CN110855424A - Method and device for synthesizing asymmetric flow xDR in DPI field - Google Patents

Abstract

The invention relates to the technical field of DPI, and provides a method and a device for synthesizing asymmetric flow xDR in the field of DPI. The method comprises the steps of generating a message abstract which can be used for determining the uplink flow and the downlink flow of the same session according to one or more items in the five-element group data; determining the total number N of synthesis servers capable of providing the call ticket synthesis service currently; and each DPI device sends the uplink flow and/or the downlink flow stored by the DPI device to a target call ticket synthesis server appointed by the distribution strategy according to the same preset distribution strategy. After the uplink and downlink flows of the session in the network are processed by the DPI equipment loaded in different machine rooms, the DPI equipment can synthesize accurate and complete xDR call ticket records and provide the xDR call ticket records to an upper application big data analysis platform to ensure the accuracy of the platform analysis result, and meanwhile, the xDR call ticket quantity generated by asymmetric flow is reduced, and the processing pressure of the upper big data platform is reduced.

Description

A kind of method and device for asymmetric flow xDR synthesis in DPI field

【Technical field】

The present invention relates to the technical field of DPI, in particular to a method and device for synthesizing asymmetric flow xDR in the field of DPI.

【Background technique】

At present, in the field of Deep Packet Inspection (DPI) technology, on different operators and networks, DPI devices are deployed at the Internet Data Center (Internet Data Center, referred to as: IDC) computer room exit, mobile network exit, urban Area network exit and other places. DPI needs to collect and analyze the traffic passing through these exit points, and generate xDR (full name: X Detailed Record) bills. A typical system architecture is shown in Figure 1.

In practical applications, DPI devices are divided into splitters, front-end machines, and xDR servers according to different services. The function of the splitter is to split the load of the incoming traffic, and at the same time ensure that the traffic of the same session can be loaded to the same front-end/xDR server for processing; the front-end is the core device of DPI, which mainly completes the pre-processing of the original traffic. Processing, including identification, analysis, and statistics of traffic applications, such as identification of http sessions, acquisition of corresponding urls, and statistics of the total traffic of requests and responses in this session, etc. The xDR server mainly generates different final applications. xDR bills, such as http bills, DNS bills, ftp bills, email bills, etc. The key is to identify the application in the process from the access of traffic to the generation of xDR bills. The front-end machine identifies the corresponding application according to the upstream or downstream traffic of a certain session, such as http video, qq, WeChat, iQiyi, etc. The corresponding session information is generated and transmitted to the xDR server, and the xDR server generates an xDR CDR of the corresponding application according to the session information.

Although in the same equipment room, after the traffic passes through the front-end splitter, it can ensure that the traffic of the same session can be aggregated to the same DPI front-end for processing, and the same session information data is aggregated to the xDR server through the back-end splitter to generate xDR bills . However, in current practical applications, the upstream traffic and downstream traffic of many sessions, especially IPv6 sessions, are loaded to different computer rooms, as shown in Figure 2.

The upstream traffic of an email session is loaded to computer room A, and the downstream traffic is loaded to computer room B. Computer room A recognizes that it is an email application through the upstream traffic, and outputs the xDR bill of email; while the computer room B cannot identify the email application through the downstream traffic, and finally outputs an xDR bill of an unknown application, which is finally transmitted to the application big data Platform analysis will cause many problems: first, inaccurate analysis data sources for applications lead to large deviations in the final analysis results; second, after the upstream and downstream traffic are separated, only one CDR needs to be output for each session, but now two copies are output, which greatly It increases the performance burden of the upper-layer application big data analysis platform. However, if the traffic of one computer room is aggregated to another computer room, the existing problem can be solved, but it requires large bandwidth resources (100G or even TB level), which is basically unfeasible.

In view of this, overcoming the defects of the prior art is an urgent problem to be solved in the technical field.

[Content of the invention]

The technical problem to be solved by the present invention is to provide a method for asymmetric flow xDR synthesis in the DPI field.

The further technical problem to be solved by the present invention is to provide a method for asymmetric flow xDR synthesis in the DPI field.

The present invention adopts following technical scheme:

In a first aspect, the present invention provides a method for asymmetric flow xDR synthesis in the DPI field, including:

Generate a message digest that can be used to determine the upstream and downstream traffic of the same session according to one or more of the five-tuple data;

Determine the total number N of synthesis servers that can currently provide CDR synthesis services;

Each DPI device sends the upstream traffic and/or downstream traffic stored by itself to the target CDR synthesis server specified by the allocation strategy according to the same preset allocation strategy;

Wherein, the allocation strategy includes a method of specifying a target CDR synthesis server for each DPI device according to the message digest and the total number N of synthesis servers.

