CN116248471A - Flow detection system, method, device and storage medium thereof - Google Patents

Abstract

The present application relates to the technical field of communications, and in particular to a traffic detection system, method, device and storage medium thereof, capable of effectively detecting IP addresses. The method includes: identifying the flow label of the data flow; the flow label is any one of the inbound flow label and the outbound flow label; in the case that the flow label is the inbound flow label, determining the destination IP address of the data flow; determining Whether the destination IP address is a filing IP address; if the traffic label is an outbound traffic label, determine the source IP address of the data traffic; determine whether the source IP address is a filing IP address. This application is used in the flow detection process.

Description

Flow detection system, method, device and storage medium thereof

technical field

The present application relates to the technical field of communication, and in particular to a flow detection system, method, device and storage medium thereof.

Background technique

In related technologies, Internet Protocol (IP) addresses for Internet Data Centers (Internet Data Centers, IDCs) or Internet Service Providers (Internet Service Providers, ISPs) cannot be effectively monitored, and it is easy for alarm devices to record addresses for users. The problem of misstatement. Therefore, how to effectively detect the IP address is an urgent problem to be solved at present.

Contents of the invention

The present application provides a traffic detection system, method, device and storage medium thereof, capable of effectively detecting IP addresses.

In order to achieve the above object, the application adopts the following technical solutions:

In the first aspect, the present application provides a traffic detection system, which includes: a core router CR, an Internet data center IDC device, a converging and distributing device, and an execution unit EU; Mutual forwarding of data; the aggregation and distribution device accesses the communication link between the CR and the IDC device through the optical splitter; the aggregation and distribution device is configured to: obtain the first data flow forwarded between the CR and the IDC device; according to the preset Layer 2 The message policy adds a label to the first data flow, generates a second data flow, and sends the second data flow to the execution unit EU; the execution unit EU is configured to: receive the second data flow, and determine the flow label of the second data flow; The traffic label is any one of the inbound traffic label and the outbound traffic label; if the traffic label is the inbound traffic label, determine the destination IP address of the data traffic; determine whether the destination IP address is the filing IP address; If the label is an outbound traffic label, determine the source IP address of the data traffic; determine whether the source IP address is the record IP address.

In combination with the first aspect, in a possible implementation manner, the system further includes: an alarm output device; the EU is further configured to: generate alarm information when the destination IP address or the source IP address is not the filing IP address; Send alarm information to an alarm output device; the alarm output device is also configured to: output alarm information.

In the second aspect, the present application provides a flow detection method, the method includes: identifying the flow label of the data flow; the flow label is any one of the flow label in the inbound direction and the flow label in the outbound direction; In this case, determine the destination IP address of the data traffic; determine whether the destination IP address is the filing IP address; if the traffic label is the outbound traffic label, determine the source IP address of the data traffic; determine whether the source IP address is the filing IP address .

With reference to the second aspect, in a possible implementation manner, the traffic label is a label added to the data traffic according to a preset Layer 2 packet policy after the convergence and distribution device acquires the data traffic.

With reference to the second aspect, in a possible implementation manner, the method further includes: generating alarm information when the destination IP address or the source IP address is not the record IP address; and sending the alarm information to an alarm output device.

In a third aspect, the present application provides a flow detection device, which includes: the device includes: a processing unit; the processing unit is used to identify the flow label of the data flow; the flow label is any one of the inbound flow label and the outbound flow label One item; when the flow label is an inbound flow label, the processing unit is also used to determine the destination IP address of the data flow; the processing unit is also used to determine whether the destination IP address is an IP address for filing; In the case of a direction flow label, the processing unit is also used to determine the source IP address of the data flow; the processing unit is also used to determine whether the source IP address is a filing IP address.

In combination with the third aspect, in a possible implementation manner, the traffic label is a label added to the data traffic according to a preset Layer 2 packet policy after the convergence and distribution device obtains the data traffic.

