Network data packet classification method and system based on 7-layers of application

Abstract

The invention provides a network data packet classification method and system based on 7-layer of applications. The network data packet classification method based on 7-layer of applications includes the steps: according to the data frame type, performing classified judgment on the data packet, when the source MAC address for receiving the data or the target MAC address is matched with the preset MAC address in the strategy; obtaining the data message head by splitting and analysis the data packet, and according to the data message head, determining the type of sub data; and finally matching the application layer protocol characteristic codes in the effective load of data, and according to the application layer protocol characteristic codes, obtaining the application layer protocol type. Therefore, the network data packet classification method and system based on 7-layer of applications can accurately identify various network applications, can reduce the output flow, can improve the convergence ratio, and can greatly reduce the displayed quantity of data content analysis servers at the back end.

Description

technical field [0001] The invention relates to the technical field of network traffic processing, in particular to a method and system for classifying network data packets based on 7-layer applications. Background technique [0002] Facing the rapid development of informatization and meeting the growing demands of network security, various security vendors continue to develop new technologies, from traditional 3 and 4 layer application filtering to today's 7 layer application content tracking. With the "explosive" growth of network traffic and the in-depth analysis of security application analysis, traditional network traffic classification equipment can only perform preliminary classification based on layer 3 and layer 4 applications, and cannot go deep into layer 7 applications. Relying on traditional solutions can no longer meet the needs of real-world security applications. Therefore, there is an urgent need for a layer 7 application traffic identification and classific...

AI Technical Summary

Problems solved by technology

With the "explosive" growth of network traffic and in-depth analysis of security application analysis, traditional network traffic classification equipment can only perform preliminary classification based on layer 3 and layer 4 applications, and cannot go deep into layer 7 applications

Relying on traditional solutions can no longer meet the needs of real-world security applications. Therefore, there is an urgent need for a layer 7 application traffic identification and classification system that can classify massive network traffic and filter out a large number of unnecessary network data packets. Layer 7 application data packets are filtered out to the security engine

Images