WO2016184163A1 - Method and device for generating a dpi rules - Google Patents

Abstract

Disclosed is a method for generating a DPI rule, comprising: acquiring internet data, and identifying, based on the DPI rule of a DPI rule repository, the internet data; when there is unidentified data in the internet data, analyzing the unidentified data to acquire a first characteristic of the unidentified data; compiling, based on the first characteristic, to generate a DPI rule; and storing the DPI rule to the DPI rule repository.

Description

Method and device for generating DPI rules Technical field

This document relates to, but is not limited to, the field of network data transmission technologies, and in particular, to a method, an apparatus, and a computer readable storage medium for generating DPI rules.

Background technique

DPI (Deep Packet Inspection) is a technology for distinguishing different service flows in a network. DPI identifies data attributes and service types by analyzing the depth feature values and protocol behavior of data packets in the service flow. The identification of customers and different services provides support for the refined analysis and control of network services.

At present, the service applications of the mobile Internet are endless, and the version of the same application is frequently updated. As a result, the DPI rules based on the known service identification of the current DPI rule base cannot meet the needs of service analysis, and the DPI rules cannot accurately identify the service data in the Internet data. .

Summary of the invention

The following is a summary of the subject matter described in detail herein, and is not intended to limit the scope of the claims.

Embodiments of the present invention provide a method, an apparatus, and a computer readable storage medium for generating a DPI rule, which are to solve the technical problem that the DPI rule of the DPI rule base cannot accurately identify the service data in the Internet data.

A method for generating a DPI rule according to an embodiment of the present invention, the method for generating the DPI rule includes the following steps:

Obtaining internet data, identifying the internet data based on existing DPI rules in a DPI rule base;

When the Internet data has unidentified data, analyzing the unidentified data to obtain a first feature of the unidentified data, wherein the unidentified data is unrecognizable by the DPI rule in the Internet data. Internet data;

Generating a new DPI rule based on the first feature compilation;

The new DPI rules are stored to the DPI rule base.

Optionally, the step of analyzing the unidentified data to obtain the first feature of the unidentified data when the Internet data has unidentified data includes:

Acquiring the second feature of the unidentified data when the Internet data has unidentified data;

Filtering the unidentified data based on the second feature to obtain service data;

Analyzing the service data to obtain a service feature of the service data;

The acquired service feature is taken as the first feature of the unidentified data.

Optionally, when the Internet data has unidentified data, the step of acquiring the second feature of the unidentified data and the step of filtering the unidentified data based on the second feature to obtain the service data The method for generating the DPI rule further includes:

Obtaining a first target IP address and/or first user data corresponding to the second feature;

And updating, by the second target IP, the first target IP address in the unidentified data when the first target IP address is inconsistent with the second target IP address corresponding to the second feature;

And/or, when the first user data is inconsistent with the second user data corresponding to the second feature, the second user data is used to update the first user data in the unidentified data.

Optionally, the step of analyzing the service data to obtain the service feature of the service data includes:

Dividing the service data into multiple groups of service data groups;

Performing data mining on the same sequence of load packets of the service data group to obtain service characteristics of the plurality of service data groups;

The plurality of the obtained service features are taken as the first feature of the unidentified data.

Optionally, the step of storing the new DPI rule to the DPI rule base includes:

Determining whether the generated new DPI rule conflicts with an existing DPI rule in the DPI rule base;

When the generated new DPI rule does not conflict with the existing DPI rule of the DPI rule base, the new DPI rule is stored to the DPI rule base.

In addition, the embodiment of the present invention further provides a device for generating a DPI rule, where the device for generating the DPI rule includes:

An identification module configured to obtain Internet data, and identify the Internet data based on an existing DPI rule in a DPI rule base;

An analysis module, configured to analyze the unidentified data to obtain a first feature of the unidentified data when the Internet data has unidentified data, wherein the unidentified data is the Internet data Internet data that is not recognized by DPI rules;

Compiling a module, configured to generate a new DPI rule based on the first feature compilation;

a storage module configured to store the new DPI rule to the DPI rule base.

