A kind of recognition methods of peer-to-peer network flow and identification deviceTechnical field
The present invention relates to peer-to-peer network flow identification technology field, more particularly to a kind of recognition methods of peer-to-peer network flowAnd identification device.
Background technology
At present, peer-to-peer network (Peer-to-Peer, P2P) is a variety of due to having the advantages that, such as resource occupation is low, and resource is commonEnjoy rate height and resource utilization height etc. so that the ratio that peer-to-peer network flow occupies in network traffics is increasing.But withThe increase that peer-to-peer network flow takes network bandwidth, while carrys out larger burden to Netowrk tape.Based on this, to peer-to-peer network flowIdentification, and further management is more and more important.
In the prior art, generally use deep message detects (Deep Packet Inspection, DPI) method to equityNetwork traffics are identified, but such a method None- identified encryption message.To encrypting message, it is special that generally use is based on stream statisticsProperty recognition methods to encryption message belonging to session stream carry out statistical analysis so that whether the flow for identifying the session stream is pairEtc. network traffics, but this method easily misidentifies, and the accuracy of identification is relatively low.
So the recognition methods of existing peer-to-peer network flow, can not accurately identify the flow of encryption message, applicability compared withDifference.
The content of the invention
Recognition methods and identification device the present invention provides a kind of peer-to-peer network flow, to solve existing peer-to-peer networkThe problem of recognition methods of flow, can not accurately identify the flow of encryption message, and applicability is poor.
In a first aspect, the present invention provides a kind of recognition methods of peer-to-peer network flow, which includes：Obtain meshMark the message amount of the affiliated session stream of message；If the message amount is more than preset first threshold value, the object message is obtainedThe message amount of affiliated session stream first direction and the first of the message amount of the affiliated session stream second direction of the object messageRatio, and the data volume of the affiliated session stream first direction of the object message and the affiliated session stream second party of the object messageTo data volume the second ratio；If first ratio is more than default second threshold and second ratio is more than default theThree threshold values, the source IP address collection of peer network resources request behavior known to acquisition；If the source IP address is concentrated comprising describedThe source IP address of object message, and the time of corresponding storage and the difference of current time are less than or wait together with the source IP addressIn preset time threshold, the flow of the affiliated session stream of the object message is determined as peer-to-peer network flow.
Further, which further includes：The application behavioural characteristic that message to be detected is carried and known applications behaviorThe application behavioural characteristic included in feature set is matched, according to matched result determine the message to be detected it is corresponding known toUsing behavior；If there is no with the corresponding known applications behavior of message to be detected, the message to be detected is determinedFor object message.
Further, which further includes：If the corresponding known applications behavior of the message to be detected is asymmetricalNetwork resource request behavior, is determined as asymmetrical network traffics by the flow of the affiliated session stream of message to be detected, and describedThe application identities of the corresponding known applications behavior of the message to be detected are added on the affiliated session stream of message to be detected.
Further, which further includes：If the corresponding known applications behavior of the message to be detected is peer-to-peer networkNetwork resource request behavior, the source IP address of the message to be detected and current time are corresponded to and stored to the known peer-to-peer networkThe source IP address of resource request behavior is concentrated.
Further, which further includes：If the source IP address concentrates the source IP not comprising the object messageAddress, or the source IP address concentrate the source IP address comprising the object message and the corresponding storage together with the source IP addressTime and the difference of current time be more than preset time threshold, the flow of the affiliated session stream of the object message is determined as non-Peer-to-peer network flow.
