CN109995605A - A traffic identification method and device, and a computer-readable storage medium - Google Patents

Abstract

The invention discloses a traffic identification method, which comprises: acquiring to-be-identified traffic data packets generated when an electronic device is used; performing feature extraction on the to-be-identified traffic data packets to obtain first content features; The content feature is matched with the second content feature of each App in the pre-built feature database to determine at least one App associated with the traffic data packet to be identified; the second content feature is the content extracted from the valid traffic samples of the App feature, the valid traffic samples include traffic data packets generated by an App calling a local database; according to the second behavioral feature of the at least one App in the feature database, determine the traffic data to be identified from the at least one App The App to which the package belongs; the second behavioral feature represents the calling behavioral feature of the App to the third-party database. The invention also discloses a flow identification device and a computer-readable storage medium.

Description

A traffic identification method and device, and a computer-readable storage medium

technical field

The present invention relates to communication technologies, and in particular, to a method and device for identifying traffic, and a computer-readable storage medium.

Background technique

Related research analysis found that people's dependence on mobile Internet devices is becoming more and more serious, and the average person spends more than three hours a day on mobile electronic devices; among them, the time spent on smartphones accounts for nearly two hours. hours, the time spent is mainly focused on the use of applications (App, Application) installed on the smartphone. In addition, the frequency of users' use of apps is usually related to the user's identity. For example, users who frequently use financial securities-related apps are likely to be securities managers, individuals or corporate investors; The attributes reflect the user's personal attributes to some extent.

Based on the above possibilities, if the user's App usage behavior can be reliably obtained, and the obtained App usage behavior can be analyzed and profiled, a user description with high reliability can be obtained. However, the user's app usage behavior belongs to the user's privacy, and there are many types of apps on smartphones. Currently, the number of apps commonly used by users exceeds 100,000; therefore, the conventional method cannot reliably obtain the user's app usage behavior samples. . However, for the mobile data provider, it is possible to obtain the traffic data of the user's app using; if the app used by the user can be identified according to the traffic data, it becomes possible to reliably obtain the user's app usage behavior.

In order to identify the App used by the user according to the traffic data of the user using the App, first, the traffic samples of the App need to be obtained; then, feature extraction is performed on the obtained traffic samples to construct a feature database according to the extracted features; finally, based on the constructed The feature database performs feature matching on the traffic data of the app used by the user to identify the app used by the user. It can be seen from the above description that how to perform feature extraction on the obtained traffic data so that the extracted features have better granularity and anti-interference ability are the key factors to accurately identify apps. However, the features extracted by the existing traffic feature extraction method have the defects of insufficient recognition granularity and unsatisfactory recognition effect under the condition of noise, so that the App used by the user cannot be accurately identified according to the traffic data, resulting in traffic identification. Poor accuracy.

SUMMARY OF THE INVENTION

In order to solve the existing technical problems, the embodiments of the present invention provide a traffic identification method and device, and a computer-readable storage medium, which can accurately identify the App used by the user according to the traffic data packets generated when the user uses an electronic device. .

The technical solution of the embodiment of the present invention is realized as follows:

An embodiment of the present invention provides a traffic identification method, and the method includes:

Obtain the traffic data packets to be identified generated when the electronic device is used;

Perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program App associated with the traffic data packet to be identified;

Match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the second content feature is the valid traffic from the App The content feature extracted from the sample, the effective flow sample includes the flow data packet generated by the App calling the local database;

According to the second behavior feature of the at least one App in the feature database, the App to which the traffic data packet to be identified belongs is determined from the at least one App; the second behavior feature represents the call of the App to the third-party database Behavioral characteristics.

In the above scheme, the method also includes:

For each App, obtain the corresponding native traffic, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment;

Filtering the native traffic to obtain valid traffic samples of the corresponding App;

Perform content feature extraction on the valid traffic sample to obtain the second content feature of the corresponding App;

Obtain the second behavioral feature of the corresponding App according to the pre-acquired second content feature of the App and the native traffic;

The feature database is constructed by using the second content feature and the second behavior feature of each App.

In the above solution, the filtering of the native traffic to obtain valid traffic samples of the corresponding App includes:

Semantic analysis is performed on the Nth feature information of the App to obtain the first semantic information, and the N is a positive integer;

Perform semantic analysis on the content corresponding to the Nth feature information in the traffic data packet to be analyzed, and obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is the original traffic through N -1 traffic data packet that is not determined to be an effective traffic data packet after filtering the characteristic information; the effective traffic data packet is the traffic data packet in the effective traffic sample;

calculating the degree of association between the first semantic information and the second semantic information;

The traffic data packets to be analyzed whose correlation degree is greater than or equal to the preset value are determined as the traffic data packets in the valid traffic samples.

In the above solution, the second behavioral feature of the corresponding App is obtained according to the second content feature of the app obtained in advance and the native traffic, including:

performing content feature extraction on the native traffic to obtain content features of the native traffic;

Matching the content feature of the native traffic with the second content feature of the pre-acquired App to determine the App associated with the native traffic;

The second behavior characteristic is obtained according to the description information of the App and the App associated with the native traffic.

In the above solution, the App to which the to-be-identified traffic data packet belongs is determined from the at least one App according to the second behavioral feature of the at least one App in the feature database, including:

Obtain the target behavior feature from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes all the Apps associated with the traffic data packet to be identified;

Obtain the App corresponding to the target behavior feature from the feature database;

The App corresponding to the target behavior feature is determined as the App to which the to-be-identified traffic data packet belongs.

An embodiment of the present invention further provides a device for identifying traffic, the device comprising: a processor, and a memory for storing a computer program that can run on the processor; wherein,

When the processor is configured to run the computer program, execute:

Obtain the traffic data packets to be identified generated when the electronic device is used;

Perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program App associated with the traffic data packet to be identified;

Match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the second content feature is the valid traffic from the App The content feature extracted from the sample, the effective flow sample includes the flow data packet generated by the App calling the local database;

According to the second behavior feature of the at least one App in the feature database, the App to which the traffic data packet to be identified belongs is determined from the at least one App; the second behavior feature represents the call of the App to the third-party database Behavioral characteristics.