Preferably, generating a message digest that can be used to determine the upstream traffic and downstream traffic of the same session according to one or more of the five-tuple data, specifically including:

According to the source IP, destination IP, source port and destination port in the quintuple, obtain the message digest through the HASH algorithm; or,

According to the source IP, destination IP, source port, destination port and protocol in the quintuple, obtain the message digest through the HASH algorithm; or,

According to the source IP and destination IP in the quintuple, the message digest is obtained through the HASH algorithm.

Preferably, the HASH algorithm includes:

MD4, MD5 and/or SHA-1.

Preferably, the allocation strategy includes a method for specifying a target CDR synthesis server for each DPI device according to the message digest and the total number N of synthesis servers, specifically:

When each CDR synthesis server is numbered by 0, 1, ..., N, the number of the target CDR synthesis server is obtained by directly performing a remainder operation with the total number N according to the message digest;

The distribution interval of the statistically obtained message digest is obtained, and the distribution interval is divided according to the total number N, and the target CDR synthesis server is determined according to the distribution interval to which the generated message digest belongs.

Preferably, if the mth CDR synthesis server is to be maintained offline, the method further includes:

The CDR synthesis server management unit sends a request message for updating the allocation strategy to each DPI device; wherein the request message for updating the allocation strategy includes updating the CDR synthesis server and the number mapping relationship, or sending an update CDR synthesis server Mapping relationship with regional division;

a CDR synthesis server management unit, obtaining from the mth CDR synthesis server the upstream traffic and/or downlink traffic that it has acquired;

The CDR synthesis server management unit, according to the updated allocation policy, obtains the obtained upstream traffic and/or downlink traffic from the m-th CDR synthesis server, and forwards it to the destination CDR synthesis specified by the updated allocation policy server.

Preferably, if the N+1th bill synthesis server is to be added to the bill synthesis server group, the method includes:

The CDR synthesis server management unit sends a request message for updating the allocation strategy to each DPI device; wherein the request message for updating the allocation strategy includes updating the CDR synthesis server and the number mapping relationship, or sending an update CDR synthesis server Mapping relationship with regional division;

A bill synthesis server management unit, sending the pre-update allocation strategy and the updated allocation strategy to the N+1th bill synthesis server at the same time;

Within the preset time after going online, if the obtained upstream traffic or downstream traffic cannot form a complete bill by the N+1 CDR synthesis server, the corresponding upstream traffic or downstream traffic will be allocated according to the pre-updated distribution. The policy is forwarded to the destination CDR synthesis server executed by the pre-update allocation policy.

In the second aspect, the present invention also provides a method for asymmetric traffic xDR synthesis in the DPI field. If the mth CDR synthesis server in the CDR synthesis server group is to be maintained offline, the system includes:

Send a request message for updating the allocation strategy to each DPI device; wherein, the request message for updating the allocation strategy includes updating the CDR synthesis server and the numbering mapping relationship, or, sending and updating the CDR synthesis server and the area division mapping relationship;

Obtain the upstream traffic and/or downstream traffic that it has obtained from the mth CDR synthesis server;

According to the updated allocation strategy, the obtained upstream traffic and/or downstream traffic will be obtained from the mth CDR synthesis server, and forwarded to the destination CDR synthesis server specified by the updated allocation strategy.

Preferably, the allocation strategy includes:

When each CDR synthesis server is numbered by 0, 1, ..., N, the number of the target CDR synthesis server is obtained by directly performing a remainder operation with the total number N according to the message digest;

The distribution interval of the statistically obtained message digest is obtained, and the distribution interval is divided according to the total number N, and the target CDR synthesis server is determined according to the distribution interval to which the generated message digest belongs.

Preferably, if the N+1th bill synthesis server is to be added to the bill synthesis server group, the method further includes:

Send a request message for updating the allocation strategy to each DPI device; wherein, the request message for updating the allocation strategy includes updating the CDR synthesis server and the numbering mapping relationship, or, sending and updating the CDR synthesis server and the area division mapping relationship;

Sending both the pre-update allocation strategy and the updated allocation strategy to the N+1th CDR synthesis server;

Within the preset time after going online, if the obtained upstream traffic or downstream traffic cannot form a complete bill by the N+1 CDR synthesis server, the corresponding upstream traffic or downstream traffic will be allocated according to the pre-updated distribution. The policy is forwarded to the destination CDR synthesis server executed by the pre-update allocation policy.

