Application identification method, data mining method, device and system

Abstract

Disclosed are a data mining method, device and system. The UBA data mining method comprises: acquiring data to be processed, the data to be processed comprising a plurality of records, wherein each record comprises: application information and far-end triad information in a corresponding relationship; performing clustering processing on a record with the same far-end triad information and application information in the data to be processed, and calculating a service load corresponding to the far-end triad information and application information according to the record with the same far-end triad information and application information in the data to be processed, so as to obtain a clustering result comprising the far-end triad information, the application information and the service load in a corresponding relationship; selecting far-end triad and application information with a high degree of reliability and in a corresponding relationship from the clustering result according to the size or proportion of the service load; and sending to a DPI subsystem the far-end triad and application information with a high degree of reliability and in a corresponding relationship, thereby improving DPI identification performance and application identification rate.

Description

technical field [0001] The present invention relates to the field of communication technology, in particular to an application identification method, data mining method, device and system. Background technique [0002] With the rapid development of broadband services, it brings opportunities as well as challenges to operators. With the popularization of P2P, online games, Web TV, VoIP, online banking, network disk and other applications, bandwidth management, content A series of issues such as billing and information security processing. [0003] Deep Packet Inspection (DPI) technology is considered to be a method to deal with the management problems caused by the operation of multiple services in the network, that is, the use of DPI technology can quickly analyze network data, so that the operator's network can Support application-based services, such as mail tariff packages, video tariff packages, game tariff packages, blocking of specific download software, etc. [0004...

AI Technical Summary

Problems solved by technology

[0006] In addition, since the update speed of Internet applications is much faster than that of DPI’s feature library, and many applications are increasingly using encryption methods such as SSL and HTTPS for data transmission for security reasons, resulting in low DPI recognition performance. The application identification of the encryption protocol can only identify the L7 protocol information, and the running application on the L7 is still unable to identify; for example, encrypted data such as HTTPS cannot identify the application, which leads to the failure of DPI identification

Images