Optionally, the analyzing module includes:

a first acquiring unit, configured to acquire a second feature of the unidentified data when the Internet data has unidentified data;

a filtering unit, configured to filter the unidentified data based on the second feature to obtain service data;

The analyzing unit is configured to analyze the service data to obtain a service feature of the service data, and use the acquired service feature as the first feature of the unidentified data.

Optionally, the analyzing module further includes:

a second acquiring unit, configured to be a first target IP address and/or first user data corresponding to the second feature;

And an update unit, configured to: when the first target IP address is inconsistent with the second target IP address corresponding to the second feature, use the second target IP to update the first target IP address in the unidentified data; And/or for updating the first user data in the unidentified data by using the second user data when the first user data is inconsistent with the second user data corresponding to the second feature.

Optionally, the analyzing unit includes:

a grouping subunit, configured to divide the service data into multiple groups of service data groups;

a data mining sub-unit, configured to perform data mining on the same sequence of load packets of the service data group, to obtain service features of the plurality of service data groups, and to obtain the plurality of the service features as the The first feature of the data is not identified.

Optionally, the storage module includes:

a determining unit, configured to determine whether the generated new DPI rule conflicts with an existing DPI rule of the DPI rule base;

The storage unit is configured to store the new DPI rule to the DPI rule base when the generated new DPI rule does not conflict with the existing DPI rule of the DPI rule base.

The embodiment of the present invention further provides a computer readable storage medium, which stores program instructions, and when the program instructions are executed by the processor, implements a DPI rule generation method provided by an embodiment of the present invention.

The embodiment of the present invention firstly obtains the Internet data by acquiring the Internet data, and the existing DPI rule based on the DPI rule base is used to obtain the unidentified data; and then analyzing the unidentified data to obtain the service feature of the unidentified data; A new DPI rule is then generated based on the business feature compilation; finally the new DPI rule is stored to the DPI rule base. Obtain unidentified data based on the obtained Internet data, analyze the business characteristics of the unidentified data, compile and generate new DPI rules based on the business features, and update the DPI rule base based on the new DPI rules, and complete the real-time automatic update of the DPI rule base. Avoiding the DPI rule of the DPI rule base can not accurately identify the business data in the Internet data, and improve the recognition rate and accuracy of data recognition.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a schematic flow chart of a first embodiment of a method for generating a DPI rule in this document;

2 is a schematic diagram of a refinement process of step S40 in FIG. 1;

3 is a schematic flow chart of the refinement of the first embodiment of step S20 of FIG. 1;

4 is a schematic flow chart of the second embodiment of step S20 of FIG. 1;

FIG. 5 is a schematic diagram showing the refinement process of step S23 in FIG. 3;

6 is a schematic diagram of functional modules of a first embodiment of a DPI rule generating apparatus;

7 is a schematic diagram of a refinement function module of the storage module in FIG. 6;

8 is a schematic diagram of a refinement function module of the first embodiment of the analysis module of FIG. 6;

9 is a schematic diagram of a refinement function module of the second embodiment of the analysis module of FIG. 6;

FIG. 10 is a schematic diagram of a refinement function module of the analysis unit of FIG. 8. FIG.

Preferred embodiment of the invention

Referring to FIG. 1, FIG. 1 is a schematic flowchart diagram of a first embodiment of a method for generating a DPI rule.

In this embodiment, the method for generating the DPI rule includes:

Step S10: Obtain internet data, and identify the internet data based on existing DPI rules in the DPI rule base;

Collect/acquire mobile internet data, and identify the collected/acquired mobile internet data based on existing DPI rules in the DPI rule base.