In a third aspect, the present invention also provides a method for synthesizing asymmetric flow xDR in the DPI field, which is used to realize the method for synthesizing asymmetric flow xDR in the DPI field described in the first aspect, and the device includes:

at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being programmed to perform the first aspect An asymmetric flow xDR synthesis method in the DPI field described.

In a fourth aspect, the present invention also provides a non-volatile computer storage medium storing computer-executable instructions, the computer-executable instructions being executed by one or more processors for completing the first A DPI field asymmetric flow xDR synthesis method described in the aspect.

In the present invention, after the upstream and downstream traffic of the session in the network is processed by the DPI equipment in different computer rooms, the DPI equipment can synthesize an accurate and complete xDR bill record and provide it to the upper-layer application big data analysis platform to ensure the accuracy of the platform analysis results. At the same time, the amount of xDR bills generated by asymmetric traffic is reduced, and the processing pressure of the upper-layer big data platform is relieved. Especially in the case that there are multiple (groups) of composite servers, the problem that the upstream and downstream bills of the same session are allocated to different composite servers is effectively improved. In addition, the problem of low efficiency in restoring a placed CDR (for example, only upstream traffic or only downstream traffic) in the prior art is improved by using the interaction mode between synthetic servers in the prior art.

【Description of drawings】

In order to describe the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings that need to be used in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other drawings can also be obtained from these drawings without creative efforts.

Fig. 1 is an existing DPI and xDR server deployment relationship diagram provided by an embodiment of the present invention;

2 is an architecture diagram of the simplest existing xDR forwarding system for DPI field traffic provided by an embodiment of the present invention;

3 is a flowchart of a method for synthesizing asymmetric traffic xDR in the DPI field provided by an embodiment of the present invention;

4 is a system architecture diagram of a DPI field asymmetric traffic xDR synthesis provided by an embodiment of the present invention;

5 is a flowchart of another method for synthesizing asymmetric traffic xDR in the DPI field provided by an embodiment of the present invention;

6 is a flowchart of another method for synthesizing asymmetric traffic xDR in the DPI field provided by an embodiment of the present invention;

7 is a flowchart of another method for synthesizing asymmetric traffic xDR in the DPI field provided by an embodiment of the present invention;

8 is a flowchart of another method for synthesizing asymmetric traffic xDR in the DPI field provided by an embodiment of the present invention;

9 is a flowchart of another method for synthesizing asymmetric traffic xDR in the DPI field provided by an embodiment of the present invention;

FIG. 10 is a structural diagram of another asymmetric flow xDR synthesis device in the DPI field provided by an embodiment of the present invention.

【Detailed ways】

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

In the description of the present invention, the orientation or positional relationship indicated by the terms "inner", "outer", "longitudinal", "lateral", "upper", "lower", "top", "bottom", etc. are based on the drawings The orientation or positional relationship shown is only for the convenience of describing the present invention rather than requiring the present invention to be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention.

In various embodiments of the present invention, xDR bills refer to records of some key information fields of traffic in networks such as mobile networks and fixed networks. For example, when a user visits a website, one or more xDR records will be generated.

Homologation means that in the process of processing network traffic, the request and response traffic that can ensure that a call back (such as http request) is converged to the same DPI device for processing.

Five-tuple: The basis for identifying the same session in network traffic, mainly source IP, destination IP, source port, destination port, and protocol.

Asymmetric traffic: Refers to the traffic that is not processed by the same computer room for uplink and downlink in the network; for example, a computer room only processes a single uplink traffic, and a certain computer room only processes a single downlink traffic.

Asymmetric xDR CDR: refers to an xDR CDR with only upstream traffic or only downstream traffic generated after processing asymmetric traffic.

As shown in Figure 4, based on the original deployment solution, a CDR synthesis server group is added. The CDR synthesis server group synthesizes the xDR CDRs of a single upstream or single downstream traffic, and finally generates a complete xDR CDR. The core of the solution is that the DPI device needs to increase the capability of asymmetric CDRs to ensure that the asymmetric CDRs of the same session can be aggregated to the same CDR synthesis server at the same time.

The main logic principle of xDR session reporting processing by DPI devices is as follows:

When the DPI device processes the session traffic and generates the CDR, it first determines whether the xDR CDR is a symmetric CDR (with upstream and downstream traffic), and if so, it is directly sent to the big data analysis platform for use, if not, the xDR CDR is sent to CDR synthesis server synthesis. The algorithm for selecting the destination synthesis server is as follows:

1. Suppose there are N CDR synthesis servers, and the corresponding IPs of each server are IP ₁ , IP ₂ , IP ₃ ... IP _N ; N is a natural number;

2. When selecting the CDR synthesis server, generate a key according to the quintuple hash of the asymmetric xDR;

3. Use the calculated key to perform key%m operation to obtain n, and IP _n is the IP of the synthesis server to which the asymmetric xDR is to be sent;

4. According to two computer rooms, the traffic connected to each computer room is 500G, and there is 70% asymmetric traffic. The amount of xDR bills generated every day is 216TB, of which 70% of the xDR bills have problems and 75.6TB. The xDR CDRs are additional CDRs due to asymmetric traffic. If this solution is used, the daily production will be reduced by 75.6TB, the performance loss of the upper-layer big data analysis platform will be reduced by about 35%, and the integrity of the upstream and downstream traffic of the xDR CDR will be ensured.

The technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

Embodiment 1:

Embodiment 1 of the present invention provides a method for xDR synthesis of asymmetric traffic in the DPI field. The execution body of the embodiment of the present invention may be in various forms, and the execution method may be directly executed in the computer room as shown in FIG. 2 . ; It is also possible to set up a single host as shown in Figure 4, including a plurality of bill synthesis server architectures, the agent of the corresponding bill synthesis server group, specially used to receive bills from each computer room, and implemented according to the present invention After the method described in the example is executed, the specific composite server object to be forwarded by the corresponding bill is determined. As shown in FIG. 3 , the method according to the embodiment of the present invention includes:

In step 201, a message digest that can be used to determine the upstream traffic and downstream traffic of the same session is generated according to one or more items in the five-tuple data.

In this embodiment of the present invention, generating a message digest that can be used to determine the upstream traffic and downstream traffic of the same session according to one or more of the five-tuple data, typical methods include:

Manner 1: According to the source IP, destination IP, source port and destination port in the quintuple, the message digest is obtained through a HASH algorithm.

Manner 2: According to the source IP, the destination IP, the source port, the destination port and the protocol in the quintuple, the message digest is obtained through a HASH algorithm.

Manner 3: According to the source IP and the destination IP in the quintuple, the message digest is obtained through a HASH algorithm.

The above three methods have little effect on the final processing, and considering the calculation efficiency, the calculation time spent in the first method will be less, and it is sufficient to satisfy the function of distinguishing the CDRs.

In step 202, the total number N of synthesis servers that can currently provide the CDR synthesis service is determined.

The determination action here may be pre-stored on the execution body of the embodiment of the present invention, or may be obtained from the object in charge of the number management of the synthesis server after the execution body of the embodiment of the present invention is started; for example, at the beginning of the embodiment of the present invention The agent introduced; alternatively, maintained by a big data analytics platform as shown in Figure 4. Further, if the total number of synthetic servers is maintained by a separate third party (such as an agent or a big data analysis platform), then in the case where the corresponding third party determines that the total number of synthetic servers has changed, it is preferable to send an update directly. The main body of the method embodiment of the present invention is requested to run, so that it updates the locally stored or acquired total number N of synthesis servers.

In step 203, each DPI device sends the upstream traffic and/or downstream traffic stored by itself to the target CDR synthesis server specified by the allocation strategy according to the same preset allocation strategy;

Wherein, the allocation strategy includes a method of specifying a target CDR synthesis server for each DPI device according to the message digest and the total number N of synthesis servers.

In the embodiment of the present invention, after the upstream and downstream traffic of the session in the network is loaded to the DPI equipment in different computer rooms for processing, the DPI equipment can synthesize an accurate and complete xDR bill record and provide it to the upper-layer application big data analysis platform to ensure the accuracy of the platform analysis results. At the same time, the amount of xDR bills generated by asymmetric traffic is reduced, and the processing pressure of the upper big data platform is relieved. Especially in the case that there are multiple (groups) of CDR synthesis servers, the problem that the upstream and downstream CDRs of the same session are allocated to different CDR synthesis servers is effectively improved. In addition, the existing technology uses the interaction between the CDR synthesis servers to improve the problem of low efficiency in restoring the CDR (for example, only the upstream traffic or only the downstream traffic).

