、光信号或上述的任意合适的组合。计算机可读的信号介质还可以是计算机可读存储介质以外的任何计算机可读介质,该计算机可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
计算机可读介质上包含的程序代码可以用任何适当的介质传输,包括但不限于无线、电线、光缆、射频(Radio Frequency,RF)等等,或者上述的任意合适的组合。
可以以一种或多种程序设计语言或其组合来编写用于执行本申请操作的计算机程序代码,所述程序设计语言包括面向对象的程序设计语言,诸如Java、Smalltalk、C++,还包括常规的过程式程序设计语言,诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中,远程计算机可以通过任意种类的网络——包括LAN或WAN—连接到用户计算机,或者,可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。

Claims (10)

  1. 一种应用识别方法,包括:
    获取目标终端发送的目标网络流量数据;
    对所述目标网络流量数据进行解析得到目标特征数据;
    根据所述目标特征数据查找应用识别特征库,识别所述目标特征数据对应的目标应用。
  2. 根据权利要求1所述的方法,其中,所述目标特征数据包括以下至少之一:目标主机头HOST、或目标服务器名称指示SNI;
    所述根据所述目标特征数据查找应用识别特征库,识别所述目标特征数据对应的目标应用,包括:
    根据所述目标HOST查找所述应用识别特征库,确定所述目标HOST对应的目标应用标识ID和目标应用名称,或者,根据所述目标SNI查找所述应用识别特征库,确定所述目标SNI对应的目标应用ID和目标应用名称。
  3. 根据权利要求1所述的方法,其中,在所述获取目标终端发送的目标网络流量数据之前,还包括:
    通过模拟器安装至少一个应用;
    获取每个应用在运行期间产生的网络流量数据;
    将每个应用产生的网络流量数据保存为PCAP文件,其中,所述PCAP文件携带所述网络流量数据对应的应用ID和应用名称。
  4. 根据权利要求3所述的方法,其中,在所述将每个应用产生的网络流量数据保存为PCAP文件之后,还包括:
    解析所述PCAP文件得到候选特征数据,以及所述候选特征数据对应的应用ID和应用名称;
    根据所述候选特征数据,以及所述候选特征数据对应的应用ID和应用名称确定每个应用ID对应的第一特征数据;
    将所述第一特征数据,以及所述第一特征数据对应的应用ID和应用名称存储至所述应用识别特征库。
  5. 根据权利要求4所述的方法,其中,所述根据所述候选特征数据,以及所述候选特征数据对应的应用ID和应用名称确定每个应用ID对应的第一特征数据,包括:
    获取所有应用对应的候选特征数据;
    根据所有应用对应的候选特征数据建立候选全局哈希表;
    通过所述候选全局哈希表选取每个应用ID对应的第一特征数据。
  6. 根据权利要求5所述的方法,其中,所述第一特征数据包括以下至少之一:全局唯一HOST、或全局唯一SNI。
  7. 一种应用识别装置,包括:
    第一获取模块,设置为获取目标终端发送的目标网络流量数据;
    解析模块,设置为对所述目标网络流量数据进行解析得到目标特征数据;
    识别模块,设置为根据所述目标特征数据查找应用识别特征库,识别所述目标特征数据对应的目标应用。
  8. 根据权利要求7所述的装置,其中,所述目标特征数据包括以下至少之一:目标主机头HOST、或目标服务器名称指示SNI;所述识别模块,是设置为:
    根据所述目标HOST查找所述应用识别特征库,确定所述目标HOST对应的目标应用标识ID和目标应用名称,或者,根据所述目标SNI查找所述应用识别特征库,确定所述目标SNI对应的目标应用ID和目标应用名称。
  9. 一种计算机设备,包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序,其中,所述处理器执行所述计算机程序时实现如权利要求1-6中任一项所述的方法。
  10. 一种计算机可读存储介质,存储有计算机程序,其中,所述计算机程序被处理器执行时实现如权利要求1-6中任一项所述的方法。
PCT/CN2021/115879 2020-12-16 2021-09-01 应用识别方法、装置、设备及存储介质 WO2022127196A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011490933.5A CN112615758B (zh) 2020-12-16 2020-12-16 一种应用识别方法、装置、设备及存储介质
CN202011490933.5 2020-12-16

Publications (1)

Publication Number Publication Date
WO2022127196A1 true WO2022127196A1 (zh) 2022-06-23

Family

ID=75240173

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/115879 WO2022127196A1 (zh) 2020-12-16 2021-09-01 应用识别方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN112615758B (zh)
WO (1) WO2022127196A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112615758B (zh) * 2020-12-16 2022-04-29 北京锐安科技有限公司 一种应用识别方法、装置、设备及存储介质
CN113347184A (zh) * 2021-06-01 2021-09-03 国家计算机网络与信息安全管理中心 网络流量安全检测引擎的测试方法、装置、设备及介质
CN115022216A (zh) * 2022-05-27 2022-09-06 中国电信股份有限公司 已安装app检测方法和装置、网络侧设备

