CN118158167A - Method, device, electronic device and storage medium for identifying small-category business traffic - Google Patents

Abstract

The application discloses a method and a device for identifying subclass service flow, electronic equipment and a storage medium. Belongs to the technical field of flow identification and is used for realizing the accurate identification of service flow. The method comprises the following steps: collecting flow data to be identified; acquiring target flow data corresponding to each target address information according to the target address information of the flow data; obtaining target subclass services corresponding to the target address information according to a pre-obtained subclass service identification library, wherein the subclass service identification library comprises: the corresponding relation between the address information and the subclass service; and acquiring the flow of each target subclass service in the flow data according to the target flow data corresponding to each target address information and the target subclass service corresponding to each target address information.

Description

Method, device, electronic device and storage medium for identifying small-category business traffic

Technical Field

The present application belongs to the technical field of traffic identification, and specifically relates to a method, device, electronic device and storage medium for identifying small-category business traffic.

Background technique

With the rapid popularization of broadband services and smart products, operators need to use reliable and efficient network service traffic monitoring systems to monitor and analyze the real-time traffic flow of their network traffic, quality, and various services carried by the network. Currently, the common means of Internet traffic monitoring are deep packet inspection technology and network traffic detection system technology. Deep packet inspection technology is a traffic detection and control technology based on the application layer, which can realize service identification;

However, with the development of encryption technology, more and more encrypted traffic is included in the business interaction Internet protocol, and the proportion of unrecognizable data flows is gradually increasing. The network traffic detection system and traffic collection system can monitor the fixed/mobile network traffic in the entire province based on the Internet protocol quintuple, but lacks accurate identification of business traffic.

Summary of the invention

The embodiments of the present application provide a method, device, electronic device and storage medium for identifying small-category business traffic, which can solve the problem of accurate identification of small-category business traffic.

In the first aspect, an embodiment of the present application provides a method for identifying small-category business traffic, comprising: collecting traffic data to be identified; obtaining target traffic data corresponding to each target address information based on the target address information of the traffic data; obtaining target small-category businesses corresponding to each target address information based on a pre-acquired small-category business identification library, wherein the small-category business identification library includes: a correspondence between address information and small-category businesses; obtaining the traffic of each target small-category business in the traffic data based on the target traffic data corresponding to each target address information and the target small-category business corresponding to each target address information.

In the second aspect, an embodiment of the present application provides a device for identifying small-category business traffic, including: a collection module for collecting traffic data to be identified; a first acquisition module for acquiring target traffic data corresponding to each target address information based on the target address information of the traffic data; a second acquisition module for acquiring target small-category businesses corresponding to each target address information based on a pre-acquired small-category business identification library, wherein the small-category business identification library includes: a correspondence between address information and small-category business; a third acquisition module for acquiring the traffic of each target small-category business in the traffic data based on the target traffic data corresponding to each target address information and the target small-category business corresponding to each target address information.

In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method for identifying small-category business traffic as described in the first aspect.

In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method for identifying small-category business traffic as described in the first aspect are implemented.

In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method for identifying small-category business traffic as described in the first aspect.

In an embodiment of the present application, by acquiring the target traffic data of the target address information related to the traffic data, based on the correspondence between the address information and the sub-category of business, through the target sub-category of business corresponding to each of the target address information, and the target traffic data corresponding to the target sub-category of business, the traffic of each of the target sub-category of business in the traffic data is acquired, thereby enabling accurate identification of the sub-category of business traffic.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a method for identifying small-category business traffic provided in an embodiment of the present application;

FIG2 is a schematic diagram of a process for obtaining target sub-category service traffic in an embodiment of the present application;

FIG3a is a flow chart of a method for identifying small-category business traffic provided in an embodiment of the present application;

FIG3b is another schematic diagram of a flow chart of a method for identifying small-category business traffic provided in an embodiment of the present application;

FIG4a is a schematic diagram of a correspondence between a small class of services and an IP address in an embodiment of the present application;

FIG4b is a schematic diagram of determining a flow rate change trend in an embodiment of the present application;

FIG5 is a schematic diagram of a flow chart of a device for identifying small-category business traffic provided in an embodiment of the present application;

FIG. 6 is a schematic diagram of the structure of an electronic device according to an embodiment of the present application.

