CN106330563B - A kind of method and device of determining Intranet http communication stream service type - Google Patents

Abstract

The present invention relates to the field of computer technology, in particular to a method and device for determining the type of intranet HTTP communication flow service. Whether the difference between the update time of the communication flow list is not less than the update time threshold; if it is not less than, it indicates that the HTTP communication flow in the most effective service communication flow list tends to be stable, then parse out the HTTP communication flow in the most effective service communication flow list service type and service logo information, and establish identification rules. In the embodiment of the present invention, some of the most effective service communication flows are selected from a large number of communication flows to establish identification rules, thereby realizing the automatic identification of effective services in the HTTP communication flow in the internal network, which can be effectively performed without manual participation. Control HTTP communication flow in the internal network.

Description

A method and device for determining the service type of intranet HTTP communication flow

technical field

The invention relates to the technical field of communication, in particular to a method and a device for determining the service type of an intranet HTTP communication flow.

Background technique

At present, the identification of service types corresponding to HTTP (HyperText Transfer Protocol, hypertext transfer protocol) communication flow is more focused on the identification of public network traffic, and the HTTP communication flow in the intranet is very different, so it is currently possible to use it without manual participation. Generally, it can only identify the service type of the basic application protocol, such as identifying the HTTP communication flow in the intranet as a service of the HTTP upload protocol type, or identifying the HTTP communication flow in the intranet as a service of the HTTP download protocol type.

If you want to obtain accurate information about the service type corresponding to the HTTP communication flow in the intranet, you can generally choose to establish the identification rules between the HTTP communication flow and the service type in advance. If an identification rule between HTTP communication flow and service type is established for each HTTP communication flow, the number of identification rules in the application identification rule list will be large, so manual participation is generally required to remove some of them. Ineffective services, resulting in poor control of services in the intranet in the prior art without manual participation.

To sum up, the prior art cannot effectively control the HTTP communication flow in the internal network without manual participation, and it is difficult to identify the service type corresponding to the HTTP communication flow in the internal network.

Contents of the invention

The present invention provides a method and device for determining HTTP communication flow identification, which is used to solve the problem in the prior art that the HTTP communication flow in the internal network cannot be effectively controlled without manual participation, and the service type corresponding to the HTTP communication flow in the internal network is solved. Identify more difficult technical issues.

On the one hand, the embodiment of the present invention provides a method for determining the type of intranet HTTP communication flow service, including:

Analyzing the obtained HTTP communication flow to obtain the URL of the HTTP communication flow;

Judging whether the URL of the HTTP communication flow is the same as the URL stored in the preset position in the most effective service communication flow list, the most effective service communication flow list is obtained according to the top N URLs with the highest traffic ranking in the historical HTTP communication flow of;

If it is determined that the URL of the HTTP communication flow is identical to the URL stored in the preset position in the most effective service communication flow list, then it is judged whether the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold ;

If it is determined that the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold, then use the HTTP communication flow corresponding to the URL in the most effective service communication flow list as the target communication flow the target communication flow in the list;

For any target communication flow in the target communication flow list, analyze the target communication flow, obtain the identification rule of the service type and service identification information of the target communication flow, and add it to the application identification of the service identification information and service type The rule list, the service identification information and the service type application identification rule list are used to determine the service type of the HTTP communication flow to be identified for the HTTP communication flow to be identified.

Optionally, after obtaining the URL of the HTTP communication flow, it also includes:

Determine that the effective service communication flow list includes the service corresponding to the URL of the HTTP communication flow, and add one to the visit volume of the service corresponding to the URL of the HTTP communication flow in the effective service communication flow list, and the effective service communication flow The list is used to store the URLs of all valid service communication flows in the intranet and the visits of services corresponding to the URLs of all valid service communication flows.

Optionally, after obtaining the URL of the HTTP communication flow, it also includes:

Determining that the valid service communication flow list does not include the service corresponding to the URL of the HTTP communication flow, and determining that the service corresponding to the URL of the HTTP communication flow is a valid service, and combining the URL of the HTTP communication flow and the HTTP communication flow The service corresponding to the URL is added to the effective service communication flow list. The effective service refers to the service whose number of different visitors to the service is greater than the preset visitor threshold. The effective service communication flow list is used to store The URLs of all valid service communication flows in the network and the service visits corresponding to the URLs of all valid service communication flows.

Optionally, after determining that the URL of the HTTP communication flow is the same as the URL stored in a preset location in the most effective service communication flow list, the method further includes:

If it is determined that the difference between the current time and the update time of the most effective service communication flow list is less than the update time threshold, obtain the top N URLs with the highest traffic ranking in the effective service communication flow list as target URLs ;

If the obtained target URL is not exactly the same as the URL of the HTTP communication flow in the most effective service communication flow list, update the most effective service communication flow list according to the target URL, and update the most effective service communication flow list according to the current time Updating the update time of the most effective service communication flow list.

Optionally, before judging whether the URL of the HTTP communication flow is the same as the URL stored in a preset position in the most effective service communication flow list, it also includes:

It is determined that the service corresponding to the URL of the HTTP communication flow is not a noise service.

Optionally, if some or all of the following conditions are met, the service corresponding to the URL of the HTTP communication flow is determined to be a noise service:

The first request message of the HTTP communication flow includes request parameters, the URL of the HTTP communication flow includes preset abnormal characters, and the URL of the HTTP communication flow includes image type keywords.

Optionally, after parsing the target communication flow, obtaining the service type of the target communication flow and identification rules for service identification information and adding them to the list of application identification rules for service identification information and service types, the method further includes:

Obtain the first HTTP communication flow to be identified;

Parsing out the service identification information in the first HTTP communication flow to be identified;

The service type corresponding to the first HTTP communication flow to be identified is determined according to the service identification information and the application identification rule list of the service type.

Optionally, the parsing the target communication flow to obtain the identification rules of the service type and service identification information of the target communication flow includes:

Analyzing the target communication flow to obtain the response message and service identification information in the target communication flow;

Analyzing the response message to obtain the service type of the target communication flow;

According to the service type of the target communication flow and the service identification information, an identification rule for the service type of the target communication flow and the service identification information is obtained.

On the other hand, an embodiment of the present invention provides a device for determining the type of intranet HTTP communication flow service, including:

A parsing unit, configured to parse the obtained HTTP communication flow to obtain the URL of the HTTP communication flow;

A judging unit, configured to judge whether the URL of the HTTP communication flow is the same as the URL stored in a preset position in the most effective service communication flow list, the most effective service communication flow list is the highest ranking according to the historical HTTP communication flow The first N URLs are obtained; if it is determined that the URL of the HTTP communication flow is the same as the URL stored in the preset position in the most effective service communication flow list, then judge the difference between the current time and the update time of the most effective service communication flow list Whether the value is not less than the update time threshold;

A target communication flow determining unit, configured to match the URL in the most effective service communication flow list to The HTTP communication flow of is used as the target communication flow in the target communication flow list;

An identification rule setting unit, configured to analyze the target communication flow for any target communication flow in the target communication flow list, obtain the identification rules of the service type and service identification information of the target communication flow, and add them to the service identification Information and a service type application identification rule list, the service identification information and service type application identification rule list are used to determine the service type of the HTTP communication flow to be identified for the HTTP communication flow to be identified.

Optionally, the device further includes a traffic volume setting unit, configured to:

Determine that the effective service communication flow list includes the service corresponding to the URL of the HTTP communication flow, and add one to the visit volume of the service corresponding to the URL of the HTTP communication flow in the effective service communication flow list, and the effective service communication flow The list is used to store the URLs of all valid service communication flows in the intranet and the visits of services corresponding to the URLs of all valid service communication flows.

Optionally, the device further includes an effective service determination unit, configured to:

Determining that the valid service communication flow list does not include the service corresponding to the URL of the HTTP communication flow, and determining that the service corresponding to the URL of the HTTP communication flow is a valid service, and combining the URL of the HTTP communication flow and the HTTP communication flow The service corresponding to the URL is added to the effective service communication flow list. The effective service refers to the service whose number of different visitors to the service is greater than the preset visitor threshold. The effective service communication flow list is used to store The URLs of all valid service communication flows in the network and the service visits corresponding to the URLs of all valid service communication flows.

Optionally, the device further includes an updating unit, configured to:

If it is determined that the difference between the current time and the update time of the most effective service communication flow list is less than the update time threshold, obtain the top N URLs with the highest traffic ranking in the effective service communication flow list as target URLs ;

If the obtained target URL is not exactly the same as the URL of the HTTP communication flow in the most effective service communication flow list, update the most effective service communication flow list according to the target URL, and update the most effective service communication flow list according to the current time Updating the update time of the most effective service communication flow list.

Optionally, the device further includes a noisy service determination unit, configured to determine whether the URL of the HTTP communication flow is the same as the URL stored in a preset location in the most effective service communication flow list, before determining whether the URL of the HTTP communication flow is identical. The service corresponding to the URL is not a noise service.

Optionally, if some or all of the following conditions are met, the service corresponding to the URL of the HTTP communication flow is determined to be a noise service:

The first request message of the HTTP communication flow includes request parameters, the URL of the HTTP communication flow includes preset abnormal characters, and the URL of the HTTP communication flow includes image type keywords.

Optionally, the device further includes a service type identification unit, configured to:

Obtain the first HTTP communication flow to be identified;

Parsing out the service identification information in the first HTTP communication flow to be identified;

The service type corresponding to the first HTTP communication flow to be identified is determined according to the service identification information and the application identification rule list of the service type.

Optionally, the identification rule setting unit is specifically used for:

Analyzing the target communication flow to obtain the response message and service identification information in the target communication flow;

Analyzing the response message to obtain the service type of the target communication flow;

According to the service type of the target communication flow and the service identification information, an identification rule for the service type of the target communication flow and the service identification information is obtained.

In the embodiment of the present invention, the obtained HTTP communication flow is analyzed to obtain the URL of the HTTP communication flow, and whether the trigger condition is satisfied is determined by judging whether the URL of the HTTP communication flow is the same as the URL stored in a preset position in the most effective service communication flow list , if the trigger condition is met, it is judged whether the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold; if not, it indicates that the HTTP communication corresponding to the URL in the most effective service communication flow list The flow tends to be stable, and then the HTTP communication flow corresponding to the URL in the most effective service communication flow list is used as the target communication flow in the target communication flow list, and its service type and service mark information are parsed out, and the service mark information and service type are established identification rules. In the embodiment of the present invention, some of the most effective service communication flows are selected from a large number of communication flows to establish identification rules, thereby realizing the automatic identification of effective services in the HTTP communication flow in the internal network, which can be effectively performed without manual participation. Control HTTP communication flow in the internal network.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

Fig. 1 is a kind of flow chart of the method for determining intranet HTTP communication flow service type provided by the embodiment of the present invention;

Fig. 2 is a detailed flowchart of a method for determining the type of intranet HTTP communication flow service provided by an embodiment of the present invention;

FIG. 3 is a schematic diagram of an apparatus for determining an intranet HTTP communication flow service type provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The embodiments of the present invention will be further described in detail below in conjunction with the accompanying drawings.

In the internal network, the HTTP communication flow refers to the communication between the client and the server generated by HTTP protocol access. For example, if the client wants to request a certain service from the server (such as requesting financial statement services, etc.), then The client sends an HTTP request to the server to request services from the server. After receiving the HTTP request, the server will respond with the content corresponding to the requested service.

An HTTP communication flow generally includes the following information:

Destination IP (Internet Protocol, the protocol for interconnection between networks): indicates the IP information of the server providing the service;

Source IP: Indicates the IP information of the visitor's client;

URL (Uniform Resoure Locator, Uniform Resource Locator): Indicates the address information of the service to be requested, which can be parsed from the HTTP communication flow;

In order to determine the type of service corresponding to the URL in an HTTP communication flow (also called the service type corresponding to the HTTP communication flow), for example, the service type corresponding to HTTP communication flow A is financial report service, and the corresponding service type of HTTP communication flow B The service type is Payroll Report Service, etc.

Specifically, the following methods can be used to obtain the service type corresponding to the URL in an HTTP communication flow:

Through analysis, it is found that the source code of the front page corresponding to most services contains <title> information, which can effectively describe the service information provided by the service page and determine the service type. In the HTTP communication flow, the <title> information is generally included in the response message, so the embodiment of the present invention chooses to obtain the <title> information to complete the determination of the service type by analyzing the response message in the HTTP communication flow.

For example, by parsing the response message in the HTTP communication flow C, it is obtained that its service type is performance report service.

Therefore, if you want to get the service type corresponding to an HTTP communication flow, you can get it by parsing the response message. However, in practical applications, due to the low efficiency of analyzing the HTTP communication flow in real time to obtain the corresponding service type, and it is impossible to do application control, So you can choose to implement a list of application identification rules for establishing HTTP streams and service types. .

That is, by analyzing the HTTP communication flow, the response message and service identification information in the HTTP communication flow are obtained; the response message is analyzed to obtain the service type of the HTTP communication flow; according to the service type and service identification information of the HTTP communication flow, the HTTP The service type of the communication flow and the identification rule of the service identification information.

Among them, to establish the identification rule between HTTP communication flow and service type, you can generally choose to establish an identification rule between HTTP communication flow and service type for each HTTP communication flow. For example, there are 1 If there are 10,000 HTTP communication flows (that is, the URLs and service types corresponding to these 10,000 HTTP communication flows are different), it is necessary to establish 10,000 identification rules for HTTP communication flows and service types. Obviously, this method consumes more resources. , especially when some HTTP communication flow and service type identification rules are rarely used, establishing a large number of identification rules will lead to excessive system resources, and if too many services are collected, effective services will be obliterated In a large number of invalid services, it makes it difficult for users to use this function.

Below in conjunction with accompanying drawing 1, provide a method for determining the service type corresponding to the HTTP communication flow, as shown in Figure 1, the method for determining the service type of the intranet HTTP communication flow provided by the embodiment of the present invention includes:

Step 101, analyzing the acquired HTTP communication flow to obtain the URL of the HTTP communication flow;

Step 102, judging whether the URL of the HTTP communication flow is the same as the URL stored in the preset position in the most effective service communication flow list, the most effective service communication flow list is the top N with the highest number of visits in the historical HTTP communication flow obtained from a URL;

Step 103, if it is determined that the URL of the HTTP communication flow is the same as the URL stored in the preset position in the most effective service communication flow list, then determine whether the difference between the current time and the update time of the most effective service communication flow list is not less than update time threshold;

Step 104: If it is determined that the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold, then use the HTTP communication flow corresponding to the URL in the most effective service communication flow list as the target communication flow in the target communication flow list;

Step 105: For any target communication flow in the target communication flow list, analyze the target communication flow, obtain the service type and service identification information identification rules of the target communication flow, and add them to the service identification information and service type The application identification rule list of the service identification information and the service type application identification rule list are used to determine the service type of the HTTP communication flow to be identified for the HTTP communication flow to be identified.

In the above step 101, the acquired HTTP communication flow is firstly parsed to obtain the URL of the HTTP communication flow.

Generally, the URL can be obtained by parsing the first request message of the HTTP communication flow, and a URL is used to indicate the address of the service to be requested, that is, there is a one-to-one correspondence between a URL and a service.

There are a lot of HTTP communication flows in the intranet. Here, the embodiment of the present invention pre-sets a list of the most effective service communication flows. The top N URLs, that is, the most effective service communication flow list stores the top N URLs with the highest number of visits.

For example, suppose there are 10,000 HTTP communication flows in the intranet, and the value of N is 20, and URLs corresponding to the top 20 HTTP communication flows corresponding to the URLs of the HTTP communication flows are stored in the last List of valid service communication flows.

Optionally, an effective service communication flow list can be established again, and the effective service communication flow list is used to store the URLs of all effective service communication flows in the intranet and the service traffic corresponding to the URLs of all effective service communication flows, so that In the above step 101, after obtaining the URL of the HTTP communication flow, if it is determined that the valid service communication flow list does not include the service corresponding to the URL of the HTTP communication flow, and it is determined that the service corresponding to the URL of the HTTP communication flow is valid service, add the URL of the HTTP communication flow and the service corresponding to the URL of the HTTP communication flow to the effective service communication flow list.

Wherein, the valid service refers to a service for which the number of different visitors to the service is greater than a preset visitor threshold. For example, the service corresponding to the URL of an HTTP communication flow has a total of 100 different visitors (you can use the access IP to distinguish different visitors), and the visitor threshold is 80, then the service corresponding to the URL of the HTTP communication flow can be identified If it is an effective service, when the service corresponding to the URL of the HTTP communication flow is not included in the current effective service communication flow list, the URL of the HTTP communication flow and the service corresponding to the URL of the HTTP communication flow are added to the effective service communication flow list.

Of course, if it is determined that the valid service communication flow list includes the service corresponding to the URL of the HTTP communication flow, then add one to the visit volume of the service corresponding to the URL of the HTTP communication flow in the valid service communication flow list.

Therefore, there are two communication flow lists in the embodiment of the present invention, one is an effective service communication flow list, which is used to store the URLs of all effective service communication flows in the intranet and the services corresponding to the URLs, and the other is the most effective service communication flow list , which is used to store the URLs of the top N HTTP communication flows corresponding to the services in the list of valid service communication flows.

Therefore, in the embodiment of the present invention, it is finally necessary to establish identification rules between HTTP communication flows and service types for the HTTP communication flows corresponding to the N URLs in the most effective service communication flow list, thereby reducing the number of establishment of identification rules, And the most effective service can be obtained, and the most effective service can be prevented from being buried in services that a large number of users do not pay attention to. .

The above effective service communication flow list stores the URLs of all effective service communication flows in the intranet and the visits of the services corresponding to the URLs. Among them, the effective service refers to the non-noise service. For the noise service, there are many ways to define it. Define according to actual needs. Here is a way to determine whether a service is valid or noisy:

Optionally, if some or all of the following conditions are met, the service corresponding to the URL of the HTTP communication flow is determined to be a noise service: the first request message of the HTTP communication flow contains request parameters, the HTTP communication flow The URL of the URL contains preset abnormal characters, and the URL of the HTTP communication stream contains preset type keywords such as pictures.

There are many HTTP communication flows in the internal network, which may only correspond to operations such as image acquisition and page refresh under the service. The analysis of these HTTP communication flows will not only fail to increase the acquisition of intranet service information, but will increase the search for service information. Therefore, it is determined that the URLs obtained by parsing these HTTP streams correspond to noise services. In order to filter these HTTP streams, services that meet the following conditions are therefore identified as bit noise services:

1) There may be multiple requests in an HTTP stream to obtain multiple resources under the same service, and the first request message usually contains the general information of these requested resources under this service, so set the URL from the HTTP stream If the first request message of the HTTP flow contains request parameters, it is determined that the resource corresponding to the request is not the information of the service link, and the service corresponding to this type of HTTP communication flow is determined to be a noise service.

2) If the URL of the HTTP communication flow contains image type keywords, such as ".jpg", etc., it means that the HTTP flow is used to obtain image resources under the service, so the service corresponding to this type of HTTP communication flow is determined as noise Serve.

3) If the URL of the HTTP communication flow contains abnormal characters, such as "%", it means that the parsed URL cannot effectively correspond to a service, so the service corresponding to this type of HTTP communication flow is determined to be a noise service.

Henceforth, in the embodiment of the present invention, when acquiring an HTTP communication flow, if it is determined that the service corresponding to the URL of the HTTP communication flow is not a noise service, then the visit amount of the service corresponding to the URL of the HTTP communication flow is increased by one .

Then, in the above step 102, the URL of the HTTP communication flow is compared with the URL stored in the preset position in the most effective service communication flow list, and it is judged that the URL of the HTTP communication flow is the same as that preset in the most effective service communication flow list. Set whether the URLs stored in the location are the same. If they are the same, it will trigger the convergence judgment of the most effective service communication flow list on the intranet. The convergence of the most effective service communication flow list means that the most effective service communication flow list remains unchanged for a period of time , then it is considered that the service corresponding to the URL in the most effective service communication flow list is the most effective service, that is, the service with the highest number of visits.

In the above step 103, if it is determined that the URL of the HTTP communication flow is the same as the URL stored in the preset position in the most effective service communication flow list, then it is judged whether the difference between the current time and the update time of the most effective service communication flow list is Not less than the update time threshold.

The reason why it is judged whether the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold is based on a premise that if the most effective service communication flow list exceeds a certain period of time (that is, the update time Threshold) does not update, then it is considered that the most effective service communication flow list tends to be stable, then in step 104, the HTTP communication flow corresponding to the URL in the most effective service communication flow list is used as the target in the target communication flow list communication flow; then in step 105, for any target communication flow in the target communication flow list, analyze the target communication flow, obtain the service type and identification rules of service identification information of the target communication flow and add them to The service identification information and the application identification rule list of the service type are used to determine the service type of the HTTP communication flow to be identified for the HTTP communication flow to be identified.

Of course, if the difference between the current time and the update time of the most effective service communication flow list is less than the update time threshold, it is necessary to further determine whether the most effective service communication flow list can be updated, specifically, to obtain the effective service communication flow list The top N URLs with the highest number of visits are used as target URLs; if the acquired target URL is not exactly the same as the URL of the HTTP communication flow in the most effective service communication flow list, then according to the target URL, update all The most effective service communication flow list, and update the update time of the most effective service communication flow list according to the current time.

The implementation method of the above steps 101 to 105 will be described below in conjunction with a specific example. Suppose there are a total of 10,000 historical HTTP communication flows in the intranet, corresponding to a total of 10,000 services. Among them, the effective service communication flow list stores the 10,000 historical HTTP communications and the visits of services corresponding to each HTTP communication flow. For any of the 10,000 HTTP communication flows, if it is determined that the service corresponding to the HTTP communication flow is not a noise service, Then judge whether the URL of the HTTP communication flow is the same as the URL in the preset position (for example, the 5th position) of the most effective service communication flow list; becoming steady):

Convergence Judgment: Judging the relationship between the difference between the current time and the update time of the most effective service communication flow list and the update time threshold:

Case 1: The difference between the current time and the update time of the most effective service communication flow list is greater than or equal to the update time threshold

It indicates that the most effective service communication flow list is within the update time threshold. For example, if the update time threshold is set to 1 hour, it indicates that the most effective service communication flow list has not been updated within one hour. At this time, the most effective service communication flow list is considered Tend to convergence, then use the HTTP communication flow corresponding to the URL in the most effective service communication flow list as the target communication flow in the target communication flow list, and then analyze the target communication flow to obtain the service type and service of the target communication flow Identification information identification rules are added to the list of application identification rules for service identification information and service types.

That is, in the embodiment of the present invention, a certain number of HTTP communication streams corresponding to the most effective services are first screened out, and then these HTTP communication streams are analyzed to obtain the service type and service identification information, and establish identification rules for the service type and service identification information . Wherein, the service identification information can be represented by URL, and of course, it can also be represented by other means, for example, the service identification information can be represented by using information such as the URL of the HTTP communication flow and the request method as a whole. The specific form is not limited.

Scenario 2: The difference between the current time and the update time of the most effective service communication flow list is less than the update time threshold

It shows that the most effective service communication flow list has not tended to be stable and convergent, therefore, it is necessary to further judge whether the most effective service communication flow list can be updated, specifically, the top N most visited traffic flow list in the effective service communication flow list can be obtained URL as the target URL, if it is determined that the target URL is not exactly the same as the URL of the HTTP communication flow in the most effective service communication flow list, then according to the target URL, update the most effective service communication flow list, and according to The update time of the most effective service communication flow list is updated by the current time.

If it is determined that the target URL is exactly the same as the URL of the HTTP communication flow in the most effective service communication flow list, then do nothing, that is, neither update the most effective service communication flow list nor update the most effective service communication flow list. The update time of the service traffic list.

Therefore, through the above method, a part of HTTP communication flows corresponding to the most effective services are selected from a large number of HTTP communication flows in the intranet, and then the identification rules between these HTTP communication flows and service types are established, and after obtaining the service identification information After the application identification rule list and service type, the rule list can be used to determine the category of a newly acquired first HTTP communication flow to be identified, specifically:

Obtaining the first HTTP communication flow to be identified; parsing out the service identification information in the first HTTP communication flow to be identified; determining the first HTTP communication to be identified according to the service identification information and the application identification rule list of the service type The service type corresponding to the stream.

Wherein, the first HTTP communication flow to be identified refers to any intranet HTTP communication flow. After obtaining the HTTP communication flow, the first HTTP communication flow is determined according to the established service identification information and service type application identification rule list. The service type corresponding to the HTTP communication flow to be identified.

Of course, since only part of the service identification information and service type identification rules are stored in the service identification information and service type application identification rule list, there is also a situation where the service type corresponding to the first HTTP communication flow to be identified cannot be identified, but this This probability is relatively low. Therefore, in the embodiment of the present invention, on the basis of establishing fewer identification rules for HTTP communication flows and service types, it is guaranteed to determine the service type corresponding to an HTTP communication flow to be identified with a relatively high probability. It has good practical application performance.

In the embodiment of the present invention, the obtained HTTP communication flow is analyzed to obtain the URL of the HTTP communication flow, and whether the trigger condition is satisfied is determined by judging whether the URL of the HTTP communication flow is the same as the URL stored in a preset position in the most effective service communication flow list , if the trigger condition is met, it is judged whether the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold; if not, it indicates that the HTTP communication corresponding to the URL in the most effective service communication flow list The flow tends to be stable, and then the HTTP communication flow corresponding to the URL in the most effective service communication flow list is used as the target communication flow in the target communication flow list, and its service type and service mark information are parsed out, and the service mark information and service type are established identification rules. In the embodiment of the present invention, some of the most effective service communication flows are selected from a large number of communication flows to establish identification rules, thereby realizing the automatic identification of effective services in the HTTP communication flow in the internal network, which can be effectively performed without manual participation. Control HTTP communication flow in the internal network.