In the above solution, when the processor is used to run the computer program, execute:

For each App, obtain the corresponding native traffic, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment;

Filtering the native traffic to obtain valid traffic samples of the corresponding App;

Perform content feature extraction on the valid traffic sample to obtain the second content feature of the corresponding App;

Obtain the second behavioral feature of the corresponding App according to the pre-acquired second content feature of the App and the native traffic;

The feature database is constructed by using the second content feature and the second behavior feature of each App.

In the above solution, when the processor is used to run the computer program, execute:

Semantic analysis is performed on the Nth feature information of the App to obtain the first semantic information, and the N is a positive integer;

Perform semantic analysis on the content corresponding to the Nth feature information in the traffic data packet to be analyzed, and obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is the original traffic through N -1 traffic data packet that is not determined to be an effective traffic data packet after filtering the characteristic information; the effective traffic data packet is the traffic data packet in the effective traffic sample;

calculating the degree of association between the first semantic information and the second semantic information;

The traffic data packets to be analyzed whose correlation degree is greater than or equal to the preset value are determined as the traffic data packets in the valid traffic samples.

In the above solution, when the processor is used to run the computer program, execute:

performing content feature extraction on the native traffic to obtain content features of the native traffic;

Matching the content feature of the native traffic with the second content feature of the pre-acquired App to determine the App associated with the native traffic;

The second behavior characteristic is obtained according to the description information of the App and the App associated with the native traffic.

In the above solution, when the processor is used to run the computer program, execute:

Obtain the target behavior feature from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes all the Apps associated with the traffic data packet to be identified;

Obtain the App corresponding to the target behavior feature from the feature database;

The App corresponding to the target behavior feature is determined as the App to which the to-be-identified traffic data packet belongs.

An embodiment of the present invention further provides a traffic identification device, the device includes: an acquisition module, a feature extraction module, a first determination module and a second determination module; wherein,

The acquisition module is used to acquire the traffic data packets to be identified generated when the electronic device is used;

The feature extraction module is configured to perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program associated with the traffic data packet to be identified;

The first determining module is configured to match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the first The second content feature is the content feature extracted from the valid flow sample of the App, and the valid flow sample includes the flow data packet generated by the App calling the local database;

The second determination module is configured to determine the App to which the traffic data packet to be identified belongs from the at least one App according to the second behavior feature of the at least one App in the feature database; the second behavior The characteristics represent the behavior characteristics of the app calling the third-party database.

Embodiments of the present invention further provide a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when a computer program of the computer-executable instructions is executed by a processor, the foregoing traffic identification method is implemented.

In the traffic identification method and device provided by the embodiments of the present invention, firstly, the to-be-identified traffic data packet generated when the electronic device is used is obtained; then, feature extraction is performed on the to-be-identified traffic data packet to obtain the first content feature; The first content feature represents the content feature of the application program App associated with the traffic data packet to be identified; the first content feature is matched with the second content feature of each App in the pre-built feature database, and the traffic to be identified is determined. At least one App associated with the data package; the second content feature is the content feature extracted from the valid flow sample of the App, and the valid flow sample includes the flow data packet generated by the App calling the local database; finally, according to the feature The second behavior feature of the at least one App in the database is to determine the App to which the to-be-identified traffic data packet belongs from the at least one App; the second behavior feature represents the calling behavior feature of the App to the third-party database.

Because the pre-built feature database in the embodiment of the present invention not only includes the second content feature of each App, but also includes the second behavior feature of each App, the second content feature is the traffic data packet generated by calling the local database from the App The second behavior feature represents the calling behavior feature of the App to the third-party database; therefore, based on the local library traffic and external library traffic, different types of features are extracted from the App’s traffic data packets, so that the feature database The features have better granularity and stronger anti-interference ability, which can improve the granularity of feature identification and greatly improve the accuracy of traffic identification. In addition, the traffic identification method of the embodiment of the present invention has strong robustness, can deal with the differences between different apps in the traffic level, and can generally identify the traffic of most apps.

Description of drawings

In the drawings, which are not necessarily to scale, like reference numerals may describe like parts in the different views. Similar reference numbers with different letter suffixes may denote different instances of similar components. The accompanying drawings generally illustrate, by way of example and not limitation, the various embodiments discussed herein.

FIG. 1 is a schematic flowchart of the implementation of the traffic identification method in Embodiment 1 of the present invention;

2 is a schematic diagram of a specific implementation flow of constructing a feature database in Embodiment 2 of the present invention;

3 is a schematic diagram of a specific implementation flow of step 204 in the implementation process shown in FIG. 2;

4 is a schematic structural diagram of the composition of a flow identification device according to an embodiment of the present invention;

5 is a schematic diagram of a specific composition structure of a third acquisition module in the device shown in FIG. 4;

FIG. 6 is a schematic structural diagram of a hardware composition of a flow device according to an embodiment of the present invention.

Detailed ways

Usually, it is common for the current App to call external database files, which is mainly manifested in the injection of advertisements inside the application, and the call of other App interfaces such as Software Development Kit (SDK, Software Development Kit) interface and Application Programming Interface (API, Application Programming Interface) interface, etc. , the calls of these external database files will also be reflected in the traffic packets.

Because the traffic generated by the app calling the external database file is the external library traffic, which reflects the external characteristics, and the traffic generated by the app calling the local database file is the local library traffic, which reflects the app's own characteristics (ie local characteristics). And the same library file can have different properties for different apps; for example, the library file of Taobao App is a local database file for Taobao App, and it is an external database file for Meituan App. Therefore, this has a serious negative impact on extracting the local characteristics of the traffic data packets and identifying the App to which the traffic data packets belong according to the characteristics; when identifying the traffic data packets, the content of the traffic data packets alone cannot be accurately located. The App to which the traffic packet belongs.