Step S20, analyzing the unidentified data to obtain the first feature of the unidentified data when the Internet data has unidentified data, wherein the unidentified data is based on the existing data in the Internet data. Internet data that is not recognized by the DPI rule;

When the Internet data has unidentified data, the unidentified data is analyzed to obtain the first feature of the unidentified data. The first feature may be acquired based on a data mining algorithm using features included in the intrinsic feature set, load of unidentified data, and/or common features of the same sequence of most data streams in unidentified data. The first feature is a feature included in the intrinsic feature set, a load of unidentified data, and/or one or more of the common features of the same sequence of the majority of the data streams in the unidentified data; wherein the load refers to the unidentified data inclusion Corresponding server and other encrypted data sequences. For example: access Sohu network, through the general way to resolve the HTTP protocol header field fixed field HOST search out the first feature is www.sohu.com .

Step S30, compiling and generating a new DPI rule based on the first feature;

A new DPI rule is generated based on the acquired first feature compilation. The compiling method may adopt the compiling method of the existing DPI rules, or may be other compiling manners, for example, the compiling manner of the existing DPI rules in the compiling manner is optimized, and is not further limited in this embodiment.

Step S40, storing the newly generated DPI rule to the DPI rule base.

The new DPI rules generated by the compilation are stored in the DPI rule base, that is, the DPI rule base is updated based on the new DPI rules generated by the compilation, and the update process adopts a hot update.

In other embodiments, please refer to FIG. 2, and step S40 includes:

Step S41: Determine whether the generated DPI rule conflicts with an existing DPI rule of the DPI rule base.

Step S42: When the generated DPI rule does not conflict with the existing DPI rule of the DPI rule base, the DPI rule is stored in the DPI rule base.

Data searched based on newly generated DPI rules and existing DPI rules based on DPI rule base If the searched data is the same or the data searched based on the newly generated DPI rule contains or is included in the data of the existing DPI rule search based on the DPI rule base, it is determined that the newly generated DPI rule and the existing DPI rule of the DPI rule base exist. conflict. When the newly generated DPI rule conflicts with the existing DPI rule of the DPI rule base, analyzing the newly generated DPI rule and the existing DPI rule corresponding to the conflict, and finding out the cause of the conflict, and modifying the new cause based on the reason The generated DPI rule stores the modified newly generated DPI rule to the DPI rule base when there is no conflict between the modified newly generated DPI rule and the existing DPI rule of the DPI rule base. Wherein, when the data searched based on the newly generated DPI rule includes or is included in the data of the existing DPI rule search based on the DPI rule base, the priority of the newly generated DPI rule and the existing DPI rule of the DPI rule base is set, and The DPI rule base is updated based on the newly generated DPI rules after the priority is set and the existing DPI rules of the DPI rule base; if the modified newly generated DPI rules still conflict with the existing DPI rules of the DPI rule base, the modification continues or Discard the DPI rules.

After updating the DPI rule base based on compiling the newly generated DPI rule, the DPI rule of the updated DPI rule base can be used to identify the newly appearing business data in the mobile internet.

The method for generating a DPI rule in this embodiment firstly identifies the Internet data by acquiring an Internet data according to an existing DPI rule of the DPI rule base; and then analyzing the unidentified data when the Internet data has unidentified data, Obtaining a first feature of the unrecognized data; then generating a new DPI rule based on the first feature compilation; and finally storing the new DPI rule to the DPI rule base. Obtain unidentified data based on the obtained Internet data, analyze the business characteristics of the unidentified data, compile and generate new DPI rules based on the business features, and update the DPI rule base based on the new DPI rules, and complete the real-time automatic update of the DPI rule base. Avoiding the DPI rule of the DPI rule base can not accurately identify the business data in the Internet data, and improve the recognition rate and accuracy of data recognition.

Referring to FIG. 3, FIG. 3 is a schematic diagram of a refinement process of the first embodiment of step S20 of FIG.

Optionally, an embodiment of the refinement process of step S20 in the method for generating a DPI rule of the present invention is provided based on the first embodiment. In this embodiment, step S20 includes:

Step S21: Acquire a second feature of the unidentified data when the Internet data has unidentified data;

Obtaining second data of unidentified data using existing protocols based on plaintext data of unidentified data The second feature includes a plaintext data feature of unidentified data such as a domain name, and the second feature is used as a service name corresponding to the unidentified data.

Step S22, filtering the unidentified data based on the second feature to obtain service data.

Filter unidentified data, remove non-business data of unidentified data, and ensure that the remaining unidentified data is pure business data. The unidentified data corresponding to the user data may be the service when the user data and the target IP address corresponding to the user data are successfully matched with the second feature by acquiring the user data corresponding to the user data and the target IP address corresponding to the user data. Data; when the target IP address corresponding to the user data and the user data cannot be successfully matched with the second feature at the same time, the unidentified data corresponding to the user data is non-service data. The manner of filtering unidentified data in the present embodiment may delete or mark non-service data in the unidentified data as non-service data.

Step S23, analyzing the service data to obtain a service feature of the service data;

The business characteristics of the business data may be analyzed based on a data mining algorithm using features included in the intrinsic feature set, loads of unidentified data, and/or common features of the same sequence of most data streams in unidentified data. The service feature is a feature included in the intrinsic feature set, a load of unidentified data, and/or one or more of the common features of the same sequence of most data streams in the unidentified data; wherein the load refers to the unidentified data included Corresponding server and other encrypted data sequences.

Step S24, the acquired service feature is used as the first feature of the unidentified data.

In the second embodiment of the method for generating a DPI rule, referring to FIG. 4, between the step S21 and the step S22, the method for generating the DPI rule further includes:

Step S25: Obtain a first target IP address and/or first user data corresponding to the second feature.

The first target IP address and the first user data are respectively a target IP address and user data corresponding to the second feature in the unidentified data.

Step S26, when the first target IP address is inconsistent with the second target IP address corresponding to the second feature, using the second target IP to update the first target IP address in the unidentified data;

And/or, when the first user data is inconsistent with the second user data corresponding to the second feature, the second user data is used to update the first user data in the unidentified data.

The second target IP address is a target IP address corresponding to the second feature in the Internet data, and the second user data is user data corresponding to the second feature in the Internet data.

Obtaining, by the first target IP address and/or the first user data corresponding to the second feature in the unidentified data, and when the first target IP address is inconsistent with the second target IP address corresponding to the second feature Updating the first target IP address in the unidentified data by using the second target IP, and/or, when the first user data is inconsistent with the second user data corresponding to the second feature, The second user data updates the first user data in the unidentified data. Complementing the unidentified data ensures the integrity of the unidentified data corresponding to the second feature, thereby improving the accuracy of the subsequently generated DPI rules. For example, for the service X, the first target IP address corresponding to the acquired second feature is A, and when the service X service rule changes, the application version of the service X is upgraded, and the acquired Internet data may include the second feature corresponding to the second feature. The second target IP address is data of B; wherein address B is a new target IP address in the data generated by the upgraded version, and address A is the target IP address in the data generated by the old version before the upgrade. At this time, the addresses A and B are inconsistent, and the second target IP address B is used to update the first target IP address A in the unidentified data; and the second target IP address B is added to the first target IP address, and the updated The first target IP address corresponding to the second feature is A and B; or, the first target IP address is updated to B. For example, for the service Y, the first user data corresponding to the acquired second feature is C, and when the service Y service rule changes, the application version of the service Y is upgraded, and the acquired Internet data may include the second feature corresponding to the second feature. The user data is the data of D; wherein the user data D is new user data in the data generated by the upgraded version, and the user data C is the user data in the data generated by the old version before the upgrade. At this time, when D and C are inconsistent, the first user data C in the unidentified data is updated by using the second user data D; including: adding the second user data D to the first user data, and the updated first user data For C and D; or, update the first user data to D.

In this embodiment, the unidentified data is filtered by the second feature, the service data in the unidentified data is obtained, and the service feature of the service data is obtained by analyzing the service data, and the obtained service feature is used as The first feature of the unidentified data improves the accuracy of the first feature, thereby improving the accuracy of the subsequently generated DPI rule.

Referring to FIG. 5, FIG. 5 is a schematic diagram of the refinement process of step S23 in FIG.

An embodiment of the refinement process of step S23 in the method for generating a DPI rule according to the present invention is provided based on the previous embodiment. In this embodiment, step S23 includes:

Step S231, dividing the service data into multiple groups of service data groups;

The service data is divided into multiple groups of service data groups in units of user flows, and the service data may be grouped by a group of N user flows. User flow refers to the data flow generated during the process of connecting a server to an IP address when the user accesses a server.

Step S232: Perform data mining on the same sequence of load packets of the service data group to obtain service features of the plurality of service data groups.

The data mining algorithm is used to perform data mining on the same sequence of load packets of each service data group, so as to obtain the service features of each of the service data groups, where the service feature refers to a service data group capable of covering a preset ratio or more. The common feature of the service data, that is, the common feature of the service data above the preset ratio of the service data group, or the service data of the service data group preset ratio or more includes the service feature, wherein the preset ratio is to ensure the subsequent generation of the DPI rule. The accuracy ratio and the preset ratio, the preset ratio can be set to 90%, 95%, etc. according to the demand.

Step S233, the obtained plurality of the service features are used as the first feature of the unidentified data.

In this embodiment, the service data is divided into multiple groups of service data groups; data mining of the same sequence of load packets of the service data group is performed, to obtain the service characteristics of the service data group, and The obtained service feature is used as the first feature of the unidentified data; the service feature of the service data is obtained by using the data mining method, and the accuracy of the service feature is improved.

A device for generating DPI rules.

Referring to FIG. 6, FIG. 6 is a schematic diagram of functional modules of a first embodiment of a DPI rule generating apparatus.

In this embodiment, the generating device of the DPI rule includes:

The identification module 10 is configured to acquire Internet data, and identify the Internet data based on a DPI rule of the DPI rule base;

The identification module 10 collects/acquires mobile internet data, and the DPI rule set as the DPI rule base identifies the collected/acquired mobile internet data.

The analyzing module 20 is configured to analyze the unidentified data to obtain the first feature of the unidentified data when the Internet data has unidentified data, wherein the unidentified data is in the Internet data Internet data that is not recognized by DPI rules;

When the Internet data has unidentified data, the analyzing module 20 is configured to analyze the unidentified data to obtain the first feature of the unidentified data. The analysis module 20 is configured to employ features included in the intrinsic feature set, load of unidentified data, and/or phase of most data streams in unidentified data. The first feature is acquired based on a data mining algorithm, such as a common feature possessed by the same sequence. The first feature is a feature included in the intrinsic feature set, a load of unidentified data, and/or one or more of the common features of the same sequence of the majority of the data streams in the unidentified data; wherein the load refers to the unidentified data inclusion Corresponding server and other encrypted data sequences.

The compiling module 30 is configured to generate a DPI rule based on the first feature compilation;

The compiling module 30 is configured to generate a DPI rule based on the acquired first feature compilation. The compiling method may adopt the compiling method of the existing DPI rules, and may also adopt other compiling methods, such as the compiling mode optimized by the existing DPI rules, which is not further limited in this embodiment.

The storage module 40 is configured to store the newly generated DPI rule to the DPI rule base.

The storage module 40 stores the new DPI rules generated by the compilation into the DPI rule base, that is, updates the DPI rule base based on the new DPI rules generated by the compilation, and the update process adopts a hot update.

In other embodiments, referring to FIG. 7, the storage module 40 includes:

The determining unit 41 is configured to determine whether the generated new DPI rule conflicts with an existing DPI rule of the DPI rule base;

The storage unit 42 is configured to store the newly generated DPI rule to the DPI rule base when there is no conflict between the newly generated DPI rule and the existing DPI rule of the DPI rule base.

The data searched based on the newly generated DPI rule is the same as the data searched by the existing DPI rule based on the DPI rule base or the data searched based on the newly generated DPI rule contains or is included in the data of the existing DPI rule search based on the DPI rule base. The judging unit 41 determines that the newly generated DPI rule conflicts with the existing DPI rule of the DPI rule base. When the newly generated DPI rule conflicts with the existing DPI rule of the DPI rule base, analyzing the newly generated DPI rule and the existing DPI rule corresponding to the conflict, and finding out the cause of the conflict, and modifying the new cause based on the reason The generated DPI rule stores the modified newly generated DPI rule to the DPI rule base when the modified newly generated DPI rule does not conflict with the existing DPI rule of the DPI rule base, wherein the newly generated DPI rule is based on the newly generated DPI rule When the searched data contains or is included in the data of the existing DPI rule search based on the DPI rule base, the priority of the newly generated DPI rule and the existing DPI rule of the DPI rule base is set, and the newly generated DPI rule is set based on the setting. Update the DPI rule base with the existing DPI rules of the DPI rule base; if the modified newly generated DPI rule still conflicts with the existing DPI rule of the DPI rule base, continue to modify or discard the DPI rule.

The device for generating DPI rules in this embodiment first acquires Internet data through the identification module 10, The existing DPI rules based on the DPI rule base identify the Internet data; then, when the Internet data has unidentified data, the analysis module 20 analyzes the unidentified data to obtain the first feature of the unidentified data; The compiling module 30 compiles a new DPI rule based on the first feature compilation; the last storage module 40 stores the newly generated DPI rule to the DPI rule base. According to the obtained Internet data, the unidentified data is obtained, the unidentified data is analyzed, the DPI rule is compiled based on the service feature, and the DPI rule base is updated based on the newly generated DPI rule, and the real-time automatic update of the DPI rule base is completed, thereby avoiding The DPI rule of the DPI rule base cannot accurately identify the problem of business data in the Internet data, and improves the recognition rate and accuracy of data recognition.

Referring to FIG. 8, FIG. 8 is a schematic diagram of a refinement function module of the first embodiment of the analysis module of FIG. 6.

An embodiment of the refinement function module of the analysis module in the first embodiment of the device for generating the above-mentioned DPI rules. In this embodiment, the analysis module 20 includes:

The first obtaining unit 21 is configured to acquire a second feature of the unidentified data when the Internet data has unidentified data;

The first acquiring unit 21 is configured to acquire the second feature of the unidentified data by using an existing protocol based on the plaintext data of the unidentified data, and the second feature includes the plaintext data feature of the unidentified data such as the domain name, and the second feature The feature is the business name corresponding to the unidentified data.

The filtering unit 22 is configured to filter the unidentified data based on the second feature to obtain service data;

The filtering unit 22 is configured to filter unidentified data, remove non-service data of unidentified data, and ensure that the remaining unidentified data is pure service data. The unidentified data corresponding to the user data may be the service when the user data and the target IP address corresponding to the user data are successfully matched with the second feature by acquiring the user data corresponding to the user data and the target IP address corresponding to the user data. Data; when the target IP address corresponding to the user data and the user data cannot be successfully matched with the second feature at the same time, the unidentified data corresponding to the user data is non-service data. The manner of filtering unidentified data in this embodiment may delete or mark non-service data in the unidentified data as non-service data.

The analyzing unit 23 is configured to analyze the service data to obtain a service feature of the service data, and use the acquired service feature as the first feature of the unidentified data.

Wherein, the analyzing unit 23 is configured to adopt the features included in the intrinsic feature set, and the unidentified data. The common features of the same sequence of most data streams in the payload and/or unidentified data, etc. are based on data mining algorithms to analyze the business characteristics of the business data. The service feature is a feature included in the intrinsic feature set, a load of unidentified data, and/or one or more of the common features of the same sequence of most data streams in the unidentified data; wherein the load refers to the unidentified data included Corresponding server and other encrypted data sequences.

Referring to FIG. 9, FIG. 9 is a schematic diagram of a refinement function module of the second embodiment of the analysis module of FIG. 6.

In this embodiment, the analysis module 20 further includes:

The second obtaining unit 24 is configured to acquire a first target IP address and/or first user data corresponding to the second feature;

The first target IP address and the first user data are respectively a target IP address and user data corresponding to the second feature in the unidentified data.

The updating unit 25 is configured to update, by using the second target IP, the first target IP address in the unidentified data when the first target IP address is inconsistent with the second target IP address corresponding to the second feature And/or, when the first user data is inconsistent with the second user data corresponding to the second feature, the first user data in the unidentified data is updated by using the second user data.

The second target IP address is a target IP address corresponding to the second feature in the Internet data, and the second user data is user data corresponding to the second feature in the Internet data.

Obtaining, by the second obtaining unit 24, a first target IP address and/or first user data corresponding to the second feature in the unidentified data, and the second target corresponding to the second feature in the first target IP address When the IP addresses are inconsistent, the updating unit 25 is configured to update the first target IP address in the unidentified data by using the second target IP, and/or, in the first user data, corresponding to the second feature. When the second user data is inconsistent, the updating unit 25 is configured to update the first user data in the unidentified data with the second user data. Complementing the unidentified data ensures the integrity of the unidentified data corresponding to the second feature, thereby improving the accuracy of the subsequently generated DPI rules.

In this embodiment, the filtering unit 22 is configured to filter the unidentified data based on the second feature to obtain service data in the unidentified data, and obtain the service feature of the service data by analyzing the service data, and obtain the service feature. The service feature as a first feature of the unidentified data, The accuracy of the first feature is improved, thereby improving the accuracy of the subsequently generated DPI rules.

Referring to FIG. 10, FIG. 10 is a schematic diagram of a refinement function module of the analysis unit of FIG.

An embodiment of the refinement flow function module of the analysis unit in the DPI rule generation device of the present invention is proposed based on the previous embodiment. In this embodiment, the analysis unit 23 includes:

The grouping subunit 231 is configured to divide the service data into multiple groups of service data groups;

The grouping subunit 231 is configured to divide the service data into at least two sets of service data groups in units of user streams, and may group the service data in groups of N user streams. User flow refers to all data in the access process when a user successfully accesses a server IP.

The data mining sub-unit 232 is configured to perform data mining on the same sequence of load packets of the service data group, to obtain service features of the plurality of service data groups, and obtain the plurality of the service features as the The first feature of the unrecognized data is described.

The data mining sub-unit 232 is configured to perform data mining on the same sequence of load packets of each service data group by using a data mining algorithm to obtain a service feature of the service data group, where the service feature is capable of covering a preset ratio. The common feature of the service data of the foregoing service data group, that is, the common feature of the service data above the preset ratio of the service data group, or the service data of the service data group preset ratio or more includes the service feature, wherein the preset ratio is The ratio of the accuracy of the subsequently generated DPI rule is set in advance, and the preset ratio can be set to 90%, 95%, etc. according to requirements.

In this embodiment, the grouping subunit 221 is configured to divide the service data into multiple groups of service data groups; the data mining subunit 222 performs data mining on the same sequence of load packets of the service data group to obtain multiple The service characteristics of the service data group; grouping and adopting data mining to obtain service characteristics of the service data, and improving the accuracy of the service feature.

The embodiment of the present invention further provides a computer readable storage medium, which stores program instructions, and when the program instructions are executed by the processor, can implement a DPI rule generation method provided by an embodiment of the present invention.

Industrial applicability

The method provided by the embodiment of the present invention acquires unidentified data according to the acquired Internet data, analyzes the service characteristics of the unidentified data, compiles and generates a new DPI rule based on the service feature, and updates the DPI rule base based on the newly generated DPI rule, and completes The real-time automatic update of the DPI rule base avoids the problem that the DPI rule of the DPI rule base cannot accurately identify the business data in the Internet data, and improves the recognition rate and accuracy of the data recognition.

Claims (11)

A method for generating a DPI deep service identification rule includes the following steps: Obtaining internet data, and identifying the internet data based on existing DPI rules of the DPI rule base; When the Internet data has unidentified data, analyzing the unidentified data to obtain a first feature of the unidentified data, wherein the unidentified data is unrecognizable by the DPI rule in the Internet data. Internet data; Generating a new DPI rule based on the first feature compilation; The new DPI rules are stored to the DPI rule base. The method for generating a DPI rule according to claim 1, wherein the step of analyzing the unidentified data to obtain the first feature of the unidentified data when the Internet data has unidentified data comprises: Acquiring the second feature of the unidentified data when the Internet data has unidentified data; Filtering the unidentified data based on the second feature to obtain service data; Analyzing the service data to obtain a service feature of the service data; The acquired service feature is taken as the first feature of the unidentified data. The method of generating a DPI rule according to claim 2, wherein, when the Internet data has unidentified data, the step of acquiring the second feature of the unidentified data and the filtering based on the second feature The method for generating the DPI rule between the steps of not identifying the data to obtain the business data further includes: Obtaining a first target IP address and/or first user data corresponding to the second feature; And updating, by the second target IP, the first target IP address in the unidentified data when the first target IP address is inconsistent with the second target IP address corresponding to the second feature; And/or, when the first user data is inconsistent with the second user data corresponding to the second feature, the second user data is used to update the first user data in the unidentified data. The method for generating a DPI rule according to claim 2, wherein the step of analyzing the service data to obtain a service feature of the service data comprises: Dividing the service data into multiple groups of service data groups; Performing data mining on the same sequence of load packets of each of the service data groups to obtain service characteristics of each of the service data groups; The plurality of the obtained service features are taken as the first feature of the unidentified data. The method for generating a DPI rule according to any one of claims 1 to 4, wherein the step of storing the new DPI rule to a DPI rule base comprises: Determining whether the generated new DPI rule conflicts with an existing DPI rule of the DPI rule base; When the generated new DPI rule does not conflict with the existing DPI rule of the DPI rule base, the new DPI rule is stored to the DPI rule base. A device for generating DPI rules, comprising: An identification module configured to obtain Internet data, and the Internet data is identified based on an existing DPI rule of the DPI rule base; An analysis module, configured to analyze the unidentified data to obtain a first feature of the unidentified data when the Internet data has unidentified data, wherein the unidentified data is the Internet data Internet data that is not recognized by DPI rules; Compiling a module, configured to generate a new DPI rule based on the first feature compilation; a storage module configured to store the new DPI rule to the DPI rule base. The apparatus for generating DPI rules according to claim 6, wherein the analysis module comprises: a first acquiring unit, configured to acquire a second feature of the unidentified data when the Internet data has unidentified data; a filtering unit, configured to filter the unidentified data based on the second feature to obtain service data; The analyzing unit is configured to analyze the service data to obtain a service feature of the service data, and use the acquired service feature as the first feature of the unidentified data. The apparatus for generating DPI rules according to claim 7, wherein said analysis module further includes include: a second acquiring unit, configured to acquire a first target IP address and/or first user data corresponding to the second feature; And an update unit, configured to: when the first target IP address is inconsistent with the second target IP address corresponding to the second feature, use the second target IP to update the first target IP address in the unidentified data; And/or, configured to update the first user data in the unidentified data by using the second user data when the first user data is inconsistent with the second user data corresponding to the second feature. The apparatus for generating DPI rules according to claim 7, wherein the analyzing unit comprises: a grouping subunit, configured to divide the service data into multiple groups of service data groups; a data mining sub-unit, configured to perform data mining on the same sequence of load packets of each of the service data groups, to obtain service features of the plurality of service data groups, and use the obtained service features as the The first feature of the data is not identified. The apparatus for generating a DPI rule according to any one of claims 6-9, wherein the storage module comprises: a determining unit, configured to determine whether the generated new DPI rule conflicts with an existing DPI rule in the DPI rule base; The storage unit is configured to store the new DPI rule to the DPI rule base when the generated new DPI rule does not conflict with the existing DPI rule of the DPI rule base. A computer readable storage medium storing program instructions that, when executed by a processor, implement the method of any one of claims 1 to 5.

Images