CN112969194B - URR statistical method based on reverse packet processing - Google Patents
URR statistical method based on reverse packet processing Download PDFInfo
- Publication number
- CN112969194B CN112969194B CN202110188533.7A CN202110188533A CN112969194B CN 112969194 B CN112969194 B CN 112969194B CN 202110188533 A CN202110188533 A CN 202110188533A CN 112969194 B CN112969194 B CN 112969194B
- Authority
- CN
- China
- Prior art keywords
- urr
- url
- packet
- handshake
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/08—Testing, supervising or monitoring using real traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/18—Protocol analysers
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a URR statistical method based on reverse packet processing, relating to the technical field of 5G communication; opening a DPI seven-layer protocol recognition function through the UPF to record URR, caching the three-layer information and the packet length of the unidentified handshake packet, identifying the URL of the HTTP through the UPF, recording the three-layer information of the URL, reversely matching the three-layer information of the URL with the cached three-layer information of the handshake packet, and adding the packet length of the matched handshake packet into the URR statistics corresponding to the URL.
Description
Technical Field
The invention discloses a method, relates to the technical field of 5G communication, and particularly relates to a URR statistical method based on reverse packet processing.
Background
The 5G UPF device can perform DPI seven-layer protocol identification on the data packets received by the N3 port according to a predefined rule. Different predefined rules may be used to account for different URRs for application-specific usage statistics. After the URR is reported, the control plane network element can carry out charging according to the URR. However, this process has the following disadvantages: when the seven-layer protocol identification is carried out on the HTTP message through the DPI, the HTTP belongs to a TCP type protocol, and interaction can be carried out only through three-way handshake, but the URL of a specific application layer identified by the DPI is an HTTP GET packet after the three-way handshake, so that handshake information is not identified, the accuracy of URR statistics is influenced, and errors are generated in charging.
Disclosure of Invention
Aiming at the problems in the prior art, the invention provides the URR statistical method based on reverse packet processing, which can correctly count the length of the three handshake packets which cannot be identified by the DPI in the HTTP process, so that the URR statistics is more accurate.
The specific scheme provided by the invention is as follows:
a URR statistical method based on reverse packet processing comprises recording URR by UPF opening DPI seven-layer protocol identification function, caching unrecognized handshake packet and recording three-layer information and packet length of handshake packet,
identifying the URL of the HTTP through the UPF, recording three layers of information of the URL, reversely matching the three layers of information of the URL with the three layers of information of the cached handshake package,
and adding the packet length of the matched handshake packet into the URR statistics corresponding to the URL.
Furthermore, in the URR statistical method based on reverse packet processing, the URR statistical rule is predefined, the DPI seven-layer protocol recognition function is started through the UPF, and unidentified handshake packets are cached.
Further, in the URR statistical method based on reverse packet processing, three layers of information and packet length of an unidentified handshake packet are recorded, wherein the three layers of information include a source IP, a source PORT, a destination IP and a destination PORT.
A URR statistical system based on reverse packet processing comprises a starting module, a cache module, an identification module, a matching module and a statistical module,
the starting module starts the DPI seven-layer protocol recognition function to record URR through UPF, the caching module caches unidentified handshake packets and records three-layer information and packet length of the handshake packets,
the identification module identifies the URL of the HTTP through the UPF and records three layers of information of the URL, the matching module reversely matches the three layers of information of the URL with the three layers of information of the cached handshake package,
and the counting module adds the packet length of the matched handshake packet into the URR (universal resource locator) statistics corresponding to the URL.
Further, in the URR statistical system based on reverse packet processing, the start module predefines the URR statistical rule first, and starts the DPI seven-layer protocol recognition function through the UPF to notify the cache module to cache unidentified handshake packets.
Further, the cache module in the URR statistical system based on reverse packet processing records three layers of information of unidentified handshake packets and packet lengths, wherein the three layers of information include a source IP, a source PORT, a destination IP and a destination PORT.
A URR statistics apparatus based on reverse packet processing, comprising at least one memory and at least one processor;
the at least one memory to store a machine readable program;
the at least one processor is configured to invoke the machine readable program to perform the URR statistical method based on reverse packet processing.
A computer readable medium having stored thereon computer instructions, which when executed by a processor, cause the processor to perform the method for reverse packet processing based URR statistics.
The invention has the advantages that:
the invention provides a URR statistical method based on reverse packet processing, which comprises the steps of caching an unidentified handshake packet when starting a DPI seven-layer protocol identification function to record URR through a UPF, recording three-layer information and length of the handshake packet, then reversely matching the three-layer information after identifying an HTTP URL through the UPF, counting the unidentified packet length before, and recording the packet length into the URR, so that handshake messages which cannot be identified by the DPI are accurately recorded into a specific URR, three-way handshake messages which cannot be identified by the HTTP service DPI are accurately counted into the URR, and the accuracy of dosage identification is improved.
Drawings
FIG. 1 is a schematic diagram of the process of the present invention.
Detailed Description
The present invention is further described below in conjunction with the following figures and specific examples so that those skilled in the art may better understand the present invention and practice it, but the examples are not intended to limit the present invention.
The invention provides a URR statistical method based on reverse packet processing, which records URR by opening a seven-layer protocol recognition function of a DPI through a UPF (unified power flow), caches three layers of information and packet length of a handshake packet without recognizing the handshake packet,
identifying the URL of the HTTP through the UPF, recording three layers of information of the URL, reversely matching the three layers of information of the URL with the three layers of information of the cached handshake package,
and adding the packet length of the matched handshake packet into the URR statistics corresponding to the URL.
The method can correctly count the length of the three handshake packets which can not be identified by the DPI in the HTTP process, thereby enabling the URR to be more accurate.
In a specific application, in some embodiments of the present invention, the UPF starts a predefined rule URR statistic identified by a seven-layer protocol, starts a caching mechanism, caches a received handshake packet that cannot identify a corresponding URL, and records packet length and three-layer information, where the three-layer information includes a source IP, a source PORT, a destination IP, and a destination PORT,
and the UPF continuously forwards the data packet, identifies the URL in the HTTP GET packet through the DPI, records three layers of information of the URL while counting the URL, reversely matches the three layers of information of the identified URL with the three layers of information of the handshake packet stored in the previous cache, and adds the packet length of the handshake packet into the URR statistics corresponding to the URL after matching. Referring to fig. 1, in the figure, the SMF configures a URR statistics report of a certain URL of the UPF, where 1M reporting may be set once, the UPF performs protocol identification and then performs statistics on the traffic received by the URL, and after the uplink and downlink reach 1M, the SMF reports a URR once through the PFCP signaling.
The method of the invention is utilized to correctly count the three-way handshake message which can not be identified by the HTTP service DPI into the URR, thereby improving the accuracy of the usage identification.
Meanwhile, the invention also provides a URR statistical system based on reverse packet processing, which comprises a starting module, a cache module, an identification module, a matching module and a statistical module,
the starting module starts a DPI seven-layer protocol recognition function recording URR through a UPF, the caching module caches unidentified handshake packets and records three-layer information and packet length of the handshake packets,
the identification module identifies the URL of the HTTP through the UPF and records three layers of information of the URL, the matching module reversely matches the three layers of information of the URL with the three layers of information of the cached handshake package,
and the counting module adds the packet length of the matched handshake packet into the URR (universal resource locator) statistics corresponding to the URL.
The information interaction, execution process and other contents between the modules in the system are based on the same concept as the method embodiment of the present invention, and specific contents can be referred to the description in the method embodiment of the present invention, and are not described herein again.
And a reverse packet processing based URR statistics apparatus comprising at least one memory and at least one processor;
the at least one memory to store a machine readable program;
the at least one processor is configured to invoke the machine readable program to perform the URR statistical method based on reverse packet processing.
The contents of information interaction, readable program process execution and the like of the processor in the device are based on the same concept as the method embodiment of the present invention, and specific contents can be referred to the description in the method embodiment of the present invention, and are not described herein again.
A computer readable medium having stored thereon computer instructions, which when executed by a processor, cause the processor to perform the method for reverse packet processing based URR statistics. Specifically, a system or an apparatus equipped with a storage medium on which software program codes that realize the functions of any of the above-described embodiments are stored may be provided, and a computer (or a CPU or MPU) of the system or the apparatus is caused to read out and execute the program codes stored in the storage medium.
In this case, the program code itself read from the storage medium can realize the functions of any of the above-described embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.
Examples of the storage medium for supplying the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (e.g., CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD + RW), a magnetic tape, a nonvolatile memory card, and a ROM. Alternatively, the program code may be downloaded from a server computer via a communications network.
Further, it should be clear that the functions of any one of the above-described embodiments may be implemented not only by executing the program code read out by the computer, but also by causing an operating system or the like operating on the computer to perform a part or all of the actual operations based on instructions of the program code.
Further, it is to be understood that the program code read out from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion unit connected to the computer, and then causes a CPU or the like mounted on the expansion board or the expansion unit to perform part or all of the actual operations based on instructions of the program code, thereby realizing the functions of any of the above-described embodiments.
It should be noted that not all steps and modules in the processes and the system device structures in the preferred embodiments are necessary, and some steps or modules may be omitted according to actual needs. The execution order of the steps is not fixed and can be adjusted as required. The system structure described in the above embodiments may be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by a plurality of physical entities, or some components in a plurality of independent devices may be implemented together.
The above-mentioned embodiments are merely preferred embodiments for fully illustrating the present invention, and the scope of the present invention is not limited thereto. The equivalent substitutions or changes made by the person skilled in the art on the basis of the present invention are all within the protection scope of the present invention. The protection scope of the invention is subject to the claims.
Claims (4)
1. A URR statistical method based on reverse packet processing is characterized in that URR statistical rules are predefined, a DPI seven-layer protocol recognition function is started through UPF to record URR, a handshake packet is cached and not recognized, three-layer information and packet length of the handshake packet are recorded, the three-layer information comprises a source IP, a source PORT, a destination IP and a destination PORT,
identifying the URL of the HTTP through the UPF, recording three layers of information of the URL, reversely matching the three layers of information of the URL with the three layers of information of the cached handshake package,
and adding the packet length of the matched handshake packet into the URR statistics corresponding to the URL.
2. A URR statistical system based on reverse packet processing is characterized by comprising a starting module, a cache module, an identification module, a matching module and a statistical module,
the starting module predefines URR statistical rules firstly, starts the DPI seven-layer protocol recognition function to record URR through UPF, the buffer module buffers the unrecognized handshake packet and records the three-layer information and the packet length of the handshake packet, the three-layer information comprises a source IP, a source PORT, a destination IP and a destination PORT,
the identification module identifies the URL of the HTTP through the UPF and records three layers of information of the URL, the matching module reversely matches the three layers of information of the URL with the three layers of information of the cached handshake package,
and the counting module adds the packet length of the matched handshake packet into the URR (universal resource locator) statistics corresponding to the URL.
3. A URR statistical device based on reverse packet processing is characterized by comprising at least one memory and at least one processor;
the at least one memory to store a machine readable program;
the at least one processor, configured to invoke the machine readable program to perform the URR statistical method based on reverse packet processing of claim 1.
4. Computer readable medium characterized in that said computer readable medium has stored thereon computer instructions which, when executed by a processor, cause said processor to execute a URR statistical method based on reverse packet processing according to claim 1.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110188533.7A CN112969194B (en) | 2021-02-19 | 2021-02-19 | URR statistical method based on reverse packet processing |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110188533.7A CN112969194B (en) | 2021-02-19 | 2021-02-19 | URR statistical method based on reverse packet processing |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112969194A CN112969194A (en) | 2021-06-15 |
| CN112969194B true CN112969194B (en) | 2023-04-07 |
Family
ID=76285036
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110188533.7A Active CN112969194B (en) | 2021-02-19 | 2021-02-19 | URR statistical method based on reverse packet processing |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112969194B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112312339A (en) * | 2019-07-31 | 2021-02-02 | 华为技术有限公司 | Charging method, charging system and communication device |
| WO2021018406A1 (en) * | 2019-07-26 | 2021-02-04 | Telefonaktiebolaget Lm Ericsson (Publ) | Traffic monitoring in a network node |
| WO2021023392A1 (en) * | 2019-08-06 | 2021-02-11 | Telefonaktiebolaget Lm Ericsson (Publ) | Technique for controlling and performing data traffic handling in a core network domain |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110234112B (en) * | 2018-03-05 | 2020-12-04 | 华为技术有限公司 | Message processing method, system and user plane function device |
| CN110324800B (en) * | 2018-03-30 | 2021-01-29 | 华为技术有限公司 | Policy control method, network element and system |
| US10887944B2 (en) * | 2018-08-20 | 2021-01-05 | Telefonaktiebolaget Lm Ericsson (Publ) | User plane function control of control plane-user plane separation |
-
2021
- 2021-02-19 CN CN202110188533.7A patent/CN112969194B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021018406A1 (en) * | 2019-07-26 | 2021-02-04 | Telefonaktiebolaget Lm Ericsson (Publ) | Traffic monitoring in a network node |
| CN112312339A (en) * | 2019-07-31 | 2021-02-02 | 华为技术有限公司 | Charging method, charging system and communication device |
| WO2021023392A1 (en) * | 2019-08-06 | 2021-02-11 | Telefonaktiebolaget Lm Ericsson (Publ) | Technique for controlling and performing data traffic handling in a core network domain |
Non-Patent Citations (1)
| Title |
|---|
| C4-190023 "Policy and Charging Control";Huawei;《3GPP tsg_ct\wg4_protocollars_ex-cn4》;20190218;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112969194A (en) | 2021-06-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9356844B2 (en) | Efficient application recognition in network traffic | |
| CN112333169B (en) | Message processing method, device, electronic equipment and computer readable medium | |
| CN106921665B (en) | Message processing method and network equipment | |
| CN114422617B (en) | Message processing method, system and computer readable storage medium | |
| CN110581780B (en) | Automatic identification method for WEB server assets | |
| CN112969194B (en) | URR statistical method based on reverse packet processing | |
| CN105516200B (en) | Cloud system method and device of safe processing | |
| CN102523221B (en) | Detection method of data message and network safety detection device | |
| CN116319448A (en) | Packet loss diagnosis method, apparatus, electronic device and computer readable storage medium | |
| CN112615857B (en) | Network data processing method, device and system | |
| CN113595959B (en) | Network traffic data processing method and server | |
| CN103532763B (en) | A kind of Fault Locating Method and device | |
| CN111741029B (en) | Log data processing method, processing device and storage medium | |
| CN113609089A (en) | Interface request processing method and device, readable storage medium and computer equipment | |
| CN114125078A (en) | MAC address learning method and device | |
| CN108683716B (en) | business logic learning and protecting method and learning and protecting device based on big data | |
| CN113259386A (en) | Malicious request intercepting method and device and computer equipment | |
| KR100990555B1 (en) | Method and system for providing a unified data exchange and storage format | |
| CN117061638B (en) | Message transmission method, device, storage medium, equipment and system | |
| CN109996200B (en) | Method, device, equipment and medium for preventing flow fraud | |
| CN115334498B (en) | Beidou information communication method and device, server and medium | |
| CN115460270B (en) | 5G UPF (high speed uplink packet filter) illegal service blocking method and related equipment | |
| CN108255617A (en) | Data transferring method, system and electronic equipment | |
| CN113839826B (en) | Method and device for detecting windows terminal and computer readable storage medium | |
| KR20080049439A (en) | The method and system delivering data by leading a user's request information prediction in network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |