NAT detection method based on converged user behavior and Thunder ID

Abstract

The invention discloses an NAT detection method based on converged user behaviors and Thunder ID. The method comprises the following steps: (1) enabling a traffic processing platform to extract the User-Agent, Cookie ID and Thunder ID information from the captured network traffic, and splicing the extracted information to an JSON string; (2) loading and balancing the JSON string to a corresponding server in the traffic processing platform for processing according to quintuples of the network traffic; and (3) enabling the server to classify the data according to the quintuples, and when determining that the TCP flow corresponding to a certain quintuple ends, on-line processing the TCP flow, wherein the on-line processing method comprises the following steps: calculating the host out-degree and host in-degree of the client IP according to the quintuples, determining the NAT attribute of the client IP, and calculating the host scale of the client IP. According to the NAT detection method disclosed by the invention, a large number of IP attributes can be calibrated, and the NAT scale can be accurately determined.

Description

technical field [0001] The invention belongs to the technical field of Internet passive traffic analysis and NAT detection, and relates to a NAT detection method based on fusion of user behavior and Thunder ID. Background technique [0002] The application of NAT (Network Address Translation, Network Address Translation) technology slows down the depletion of IP address space, realizes the mapping relationship between private network IP addresses and public network IP addresses, isolates internal and external networks, and thus isolates all computers in the LAN It is hidden and protected, and cannot be accessed through the public network, effectively preventing various illegal attacks from the public network. Therefore, NAT technology also provides a new idea for the development of firewall technology. Today, most routers integrate NAT technology, which provides a certain guarantee for private network security. [0003] However, like many other technologies throughout hist...

AI Technical Summary

Problems solved by technology

[0009] However, the User-Agent identification method is largely restricted by the user's online habits. The use of some operating systems and browsers, such as opening two different browsers on a host, will cause misjudgment, and due to User-Agent The Agent field can be easily modified by the user, and the detection effect of this method is not guaranteed

The Cookie ID identification method is largely restricted by the user's online habits, and it is difficult to ensure that different users visit the same website within the same detection period

Moreover, some users will clear the Cookie information on the machine at any time, and these factors will make the detection error of the Cookie ID identification method relatively large

Images