Distributed flow mirror image acquisition method realized based on ovs flow table and VXLAN protocol

Abstract

The invention discloses a distributed traffic mirror image acquisition method based on an OVS flow table and a VXLAN protocol, and the method comprises the following steps: S1, initializing a working environment, and configuring an OVS service; s2, creating a virtual machine and acquiring network bridge information of the virtual machine; s3, binding the VXLAN tunnel interface to a network bridge of the virtual machine; s4, adding a flow table rule in the network bridge to realize flow matching and mirror image output; s5, the rules are dynamically adjusted through an adaptive flow table optimization algorithm, and the flow processing efficiency is improved; s6, detecting and removing repeated data packets by using an in-segment data deduplication algorithm; s7, receiving the mirror image data and carrying out traffic summarization and classification processing; and S8, completing distributed flow collection, and obtaining high-quality flow data for analysis and processing. According to the method, additional services are not needed, the deployment process is simplified, the flow collection efficiency and the data integrity are improved through dynamic adjustment and de-duplication optimization, and the method is suitable for network flow management and analysis of a large-scale cloud computing environment.

Description

Technical Field

[0001] The present invention relates to the field of virtualized network communication, and in particular to a method for distributed traffic mirroring collection based on an OVS flow table and a VXLAN protocol. Background Art

[0002] With the rapid development of cloud computing technology, the demand for traffic management and data collection in large-scale virtualized environments is growing. In cloud computing systems, network traffic analysis between virtual machines is an important means to ensure service quality and improve network performance. However, when facing complex virtualized network environments, existing traffic mirroring collection methods have problems such as complex deployment, high resource usage, and insufficient data quality, which makes it difficult to meet the needs of modern cloud computing systems for efficient distributed traffic management.

[0003] Traditional traffic mirroring collection methods usually adopt two implementation schemes: one is to collect virtual network card traffic through tools in the virtual machine, generate data files and then analyze them offline; the other is to install additional traffic collection service programs to realize the collection and analysis of real-time traffic data. These methods can play a certain role in small-scale network environments, but they expose the following significant deficiencies in large-scale virtualized environments: The first is that the deployment is complex and has a great impact on the existing environment; traditional traffic collection solutions require the installation of additional tools or services on each virtual machine, which interferes with the operating environment of the cloud computing system and increases the complexity of deployment and maintenance.

[0004] Second, the collection scope is limited, making it difficult to achieve distributed traffic management; existing methods are usually limited to local collection of single-node traffic and lack the ability to globally manage cross-node traffic. In a large-scale cloud computing environment, virtual machines may be distributed across multiple physical nodes, and their network traffic needs to be collected and analyzed across nodes. Traditional methods cannot break through the limitations of physical nodes, resulting in incomplete collected data and difficulty meeting the needs of global network traffic analysis.

[0005] The third problem is the poor quality of data collection and the lack of dynamic optimization capabilities. Traditional methods usually do not optimize data when collecting traffic, and the collected data may contain a lot of redundant content, increasing the burden of transmission and storage. When mirroring traffic, duplicate data packets are not effectively removed, which not only wastes network bandwidth but also reduces the efficiency of data analysis.

[0006] Therefore, how to provide a method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol is a problem that technicians in this field need to solve urgently. Summary of the invention

[0007] One purpose of the present invention is to propose a distributed traffic mirroring collection method based on OVS flow table and VXLAN protocol. The present invention makes full use of virtualized network technology, SDN technology and data deduplication optimization algorithm, and describes in detail the specific implementation scheme of configuring OVS flow table rules, dynamically adjusting traffic processing rules and collecting traffic mirroring across nodes, which has the advantages of simple deployment, high data integrity and high collection efficiency.

[0008] A method for distributed traffic mirroring collection based on an ovs flow table and a VXLAN protocol according to an embodiment of the present invention includes the following steps: S1. Initialize the OVS working environment, including installing and configuring the OVS service on the host machine; S2. Create a target virtual machine and obtain the OVS bridge name to which the actual network interface of the target virtual machine is bound; S3. Create a VXLAN tunnel interface and bind it to the OVS bridge where the target VM is located. S4. Add flow table rules on the OVS bridge to which the target virtual machine belongs, including configuring traffic matching conditions and traffic forwarding actions, copy the traffic of the target virtual machine through the flow table rules and output it to the VXLAN tunnel interface; S5, introduce adaptive flow table optimization algorithm, adjust flow table rules in real time according to dynamic changes of network traffic, optimize traffic processing efficiency and resource utilization; S6. Use the intra-segment data deduplication algorithm to detect and remove duplicate data packets in the same data segment before traffic mirroring transmission; S7, receiving the traffic mirroring data transmitted through the VXLAN tunnel on the OVS bridge of the traffic processing node, and summarizing the traffic according to the preset rules; S8. Complete the distributed traffic mirroring collection and obtain the full traffic data of the target virtual machine for traffic analysis and processing.

[0009] Optionally, the S4 includes: S41. Define a set of traffic matching conditions in the OVS bridge to which the target virtual machine belongs. , where each flow matches the condition Indicates specific traffic characteristics, including source IP address, destination IP address, source port, destination port, and protocol type; S42, send flow table rules to the OVS bridge through the OpenFlow protocol, the flow table rules include traffic matching conditions and forwarding actions , where each forwarding action Specify matching conditions The traffic is copied and output to the VXLAN tunnel interface; S43. Set priority parameters in flow table rules , priority The value determines the order in which rules are executed when traffic meets multiple matching conditions at the same time. is defined as: ,in, Indicates the weight coefficient of the matching condition, Indicates the matching strength when the condition is met. is the set of all flow conditions; S44, deploy the configured flow table rules to the OVS bridge in a real-time update manner, so that the traffic of the target virtual machine is matched and copied according to the flow table rules, and transmitted to the designated traffic processing node through the VXLAN tunnel interface; S45. Dynamically monitor the execution results of traffic forwarding and record matching conditions and forwarding actions The hit statistics are used to optimize the flow table rules.

[0010] Optionally, the S5 includes: S51. Collect the current network traffic status parameter set of the target virtual machine ,in Indicates specific traffic characteristic parameters, including traffic size, transmission rate, and network delay; S52, establish flow state evaluation function , evaluate the target virtual machine in time Dynamic changes in network traffic at all times: ; in, Indicates time The actual value of the traffic characteristic parameter at the moment, The traffic feature weight indicates the importance of a specific feature to system performance and traffic mirroring collection strategy, and is dynamically adjusted according to the network environment. S53, according to Dynamically adjust flow table rules based on evaluation results, including optimizing the set of traffic matching conditions and forwarding action set , the adjustment factor is defined as: ; in, Indicates traffic characteristics The relative contribution ratio to the optimization strategy, used to dynamically allocate resources, is a minimum value, which is used to avoid calculation errors when the characteristic parameter is zero; S54, define the dynamic adjustment strategy of the flow table rule priority, priority parameter : ; in, Indicates the priority of the flow table rule item. To adjust the proportional coefficient, used to control the range of priority changes, It is the preset maximum priority value, which is used to limit the priority range to avoid unreasonable allocation; S55, through the optimized flow table rules, the rules are sent to the OVS bridge to realize the processing and dynamic optimization of the target virtual machine traffic; S56. Monitor the adjusted traffic processing performance and record the performance parameters before and after optimization. and , calculation performance improvement rate : ; in, Indicates the performance improvement ratio after flow table optimization, which is used to quantify the impact of flow table rule adjustment on traffic mirroring collection efficiency.

[0011] Optionally, the S53 includes: S531. According to the dynamic changes of the network traffic of the target virtual machine, collect the current network traffic state parameter set of the target virtual machine ; S532, build dynamic adjustment coefficient ; S533, using dynamic adjustment coefficient Matching condition set in flow table rules Optimize and optimize the matching condition set The update rule is: ; in, is the optimized matching condition value, is the original matching condition value; S534: forwarding action set Optimize and optimize the forwarding action set The update rule is: ; in, is the optimized forwarding action value, is the original forwarding action value, is the action adjustment factor, which is used to control the upper limit of action adjustment; S535: The optimized matching condition set and forwarding action set Deploy to the OVS flow table of the target virtual machine and dynamically update the flow table rules; S536. Based on real-time monitoring of the running status of the optimized flow table rules, evaluate the execution effect of the traffic matching conditions and forwarding actions, and adjust the flow table update frequency in combination with the dynamic change trend of the traffic.

[0012] Optionally, the S6 includes: S61. Extract the traffic mirror data packet set of the target virtual machine ,in Indicates the mirrored traffic. Data packets, record the transmission timestamp, source address, destination address and data content hash value of each data packet; S62: Collect the extracted data packets Apply intra-segment data deduplication algorithms by building improved duplicate detection functions Identify duplicate relationships between packets: ; in, For data packets The content hash value of Represents the bitwise XOR operation of the hash value, which is used to measure the similarity of the data packet content. is the threshold of hash value difference, For data packets timestamp, is the detection time window, when When the data packet Identified as a duplicate package; S63, based on the result of the duplicate detection function, the data packet set Divide into unique sets of packets and duplicate packet collection ,in, , unique data packet set Reserved for traffic analysis and transmission, repeated data packet collection Marked as redundant data; S64. Define the optimized traffic transmission ratio : ; in, and Represents the size of the unique data packet set and the original data packet set, and They represent the importance weights of the data packets in the corresponding set, respectively. The weights are calculated based on the frequency and priority of the data packets in the network. S65: The unique data packet after deduplication is collected The data is output to the traffic processing node and transmitted through the VXLAN tunnel interface. The optimized data packet transmission performance indicators are recorded, including the transmission efficiency and bandwidth occupancy ratio before and after optimization.

[0013] Optionally, the S62 includes: S621, traffic mirroring data packet set for the target virtual machine Define the method for generating the hash value of the data packet content and generate the hash value using the following formula : ; in, Represents the payload of the data packet, including the main content of the data packet. Represents the metadata of the data packet, including source address, destination address and port number information. Represents a splicing operation, Represents a hash function, which is used to generate a unique hash identifier; S622. Construct duplicate detection function , combined with the hash value and timestamp of the data packet, it is determined whether two data packets are duplicates.

[0014] Optionally, the S7 includes: S71. On the OVS bridge of the traffic processing node, receive a set of traffic mirror data packets transmitted through the VXLAN tunnel, process the received data packets, and import them into the traffic aggregation interface; S72, classifying the received data packets according to the source address, the destination address, and the protocol type flow characteristics, and generating a set of classification indexes, each of which is used to identify an independent flow group; S73, according to the classification index set, grouping the data packets according to the classification index to form multiple groups of traffic group data, each group of traffic data packets containing all data packets with the same classification index; S74, storing the grouped traffic data and recording statistical information of each group of data, including the number of data packets, the total traffic size, and the proportion of the total traffic; S75, further analyzing the grouped traffic data, forwarding the traffic that meets the analysis conditions to a designated analysis module or storage node, and discarding or archiving the traffic data that does not meet the analysis conditions according to preset rules; S76. Dynamically adjust classification rules and storage strategies based on real-time changes in traffic to optimize resource allocation and operating efficiency of traffic processing nodes.

[0015] The beneficial effects of the present invention are: (1) The present invention combines virtualized network technology and SDN technology to achieve efficient collection and cross-node transmission of target virtual machine traffic in a distributed environment. By configuring OVS flow table rules and using the VXLAN protocol, the present invention can complete the traffic mirroring collection task without installing additional services, simplifying the deployment process, reducing interference with the existing virtualized network environment, and significantly improving the deployment flexibility and adaptability of the system.

[0016] (2) The present invention adopts an adaptive flow table optimization algorithm and an intra-segment data deduplication algorithm to adjust the traffic processing rules in real time during the traffic collection process and remove redundant data packets in transmission, effectively improving the efficiency of traffic collection and the transmission quality. This method achieves flexible management of complex network traffic by dynamically optimizing flow table rules, improves the resource utilization of traffic processing nodes, and provides a complete and high-quality data foundation for subsequent traffic analysis.

[0017] (3) The present invention achieves efficient aggregation and hierarchical management of traffic by classifying and grouping mirror data at traffic processing nodes. Classified data supports further analysis of critical traffic and archiving of non-critical traffic. Combined with dynamic adjustment strategies, it optimizes the operating efficiency and resource allocation of traffic processing nodes, effectively meeting the traffic analysis needs in large-scale cloud computing environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 A flow chart of a method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol proposed by the present invention; Figure 2 The present invention provides a flow chart of flow table rules and traffic classification processing in a method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol. DETAILED DESCRIPTION

[0019] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0020] refer to Figure 1-2 , a method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol, comprising the following steps: S1. Initialize the OVS working environment, including installing and configuring the OVS service on the host machine; S2. Create a target virtual machine and obtain the OVS bridge name to which the actual network interface of the target virtual machine is bound; S3. Create a VXLAN tunnel interface and bind it to the OVS bridge where the target VM is located. S4. Add flow table rules on the OVS bridge to which the target virtual machine belongs, including configuring traffic matching conditions and traffic forwarding actions, copy the traffic of the target virtual machine through the flow table rules and output it to the VXLAN tunnel interface; S5, introduce adaptive flow table optimization algorithm, adjust flow table rules in real time according to dynamic changes of network traffic, optimize traffic processing efficiency and resource utilization; S6. Use the intra-segment data deduplication algorithm to detect and remove duplicate data packets in the same data segment before traffic mirroring transmission; S7, receiving the traffic mirroring data transmitted through the VXLAN tunnel on the OVS bridge of the traffic processing node, and summarizing the traffic according to the preset rules; S8. Complete the distributed traffic mirroring collection and obtain the full traffic data of the target virtual machine for traffic analysis and processing.

[0021] In this implementation, S4 includes: S41. Define a set of traffic matching conditions in the OVS bridge to which the target virtual machine belongs. , where each flow matches the condition Indicates specific traffic characteristics, including source IP address, destination IP address, source port, destination port, and protocol type; S42, send flow table rules to the OVS bridge through the OpenFlow protocol, the flow table rules include traffic matching conditions and forwarding actions , where each forwarding action Specify matching conditions The traffic is copied and output to the VXLAN tunnel interface; S43. Set priority parameters in flow table rules , priority The value determines the order in which rules are executed when traffic meets multiple matching conditions at the same time. is defined as: ,in, Indicates the weight coefficient of the matching condition, Indicates the matching strength when the condition is met. is the set of all flow conditions; S44, deploy the configured flow table rules to the OVS bridge in a real-time update manner, so that the traffic of the target virtual machine is matched and copied according to the flow table rules, and transmitted to the designated traffic processing node through the VXLAN tunnel interface; S45. Dynamically monitor the execution results of traffic forwarding and record matching conditions and forwarding actions The hit statistics are used to optimize the flow table rules.

[0022] In this implementation, S5 includes: S51. Collect the current network traffic status parameter set of the target virtual machine ,in Indicates specific traffic characteristic parameters, including traffic size, transmission rate, and network delay; S52, establish flow state evaluation function , evaluate the target virtual machine in time Dynamic changes in network traffic at all times: ; in, Indicates time The actual value of the traffic characteristic parameter at the moment, The traffic feature weight indicates the importance of a specific feature to system performance and traffic mirroring collection strategy, and is dynamically adjusted according to the network environment. S53, according to Dynamically adjust flow table rules based on evaluation results, including optimizing the set of traffic matching conditions and forwarding action set , the adjustment factor is defined as: ; in, Indicates traffic characteristics The relative contribution ratio to the optimization strategy, used to dynamically allocate resources, is a minimum value, which is used to avoid calculation errors when the characteristic parameter is zero; S54, define the dynamic adjustment strategy of the flow table rule priority, priority parameter : ; in, Indicates the priority of the flow table rule item. To adjust the proportional coefficient, used to control the range of priority changes, It is the preset maximum priority value, which is used to limit the priority range to avoid unreasonable allocation; S55, through the optimized flow table rules, the rules are sent to the OVS bridge to realize the processing and dynamic optimization of the target virtual machine traffic; S56. Monitor the adjusted traffic processing performance and record the performance parameters before and after optimization. and , calculation performance improvement rate : ; in, Indicates the performance improvement ratio after flow table optimization, which is used to quantify the impact of flow table rule adjustment on traffic mirroring collection efficiency.

[0023] In this implementation, the S53 includes: S531. According to the dynamic changes of the network traffic of the target virtual machine, collect the current network traffic state parameter set of the target virtual machine ; S532, build dynamic adjustment coefficient ; S533, using dynamic adjustment coefficient Matching condition set in flow table rules Optimize and optimize the matching condition set The update rule is: ; in, is the optimized matching condition value, is the original matching condition value; S534: forwarding action set Optimize and optimize the forwarding action set The update rule is: ; in, is the optimized forwarding action value, is the original forwarding action value, is the action adjustment factor, which is used to control the upper limit of action adjustment; S535: The optimized matching condition set and forwarding action set Deploy to the OVS flow table of the target virtual machine and dynamically update the flow table rules; S536. Based on real-time monitoring of the running status of the optimized flow table rules, evaluate the execution effect of the traffic matching conditions and forwarding actions, and adjust the flow table update frequency in combination with the dynamic change trend of the traffic.

[0024] In this implementation, S6 includes: S61. Extract the traffic mirror data packet set of the target virtual machine ,in Indicates the mirrored traffic. Data packets, record the transmission timestamp, source address, destination address and data content hash value of each data packet; S62: Collect the extracted data packets Apply intra-segment data deduplication algorithms by building improved duplicate detection functions Identify duplicate relationships between packets: ; in, For data packets The content hash value of Represents the bitwise XOR operation of the hash value, which is used to measure the similarity of the data packet content. is the threshold of hash value difference, For data packets timestamp, is the detection time window, when When the data packet Identified as a duplicate package; S63, based on the result of the duplicate detection function, the data packet set Divide into unique sets of packets and duplicate packet collection ,in, , unique data packet set Reserved for traffic analysis and transmission, repeated data packet collection Marked as redundant data; S64. Define the optimized traffic transmission ratio : ; in, and Represents the size of the unique data packet set and the original data packet set, and They represent the importance weights of the data packets in the corresponding set, respectively. The weights are calculated based on the frequency and priority of the data packets in the network. S65: The unique data packet after deduplication is collected The data is output to the traffic processing node and transmitted through the VXLAN tunnel interface. The optimized data packet transmission performance indicators are recorded, including the transmission efficiency and bandwidth occupancy ratio before and after optimization.

[0025] In this implementation, the S62 includes: S621, traffic mirroring data packet set for the target virtual machine Define the method for generating the hash value of the data packet content and generate the hash value using the following formula : ; in, Represents the payload of the data packet, including the main content of the data packet. Represents the metadata of the data packet, including source address, destination address and port number information. Represents a splicing operation, Represents a hash function, which is used to generate a unique hash identifier; S622. Construct duplicate detection function , combined with the hash value and timestamp of the data packet, it is determined whether two data packets are duplicates.

[0026] In this implementation, the S7 includes: S71. On the OVS bridge of the traffic processing node, receive a set of traffic mirror data packets transmitted through the VXLAN tunnel, process the received data packets, and import them into the traffic aggregation interface; S72, classifying the received data packets according to the source address, the destination address, and the protocol type flow characteristics, and generating a set of classification indexes, each of which is used to identify an independent flow group; S73, according to the classification index set, grouping the data packets according to the classification index to form multiple groups of traffic group data, each group of traffic data packets containing all data packets with the same classification index; S74, storing the grouped traffic data and recording statistical information of each group of data, including the number of data packets, the total traffic size, and the proportion of the total traffic; S75, further analyzing the grouped traffic data, forwarding the traffic that meets the analysis conditions to a designated analysis module or storage node, and discarding or archiving the traffic data that does not meet the analysis conditions according to preset rules; S76. Dynamically adjust classification rules and storage strategies based on real-time changes in traffic to optimize resource allocation and operating efficiency of traffic processing nodes.

[0027] Embodiment 1: In the data center of a large Internet company in China, the company is mainly responsible for providing cloud computing services to global users, involving the distributed deployment of virtual machines, network traffic monitoring, and efficient data management. With the continuous expansion of the scale of the data center, the company faces the following major challenges: how to accurately collect the network traffic of large-scale virtual machines without affecting the existing virtualized network environment; how to achieve efficient management and transmission of distributed traffic; and how to ensure the integrity and quality of collected data. To this end, the company decided to introduce the distributed traffic mirroring collection method based on the OVS flow table and VXLAN protocol proposed in the present invention to optimize its traffic management system.

[0028] In actual application, the enterprise deployed the method of the present invention in a large data center with 500 servers and more than 3,000 virtual machines. The deployment process first installs and configures the OVS service in each host machine to initialize the network environment; then creates a VXLAN tunnel interface on the target virtual machine, and implements real-time mirroring and transmission of virtual machine traffic through flow table rule configuration. By introducing an adaptive flow table optimization algorithm, the flow table rules are dynamically adjusted to cope with dynamic changes in network traffic, ensuring priority processing of critical traffic. In addition, the intra-segment data deduplication algorithm effectively removes duplicate data packets in mirror transmission, significantly improving transmission efficiency.

[0029] In a test in a data center, the network traffic of 100 virtual machines was selected for mirroring. The test results show that compared with traditional traffic collection methods (such as tcpdump or installing third-party traffic analysis tools), the method of the present invention has obvious advantages in deployment efficiency and data quality. The specific performance is as follows: Table 1 Performance comparison before and after the implementation of distributed traffic mirroring As shown in Table 1 above, in actual scenario applications, the intra-segment data deduplication algorithm of the present invention efficiently identifies and removes redundant data packets in mirror transmission. Taking a peak traffic period as an example (the peak traffic of a virtual machine is 500Mbps), about 15% of the data packets generated by the traditional method are duplicate packets, and the present invention reduces the repetition rate to 2% through dynamic hash detection and time window filtering, effectively reducing bandwidth occupancy. In addition, the adaptive flow table optimization algorithm dynamically adjusts the matching rules according to the real-time changes in traffic, and realizes the priority processing of critical traffic. In a burst traffic event (the target virtual machine traffic instantly increased to 800 Mbps), the packet loss rate of the traditional method was as high as 5%, while the present invention reduced the packet loss rate to 0.5% through real-time rule adjustment.

[0030] After the implementation of the present invention, the overall traffic collection efficiency and system operation stability are significantly improved. It not only solves the problems of complex deployment and insufficient data quality of traditional traffic collection methods, but also greatly reduces system resource overhead and optimizes the performance of distributed traffic collection and management. Compared with traditional methods, the present invention provides a more intelligent and accurate solution in a dynamic network environment, and provides strong technical support for traffic management and data analysis in a cloud computing environment.

[0031] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol, characterized in that: The following steps are involved: S1. Initialize the OVS working environment, including installing and configuring the OVS service on the host machine; S2. Create a target virtual machine and obtain the OVS bridge name to which the actual network interface of the target virtual machine is bound; S3. Create a VXLAN tunnel interface and bind it to the OVS bridge where the target VM is located. S4. Add flow table rules on the OVS bridge to which the target virtual machine belongs, including configuring traffic matching conditions and traffic forwarding actions, copy the traffic of the target virtual machine through the flow table rules and output it to the VXLAN tunnel interface; S5, introduce adaptive flow table optimization algorithm, adjust flow table rules in real time according to dynamic changes of network traffic, optimize traffic processing efficiency and resource utilization; S6. Use the intra-segment data deduplication algorithm to detect and remove duplicate data packets in the same data segment before traffic mirroring transmission; S7, receiving the traffic mirroring data transmitted through the VXLAN tunnel on the OVS bridge of the traffic processing node, and summarizing the traffic according to the preset rules; S8. Complete the distributed traffic mirroring collection and obtain the full traffic data of the target virtual machine for traffic analysis and processing.

2. A method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol implementation according to claim 1, characterized in that, The S4 includes: S41. Define a set of traffic matching conditions in the OVS bridge to which the target virtual machine belongs. , where each flow matches the condition Indicates specific traffic characteristics, including source IP address, destination IP address, source port, destination port, and protocol type; S42, send flow table rules to the OVS bridge through the OpenFlow protocol, the flow table rules include traffic matching conditions and forwarding actions , where each forwarding action Specify matching conditions The traffic is copied and output to the VXLAN tunnel interface; S43. Set priority parameters in flow table rules , priority The value determines the order in which rules are executed when traffic meets multiple matching conditions at the same time. is defined as: ,in, Indicates the weight coefficient of the matching condition, Indicates the matching strength when the condition is met. is the set of all flow conditions; S44, deploy the configured flow table rules to the OVS bridge in real-time update mode, so that the traffic of the target virtual machine is matched and copied according to the flow table rules, and transmitted to the designated traffic processing node through the VXLAN tunnel interface; S45. Dynamically monitor the execution results of traffic forwarding and record matching conditions and forwarding actions The hit statistics are used to optimize the flow table rules.

3. A method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol implementation according to claim 1, characterized in that, The S5 includes: S51. Collect the current network traffic status parameter set of the target virtual machine ,in Indicates specific traffic characteristic parameters, including traffic size, transmission rate, and network delay; S52, establish flow state evaluation function , evaluate the target virtual machine in time Dynamic changes in network traffic at all times: ； in, Indicates time The actual value of the traffic characteristic parameter at the moment, The traffic feature weight indicates the importance of a specific feature to system performance and traffic mirroring collection strategy, and is dynamically adjusted according to the network environment. S53, according to Dynamically adjust flow table rules based on evaluation results, including optimizing the set of traffic matching conditions and forwarding action set , the adjustment factor is defined as: ； in, Indicates traffic characteristics The relative contribution ratio to the optimization strategy, used to dynamically allocate resources, is a minimum value, which is used to avoid calculation errors when the characteristic parameter is zero; S54, define the dynamic adjustment strategy of the flow table rule priority, priority parameter : ； in, Indicates the priority of the flow table rule item. To adjust the proportional coefficient, used to control the range of priority changes, It is the preset maximum priority value, which is used to limit the priority range to avoid unreasonable allocation; S55, through the optimized flow table rules, the rules are sent to the OVS bridge to realize the processing and dynamic optimization of the target virtual machine traffic; S56. Monitor the adjusted traffic processing performance and record the performance parameters before and after optimization. and , calculation performance improvement rate : ； in, Indicates the performance improvement ratio after flow table optimization, which is used to quantify the impact of flow table rule adjustment on traffic mirroring collection efficiency.

4. A method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol implementation according to claim 3, characterized in that, The S53 includes: S531. According to the dynamic changes of the network traffic of the target virtual machine, collect the current network traffic state parameter set of the target virtual machine ; S532, build dynamic adjustment coefficient ; S533, using dynamic adjustment coefficient Matching condition set in flow table rules Optimize and optimize the matching condition set The update rule is: ； in, is the optimized matching condition value, is the original matching condition value; S534: forwarding action set Optimize and optimize the forwarding action set The update rule is: ； in, is the optimized forwarding action value, is the original forwarding action value, is the action adjustment factor, which is used to control the upper limit of action adjustment; S535: The optimized matching condition set and forwarding action set Deploy to the OVS flow table of the target virtual machine and dynamically update the flow table rules; S536. Based on real-time monitoring of the running status of the optimized flow table rules, evaluate the execution effect of the traffic matching conditions and forwarding actions, and adjust the flow table update frequency in combination with the dynamic change trend of the traffic.

5. A method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol implementation according to claim 1, characterized in that, The S6 includes: S61. Extract the traffic mirror data packet set of the target virtual machine ,in Indicates the mirrored traffic. Data packets, record the transmission timestamp, source address, destination address and data content hash value of each data packet; S62: Collect the extracted data packets Apply intra-segment data deduplication algorithms by building improved duplicate detection functions Identify duplicate relationships between packets: ； in, For data packets The content hash value of Represents the bitwise XOR operation of the hash value, which is used to measure the similarity of the data packet content. is the threshold of hash value difference, For data packets timestamp, is the detection time window, when When the data packet Identified as a duplicate package; S63, based on the result of the duplicate detection function, the data packet set Divide into unique sets of packets and duplicate packet collection ,in, , unique data packet set Reserved for traffic analysis and transmission, repeated data packet collection Marked as redundant data; S64. Define the optimized traffic transmission ratio : ； in, and Represents the size of the unique data packet set and the original data packet set, and They represent the importance weights of the data packets in the corresponding set, respectively. The weights are calculated based on the frequency and priority of the data packets in the network. S65: The unique data packet after deduplication is collected The data is output to the traffic processing node and transmitted through the VXLAN tunnel interface. The optimized data packet transmission performance indicators are recorded, including the transmission efficiency and bandwidth occupancy ratio before and after optimization.

6. A method for distributed traffic mirroring acquisition based on ovs flow table and VXLAN protocol according to claim 5, characterized in that, The S62 includes: S621, traffic mirroring data packet set for the target virtual machine Define the method for generating the hash value of the data packet content and generate the hash value using the following formula : ； in, Represents the payload of the data packet, including the main content of the data packet. Represents the metadata of the data packet, including source address, destination address and port number information, Represents a splicing operation, Represents a hash function, which is used to generate a unique hash identifier; S622. Construct duplicate detection function , combined with the hash value and timestamp of the data packet, it is determined whether two data packets are duplicates.

7. A method for distributed traffic mirroring collection based on ovs flow table and VXLAN protocol according to claim 1, characterized in that, The S7 comprises: S71. On the OVS bridge of the traffic processing node, receive a set of traffic mirror data packets transmitted through the VXLAN tunnel, process the received data packets, and import them into the traffic aggregation interface; S72, classifying the received data packets according to the source address, the destination address, and the protocol type flow characteristics, and generating a set of classification indexes, each of which is used to identify an independent flow group; S73, according to the classification index set, grouping the data packets according to the classification index to form multiple groups of traffic group data, each group of traffic data packets containing all data packets with the same classification index; S74, storing the grouped traffic data and recording statistical information of each group of data, including the number of data packets, the total traffic size, and the proportion of the total traffic; S75, further analyzing the grouped traffic data, forwarding the traffic that meets the analysis conditions to a designated analysis module or storage node, and discarding or archiving the traffic data that does not meet the analysis conditions according to preset rules; S76. Dynamically adjust classification rules and storage strategies based on real-time changes in traffic to optimize resource allocation and operating efficiency of traffic processing nodes.

Images