Summary of the invention
The present invention proposes a kind of service role recognition method based on flow communication mode, and the present invention can identify the service side of network traffics efficiently and accurately.
The present invention adopts following technical scheme:
A kind of service role recognition method based on flow communication mode, it is characterized in that: in 5 minutes scopes of a time scale, flow maintenance { source IP address and source port } node for measuring in ltsh chain table, and preceding two different IP addresses, place of writing down its correspondence for the node of each identical { source IP address and source port }, if write down two different IP addresses, place in { source IP address and source port } node, illustrate this source IP address from this source port at least 2 other different main frame transmitted traffics, think that then this source IP address is service side, its serve port is this source port, and concrete steps are as follows:
The first step: parameter setting
An array of pointers A[n is set], n is the size of array of pointers A, and n=2 is set
m, wherein m is the positive integer greater than 0, each element assignment of array A is a null pointer, the Bit String S of one 48 bit length is set, a hash function F is set, and the input of hash function F is the Bit String S of 48 bit lengths, and the cryptographic Hash of hash function F output is that a span is 0 to 2
mPositive integer between-1, hash function F adopts present computer MD5 hash function commonly used, MD represents informative abstract, it is the hash function that is widely used by Ron Rivest design, the input of MD5 hash function is the Bit String of a random length, output is 128 informative abstracts, hash function F chooses preceding m bit of MD5 hash function cryptographic Hash and exports cryptographic Hash as it, a structure B is set, this structure B comprises four integer variables and a pointer variable, four integer variables of structure B write down host IP address respectively, source port number, IP address, first place, IP address, second place, the pointer variable of structure B is pointed to next node, measure beginning,, entered for second step if a new discharge record arrives;
Second step: handle arriving discharge record
Read source IP address, source port and the IP address, place of this discharge record, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, with the input of 48 Bit String S as hash function F, calculate cryptographic Hash i, i the pointer of reading pointer array A, if this pointer is a null pointer, generate a new node according to structure B, this newly-generated node of i pointed with array of pointers A, entered for the 3rd step,, then entered for the 4th step if this pointer is not empty;
The 3rd step: the new node of initialization
The source IP address of the source IP address of this new node for this discharge record is set, the source port of this new node is the source port of this discharge record, the IP address, first place of this new node is the IP address, place of this discharge record, second place IP address setting of this new node is 0, the pointer that this new node is set is a null pointer, enters for the 6th step;
The 4th step: search the pointer chained list
Search the node chained list of i the pointed of array of pointers A, if in this chained list, find a node, the source IP address of this node equals the source IP address of this discharge record, the source port of this node equals the source port of this discharge record, entered for the 5th step, otherwise generate a new node according to structure B,, got back to for the 3rd step this newly-generated node of last pointed of i the pointed node chained list of array of pointers A;
The 5th step: upgrade node
Search the IP address, first place of this node, if this discharge record place IP equals the IP address, first place of this node, then entered for the 6th step, otherwise search the IP address, second place of this node, if the IP address, second place of this node is 0, then IP address, second place assignment with this node is the IP address, place of this discharge record, enters for the 6th step, if the IP address, second place of this node is not 0, then directly entered for the 6th step;
The 6th step: measure and finish
Finish if measure, entered for the 7th step, do not finish, wait for that a new discharge record arrives,, got back to for second step if a new discharge record arrives if measure;
The 7th step: measurement result output
Search all nodes among the array of pointers A, if the IP address, second place of a node is not 0, illustrate that then pairing source IP address of this node and source port number are in the Measuring Time scope, to at least two chummage IP address transmitted traffics not, the source IP address of this node and source port are service side, export the source IP address and the source port of this node.
Compared with prior art, the present invention has following advantage and beneficial effect:
1, the advantage of this method is to discern the service role of Transmission Control Protocol and udp protocol flow simultaneously, only need extracting part shunt volume data can accurately discern the traffic service role, can carry out service role identification according to the original message data and also can adopt stream data such as NetFlow to carry out service role identification;
2, this method can be carried out efficient identification to the service role in the network traffics, can discern sampling or gather the service role of number of different types datas on flows such as flow, message or flow data, UDP flow or TCP flow entirely;
3; this method can be according to network traffic information; identify the service role of flow communication exactly; promptly identify service IP and serve port; the flow application that accurately is identified in of service IP and serve port is classified; significant in network management and the network security; in the flow application classification; service IP and serve port are correctly discerned an important measure index of flow application type; in network management; the variation of the host role of network manager in can real-time tracking institute managed network; to prevent that client computer from outwards providing service alone; influence the normal operation of network, variation that simultaneously can the monitoring host computer role is to judge the unusual or normal of main frame behavior.
