CN115603969A - A user network traffic statistics method, acquisition method and statistics system - Google Patents
A user network traffic statistics method, acquisition method and statistics systemDownload PDFInfo
- Publication number
- CN115603969A CN115603969ACN202211204052.1ACN202211204052ACN115603969ACN 115603969 ACN115603969 ACN 115603969ACN 202211204052 ACN202211204052 ACN 202211204052ACN 115603969 ACN115603969 ACN 115603969A
- Authority
- CN
- China
- Prior art keywords
- request message
- access request
- network access
- session table
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Translated fromChinese
Description
Translated fromChinese技术领域technical field
本申请涉及网络安全技术领域，具体而言，涉及一种用户网络流量统计方法、获取方法及统计系统。The present application relates to the technical field of network security, in particular, to a user network traffic statistics method, acquisition method and statistics system.
背景技术Background technique
如果在网络中存在大量的恶意流量，将会消耗大量的网络带宽资源，严重影响正常网络业务的传输。如何更好的进行网络行为监控，实现有效的网络资源管理，是网关设备的重要功能。对网络流量进行高效的统计能够帮助管理员更全面的掌控网络流量情况，根据可能的异常状况快速做出响应，从而提高网络资源利用率。If there is a large amount of malicious traffic in the network, it will consume a large amount of network bandwidth resources and seriously affect the transmission of normal network services. How to better monitor network behavior and realize effective network resource management is an important function of gateway equipment. Efficient statistics on network traffic can help administrators more comprehensively control network traffic conditions and quickly respond to possible abnormal conditions, thereby improving network resource utilization.
当网关设备的网络报文通过FPGA实现转发处理时，由于其流量信息不能通过网关运行的操作系统直接获取，因此，不能实现网络流量的统计。When the network packets of the gateway device are forwarded and processed by the FPGA, since the flow information cannot be obtained directly through the operating system running on the gateway, the statistics of the network flow cannot be realized.
发明内容Contents of the invention
本申请实施例的目的在于提供一种用户网络流量统计方法、获取方法及统计系统，基于Session表对网络报文进行流量统计并与对应的用户信息进行关联，实现用户访问流量的精细化统计，解决了现有方法无法实现网络流量统计的问题。The purpose of the embodiment of the present application is to provide a user network traffic statistics method, acquisition method and statistics system, based on the Session table to perform traffic statistics on network packets and associate them with corresponding user information, so as to realize refined statistics of user access traffic, The problem that the existing method cannot realize network traffic statistics is solved.
本申请实施例提供了一种用户网络流量统计方法，应用于FPGA模块，所述方法包括：The embodiment of the present application provides a user network traffic statistics method, which is applied to the FPGA module, and the method includes:
接收用户端发送的网络访问请求报文；Receive the network access request message sent by the client;
解析所述网络访问请求报文，并将解析结果与已有Session表进行匹配；Analyzing the network access request message, and matching the parsing result with the existing Session table;
若不匹配，则将所述网络访问请求报文发送至运算处理器，以利用所述运算处理器建立所述网络访问请求报文的Session表；If it does not match, the network access request message is sent to the operation processor, so as to use the operation processor to establish the Session table of the network access request message;
接收所述运算处理器发送的Session表和对应的网络访问请求报文，并对所述网络访问请求报文进行流量统计。Receive the Session table and the corresponding network access request message sent by the operation processor, and perform traffic statistics on the network access request message.
在上述实现过程中，在利用FPGA实现的网关设备中，基于Session表对网络访问请求报文进行快速匹配和流量统计，实现用户访问流量的精细化统计。In the above implementation process, in the gateway device implemented by FPGA, the network access request message is quickly matched and traffic statistics are performed based on the Session table, so as to realize the refined statistics of user access traffic.
进一步地，所述方法还包括：Further, the method also includes:
若解析结果与已有Session表相匹配，则对所述网络访问请求报文进行流量统计并更新对应数据流的流量信息。If the parsing result matches the existing Session table, perform traffic statistics on the network access request message and update the traffic information of the corresponding data stream.
在上述实现过程中，利用Session表对网络访问请求报文进行快速匹配，将数据流session表项与用户在线数据表相关联，实现FPGA统计的针对数据流统计的流量，可以基于用户进行快速汇总。In the above implementation process, the Session table is used to quickly match the network access request message, and the data flow session entry is associated with the user's online data table, so that the FPGA statistics for the data flow statistics traffic can be quickly summarized based on the user .