Detailed ways

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and/or" in the specification and claims represents at least one of the connected objects, and the character "/" generally indicates that the objects associated with each other are in an "or" relationship.

In conjunction with the accompanying drawings, the following describes in detail the method, device, electronic device and storage medium for identifying small-category business traffic provided by the embodiments of the present application through specific embodiments and their application scenarios.

FIG1 shows a method for identifying small-category traffic provided by an embodiment of the present invention. The method can be executed by an electronic device, and the electronic device may include: a terminal device, wherein the terminal device may be, for example, a computer terminal or a mobile phone terminal. In other words, the method can be executed by software or hardware installed in the terminal device, and the method includes the following steps:

Step 101: Collect traffic data to be identified.

In one embodiment, the flow data to be identified can be collected through a data collection program of a network flow detection (NetFlow) system. Of course, in the embodiment of the present application, there is no specific limitation on the method of collecting the flow data.

Step 102: According to the target address information of the flow data, the target flow data corresponding to each target address information is obtained.

For example, the target data flow corresponding to the target address information can be obtained based on the relevant target address information of the traffic data collected by the NetFlow system, where the target address information is a field related to the target data flow, and the number of target address information can be one or more, which is not specifically limited in the embodiments of the present application.

Step 103: acquiring the target sub-category service corresponding to each target address information according to the pre-acquired sub-category service identification library, wherein the sub-category service identification library includes: the correspondence between address information and sub-category service.

For example, the target subclass service corresponding to the target address information in the NetFlow system can be matched through the subclass service identification library, so as to form a form in which the target subclass service corresponds to the target address information, thereby further achieving a corresponding effect of the data flow of the target subclass service and the target address information. Obtaining the target subclass service corresponding to each target address information can achieve the effect of accurately identifying the target subclass service, and the address information in the subclass service identification library and the subclass service also have a corresponding relationship, wherein the target address information can be an independent target address information corresponding to a target subclass service, or it can be a mixed target address information corresponding to multiple target subclass services. The mixed target address information can be split to obtain each target subclass service in the mixed target address information. Of course, this is not specifically limited in the embodiments of the present application.

In the embodiment of the present application, sub-categories of services can be divided according to specific needs. For example, they can be divided into video services, audio services, etc. according to the type of application. Of course, it is not limited to this. They can also be classified according to service providers, which is not limited to the specific embodiment of the present application.

Step 104: According to the target traffic data corresponding to each target address information and the target sub-category service corresponding to each target address information, the traffic of each target sub-category service in the traffic data is acquired.

For example, the mixed target address information can be split in the NetFlow system to achieve accurate identification of the traffic of each target sub-class service in the traffic data, form a correspondence between the mixed target address information, the target sub-class service, and the target traffic data, and obtain the traffic of each target sub-class service in the mixed target address information. When the traffic of the target sub-class service corresponding to the independent target address information is added, the effect of accurately outputting the sub-class service traffic can be achieved. Of course, in the embodiment of the present application, the type of target address information is not specifically limited and can be selected according to the specific application.

In an embodiment of the present application, by acquiring the target traffic data of the target address information related to the traffic data, based on the correspondence between the address information and the sub-category of business, through the target sub-category of business corresponding to each of the target address information, and the target traffic data corresponding to the target sub-category of business, the traffic of each of the target sub-category of business in the traffic data is acquired, thereby enabling accurate identification of the sub-category of business traffic.

