Law EnforcementIndustry Solutions

Cyberspace Intelligence Analysis System（CIAS）

Full traffic deep parsing and intelligent content identification solution

Key Features

Full-Dimensional Protocol Parsing and Identification

Multi-Level Protocol Parsing Engine

Covers mainstream, encrypted, and proprietary protocols, supporting multiple identification technologies including feature matching, behavior analysis, and fingerprint recognition. Based on machine learning methods, the system performs modeling analysis on flow characteristics to accurately identify application types of encrypted protocols such as HTTPS, QUIC, and TLS 1.3, filling the supervision gap of encrypted traffic. For the 5G core network, it supports PFCP protocol parsing on the N4 interface, meeting the signaling plane and user plane access requirements under the 5G SA architecture.

Non-Encrypted Protocol Restoration and Encrypted Protocol Application Analysis

Intelligent File Restoration and Deep Content Analysis

The system supports file restoration and type identification across non-encrypted protocols, including email (SMTP, POP3, IMAP, Webmail), Web (HTTP), and FTP. Additionally, it enables communication relationship mining for encrypted protocol applications such as WhatsApp, Telegram, Facebook Messenger, Tango, Viber, Signal, Googlechat, VK and facilitates real-identity attribution for virtual accounts on social media platforms such as Facebook, X, WhatsApp, Tiktok and Instagram.

Unknown Application Mining

Intelligent Unknown Application Mining

Performs in-depth analysis on unidentified application data. Based on behavior analysis and statistical mining, it continuously discovers unknown applications and virtual identity information, supporting protocol signature database iteration and forward identification development.

Core Values

Deep Network Security Exploration

Full Traffic Intelligent Exploration and Unknown Threat Discovery

Through deep parsing and intelligent mining of full traffic, the system continuously discovers unknown applications, encrypted tunnels, OTT communication relationship and abnormal behaviors in the network, effectively identifying potential risks and providing in-depth data support for network security situational awareness.

Network Behavior Precise Traceability

Multi-Dimensional Correlation and Behavior Chain Restoration

Automatically completes three-code (IMSI-MSISDN-IMEI) correlation completion and identity tagging, supports user-dimensional historical behavior backtracking, communication trajectory tracking, and multi-network correlation analysis, providing a complete evidence chain for precise traceability and in-depth analysis.

Durable Value Investment Protection

Future-Oriented Sustainable Evolution Architecture

Adopts modular and scalable system design, supporting smooth upgrade of interface capabilities and continuous function iteration. The protocol signature database maintains high-frequency updates, and unknown application mining continuously drives capability evolution, ensuring long-term system availability and continuous value appreciation.

Technical Architecture

The system adopts a four-layer cascaded architecture: Collection & Access - Parsing & Processing - Data Output - Intelligent Mining

Collection & Access Layer (FlowWare): Located at the bottom of the architecture, adopts high-performance traffic access devices supporting multiple methods including optical splitting, TAP, and port mirroring. Implements raw traffic aggregation, filtering, and load balancing for high-speed links in fixed networks/mobile networks/5G core networks, featuring high throughput and low latency processing capabilities.

Parsing & Processing Layer (DPI Device): Core layer consisting of software modules including protocol decoding, application identification, feature extraction, and file restoration. Responsible for parsing protocols from raw packets, identifying application types, extracting metadata and fingerprint information, supporting out-of-order reassembly and integrity verification.

Data Output Layer (Data Exchange Platform): Responsible for outputting parsing results in standardized formats, supporting multiple protocols including Syslog, NetFlow/IPFIX, and JSON. Provides API interfaces for connecting to upper-layer applications such as situational awareness platforms and big data analysis systems. Also provides raw packet storage and retrieval functions, supporting policy-based file storage and retrieval.

Intelligent Mining Layer (Intelligent Mining Engine): Performs in-depth analysis on unidentified application data. Discovers unknown applications through statistical queries and behavior clustering, supporting protocol signature database iteration and model training, driving continuous evolution of system identification capabilities.

Industry Applications and Typical Scenarios

Government /Regulators

Network situational awareness, application distribution statistics, encrypted traffic monitoring, unknown application discovery

Telecom Operators

Network traffic analysis, traffic integrity analysis, traffic supervision

Public Security /National Security

Abnormal behavior discovery, behavior backtracking, raw packet retrieval

Frequently Asked Questions （FAQ）

What deployment methods does the system support?

How does the system handle 5G network traffic?

How many applications does the system support for identification?