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7587484B1 (en) * 2001-10-18 2009-09-08 Microsoft Corporation Method and system for tracking client software use
CN107222369A (zh) * 2017-07-07 2017-09-29 北京小米移动软件有限公司 应用程序的识别方法、装置、交换装置和存储介质
CN111565311A (zh) * 2020-04-29 2020-08-21 杭州迪普科技股份有限公司 网络流量特征生成方法及装置
CN111740923A (zh) * 2020-06-22 2020-10-02 北京神州泰岳智能数据技术有限公司 应用识别规则的生成方法、装置、电子设备和存储介质
CN111953706A (zh) * 2020-08-21 2020-11-17 公安部第三研究所 基于https流量信息识别移动应用的方法
CN112039731A (zh) * 2020-11-05 2020-12-04 武汉绿色网络信息服务有限责任公司 Dpi识别方法、装置、计算机设备及存储介质
CN112615758A (zh) * 2020-12-16 2021-04-06 北京锐安科技有限公司 一种应用识别方法、装置、设备及存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110233769B (zh) * 2018-03-06 2021-09-14 华为技术有限公司 流量检测方法和设备、样本训练方法和设备、以及介质
CN110768933B (zh) * 2018-07-27 2022-08-09 深信服科技股份有限公司 一种网络流量应用识别方法、系统及设备和存储介质
US20200258118A1 (en) * 2019-02-10 2020-08-13 Surya Kumar Kovvali Correlating multi-dimensional data to extract & associate unique identifiers for analytics insights, monetization, QOE & Orchestration
CN110011860A (zh) * 2019-04-16 2019-07-12 湖南警察学院 基于网络流量分析的安卓应用识别方法
CN110245273B (zh) * 2019-06-21 2021-04-30 武汉绿色网络信息服务有限责任公司 一种获取app业务特征库的方法及相应的装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7587484B1 (en) * 2001-10-18 2009-09-08 Microsoft Corporation Method and system for tracking client software use
CN107222369A (zh) * 2017-07-07 2017-09-29 北京小米移动软件有限公司 应用程序的识别方法、装置、交换装置和存储介质
CN111565311A (zh) * 2020-04-29 2020-08-21 杭州迪普科技股份有限公司 网络流量特征生成方法及装置
CN111740923A (zh) * 2020-06-22 2020-10-02 北京神州泰岳智能数据技术有限公司 应用识别规则的生成方法、装置、电子设备和存储介质
CN111953706A (zh) * 2020-08-21 2020-11-17 公安部第三研究所 基于https流量信息识别移动应用的方法
CN112039731A (zh) * 2020-11-05 2020-12-04 武汉绿色网络信息服务有限责任公司 Dpi识别方法、装置、计算机设备及存储介质
CN112615758A (zh) * 2020-12-16 2021-04-06 北京锐安科技有限公司 一种应用识别方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN112615758A (zh) 2021-04-06
CN112615758B (zh) 2022-04-29

Similar Documents

Publication Publication Date Title
WO2022127196A1 (zh) 应用识别方法、装置、设备及存储介质
CN109933522B (zh) 一种自动化用例的测试方法、测试系统及存储介质
US8572625B2 (en) Method and system for application migration using per-application persistent configuration dependency
US9239873B2 (en) Process-aware code migration
CN109672722B (zh) 数据部署方法及装置、计算机存储介质和电子设备
US9600567B2 (en) Local context search results improvements
US20160124795A1 (en) Evaluation method and apparatus
WO2017020459A1 (zh) 一种为宿主配置插件包的方法与装置
WO2023160327A1 (en) Container image management
CN110659210A (zh) 一种信息获取方法、装置、电子设备及存储介质
CN114629831B (zh) 一种网卡性能测试方法、装置、设备和存储介质
CN115576600A (zh) 基于代码变更的差异处理方法、装置、终端及存储介质
US20100017863A1 (en) Portable storage apparatus for providing working environment migration service and method thereof
CN109218338B (zh) 信息处理系统、方法和装置
WO2020238131A1 (zh) 网络爬虫系统的测试方法及装置、存储介质、电子设备
WO2023151397A1 (zh) 应用程序部署方法、装置、设备及介质
CN111949484A (zh) 信息处理方法、装置、电子设备和介质
CN114090514A (zh) 分布式系统的日志检索方法及装置
CN110753136B (zh) 域名解析方法、装置、设备及存储介质
CN113326004B (zh) 云计算环境下高效日志集中化方法及设备
US20120150898A1 (en) Dynamic Collection Of System Support Files In A Data Processing Environment
CN115454827B (zh) 兼容性检测方法、系统、设备和介质
CN111061502B (zh) 一种安装包获取方法、装置、设备和存储介质
US20240235944A9 (en) Cloud migration data analysis method using system process information, and system thereof
US20240137278A1 (en) Cloud migration data analysis method using system process information, and system thereof

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21905129

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 28.03.24)