For example, Taobao advertisements will be injected into the interior of many network applications, and these Taobao advertisements will also generate traffic with the content characteristics of Taobao App (for example, the traffic-related fields of a large-scale online game carry the taobao characteristic word). Then, when the feature extraction is performed on the traffic data packets of the App containing Taobao advertisements, there will be a lot of noise interference, which makes it impossible to accurately identify which traffic data packets are local library traffic and which are external library traffic, so it is impossible to accurately identify which ones are local library traffic and which are external library traffic. Locate the APP to which the traffic data packet belongs.

Based on this, in the embodiment of the present invention: firstly, in the traffic identification method and device provided by the embodiment of the present invention, firstly, the to-be-identified traffic data packet generated when the electronic device is used is obtained; then, the to-be-identified traffic data packet is obtained; Feature extraction is performed on the package to obtain the first content feature; the first content feature represents the content feature of the application program App associated with the traffic data packet to be identified; the first content feature is compared with the first content feature of each App in the pre-built feature database. Two content features are matched to determine at least one App associated with the to-be-identified traffic data packet; the second content feature is a content feature extracted from a valid traffic sample of the App, and the valid traffic sample includes the data generated by the App calling the local database. The generated traffic data package; finally, according to the second behavioral feature of the at least one App in the feature database, determine the App to which the traffic data package to be identified belongs from the at least one App; the second behavioral feature Characterize the calling behavior characteristics of the App to the third-party database.

Because the pre-built feature database in the embodiment of the present invention not only includes the second content feature of each App, but also includes the second behavior feature of each App, the second content feature is the traffic data packet generated by calling the local database from the App The second behavior feature represents the calling behavior feature of the App to the third-party database; therefore, based on the local library traffic and external library traffic, different types of features are extracted from the App’s traffic data packets, so that the feature database The features have better granularity and stronger anti-interference ability, which can improve the granularity of feature identification and greatly improve the accuracy of traffic identification. In addition, the traffic identification method of the embodiment of the present invention has strong robustness, can deal with the differences between different apps in the traffic level, and can generally identify the traffic of most apps.

The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments.

The traffic identification method provided by the embodiment of the present invention is applied to an electronic device, as shown in FIG. 1 , and includes the following steps:

Step 101, acquiring traffic data packets to be identified generated when the electronic device is used;

The traffic identification method in this embodiment is applied to an electronic device, which may be a mobile terminal, and is used to identify the App used by the user according to the traffic data packets generated when the user uses the mobile terminal, thereby identifying the user The App usage behavior of the user can be obtained, and then the user description of the user can be obtained.

Here, the to-be-identified traffic data packet may be acquired in the traffic channel of the mobile terminal. The mobile terminal can monitor whether there is a traffic data packet in the traffic channel in real time to monitor whether the user generates traffic when using the mobile terminal; when monitoring the presence of a traffic data packet in the traffic channel, obtain the to-be-identified traffic data packet. . Of course, the mobile terminal may also acquire the traffic data packets to be identified from the traffic channel periodically or aperiodically.

Step 102, perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of the application App associated with the traffic data packet to be identified;

Specifically, content feature extraction is performed on the to-be-identified traffic data packet to obtain the first content feature, where the first content feature may include features such as website title, keywords, description, and text content corresponding to the homepage. These features It is used to reflect the content characteristics of the application program App associated with the traffic data packet to be identified.

The fixed-position content extraction method can be used to extract the content features of the traffic data packets to be identified; other content feature extraction methods can also be flexibly selected, such as: DPI method, longest maximum common subsequence extraction method, and features in deep learning The mining method, etc., will not be limited here.

Step 103: Match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the second content feature is from the App The content feature extracted from the valid flow sample, the valid flow sample includes the flow data packet generated by the App calling the local database;

Here, the second content feature specifically represents the content feature of the local library traffic of the App.

Here, the first content feature and the second content feature of each App in the feature database are compared one by one to obtain at least one App associated with the to-be-identified traffic data packet; since the to-be-identified traffic data cannot be distinguished The traffic of the local library and the traffic of the external library in the package, therefore, the at least one App includes the App to which the traffic data package to be identified may belong.

For example, the first content feature includes the feature of "taobao", and the second content feature of Taobao App also includes the feature of "taobao", then the first content feature and the second content feature of Taobao App are successfully matched, so The app to which the traffic data packet to be identified may belong includes the Taobao App; for another example, the first content feature also includes the feature of "meituan", and the second content feature of the Meituan App also includes this feature, then the The apps to which the traffic data packets to be identified may belong also include the Meituan app.

Step 104, according to the second behavioral feature of the at least one App in the feature database, determine the App to which the traffic data packet to be identified belongs from the at least one App; the second behavioral feature characterizes the App to a third party. Database call behavior characteristics.

Because the traffic data packet may include both local library traffic and external library traffic, and in unsupervised scenarios, its attributes cannot be determined only from the content of the traffic; in the process of traffic identification, there may be traffic attribute errors. This will seriously interfere with the recognition accuracy. Therefore, in the feature database, it is necessary to extract more fine-grained features (ie, the second behavior feature) to solve the defect that the traffic attribute cannot be judged in the feature identification process and improve the identification accuracy.

The at least one App associated with the traffic data packet to be identified is only the preliminary identification result obtained in the flow identification process; only the content characteristics are considered in the identification result at this time, and the attributes of the traffic are not distinguished, so it contains a large number of false identifications .

Here, according to the second behavior feature of the at least one App in the feature database, the Apps in the at least one App are filtered one by one, and finally the App to which the traffic data packet to be identified belongs can be determined. Specifically, the target behavior feature is obtained from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes all the Apps associated with the traffic data packet to be identified; from the feature The App corresponding to the target behavior feature is obtained from the database; the App corresponding to the target behavior feature is determined as the App to which the traffic data packet to be identified belongs.

For example, the at least one App includes Taobao App and Alipay App, and the second behavior feature of Taobao App includes the calling behavior of Taobao App to Alipay App. It can be seen that the calling behavior is related to Taobao App and Alipay App, and the first behavior of Alipay App is related to Taobao App and Alipay App. The second behavior feature does not include the calling behavior of the Alipay App to the Taobao App. It can be seen that the calling behavior only includes the Taobao App. Therefore, the target behavior feature is the second behavior feature of the Taobao App, and the Taobao App is the App to which the traffic data packet to be identified belongs.