进一步地，所述解析所述网络访问请求报文，并将解析结果与已有Session表进行匹配，包括：Further, the parsing of the network access request message and matching the parsing result with the existing Session table include:
获取所述网络访问请求报文的解析结果，所述解析结果包括源IP、源端口、目的IP、目的端口以及通信协议；Acquiring an analysis result of the network access request message, the analysis result including source IP, source port, destination IP, destination port and communication protocol;
基于所述解析结果对所述Session表进行查找，以确定所述解析结果是否存在与所述Session表中。Searching the Session table based on the parsing result to determine whether the parsing result exists in the Session table.
在上述实现过程中，建立基于源IP、源端口、目的IP、目的端口以及通信协议的Session表，用于实现数据流的快速匹配。In the above implementation process, a Session table based on source IP, source port, destination IP, destination port and communication protocol is established to realize fast matching of data streams.
本申请实施例还提供一种用户网络流量信息获取方法，应用于运算处理器，所述方法包括：The embodiment of the present application also provides a method for acquiring user network traffic information, which is applied to an arithmetic processor, and the method includes:
接收FPGA模块发送的网络访问请求报文；Receive the network access request message sent by the FPGA module;
基于所述网络访问请求报文建立Session表；Establishing a Session table based on the network access request message;
将所述Session表同步至所述FPGA模块，以使所述FPGA模块基于所述Session表统计流量信息；Synchronizing the Session table to the FPGA module, so that the FPGA module counts traffic information based on the Session table;
定时获取所述流量信息，并基于所述流量信息对在线用户列表进行更新。The traffic information is acquired regularly, and the online user list is updated based on the traffic information.
在上述实现过程中，将网络访问请求报文与用户信息相关联，实现用户访问流量的精细化统计。In the above implementation process, the network access request message is associated with user information to realize refined statistics of user access traffic.
进一步地，所述基于所述网络访问请求报文建立Session表，包括：Further, the establishment of the Session table based on the network access request message includes:
获取所述网络访问请求报文的源IP、源端口、目的IP、目的端口以及通信协议；Obtain the source IP, source port, destination IP, destination port and communication protocol of the network access request message;
基于所述源IP、源端口、目的IP、目的端口以及通信协议建立Session表。A Session table is established based on the source IP, source port, destination IP, destination port and communication protocol.
在上述实现过程中，创建基于源IP、源端口、目的IP、目的端口以及网络报文通信协议的数据流Session表项，用于实现数据流的快速匹配。In the above implementation process, a data flow session entry based on the source IP, source port, destination IP, destination port, and network message communication protocol is created for fast matching of data flows.
进一步地，所述方法还包括：Further, the method also includes:
基于所述源IP获取所述源IP对应的在线用户的内存地址；Obtaining the memory address of the online user corresponding to the source IP based on the source IP;
将所述内存地址保存至所述Session表中。Save the memory address into the Session table.
在上述实现过程中，可以通过Session表对应存储空间记录的用户在线列表内存地址信息，快速访问用户在线列表对应的存储空间。In the above implementation process, the storage space corresponding to the user online list can be quickly accessed through the memory address information of the user online list recorded in the corresponding storage space of the Session table.
本申请实施例还提供一种用户网络流量统计系统，所述系统包括：The embodiment of the present application also provides a user network traffic statistics system, the system includes:
FPGA模块，用于接收用户发送的网络访问请求报文，并基于所述网络访问请求报文对应的Session表对所述网络访问请求报文进行流量统计，若所述网络访问请求报文没有Session表，则将所述网络访问请求报文发送至运算处理器；The FPGA module is configured to receive a network access request message sent by a user, and perform traffic statistics on the network access request message based on the Session table corresponding to the network access request message, if the network access request message does not have a Session table, then send the network access request message to the computing processor;
所述运算处理器，用于接收所述网络访问请求报文，基于所述网络访问请求报文建立Session表，并将所述Session表同步至所述FPGA模块。The arithmetic processor is configured to receive the network access request message, establish a Session table based on the network access request message, and synchronize the Session table to the FPGA module.
在上述实现过程中，在利用FPGA实现的网关设备中，基于Session表对网络访问请求报文进行快速匹配和流量统计，实现用户访问流量的精细化统计。In the above implementation process, in the gateway device implemented by FPGA, the network access request message is quickly matched and traffic statistics are performed based on the Session table, so as to realize the refined statistics of user access traffic.
所述运算处理器还用于：The arithmetic processor is also used to:
定时获取所述流量信息，并基于所述流量信息对在线用户列表进行更新。The traffic information is acquired regularly, and the online user list is updated based on the traffic information.
在上述实现过程中，获取FPGA统计的网络流量，并将流量信息汇总至对应的在线用户信息中。In the above implementation process, the network traffic counted by the FPGA is obtained, and the traffic information is summarized into corresponding online user information.
