Rapid network packet classification method based on network traffic statistic information

Abstract

The invention relates to a rapid network packet classification method based on network traffic statistic information, which belongs to the technical field of filtration and monitoring of network traffic. The method comprises the steps of: determining the space partition of various domains of a header and a rule mapping table thereof according to a classification rule set, and establishing an address lookup table, a port lookup table and a rule lookup table; recording the times that the header of a network packet appears in the space partition of the domains and calculating prior distribution; establishing a letter search tree of the domains according to the prior distribution; performing continuous matching on the received header of the network packet according to the letter search tree and the lookup tables; and re-calculating the prior distribution and updating the letter search tree at update time, and continuing to match the received network traffic. The method uses the classification rule set and heuristic information of the network traffic from two different levels of network packet classification, strengthens the adaptability of the classification method, and improves average classification efficiency. The method has quick lookup speed and strong adaptability, can be realized on a plurality of platforms, and is applicable to the filtration and monitoring of high-performance network traffic.

Description

technical field [0001] The invention relates to a fast network packet classification method based on network flow statistical information, and belongs to the technical field of network flow filtering and monitoring. Background technique [0002] The Internet has become one of the important infrastructures of today's society, and the requirements for the efficiency and security of information exchange by network applications are also continuously increasing. In addition to traditional forwarding functions, routers must also be able to support functions such as access control, QoS, and traffic accounting. All these functions require the router to be able to classify network traffic according to the header of the network packet, and to process the network packets in different ways accordingly. Network packet classification usually refers to matching filtering rules according to the third-layer and fourth-layer domains of the network packet header, and correspondingly disposing...

AI Technical Summary

Problems solved by technology

However, the problem of network packet classification involves the matching of network traffic and classification rule sets. Most of the existing methods only consider mining heuristic information from the structural characteristics of classification rule sets to improve the speed of network packet classification, while ignoring the use of Network traffic statistics feature to improve performance

Images