It should be noted that, when there are multiple apps associated with the calling behavior of the second behavioral feature of the app, including all the apps associated with the traffic data packets to be identified, the corresponding App corresponding to the traffic data packets to be identified can be How much traffic to determine the target behavior characteristics. Specifically, the second behavior feature of the App whose traffic data packets to be identified account for the most traffic may be determined as the target behavior feature. For example, the second behavior feature of Taobao App includes the calling behavior of Taobao App to Alipay App, and the second behavior feature of Alipay App includes the calling behavior of Alipay App to Taobao App; however, Taobao App is in the traffic data package to be identified. The traffic occupied is greater than the traffic occupied by the Alipay App in the traffic data packets to be identified, therefore, the target behavior feature can be the second behavior feature of the Taobao App.

To sum up, in the embodiment of the present invention, the first content feature is obtained by extracting the features of the traffic data packets to be identified; then the first content feature is matched with the second content feature of each App in the pre-built feature database , determine at least one App associated with the traffic data packet to be identified; finally, according to the second behavioral feature of the at least one App in the feature database, determine from the at least one App to which the traffic data packet to be identified belongs App.

Because the pre-built feature database in the embodiment of the present invention not only includes the second content feature of each App, but also includes the second behavior feature of each App, the second content feature is the traffic data packet generated by calling the local database from the App The second behavior feature represents the calling behavior feature of the App to the third-party database; therefore, based on the local library traffic and external library traffic, different types of features are extracted from the App’s traffic data packets, so that the feature database The features have better granularity and stronger anti-interference ability, which can improve the granularity of feature identification and greatly improve the accuracy of traffic identification. In addition, the traffic identification method of the embodiment of the present invention has strong robustness, can deal with the differences between different apps in the traffic level, and can generally identify the traffic of most apps.

In order to ensure that the first content feature can be matched in the pre-built feature database, the feature database needs to include a large number of second content features and second behavior features of apps; and for the accuracy of identification, the feature database needs to be guaranteed the validity of the features. How to obtain a large number of valid traffic samples of apps and the corresponding traffic feature extraction methods are the key factors in building a feature database. Wherein, the valid traffic samples include traffic data packets generated by the App calling the local database.

At present, there are two main methods to obtain valid traffic samples:

The first is: calibrating the flow sample;

Specifically, first, the App is used manually to monitor the traffic generated during the running process of the App; then, according to expert experience, the obtained traffic is filtered, and the App traffic that is considered to be valid is demarcated as the traffic sample of the App.

The second is: do not calibrate the flow sample;

Specifically, the App is used manually many times, the traffic generated by the running process of the App is monitored, and the traffic obtained by the multiple monitoring is spliced into a traffic sample.

At present, there are mainly three kinds of traffic feature extraction methods:

The first is: traffic feature extraction method based on predefined or special ports;

Specifically, network traffic is extracted and identified according to a common network protocol port, or network traffic is extracted and identified according to a predefined special port.

The second is: DPI-based traffic feature extraction method;

Specifically, according to the determined experience and rules, feature words, fingerprints or sequences that meet the specified conditions are extracted from the content of the traffic as traffic features.

The third is: traffic feature extraction method based on deep learning model;

Specifically, the content of the traffic is converted into the standard input of the deep learning model according to a certain mapping relationship; and the traffic features are automatically extracted according to the deep learning model.

However, due to the current traffic sample acquisition method, there are the following shortcomings: the acquisition must be done manually, which greatly limits the number of APPs in the feature database; the method of calibrating traffic samples needs to rely on strong expert experience, and the calibration personnel The quality requirements of the APP are relatively high; the method does not need to calibrate the traffic samples, and it depends on the quantity of the local library traffic is much larger than the external library traffic. In practical applications, the universality cannot be guaranteed, and the APP is used and monitored many times. In order to splicing the flow samples, the time consumption is further increased. Therefore, there is an urgent need to find a method for automatically acquiring valid traffic samples, so that electronic devices can automatically acquire valid traffic samples of a large number of apps.

At the same time, the current traffic feature extraction method has the following shortcomings:

The traffic feature extraction method based on predefined or special ports, because the network protocols used by the App are mostly of several common types, such as HTTP, SSL, HTTPS, etc. Therefore, traffic identification is performed through non-standard ports or newly defined ports. , the identification granularity is not enough to locate the App that generates the sample traffic. The DPI-based traffic feature extraction method is supervised or semi-supervised, which is time-consuming and labor-intensive in the process of determining feature words or fingerprints, and in the presence of noise, the selection and identification of features are not ideal. For the traffic feature extraction method based on deep learning model, the input needs to be manually screened and calibrated, which is not suitable for large-scale automated network application feature extraction and recognition, and the time overhead in the model training process is relatively large, lacking theoretical validity explanations.

Therefore, it is urgent to find a traffic feature extraction method, so that the extracted traffic features have better granularity and breadth performance, and stronger anti-interference ability.

The following describes in detail how to construct the feature database in detail.

Specifically, FIG. 2 is a schematic diagram of a specific implementation flow of building a feature database in Embodiment 2 of the present invention. Referring to FIG. 2 , building a feature database in the embodiment of the present invention specifically includes the following steps:

Step 201, for each App, obtain the corresponding native traffic, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment;

Here, the simulated environment may be a pure sandbox environment, and the native traffic of each App running in the pure sandbox environment is automatically monitored and acquired through the web crawler technology and the sandbox control technology.

This step mainly uses two modules: APK crawler module and anthropomorphic trigger module.

Among them, the APK crawler module is used to automatically crawl the installation package (ie, the APK file) of the corresponding App from the network site according to the specified requirements based on the description information of each App.

The anthropomorphic trigger module is used to automatically monitor and capture the native traffic of the App, and save it to the specified file. Specifically, first, in a pure simulator environment, install the App based on the App installation package, and use an effective anthropomorphic triggering method (such as the monkey command or the PUMA method of depth-priority triggering of components with anthropomorphic triggering logic, etc. ), trigger the installed App to make the App run automatically; then, start a traffic monitoring process (such as tcpdump or similar functional process) in the background of the simulator to monitor the traffic generated during the running of the App; finally, filter out After the background traffic of the simulator, save the monitored traffic to the specified file to obtain the native traffic of the app.

