Storm control method based on application program identification

Abstract

The invention discloses a storm control method based on application program identification, and relates to the technical field of network traffic management, and the method comprises the steps: obtaining network traffic passing through an application layer under the condition that a network storm is detected, identifying an application layer protocol corresponding to the network traffic, and transmitting the network traffic to the application layer, obtaining an application traffic type; determining the priority of the application traffic according to the application traffic type; and acquiring a network flow state in real time, and determining and dynamically adjusting a storm control strategy according to the network flow state, the priority of the application flow and a preset model, so as to perform network storm control through the dynamically adjusted storm control strategy. The application type can be identified, the storm control strategy can be dynamically adjusted, and the traffic demands of different applications can be guaranteed.

Description

Technical Field

[0001] The present application relates to the technical field of network traffic management, and in particular to a storm control method based on application identification. Background Art

[0002] At present, switch storm control mainly limits data traffic based on packet rate (PPS) and bit rate (BPS) to prevent network storms caused by broadcast, multicast and unknown unicast. However, this traditional storm control method ignores the actual content of the traffic and only focuses on the transmission rate of data packets, which can easily lead to the mistaken killing of critical application traffic. However, especially in modern networks, the demand for real-time communication, video streaming and other delay-sensitive applications is increasing. Traditional PPS / BPS control cannot effectively distinguish high-priority applications from ordinary traffic, nor can it make flexible judgments based on application type, priority and traffic nature, resulting in the same restrictions on critical business traffic, affecting network performance.

[0003] Therefore, how to ensure the traffic requirements of different applications during storm control is a problem that still needs to be solved today.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a storm control method based on application identification, aiming to solve the technical problem of how to ensure the traffic requirements of different applications during storm control.

[0006] To achieve the above objectives, the present application proposes a storm control method based on application identification, the method comprising: In the case of detecting a network storm, obtaining network traffic passing through the application layer, identifying the application layer protocol corresponding to the network traffic, and obtaining the application traffic type; Determining the priority of the application traffic according to the application traffic type; The network traffic status is acquired in real time, and a storm control strategy is determined and dynamically adjusted according to the network traffic status, the priority of the application traffic, and a preset model, so as to perform network storm control through the dynamically adjusted storm control strategy.

[0007] In one embodiment, the step of identifying the application layer protocol corresponding to the network traffic and obtaining the application traffic type includes: Preprocessing the data packets of the network traffic, wherein the preprocessing at least includes decoding the data packets and reorganizing the target data packets to obtain processed data packets; Parsing the processed data packet to extract application layer protocol information, wherein the protocol information at least includes a data packet header and a payload; The application layer protocol information is compared with a preset protocol feature library, and the application traffic type of the processed data packet is obtained according to the comparison result.

[0008] In one embodiment, the step of determining the priority of the application traffic according to the application traffic type includes: Determining the delay sensitivity and bandwidth requirement of the application traffic according to the application traffic type; sorting the application traffic according to the delay sensitivity and the bandwidth requirement; Determine the priority of application traffic based on the sorting results.

[0009] In one embodiment, the step of acquiring the network traffic status in real time and determining and dynamically adjusting the storm control strategy according to the network traffic status, the priority of the application traffic and a preset model includes: Acquire the flow data of network equipment in real time, and obtain the network flow status according to the flow data; According to the network traffic state, adjusting the storm control strategy based on the network load; adjusting the storm control strategy based on the priority of the application traffic; According to the network traffic state, adjusting the storm control strategy based on abnormal traffic; According to the network traffic status, the storm control strategy is adjusted based on a preset model.

[0010] In one embodiment, the real-time acquisition of traffic data of network devices includes at least one of the following: Packet rate, bit rate, traffic type, delay and packet loss rate, protocol type, and application traffic type.

[0011] In one embodiment, the step of adjusting the storm control strategy based on the network load according to the network traffic state includes: When the network load reaches a preset upper limit, the packet rate and the bit rate thresholds are increased according to a first preset amplitude; When the network load reaches a preset lower limit, the thresholds of the packet rate and the bit rate are reduced according to a second preset amplitude.

[0012] In one embodiment, the step of adjusting the storm control strategy based on the priority of the application traffic includes: Obtaining real-time application traffic and non-real-time application traffic according to the priority of the application traffic; When the network load increases, the bandwidth restriction on the real-time application traffic is reduced, and the bandwidth allocation for the non-real-time application traffic is reduced.

[0013] The step of adjusting the storm control strategy based on abnormal traffic according to the network traffic state includes: In one embodiment, the step of adjusting the storm control strategy based on abnormal traffic according to the network traffic state includes: According to the network traffic status, the detected network storm and distributed denial of service attack are regarded as abnormal traffic; Detecting burst traffic by flow fluctuation rate, packet size and flow duration, and treating the burst traffic as abnormal traffic; When the abnormal traffic is detected, the packet rate and bit rate limits are reduced to control the traffic growth rate; Identify attack traffic through blacklist or access control list rules and isolate the attack traffic; Start traffic cleaning to ensure that the attack traffic is isolated.

[0014] In one embodiment, the step of adjusting the storm control strategy based on a preset model according to the network traffic state includes: According to the network traffic status, the future network traffic change trend is predicted through the machine learning training model, and whether there is a storm risk is determined, and the packet rate and bit rate thresholds are adjusted according to the judgment results to avoid network congestion or storms; According to the network traffic status, the limits of packet rate and bit rate are dynamically adjusted through an adaptive adjustment model to ensure a stable operation state of the network.

[0015] In one embodiment, after the network storm control is performed by the dynamically adjusted storm control strategy, the method further includes: According to the priority of the application traffic, the application traffic is divided into real-time traffic, business traffic and non-critical traffic, and the real-time traffic, the business traffic and the non-critical traffic are respectively diverted and speed-limited; Set dynamic restriction policies for non-critical traffic, and reduce restrictions on non-critical traffic when network traffic increases; Monitor and handle abnormal situations in network traffic in real time to avoid accidentally killing non-critical traffic; Regularly evaluate network load conditions and adjust the storm control strategy.

[0016] In addition, to achieve the above purpose, the present application also proposes a storm control device based on application identification, and the storm control device based on application identification includes: An identification module is used to obtain network traffic passing through the application layer when a network storm is detected, identify the application layer protocol corresponding to the network traffic, and obtain the application traffic type; A determination module, configured to determine the priority of the application traffic according to the application traffic type; The adjustment module is used to obtain the network traffic status in real time, and determine and dynamically adjust the storm control strategy according to the network traffic status, the priority of the application traffic and the preset model, so as to perform network storm control through the dynamically adjusted storm control strategy.

[0017] In addition, to achieve the above-mentioned objectives, the present application also proposes a storm control device based on application identification, the device comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the storm control method based on application identification as described above.

[0018] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the storm control method based on application identification as described above are implemented.

[0019] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the storm control method based on application identification as described above.

[0020] The present application provides a storm control method based on application identification. When a network storm is detected, the present application obtains network traffic passing through the application layer, identifies the application layer protocol corresponding to the network traffic, and obtains the application traffic type; determines the priority of the application traffic according to the application traffic type; obtains the network traffic status in real time, and determines and dynamically adjusts the storm control strategy according to the network traffic status, the priority of the application traffic, and a preset model, so as to perform network storm control through the dynamically adjusted storm control strategy.

[0021] In summary, the present application ensures the traffic requirements of different applications by differentiating the priorities for different application traffic and adjusting the storm control strategy according to the priorities. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0024] Figure 1 A flowchart of a storm control method based on application identification according to the present invention; Figure 2 A flowchart diagram of the second embodiment of the storm control method based on application identification provided in this application; Figure 3 This is a schematic diagram of the module structure of a storm control device based on application recognition in an embodiment of the present application; Figure 4 Schematic diagram of the device structure of the hardware operating environment involved in the storm control method based on application recognition in an embodiment of the present application.

[0025] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0026] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0027] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0028] The main solution of the present application is to obtain the network traffic passing through the application layer, identify the application layer protocol corresponding to the network traffic, and obtain the application traffic type when a network storm is detected; determine the priority of the application traffic according to the application traffic type; obtain the network traffic status in real time, and determine and dynamically adjust the storm control strategy according to the network traffic status, the priority of the application traffic and a preset model, so as to control the network storm through the dynamically adjusted storm control strategy.

[0029] At present, switch storm control mainly limits data traffic based on packet rate (PPS) and bit rate (BPS) to prevent network storms caused by broadcast, multicast and unknown unicast. However, this traditional storm control method ignores the actual content of the traffic and only focuses on the transmission rate of data packets, which can easily lead to the mistaken killing of critical application traffic. However, especially in modern networks, the demand for real-time communication, video streaming and other delay-sensitive applications is increasing. Traditional PPS / BPS control cannot effectively distinguish high-priority applications from ordinary traffic, nor can it make flexible judgments based on application type, priority and traffic nature, resulting in the same restrictions on critical business traffic, affecting network performance. Therefore, how to ensure the traffic requirements of different applications during storm control is a problem that still needs to be solved today.

[0030] The present application solves the technical problem of how to ensure the traffic requirements of different applications during storm control by prioritizing traffic of different applications and adjusting the storm control strategy according to the priority.

[0031] Based on this, the embodiment of the present application provides a storm control method based on application identification, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the storm control method based on application identification of the present application.

[0032] In this embodiment, the storm control method based on application identification includes steps S10 to S30: Step S10: when a network storm is detected, obtaining network traffic passing through the application layer, identifying the application layer protocol corresponding to the network traffic, and obtaining the application traffic type; It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a storm control device based on application recognition, etc. The following takes the storm control device based on application recognition as an example to illustrate this embodiment and the following embodiments.

[0033] It should be noted that a network storm refers to a phenomenon in which the data traffic in the network increases sharply due to some reason, resulting in a serious decline in network performance or even paralysis. The application layer is the seventh layer of the open system interconnection model and is also the highest layer. It directly interfaces with the application program and provides common network application services. Network traffic refers to the amount of data transmitted in a computer network. This data can be in different forms of data such as text, images, video, audio, etc., and they are transmitted in large quantities every second on the Internet. The application layer protocol is a protocol located at the application layer in the computer network protocol architecture.

[0034] In a feasible manner, the step of identifying the application layer protocol corresponding to the network traffic and obtaining the application traffic type includes: Preprocessing the data packets of the network traffic, wherein the preprocessing at least includes decoding the data packets and reorganizing the target data packets to obtain processed data packets; Parsing the processed data packet to extract application layer protocol information, wherein the protocol information at least includes a data packet header and a payload; The application layer protocol information is compared with a preset protocol feature library, and the application traffic type of the processed data packet is obtained according to the comparison result.

[0035] It should be noted that data packets are the basic units of network traffic, which contain the data to be transmitted and some control information. The packet header contains a large amount of control information and verification information for integrity check of the packet. The payload is the backbone of the packet, and the content can be divided into transmitted user data, padding data, and reserved data. The preset protocol feature library is a database containing feature information of various network communication protocols.

[0036] It is understandable that by comparing the application layer protocol information with the preset protocol feature library, the application traffic type corresponding to the application layer protocol information can be obtained. For example, by identifying the SIP protocol and RTP traffic and checking the voice data stream characteristics, the application traffic type can be obtained as real-time communication; by identifying video streaming protocols such as H.264 and WebRTC, the application traffic type can be obtained as video conferencing; by identifying HTTP / HTTPS requests, the application traffic type can be obtained as web browsing or email; by identifying FTP and P2P traffic and checking the file transfer protocol and data size, the application traffic type can be obtained as file transfer.

[0037] Step S20: Determine the priority of the application traffic according to the application traffic type; Understandably, prioritizing application traffic can help with subsequent storm control.

[0038] In a feasible manner, the step of determining the priority of the application traffic according to the application traffic type includes: Determining the delay sensitivity and bandwidth requirement of the application traffic according to the application traffic type; sorting the application traffic according to the delay sensitivity and the bandwidth requirement; Determine the priority of application traffic based on the sorting results.

[0039] It is understandable that application traffic types include real-time communication, video conferencing, web browsing and email, and file transfer. Among them, real-time communication has the highest delay sensitivity and bandwidth requirement, while file transfer has the lowest delay sensitivity and bandwidth requirement. Therefore, the results of sorting according to delay sensitivity and bandwidth requirement are real-time communication, video conferencing, web browsing and email, and file transfer from high to low. Therefore, the priority of application traffic is real-time communication, video conferencing, web browsing and email, and file transfer from high to low. The priority of application traffic can be referred to Table 1.

[0040]

[0041] Table 1 Step S30: Acquire the network traffic status in real time, and determine and dynamically adjust the storm control strategy according to the network traffic status, the priority of the application traffic and a preset model, so as to perform network storm control through the dynamically adjusted storm control strategy.

[0042] It is understandable that by comprehensively considering the network traffic status, the priority of application traffic, and using a preset model, a storm control strategy can be determined and adjusted at any time.

[0043] In a feasible manner, after the network storm control is performed by the dynamically adjusted storm control strategy, the method further includes: According to the priority of the application traffic, the application traffic is divided into real-time traffic, business traffic and non-critical traffic, and the real-time traffic, the business traffic and the non-critical traffic are respectively diverted and speed-limited; Set dynamic restriction policies for non-critical traffic, and reduce restrictions on non-critical traffic when network traffic increases; Monitor and handle abnormal situations in network traffic in real time to avoid accidentally killing non-critical traffic; Regularly evaluate network load conditions and adjust the storm control strategy.

[0044] It is understandable that, according to the priority of the application traffic, the application traffic is divided into real-time traffic, business traffic and non-critical traffic. When performing storm control, it is necessary to be careful not to kill non-critical traffic by mistake, so different diversion and speed limit strategies need to be adopted for the real-time traffic, the business traffic and the non-critical traffic respectively. In addition, a dynamic restriction strategy is set for non-critical traffic to reduce the restriction on non-critical traffic when network traffic resources are sufficient. Regularly evaluate the current traffic control strategy and network load conditions, and optimize the storm control strategy to ensure that the impact on non-critical traffic is minimized under different traffic changes. For example, by regularly reviewing traffic models and strategies, correct unreasonable traffic restrictions; optimize traffic control strategies through user feedback on traffic delays and packet loss.

[0045] In the present embodiment, when a network storm is detected, network traffic passing through the application layer is obtained, the application layer protocol corresponding to the network traffic is identified, and the application traffic type is obtained; the priority of the application traffic is determined according to the application traffic type; the network traffic status is obtained in real time, and the storm control strategy is determined and dynamically adjusted according to the network traffic status, the priority of the application traffic and a preset model, so as to control the network storm through the dynamically adjusted storm control strategy.

[0046] In summary, this embodiment solves the technical problem of how to ensure the traffic requirements of different applications during storm control by differentiating the priorities for different application traffic and adjusting the storm control strategy according to the priorities.

[0047] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 , the step S30 includes steps S301 to S305: Step S301: acquiring the flow data of the network device in real time, and obtaining the network flow status according to the flow data; It should be noted that network devices include switches and routers, and traffic data includes at least one of the following: packet rate, bit rate, traffic type, delay and packet loss rate, protocol type, and application traffic type. Traffic types include real-time communication, video streaming, and file transfer. Delay and packet loss rate refer to the delay and packet loss of network transmission.

[0048] Step S302: adjusting the storm control strategy based on the network load according to the network traffic status; According to the network traffic status, the network load situation can be obtained, and the storm control strategy can be adjusted according to the network load.

[0049] In a feasible manner, the step of adjusting the storm control strategy based on the network load according to the network traffic state includes: When the network load reaches a preset upper limit, the packet rate and the bit rate thresholds are increased according to a first preset amplitude; When the network load reaches a preset lower limit, the thresholds of the packet rate and the bit rate are reduced according to a second preset amplitude.

[0050] When the network load is high, the PPS and BPS limits are moderately increased to reduce the impact of storm control on normal traffic; when the network load is low, these limits are lowered to prevent potential storm outbreaks. For example, when the network traffic reaches 80% of the preset upper limit, the PPS is adjusted from 1000 packets / second to 1200 packets / second, and the BPS is adjusted from 10 Mbps to 12 Mbps to accommodate more traffic; when the traffic is below 50% of the upper limit, the PPS is reduced from 1000 packets / second to 800 packets / second, and the BPS is reduced from 10 Mbps to 8Mbps.

[0051] Step S303: adjusting the storm control strategy based on the priority of the application traffic; The storm control strategy is adjusted according to the priority of the application traffic, so as to ensure the status of the high priority application traffic.

[0052] In a feasible manner, the step of adjusting the storm control strategy based on the priority of the application traffic includes: Obtaining real-time application traffic and non-real-time application traffic according to the priority of the application traffic; When the network load increases, the bandwidth restriction on the real-time application traffic is reduced, and the bandwidth allocation for the non-real-time application traffic is reduced.

[0053] According to the priority of the application traffic, real-time application traffic and non-real-time application traffic are obtained, for example, real-time communication and video conferencing are determined as real-time application traffic, and file transfer and file download are determined as non-real-time traffic. When the network load is high, real-time application traffic can be allowed to pass 100% of the bandwidth limit, and non-real-time traffic can be subject to stricter restrictions, controlling the bandwidth within 30% to avoid occupying too much bandwidth resources.

[0054] Step S304: adjusting the storm control strategy based on the abnormal traffic according to the network traffic state; According to the network traffic status, abnormal traffic detection rules can be set, and the storm control mechanism will be triggered when abnormal traffic is detected.

[0055] In a feasible manner, the step of adjusting the storm control strategy based on abnormal traffic according to the network traffic state includes: According to the network traffic status, the detected network storm and distributed denial of service attack are regarded as abnormal traffic; Detecting burst traffic by flow fluctuation rate, packet size and flow duration, and treating the burst traffic as abnormal traffic; When the abnormal traffic is detected, the packet rate and bit rate limits are reduced to control the traffic growth rate; Identify attack traffic through blacklist or access control list rules and isolate the attack traffic; Start traffic cleaning to ensure that the attack traffic is isolated.

[0056] It should be noted that a distributed denial of service attack (DDoS attack) is an attack method that consumes the resources of a network or network device through malicious traffic, which can cause the website to not operate normally or the online service to not be provided normally. Therefore, the detected network storm and DDoS attack are regarded as abnormal traffic. In addition, the presence of burst traffic is detected by using characteristics such as traffic fluctuation rate, packet size, and traffic duration. For example, a certain type of traffic suddenly surges in a short period of time, which can be identified as burst traffic. Burst traffic is also regarded as abnormal traffic. When burst traffic is detected, the packet rate and bit rate limits are reduced to control the traffic growth rate. Access Control List (ACL) is a network security technology that can allow or prevent traffic from entering or leaving the network by simply filtering the traffic when it reaches the network device. Specifically, it identifies data packets based on multiple factors such as source IP address, destination IP address, protocol type, port number, etc., and filters and controls them according to predefined rules. Blacklist and ACL rules can identify attack traffic and isolate attack traffic. For example, when it is detected that the traffic of a certain port increases by more than 5 times the normal level in a short period of time, the PPS limit of the port can be immediately reduced, and the storm control strength can be increased to limit the traffic of other ports.

[0057] Step S305: According to the network traffic status, adjust the storm control strategy based on a preset model.

[0058] It should be noted that the preset models include machine learning models and adaptive adjustment models.

[0059] In a feasible manner, the step of adjusting the storm control strategy based on a preset model according to the network traffic state includes: According to the network traffic status, the future network traffic change trend is predicted through the machine learning training model, and whether there is a storm risk is determined, and the packet rate and bit rate thresholds are adjusted according to the judgment results to avoid network congestion or storms; According to the network traffic status, the limits of packet rate and bit rate are dynamically adjusted through an adaptive adjustment model to ensure a stable operation state of the network.

[0060] The machine learning model uses historical traffic data to train the model, predict future network traffic trends, identify traffic patterns, determine whether there is a storm risk, and make adjustments in advance. For example, use the machine learning model to analyze traffic fluctuations and predict traffic trends in the next 5 minutes. Based on the prediction results, adjust the PPS / BPS threshold in advance to avoid network congestion or storms.

[0061] Adaptive control models such as PID control and fuzzy control are used to dynamically adjust PPS and BPS limits. The control strategy is continuously optimized by adjusting the algorithm so that the network can still operate stably under high load.

[0062] This embodiment obtains the flow data of the network device in real time, and obtains the network flow status according to the flow data; according to the network flow status, adjusts the storm control strategy based on the network load; adjusts the storm control strategy based on the priority of the application flow; according to the network flow status, adjusts the storm control strategy based on abnormal flow; according to the network flow status, adjusts the storm control strategy based on a preset model.

[0063] In summary, this embodiment adjusts the storm control strategy according to the network traffic status, network load, application traffic priority and preset model, and solves the problem of how to ensure the traffic requirements of different applications during storm control.

[0064] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the storm control method based on application identification of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0065] This application also provides a storm control device based on application recognition, please refer to Figure 3 , the storm control device based on application recognition includes: The identification module 10 is used to obtain the network traffic passing through the application layer, identify the application layer protocol corresponding to the network traffic, and obtain the application traffic type when a network storm is detected; A determination module 20, configured to determine the priority of the application traffic according to the application traffic type; The adjustment module 30 is used to obtain the network traffic status in real time, and determine and dynamically adjust the storm control strategy according to the network traffic status, the priority of the application traffic and the preset model, so as to perform network storm control through the dynamically adjusted storm control strategy.

[0066] In the present embodiment, when a network storm is detected, network traffic passing through the application layer is obtained, the application layer protocol corresponding to the network traffic is identified, and the application traffic type is obtained; the priority of the application traffic is determined according to the application traffic type; the network traffic status is obtained in real time, and the storm control strategy is determined and dynamically adjusted according to the network traffic status, the priority of the application traffic and a preset model, so as to control the network storm through the dynamically adjusted storm control strategy.

[0067] In summary, this embodiment solves the technical problem of how to ensure the traffic requirements of different applications during storm control by differentiating the priorities for different application traffic and adjusting the storm control strategy according to the priorities.

[0068] In one embodiment, the identification module 10 is also used to preprocess the data packets of the network traffic, wherein the preprocessing at least includes decoding the data packets and reorganizing the target data packets to obtain processed data packets; parsing the processed data packets to extract application layer protocol information, wherein the protocol information at least includes a data packet header and a payload; comparing the application layer protocol information with a preset protocol feature library, and obtaining the application traffic type of the processed data packet based on the comparison result.

[0069] In one embodiment, the determination module 20 is further used to determine the delay sensitivity and bandwidth requirement of the application traffic according to the application traffic type; sort the application traffic according to the delay sensitivity and the bandwidth requirement; and determine the priority of the application traffic according to the sorting result.

[0070] In one embodiment, the adjustment module 30 is also used to obtain the flow data of the network device in real time, and obtain the network flow status according to the flow data; according to the network flow status, adjust the storm control strategy based on the network load; adjust the storm control strategy based on the priority of the application flow; according to the network flow status, adjust the storm control strategy based on abnormal flow; according to the network flow status, adjust the storm control strategy based on a preset model.

[0071] In one embodiment, the adjustment module 30 is also used to increase the thresholds of the packet rate and the bit rate according to a first preset range when the network load reaches a preset upper limit; and to reduce the thresholds of the packet rate and the bit rate according to a second preset range when the network load reaches a preset lower limit.

[0072] In one embodiment, the adjustment module 30 is further used to obtain the real-time application traffic and the non-real-time application traffic according to the priority of the application traffic; when the network load increases, the bandwidth restriction on the real-time application traffic is reduced, and the bandwidth allocation of the non-real-time application traffic is reduced. The step of adjusting the storm control strategy based on the abnormal traffic according to the network traffic state includes: In one embodiment, the adjustment module 30 is also used to treat the detected network storm and distributed denial of service attack as abnormal traffic according to the network traffic status; detect burst traffic through traffic fluctuation rate, packet size and traffic duration, and treat the burst traffic as abnormal traffic; when the abnormal traffic is detected, reduce the limit of packet rate and bit rate to control the traffic growth rate; identify attack traffic through blacklist or access control list rules and isolate the attack traffic; start traffic cleaning to ensure that the attack traffic is isolated.

[0073] In one embodiment, the adjustment module 30 is also used to predict the future trend of network traffic changes through a machine learning training model according to the network traffic status, and determine whether there is a storm risk, and adjust the thresholds of the packet rate and the bit rate according to the judgment result to avoid network congestion or storms; according to the network traffic status, the packet rate and the bit rate limits are dynamically adjusted through an adaptive adjustment model to ensure the stable operation of the network.

[0074] In one embodiment, the adjustment module 30 is also used to divide the application traffic into real-time traffic, business traffic and non-critical traffic according to the priority of the application traffic, and to divert and limit the real-time traffic, the business traffic and the non-critical traffic respectively; set a dynamic restriction strategy for non-critical traffic to reduce the restriction on non-critical traffic when the network traffic increases; monitor and handle anomalies in network traffic in real time to avoid accidentally killing the non-critical traffic; regularly evaluate the network load and adjust the storm control strategy.

[0075] The storm control device based on application identification provided by the present application adopts the storm control method based on application identification in the above embodiment, which can solve the technical problem of how to ensure the traffic requirements of different applications during storm control. Compared with the prior art, the beneficial effects of the storm control device based on application identification provided by the present application are the same as the beneficial effects of the storm control method based on application identification provided by the above embodiment, and the other technical features of the storm control device based on application identification are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0076] The present application provides a storm control device based on application identification, and the storm control device based on application identification includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the storm control method based on application identification in the above-mentioned embodiment one.

[0077] Reference below Figure 4 , which shows a schematic diagram of the structure of a storm control device based on application identification suitable for implementing the embodiment of the present application. The storm control device based on application identification in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The storm control device based on application identification shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0078] like Figure 4As shown, the storm control device based on application recognition may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. Various programs and data required for the operation of the storm control device based on application recognition are also stored in RAM1004. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 may allow the storm control device based on application recognition to communicate wirelessly or wired with other devices to exchange data. Although the storm control device based on application recognition with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0079] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0080] The storm control device based on application identification provided by the present application adopts the storm control method based on application identification in the above embodiment, which can solve the technical problem of how to ensure the traffic requirements of different applications during storm control. Compared with the prior art, the beneficial effects of the storm control device based on application identification provided by the present application are the same as the beneficial effects of the storm control method based on application identification provided by the above embodiment, and the other technical features of the storm control device based on application identification are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0081] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0083] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the storm control method based on application program identification in the above-mentioned embodiment.

[0084] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0085] The computer-readable storage medium may be included in the storm control device based on application recognition; or may exist independently without being assembled into the storm control device based on application recognition.

[0086] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the storm control device based on application recognition, the storm control device based on application recognition: when a network storm is detected, obtains the network traffic passing through the application layer, identifies the application layer protocol corresponding to the network traffic, and obtains the application traffic type; determines the priority of the application traffic according to the application traffic type; obtains the network traffic status in real time, and determines and dynamically adjusts the storm control strategy according to the network traffic status, the priority of the application traffic and a preset model, so as to perform network storm control through the dynamically adjusted storm control strategy.

[0087] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0088] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0089] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0090] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned storm control method based on application identification, and can solve the technical problem of how to ensure the traffic requirements of different applications during storm control. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the storm control method based on application identification provided by the above-mentioned embodiment, and will not be repeated here.

[0091] The present application also provides a computer program product, including a computer program, which implements the steps of the storm control method based on application identification as described above when executed by a processor.

[0092] The computer program product provided by the present application can solve the technical problem of how to ensure the traffic requirements of different applications during storm control. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the storm control method based on application identification provided by the above embodiment, which will not be repeated here.

[0093] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A storm control method based on application identification, characterized in that: The method includes: In the case of detecting a network storm, obtaining network traffic passing through the application layer, identifying the application layer protocol corresponding to the network traffic, and obtaining the application traffic type; Determining the priority of the application traffic according to the application traffic type; The network traffic status is acquired in real time, and a storm control strategy is determined and dynamically adjusted according to the network traffic status, the priority of the application traffic, and a preset model, so as to perform network storm control through the dynamically adjusted storm control strategy.

2. The method according to claim 1, characterized in that The step of identifying the application layer protocol corresponding to the network traffic and obtaining the application traffic type comprises: Preprocessing the data packets of the network traffic, wherein the preprocessing at least includes decoding the data packets and reorganizing the target data packets to obtain processed data packets; Parsing the processed data packet to extract application layer protocol information, wherein the protocol information at least includes a data packet header and a payload; The application layer protocol information is compared with a preset protocol feature library, and the application traffic type of the processed data packet is obtained according to the comparison result.

3. The method according to claim 1, characterized in that The step of determining the priority of the application traffic according to the application traffic type comprises: Determining the delay sensitivity and bandwidth requirement of the application traffic according to the application traffic type; sorting the application traffic according to the delay sensitivity and the bandwidth requirement; Determine the priority of application traffic based on the sorting results.

4. The method according to claim 1, characterized in that The step of acquiring the network traffic status in real time and determining and dynamically adjusting the storm control strategy according to the network traffic status, the priority of the application traffic and the preset model includes: Acquire the flow data of network equipment in real time, and obtain the network flow status according to the flow data; According to the network traffic state, adjusting the storm control strategy based on the network load; adjusting the storm control strategy based on the priority of the application traffic; According to the network traffic state, adjusting the storm control strategy based on abnormal traffic; According to the network traffic status, the storm control strategy is adjusted based on a preset model.

5. The method according to claim 4, characterized in that The real-time acquisition of traffic data of network devices includes at least one of the following: Packet rate, bit rate, traffic type, delay and packet loss rate, protocol type, and application traffic type.

6. The method according to claim 4, characterized in that The step of adjusting the storm control strategy based on the network load according to the network traffic state includes: When the network load reaches a preset upper limit, the packet rate and the bit rate thresholds are increased according to a first preset amplitude; When the network load reaches a preset lower limit, the thresholds of the packet rate and the bit rate are reduced according to a second preset amplitude.

7. The method according to claim 4, characterized in that The step of adjusting the storm control strategy based on the priority of the application traffic includes: Obtaining real-time application traffic and non-real-time application traffic according to the priority of the application traffic; When the network load increases, the bandwidth restriction on the real-time application traffic is reduced, and the bandwidth allocation for the non-real-time application traffic is reduced.

8. The method according to claim 4, characterized in that The step of adjusting the storm control strategy based on abnormal traffic according to the network traffic state includes: According to the network traffic status, the detected network storm and distributed denial of service attack are regarded as abnormal traffic; Detecting burst traffic by flow fluctuation rate, packet size and flow duration, and treating the burst traffic as abnormal traffic; When the abnormal traffic is detected, the packet rate and bit rate limits are reduced to control the traffic growth rate; Identify attack traffic through blacklist or access control list rules and isolate the attack traffic; Start traffic cleaning to ensure that the attack traffic is isolated.

9. The method according to claim 4, characterized in that The step of adjusting the storm control strategy based on a preset model according to the network traffic state includes: According to the network traffic status, the future network traffic change trend is predicted through the machine learning training model, and whether there is a storm risk is determined, and the packet rate and bit rate thresholds are adjusted according to the judgment results to avoid network congestion or storms; According to the network traffic status, the limits of packet rate and bit rate are dynamically adjusted through an adaptive adjustment model to ensure a stable operation state of the network.

10. The method according to claim 1, characterized in that After the network storm control is performed by the dynamically adjusted storm control strategy, the method further includes: According to the priority of the application traffic, the application traffic is divided into real-time traffic, business traffic and non-critical traffic, and the real-time traffic, the business traffic and the non-critical traffic are respectively diverted and speed-limited; Set dynamic restriction policies for non-critical traffic, and reduce restrictions on non-critical traffic when network traffic increases; Monitor and handle abnormal situations in network traffic in real time to avoid accidentally killing non-critical traffic; Regularly evaluate network load conditions and adjust the storm control strategy.

Images