TRAFFIC ANALYSIS METHOD, PUBLIC SERVICE TRAFFIC ATTRIBUTION METHOD AND CORRESPONDING COMPUTER SYSTEM

摘要

Provided in the present application are a traffic analysis method and device and a computer system. The method comprises: acquiring plaintext characteristics and ciphertext characteristics of a message in traffic, the ciphertext characteristics comprising length characteristics of encrypted fields in the message; and analyzing the traffic according to the plaintext characteristics and the ciphertext characteristics so as to identify the service or application to which the traffic is attributed. The method may be used for service identification as well as application identification. The accuracy of traffic identification is increased in the message encryption scenario by means of introducing ciphertext characteristics into traffic analysis. On the other hand, also provided in the present application are a method and device for attributing traffic of a public service and a computer system. The traffic of the public service is attributed to a corresponding application by identifying initial service and/or exclusive service of the application, thus providing application traffic attribution accuracy and providing a basis for subsequent services such as application traffic billing.