In combination with the third aspect, in a possible implementation manner, the device further includes: a communication unit; when the destination IP address or the source IP address is not the record IP address, the processing unit is also used to generate alarm information; the communication unit , used to send alarm information to the alarm output device.

In a fourth aspect, the present application provides a flow detection device, which includes: a processor and a communication interface; the communication interface is coupled to the processor, and the processor is used to run computer programs or instructions to achieve the second aspect and the second aspect The traffic detection method described in any possible implementation manner of .

In the fifth aspect, the present application provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the instructions are run on the terminal, the terminal executes any one of the second aspect and the second aspect. The flow detection method described in the implementation of .

In this application, the names of the above-mentioned flow detection devices do not limit the equipment or functional modules themselves. In actual implementation, these equipment or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of the present application, they fall within the scope of the claims of the present application and their equivalent technologies.

These or other aspects of the present application will be more clearly understood in the following description.

Based on the above technical solution, the flow detection method provided by the embodiment of the present application uses the flow detection device to identify the flow label of the data flow. If the flow label is an inbound flow label, the destination IP address of the data flow is determined, and the flow detection device determines the destination again. Whether the IP address belongs to the record IP address, if the traffic label is the outbound traffic label, then determine the source IP address of the data flow, and then the traffic detection device determines whether the source IP address belongs to the record IP address, which can effectively detect the IP address and avoid alarm equipment The problem of misreporting the user's filing address.

Description of drawings

Fig. 1 is a schematic structural diagram of a flow detection device provided by the present application;

Fig. 2 is a schematic diagram of a flow detection system provided by the present application;

Fig. 3 is a flow chart of a flow detection method provided by the present application;

FIG. 4 is a flow chart of another flow detection method provided by the present application;

FIG. 5 is a schematic structural diagram of a flow detection device provided by the present application;

FIG. 6 is a schematic structural diagram of another flow detection device provided by the present application.

Detailed ways

A flow detection system, method, device and storage medium thereof provided in the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

The term "and/or" in this article is just an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B can mean: A exists alone, A and B exist simultaneously, and there exists alone B these three situations.

The terms "first" and "second" in the specification and drawings of the present application are used to distinguish different objects, or to distinguish different processes for the same object, rather than to describe a specific sequence of objects.

In addition, the terms "including" and "having" mentioned in the description of the present application and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes other unlisted steps or units, or optionally also includes Other steps or elements inherent to the process, method, product or apparatus are included.

It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used as examples, illustrations or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present application shall not be interpreted as being more preferred or more advantageous than other embodiments or design schemes. Rather, the use of words such as "exemplary" or "such as" is intended to present related concepts in a concrete manner.

Figure 1 is a schematic structural diagram of a flow detection device provided by the embodiment of the present application. As shown in Figure 1, the flow detection device 100 includes at least one processor 101, a communication line 102, and at least one communication interface 104, and may also include memory 103. Wherein, the processor 101 , the memory 103 and the communication interface 104 may be connected through a communication line 102 .

The processor 101 may be a central processing unit (central processing unit, CPU), or a specific integrated circuit (application specific integrated circuit, ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, For example: one or more digital signal processors (digital signal processor, DSP), or one or more field programmable gate arrays (field programmable gate array, FPGA).

Communication line 102 may include a path for communicating information between the above-described components.

The communication interface 104 is used to communicate with other devices or communication networks, and any device such as a transceiver can be used, such as Ethernet, radio access network (radio access network, RAN), wireless local area network (wireless local area networks, WLAN), etc. .

The memory 103 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, a random access memory (random access memory, RAM) or other types that can store information and instructions The dynamic storage device can also be an electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage ( including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to include or store desired program code in the form of instructions or data structures and can be stored by a computer Any other medium, but not limited to.