This step replaces manual triggering with automatic anthropomorphic triggering, which automatically realizes the acquisition of traffic samples, so that a large amount of native traffic of the App can be obtained.

Step 202, filtering the native traffic to obtain valid traffic samples of the corresponding App;

Here, based on the semantic screening method, valid traffic samples of the corresponding App can be screened from the native traffic of the App. Among them, the first-level semantic screening method, the second-level semantic screening method, the third-level semantic screening method, or the more-level semantic screening method can be used to obtain the effective traffic samples; in this embodiment , which will be described in detail by taking the four-level semantic screening method as an example.

Specifically, perform semantic analysis on the Nth feature information of the App to obtain first semantic information, where N is a positive integer; perform semantic analysis on the content corresponding to the Nth feature information in the traffic data packet to be analyzed , obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is the traffic data packet that is not determined to be an effective traffic data packet after filtering through N-1 characteristic information in the original traffic; The effective flow data packet is the flow data packet in the effective flow sample; calculate the correlation degree between the first semantic information and the second semantic information; set the correlation degree greater than or equal to the preset value; The traffic data packet to be analyzed is determined as the traffic data packet in the valid traffic sample.

The Nth feature information may be a name, a package name, a webpage text content, or a key field, where the key field is a field used to identify an App in the content of the traffic. For example, in the native traffic of Xingrui Entertainment App, the special field "stareal" exists and only exists in the traffic of Xingrui Entertainment App, that is, the special field "stareal" has a special structure corresponding to the uniqueness of Xingrui Entertainment App. The special field "stareal" is the key field.

The following is a detailed description of the four-level semantic screening method as an example.

Let the first characteristic information be the name, the second characteristic information be the package name, the third characteristic information be the web page text content, and the fourth characteristic information be the key fields. Of course, there may also be other execution sequences, which will not be limited here.

First, perform semantic analysis on the name of the App to obtain the semantic information of the name; perform semantic analysis on the content corresponding to the name in the first traffic data packet to be analyzed to obtain the semantic information of the first traffic data packet to be analyzed; The first traffic data packet to be analyzed is all traffic data packets in the native traffic; calculating the degree of association between the semantic information of the name and the semantic information of the first traffic data packet to be analyzed; The first traffic data packet to be analyzed whose correlation degree is greater than or equal to the preset value is determined as the traffic data packet in the valid traffic sample; the remaining traffic data packet in the first traffic data packet to be analyzed is determined as the second traffic data packet to be analyzed data pack.

For example, in the native traffic of Taobao App, if a traffic data packet containing the content of the "taobao" field is found, the difference between the semantic information of the content of the "taobao" field in the traffic data packet and the semantic information of the name of Taobao App can be calculated. When the correlation degree satisfies a certain condition (such as greater than or equal to a certain threshold), it can be judged that the attribute of the traffic data packet is the local library traffic, that is, the traffic data packet in the valid sample .

Next, perform semantic analysis on the package name of the App to obtain semantic information of the package name; perform semantic analysis on the content corresponding to the package name in the second traffic data packet to be analyzed, to obtain the second traffic data packet to be analyzed. Semantic information; the second traffic data packet to be analyzed is the traffic data packet remaining after the first-level screening in the original traffic; calculate the difference between the semantic information of the packet name and the semantic information of the second traffic data packet to be analyzed. The correlation degree between the two; the second flow data packet to be analyzed whose correlation degree is greater than or equal to the preset value is determined as the flow data packet in the effective flow sample; the remaining flow data packets of the second flow data packet to be analyzed are determined as The third traffic data packet to be analyzed.

For example, in the native traffic of the AutoNavi Map App, a traffic data packet containing the content of the "autoavi" field is found, which is semantically related to the package name (com.autoavi.minimap) of the AutoNavi Map App. The degree of correlation between the semantic information of the "autoavi" field content in the traffic data packet and the semantic information of the package name of the AutoNavi Map App is relatively large. When the correlation degree satisfies certain conditions, it can be judged that the attribute of the traffic data packet is The local library traffic is the traffic data packets in the valid traffic samples.

Next, perform semantic analysis on the web page text content of the App to obtain semantic information of the web page text content; perform semantic analysis on the content corresponding to the web page text content in the third to-be-analyzed traffic data packet to obtain the third to-be-analyzed traffic Semantic information of the data packet; the third traffic data packet to be analyzed is the remaining traffic data packet in the original traffic after the second-level screening; calculating the semantic information of the webpage text content and the third traffic data packet to be analyzed The degree of association between the semantic information of The data packet is determined to be the fourth traffic data packet to be analyzed.

For example, in the native traffic of Car Owner Worry-free App, the traffic content does not contain any content that is semantically related to its name (Car Owner Worry-free) or package name (com.starbaba.starbaba). However, if some web pages such as URL---www.xmiles.com are implied in the traffic content, and the corresponding web page text content contains the keywords of Car Owner Worry-free App or other related semantic content, it is still possible to calculate the content of the traffic data packet. The correlation between the semantic information containing the content of the "URL---www.xmiles.com" field and the semantic information of the text content of the car owner's worry-free web page is relatively large. The attribute is the local library traffic, that is, the traffic data packets in the valid traffic sample.

Finally, perform semantic analysis on the key fields of the App to obtain semantic information of the key fields; perform semantic analysis on the content corresponding to the key fields in the fourth to-be-analyzed traffic data packet to obtain the fourth to-be-analyzed traffic Semantic information of the data packet; the fourth traffic data packet to be analyzed is the remaining traffic data packet in the original traffic after the third-level screening; calculating the semantic information of the key field and the fourth traffic data packet to be analyzed The correlation degree between the semantic information; the fourth traffic data packet to be analyzed whose correlation degree is greater than or equal to the preset value is determined as the traffic data packet in the valid traffic sample.