Second aspect, present invention also offers a kind of identification device of peer-to-peer network flow, which includes：MessageQuantity acquisition module, for obtaining the message amount of the affiliated session stream of object message；Ratio acquisition module, if for the reportLiterary quantity is more than preset first threshold value, obtains the message amount of the affiliated session stream first direction of the object message and the targetFirst ratio of the message amount of the affiliated session stream second direction of message, and the affiliated session stream first direction of the object messageData volume and the affiliated session stream second direction of the object message data volume the second ratio；Source IP address collection obtains mouldBlock, if being more than default 3rd threshold value more than default second threshold and second ratio for first ratio, obtainsKnow the source IP address collection of peer network resources request behavior；First flow determining module, if concentrated for the source IP addressInclude the source IP address of the object message, and the difference of the time of corresponding storage and current time together with the source IP addressLess than or equal to preset time threshold, the flow of the affiliated session stream of the object message is determined as peer-to-peer network flow.
Further, which further includes：Known applications behavior determining module, is answered for carry message to be detectedConcentrate the application behavioural characteristic included to be matched with behavioural characteristic with known applications behavioural characteristic, determined according to matched resultThe corresponding known applications behavior of the message to be detected；Object message determining module, for if there is no with it is described to be detectedThe corresponding known applications behavior of message, is determined as object message by the message to be detected.
Further, which further includes：Second flow determining module, if corresponding for the message to be detectedKnown applications behavior is non-peer network resources request behavior, the flow of the affiliated session stream of message to be detected is determined as asymmetricalNetwork traffics, and add the corresponding known applications behavior of the message to be detected on the affiliated session stream of message to be detectedApplication identities.
Further, which further includes：Memory module, if for the corresponding known applications of the message to be detectedBehavior is peer network resources request behavior, and the source IP address of the message to be detected and current time are corresponded to and stored to describedThe source IP address of known peer network resources request behavior is concentrated.
Further, which further includes：3rd flow determining module, is not wrapped if concentrated for the source IP addressSource IP address containing the object message, or the source IP address concentrate comprising the object message source IP address and with thisThe time of corresponding storage and the difference of current time are more than preset time threshold to source IP address together, by belonging to the object messageThe flow of session stream is determined as asymmetrical network traffics.
The technical solution that the embodiment of the present invention provides can include the following benefits：The present invention provides a kind of equityThe recognition methods of network traffics and identification device.In the recognition methods, the identification device of peer-to-peer network flow is received by analyzingTo the affiliated session stream of message on message amount, the message amount transmitted in the both direction of the affiliated session stream of the message transmittedRatio, the affiliated session stream of the message both direction on the source IP address of the ratio of data volume that transmits and the message withWhether the relation between the source IP address collection of known peer network resources request behavior meets corresponding setting condition, so that it is determined thatWhether the flow of the affiliated session stream of the message is peer-to-peer network flow, and for encrypting message, whole identification process will not be by messageEncrypted influence, whether the flow that can accurately identify the affiliated session stream of outgoing packet is peer-to-peer network flow, and applicability is more preferable；In addition, the recognition methods, in the message that first can also be received the identification device of peer-to-peer network flow with known applications behaviorCorresponding message filter goes out, and can subsequently reduce the misrecognition of peer-to-peer network flow, improves the accurate of peer-to-peer network flow identificationDegree.
Brief description of the drawings
In order to illustrate more clearly of technical scheme, letter will be made to attached drawing needed in the embodiment belowSingly introduce, it should be apparent that, for those of ordinary skills, without having to pay creative labor,Other attached drawings can also be obtained according to these attached drawings.
Fig. 1 is a kind of structure diagram of the identifying system of peer-to-peer network flow provided in an embodiment of the present invention；
Fig. 2 is a kind of flow diagram of the recognition methods of peer-to-peer network flow provided in an embodiment of the present invention；
Fig. 3 is a kind of structure diagram of the identification device of peer-to-peer network flow provided in an embodiment of the present invention.
Embodiment
According to background technology, the recognition methods of existing peer-to-peer network flow, there are None- identified encryption message orThe shortcomings that accuracy of identification encryption message is relatively low.In order to overcome this shortcoming, the present invention provides a kind of peer-to-peer network flowRecognition methods and identification device.
Below in conjunction with the accompanying drawings, recognition methods and the identification device of peer-to-peer network flow provided by the invention is discussed in detail.
