Address tracing method and device

Abstract

The invention provides an address tracing method and device. The method comprises the following steps: taking a minimum unrelated degree sum obtained by accumulating unrelated degrees between each log record and a target detail record corresponding to each log record as evidence and determining the target detail record corresponding to each log record; and carrying out correlation treatment on each log record and the target detail record corresponding to each log record so as to carry out IP (Internet Protocol) address tracing. The correlation treatment is carried out due to that a second standard moment corresponding to the log record for indicating is not at a first standard moment corresponding to the target detail record corresponding to the log record, which is used as a starting moment, and a time length is the unrelated degree of the possibility in a standard time length. Therefore, the technical problems that the relation accuracy of the detail records and the log records in the prior art is lower so that the IP address tracing accuracy is lower are solved.

Description

technical field [0001] The invention relates to communication technology, in particular to an address traceability method and device. Background technique [0002] In the prior art, private network IP addresses are assigned to mobile terminals accessed inside the operator's core network, and the user traffic data collection system records information related to the allocation of private network IP addresses to mobile terminals, and generates information including mobile terminal identifiers and private network IP addresses. Detailed records including address, private network port number, destination IP address, destination port number, time of assigning private network IP address, available time of private network IP address and protocol used; when the mobile terminal accesses the Internet, the private network will The network IP address is converted to a public network IP address, and the network address translation (NAT, Network Address Translation) firewall system records...

AI Technical Summary

Problems solved by technology

[0003] But in the prior art, because the moment of allocating the public network IP address recorded in the log record and the moment of allocating the private network IP address recorded in the detailed list record are all local time, and because the user traffic data collection system and the NAT firewall The clock of the system is not synchronized, resulting in the association of detailed list records and log records based on the time when the public network IP address is allocated in the log record, the available time of the public network IP address, and the time when the private network IP address is allocated in the detailed list record , the correct rate of association between detailed list records and log records is low, which in turn leads to low correct rate of IP address traceability

Images