For example, in the native traffic of Xingrui Entertainment App, the special field "stareal" exists and only exists in the traffic of Xingrui Entertainment App, that is, the special field "stareal" has a special structure corresponding to the uniqueness of Xingrui Entertainment App, then It can be determined that the traffic data packet is the local library traffic of Xingrui Entertainment App, that is, the traffic data packet in the valid traffic sample.

According to the above-mentioned four-level semantic screening, the filtering of the native traffic can be realized, the attributes of each traffic data packet can be effectively determined, and finally the valid traffic samples of the App can be obtained. Obtain.

Step 203, performing content feature extraction on the valid traffic sample to obtain the second content feature;

Here, content feature extraction can be performed on the valid traffic samples by using a content extraction method at a fixed location; other content feature extraction methods can also be flexibly selected, such as: DPI method, longest maximum common subsequence extraction method, and features in deep learning The mining method, etc., will not be limited here.

Step 204, according to the second content feature of the pre-acquired App and the native traffic, obtain the second behavior feature of the corresponding App;

FIG. 3 is a schematic diagram of a specific implementation process of step 204 in the implementation process shown in FIG. 2. Referring to FIG. 3, step 204 specifically includes the following steps:

Step 2041, performing content feature extraction on the native traffic to obtain content features of the native traffic;

The fixed-position content extraction method can be used to extract the content features of the traffic data packets to be identified; other content feature extraction methods can also be flexibly selected, such as: DPI method, longest maximum common subsequence extraction method, and features in deep learning The mining method, etc., will not be limited here.

Step 2042, matching the content characteristics of the native traffic with the second content characteristics of the pre-acquired App to determine the App associated with the native traffic;

Step 2043: Obtain the second behavior feature according to the description information of the App and the App associated with the native traffic.

Here, the second behavior feature includes the calling behavior of the App to the third-party database, and structural information such as the time sequence and frequency of the calls.

In this step, the traffic features are extracted in a multi-level asynchronous manner. First, content feature extraction is performed on the extracted valid traffic samples to determine the second content features of the valid traffic samples of the App; then, according to the pre-extracted second content of each App The feature and the content feature of the native traffic of the App are used to determine the App associated with the native traffic; finally, the second behavior feature is determined based on the description information of the App and the App associated with the native traffic. As a result, the multi-level traffic characteristics of the app are obtained, and a more accurate traffic identification effect can be obtained.

In step 205, the feature database is constructed by using the second content feature and the second behavior feature of each App.

Here, the feature database can be constructed by correlating and saving the description information of each App, the corresponding second content feature and the second behavior feature.

In order to implement the method of the embodiment of the present invention, the embodiment of the present invention further provides a traffic identification device, which is used to implement the specific details of the above-mentioned traffic identification method and achieve the same effect.

FIG. 4 is a schematic structural diagram of a traffic identification device according to an embodiment of the present invention. Referring to FIG. 4 , the traffic identification device in this embodiment includes: a first acquisition module 31 , a first feature extraction module 32 , a first determination module 33 and a first Two determination modules 34; wherein,

The first acquisition module 31 is used to acquire the traffic data packets to be identified generated when the electronic device is used;

The first feature extraction module 32 is configured to perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of the application App associated with the traffic data packet to be identified;

The first determining module 33 is configured to match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the The second content feature is the content feature extracted from the valid flow sample of the App, and the valid flow sample includes the flow data packet generated by the App calling the local database;

The second determination module 34 is configured to determine the App to which the traffic data packet to be identified belongs from the at least one App according to the second behavioral feature of the at least one App in the feature database; the second The behavior characteristics represent the behavior characteristics of the app calling the third-party database.

Optionally, the flow identification device in this embodiment further includes: a second acquisition module 35, a filtering module 36, a second feature extraction module 37, a third acquisition module 38, and a construction module 39; wherein,

The second obtaining module 35 is configured to obtain corresponding native traffic for each App, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment;

The filtering module 36 is configured to filter the native traffic to obtain valid traffic samples of the corresponding App;

The second feature extraction module 37 is configured to perform content feature extraction on the effective traffic sample to obtain the second content feature of the corresponding App;

The third obtaining module 38 is configured to obtain the second behavioral feature of the corresponding App according to the second content feature of the App obtained in advance and the native traffic;

The construction module 39 is configured to construct the characteristic database by using the second content characteristic and the second behavior characteristic of each App.

Optionally, the filtering module 36 is specifically configured to perform semantic analysis on the Nth feature information of the App to obtain first semantic information, where N is a positive integer; Perform semantic analysis on the content corresponding to the N pieces of feature information to obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is undetermined after filtering through N-1 feature information in the native traffic is a flow data packet of an effective flow data packet; the effective flow data packet is a flow data packet in the effective flow sample; calculate the correlation degree between the first semantic information and the second semantic information; The traffic data packets to be analyzed whose correlation degree is greater than or equal to the preset value are determined as the traffic data packets in the valid traffic samples.

Optionally, FIG. 5 is a schematic structural diagram of the specific composition of the third acquisition module in the device shown in FIG. 4 . Referring to FIG. 5 , the third acquisition module 38 includes: a content feature extraction unit 381 , a matching unit 382 and an acquisition unit 383; of which,

The content feature extraction unit 381 is configured to perform content feature extraction on the native traffic to obtain content features of the native traffic;

The matching unit 382 is configured to match the content characteristics of the native traffic with the second content characteristics of the pre-acquired App to determine the App associated with the native traffic;

The obtaining unit 383 is configured to obtain the second behavior feature according to the description information of the App and the App associated with the native traffic.

Optionally, the second determination module 34 is specifically configured to obtain a target behavior feature from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes the to-be-identified App. All Apps associated with the traffic data packets; obtain the App corresponding to the target behavior feature from the feature database; determine the App corresponding to the target behavior feature as the App to which the to-be-identified traffic data packet belongs.

In practical applications, the first acquisition module 31, the first feature extraction module 32, the first determination module 33, the second determination module 34, the second acquisition module 35, the filtering module 36, the second feature extraction module 37, the first The three acquisition modules 38, the construction module 39, the content feature extraction unit 381, the matching unit 382 and the acquisition unit 383 can all be implemented by a processor located in the traffic identification device.

When the traffic identification device provided by the above embodiment performs traffic identification, only the division of the above program modules is used for illustration. Divided into different program modules to perform all or part of the processing described above. In addition, the traffic identification device and the traffic identification method embodiments provided by the above embodiments belong to the same concept, and the specific implementation process thereof is detailed in the method embodiments, which will not be repeated here.

6 is a schematic diagram of the hardware structure of a flow device according to an embodiment of the present invention. Referring to FIG. 6 , the flow identification device in this embodiment includes: a processor 41 and a memory 42 for storing a computer program that can be run on the processor 41 ;in,

The processor 41, when running the computer program, executes:

Obtain the traffic data packets to be identified generated when the electronic device is used;

Perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program App associated with the traffic data packet to be identified;

Match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the second content feature is the valid traffic from the App The content feature extracted from the sample, the effective flow sample includes the flow data packet generated by the App calling the local database;

According to the second behavior feature of the at least one App in the feature database, the App to which the traffic data packet to be identified belongs is determined from the at least one App; the second behavior feature represents the call of the App to the third-party database Behavioral characteristics.

Optionally, the processor 41, when running the computer program, executes:

For each App, obtain the corresponding native traffic, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment;

Filtering the native traffic to obtain valid traffic samples of the corresponding App;

Perform content feature extraction on the valid traffic sample to obtain the second content feature of the corresponding App;

Obtain the second behavioral feature of the corresponding App according to the pre-acquired second content feature of the App and the native traffic;

The feature database is constructed by using the second content feature and the second behavior feature of each App.

Optionally, the processor 41, when running the computer program, executes:

Semantic analysis is performed on the Nth feature information of the App to obtain the first semantic information, and the N is a positive integer;

Perform semantic analysis on the content corresponding to the Nth feature information in the traffic data packet to be analyzed, and obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is the original traffic through N -1 traffic data packet that is not determined to be an effective traffic data packet after filtering the characteristic information; the effective traffic data packet is the traffic data packet in the effective traffic sample;

calculating the degree of association between the first semantic information and the second semantic information;

The traffic data packets to be analyzed whose correlation degree is greater than or equal to the preset value are determined as the traffic data packets in the valid traffic samples.

Optionally, the processor 41, when running the computer program, executes:

performing content feature extraction on the native traffic to obtain content features of the native traffic;

Matching the content feature of the native traffic with the second content feature of the pre-acquired App to determine the App associated with the native traffic;

The second behavior characteristic is obtained according to the description information of the App and the App associated with the native traffic.

Optionally, the processor 41, when running the computer program, executes:

Obtain the target behavior feature from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes all the Apps associated with the traffic data packet to be identified;

Obtain the App corresponding to the target behavior feature from the feature database;

The App corresponding to the target behavior feature is determined as the App to which the to-be-identified traffic data packet belongs.

Of course, in practical application, as shown in FIG. 6 , various components are coupled together through the bus system 43 . It is understood that the bus system 43 is used to implement the connection communication between these components. In addition to the data bus, the bus system 43 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the various buses are designated as bus system 43 in FIG. 6 .

An embodiment of the present invention further provides a computer-readable storage medium, where an executable program is stored in the computer-readable storage medium, and when the executable program is executed by the processor 41, the following steps are implemented:

Obtain the traffic data packets to be identified generated when the electronic device is used;

Perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program App associated with the traffic data packet to be identified;

Match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the second content feature is the valid traffic from the App The content feature extracted from the sample, the effective flow sample includes the flow data packet generated by the App calling the local database;

According to the second behavior feature of the at least one App in the feature database, the App to which the traffic data packet to be identified belongs is determined from the at least one App; the second behavior feature represents the call of the App to the third-party database Behavioral characteristics.

Optionally, when the executable program is executed by the processor 41, the following steps are implemented:

For each App, obtain the corresponding native traffic, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment;

Filtering the native traffic to obtain valid traffic samples of the corresponding App;

Perform content feature extraction on the valid traffic sample to obtain the second content feature of the corresponding App;

Obtain the second behavioral feature of the corresponding App according to the pre-acquired second content feature of the App and the native traffic;

The feature database is constructed by using the second content feature and the second behavior feature of each App.

Optionally, when the executable program is executed by the processor 41, it specifically implements the steps of filtering the native traffic and obtaining valid traffic samples of the corresponding App:

Semantic analysis is performed on the Nth feature information of the App to obtain the first semantic information, and the N is a positive integer;

Perform semantic analysis on the content corresponding to the Nth feature information in the traffic data packet to be analyzed, and obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is the original traffic through N -1 traffic data packet that is not determined to be an effective traffic data packet after filtering the characteristic information; the effective traffic data packet is the traffic data packet in the effective traffic sample;

calculating the degree of association between the first semantic information and the second semantic information;

The traffic data packets to be analyzed whose correlation degree is greater than or equal to the preset value are determined as the traffic data packets in the valid traffic samples.

Optionally, when the executable program is executed by the processor 41, to specifically implement the step of obtaining the second behavioral feature of the corresponding App according to the second content feature of the App and the native traffic acquired in advance:

performing content feature extraction on the native traffic to obtain content features of the native traffic;

Matching the content feature of the native traffic with the second content feature of the pre-acquired App to determine the App associated with the native traffic;

The second behavior characteristic is obtained according to the description information of the App and the App associated with the native traffic.

Optionally, when the executable program is executed by the processor 41, to specifically implement the determination of the traffic data to be identified from the at least one App according to the second behavioral feature of the at least one App in the feature database. Steps for the App the package belongs to:

Obtain the target behavior feature from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes all the Apps associated with the traffic data packet to be identified;

Obtain the App corresponding to the target behavior feature from the feature database;

The App corresponding to the target behavior feature is determined as the App to which the to-be-identified traffic data packet belongs.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements and improvements made within the spirit and scope of the present invention are included in the protection scope of the present invention.