In one embodiment, before step 101, the following steps are also included:

The full domain name information and the address information of the sub-category service are obtained from the Deep Packet Inspection (DPI) system; based on the full domain name information, the full address information corresponding to the sub-category service is obtained; and the sub-category service identification library is established, wherein the address information corresponding to the sub-category service in the sub-category service identification library is the union of the address information of the sub-category service obtained from the DPI system and the full address information corresponding to the sub-category service. The full domain name information and address information (for example, IP address) of each sub-category service are obtained through the DPI system, and then the full address information corresponding to the full domain name information is obtained, and the full address information is taken as the union with the address information from the DPI system, thereby ensuring that all address information corresponding to each sub-category service can be obtained, thereby improving the accuracy of subsequent traffic identification.

For example, the service identification code in the Extended Detection and Response (XDR) bottom-level identification list of the DPI system can be used to identify and match the full domain name information and the address information of the sub-category service, wherein the identification code is not specifically limited; then, based on the full domain name information, the full address information corresponding to the sub-category service is parsed from the Domain Name System (DNS), and the sub-category service identification library is established based on the full address information and the address information, wherein the address information corresponding to the sub-category service in the sub-category identification library is the union of the address information of the sub-category service obtained from the DPI system and the full address information corresponding to the sub-category service, and the sub-category service identification library can achieve a matching effect on the sub-category service and related address information traffic.

In one embodiment, as shown in FIG. 2 , step 104 may include the following steps:

Step 201: According to the traffic change corresponding to the first target address information, obtain the traffic change rule of the first target subclass service, wherein the first target address information is the target address information that only corresponds to the first target subclass service among multiple target address information, and the first target subclass service is any one of the multiple target subclass services.

For example, the target address information among the multiple target address information that only corresponds to the first target subclass service can be taken as the first target address information, and any one of the multiple target subclass services can be taken as the first target subclass service, and the change of the traffic corresponding to the first target address information in at least one first predetermined time period Xt1 is obtained, and the traffic change in at least one first predetermined time period is recorded as ΔX. According to the change ΔX of the traffic corresponding to the first target address information, the traffic change rule of the first target subclass service is obtained as ΔX/Xt1. The traffic change rule ΔX/Xt1 of the first target subclass service can achieve the prediction of the traffic of the first target subclass service. In the embodiment of the present application, there is no specific limitation on the selection of the preset time period, and it can be selected according to the needs.

Step 202: According to the traffic change rule of the first target subclass service, obtain the first traffic occupied by the target subclass service in the traffic corresponding to the second target address information, wherein the second target address information is the target address information corresponding to the first target subclass service and at least one second target subclass service among the multiple target address information, and the second target subclass service is the target subclass service among the multiple target subclass services except the first target subclass service.

For example, the target address information corresponding to the first target subclass service and at least one second target subclass service among the multiple target address information is the second target address information, and the target subclass services other than the first target subclass service among the multiple target subclass services are taken as the second target subclass services. It is assumed that the first change in the second predetermined time period Xt2 of the traffic corresponding to the second target address information is MT2. According to the traffic change rule ΔX/Xt1 of the first target subclass service, the change rule ΔY/Yt1 of the second target subclass service, and the first change MT2, the second change Xm of the traffic of the first target subclass service in the second predetermined time period can be obtained. Then, the ratio of the second change to the first change is Xm/MT2. If the traffic corresponding to the current second target address information is M, the first traffic of the first target subclass service can be obtained as M*Xm/MT2. The traffic occupied by the target subclass service in the traffic corresponding to the second target address information can be accurately obtained through the first traffic. Of course, the specific calculation method is not specifically limited in the embodiment of the present application.

Optionally, the second preset time period may be a time period overlapping with the first preset time period, that is, the second preset time period is the same time period as the first preset time period. Since the probability that the traffic change trend of the independent IP of the small-category service is the same as the traffic change trend of each service of the mixed IP within the same time period is relatively high, therefore, when the second preset time period is the same as the first preset time period, the traffic of the identified small-category service is more accurate.

