Traffic analysis method, public service traffic attribution method and corresponding computer system

Abstract

The invention provides a flow analysis method and device and a computer system. The method comprises the steps of obtaining plaintext features and ciphertext features of a message in traffic, whereinthe ciphertext features comprise length features of an encrypted field in the message; and performing analysis on the flow according to the plaintext features and the ciphertext features to identify aservice or an application to which the flow belongs. The method can be used for service identification and can also be applied to application identification. By introducing ciphertext characteristicsinto traffic analysis, the accuracy of traffic identification is improved in a message encryption scene. On the other hand, the invention further provides a public service flow attribution method anddevice and a computer system, the flow of the public service is attributed to the corresponding application by identifying the initial service and / or the exclusive service of the application, the accuracy of application flow attribution is improved, and a foundation is provided for subsequent application flow charging and other services.

Description

technical field [0001] The present application relates to the field of network traffic analysis, in particular to a traffic analysis method, a public service traffic attribution method, and a corresponding computer system. Background technique [0002] In recent years, with the rapid development of the mobile Internet, the proportion of network traffic has increased year by year. In order to ensure that network users enjoy reliable services and facilitate network managers to manage and monitor activities between network elements in real time, traffic analysis technology is widely used in various network devices, including network transit or grouping devices such as gateways and routers. At present, operators use this technology to provide information assurance for their network services such as billing, blocking, and policy control. [0003] One purpose of traffic analysis is to attribute packets (or data streams) included in the traffic to different applications, and this ...

AI Technical Summary

Problems solved by technology

However, with the widespread use of network protocol encryption technology, some plaintext features of messages under the original non-encrypted protocol are hidden, and application identification only uses unconcealed features, which reduces the accuracy of application identification.

[0006] On the other hand, an application may invoke multiple services. Existing traffic analysis technologies can distinguish traffic belonging to different applications to a certain extent, but rarely involve finer-grained distinctions, such as distinguishing traffic belonging to different services (this application calls Service identification, another purpose of traffic analysis), especially after the introduction of network protocol encryption technology, many original plaintext features of the message are hidden, making service identification even more difficult

Images