In a possible design, the memory 103 may exist independently of the processor 101, that is, the memory 103 may be a memory outside the processor 101. At this time, the memory 103 may be connected to the processor 101 through the communication line 102 for storing and executing Instructions or application program codes are controlled and executed by the processor 101 to implement the network quality determining method provided in the following embodiments of the present application. In yet another possible design, the memory 103 can also be integrated with the processor 101, that is, the memory 103 can be an internal memory of the processor 101, for example, the memory 103 is a cache, which can be used to temporarily store some data and instructions information etc.

As an implementable manner, the processor 101 may include one or more CPUs, for example, CPU0 and CPU1 in FIG. 1 . As another implementable manner, the flow detection device 100 may include multiple processors, for example, the processor 101 and the processor 107 in FIG. 1 . As yet another implementable manner, the flow detection device 100 may further include an output device 105 and an input device 106 .

Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be allocated according to needs It is completed by different functional modules, that is, the internal structure of the network node is divided into different functional modules to complete all or part of the functions described above. For the specific working process of the system, modules, and network nodes described above, reference may be made to the corresponding process in the foregoing method embodiments, which will not be repeated here.

Hereinafter, the nouns involved in this application will be explained.

1. Convergence and distribution equipment is the front-end equipment in the network visualization system. It mainly completes data access collection of lines of different specifications, (link layer, network layer) protocol analysis, simple filtering, traffic distribution, same source and same destination, load balancing, Also known as first-level distribution equipment and coarse screening equipment, it is deployed on the backbone network, usually in the operator's computer room, and the filtered data is sent to the user's computer room through a dedicated line. After the preprocessing (analysis, screening and filtering) of the aggregation and distribution equipment, the required data is output to different back-end business systems according to business requirements.

2. An optical splitter is a passive device, also known as an optical splitter, they do not require external energy, as long as there is input light. The beam splitter consists of entrance and exit slits, mirrors and dispersive elements, and its function is to separate the required resonant absorption lines. The key component of the spectrometer is the dispersive element, and now commercial instruments use gratings.

3. Internet data center (Internet Data Center, IDC) refers to a comprehensive equipment (including high-speed Internet access bandwidth, high-performance local area network, safe and reliable computer room environment, etc.), professional management, perfect application services platform. On the basis of this platform, IDC service providers provide customers with basic Internet platform services (server hosting, virtual hosting, mail caching, virtual mail, etc.) and various value-added services (site rental services, domain name system services, load balancing systems, database systems, data backup services, etc.).

4. Internet service provider (Internet Service Provider, ISP), Internet service provider, that is, a telecom operator that comprehensively provides Internet access services, information services, and value-added services to users. In the Internet application service industry chain "equipment suppliers - basic network operators - content collectors and producers - service providers - users", ISPs are in the position of content collectors, producers and service providers.

5. Core router (Core Router, CR), located in the core of the network in the Internet, is mainly used for routing and forwarding of data packets, and is generally a router with relatively large throughput.

6. Five-tuple is a communication term. Usually refers to the source IP address, source port, destination IP address, destination port and transport layer protocol.

7. Inbound traffic can be understood as the data traffic that enters the Internet data center IDC equipment from the core router CR.

8. The outbound traffic can be understood as the data traffic sent from the Internet data center IDC device to the core router CR.

9. The execution unit is also called the execution unit (Execution Unit, EU).

In related technologies, when collecting device data to detect traffic, DNS data sources are generally used to extract attributes from the total data that match the data in the computer room, and then simulate requests. Afterwards, make an http (get/post) request first, and if the result of the simulated request returns data that is not within a reasonable range, make an https (get/post) request again, so as to realize the detection of missing active IP data and active domain name data. . Therefore, this method mainly finds missing data by comparing the return values of http and https request results, which has certain requirements on device performance and consumes more resources.

At present, there is no better detection method for Internet Protocol (IP) addresses of Internet Data Centers (Internet Data Center, IDC) or Internet Service Providers (Internet Service Providers, ISPs), and it is impossible to effectively detect IP addresses, resulting in It is easy for the alarm device to misreport the user's record address.