Step 203: Acquire the target flow of the first target subcategory service in the flow data according to the flow corresponding to the first target address information and the first flow.

The first flow is obtained according to the calculation method of the first flow in the above embodiment. The target flow of the first target subcategory business in the flow data can be accurately obtained according to the flow corresponding to the first target address information and the first flow, that is, the target flow of the first target subcategory business is the sum of the flow corresponding to the first target address information and the flow corresponding to each second target address information.

In an embodiment of the present application, by acquiring the target traffic data of the target address information related to the traffic data, based on the correspondence between the address information and the sub-category of business, through the target sub-category of business corresponding to each of the target address information, and the target traffic data corresponding to the target sub-category of business, the traffic of each of the target sub-category of business in the traffic data is acquired, thereby enabling accurate identification of the sub-category of business traffic.

The following describes a method for identifying small-category business traffic provided by an embodiment of the present application through a specific example.

FIG. 3a shows a schematic flow chart of a method for identifying small-category service traffic in an embodiment of the present application, and FIG. 3b shows another schematic flow chart of a method for identifying small-category service traffic in an embodiment of the present application. As shown in FIG. 3a and FIG. 3b,

In process one, a sub-category business identification library can be formed based on the XDR detailed list of the DPI system. Optionally, the full domain name information and IP address information of the sub-category business can be identified by matching the major and minor business identification codes in the XDR underlying identification detailed list of the DPI identification system. Then, the full IP address of the sub-category business can be parsed from the provincial network DNS system based on the full domain name of the business, and the full IP address can be mixed and combined with the IP address in the DPI identification list to form a sub-category business identification library of "sub-category business name" plus full "IP".

Process 2: Introduce the service subclass identification library into the NetFlow system. Introduce the new service subclass identification library formed in the DPI system into the NetFlow system. According to the configuration of "service subclass name + IP five-tuple" (for example, the IP address in the service subclass identification library can be converted into the form of IP five-tuple), the NetFlow system can match the traffic and flow direction of the subclass service and related IP.

Process 3: When the NetFlow system identifies the traffic of each sub-category of services in the traffic data, it can query the sub-category of services identification library according to the IP address included in the traffic data, obtain the sub-category of services corresponding to each IP address, and then divide the IP type of each sub-category of services. There are two situations for the association between IP address and sub-category of services: ① Independent IP, one IP address corresponds to only one sub-category of services; ② Mixed IP, one IP address corresponds to multiple sub-category of services. For example, assuming that the sub-category of services corresponding to each IP address in the traffic data is shown in the left half of Figure 4a, by matching the IP address type, the independent IP and mixed IP corresponding to each sub-category of services can be obtained. For example, the independent IP corresponding to sub-category of service X includes IP1, the independent IP corresponding to sub-category of service Y includes IP3, the independent IP corresponding to sub-category of service Z includes IPx, and the mixed IP corresponding to sub-category of service X includes IP2, etc.

Process 4, calculate the change trend of the business traffic of the independent IP address corresponding to the business subclass within the Δt time. For the independent IP corresponding to the target subclass business, that is, one IP address corresponds to a subclass business, then the traffic corresponding to the IP address is the traffic of the subclass business. For the mixed IP corresponding to the target subclass business, that is, one IP address corresponds to multiple subclass businesses, then the traffic corresponding to the IP address is the total traffic of all subclass businesses corresponding to the mixed IP. In the embodiment of the present application, it is necessary to identify the traffic of each subclass business in the total traffic corresponding to the mixed IP.

After analysis, it is found that the traffic change trend of independent IP of small-category services is basically the same as the traffic change trend of each service of hybrid IP within the same period of time. Therefore, the traffic of independent IP corresponding to the same small-category service can be used to obtain the change trend of the small-category service in a certain period of time, and then the change trend can be applied to the hybrid IP corresponding to the small-category service to obtain the traffic change corresponding to the small-category service in the hybrid IP, thereby obtaining the traffic of the small-category service in the hybrid IP.

