A packet switched (PS) service identification method and a terminal, where a weight of at least one socket corresponding to a PS service is determined, a key socket is determined from the at least one socket according to the weight of the at least one socket, and an identifier of the key socket is sent to a network side such that the network side formulates a policy and charging control (PCC) rule according to the 5-tuple. In this PS service identification process, because the terminal does not encrypt the PS service, the terminal can accurately identify the PS service.

Packet switched service identification method and terminal

The invention is suitable for the field of identification of mobile Internet services and provides a service identification method based on a DNS (Domain Name Server) and a system of the method. The method comprises the following steps: first, acquiring an IP address carried by a user request from the user request; then, searching for a domain name corresponding to the IP address in a DNS sever; finally, identifying the service of the user request according to the pre-stored domain name and a service corresponding relation table in the DNS sever. According to the service identification method based on the DNS and the system of the method provided by the invention, compared with a conventional service identification techniques such as DPI (Deep Packet Inspection), DFI (Deep Flow Inspection) and the like, the method is relatively simple and the services which are identified are relatively comprehensive, fast and accurate, so that the increasing condition that encrypted new services cannot be identified is effectively avoided. Moreover, the fine-granularity can be automatically configured according to the domain name and the service corresponding table for a service identification result, and the method is relatively flexible and convenient.

Service identification method based on DNS (Domain Name Server) and system of method

The invention describes a method for identifying an encrypted data stream, which comprises the following steps of: analyzing a plurality of handshake messages of the encrypted data stream according toa secure encrypted transmission protocol corresponding to the encrypted data stream so as to obtain a plurality of fields contained in the handshake messages; According to the plurality of fields, determining the rule sets matched with the handshake messages from the rule sets, determining the application corresponding to the encrypted data stream according to the mapping relation between the matched rule sets and the application. therefore, the encrypted flow in the network can be identified more accurately, namely the encrypted data stream can be identified more accurately.

method and device for identifying an encrypted data stream

The embodiment of the invention provides a method and apparatus for hijacking network traffic. The method comprises the following steps: obtaining the network traffic of a web browsing port; obtaininga connection request of establishing an SSL sent by a client to a server in a process of establishing the secure socket layer SSL according to the network traffic; parsing the connection request to extract a protocol version field of the SSL and a domain name field of the server; if a protocol version corresponding to the protocol version field is a preset protocol version, parsing the domain name field to obtain a domain name address to be accessed; and if the domain name address is contained in a preset domain name address, hijacking the network traffic corresponding to the SSL. The apparatus performs the above method. By adoption of the method and apparatus for hijacking network traffic provided by the embodiment of the invention, the network traffic corresponding to the SSL can be reasonably and effectively hijacked, thereby effectively controlling the network access behaviors of enterprise employees.

Method and apparatus for hijacking network traffic

A method for identifying an encrypted data flow is described in this application. The method includes: parsing a plurality of handshake packets of an encrypted data flow according to a secure encrypted transmission protocol corresponding to the encrypted data flow, to obtain a plurality of fields included in the plurality of handshake packets; determining, from a plurality of rule sets and based on the plurality of fields, a rule set that matches the plurality of handshake packets; and determining, based on a mapping relationship between the matched rule set and an application, an application corresponding to the encrypted data flow. In this method, encrypted traffic in a network can be identified more accurately; in other words, more encrypted data flows can be identified more accurately.

Method and device for identifying encrypted data stream

The invention provides a method for recognizing a mobile data service based on an HTTPS. The method is characterized by comprising the first step of recognizing the protocol with the TCP conversation as unit caching data, wherein if the protocol is the Handshake protocol, the Client Hello message and the Certificate message are recognized according to the Handshake Type; the second step of extracting the corresponding HOST message according to the recognized Client Hello message and the Certificate message; the third step of finishing the recognition on the type of the service according to the extracted HOST message. The recognition on the type of the HTTPS service can be achieved in an initiative mode, the HOST extraction is achieved at the Handshake stages of different versions of protocols of the SSL/TLS of the HTTPS mode, the service type can be obtained through the preset HOST and service type corresponding list in an expanded mode, and the service recognition breadth can be effectively improved.

Li Huaiming

Papers

Method for recognizing mobile data service based on HTTPS