Embodiment
A kind of service role recognition method based on flow communication mode, it is characterized in that: in 5 minutes scopes of a time scale, flow maintenance { source IP address and source port } node for measuring in ltsh chain table, and preceding two different IP addresses, place of writing down its correspondence for the node of each identical { source IP address and source port }, if write down two different IP addresses, place in { source IP address and source port } node, illustrate this source IP address from this source port at least 2 other different main frame transmitted traffics, think that then this source IP address is service side, its serve port is this source port, and concrete steps are as follows:
The first step: parameter setting
An array of pointers A[n is set], n is the size of array of pointers A, and n=2 is set
m, wherein m is the positive integer greater than 0, each element assignment of array A is a null pointer, the Bit String S of one 48 bit length is set, a hash function F is set, and the input of hash function F is the Bit String S of 48 bit lengths, and the cryptographic Hash of hash function F output is that a span is 0 to 2
mPositive integer between-1, hash function F adopts present computer MD5 hash function commonly used, hash function F chooses preceding m bit of MD5 hash function cryptographic Hash and exports cryptographic Hash as it, a structure B is set, this structure B comprises four integer variables and a pointer variable, four integer variables of structure B write down host IP address, source port number, IP address, first place, IP address, second place respectively, the pointer variable of structure B is pointed to next node, measure beginning, if a new discharge record arrives, entered for second step;
Second step: handle arriving discharge record
Read source IP address, source port and the IP address, place of this discharge record, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, with the input of 48 Bit String S as hash function F, calculate cryptographic Hash i, i the pointer of reading pointer array A, if this pointer is a null pointer, generate a new node according to structure B, this newly-generated node of i pointed with array of pointers A, entered for the 3rd step,, then entered for the 4th step if this pointer is not empty;
The 3rd step: the new node of initialization
The source IP address of the source IP address of this new node for this discharge record is set, the source port of this new node is the source port of this discharge record, the IP address, first place of this new node is the IP address, place of this discharge record, second place IP address setting of this new node is 0, the pointer that this new node is set is a null pointer, enters for the 6th step;
The 4th step: search the pointer chained list
Search the node chained list of i the pointed of array of pointers A, if in this chained list, find a node, the source IP address of this node equals the source IP address of this discharge record, the source port of this node equals the source port of this discharge record, entered for the 5th step, otherwise generate a new node according to structure B,, got back to for the 3rd step this newly-generated node of last pointed of i the pointed node chained list of array of pointers A;
The 5th step: upgrade node
Search the IP address, first place of this node, if this discharge record place IP equals the IP address, first place of this node, then entered for the 6th step, otherwise search the IP address, second place of this node, if the IP address, second place of this node is 0, then IP address, second place assignment with this node is the IP address, place of this discharge record, enters for the 6th step, if the IP address, second place of this node is not 0, then directly entered for the 6th step;
The 6th step: measure and finish
Finish if measure, entered for the 7th step, do not finish, wait for that a new discharge record arrives,, got back to for second step if a new discharge record arrives if measure;
The 7th step: measurement result output
Search all nodes among the array of pointers A, if the IP address, second place of a node is not 0, illustrate that then pairing source IP address of this node and source port number are in the Measuring Time scope, to at least two chummage IP address transmitted traffics not, the source IP address of this node and source port are service side, export the source IP address and the source port of this node.
Fig. 1, Fig. 2 are based on schematic diagram and the flow chart that relates in the service role recognition method embodiment of flow communication mode, and Hash linked list array size is 16, one to have 5 nodes among Fig. 1, has handled 8 datas on flows,
Handle { the source IP of each data on flows in this example, source port, place IP} tlv triple is { 3,7,5}, { 5,5,4}, { 4,1,7}, { 9,2,2}, { 3,1,4}, { 3,7,1}, { 4,1,5}, { 3,1,7}, wherein source IP be 3 and source port be that 7 pairing 48 bit string S are 0x000700000003, source IP be 5 and source port be that 5 pairing 48 bit string S are 0x000500000005, source IP be 4 and source port be that 1 pairing 48 bit string S are 0x000100000004, source IP be 9 and source port be that 2 pairing 48 bit string S are 0x000200000009, source IP be 3 and source port be that 1 pairing 48 bit string S are 0x000100000003, suppose that simultaneously hash function F is 1 for the cryptographic Hash of input S=0x000700000003, the cryptographic Hash of input S=0x000500000005 is 4, the cryptographic Hash of input S=0x000100000004 is 7, the cryptographic Hash of input S=0x000200000009 is 13, the cryptographic Hash of input S=0x000100000003 is 13
The concrete technical step that the invention process is given an example is as follows:
(1) first step: parameter setting
An array of pointers A[n is set], n is the size of array of pointers A, and n=2 is set
m=16, wherein m=4 is the positive integer greater than 0, each element assignment of array A is a null pointer, the Bit String S of one 48 bit length is set, a hash function F is set, the input of hash function F is the Bit String S of 48 bit lengths, the cryptographic Hash of hash function F output is that a span is the positive integer between 0 to 15, hash function F adopts present computer MD5 hash function commonly used, hash function F chooses preceding 4 bits of MD5 hash function cryptographic Hash and exports cryptographic Hash as it, a structure B is set, this structure B comprises four integer variables and a pointer variable, four integer variables of structure B write down host IP address respectively, source port number, IP address, first place, IP address, second place, the pointer variable of structure B is pointed to next node, measure beginning,, entered for (2) second steps if a new discharge record arrives;
(2) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 3, source port be 7 and IP address, place be 5, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, S=0x000700000003, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 1, the 1st pointer of reading pointer array A, this pointer is a null pointer, generate a new node according to structure B, with the 1st this newly-generated node of pointed of array of pointers A, entered for (3) the 3rd steps;
(3) the 3rd steps: the new node of initialization
The source IP address that this new node is set is that the source IP address of this discharge record is 3, the source port of this new node is 7 for the source port of this discharge record, the IP address, first place of this new node is 5 for the IP address, place of this discharge record, second place IP address setting of this new node is 0, the pointer that this new node is set is a null pointer, enters for (4) the 6th steps;
(4) the 6th steps: measure and finish
Do not measure and finish, a new discharge record arrives, and gets back to for (5) second steps;
(5) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 5, source port be 5 and IP address, place be 4, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, S=0x000500000005, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 4, the 4th pointer of reading pointer array A, this pointer is a null pointer, generate a new node according to structure B, with the 4th this newly-generated node of pointed of array of pointers A, entered for (6) the 3rd steps;
(6) the 3rd steps: the new node of initialization
The source IP address that this new node is set is that the source IP address of this discharge record is 5, the source port of this new node is 5 for the source port of this discharge record, the IP address, first place of this new node is 4 for the IP address, place of this discharge record, second place IP address setting of this new node is 0, the pointer that this new node is set is a null pointer, enters for (7) the 6th steps;
(7) the 6th steps: measure and finish
Do not measure and finish, a new discharge record arrives, and gets back to for (8) second steps;
(8) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 4, source port be 1 and IP address, place be 7, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, S=0x000100000004, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 7, the 7th pointer of reading pointer array A, this pointer is a null pointer, generate a new node according to structure B, with the 7th this newly-generated node of pointed of array of pointers A, entered for (9) the 3rd steps;
(9) the 3rd steps: the new node of initialization
The source IP address that this new node is set is that the source IP address of this discharge record is 4, the source port of this new node is 1 for the source port of this discharge record, the IP address, first place of this new node is 7 for the IP address, place of this discharge record, second place IP address setting of this new node is 0, the pointer that this new node is set is a null pointer, enters for (10) the 6th steps;
(10) the 6th steps: measure and finish
Do not measure and finish, a new discharge record arrives, and gets back to for (11) second steps;
(11) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 9, source port be 2 and IP address, place be 2, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, S=0x000200000009, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 13, the 13rd pointer of reading pointer array A, this pointer is a null pointer, generate a new node according to structure B, with the 13rd this newly-generated node of pointed of array of pointers A, entered for (12) the 3rd steps;
(12) the 3rd steps: the new node of initialization
The source IP address that this new node is set is that the source IP address of this discharge record is 9, the source port of this new node is 2 for the source port of this discharge record, the IP address, first place of this new node is 2 for the IP address, place of this discharge record, second place IP address setting of this new node is 0, the pointer that this new node is set is a null pointer, enters for (13) the 6th steps;
(13) the 6th steps: measure and finish
Do not measure and finish, a new discharge record arrives, and gets back to for (14) second steps;
(14) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 3, source port be 1 and IP address, place be 4, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, S=0x000100000003, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 13, the 13rd pointer of reading pointer array A, this pointer is not empty, then enters for (15) the 4th steps;
(15) the 4th steps: search the pointer chained list
Search the node chained list of the 13rd pointed of array of pointers A, in this chained list, can not find a node, the source IP address of this node equals the source IP address 3 of this discharge record, the source port of this node equals the source port 1 of this discharge record, generate a new node according to structure B, with this newly-generated node of last pointed of the 13rd the pointed node chained list of array of pointers A, got back to for (16) the 3rd steps;
(16) the 3rd steps: the new node of initialization
The source IP address that this new node is set is that the source IP address of this discharge record is 3, the source port of this new node is 1 for the source port of this discharge record, the IP address, first place of this new node is 4 for the IP address, place of this discharge record, second place IP address setting of this new node is 0, the pointer that this new node is set is a null pointer, enters for (17) the 6th steps;
(17) the 6th steps: measure and finish
Do not measure and finish, a new discharge record arrives, and gets back to for (18) second steps;
(18) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 3, source port be 7 and IP address, place be 1, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, S=0x000700000003, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 1, the 1st pointer of reading pointer array A, this pointer is not empty, then enters for (19) the 4th steps;
(19) the 4th steps: search the pointer chained list
Search the node chained list of the 1st pointed of array of pointers A, in this chained list, find a node, the source IP address of this node equals the source IP address 3 of this discharge record, and the source port of this node equals the source port 7 of this discharge record, enters for (20) the 5th steps;
(20) the 5th steps: upgrade node
Search the IP address, first place of this node, this IP address, discharge record place 1 is not equal to the IP address, first place 5 of this node, search the IP address, second place of this node, the IP address, second place of this node is 0, be 1 for the IP address, place of this discharge record then, entered for (21) the 6th steps IP address, second place assignment of this node;
(21) the 6th steps: measure and finish
Do not measure and finish, a new discharge record arrives, and gets back to for (22) second steps;
(22) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 4, source port be 1 and IP address, place be 5, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits of source port assignment to 48 a Bit String S, S=0x000100000004, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 7, the 7th pointer of reading pointer array A, this pointer is not empty, enters for (23) the 4th steps;
(23) the 4th steps: search the pointer chained list
Search the node chained list of the 7th pointed of array of pointers A, in this chained list, find a node, the source IP address of this node equals the source IP address 4 of this discharge record, and the source port of this node equals the source port 1 of this discharge record, enters for (24) the 5th steps;
(24) the 5th steps: upgrade node
Search the IP address, first place of this node, this IP address, discharge record place 5 is not equal to the IP address, first place 7 of this node, search the IP address, second place of this node, the IP address, second place of this node is 0, be 5 for the IP address, place of this discharge record then, entered for (25) the 6th steps IP address, second place assignment of this node;
(25) the 6th steps: measure and finish
Do not measure and finish, a new discharge record arrives, and gets back to for (26) second steps;
(26) second steps: handle arriving discharge record
The source IP address that reads this discharge record is 3, source port be 1 and IP address, place be 7, preceding 32 bits with source IP address assignment to 48 a Bit String S, back 16 bits with source port assignment to 48 a Bit String S, S=0x000100000003, with the input of 48 Bit String S as hash function F, calculating cryptographic Hash i is 13, the 13rd pointer of reading pointer array A, this pointer is not empty, then enters for (27) the 4th steps;
(27) the 4th steps: search the pointer chained list
Search the node chained list of the 13rd pointed of array of pointers A, in this chained list, find a node, the source IP address of this node equals the source IP address 3 of this discharge record, and the source port of this node equals the source port 1 of this discharge record, enters for (28) the 5th steps;
(28) the 5th steps: upgrade node
Search the IP address, first place of this node, this IP address, discharge record place 7 is not equal to the IP address, first place 4 of this node, search the IP address, second place of this node, the IP address, second place of this node is 0, be 7 for the IP address, place of this discharge record then, entered for (29) the 6th steps IP address, second place assignment of this node;
(29) the 6th steps: measure and finish
Measure and finish, entered for (30) the 7th steps;
(30) the 7th steps: measurement result output
Search all nodes among the array of pointers A, if the IP address, second place of a node is not 0, illustrate that then pairing source IP address of this node and source port number are in the Measuring Time scope, to at least two chummage IP address transmitted traffics not, the source IP address of this node and source port are service side, export the source IP address and the source port of this node.
The result is as follows in output:
Source IP address service side, the side of service source port number
3 7
4 1
3 1