A deep message detection method, network device and system

Abstract

The invention relates to the network safety technology, discloses a deep message detection method, network equipment and system. The method includes: receive the data message in the data stream; determine whether the data message required to be detected or not, if yes, firstly identify the data message; if can't be identified, then copy the data message, and send one copy of the data message to the deep message detection device, that is, the DPI detection device for deep message detecting. The invention may solve the balancing problem between the DPI detection and rapid data forward performances, meet with the sensing and controlling demand of network operator for the internet services, save the network resources.

Description

technical field [0001] The present invention relates to network security technology, in particular to a deep packet inspection (Deep Packet Inspection, DPI) method, network equipment and system. Background technique [0002] With the continuous development of IP technology, the IP network is gradually transforming from carrying a single Internet service to carrying voice, data, video, VIP line, 3G, NGN and other carrier-level multi-services. During the transformation process, fundamental changes will also take place in the security, reliability, and service quality of IP networks. [0003] On the one hand, computer networks are subject to more and more serious attacks and intrusions, causing huge losses to users and operators. Although the emergence of firewalls has mitigated some of the attacks. However, ordinary firewalls are powerless to spread and attack viruses hidden in the payload of IP packets. In recent years, the development trend of network attacks is to gradua...

AI Technical Summary

Problems solved by technology

[0009] The inventor has found through research that the above two schemes all have defects in varying degrees: in the process of performing DPI detection in series, since DPI detection is to search for feature words on IP data packets, it consumes very much processor resources, resulting in DPI detection. Become the bottleneck of data forwarding, thus affecting the service quality QoS of all services

However, in the process of performing DPI detection in parallel, all user traffic must be copied to the DPI detection device for detection through optical splitting or mirroring, which increases the burden on the DPI detection device and interferes with users. It is difficult to implement under UDP encryption application, which reduces the control effect

Images