Method and device for realizing DPI identification

Abstract

The invention relates to the field of communications, particularly relates to a method and a device for realizing DPI identification. The method is used for improving the service identification rate of DPI equipment. The method comprises the following steps: using a first set of traffic features to perform service type identification on the first N data packets in the target data stream; after failure, using a second set of traffic features to perform supplementary service type identification on data packets at specified positions after the first N data packets in the target data stream. Therefore, for the target data stream of the data packet with the business feature appearing at the rear position, accurate service type identification can be realized, so that the service identification rate of the DPI equipment is effectively improved, and the detection missing condition is avoided. Meanwhile, the DPI equipment only analyzes the data packet at the specified position and does not needto analyze all the data packets in sequence when the supplementary service type is identified, so that the consumption of the DPI equipment is effectively reduced, the overload of the DPI equipment is avoided, and the service performance of the DPI equipment is further ensured.

Description

technical field [0001] The invention relates to the communication field, in particular to a method and equipment for realizing DPI identification. Background technique [0002] Under the prior art, the Deep Packet Inspection (DPI) device detects and analyzes the message content of the data stream at the key points of the network, and can filter and control the data stream according to a pre-defined strategy, thereby completing Fine-grained business identification of links, business traffic flow analysis, business traffic proportion statistics, and business proportion shaping. Further, it can also denial of service attacks at the application layer, filter viruses and Trojan horses, and conduct P2P abuse control and so on. [0003] DPI equipment is usually connected to the link through direct serial connection or optical splitting and parallel connection. refer to figure 1 As shown, when working, the DPI device first loads the preset rule base. When a data stream passes thr...

AI Technical Summary

Problems solved by technology

[0004] However, the appearance position of the message feature in the data packet is not fixed. Under the prior art, considering the performance consumption of the DPI device by data packet parsing, the DPI device usually only parses the first N data packets (such as, N =10), if the first N data packets in the data flow can be used to match the business characteristics in the rule base, the business identification can be successfully realized; data stream is set to unrecognized

[0005] In this way, the business recognition rate of DPI equipment will be reduced to a certain extent

Images