The method for determining the intranet HTTP communication flow service type provided by the embodiment of the present invention is described in detail below, as shown in FIG. 2 , including:

Step 201, analyzing the acquired HTTP communication flow to obtain the URL of the HTTP communication flow;

Step 202: Add one to the visit volume of the service corresponding to the URL of the HTTP communication flow in the effective service communication flow list, and the effective service communication flow list is used to store URLs of all effective service communication flows in the intranet and all effective services The visit volume of the service corresponding to the URL of the communication flow;

Step 203, determine whether the service corresponding to the URL is a noise service, if so, end the process, if not, then go to step 204;

Step 204, judging whether the URL of the HTTP communication flow is the same as the URL stored in the preset position in the most effective service communication flow list, if they are the same, then go to step 205, if not, then end the process;

Step 205, judging whether the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold, if yes, go to step 206, otherwise go to step 208;

Step 206, the HTTP communication flow corresponding to the URL in the most effective service communication flow list is used as the target communication flow in the target communication flow list;

Step 207: For any target communication flow in the target communication flow list, analyze the target communication flow, obtain the service type and service identification information identification rules of the target communication flow, and add them to the service identification information and service type A list of application identification rules, the service identification information and the application identification rule list of the service type are used to determine the service type of the HTTP communication flow to be identified for the HTTP communication flow to be identified;

Step 208. Obtain the top N URLs with the highest number of visits in the effective service communication flow list as target URLs;

Step 209, judging whether the obtained target URL is not exactly the same as the URL of the HTTP communication flow in the most effective service communication flow list, if not completely the same, then go to step 210, if they are completely the same, then end the process;

Step 210: Update the most effective service communication flow list according to the target URL, and update the update time of the most effective service communication flow list according to the current time.

In the embodiment of the present invention, the obtained HTTP communication flow is analyzed to obtain the URL of the HTTP communication flow, and whether the trigger condition is satisfied is determined by judging whether the URL of the HTTP communication flow is the same as the URL stored in a preset position in the most effective service communication flow list , if the trigger condition is met, it is judged whether the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold; if not, it indicates that the HTTP communication corresponding to the URL in the most effective service communication flow list The flow tends to be stable, and then the HTTP communication flow corresponding to the URL in the most effective service communication flow list is used as the target communication flow in the target communication flow list, and its service type and service mark information are parsed out, and the service mark information and service type are established identification rules. In the embodiment of the present invention, some of the most effective service communication flows are selected from a large number of communication flows to establish identification rules, thereby realizing the automatic identification of effective services in the HTTP communication flow in the internal network, which can be effectively performed without manual participation. Control HTTP communication flow in the internal network.

Based on the same technical concept, the embodiment of the present invention also provides a device for determining the type of intranet HTTP communication flow service, as shown in Figure 3, including:

The parsing unit 301 is configured to parse the obtained HTTP communication flow to obtain the URL of the HTTP communication flow;

A judging unit 302, configured to judge whether the URL of the HTTP communication flow is the same as the URL stored in a preset location in the most effective service communication flow list, the most effective service communication flow list is ranked the highest according to the number of visits in the historical HTTP communication flow If it is determined that the URL of the HTTP communication flow is the same as the URL stored in the preset location in the most effective service communication flow list, then determine the difference between the current time and the update time of the most effective service communication flow list Whether the difference is not less than the update time threshold;

The target communication flow determining unit 303 is configured to add the URL in the most effective service communication flow list to The corresponding HTTP communication flow is used as the target communication flow in the target communication flow list;

The identification rule setting unit 304 is configured to analyze the target communication flow for any target communication flow in the target communication flow list, obtain the identification rule of the service type and service identification information of the target communication flow, and add it to the service The identification information and the application identification rule list of the service type are used to determine the service type of the HTTP communication flow to be identified for the HTTP communication flow to be identified.

Optionally, the device further includes a traffic volume setting unit 305, configured to:

Determine that the effective service communication flow list includes the service corresponding to the URL of the HTTP communication flow, and add one to the visit volume of the service corresponding to the URL of the HTTP communication flow in the effective service communication flow list, and the effective service communication flow The list is used to store the URLs of all valid service communication flows in the intranet and the visits of services corresponding to the URLs of all valid service communication flows.

Optionally, the device further includes a valid service determining unit 306, configured to:

Determining that the valid service communication flow list does not include the service corresponding to the URL of the HTTP communication flow, and determining that the service corresponding to the URL of the HTTP communication flow is a valid service, and combining the URL of the HTTP communication flow and the HTTP communication flow The service corresponding to the URL is added to the effective service communication flow list. The effective service refers to the service whose number of different visitors to the service is greater than the preset visitor threshold. The effective service communication flow list is used to store The URLs of all valid service communication flows in the network and the service visits corresponding to the URLs of all valid service communication flows.

Optionally, the device further includes an updating unit 307, configured to:

If it is determined that the difference between the current time and the update time of the most effective service communication flow list is less than the update time threshold, obtain the top N URLs with the highest traffic ranking in the effective service communication flow list as target URLs ;

If the obtained target URL is not exactly the same as the URL of the HTTP communication flow in the most effective service communication flow list, update the most effective service communication flow list according to the target URL, and update the most effective service communication flow list according to the current time Updating the update time of the most effective service communication flow list.

Optionally, the device further includes a noisy service determining unit 308, configured to determine whether the URL of the HTTP communication flow is the same as the URL stored in a preset location in the most effective service communication flow list, before determining whether the HTTP communication flow The service corresponding to the URL is not a noise service.

Optionally, if some or all of the following conditions are met, the service corresponding to the URL of the HTTP communication flow is determined to be a noise service:

The first request message of the HTTP communication flow includes request parameters, the URL of the HTTP communication flow includes preset abnormal characters, and the URL of the HTTP communication flow includes image type keywords.

Optionally, the device further includes a service type identifying unit 309, configured to:

Obtain the first HTTP communication flow to be identified;

Parsing out the service identification information in the first HTTP communication flow to be identified;

The service type corresponding to the first HTTP communication flow to be identified is determined according to the service identification information and the application identification rule list of the service type.

Optionally, the identification rule setting unit 304 is specifically configured to:

Analyzing the target communication flow to obtain the response message and service identification information in the target communication flow;

Analyzing the response message to obtain the service type of the target communication flow;

According to the service type of the target communication flow and the service identification information, an identification rule for the service type of the target communication flow and the service identification information is obtained.

In the embodiment of the present invention, the obtained HTTP communication flow is analyzed to obtain the URL of the HTTP communication flow, and whether the trigger condition is satisfied is determined by judging whether the URL of the HTTP communication flow is the same as the URL stored in a preset position in the most effective service communication flow list , if the trigger condition is met, it is judged whether the difference between the current time and the update time of the most effective service communication flow list is not less than the update time threshold; if not, it indicates that the HTTP communication corresponding to the URL in the most effective service communication flow list The flow tends to be stable, and then the HTTP communication flow corresponding to the URL in the most effective service communication flow list is used as the target communication flow in the target communication flow list, and its service type and service mark information are parsed out, and the service mark information and service type are established identification rules. In the embodiment of the present invention, some of the most effective service communication flows are selected from a large number of communication flows to establish identification rules, thereby realizing the automatic identification of effective services in the HTTP communication flow in the internal network, which can be effectively performed without manual participation. Control HTTP communication flow in the internal network.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the present invention have been described, additional changes and modifications can be made to these embodiments by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies thereof, the present invention also intends to include these modifications and variations.

Claims (14)

1. a kind of method of determining Intranet hypertext transfer protocol http communication stream service type characterized by comprising

The http communication stream obtained is parsed, the uniform resource position mark URL of the http communication stream is obtained；

Judge whether the URL of the http communication stream and the URL that predeterminated position in most effective communication for service stream list stores are identical, The most effective communication for service stream list is to be obtained according to the top ranked top n URL of amount of access in history http communication stream；

If it is determined that the URL of the http communication stream is identical as the URL that predeterminated position in most effective communication for service stream list stores, then Judge whether the difference of the renewal time of current time and the most effective communication for service stream list is not less than renewal time threshold value；

If it is determined that the difference of the renewal time of the current time and the most effective communication for service stream list not less than it is described more New time threshold is then arranged the corresponding http communication stream of URL in the most effective communication for service stream list as destinations traffic stream Destinations traffic stream in table；

For any one destinations traffic stream in the destinations traffic stream list, the destinations traffic stream is parsed, the mesh is obtained It marks the service type of communication stream and the recognition rule of service identity information and is added to answering for service identity information and service type With recognition rule list, the application recognition rule list of the service identity information and service type is used to be HTTP to be identified Communication stream determines the service type of the http communication stream to be identified；

The URL of the determination http communication stream is identical as the URL that predeterminated position in most effective communication for service stream list stores Later, further includes:

If it is determined that the difference of the renewal time of the current time and the most effective communication for service stream list is less than the update Time threshold then obtains amount of access is top ranked in effective communication for service stream list top n URL as target URL；

If the incomplete phase of URL of the target URL and the http communication stream in the most effective communication for service stream list obtained Together, then the most effective communication for service stream list is updated according to the target URL, and institute is updated according to the current time State the renewal time of most effective communication for service stream list.

2. the method as described in claim 1, which is characterized in that after the URL for obtaining the http communication stream, also wrap It includes:

Determine that effective communication for service stream list includes the corresponding service of URL of the http communication stream, and by effective service The amount of access of the corresponding service of the URL of http communication stream described in communication stream list adds one, effective communication for service stream list The visit of the corresponding service of URL of URL and all effective communication for service streams for effective communication for service streams all in storing intranet The amount of asking.

3. the method as described in claim 1, which is characterized in that after the URL for obtaining the http communication stream, also wrap It includes:

It determines that effective communication for service stream list does not include the corresponding service of URL of the http communication stream, and determines the HTTP The corresponding service of the URL of communication stream is effectively to service, and by the URL of the http communication stream and URL of the http communication stream Corresponding service is added to effective communication for service stream list, and effective service refers to the different visitors' of service Quantity is greater than the service of the amount threshold of default visitor, and effective communication for service stream list has for all in storing intranet Imitate the corresponding service of URL of the URL and all effective communication for service streams of communication for service stream.

4. method as claimed in any one of claims 1-3, which is characterized in that judge the URL of the http communication stream with most Before whether the URL of predeterminated position storage is identical in effective communication for service stream list, further includes:

Determine that the corresponding service of the URL of the http communication stream is not noise service.

5. method as claimed in claim 4, which is characterized in that if meeting following part or all of condition, by the HTTP The corresponding service of the URL of communication stream is determined as noise service:

It include in the URL of required parameter, the http communication stream in the first request message of the http communication stream comprising default Unusual character, the http communication stream URL in include picture type keyword.

6. method as claimed in any one of claims 1-3, which is characterized in that the parsing destinations traffic stream obtains The service type of the destinations traffic stream and the recognition rule of service identity information are simultaneously added to service identity information and service class After the application recognition rule list of type, further includes:

Obtain the first http communication stream to be identified；

Parse the service identity information in the described first http communication stream to be identified；

According to the application recognition rule list of the service identity information and service type, determine that the described first HTTP to be identified is logical Service type corresponding to letter flow.

7. method as claimed in any one of claims 1-3, which is characterized in that the parsing destinations traffic stream obtains The service type of the destinations traffic stream and the recognition rule of service identity information, comprising:

The destinations traffic stream is parsed, the back message and service identity information in the destinations traffic stream are obtained；

The back message is parsed, the service type of the destinations traffic stream is obtained；

According to the service type of the destinations traffic stream and the service identity information, the service class of the destinations traffic stream is obtained The recognition rule of type and service identity information.

8. a kind of device of determining Intranet http communication stream service type characterized by comprising

Resolution unit obtains the URL of the http communication stream for parsing the http communication stream obtained；

Judging unit, for judging that the URL of the http communication stream is stored with predeterminated position in most effective communication for service stream list URL it is whether identical, the most effective communication for service stream list be according to amount of access in history http communication stream it is top ranked Top n URL is obtained；If it is determined that predeterminated position stores in the URL of the http communication stream and most effective communication for service stream list URL it is identical, then judge whether current time and the difference of the renewal time of the most effective communication for service stream list are not less than Renewal time threshold value；

Destinations traffic stream determination unit, for if it is determined that the current time and the most effective communication for service stream list update The difference of time is not less than the renewal time threshold value, then by the corresponding HTTP of URL in the most effective communication for service stream list Communication stream is as the destinations traffic stream in destinations traffic stream list；

Recognition rule setting unit, for for any one destinations traffic stream in the destinations traffic stream list, described in parsing Destinations traffic stream obtains the service type of the destinations traffic stream and the recognition rule of service identity information and is added to service mark The application recognition rule of the application recognition rule list of knowledge information and service type, the service identity information and service type arranges Table is used to determine the service type of the http communication stream to be identified for http communication stream to be identified；

Updating unit is used for: if it is determined that the difference of the renewal time of the current time and the most effective communication for service stream list Value is less than the renewal time threshold value, then obtains the top n URL that amount of access is top ranked in effective communication for service stream list As target URL；If the URL of the http communication stream in the target URL obtained and the most effective communication for service stream list It is not exactly the same, then according to the target URL, update the most effective communication for service stream list, and according to it is described current when Between update renewal time of the most effective communication for service stream list.

9. device as claimed in claim 8, which is characterized in that described device further includes amount of access setting unit, is used for:

Determine that effective communication for service stream list includes the corresponding service of URL of the http communication stream, and by effective service The amount of access of the corresponding service of the URL of http communication stream described in communication stream list adds one, effective communication for service stream list The visit of the corresponding service of URL of URL and all effective communication for service streams for effective communication for service streams all in storing intranet The amount of asking.

10. device as claimed in claim 9, which is characterized in that described device further includes effective service determination unit, is used for:

It determines that effective communication for service stream list does not include the corresponding service of URL of the http communication stream, and determines the HTTP The corresponding service of the URL of communication stream is effectively to service, and by the URL of the http communication stream and URL of the http communication stream Corresponding service is added to effective communication for service stream list, and effective service refers to the different visitors' of service Quantity is greater than the service of the amount threshold of default visitor, and effective communication for service stream list has for all in storing intranet Imitate the amount of access of the corresponding service of URL of the URL and all effective communication for service streams of communication for service stream.

11. the device as described in any one of claim 8-10, which is characterized in that described device further includes that noise service determines Unit, the URL for storing in the URL for judging the http communication stream with predeterminated position in most effective communication for service stream list are It is no it is identical before, determine the URL of the http communication stream it is corresponding service be not noise service.

12. device as claimed in claim 8, which is characterized in that if meeting following part or all of condition, by the HTTP The corresponding service of the URL of communication stream is determined as noise service:

It include in the URL of required parameter, the http communication stream in the first request message of the http communication stream comprising default Unusual character, the http communication stream URL in include picture type keyword.

13. the device as described in any one of claim 8-10, which is characterized in that described device further includes service type identification Unit is used for:

Obtain the first http communication stream to be identified；

Parse the service identity information in the described first http communication stream to be identified；

According to the application recognition rule list of the service identity information and service type, determine that the described first HTTP to be identified is logical Service type corresponding to letter flow.

14. the device as described in any one of claim 8-10, which is characterized in that the recognition rule setting unit, specifically For:

The destinations traffic stream is parsed, the back message and service identity information in the destinations traffic stream are obtained；

The back message is parsed, the service type of the destinations traffic stream is obtained；

According to the service type of the destinations traffic stream and the service identity information, the service class of the destinations traffic stream is obtained The recognition rule of type and service identity information.