Specifically, for the independent IP corresponding to the target small category business, the change in independent IP traffic can be calculated. The same change time T1 and T2 of the independent IP of the small category business can be randomly selected, and the independent IP traffic change ΔX, ΔY, ΔZ, ... etc. from T1 to T2 can be calculated to obtain the independent IP traffic change trend ΔA/ΔT, ΔB/ΔT, ... etc. from T1 to T2. For example, for the small categories of services X, Y and Z in Figure 4a, as shown in Figure 4b, at time T1, the traffic of the independent IPs corresponding to the small categories of services X, Y and Z are Xt1, Yt1 and Zt1 respectively, and at time T2, the traffic of the independent IPs corresponding to the small categories of services X, Y and Z are Xt2, Yt2 and Zt2 respectively. Then, from T1 to T2, the changes in the traffic of the independent IPs corresponding to the small categories of services X, Y and Z are: ΔX=Xt2-Xt1, ΔY=Yt2-Yt1 and ΔZ=Zt2-Zt1 respectively, so that the corresponding change trends of the small categories of services X, Y and Z are: ΔX/Δt, ΔY/Δt and ΔY/Δt respectively, and Δt=T2-T1.

Process five, according to the composition of the mixed IP traffic corresponding to the small-class business and the change of the business traffic of the independent IP address corresponding to the business small-class within the time Δt, use the equation to calculate the specific traffic of the business small-class included in the mixed IP.

In the embodiment of the present application, for the splitting of hybrid IP traffic, since the changing trend of the independent IP traffic of the small-category service is the same as the changing trend of the traffic of each hybrid IP service within the same period of time, the hybrid IP traffic composition is set to Xm, Ym, Zm, etc. according to the number and name of the small-category services composed of the hybrid IP traffic. The changes in the independent IP traffic of the small-category service during T1 and T2, and the changes in the mixed IP traffic of multiple services at the time point T2 are MT2. The following equations are solved to calculate the changes in the traffic of Xm, Ym, and Zm.

Among them, Mt2 is the traffic change of a hybrid IP within Δt time, and Mt4 is the traffic change of another hybrid IP within Δt time.

By obtaining the traffic change of each sub-category of service in each hybrid IP within the time Δt, the traffic of the sub-category of service in each hybrid IP at time T1 or T2 can be obtained. For example, at time T1, the traffic of a hybrid IP is M, the traffic change is MT2, and the change of a sub-category of service is Xm. Then the traffic occupied by the sub-category of service in the hybrid IP is M*Xm/MT2.

Process six, according to the above steps, calculate the traffic of the independent IP corresponding to the small category of business + the traffic corresponding to the small category of business on the hybrid IP to obtain the precise traffic of the small category of business.

It should be noted that the method for identifying small-category business traffic provided in the embodiment of the present application can be executed by a device for identifying small-category business traffic or a control module in the device for identifying small-category business traffic for executing the method for identifying small-category business traffic. In the embodiment of the present application, the device for identifying small-category business traffic provided in the embodiment of the present application is described by taking the method for identifying small-category business traffic executed by the device for identifying small-category business traffic as an example.

Fig. 5 is a schematic diagram of the structure of the device for identifying small-category service traffic according to an embodiment of the present invention. As shown in Fig. 5, the device for identifying small-category service traffic includes: a collection module 301, a first acquisition module 302, a second acquisition module 303, and a third acquisition module 304; wherein, the collection module 301 is used to collect traffic data to be identified; the first acquisition module 302 is used to obtain target traffic data corresponding to each target address information according to the target address information of the traffic data; the second acquisition module 303 is used to obtain the target small-category service corresponding to each target address information according to the pre-acquired small-category service identification library, wherein the small-category service identification library includes: the correspondence between address information and small-category service; the third acquisition module 304 is used to obtain the traffic of each target small-category service in the traffic data according to the target traffic data corresponding to each target address information and the target small-category service corresponding to each target address information.

In one embodiment, the device also includes: establishing a small class business identification library module, which is used to obtain the full domain name information and the address information of the small class business from a deep address identification DPI system; obtaining the full address information corresponding to the small class business based on the full domain name information; establishing the small class business identification library, wherein the address information corresponding to the small class business in the small class business identification library is the union of the address information of the small class business obtained from the DPI system and the full address information corresponding to the small class business.

In one embodiment, the third acquisition module is used to: obtain the traffic change rule of the first target subclass service according to the traffic change corresponding to the first target address information, wherein the first target address information is the target address information corresponding only to the first target subclass service among multiple target address information, and the first target subclass service is any one of the multiple target subclass services; obtain the first traffic occupied by the target subclass service in the traffic corresponding to the second target address information according to the traffic change rule of the first target subclass service, wherein the second target address information is the target address information corresponding to the first target subclass service and at least one second target subclass service among multiple target address information, and the second target subclass service is the target subclass service among the multiple target subclass services except the first target subclass service; obtain the target traffic of the first target subclass service in the traffic data according to the traffic corresponding to the first target address information and the first traffic.

In one embodiment, the first target subcategory service traffic change rule module is used to: obtain the change of the traffic corresponding to the first target address information in at least one first predetermined time period; and obtain the traffic change rule of the first target subcategory service based on the change of the traffic corresponding to the first target address information.

In one embodiment, the first traffic acquisition module is used to: acquire the first change in the traffic corresponding to the second target address information in the second predetermined time period; acquire the second change in the traffic of the first target subclass business in the second predetermined time period according to the traffic change rule of the first target subclass business, the change rule of the second target subclass business, and the first change; acquire the ratio of the second change to the first change; acquire the first traffic, wherein the first traffic is the product of the traffic corresponding to the second target address information and the ratio.

In one embodiment, the information acquisition module is used to: identify and match the full domain name information of the sub-category business and the address information according to the business identification code in the scalable threat detection and response XDR underlying identification details list of the DPI system.

In one embodiment, the module for obtaining full address information is used to: parse the full address information corresponding to the sub-category service from the domain name system DNS according to the full domain name information.

The identification device of the small class traffic flow in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and the non-mobile electronic device can be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

The device for identifying small-category traffic in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

The device for identifying small-category business traffic provided in the embodiment of the present application can implement each process implemented in the method embodiments of Figures 1 to 2, and will not be described again here to avoid repetition.

Based on the same technical concept, the embodiment of the present application also provides an electronic device, which is used to execute the above-mentioned method for identifying small-category business traffic. FIG6 is a schematic diagram of the structure of an electronic device that implements each embodiment of the present application. The electronic device may have relatively large differences due to different configurations or performances, and may include a processor (processor) 401, a communication interface (Communications Interface) 402, a memory (memory) 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404. The processor 401 can call a computer program stored in the memory 403 and can be run on the processor 401. The specific execution steps can refer to the various steps of the embodiment of the method for identifying small-category business traffic, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals or other devices except terminals.

The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (Random Access Memory, RAM), static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDR AM), double data rate synchronous dynamic random access memory (Double Data Rate SD RAM, DDRSDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synchlink DR AM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DRRAM).

The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned small category business traffic identification method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned small-category business traffic identification method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises one..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be noted that the scope of the method and device in the embodiment of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims (10)

1. A method for identifying traffic of a subclass, comprising:

Collecting flow data to be identified;

Acquiring target flow data corresponding to each target address information according to the target address information of the flow data;

obtaining target subclass services corresponding to the target address information according to a pre-obtained subclass service identification library, wherein the subclass service identification library comprises: the corresponding relation between the address information and the subclass service;

And acquiring the flow of each target subclass service in the flow data according to the target flow data corresponding to each target address information and the target subclass service corresponding to each target address information.

2. The method of claim 1, wherein prior to the collecting the traffic data to be identified, the method further comprises:

acquiring the full domain name information and the address information of the subclass service from a deep address identification DPI system;

acquiring full address information corresponding to the subclass service according to the full domain name information;

The subclass service identification library is established, wherein the address information corresponding to the subclass service in the subclass service identification library is a union set of the address information of the subclass service and the total address information corresponding to the subclass service obtained from the DPI system.

3. The method according to claim 1 or 2, wherein obtaining the traffic of each target subclass service in the traffic data according to the target traffic data corresponding to each target address information and the target subclass service corresponding to each target address information comprises:

Acquiring a flow change rule of a first target subclass service according to a flow change condition corresponding to first target address information, wherein the first target address information is only the target address information corresponding to the first target subclass service in a plurality of target address information, and the first target subclass service is any one of the plurality of target subclass services;

Obtaining a first flow occupied by the target subclass service in a flow corresponding to second target address information according to a flow change rule of the first target subclass service, wherein the second target address information is the target address information corresponding to the first target subclass service and at least one second target subclass service in a plurality of target address information, and the second target subclass service is the target subclass service except the first target subclass service in a plurality of target subclass services;

And acquiring the target flow of the first target subclass service in the flow data according to the flow corresponding to the first target address information and the first flow.

4. The method of claim 3, wherein obtaining the traffic variation rule of the first target subclass service according to the traffic variation condition corresponding to the first target address information comprises:

Acquiring the change condition of at least one first preset time period of the flow corresponding to the first target address information;

And obtaining a flow change rule of the first target subclass service according to the flow change condition corresponding to the first target address information.

5. The method of claim 3, wherein the obtaining, according to the traffic change rule of the first target subclass service, the first traffic occupied by the first target subclass service in the traffic corresponding to the second target address information includes:

acquiring a first variable quantity of a second preset time period of the flow corresponding to the second target address information;

Acquiring a second variable quantity of the flow of the first target subclass service in the second preset time period according to the flow change rule of the first target subclass service, the change rule of the second target subclass service and the first variable quantity;

Acquiring the ratio of the second variation to the first variation;

and acquiring the first flow, wherein the first flow is the product of the flow corresponding to the second target address information and the ratio.

6. The method of claim 2, wherein said obtaining full amount domain name information and said address information for said sub-class of traffic from a deep address recognition, DPI, system comprises:

and obtaining the full-scale domain name information and the address information of the subclass service according to the expandable threat detection and response XDR bottom layer identification codes in the detail list of the DPI system by identification matching.

7. The method according to claim 2, wherein the obtaining full-size address information corresponding to the subclass service according to the full-size domain name information includes:

And according to the full-volume domain name information, resolving the full-volume address information corresponding to the subclass service from a Domain Name System (DNS).

8. An apparatus for identifying traffic of a subclass, comprising:

The acquisition module is used for acquiring flow data to be identified;

the first acquisition module is used for acquiring target flow data corresponding to each piece of target address information according to the target address information of the flow data;

the second acquisition module acquires target subclass services corresponding to the target address information according to a pre-acquired subclass service identification library, wherein the subclass service identification library comprises: the corresponding relation between the address information and the subclass service;

And a third obtaining module, configured to obtain, according to the target traffic data corresponding to each target address information and the target subclass service corresponding to each target address information, a traffic of each target subclass service in the traffic data.

9. An electronic device comprising a processor, a memory and a program or instruction stored on the memory and executable on the processor, which program or instruction when executed by the processor implements the method steps of identifying sub-class traffic according to any one of claims 1 to 7.

10. A readable storage medium, characterized in that it has stored thereon a program or instructions which, when executed by a processor, implement the method steps of identifying sub-class traffic according to any of claims 1 to 7.