With reference to the embodiment of the present invention, the HASH algorithm adopted in the three manners in step 201 may include any one or a combination of multiples of MD4, MD5 and SHA-1 in a specific implementation process. Among them, MD4 (RFC 1320) was designed by Ronald L. Rivest of MIT in 1990, and MD is the abbreviation of Message Digest. It is suitable for high-speed software implementation on 32-bit word-length processors - it is based on bit manipulation of 32-bit operands. MD5 (RFC 1321) is an improved version of MD4 by Rivest in 1991. It still groups the input in 512 bits, and its output is a concatenation of 4 32-bit words, which is the same as MD4; MD5 is more complicated than MD4, and the speed is faster. It's slower, but safer, and is better at anti-analysis and anti-difference. SHA1 is designed by NIST NSA to be used with DSA. It generates a hash value of length 160bit for input whose length is less than 2^64, so it is more resistant to brute-force; SHA-1 is designed when Based on the same principle as MD4, and imitating the algorithm.

In step 203 of the embodiment of the present invention, the allocation strategy includes a method for specifying a target CDR synthesis server for each DPI device according to the message digest and the total number N of synthesis servers. Based on the difference of the specific implementation scenarios of the present invention, the following two feasible implementation modes are given, specifically:

Manner 1: When each CDR synthesis server is numbered with 0, 1, . . . , N, the number of the target CDR synthesis server is obtained by directly performing a remainder operation with the total number N according to the message digest.

The mode 1 is a preferred implementation mode of the embodiment of the present invention, and its step-by-step implementation is simple, and in the specific operation process, it is found that it is higher in terms of distribution evenness. However, since one round of remainder operation needs to be performed, relatively speaking, the calculation takes up more resources than Mode 2.

Manner 2: Obtain the distribution interval of the statistically obtained message digest, and divide the distribution interval into intervals according to the total number N, and then determine the target CDR synthesis server according to the distribution interval to which the generated message digest belongs.

The simple understanding of the method 2 is that the message digest (the calculated HASH value) is used as a natural number, and the area range is delimited according to the bytes occupied by its parameters. For the synthesis server, simply use the parameter values as an example: for the distribution interval [1000, 2000] as the distribution interval of the CDR synthesis server 1, if the message digest value of a CDR is calculated to be 1500, then the corresponding will be designated and forwarded to the CDR synthesis server 1 for xDR synthesis. Compared with method 1, method 2 is more efficient, and is suitable for situations where there is a large amount of data to be processed.

Therefore, there is a preferred implementation method, that is, according to the current total amount of billing services, a total business threshold is set, and if it is lower than the total business threshold, the above method 1 is adopted to improve the resource occupation level of each billing server. If the amortization rate is higher than the total business threshold, the above-mentioned method 2 is adopted to reduce the occupation of computing resources of the execution body of the embodiment of the present invention, thereby improving the adaptability of the entire solution.

In the process description process of the method in the embodiment of the present invention, it has been introduced that the failure, disconnection, and update of the CDR synthesis server may occur. Therefore, if the mth CDR synthesis server needs to perform offline maintenance (the mth CDR synthesis server The server is a member of the original N CDR synthesis servers), then as shown in FIG. 5 , the method further includes:

In step 301, the CDR synthesis server management unit (which can be understood as a form of representation of the above-mentioned agent, however, can also be implemented as a part of resources divided by any subject, and runs as the CDR synthesis server management unit, And by accepting the heartbeat message of each bill synthesis server, to determine whether it is working normally), and send a request message for updating the allocation strategy to each DPI device; wherein, the request message for updating the allocation strategy includes: updating the bill synthesis server and number mapping relationship, or, send and update the CDR synthesis server and area division mapping relationship.

In step 302, the bill synthesis server management unit obtains the obtained upstream traffic and/or downstream traffic from the mth bill synthesis server.

The explanation here is based on a normal maintenance process, that is, if the mth CDR synthesis server needs to be maintained, it needs to report the request to the CDR synthesis server management unit. On this basis, the CDR synthesis server management unit can naturally After receiving the request for maintenance reporting by the mth CDR synthesis server, obtain the acquired upstream traffic and/or downlink traffic from the mth CDR synthesis server.

In step 303, the CDR synthesis server management unit, according to the updated allocation policy, obtains the acquired upstream traffic and/or downlink traffic from the m-th CDR synthesis server, and forwards it to those specified in the updated allocation policy The destination CDR synthesis server.

The destination CDR synthesis server specified by the updated allocation policy here means that after the mapping relationship is updated, according to the acquired upstream traffic and/or downstream traffic obtained from the m-th CDR synthesis server, each upstream traffic is recalculated. and/or the Hash value of downlink traffic, and deliver it to the corresponding destination CDR synthesis server. For example: obtain the obtained upstream traffic and/or a certain downstream traffic from the mth CDR synthesis server, and calculate the value according to the above method 1 to 4 (4 represents the mapping value under its own normal operation, so historically is assigned to the m-th CDR synthesis server); and because the m-th CDR synthesis server needs to be maintained, the total number of synthesis servers and the original N is N-1. At this time, the updated mapping relationship is used. , and the calculated value according to method 1 may be 5. At this time, according to the updated mapping relationship, it should be forwarded to the CDR synthesis server that has a mapping relationship with 5 (also described as the destination CDR synthesis server in this embodiment). ).

Steps 301 to 303 in this embodiment of the present invention ensure that in the event of an emergency on the CDR synthesis server, the effective continuation of the method process can be completed under the condition that no data is lost.

The above has introduced the situation that if the mth CDR synthesis server needs to perform offline maintenance through the method process of FIG. The corresponding method implementation process when the bill synthesis server is used. As shown in Figure 6, the method further includes:

In step 401, the CDR synthesis server management unit sends a request message for updating the allocation strategy to each DPI device; wherein the request message for updating the allocation strategy includes updating the CDR synthesis server and the number mapping relationship, or sending Updated the mapping relationship between the CDR synthesis server and the area division.

In step 402, the management unit of the bill synthesis server sends both the pre-update allocation strategy and the updated allocation strategy to the N+1th bill synthesis server;

In step 403, within a preset time after going online, if the obtained upstream traffic or downstream traffic cannot form a complete bill, if the N+1 th CDR synthesis server obtains a complete CDR, the corresponding upstream traffic or downstream traffic It is forwarded to the destination CDR synthesis server executed by the pre-update allocation policy according to the pre-update allocation policy. The preset time may be determined according to the longest time required for a single session to complete the history.

Example 2:

Corresponding to Embodiment 1, in this embodiment of the present invention, an explanation is made directly on the side of the CDR server used for managing and maintaining the CDR, and how to implement the process when the mth CDR synthesis server in the CDR server group needs to perform offline maintenance. The method process, as shown in Figure 7, the method includes:

In step 501, a request message for updating the allocation strategy is sent to each DPI device; wherein, the request message for updating the allocation strategy includes updating the CDR synthesis server and the number mapping relationship, or sending the update CDR synthesis server and area Divide the mapping relationship.

In step 502, the obtained upstream traffic and/or downstream traffic is obtained from the mth CDR synthesis server.

The explanation here is based on a normal maintenance process, that is, if the mth CDR synthesis server needs to be maintained, it needs to report the request to the CDR synthesis server management unit. On this basis, the CDR synthesis server management unit can naturally After receiving the request for maintenance reporting by the mth CDR synthesis server, obtain the acquired upstream traffic and/or downlink traffic from the mth CDR synthesis server.

In step 503, according to the updated allocation strategy, the obtained upstream traffic and/or downstream traffic will be obtained from the mth CDR synthesis server, and forwarded to the destination CDR synthesis server specified by the updated allocation strategy.

The destination CDR synthesis server specified by the updated allocation policy here means that after the mapping relationship is updated, according to the acquired upstream traffic and/or downstream traffic obtained from the m-th CDR synthesis server, each upstream traffic is recalculated. and/or the Hash value of downlink traffic, and deliver it to the corresponding destination CDR synthesis server. For example: obtain the obtained upstream traffic and/or a certain downstream traffic from the mth CDR synthesis server, and calculate the value according to the above method 1 to 4 (4 represents the mapping value under its own normal operation, so historically is assigned to the m-th CDR synthesis server); and because the m-th CDR synthesis server needs to be maintained, the total number of synthesis servers and the original N is N-1. At this time, the updated mapping relationship is used. , and the calculated value according to method 1 may be 5. At this time, according to the updated mapping relationship, it should be forwarded to the CDR synthesis server that has a mapping relationship with 5 (also described as the destination CDR synthesis server in this embodiment). ).

The embodiments of the present invention ensure that the method and process can be effectively continued under the condition that no data is lost in the event of a sudden occurrence of the bill synthesis server.

With reference to the embodiment of the present invention, preferably, the allocation strategy includes:

When each CDR synthesis server is numbered by 0, 1, ..., N, the number of the target CDR synthesis server is obtained by directly performing a remainder operation with the total number N according to the message digest;

The distribution interval of the statistically obtained message digest is obtained, and the distribution interval is divided according to the total number N, and the target CDR synthesis server is determined according to the distribution interval to which the generated message digest belongs.