本申请实施例还提供一种电子设备，所述电子设备包括存储器以及处理器，所述存储器用于存储计算机程序，所述处理器运行计算机程序以使所述电子设备执行上述中任一项所述的用户网络流量统计方法。An embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform any of the above-mentioned The user network traffic statistics method described above.
本申请实施例还提供一种可读存储介质，所述可读存储介质中存储有计算机程序指令，所述计算机程序指令被一处理器读取并运行时，执行上述中任一项所述的用户网络流量统计方法。The embodiment of the present application also provides a readable storage medium, wherein computer program instructions are stored in the readable storage medium, and when the computer program instructions are read and executed by a processor, the method described in any one of the above is executed. User network traffic statistics method.
附图说明Description of drawings
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例中所需要使用的附图作简单地介绍，应当理解，以下附图仅示出了本申请的某些实施例，因此不应被看作是对范围的限定，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他相关的附图。In order to more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings that need to be used in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, so It should not be regarded as a limitation on the scope, and those skilled in the art can also obtain other related drawings according to these drawings without creative work.
图1为本申请实施例提供的一种用户网络流量统计方法的流程图；FIG. 1 is a flow chart of a user network traffic statistics method provided in an embodiment of the present application;
图2为本申请实施例提供的用户网络流量统计方法的整体流程图；FIG. 2 is an overall flow chart of the user network traffic statistics method provided by the embodiment of the present application;
图3为本申请实施例提供的基于Session表的查找过程流程图；Fig. 3 is the flow chart of the search process based on the Session table provided by the embodiment of the present application;
图4为本申请实施例提供的用户网络流量信息获取方法的流程图；FIG. 4 is a flow chart of a method for acquiring user network traffic information provided by an embodiment of the present application;
图5为本申请实施例提供的Session表的建立流程图；Fig. 5 is the establishment flowchart of the Session table that the embodiment of the present application provides;
图6为本申请实施例提供的内存地址的存储流程图；FIG. 6 is a flow chart of storing memory addresses provided by the embodiment of the present application;
图7为本申请实施例提供的一种用户网络流量统计系统。FIG. 7 is a user network traffic statistics system provided by an embodiment of the present application.
具体实施方式detailed description
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释。同时，在本申请的描述中，术语“第一”、“第二”等仅用于区分描述，而不能理解为指示或暗示相对重要性。It should be noted that like numerals and letters denote similar items in the following figures, therefore, once an item is defined in one figure, it does not require further definition and explanation in subsequent figures. Meanwhile, in the description of the present application, the terms "first", "second" and the like are only used to distinguish descriptions, and cannot be understood as indicating or implying relative importance.
实施例1Example 1
请参看图1，图1为本申请实施例提供的一种用户网络流量统计方法的流程图。基于FPGA模块100实现网络报文转发处理的网关设备的用户网络流量统计，使网关设备具备更全面的网络状态展示。该方法应用于FPGA模块100，具体可以包括以下步骤：Please refer to FIG. 1 . FIG. 1 is a flow chart of a user network traffic statistics method provided by an embodiment of the present application. Based on the FPGA module 100, the user network traffic statistics of the gateway device for network message forwarding processing is realized, so that the gateway device has a more comprehensive display of network status. The method is applied to the FPGA module 100, and may specifically include the following steps:
步骤S100：接收用户端发送的网络访问请求报文；Step S100: receiving a network access request message sent by the client;
如图2所示，为用户网络流量统计方法的整体流程图，整个实施过程的具体步骤为：As shown in Figure 2, it is an overall flowchart of the user network traffic statistics method, and the specific steps of the entire implementation process are:
首先，用户通过用户终端进行登录，CPU运算处理系统(运算处理器200)记录用户登录IP以及用户名等信息，建立用户会话，并将用户信息记录至用户在线列表中，用户终端发起网络访问请求，从而FPGA模块100接收到网络访问请求报文；First, the user logs in through the user terminal, and the CPU operation processing system (operation processor 200) records information such as the user login IP and user name, establishes a user session, and records the user information into the user online list, and the user terminal initiates a network access request , so that the FPGA module 100 receives the network access request message;
步骤S200：解析所述网络访问请求报文，并将解析结果与已有Session表进行匹配；Step S200: parsing the network access request message, and matching the parsing result with the existing Session table;
如图3所示，为基于Session表的查找过程流程图，步骤S200具体可以包括：As shown in Figure 3, it is a flow chart of the search process based on the Session table, and step S200 may specifically include:
步骤S201：获取所述网络访问请求报文的解析结果，所述解析结果包括源IP、源端口、目的IP、目的端口以及通信协议；Step S201: Obtain the analysis result of the network access request message, the analysis result includes source IP, source port, destination IP, destination port and communication protocol;
步骤S202：基于所述解析结果对所述Session表进行查找，以确定所述解析结果是否存在与所述Session表中。Step S202: Search the Session table based on the parsing result to determine whether the parsing result exists in the Session table.
用户终端发起网络访问，FPGA模块100接收对应的网络访问请求报文，根据源IP、源端口、目的IP、目的端口以及网络报文通信协议，在Session表中对该网络访问请求报文进行查找，如果没有该网络访问请求报文对应的Session表，说明没有连接，即用户发起的网络访问为首包，则将该网络访问请求报文发送至CPU运算处理系统，以在CPU运算处理系统建立数据Session连接。The user terminal initiates network access, and the FPGA module 100 receives the corresponding network access request message, and searches the network access request message in the Session table according to the source IP, source port, destination IP, destination port, and network message communication protocol , if there is no Session table corresponding to the network access request message, it means that there is no connection, that is, the network access initiated by the user is the first packet, and the network access request message is sent to the CPU operation processing system to establish data in the CPU operation processing system Session connection.
在FPGA模块100中，创建基于源IP、源端口、目的IP、目的端口以及网络报文通信协议的数据流Session表项，用于实现网络访问请求报文的快速匹配，以便对该网络访问请求报文进行流量的精确统计。In the FPGA module 100, create a data flow session table item based on source IP, source port, destination IP, destination port and network message communication protocol, for realizing the fast matching of network access request message, so that the network access request Accurate statistics on the traffic of packets.
其中，Session是指会话控制，是保存在服务器上的一种机制，当客户端访问服务器的时候，服务器会把信息以某种形式记录在服务器上，恰恰和Cookie相反。Among them, Session refers to session control, which is a mechanism stored on the server. When the client accesses the server, the server will record the information on the server in some form, which is exactly the opposite of Cookie.
步骤S300：若不匹配，则将所述网络访问请求报文发送至运算处理器200，以利用所述运算处理器200建立所述网络访问请求报文的Session表；Step S300: If they do not match, send the network access request message to the operation processor 200, so as to use the operation processor 200 to establish a Session table of the network access request message;
步骤S400：接收所述运算处理器200发送的Session表和对应的网络访问请求报文，并对所述网络访问请求报文进行流量统计。Step S400: Receive the Session table and the corresponding network access request message sent by the arithmetic processor 200, and perform traffic statistics on the network access request message.
该方法还包括：The method also includes:
若解析结果与已有Session表相匹配，则对所述网络访问请求报文进行流量统计并更新对应数据流的流量信息。If the parsing result matches the existing Session table, perform traffic statistics on the network access request message and update the traffic information of the corresponding data stream.
如果用户发起的网络访问非首包，网络访问请求报文在被FPGA模块100接收之后，根据源IP、源端口、目的IP、目的端口以及网络报文通信协议，在网络连接Session表中对该连接进行查找，如果匹配到该连接对应的Session表，FPGA模块100对网络访问请求报文进行流量统计后，更新该条数据流的流量信息，并直接将该网络访问请求报文进行转发，不需要上送至CPU运算处理系统。If the network access initiated by the user is not the first packet, after the network access request message is received by the FPGA module 100, according to the source IP, source port, destination IP, destination port and network message communication protocol, the network access request message will be listed in the network connection Session table. The connection is searched, if the Session table corresponding to the connection is matched, the FPGA module 100 will update the flow information of the data stream after performing traffic statistics on the network access request message, and directly forward the network access request message without It needs to be sent to the CPU computing processing system.
本申请实施例还提供一种用户网络流量信息获取方法，应用于运算处理器200，如图4所示，为用户网络流量信息获取方法的流程图，所述方法包括以下步骤：The embodiment of the present application also provides a method for obtaining user network traffic information, which is applied to the computing processor 200. As shown in FIG. 4 , it is a flow chart of the method for obtaining user network traffic information. The method includes the following steps:
步骤S500：接收FPGA模块100发送的网络访问请求报文；Step S500: receiving the network access request message sent by the FPGA module 100;
步骤S600：基于所述网络访问请求报文建立Session表；Step S600: Establishing a Session table based on the network access request message;
如图5所示，为Session表的建立流程图，步骤S600具体可以包括：As shown in Figure 5, it is a flow chart for establishing the Session table, and step S600 may specifically include:
步骤S601：获取所述网络访问请求报文的源IP、源端口、目的IP、目的端口以及通信协议；Step S601: Obtain the source IP, source port, destination IP, destination port and communication protocol of the network access request message;
步骤S602：基于所述源IP、源端口、目的IP、目的端口以及通信协议建立Session表。Step S602: Establish a Session table based on the source IP, source port, destination IP, destination port and communication protocol.
CPU运算处理系统在接收到网络访问请求报文后，根据报文的源IP、源端口、目的IP、目的端口以及网络报文通信协议建立Session表，Session表用于实现数据流的快速匹配，并且建立Session表与用户的关联关系。After the CPU processing system receives the network access request message, it establishes a Session table according to the source IP, source port, destination IP, destination port, and network message communication protocol of the message. The Session table is used to realize fast matching of data streams. And establish the association relationship between the Session table and the user.
步骤S700：将所述Session表同步至所述FPGA模块100，以使所述FPGA模块100基于所述Session表统计流量信息；Step S700: Synchronize the Session table to the FPGA module 100, so that the FPGA module 100 collects traffic information based on the Session table;
CPU运算处理系统将网络访问请求报文下发至FPGA模块100，FPGA模块100对网络访问请求报文进行流量统计后，更新该条数据流的流量信息。其中，流量统计主要是统计报文的长度，流量信息即一定时间段内的流量大小，以便监测是否为恶意流量。The CPU operation processing system sends the network access request message to the FPGA module 100, and the FPGA module 100 updates the flow information of the data flow after performing traffic statistics on the network access request message. Among them, traffic statistics mainly counts the length of packets, and the traffic information refers to the size of traffic in a certain period of time, so as to monitor whether it is malicious traffic.
步骤S800：定时获取所述流量信息，并基于所述流量信息对在线用户列表进行更新。Step S800: Obtain the traffic information regularly, and update the online user list based on the traffic information.
CPU运算处理系统定时获取FPGA模块100统计的数据流信息，根据数据流中记录的在线用户内存地址，快速更新在线用户列表中该用户对应的流量信息。The CPU operation processing system regularly acquires the data stream information counted by the FPGA module 100, and quickly updates the traffic information corresponding to the user in the online user list according to the memory address of the online user recorded in the data stream.
将数据流Session表项与在线用户列表相关联，实现FPGA模块100统计的针对数据流统计的流量，可以基于用户进行快速汇总。By associating the data flow Session entry with the online user list, the traffic statistics of the FPGA module 100 for the data flow can be quickly summarized based on users.
将网络访问请求报文与用户信息相关联，实现用户访问流量的精细化统计。Associate network access request packets with user information to achieve refined statistics on user access traffic.
如图6所示，为内存地址的存储流程图，该方法还包括：As shown in Figure 6, it is a flow chart of storing the memory address, and the method also includes:
步骤S901：基于所述源IP获取所述源IP对应的在线用户的内存地址；Step S901: Obtain the memory address of the online user corresponding to the source IP based on the source IP;
步骤S902：将所述内存地址保存至所述Session表中。Step S902: saving the memory address into the Session table.
可以通过Session表对应存储空间记录的用户在线列表内存地址信息，快速访问用户在线列表对应的存储空间。You can quickly access the storage space corresponding to the user online list through the memory address information of the user online list recorded in the corresponding storage space of the Session table.
在步骤S600之后，CPU运算处理系统在建立的Session表中，根据源IP，查询获取该源IP对应的在线用户的内存地址，并将该内存地址记录至Session表中。After step S600, the CPU operation processing system queries and obtains the memory address of the online user corresponding to the source IP in the established Session table according to the source IP, and records the memory address into the Session table.
在利用FPGA模块100实现的网关设备中，将利用FPGA模块100处理的网络报文进行流量统计并与用户信息相关联，实现用户访问流量的精细化统计；并且在对用户的数据流量进行记录时，用户流量统计以及查询的算法复杂度为O(1)，因此可快速实现用户的流量统计。In the gateway device implemented by the FPGA module 100, the network packets processed by the FPGA module 100 are used for traffic statistics and associated with user information, so as to realize the refined statistics of user access traffic; and when recording the user's data traffic , the algorithm complexity of user traffic statistics and query is O(1), so user traffic statistics can be quickly realized.
在利用FPGA模块100实现的网关设备中，利用FPGA模块100处理网络访问请求报文并进行流量统计，再与用户信息相关联，实现用户访问流量的精细化统计。In the gateway device implemented by the FPGA module 100, the FPGA module 100 is used to process the network access request message and perform traffic statistics, and then correlate with user information to realize refined statistics of user access traffic.
用户发起的网络访问请求报文首先被FPGA模块100接收，并根据源IP、源端口、目的IP、目的端口以及网络报文通信协议，在网络连接Session表中对该连接进行查找，如果没有该连接对应的Session表，则将网络报文发送至运算处理器200；运算处理器200接收到报文时，根据报文的源IP、源端口、目的IP、目的端口以及网络报文通信协议建立Session表；在建立的session表中，根据源IP，查询获取该源IP对应的在线用户的内存地址，并将该内存地址记录至Session表；并将建立的Session表同步至FPGA模块，以使FPGA模块100对该网络访问请求报文进行流量统计。The network access request message initiated by the user is first received by the FPGA module 100, and according to the source IP, source port, destination IP, destination port and network message communication protocol, the connection is searched in the network connection Session table, if there is no such Connect the corresponding Session table, then send the network message to the computing processor 200; when the computing processor 200 receives the message, it will establish Session table; in the established session table, according to the source IP, query and obtain the memory address of the online user corresponding to the source IP, and record the memory address to the Session table; and synchronize the established Session table to the FPGA module, so that The FPGA module 100 performs traffic statistics on the network access request message.
若用户发起的网络访问非首包，则在FPGA模块100直接进行流量统计并更新对应的流量信息后，转发出去，无需发送至运算处理器200。If the network access packet initiated by the user is not the first packet, the FPGA module 100 directly performs traffic statistics and updates the corresponding traffic information, and then forwards it without sending it to the computing processor 200 .
实施例2Example 2
本申请实施例提供一种用户网络流量统计系统，如图7所示，为用户网络流量统计系统的结构框图，所述系统包括：An embodiment of the present application provides a user network traffic statistics system, as shown in FIG. 7 , which is a structural block diagram of the user network traffic statistics system. The system includes:
FPGA模块100，用于接收用户发送的网络访问请求报文，并基于所述网络访问请求报文对应的Session表对所述网络访问请求报文进行流量统计，若所述网络访问请求报文没有Session表，则将所述网络访问请求报文发送至运算处理器200；The FPGA module 100 is configured to receive a network access request message sent by a user, and perform traffic statistics on the network access request message based on the Session table corresponding to the network access request message, if the network access request message does not have Session table, then the network access request message is sent to the computing processor 200;
所述运算处理器200，用于接收所述网络访问请求报文，基于所述网络访问请求报文建立Session表，并将所述Session表同步至所述FPGA模块100。The arithmetic processor 200 is configured to receive the network access request message, establish a Session table based on the network access request message, and synchronize the Session table to the FPGA module 100 .
运算处理器200还用于：The arithmetic processor 200 is also used for:
定时获取所述流量信息，并基于所述流量信息对在线用户列表进行更新。The traffic information is acquired regularly, and the online user list is updated based on the traffic information.
获取FPGA统计的网络流量，并将流量信息汇总至对应的在线用户信息中。Obtain the network traffic counted by the FPGA, and summarize the traffic information into the corresponding online user information.
FPGA模块100用于：实现网络访问请求报文的接收，将接收到的网络访问请求报文传输至运算处理器200如CPU运算处理系统；接收CPU运算处理系统发送的网络访问请求报文；查询网络连接的快速转发列表，实现网络访问请求报文的快速转发；统计每条数据流的网络流量。The FPGA module 100 is used to: realize the reception of the network access request message, and transmit the received network access request message to the computing processor 200 such as the CPU computing processing system; receive the network access request message sent by the CPU computing processing system; query The fast forwarding list of network connections realizes the fast forwarding of network access request messages; counts the network traffic of each data flow.
CPU运算处理系统，由硬件和软件两部分组成，其中，硬件主要包括CPU、内存和硬盘等，软件包括操作系统和各种应用程序。CPU运算处理系统用于：维护用户在线列表，实现在线用户的增、删、改、查；实现对Session表以及对应存储空间的维护，实现数据连接Session表的增、删、改、查；实现数据连接Session对应存储空间和用户在线列表对应存储空间的关联，可以通过数据连接Session对应存储空间记录的用户在线列表内存地址信息，快速访问用户在线列表对应的存储空间；获取FPGA模块100统计的网络流量，并将对应的流量信息汇总至对应的在线用户信息中，此处的流量信息包括流量大小，可用于对恶意流量进行监测。The CPU operation processing system is composed of hardware and software. Among them, the hardware mainly includes CPU, memory and hard disk, etc., and the software includes the operating system and various application programs. The CPU operation processing system is used to: maintain the user online list, realize the addition, deletion, modification, and query of online users; realize the maintenance of the Session table and the corresponding storage space, and realize the addition, deletion, modification, and query of the data connection Session table; The association between the storage space corresponding to the data connection session and the corresponding storage space of the user online list can be through the memory address information of the user online list recorded in the corresponding storage space of the data connection session, and the storage space corresponding to the user online list can be quickly accessed; the network statistics of the FPGA module 100 can be obtained traffic, and summarize the corresponding traffic information into the corresponding online user information, where the traffic information includes the size of the traffic, which can be used to monitor malicious traffic.