In order to solve the problem that the IP address cannot be effectively detected in the prior art, the present application provides a traffic detection system 20 as shown in FIG. 2 .

As shown in FIG. 2 , the traffic detection system 20 provided by this application includes a core router CR201 , an Internet data center IDC device 202 , a converging and distributing device 203 , and an execution unit EU204 .

Among them, the core router CR201 and the Internet data center IDC device 202 are connected through a communication link and forward data to each other through the communication link; the convergence and distribution device 203 is connected to the communication link between the core router CR201 and the Internet data center IDC device 202 through an optical splitter The aggregation and distribution device 203 is configured to: obtain the first data flow forwarded between the core router CR201 and the Internet data center IDC device 202; add a label to the first flow data according to the preset layer 2 packet policy, and generate a second The data flow is to send the second data flow to the execution unit EU204.

The execution unit EU204 is configured to: receive the second data flow, and determine the flow label of the second data flow; the flow label is any one of the flow label in the inbound direction and the flow label in the outbound direction; In this case, determine the destination IP address of the data traffic; determine whether the destination IP address is the filing IP address; if the traffic label is the outbound traffic label, determine the source IP address of the data traffic; determine whether the source IP address is the filing IP address .

In a possible implementation manner, when the core router CR201 exchanges data traffic with the Internet data center IDC device 202, if a certain data traffic enters the Internet data center IDC device 202, the data traffic is inbound data traffic; If a certain data traffic is sent from the Internet data center IDC device 202, the data traffic is outbound data traffic.

Optionally, the aggregation and distribution device 203 includes multiple ports, and the multiple ports are respectively used to obtain traffic in different directions, or to obtain traffic between different IDC devices and CR devices.

In one example, the convergence and distribution device 203 includes two ports, and the two ports are port A31 and port B32 respectively. Among them, port A31 is used to obtain the inbound flow between CR201 and IDC202; port B32 is used to obtain the outbound flow between CR201 and IDC202.

Hereinafter, the process of acquiring traffic by the converging and distributing device 203 will be described with reference to this example.

The convergence and distribution device 203 obtains the first data traffic of the core router CR201 and the Internet data center IDC device 202 during data traffic exchange through the optical splitter. If the first data traffic is data traffic in the inbound direction, the optical splitter sends the first data traffic to the converging and splitting device 203, and the port A31 is configured with a preset Layer 2 message policy, and the preset Layer 2 message policy is used to An inbound traffic label is added to the first data traffic to generate the second data traffic. Exemplarily, the traffic label in the inbound direction may be vlan10.

In another example, the converging and splitting device 203 acquires the first data traffic of the core router CR201 during data traffic exchange with the Internet data center IDC device 202 through the optical splitter. If the first data traffic is data traffic in the outgoing direction, the optical splitter sends the first data traffic to the converging and splitting device 203, and the port B32 is configured with a preset layer 2 message policy, and the preset layer 2 message policy is used to A traffic label in the outbound direction is added to the first data traffic to generate the second data traffic. Exemplarily, the outbound traffic label may be vlan20.

In the following, the flow detection process of the execution unit EU204 will be described with reference to an example.

In another example, the convergence and distribution device 203 sends the generated second data traffic to the execution unit EU204. The execution unit EU204 identifies the flow label of the second data flow. If the flow label of the second data flow is vlan10, the execution unit EU204 determines that the second data flow is inbound flow, and the execution unit EU204 determines the second data flow through quintuple analysis. The destination IP address of the traffic. Finally, the execution unit EU204 compares the destination IP address of the second data flow with the registered IP address in the storage unit DU206 to determine whether the destination IP address exceeds the range of the registered IP address.

In another example, the convergence and distribution device 203 sends the generated second data traffic to the execution unit EU204. The execution unit EU204 identifies the flow label of the second data flow. If the flow label of the second data flow is vlan20, the execution unit EU204 determines that the second data flow is outbound flow, and the execution unit EU204 determines the second data flow through quintuple analysis. The source IP address of the traffic. Finally, the execution unit EU204 compares the source IP address of the second data flow with the registered IP address in the storage unit DU206 to determine whether the source IP address exceeds the range of the registered IP address.

In a possible implementation, as shown in FIG. 2 , the traffic detection system 20 further includes: an alarm output device 205; an execution unit EU204, which is also configured to: In some cases, generate warning information; send the warning information to the warning output device 205 .

The alarm output device 205 is further configured to: output alarm information.

In one example, if the destination IP address or the source IP address exceeds the filing IP address, the execution unit EU4 generates alarm information, and the alarm output device outputs the alarm information.

Based on the above technical solution, the flow detection system provided by this application adds a flow label to the first data flow through the aggregation and distribution device and sends it to the execution unit EU. The execution unit EU identifies the flow label according to the layer-2 message policy, and then determines the first data flow. Whether the traffic is inbound traffic or outbound traffic, if the first data traffic is inbound traffic, the execution unit EU determines its destination IP address, and finally compares the destination IP address with the filing IP address to determine whether the destination IP address exceeds the filing IP address, Correspondingly, if the second data traffic is outbound traffic, the execution unit EU determines its source IP address, and finally compares the source IP address with the registered IP address to determine whether the source IP address exceeds the registered IP address, and then effectively detects the IP address. Avoid the problem that the alarm device misreports the user's record address.

Above, the flow detection system provided by the embodiment of the present application has been introduced and described.

Hereinafter, the flow detection method provided by the embodiment of the present application will be introduced and described.

FIG. 3 is a flowchart of a flow detection method provided by the present application. The flow detection method provided by the embodiment of the present application can be applied to the flow detection system shown in Figure 2. The execution unit EU identifies the flow label of the data flow. If the flow label is an inbound flow label, the execution unit EU determines the data flow label. The destination IP address of the traffic, and compare the destination IP address with the filing IP address in the filing table to determine whether the destination IP address is the filing IP address to ensure effective monitoring of the destination IP address; if the traffic label is outbound traffic label, the execution unit EU determines the source IP address of the data traffic, compares the source IP address with the filing IP address in the filing table, and determines whether the source IP address is a filing IP address, which can effectively verify the source The IP address is monitored to avoid the problem that the alarm device misreports the user's record address.

Hereinafter, the flow detection method provided by the embodiment of the present application will be described in detail. As shown in FIG. 3 , the flow detection method can be implemented through the following S301-S305.

S301. The flow detecting device identifies a flow label of data flow.

Wherein, the traffic label is any one of the inbound traffic label and the outbound traffic label.

In a possible implementation manner, the flow detection device can be understood as an execution unit EU. The traffic label is the label added to the data traffic according to the preset Layer 2 packet policy after the aggregation and distribution device obtains the data traffic.

In one example, the flow detection device identifies the flow label of the data flow. If the flow label is an inbound flow label, the inbound flow label can be expressed as Vlan10, then the data flow is the inbound data flow. If the flow label is the outbound flow label , the outbound traffic label can be expressed as Vlan20, then the data traffic is outbound data traffic.

S302. If the traffic label is an inbound traffic label, the traffic detection device determines the destination IP address of the data traffic.

In one example, if the data traffic is inbound data traffic, the traffic detection device analyzes the five-tuple of inbound data traffic to determine that the destination IP address of the data traffic is 120.80.100.200, and the destination IP address at this time is the IP address of the IDC device.

S303. The traffic detection device determines whether the destination IP address is a filing IP address.

Referring to the example in S302, the recordation IP address stored in the storage unit DU is 120.80.100.0/25, and the traffic detection device determines that the destination IP address 120.80.100.200 of the data traffic is not the recordation IP address 120.80.100.0/25. If the filing IP address stored in the storage unit DU is 120.80.100.200, the traffic detection device determines that the destination IP address 120.80.100.200 of the data flow is the filing IP address 120.80.100.200.

It should be noted that the destination IP address of the inbound data traffic is the IP address of the IDC device. Each IDC device has a record IP address stored in the storage unit DU in advance. The record IP address is used for comparison with the destination IP address determined by the traffic detection device. If the destination IP address is not the record IP address, it means that there is a leak in the system. In the case of reporting the IP address, it is necessary to add the missing IP address to the record IP address to avoid the situation of missing reporting.

S304. If the traffic label is an outbound traffic label, the traffic detection device determines the source IP address of the data traffic.

In one example, if the data traffic is outbound data traffic, the traffic detection device analyzes the outbound data traffic quintuple to determine that the source IP address of the data traffic is 120.80.100.200, and the source IP address at this time is the IP address of the IDC device.

In another example, when the data traffic is data traffic in the outgoing direction, the traffic detection device analyzes the quintuple of the outgoing data traffic to determine that the destination IP address of the data traffic is 120.80.100.200, and the destination IP address at this time is the IP address of the client; In the existing system, 120.80.100.200 may be an external business address, or it may be a business address missed by the user, so it cannot be judged. Therefore, this application uses the execution unit EU to identify the traffic label and judge that the traffic label is inbound traffic. The label is still an outbound traffic label. If it is an outbound traffic label and the destination IP address is determined after analyzing the quintuple, the destination IP address 120.80.100.200 is the external network service address, which is not a case of user omission.

S305. The traffic detection device determines whether the source IP address is a record IP address.

Referring to the example in S304, the recordation IP address stored in the storage unit DU is 120.80.100.0/25, and the traffic detection device determines that the source IP address 120.80.100.200 of the data traffic is not the recordation IP address 120.80.100.0/25. If the filing IP address stored in the storage unit DU is 120.80.100.200, the traffic detection device determines that the source IP address 120.80.100.200 of the data traffic is the filing IP address 120.80.100.200.

It should be pointed out that the source IP address of the outbound data traffic is the IP address of the IDC device; the destination IP address of the outbound data traffic is the IP address of the client. Each IDC device has a record IP address stored in the storage unit DU in advance. The record IP address is used for comparison with the source IP address determined by the traffic detection device. If the source IP address is not the record IP address, it means that there is a leak in the system. In the case of reporting the IP address, the missing IP address needs to be added to the record IP address.

The technical solutions provided by the above embodiments bring at least the following beneficial effects. Compared with the prior art, the flow detection method provided by the embodiments of the present application uses the flow detection device to identify the flow label of the data flow. If the flow label is an inbound flow label , then determine the destination IP address of the data traffic, the traffic detection device then determines whether the destination IP address belongs to the record IP address, if the traffic label is an outgoing traffic label, then determines the source IP address of the data traffic, and the traffic detection device then determines the source IP address Whether it belongs to the filing IP address can effectively detect the IP address and avoid the problem that the alarm device misreports the user's filing address.

In a possible implementation manner, in combination with Fig. 2 and Fig. 3, as shown in Fig. 4, before the above S301, the traffic detection device identifies the traffic label of the data traffic, the converging and splitting device needs to add a label to the data traffic, specifically through the following The implementation of S401-S402 is described in detail below:

S401. The converging and distributing device acquires data traffic.

In one example, when the core router CR exchanges data traffic with the Internet data center IDC equipment, the converging and distributing equipment obtains the exchanged data traffic through the optical splitter.

S402. The converging and distributing device adds a label to the data traffic according to a preset Layer 2 packet policy.

In one example, there are two ports on the convergence and distribution device, and the two ports are port A and port B respectively. If the data traffic is inbound data traffic, the aggregation and distribution device will add a label to the inbound data traffic through the Layer 2 packet policy on port A. The traffic label of the inbound data traffic can be vlan10. If the data traffic is outbound data traffic , the aggregation and distribution device adds a label to the outbound data traffic through the Layer 2 packet policy on port B, and the traffic label of the outbound data traffic can be vlan20.

In a possible implementation manner, as shown in FIG. 3 , the present application further includes the following warning steps, which can be specifically implemented through S306-S307, and are described in detail below:

S306. In the case that the destination IP address or the source IP address is not the registered IP address, the traffic detection device generates alarm information.

Referring to the example in S303, the destination IP address 120.80.100.200 is not the filing IP address 120.80.100.0/25, and the traffic detection device determines the alarm information.

With reference to the example in S305, the source IP address 120.80.100.200 is not the filing IP address 120.80.100.0/25, and the traffic detection device determines the alarm information.

S307. The flow detection device sends alarm information to the alarm output device.

The embodiments of the present application can divide the flow detection device into functional modules or functional units according to the above-mentioned method examples. For example, each functional module or functional unit can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated modules can be implemented not only in the form of hardware, but also in the form of software function modules or functional units. Wherein, the division of modules or units in the embodiment of the present application is schematic, and is only a logical function division, and there may be another division manner in actual implementation.

As shown in FIG. 5 , it is a schematic structural diagram of a flow detection device 50 provided in the embodiment of the present application. The flow detection device 50 includes a processing unit 501 .

The processing unit 501 is used to identify the traffic label of the data traffic; the traffic label is any one of the inbound traffic label and the outbound traffic label; when the traffic label is an inbound traffic label, the processing unit 501 is also used for Determine the destination IP address of the data traffic; the processing unit 501 is also used to determine whether the destination IP address is an IP address for record; when the traffic label is an outgoing traffic label, the processing unit 501 is also used to determine the source IP of the data traffic Address; the processing unit 501 is also used to determine whether the source IP address is a filing IP address.

Optionally, the traffic label is a label added to the data traffic according to a preset Layer 2 packet policy after the convergence and distribution device obtains the data traffic.

Optionally, the traffic detection device 50 also includes: a communication unit 502; when the destination IP address or the source IP address is not a filing IP address, the processing unit 501 is also used to generate alarm information; the communication unit 502 is used to Send alarm information to the alarm output device.

When implemented by hardware, the communication unit 502 in the embodiment of the present application may be integrated on a communication interface, and the processing unit 501 may be integrated on a processor. The specific implementation is shown in Figure 6.

Fig. 6 shows another possible structural schematic diagram of the flow detection device involved in the above embodiment. The flow detection device includes: a processor 602 and a communication interface 603 . The processor 602 is used to control and manage the actions of the flow detection device, for example, to execute the steps executed by the processing unit 501 above, and/or to execute other processes of the technologies described herein. The communication interface 603 is used to support communication between the flow detection device and other network entities, for example, to perform the steps performed by the communication unit 502 above. The flow detection device may also include a memory 601 and a bus 604, and the memory 601 is used to store program codes and data of the flow detection device.

Wherein, the memory 601 can be a memory in the flow detection device, etc., and the memory can include a volatile memory, such as a random access memory; the memory can also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state hard disk; the storage may also include a combination of the above-mentioned types of storage.

The above-mentioned processor 602 may realize or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may be a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, a combination of one or more microprocessors, a combination of DSP and a microprocessor, and the like.

The bus 604 may be an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like. The bus 604 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 6 , but it does not mean that there is only one bus or one type of bus.

Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be allocated according to needs It is completed by different functional modules, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. For the specific working process of the above-described system, device, and unit, reference may be made to the corresponding process in the foregoing method embodiments, and details are not repeated here.

An embodiment of the present application provides a computer program product containing instructions, and when the computer program product is run on a computer, the computer is made to execute the traffic detection method in the above method embodiment.

The embodiment of the present application also provides a computer-readable storage medium, and instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer, the computer is made to perform flow detection in the method flow shown in the above method embodiments method.

Wherein, the computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more conductors, portable computer disks, hard disks, Random Access Memory (RAM), read-only memory (Read-Only Memory, ROM), Erasable Programmable Read-Only Memory (Erasable Programmable Read Only Memory, EPROM), Registers, Hard Disk, Optical Fiber, Portable Compact Disk Read-Only Memory (Compact Disc Read-Only Memory, CD-ROM ), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may be located in an application specific integrated circuit (Application Specific Integrated Circuit, ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, and the program may be used by or in combination with an instruction execution system, device, or device.

Since the flow detection device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above methods, the technical effects that can be obtained can also refer to the above method embodiments, and the embodiments of the present invention are hereby No longer.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

A unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

The above are only specific implementation methods of this application, but the protection scope of this application is not limited thereto. Any changes or replacements within the technical scope disclosed in this application shall be covered within the protection scope of this application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (10)

1. A flow detection system, characterized in that the system comprises: Core router CR, Internet data center IDC equipment, aggregation and distribution equipment, and execution unit EU; the CR and the IDC equipment are connected through a communication link and transmit data to each other through the communication link; the aggregation and distribution equipment transmits data through optical splitting A device accesses the communication link between the CR and the IDC device; The converging and distributing device is configured to: obtain the first data flow forwarded between the CR and the IDC device; add a label to the first data flow according to a preset Layer 2 message policy, and generate a second data flow traffic, sending the second data traffic to the execution unit EU; The execution unit EU is configured to: receive the second data flow, and determine a flow label of the second data flow; the flow label is any one of an inbound flow label and an outbound flow label; When the flow label is an incoming flow label, determine the destination IP address of the data flow; determine whether the destination IP address is an IP address for record; if the flow label is an outgoing flow label, determine The source IP address of the data traffic; determine whether the source IP address is a filing IP address. 2. The system according to claim 1, further comprising: an alarm output device; The EU is further configured to: generate alarm information when the destination IP address or the source IP address is not the filing IP address; send the alarm information to the alarm output device; The alarm output device is further configured to: output the alarm information. 3. A flow detection method, characterized in that the method comprises: A traffic label for identifying data traffic; the traffic label is any one of an inbound traffic label and an outbound traffic label; In the case where the traffic label is an inbound traffic label, determine the destination IP address of the data traffic; Determine whether the destination IP address is a filing IP address; In the case where the traffic label is an outgoing traffic label, determine the source IP address of the data traffic; Determine whether the source IP address is a filing IP address. 4. The method according to claim 3, wherein the traffic label is a label added to the data traffic according to a preset Layer 2 packet policy after the convergence and distribution device obtains the data traffic. 5. The method according to claim 3, wherein the method further comprises: When the destination IP address or the source IP address is not an IP address for filing, generate a warning message; Send the alarm information to an alarm output device. 6. A flow detection device, characterized in that the device comprises: a processing unit; The processing unit is configured to identify a traffic label of data traffic; the traffic label is any one of an inbound traffic label and an outbound traffic label; In the case where the traffic label is an inbound traffic label, the processing unit is further configured to determine a destination IP address of the data traffic; The processing unit is also used to determine whether the destination IP address is a filing IP address; In the case where the traffic label is an outbound traffic label, the processing unit is further configured to determine the source IP address of the data traffic; The processing unit is further configured to determine whether the source IP address is a filing IP address. 7 . The device according to claim 6 , wherein the traffic label is a label added to the data traffic according to a preset Layer 2 packet policy after the convergence and distribution device acquires the data traffic. 7 . 8. The device according to claim 6, further comprising: a communication unit; In the case where the destination IP address or the source IP address is not a filing IP address, the processing unit is further configured to generate alarm information; The communication unit is configured to send the alarm information to an alarm output device. 9. A flow detection device, characterized in that it comprises: a processor and a communication interface; the communication interface is coupled to the processor, and the processor is used to run computer programs or instructions to achieve the requirements of claims 3-5. The flow detection method described in any one. 10. A computer-readable storage medium, with instructions stored in the computer-readable storage medium, characterized in that, when a computer executes the instructions, the computer executes the flow described in any one of claims 3-5 Detection method.

Images