When needing that the peer-to-peer network flow in network traffics is identified, usually between user terminal and serverThe identification device of peer-to-peer network flow is connected in communication network, so as to the net to the communication network between user terminal and serverNetwork flow is identified.Based on this, before the recognition methods of peer-to-peer network flow provided by the invention and identification device is introduced,A kind of identifying system of peer-to-peer network flow is introduced first, and it is provided in an embodiment of the present invention right to implement using the identifying systemEtc. each step of the recognition methods of network traffics.
Referring to Fig. 1, Fig. 1 is illustrated that a kind of structure of the identifying system of peer-to-peer network flow provided in an embodiment of the present inventionBlock diagram.According to Fig. 1, which includes：The identification device 3 of user terminal 1, server 2 and peer-to-peer network flow, itsIn, the identification device 3 of peer-to-peer network flow is connected in series in the communication network between user terminal 1 and server 2, and user is wholeEnd 1 sends to the message of server 2 identification device 3 that can pass through peer-to-peer network flow, and server 2 is sent to the user terminal 1Message also can pass through peer-to-peer network flow identification device 3, can be to user using the identification device 3 of peer-to-peer network flowThe network traffics of communication network between terminal 1 and server 2 are identified.
Referring to Fig. 2, Fig. 2 is illustrated that a kind of flow of the recognition methods of peer-to-peer network flow provided in an embodiment of the present inventionSchematic diagram, the recognition methods be used for peer-to-peer network flow identification device (such as the peer-to-peer network flow shown in Fig. 1 identification dress3) side is put, is included the following steps：
Step 101, the message amount for obtaining the affiliated session stream of object message.
In some optional embodiments, any one message that the identification device of peer-to-peer network flow receives can be withAs object message.The affiliated session stream of object message refers to user terminal (such as the user terminal 1 shown in Fig. 1) and serviceOnce complete session interaction process between device (such as the server 2 shown in Fig. 1), is made of, mesh a series of mutual messagesMark message is a message in a series of this mutual message, and the message amount of the affiliated session stream of object message is exactly that this is a series ofThe sum of mutual message.
In some other optional embodiment, before the message amount of the affiliated session stream of object message is obtained, that is, holdBefore row step 101, which further includes：The application behavioural characteristic that message to be detected carries is obtained, this is applied into behaviorFeature concentrates the application behavioural characteristic included to be matched with known applications behavioural characteristic, is treated according to determining matched resultThe corresponding known applications behavior of detection messages；If it is known that using behavioural characteristic concentrate be not present using behavioural characteristic with it is to be detectedMessage carry the characteristic signature file to match using behavioural characteristic, that is, match it is unsuccessful, illustrate there is no with it is described to be checkedThe corresponding known applications behavior of text is observed and predicted, then the message to be detected is determined as object message.Determined using such a modeObject message, message sieve corresponding with known applications behavior in the message that the identification device of peer-to-peer network flow can be receivedSelect, can subsequently reduce the misrecognition of peer-to-peer network flow, improve the accuracy of peer-to-peer network flow identification.
Wherein, message to be detected refers to the message that the identification device of peer-to-peer network flow receives, peer-to-peer network flowAny one message for receiving of identification device can be used as message to be detected.Known applications behavior refers to should known in someOperation behavior, such as certain known shopping website is accessed, by certain known download software download data, and log in certain public affairsKnow that chat software etc. belongs to known applications behavior.Known applications behavioural characteristic collection refers to the characteristic signature text of known applications behaviorThe set of part, wherein, include using behavioural characteristic in each characteristic signature file in the set and apply behavior special with thisLevy the title of corresponding known applications behavior.The mark using behavior is referred to using behavioural characteristic, is each application behavior areaNot with the mark of other application behavior.For example, accessing certain known shopping website, this can be with using the application behavioural characteristic of behaviorFor the domain name of the known shopping website.
Further, it is possible to which known applications behavioural characteristic collection is pre-stored within the identification device of peer-to-peer network flow, makeUsed time is directly transferred from the identification device of peer-to-peer network flow.Known applications behavioural characteristic collection can certainly be storedIn other storage devices, it will not enumerate herein.
If step 102, the message amount are more than preset first threshold value, the affiliated session stream of the object message is obtainedFirst ratio of the message amount in one direction and the message amount of the affiliated session stream second direction of the object message, and it is describedThe data volume of the affiliated session stream first direction of object message and the data volume of the affiliated session stream second direction of the object messageSecond ratio.
Wherein, the affiliated session stream first direction of object message can be by the direction of user terminal to server, can alsoIt is by the direction of server to user terminal.Preset first threshold value can be set according to actual needs.
When the affiliated session stream first direction of object message is the direction by user terminal to server, belonging to object messageSession stream second direction is by the direction of server to user terminal.The message amount of the affiliated session stream first direction of object messageRefer to that user terminal is sent to the sum of the message of server, the affiliated session stream of object message in the affiliated session stream of the object messageThe message amount of second direction refers to the sum of the message that server is sent to the user terminal in the affiliated session stream of the object message.The data volume of the affiliated session stream first direction of object message refers to that user terminal is sent to clothes in the affiliated session stream of the object messageThe data volume of business device, the data volume of the affiliated session stream second direction of object message refer to service in the affiliated session stream of the object messageThe data volume that device is sent to the user terminal.
When the affiliated session stream first direction of object message is the direction by server to user terminal, belonging to object messageSession stream second direction is by the direction of user terminal to server.The message amount of the affiliated session stream first direction of object messageRefer to the sum of the message that server is sent to the user terminal in the affiliated session stream of the object message, the affiliated session stream of object messageThe message amount of second direction refers to that user terminal is sent to the sum of the message of server in the affiliated session stream of the object message.The data volume of the affiliated session stream first direction of object message refers to that server is sent to user in the affiliated session stream of the object messageThe data volume of terminal, the data volume of the affiliated session stream second direction of object message refer to user in the affiliated session stream of the object messageTerminal is sent to the data volume of server.
If step 103, first ratio are more than default second threshold and second ratio is more than default 3rd thresholdValue, the source IP address collection of peer network resources request behavior known to acquisition.
It is known that peer network resources request behavior refers to by some known download software download datas.It is knownThe source IP address collection of peer network resources request behavior is the set of source IP address storage file, each source IP address in the setThe time of storage is corresponded in storage file comprising a source IP address and together with the source IP address, wherein, the source IP addressFor by the source IP address of certain known user terminal for downloading software download data, storage is corresponded to together with the source IP addressTime refers to storing the source IP address into the storage time into the source IP address storage file.Default second threshold and default theThree threshold values can be set according to actual needs.
If step 104, the source IP address concentrate the source IP address for including the object message, and with the source IPThe time of corresponding storage and the difference of current time are less than or equal to preset time threshold together for location, by belonging to the object messageThe flow of session stream is determined as peer-to-peer network flow.
When it is implemented, parsing the source IP address of object message first, peer network resources request is gone known to inquiry afterwardsFor source IP address concentrate whether there is the source IP address storage file comprising the source IP address, if it is known that peer network resourcesThe source IP address of request behavior, which is concentrated, has the source IP address storage file comprising the source IP address, and peer-to-peer network known to explanation providesThe source IP address of source request behavior, which is concentrated, includes the source IP address, then determines the time included in the source IP address storage file againWhether it is less than or equal to preset time threshold with the difference of current time, if the time included in the source IP address storage fileIt is less than or equal to preset time threshold with the difference of current time, then the flow of the affiliated session stream of object message is determined as equityNetwork traffics.Wherein, preset time threshold can be set according to actual needs.
Further, after the flow of the affiliated session stream of object message is determined as peer-to-peer network flow, the recognition methodsFurther include：P2P flow identifier is added on the affiliated session stream of object message.
In some other optional embodiment, which further includes：If it is known that peer network resources request rowFor source IP address concentrate source IP address storage file there is no the source IP address comprising the object message, it is right known to explanationSource IP address etc. network resource request behavior concentrates the source IP address not comprising the object message, or known peer-to-peer networkThe source IP address of resource request behavior concentrates the source IP address storage file that there is the source IP address comprising the object message, butThe time included in the source IP address storage file and the difference of current time are more than preset time threshold, peer-to-peer network known to explanationThe source IP address of network resource request behavior is concentrated the source IP address comprising the object message and is corresponded to together with the source IP addressThe time of storage and the difference of current time are more than preset time threshold, then the flow of the affiliated session stream of the object message is trueIt is set to asymmetrical network traffics, and non-P2P flow identifier is added on the affiliated session stream of the object message.
In some other optional embodiment, which further includes：If it is known that being concentrated using behavioural characteristic, depositApplying behavioural characteristic and the characteristic signature file to match using behavioural characteristic of message to be detected carrying, and this feature labelThe title of the known applications behavior included in name file is the title of some asymmetrical network resource request behavior, is treated described in explanationThe corresponding known applications behavior of detection messages is non-peer network resources request behavior, then by the affiliated session stream of message to be detectedFlow is determined as asymmetrical network traffics, and adds the message pair to be detected on the affiliated session stream of message to be detectedThe application identities for the known applications behavior answered.The application identities can be the corresponding Apply Names of known applications behavior, such as visitAsk certain known shopping website this using the corresponding Apply Names of behavior be the known shopping website title.
In some other optional embodiment, which further includes：If it is known that being concentrated using behavioural characteristic, depositApplying behavioural characteristic and the characteristic signature file to match using behavioural characteristic of message to be detected carrying, and this feature labelThe title of known applications behavior included in name file is the title of some known peer network resources request behavior, described in explanationThe corresponding known applications behavior of message to be detected is peer network resources request behavior, then parses the source IP of the message to be detectedAddress, the source IP address of the message to be detected and current time are corresponded to and stored to the known peer network resources request rowFor source IP address concentrate, and the flow of the affiliated session stream of message to be detected is determined as peer-to-peer network flow, is treated describedP2P flow identifier is added on the affiliated session stream of detection messages.
In the recognition methods of peer-to-peer network flow provided in an embodiment of the present invention, the identification device of peer-to-peer network flow passes throughAnalyze the message amount transmitted on the affiliated session stream of message that receives, transmit in the both direction of the affiliated session stream of the messageThe ratio of data volume transmitted in the both direction of the affiliated session stream of the ratio of message amount, the message and the source of the messageWhether the relation between IP address and the source IP address collection of known peer network resources request behavior meets corresponding setting condition,So that it is determined that whether the flow of the affiliated session stream of the message is peer-to-peer network flow, for encrypting message, whole identification process is notIt can be influenced by message encryption, whether the flow that can accurately identify the affiliated session stream of outgoing packet is peer-to-peer network flow, is fittedIt is more preferable with property；In addition, the recognition methods, in the message that first can also be received the identification device of peer-to-peer network flow with it is knownGo out using the corresponding message filter of behavior, can subsequently reduce the misrecognition of peer-to-peer network flow, improve peer-to-peer network flow and knowOther accuracy.
Corresponding with the recognition methods of peer-to-peer network flow provided by the invention, present invention also offers a kind of peer-to-peer networkThe identification device of flow.