Claims (12)

1. a traffic identification method, is characterized in that, described method comprises: Obtain the traffic data packets to be identified generated when the electronic device is used; Perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program App associated with the traffic data packet to be identified; Match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the second content feature is the valid traffic from the App The content feature extracted from the sample, the effective flow sample includes the flow data packet generated by the App calling the local database; According to the second behavior feature of the at least one App in the feature database, the App to which the traffic data packet to be identified belongs is determined from the at least one App; the second behavior feature represents the call of the App to the third-party database Behavioral characteristics. 2. The method according to claim 1, wherein the method further comprises: For each App, obtain the corresponding native traffic, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment; Filtering the native traffic to obtain valid traffic samples of the corresponding App; Perform content feature extraction on the valid traffic sample to obtain the second content feature of the corresponding App; Obtain the second behavioral feature of the corresponding App according to the pre-acquired second content feature of the App and the native traffic; The feature database is constructed by using the second content feature and the second behavior feature of each App. 3. The method according to claim 2, wherein the filtering of the native traffic to obtain an effective traffic sample of the corresponding App comprises: Semantic analysis is performed on the Nth feature information of the App to obtain the first semantic information, and the N is a positive integer; Perform semantic analysis on the content corresponding to the Nth feature information in the traffic data packet to be analyzed, and obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is the original traffic through N -1 traffic data packet that is not determined to be an effective traffic data packet after filtering the characteristic information; the effective traffic data packet is the traffic data packet in the effective traffic sample; calculating the degree of association between the first semantic information and the second semantic information; The traffic data packets to be analyzed whose correlation degree is greater than or equal to the preset value are determined as the traffic data packets in the valid traffic samples. 4. The method according to claim 2, wherein, obtaining the second behavioral feature of the corresponding App according to the second content feature of the App and the native traffic obtained in advance, comprising: performing content feature extraction on the native traffic to obtain content features of the native traffic; Matching the content feature of the native traffic with the second content feature of the pre-acquired App to determine the App associated with the native traffic; The second behavior characteristic is obtained according to the description information of the App and the App associated with the native traffic. 5. The method according to claim 1, wherein, according to the second behavior feature of the at least one App in the feature database, it is determined from the at least one App that the traffic data packet to be identified belongs to , including: Obtain the target behavior feature from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes all the Apps associated with the traffic data packet to be identified; Obtain the App corresponding to the target behavior feature from the feature database; The App corresponding to the target behavior feature is determined as the App to which the to-be-identified traffic data packet belongs. 6. A flow identification device, characterized in that the device comprises: a processor, a memory for storing a computer program that can be executed on the processor; wherein, When the processor is configured to run the computer program, execute: Obtain the traffic data packets to be identified generated when the electronic device is used; Perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program App associated with the traffic data packet to be identified; Match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the second content feature is the valid traffic from the App The content feature extracted from the sample, the effective flow sample includes the flow data packet generated by the App calling the local database; According to the second behavior feature of the at least one App in the feature database, the App to which the traffic data packet to be identified belongs is determined from the at least one App; the second behavior feature represents the call of the App to the third-party database Behavioral characteristics. 7. The apparatus according to claim 6, wherein when the processor is configured to run the computer program, execute: For each App, obtain the corresponding native traffic, where the native traffic is the traffic generated by the corresponding App during the running process of the simulated environment; Filtering the native traffic to obtain valid traffic samples of the corresponding App; Perform content feature extraction on the valid traffic sample to obtain the second content feature of the corresponding App; Obtain the second behavioral feature of the corresponding App according to the pre-acquired second content feature of the App and the native traffic; The feature database is constructed by using the second content feature and the second behavior feature of each App. 8. The apparatus according to claim 7, wherein when the processor is configured to run the computer program, execute: Semantic analysis is performed on the Nth feature information of the App to obtain the first semantic information, and the N is a positive integer; Perform semantic analysis on the content corresponding to the Nth feature information in the traffic data packet to be analyzed, and obtain the second semantic information of the traffic data packet to be analyzed; the traffic data packet to be analyzed is the original traffic through N -1 traffic data packet that is not determined to be an effective traffic data packet after filtering the characteristic information; the effective traffic data packet is the traffic data packet in the effective traffic sample; calculating the degree of association between the first semantic information and the second semantic information; The traffic data packets to be analyzed whose correlation degree is greater than or equal to the preset value are determined as the traffic data packets in the valid traffic samples. 9. The apparatus according to claim 7, wherein when the processor is configured to run the computer program, execute: performing content feature extraction on the native traffic to obtain content features of the native traffic; Matching the content feature of the native traffic with the second content feature of the pre-acquired App to determine the App associated with the native traffic; The second behavior characteristic is obtained according to the description information of the App and the App associated with the native traffic. 10. The apparatus according to claim 6, wherein when the processor is configured to run the computer program, execute: Obtain the target behavior feature from the second behavior feature of the at least one App, and the App associated with the calling behavior in the target behavior feature includes all the Apps associated with the traffic data packet to be identified; Obtain the App corresponding to the target behavior feature from the feature database; The App corresponding to the target behavior feature is determined as the App to which the to-be-identified traffic data packet belongs. 11. A flow identification device, characterized in that the device comprises: an acquisition module, a feature extraction module, a first determination module and a second determination module; wherein, The acquisition module is used to acquire the traffic data packets to be identified generated when the electronic device is used; The feature extraction module is configured to perform feature extraction on the traffic data packet to be identified to obtain a first content feature; the first content feature represents the content feature of an application program associated with the traffic data packet to be identified; The first determining module is configured to match the first content feature with the second content feature of each App in the pre-built feature database, and determine at least one App associated with the traffic data packet to be identified; the first The second content feature is the content feature extracted from the valid flow sample of the App, and the valid flow sample includes the flow data packet generated by the App calling the local database; The second determination module is configured to determine the App to which the traffic data packet to be identified belongs from the at least one App according to the second behavior feature of the at least one App in the feature database; the second behavior The characteristics represent the behavior characteristics of the app calling the third-party database. 12. A computer-readable storage medium, wherein computer-executable instructions are stored in the computer-readable storage medium, and when a computer program of the computer-executable instructions is executed by a processor, any one of claims 1 to 5 is implemented. A traffic identification method as described in one of the above.