Based on the embodiment of the present invention, if the N+1th bill synthesis server is to be added to the bill synthesis server group, as shown in FIG. 8 , the method further includes:

In step 601, a request message for updating the allocation strategy is sent to each DPI device; wherein, the request message for updating the allocation strategy includes updating the CDR synthesis server and the number mapping relationship, or sending the update CDR synthesis server and area Divide the mapping relationship.

In step 602, the allocation strategy before the update and the allocation strategy after the update are simultaneously sent to the N+1th bill synthesis server.

In step 603, within a preset time after going online, if the obtained upstream traffic or downstream traffic cannot form a complete bill, if the N+1 bill synthesis server obtains a complete bill, the corresponding upstream traffic or downstream traffic It is forwarded to the destination CDR synthesis server executed by the pre-update allocation policy according to the pre-update allocation policy.

Example 3:

This embodiment of the present invention shows, from a higher-level perspective, how the method and process of Embodiment 1 and Embodiment 2 of the present invention are embedded and implemented at the level of the entire system architecture. Taking the system architecture shown in FIG. 4 as an example, as shown in FIG. 9 , the method process includes:

In step 701, the xDR CDR is reported.

In step 702, it is judged whether the xDR bill is a symmetric bill, that is, whether it has both uplink and downlink data. If the judgment result is "Yes", step 703 is executed; if the judgment result is "No", step 704 is executed.

In step 703, the symmetric xDR bill is sent to the final application big data analysis platform. End the current xDR CDR sending process.

In step 704, the method for selecting a target CDR synthesis server proposed in Embodiment 1 of the present invention is executed. Wherein, the method process of Embodiment 2 can be executed in parallel in the method process of the embodiment of the present invention, and can achieve seamless integration.

In step 705, the asymmetric xDR is sent to the destination CDR synthesis server, and the symmetric xDR CDR is merged by the purpose-integrated CDR server and sent to the final big data platform. End the current xDR CDR sending process.

Example 4:

As shown in FIG. 10 , it is a schematic structural diagram of an asymmetric traffic xDR synthesis device in the DPI field according to an embodiment of the present invention. A device for synthesizing an asymmetric traffic xDR in the DPI field in this embodiment includes one or more processors 21 and a memory 22 . Among them, one processor 21 is taken as an example in FIG. 10 .

The processor 21 and the memory 22 may be connected through a bus or in other ways, and the connection through a bus is taken as an example in FIG. 10 .

As a non-volatile computer-readable storage medium, the memory 22 can be used to store non-volatile software programs and non-volatile computer-executable programs, such as a DPI field asymmetric flow xDR synthesis method in Embodiment 1 . The processor 21 executes an asymmetric flow xDR synthesis method in the DPI field by running the non-volatile software programs and instructions stored in the memory 22 .

Memory 22 may include high speed random access memory, and may also include nonvolatile memory, such as at least one magnetic disk storage device, flash memory device, or other nonvolatile solid state storage device. In some embodiments, the memory 22 may optionally include memory located remotely from the processor 21, and these remote memories may be connected to the processor 21 through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The program instructions/modules are stored in the memory 22, and when executed by the one or more processors 21, execute a DPI field asymmetric traffic xDR synthesis method in the above Embodiment 1, for example, execute the above Describe the various steps shown in Figures 5-9.

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: Read memory (ROM, Read Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, etc.

The above descriptions are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included in the protection of the present invention. within the range.

Claims (10)

1. a method for synthesizing asymmetric flow xDR in the DPI field, is characterized in that, comprising: Generate a message digest that can be used to determine the upstream and downstream traffic of the same session according to one or more of the five-tuple data; Determine the total number N of synthesis servers that can currently provide CDR synthesis services; Each DPI device sends the upstream traffic and/or downstream traffic stored by itself to the target CDR synthesis server specified by the allocation strategy according to the same preset allocation strategy; Wherein, the allocation strategy includes a method of specifying a target CDR synthesis server for each DPI device according to the message digest and the total number N of synthesis servers. 2. The method for combining asymmetric traffic xDR in the DPI field according to claim 1, wherein, according to one or more of the five-tuple data, generate a A summary of the message, including: According to the source IP, destination IP, source port and destination port in the quintuple, obtain the message digest through the HASH algorithm; or, According to the source IP, destination IP, source port, destination port and protocol in the quintuple, obtain the message digest through the HASH algorithm; or, According to the source IP and destination IP in the quintuple, the message digest is obtained through the HASH algorithm. 3. the method for DPI field asymmetric flow xDR synthesis according to claim 2, is characterized in that, described HASH algorithm comprises: MD4, MD5 and/or SHA-1. 4. The method for asymmetric traffic xDR synthesis in the DPI field according to claim 1, wherein the allocation strategy comprises specifying a target CDR synthesis for each DPI device according to the message digest and the total number N of synthesis servers. The server method, specifically: When each CDR synthesis server is numbered by 0, 1, ..., N, the number of the target CDR synthesis server is obtained by directly performing a remainder operation with the total number N according to the message digest; The distribution interval of the statistically obtained message digest is obtained, and the distribution interval is divided according to the total number N, and the target CDR synthesis server is determined according to the distribution interval to which the generated message digest belongs. 5. The method for asymmetric traffic xDR synthesis in the DPI field according to claim 4, wherein if the mth bill synthesis server is to be maintained offline, the method further comprises: The CDR synthesis server management unit sends a request message for updating the allocation strategy to each DPI device; wherein the request message for updating the allocation strategy includes updating the CDR synthesis server and the number mapping relationship, or sending an update CDR synthesis server Mapping relationship with regional division; a CDR synthesis server management unit, obtaining from the mth CDR synthesis server the upstream traffic and/or downlink traffic that it has acquired; The CDR synthesis server management unit, according to the updated allocation policy, obtains the obtained upstream traffic and/or downlink traffic from the m-th CDR synthesis server, and forwards it to the destination CDR synthesis specified by the updated allocation policy server. 6. The method for asymmetric traffic xDR synthesis in the DPI field according to claim 4, wherein, if the N+1th CDR synthesis server is to be added to the CDR synthesis server group, the method comprises: The CDR synthesis server management unit sends a request message for updating the allocation strategy to each DPI device; wherein the request message for updating the allocation strategy includes updating the CDR synthesis server and the number mapping relationship, or sending an update CDR synthesis server Mapping relationship with regional division; A bill synthesis server management unit, sending the pre-update allocation strategy and the updated allocation strategy to the N+1th bill synthesis server at the same time; Within the preset time after going online, if the obtained upstream traffic or downstream traffic cannot form a complete bill by the N+1 CDR synthesis server, the corresponding upstream traffic or downstream traffic will be allocated according to the pre-updated distribution. The policy is forwarded to the destination CDR synthesis server executed by the pre-update allocation policy. 7. A method for asymmetric traffic xDR synthesis in the DPI field, characterized in that, if the mth bill synthesis server in the bill synthesis server group is to be maintained offline, the system comprises: Send a request message for updating the allocation strategy to each DPI device; wherein, the request message for updating the allocation strategy includes updating the CDR synthesis server and the numbering mapping relationship, or, sending and updating the CDR synthesis server and the area division mapping relationship; Obtain the upstream traffic and/or downstream traffic that it has obtained from the mth CDR synthesis server; According to the updated allocation strategy, the obtained upstream traffic and/or downstream traffic will be obtained from the mth CDR synthesis server, and forwarded to the destination CDR synthesis server specified by the updated allocation strategy. 8. The method for asymmetric traffic xDR synthesis in the DPI field according to claim 7, wherein the allocation strategy comprises: When each CDR synthesis server is numbered by 0, 1, ..., N, the number of the target CDR synthesis server is obtained by directly performing a remainder operation with the total number N according to the message digest; The distribution interval of the statistically obtained message digest is obtained, and the distribution interval is divided according to the total number N, and the target CDR synthesis server is determined according to the distribution interval to which the generated message digest belongs. 9. The method for asymmetric traffic xDR synthesis in the DPI field according to claim 7, wherein, if the N+1th CDR synthesis server is to be newly added to the CDR synthesis server group, the method further comprises: Send a request message for updating the allocation strategy to each DPI device; wherein, the request message for updating the allocation strategy includes updating the CDR synthesis server and the numbering mapping relationship, or, sending and updating the CDR synthesis server and the area division mapping relationship; Sending both the pre-update allocation strategy and the updated allocation strategy to the N+1th CDR synthesis server; Within the preset time after going online, if the obtained upstream traffic or downstream traffic cannot form a complete bill by the N+1 CDR synthesis server, the corresponding upstream traffic or downstream traffic will be allocated according to the pre-updated distribution. The policy is forwarded to the destination CDR synthesis server executed by the pre-update allocation policy. 10. A device for asymmetric flow xDR synthesis in the DPI field, wherein the device comprises: at least one processor; and, a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being programmed to perform claims 1- 9. Any one of the described methods for xDR synthesis of asymmetric flow in the DPI field.

Images