Referring to Fig. 3, Fig. 3 is illustrated that a kind of structure of the identification device of peer-to-peer network flow provided in an embodiment of the present inventionBlock diagram.According to Fig. 3, which includes：Message amount acquisition module 301, for obtaining the affiliated session of object messageThe message amount of stream；Ratio acquisition module 302, if being more than preset first threshold value for the message amount, obtains the meshMark the message amount of the affiliated session stream first direction of message and the message amount of the affiliated session stream second direction of the object messageThe first ratio, and the data volume of the affiliated session stream first direction of the object message and the affiliated session stream of the object messageSecond ratio of the data volume of second direction；Source IP address collection acquisition module 303, if be more than for first ratio defaultSecond threshold and second ratio are more than default 3rd threshold value, the source IP address of peer network resources request behavior known to acquisitionCollection；First flow determining module 304, if the source IP address for including the object message is concentrated for the source IP address, andAnd the time of corresponding storage and the difference of current time are less than or equal to preset time threshold together with the source IP address, by described inThe flow of the affiliated session stream of object message is determined as peer-to-peer network flow.
Further, which further includes：Known applications behavior determining module 305, for message to be detected to be carriedConcentrate the application behavioural characteristic included to be matched using behavioural characteristic and known applications behavioural characteristic, according to matched resultDetermine the corresponding known applications behavior of the message to be detected；Object message determining module 306, for if there is no with it is describedThe corresponding known applications behavior of message to be detected, is determined as object message by the message to be detected.
Further, which further includes：Second flow determining module 307, if for the message pair to be detectedThe known applications behavior answered is non-peer network resources request behavior, the flow of the affiliated session stream of message to be detected is determined as non-Peer-to-peer network flow, and add the corresponding known applications of the message to be detected on the affiliated session stream of message to be detectedThe application identities of behavior.
Further, which further includes：Memory module 308, if corresponding known for the message to be detectedPeer network resources request behavior using behavior, the source IP address of the message to be detected and current time are corresponded to store toThe source IP address of the known peer network resources request behavior is concentrated.
Further, which further includes：3rd flow determining module 309, if concentrated for the source IP addressSource IP address not comprising the object message, or the source IP address concentrate comprising the object message source IP address andIt is more than preset time threshold with the time of corresponding storage together with the source IP address and the difference of current time, by the object messageThe flow of affiliated session stream is determined as asymmetrical network traffics.
Above-mentioned peer-to-peer network flow can be implemented using the identification device of peer-to-peer network flow provided in an embodiment of the present inventionRecognition methods in each step, and obtain identical beneficial effect.Using the identification device of the peer-to-peer network flow to encryptionMessage carries out flow identification, and whole identification process will not be influenced by message encryption, can accurately identify meeting belonging to outgoing packetWhether the flow of words stream is peer-to-peer network flow, and applicability is more preferable；In addition, the identification device, the report that will first can also be receivedMessage filter corresponding with known applications behavior goes out in text, can subsequently reduce the misrecognition of peer-to-peer network flow, improves equityThe accuracy of network traffics identification.
In the specific implementation, the present invention also provides a kind of computer-readable storage medium, wherein, which can storeThere is program, which may include the part in each embodiment of the recognition methods of peer-to-peer network flow provided by the invention when performingOr Overall Steps.The storage medium can be magnetic disc, CD, read-only memory (English：Read-only memory,Referred to as：ROM) or random access memory is (English：Random access memory, referred to as：RAM) etc..
It is required that those skilled in the art can be understood that the technology in the embodiment of the present invention can add by softwareThe mode of general hardware platform realize.Based on such understanding, the technical solution in the embodiment of the present invention substantially orSay that the part to contribute to the prior art can be embodied in the form of software product, which can depositStorage is in storage medium, such as ROM/RAM, magnetic disc, CD, including some instructions are used so that computer equipment (can be withBe personal computer, server, either network equipment etc.) perform some part institutes of each embodiment of the present invention or embodimentThe method stated.
In this specification between each embodiment identical similar part mutually referring to.Especially for peer-to-peer networkFor the identification device embodiment of flow, since it is substantially similar to embodiment of the method, so description is fairly simple, correlationPlace is referring to the explanation in embodiment of the method.
Invention described above embodiment is not intended to limit the scope of the present invention..