其中，CPU运算处理系统通过PCI-e总线与FPGA模块100中的多队列DMA控制器连接，实现CPU运算处理系统与FPGA模块100之间的报文数据和Session表管理同步的功能。Among them, the CPU operation processing system is connected to the multi-queue DMA controller in the FPGA module 100 through the PCI-e bus, so as to realize the synchronization function of message data and session table management between the CPU operation processing system and the FPGA module 100 .
FPGA模块100具有报文协议解析、数据HASH运算、报文转发等功能，并通过网络数据收发模块实现以太网链路的接入。The FPGA module 100 has the functions of message protocol analysis, data HASH calculation, message forwarding, etc., and realizes the access of the Ethernet link through the network data transceiver module.
具体地，当一条网络访问请求报文被FPGA模块100接收后，FPGA模块100的网络数据处理引擎对网络访问请求报文进行协议解析，查找该网络访问请求报文是否存在对应的Session表，若该报文为首次被接收，Session表项里没有该报文信息，网络数据处理引擎将把报文上送给CPU运算处理系统。Specifically, after a network access request message is received by the FPGA module 100, the network data processing engine of the FPGA module 100 performs protocol analysis on the network access request message, and searches for whether there is a corresponding Session table for the network access request message. This message is received for the first time, and there is no such message information in the Session entry, and the network data processing engine will upload the message to the CPU computing processing system.
CPU运算处理系统接收该报文，对该报文建立Session表，并将该连接报文的Session表同步至FPGA模块100，以在FPGA模块100实现流量统计。The CPU processing system receives the message, establishes a session table for the message, and synchronizes the session table of the connection message to the FPGA module 100 to implement traffic statistics on the FPGA module 100 .
当该网络访问请求报文再次被FPGA模块100接收，这时FPGA模块100已记录该条网络访问请求报文的Session表，FPGA模块100通过匹配该Session表进行流量统计，将匹配成功的网络访问请求报文，直接从对应以太网接口转发出去，不需要再经过CPU运算处理系统处理，提高了网络访问请求报文的响应效率，提高了运行速度。When the network access request message is received by the FPGA module 100 again, the FPGA module 100 has recorded the Session table of the network access request message at this time, and the FPGA module 100 performs traffic statistics by matching the Session table, and will match the successful network access The request message is directly forwarded from the corresponding Ethernet interface without being processed by the CPU computing system, which improves the response efficiency of the network access request message and improves the running speed.
在FPGA模块100中，创建基于源IP、源端口、目的IP、目的端口以及网络报文通信协议的数据流Session表项，用于实现数据流的快速匹配；将数据流Session表项与用户在线数据表相关联，实现FPGA统计的针对数据流统计的流量，可以基于用户进行快速汇总；在利用FPGA实现的网关设备中，将利用FPGA处理的网络报文进行流量统计并与用户信息相关联，实现用户访问流量的精细化统计。In the FPGA module 100, create a data flow session entry based on source IP, source port, destination IP, destination port and network message communication protocol, for realizing fast matching of data flow; online data flow session table entry and user The data table is associated to realize the traffic statistics of the FPGA statistics for the data flow, which can be quickly summarized based on the user; in the gateway device implemented by the FPGA, the network packets processed by the FPGA are used for traffic statistics and associated with user information. Realize the refined statistics of user access traffic.
本申请实施例还提供一种电子设备，所述电子设备包括存储器以及处理器，所述存储器用于存储计算机程序，所述处理器运行计算机程序以使所述电子设备执行实施例1所述的用户网络流量统计方法。The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program so that the electronic device executes the method described in Embodiment 1. User network traffic statistics method.
本申请实施例还提供一种可读存储介质，所述可读存储介质中存储有计算机程序指令，所述计算机程序指令被一处理器读取并运行时，执行实施例1所述的用户网络流量统计方法。The embodiment of the present application also provides a readable storage medium, where computer program instructions are stored in the readable storage medium. When the computer program instructions are read and executed by a processor, the user network described in Embodiment 1 is executed. Traffic statistics method.
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，也可以通过其它的方式实现。以上所描述的装置实施例仅仅是示意性的，例如，附图中的流程图和框图显示了根据本申请的多个实施例的装置、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或代码的一部分，所述模块、程序段或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现方式中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are only illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functions and possible implementations of devices, methods and computer program products according to multiple embodiments of the present application. operate. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or part of code that includes one or more Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or action , or may be implemented by a combination of dedicated hardware and computer instructions.
另外，在本申请各个实施例中的各功能模块可以集成在一起形成一个独立的部分，也可以是各个模块单独存在，也可以两个或两个以上模块集成形成一个独立的部分。In addition, each functional module in each embodiment of the present application may be integrated to form an independent part, each module may exist independently, or two or more modules may be integrated to form an independent part.
所述功能如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .
以上所述仅为本申请的实施例而已，并不用于限制本申请的保护范围，对于本领域的技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释。The above descriptions are only examples of the present application, and are not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and changes may be made to the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application shall be included within the protection scope of this application. It should be noted that like numerals and letters denote similar items in the following figures, therefore, once an item is defined in one figure, it does not require further definition and explanation in subsequent figures.
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。The above is only a specific implementation of the application, but the scope of protection of the application is not limited thereto. Anyone familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the application. Should be covered within the protection scope of this application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. There is no such actual relationship or order between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.
Claims (10)
Translated fromChinesePriority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211204052.1ACN115603969A (en) | 2022-09-29 | 2022-09-29 | A user network traffic statistics method, acquisition method and statistics system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211204052.1ACN115603969A (en) | 2022-09-29 | 2022-09-29 | A user network traffic statistics method, acquisition method and statistics system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115603969Atrue CN115603969A (en) | 2023-01-13 |
Family
ID=84844952
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211204052.1APendingCN115603969A (en) | 2022-09-29 | 2022-09-29 | A user network traffic statistics method, acquisition method and statistics system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115603969A (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103581044A (en)* | 2013-11-04 | 2014-02-12 | 汉柏科技有限公司 | Flow statistic method and device |
| CN104717102A (en)* | 2013-12-12 | 2015-06-17 | 华为技术有限公司 | Flow statistic method and device and NAT gateway device |
| CN112804200A (en)* | 2020-12-30 | 2021-05-14 | 北京天融信网络安全技术有限公司 | Reflection attack defense method and device, electronic equipment and storage medium |
| CN112994983A (en)* | 2021-04-01 | 2021-06-18 | 杭州迪普信息技术有限公司 | Flow statistical method and device and electronic equipment |
| CN113132240A (en)* | 2021-04-21 | 2021-07-16 | 北京字节跳动网络技术有限公司 | Data packet processing and forwarding method, device, integrated chip, switch and system |
- 2022
- 2022-09-29CNCN202211204052.1Apatent/CN115603969A/enactivePending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103581044A (en)* | 2013-11-04 | 2014-02-12 | 汉柏科技有限公司 | Flow statistic method and device |
| CN104717102A (en)* | 2013-12-12 | 2015-06-17 | 华为技术有限公司 | Flow statistic method and device and NAT gateway device |
| CN112804200A (en)* | 2020-12-30 | 2021-05-14 | 北京天融信网络安全技术有限公司 | Reflection attack defense method and device, electronic equipment and storage medium |
| CN112994983A (en)* | 2021-04-01 | 2021-06-18 | 杭州迪普信息技术有限公司 | Flow statistical method and device and electronic equipment |
| CN113132240A (en)* | 2021-04-21 | 2021-07-16 | 北京字节跳动网络技术有限公司 | Data packet processing and forwarding method, device, integrated chip, switch and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113037500B (en) | Network device and method for network communication | |
| US9054952B2 (en) | Automated passive discovery of applications | |
| CN103929507B (en) | A kind of realize can change the method and device of DNS service offline | |
| US10397329B2 (en) | Methods and systems for distribution and retrieval of network traffic records | |
| JP2018531527A (en) | Method and apparatus for identifying application information in network traffic | |
| JP2018531527A6 (en) | Method and apparatus for identifying application information in network traffic | |
| JP2020113924A (en) | Monitoring program, programmable device, and monitoring method | |
| WO2017092351A1 (en) | Cache data update method and device | |
| WO2024060408A1 (en) | Network attack detection method and apparatus, device and storage medium | |
| WO2005006671A1 (en) | Particular service optimal routing method in network and server and routing node used in the network | |
| CN101383818A (en) | A processing method and device for accessing a network | |
| CN106100928A (en) | It is applied to transmission method and the device of the monitoring data of data center | |
| WO2016082616A1 (en) | Method and device for providing website authentication data for search engine | |
| WO2023143579A1 (en) | Flow table entry control method and apparatus | |
| CN101146130A (en) | A method and system for transmitting data between clients | |
| WO2022100581A1 (en) | Method for processing ipfix message, storage medium, network switching chip and asic chip | |
| EP3167575B1 (en) | Delayed proxy action | |
| CN115603969A (en) | A user network traffic statistics method, acquisition method and statistics system | |
| CN109309711B (en) | A virtual cache sharing method and system | |
| CN115190107B (en) | Multi-subsystem management method based on extensive domain name, management terminal and readable storage medium | |
| WO2009121261A1 (en) | Route managing method, device and system | |
| US20140078913A1 (en) | Data packet stream fingerprint | |
| JP2013126219A (en) | Transfer server and transfer program | |
| Li et al. | Network Control Message Protocol | |
| WO2017092350A1 (en) | Method and device for improving cache hit ratio |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |