An adaptive bidirectional traffic shaping method and system suitable for service mesh

Abstract

The application discloses a kind of adaptive bidirectional traffic shaping method and system suitable for service grid, it is related to network security technical field, the metadata collection mechanism based on time window of the present application makes system can continuously perceive service state change, by the configuration file of dynamic updating shaping strategy, it is realized to the quick adaptation of new service on-line, traffic mode change etc. Scene, by dynamically clustering analysis service traffic characteristics, can automatically identify key services and form optimal shaping strategy, realize the accurate allocation of network resources, effectively avoid the problem of bandwidth waste or key service resource shortage caused by traditional fixed strategy. Adopt sending / receiving double-agent architecture, implement cooperative shaping at both ends of communication. The sending end marks the shaped traffic by header identification, and the receiving end significantly reduces the impact of burst traffic on the system through intelligent reorganization and differential processing of virtual / real requests, improving the stability and reliability of inter-service communication.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a self-adaptive bidirectional traffic shaping method and system suitable for a service mesh. BACKGROUND

[0002] As a new paradigm, cloud native is widely welcomed due to its flexibility and scalability. In addition, service mesh, as a typical technology in cloud native, is also widely used in the governance of microservices. Unlike traditional monolithic applications, cloud native applications are decoupled into multiple microservices, which can be developed, deployed and run independently. These microservices communicate with each other through network-exposed remote calls. This creates a potential attack surface, and attackers can profile the behavior of services based on the analysis of network traffic indicators. These traffic characteristics make microservices vulnerable to traffic analysis attacks, which may lead to privacy leakage.

[0003] Existing works usually protect the side channel of network traffic by performing traffic shaping. There are mainly the following ways. The first way is to divide the traffic into several categories obtained through a large amount of research according to public information as an indicator and packet arrival time and packet queuing time as a basis, and to determine the shaping scheme according to the indicator and other traffic characteristics. The disadvantage is that it needs pre-research and is high in cost. If the classification is not complete, the applicability is not high. The second way is to process application traffic in a periodic and fixed-length shaping interval according to a pre-set sensitivity. In a shaping interval, it accumulates application traffic into a buffer. The length of the buffer is the total traffic in the interval, and then the traffic in the buffer is differentially private shaping. The disadvantage is that the sensitivity needs to be set by oneself, and the higher the sensitivity, the lower the communication efficiency, and it is difficult to determine a suitable sensitivity to balance the relationship between privacy and efficiency. The third way is to insert a virtual packet in the interval by analyzing the actual traffic packet interval time. If no new actual data packet arrives in the expected interval, a virtual packet is sent to "fill" the interval. The disadvantage is that it cannot resist deep learning analysis attacks.

[0004] From the above, in the feasible scheme of application traffic shaping, the shaping strategy adopted by the application traffic is particularly important in the network side channel defense process. In the above three schemes, the adaptability to the cloud native scene, the strategy hot update, and the effectiveness of the strategy cannot well meet the actual needs in the cloud native scene. SUMMARY

[0005] In order to solve the above problems in the prior art, the application provides a self-adaptive bidirectional traffic shaping method and system suitable for a service mesh. The technical problems to be solved by the application are realized through the following technical scheme:

[0006] The application provides an adaptive bidirectional traffic shaping method suitable for a service grid, comprising:

[0007] Step 1: collecting metadata of each service in a preset time window;

[0008] Step 2: identifying a key service according to the metadata, and clustering all services according to traffic characteristics to form a service cluster to be shaped based on the key service;

[0009] Step 3: generating shaping standards of the service cluster to be shaped based on the traffic characteristics, and generating a configuration file of a shaping strategy according to the shaping standards;

[0010] Step 4: generating corresponding shaping agent components for services in the service cluster to be shaped, wherein the shaping agent components comprise a sending shaping agent and a receiving shaping agent;

[0011] Step 5: at a sending end, the sending shaping agent of the sending end shapes the traffic to be sent according to the configuration file and identifies the header of the shaped traffic; at a receiving end, when the receiving shaping agent of the receiving end receives the traffic, it judges whether the traffic is shaped traffic, if yes, it recombines the same packets according to the header identification of the traffic, executes service processing logic and generates a response to return to the receiving shaping agent of the sending end, wherein a virtual request is generated into a virtual response according to the configuration file, and a real request is shaped into a real response according to the configuration file; if not, it executes service processing logic and generates a response to return to the receiving shaping agent of the sending end.

[0012] In an embodiment of the application, the metadata comprises a service name, log information, a service topology diagram of an application and traffic between services.

[0013] In an embodiment of the application, the step 2 comprises:

[0014] Step 2.1: identifying a key service according to the metadata;

[0015] Step 2.2: determining traffic characteristics of each service according to the metadata;

[0016] Step 2.3: calculating similarity between each service and the key service through a clustering algorithm according to the traffic characteristics, and selecting a preset number of services to form the service cluster to be shaped with the key service as a cluster center according to the similarity.

[0017] In an embodiment of the application, the traffic characteristics comprise a time interval and a packet size.

[0018] In an embodiment of the application, the step 3 comprises:

[0019] Step 3.1: According to the traffic characteristics of each service in the service cluster to be shaped, the confidence interval of the traffic characteristics of the service cluster to be shaped is calculated;

[0020] Step 3.2: Taking the maximum value in the confidence interval as the shaping standard of the service cluster to be shaped;

[0021] Step 3.3: According to the shaping standard, a configuration file of the shaping policy is generated by a configuration file composer.

[0022] In an embodiment of the present application, the configuration file of the shaping policy includes a namespace, a service name, and a shaping standard.

[0023] In an embodiment of the present application, the sending shaping agent of the sending end shapes the sent traffic according to the configuration file, including:

[0024] The sending shaping agent of the sending end performs at least one operation of cutting, padding, sending a virtual packet, and delaying sending on the sent traffic according to the configuration file, so that the sent traffic conforms to the shaping standard.

[0025] In an embodiment of the present application, the real request is shaped according to the configuration file to generate a real response, including:

[0026] The real request is shaped according to the configuration file to generate a real response, including at least one operation of cutting, padding, sending a virtual packet, and delaying sending, so that the real response conforms to the shaping standard.

[0027] The present application provides an adaptive bidirectional traffic shaping system suitable for a service mesh, which is suitable for the adaptive bidirectional traffic shaping method suitable for a service mesh described in any of the above embodiments, and the system includes:

[0028] A data collector is configured to collect metadata of each service within a preset time window;

[0029] A shaping policy generator is configured to identify a key service according to the metadata, cluster all services according to traffic characteristics to form a service cluster to be shaped based on the key service, and generate a shaping standard of the service cluster to be shaped based on the traffic characteristics;

[0030] A configuration file composer is configured to generate a configuration file of a shaping policy according to the shaping standard;

[0031] A control plane is configured to generate a corresponding shaping agent component for a service in the service cluster to be shaped, and send the configuration file to the shaping agent component, wherein the shaping agent component includes a sending shaping agent and a receiving shaping agent.

[0032] At the sending end, the sending shaping agent is configured to shape the sending traffic according to the configuration file and identify the header of the shaped traffic, and the receiving shaping agent is configured to receive the response returned by the receiving end;

[0033] At the receiving end, the receiving shaping agent is configured to, when receiving the traffic, determine whether the traffic is shaped, and if so, recombine the same packets according to the header identification of the traffic, execute the service processing logic, and generate a response to be returned to the sending end, wherein a virtual request is generated according to the configuration file to generate a virtual response, and a real request is shaped according to the configuration file to generate a real response; otherwise, the service processing logic is executed and a response is generated to be returned to the sending end.

[0034] Compared with the prior art, the present application has the following beneficial effects:

[0035] The adaptive bidirectional traffic shaping method suitable for a service grid can automatically identify key services and form an optimal shaping strategy by dynamically clustering and analyzing service traffic characteristics, accurately allocate network resources, and effectively avoid the problems of bandwidth waste or insufficient key service resources caused by traditional fixed strategies. The sending / receiving dual-agent architecture is used to implement collaborative shaping at both ends of the communication. The sending end marks the shaped traffic by header identification, and the receiving end significantly reduces the impact of burst traffic on the system through intelligent recombination and differential processing of virtual / real requests, thereby improving the stability and reliability of inter-service communication. The metadata collection mechanism based on a time window enables the system to continuously perceive service state changes, dynamically update the configuration file of the shaping strategy, quickly adapt to scenarios such as new service online and traffic mode changes, and reduce manual maintenance costs.

[0036] The above description is only a summary of the technical solutions of the present application. In order to more clearly understand the technical means of the present application, the following preferred embodiments are described in detail in combination with the contents of the description, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following preferred embodiments are described in detail in combination with the drawings, as follows. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is a flowchart of an adaptive bidirectional traffic shaping method suitable for a service grid provided by an embodiment of the present application;

[0038] Figure 2 is an example diagram of a cluster of services to be shaped formed by clustering;

[0039] Figure 3 is an example diagram of traffic before and after shaping;

[0040] Figure 4 is a schematic diagram of an adaptive bidirectional traffic shaping system suitable for a service mesh provided by an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to further illustrate the technical means and effects taken by the present application to achieve the predetermined object, a method and system for adaptive bidirectional traffic shaping suitable for a service mesh according to the present application are described in detail below in conjunction with the drawings and specific embodiments.

[0042] The foregoing and other technical contents, features and effects of the present application can be clearly presented in the detailed description of the specific embodiments below in conjunction with the drawings. Through the description of the specific embodiments, the technical means and effects taken by the present application to achieve the predetermined object can be more deeply and specifically understood. However, the accompanying drawings are provided for reference and illustration only, and are not intended to limit the technical solutions of the present application.

[0043] In a first aspect, the present application provides a method for adaptive bidirectional traffic shaping suitable for a service mesh, please see Figure 1 , Figure 1 is a flowchart of a method for adaptive bidirectional traffic shaping suitable for a service mesh provided by an embodiment of the present application. As shown in Figure 1 , the method for adaptive bidirectional traffic shaping suitable for a service mesh of the present embodiment can include the following steps:

[0044] Step 1: Collect metadata of each service within a preset time window.

[0045] In the present embodiment, the metadata includes service name, log information, service topology diagram of the application, and traffic between services.

[0046] Optionally, the metadata of each service under the application namespace within the preset time window can be collected by means of the instructions provided by Kubernetes (a container orchestration platform) and Istio (an open source service mesh).

[0047] Step 2: Identify key services according to the metadata, and cluster all services according to traffic characteristics based on the key services to form a service cluster to be shaped.

[0048] Optionally, step 2 can include the following steps:

[0049] Step 2.1: Identify key services according to the metadata.

[0050] In the present embodiment, services with sensitive, large traffic and other characteristics can be identified as key services according to service metadata, service topology diagram of the application, and traffic between services.

[0051] Exemplarily, the keywords pay, Auth or the service information calling these keywords in the metadata can be identified as sensitive services. The services with more out-degree and in-degree in the service topology graph of the application can be identified as key services. The high-traffic services are often services with more traffic and are also classified as key services.

[0052] Step 2.2: Determine the traffic characteristics of each service according to the metadata.

[0053] In this embodiment, the traffic characteristics include time interval and packet size.

[0054] Optionally, the traffic characteristics of each service in the application can be modeled as <interval, packet_size>.

[0055] Step 2.3: Calculate the similarity between each service and the key service according to the traffic characteristics by using a clustering algorithm, and select a preset number of services according to the similarity to form a to-be-shaped service cluster with the key service as the cluster center.

[0056] Specifically, the similarity between the service and the key service is calculated based on the traffic characteristics of the service by using a clustering algorithm, and then a certain number of services are selected as similar services of the key service to form a to-be-shaped service cluster according to the preset number in the order of similarity from large to small. An example diagram of the to-be-shaped service cluster formed by clustering is shown in FIG. 2. Figure 2

[0057] Exemplarily, the clustering algorithm can be a K-Means clustering algorithm or a mean shift clustering algorithm.

[0058] Step 3: Generate a shaping standard of the to-be-shaped service cluster based on the traffic characteristics, and generate a configuration file of the shaping strategy according to the shaping standard.

[0059] Optionally, step 3 can include the following steps:

[0060] Step 3.1: Calculate the confidence interval of the traffic characteristics of the to-be-shaped service cluster according to the traffic characteristics of each service in the to-be-shaped service cluster.

[0061] In this embodiment, the confidence interval of the traffic characteristics of the to-be-shaped service cluster is calculated according to the traffic characteristics <interval, packet_size> of each service in the to-be-shaped service cluster, and can be represented as <min_interval~max_interval, min_packet_size~max_packet_size>.

[0062] Exemplarily, for example, the interval and packet_size data of a to-be-shaped service cluster are as follows:​

[0063] Cluster_A={

[0064] interval: [10, 15, 12, 18, 20, ...], / / Time interval samples

[0065] packet_size: [1024, 1500, 900, 1200, ...] / / Sample packet sizes

[0066] }

[0067] The process of calculating the confidence interval for the service cluster to be shaped is as follows:

[0068] 1. Choose the confidence level: Usually, a 95% confidence level (corresponding to a significance level α=0.05) is chosen, which means that there is a 95% certainty that the true parameter falls within this interval.

[0069] 2. Calculate the mean and standard deviation: Calculate the sample mean for each interval and packet_size of the service cluster to be shaped. and sample standard deviation The specific calculation formula is as follows:

[0070] ;

[0071] ;

[0072] In the formula, This indicates the number of services in the cluster to be reshaped. Indicates the first Sample values ​​for each service, when calculating the confidence interval for the time interval. Indicates the first The time interval between services, when calculating the confidence interval for packet size. Indicates the first Package size for each service.

[0073] 3. Determine the critical value: large sample size use The critical value for the 95% confidence level distribution is 1.96. (For small samples...) Distribution, degrees of freedom ,check Obtain the critical value from the distribution table.

[0074] 4. Calculate the confidence interval: The upper limit of the confidence interval is determined by the formula... The calculation yields the lower limit based on the formula. Calculations show that Indicates the critical value. represents the number of services in the service cluster to be shaped.

[0075] Step 3.2: Take the maximum value in the confidence interval as the shaping criterion of the service cluster to be shaped.

[0076] In this embodiment, the maximum value of the confidence interval, i.e., <max_interval, max_packet_size>, is taken as the shaping criterion in the service cluster to be shaped.

[0077] Step 3.3: Generate the shaping policy configuration file according to the shaping criterion using the profile composer.

[0078] In this embodiment, the shaping policy is formed according to the shaping criterion in the form of a configuration file, and the shaping policy configuration file includes: namespace, service name, and shaping criterion.

[0079] Exemplarily, the shaping policy configuration file is as follows:

[0080] namespace: "your-namespace"

[0081] service_group: "Cluster_A"

[0082] traffic_shape:

[0083] max_interval: 16.12# unit: ms

[0084] max_packet_size: 1500# unit: bytes

[0085] It can be understood that the shaping criterion is related to the traffic characteristics of the service cluster to be shaped, and the collection of metadata of each service in the preset time window will also change over time, therefore, the generated shaping policy can adapt to the dynamically changing traffic load, and realize dynamic adaptive shaping policy update.

[0086] Step 4: Generate corresponding shaping agent components for the services in the service cluster to be shaped, and the shaping agent components include sending shaping agents and receiving shaping agents.

[0087] It should be noted that when the shaping policy is generated, the corresponding shaping agent components will be generated for each service to be shaped according to the shaping policy configuration file, and if there is already a shaping agent component, only the shaping criterion field will be updated.

[0088] Step 5: At the sending end, the sending shaping agent of the sending end shapes the sending traffic according to the configuration file and identifies the header of the shaped traffic; at the receiving end, the receiving shaping agent of the receiving end receives the traffic, judges whether the traffic is shaped traffic, and if yes, reassembles the same packets according to the header identification of the traffic, executes the service processing logic, and generates a response and returns the response to the receiving shaping agent of the sending end, wherein a virtual response is generated according to the configuration file for a virtual request, and a real response is shaped according to the configuration file for a real request; otherwise, the service processing logic is executed, and a response is generated and returned to the receiving shaping agent of the sending end.

[0089] In the embodiment, the sending shaping agent of the sending end reads the configuration file of the shaping strategy, shapes the sending traffic according to the shaping standard in the configuration file, and mainly shapes the sending time interval and the packet size of the sending traffic.

[0090] Specifically, the sending shaping agent of the sending end at least one of cuts, fills, sends a virtual packet, and delays sending according to the configuration file to make the sending traffic conform to the shaping standard.

[0091] In the embodiment, the header of the shaped traffic is identified to facilitate the receiving end to identify the shaped traffic.

[0092] It can be understood that for too large traffic, splitting and sending multiple times are required. In terms of time interval, for too fast initiated traffic, uniform scheduling is performed through a cache queue, so that the traffic is sent at a fixed rate index; when there is no actual communication, virtual traffic can be injected to ensure uniform and stable traffic shape.

[0093] In the embodiment, when the receiving end receives the traffic, the receiving shaping agent of the receiving end first judges whether the traffic is shaped traffic, and if yes, the traffic needs to be reassembled before being released to the service processing logic. Specifically, the same packets are reassembled through the identification of the traffic header. It should be noted that the virtual packet cannot be released, and a virtual response needs to be returned to the sending end.

[0094] After the service processing logic is executed, a message needs to be responded to the sending end. At this time, shaping is also required to cover the traffic characteristics, specifically, a virtual response is generated according to the shaping strategy for a virtual request, and if it is a real request, at least one of cutting, filling, sending a virtual packet, and delaying sending is performed according to the shaping strategy for the real response to shape the response, so that the real response conforms to the shaping standard. Please refer to Figure 3 , Figure 3 is an example diagram before and after traffic shaping provided by the embodiment of the application.

[0095] In this embodiment, traffic shaping can be implemented based on WebAssembly (WASM, a binary instruction format that can be extended to the Envoy proxy of Istio), when a new shaping policy is generated, the WASM plug-in resource of the Envoy proxy (an open source proxy implemented in C++) in the form of a sidecar container (that is, one or more auxiliary containers are run side by side in addition to the main application container in a container group) in each container group (the smallest deployable unit that can be created and managed in Kubernetes) of Istio is updated, then the shaping proxy will listen to this change and load the configuration file of the updated shaping policy, and the whole process does not require service restart, thereby ensuring the continuous and uninterrupted operation of the service.

[0096] The adaptive bidirectional traffic shaping method for the service mesh provided by the present application can automatically identify key services and form an optimal shaping policy by dynamically clustering and analyzing service traffic characteristics, accurately allocate network resources, and effectively avoid the problems of bandwidth waste or insufficient resources of key services caused by traditional fixed strategies. The sending / receiving dual-agent architecture is adopted to implement collaborative shaping at both ends of communication. The sending end marks the shaping traffic by header identification, and the receiving end significantly reduces the impact of burst traffic on the system through intelligent reorganization and differential processing of virtual / real requests, thereby improving the stability and reliability of inter-service communication. The metadata collection mechanism based on a time window enables the system to continuously perceive changes in service state, dynamically update the configuration file of the shaping policy, quickly adapt to scenarios such as new service online and traffic mode changes, and reduce manual maintenance costs.

[0097] In addition, the adaptive bidirectional traffic shaping method for the service mesh provided by the present application implements the final shaping implementation logic based on WASM and runs in the form of a sidecar container in the container group of the service. The advantages are that the shaping logic does not invade the original application, and the shaping policy is hot-updated, which greatly improves the efficiency of the adaptive strategy update to adapt to the changing load of cloud-native applications.

[0098] In a second aspect, the embodiments of the present application provide an adaptive bidirectional traffic shaping system for a service mesh, which is applicable to the adaptive bidirectional traffic shaping method for a service mesh provided in the first aspect. Please refer to Figure 4 , Figure 4 is a schematic diagram of an adaptive bidirectional traffic shaping system for a service mesh provided by the embodiments of the present application, as Figure 4As shown, the adaptive bidirectional traffic shaping system applicable to the service mesh in the embodiment includes a data collector, a shaping policy generator, a configuration file composer, a control plane, a sending shaping agent and a receiving shaping agent. In the embodiment, the data collector, the shaping policy generator and the configuration file composer constitute a behavior analysis engine, and the sending shaping agent and the receiving shaping agent constitute a shaping agent component. The behavior analysis engine interacts with the control plane, monitors through indicators such as traffic, simultaneously performs data analysis to generate a corresponding shaping policy and compose a corresponding configuration file, and simultaneously issues the configuration file to the shaping agent component with the aid of the control plane, and the shaping agent component completes traffic shaping according to the configuration file.

[0099] Specifically, the data collector is configured to collect metadata of each service in a preset time window; the shaping policy generator is configured to identify a key service according to the metadata, cluster all services according to traffic characteristics to form a to-be-shaped service cluster based on the key service, and generate a shaping standard of the to-be-shaped service cluster based on the traffic characteristics; the configuration file composer is configured to generate a configuration file of the shaping policy according to the shaping standard; the control plane is configured to generate a corresponding shaping agent component for a service in the to-be-shaped service cluster, and send the configuration file to the shaping agent component, wherein the shaping agent component includes the sending shaping agent and the receiving shaping agent; at the sending end, the sending shaping agent is configured to shape the sent traffic according to the configuration file and identify a header of the shaped traffic, and the receiving shaping agent is configured to receive a response returned by a receiving end; at the receiving end, the receiving shaping agent is configured to, when receiving the traffic, determine whether the traffic is shaped traffic, and if yes, recombine the same packet according to the header identification of the traffic, execute service processing logic and generate a response to be returned to the sending end, wherein a virtual request is generated according to the configuration file to generate a virtual response, and a real request is shaped according to the configuration file to generate a real response; or else, execute service processing logic and generate a response to be returned to the sending end.

[0100] Optionally, the control plane can be implemented by means of Kubernetes and Istio.

[0101] For specific contents of the adaptive bidirectional traffic shaping system applicable to the service mesh and corresponding beneficial effects, please refer to the related contents of the adaptive bidirectional traffic shaping method applicable to the service mesh provided in the first aspect, which will not be repeated here.

[0102] It is to be understood that the terminology used herein such as first and second, and the like, is only intended to distinguish between one

[0103] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features or characteristics described can be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate different embodiments or examples described in the present specification.

[0104] The above is a further detailed description of the present application in conjunction with specific preferred embodiments, and it cannot be considered that the specific implementation of the present application is limited to these descriptions. For those skilled in the art, a number of simple deductions or replacements can be made without departing from the concept of the present application, which should be considered as falling within the scope of protection of the present application.

Claims

1. An adaptive bidirectional traffic shaping method suitable for service meshes, characterized in that, include: Step 1: Collect metadata for each service within a preset time window; Step 2: Identify key services based on the metadata, and cluster all services according to traffic characteristics to form service clusters to be shaped; Step 3: Generate the shaping criteria for the service cluster to be shaped based on the traffic characteristics, and generate a configuration file for the shaping strategy according to the shaping criteria; Step 4: Generate corresponding shaping proxy components for the services in the service cluster to be shaped. The shaping proxy components include sending shaping proxy and receiving shaping proxy. Step 5: At the sending end, the sending shaping proxy of the sending end shapes the sent traffic according to the configuration file and marks the header of the shaped traffic. At the receiving end, when the receiving shaping proxy of the receiving end receives traffic, it determines whether it is shaped traffic. If it is, it reassembles the same packets according to the header mark of the traffic, executes the service processing logic, generates a response and returns it to the receiving shaping proxy of the sending end. Specifically, for virtual requests, a virtual response is generated according to the configuration file, and for real requests, the generated real response is shaped according to the configuration file. Otherwise, the service processing logic is executed and a response is generated and returned to the receiving integer agent of the sending end.

2. The adaptive bidirectional traffic shaping method for service mesh according to claim 1, characterized in that, The metadata includes service name, log information, application service topology diagram, and traffic between services.

3. The adaptive bidirectional traffic shaping method for service meshes according to claim 1, characterized in that, Step 2 includes: Step 2.1: Identify key services based on the metadata; Step 2.2: Determine the traffic characteristics of each service based on the aforementioned metadata; Step 2.3: Calculate the similarity between each service and the key service using a clustering algorithm based on the traffic characteristics, and select a preset number of services based on the similarity to form the service cluster to be shaped with the key service as the cluster center.

4. The adaptive bidirectional traffic shaping method for service meshes according to claim 3, characterized in that, The traffic characteristics include: time interval and packet size.

5. The adaptive bidirectional traffic shaping method for service meshes according to claim 1, characterized in that, Step 3 includes: Step 3.1: Calculate the confidence interval of the traffic characteristics of the service cluster to be shaped based on the traffic characteristics of each service in the service cluster to be shaped; Step 3.2: Take the maximum value in the confidence interval as the shaping standard of the service cluster to be shaped; Step 3.3: Generate the configuration file for the shaping strategy using the configuration file orchestrator according to the shaping criteria.

6. The adaptive bidirectional traffic shaping method for service mesh according to claim 5, characterized in that, The configuration file for the shaping strategy includes: namespace, service name, and shaping criteria.

7. The adaptive bidirectional traffic shaping method for service meshes according to claim 6, characterized in that, The sending shaping agent at the sending end shapes the transmitted traffic according to the configuration file, including: The sending end's sending shaping agent performs at least one of the following operations on the sent traffic according to the configuration file: segmentation, padding, sending virtual packets, and delayed sending, so that the sent traffic conforms to the shaping standard.

8. The adaptive bidirectional traffic shaping method for service meshes according to claim 6, characterized in that, The generated real response is shaped according to the configuration file based on the real request, including: The generated real response to the real request is subjected to at least one of the following operations according to the configuration file: segmentation, padding, sending virtual packets, and delayed sending, so that the real response conforms to the shaping standard.

9. An adaptive bidirectional traffic shaping system suitable for service meshes, characterized in that, The adaptive bidirectional traffic shaping method for service mesh according to any one of claims 1-8, the system comprising: A data collector is used to collect metadata for each service within a preset time window; A shaping strategy generator is used to identify key services based on the metadata, cluster all services according to traffic characteristics based on the key services to form a service cluster to be shaped, and generate shaping criteria for the service cluster to be shaped based on the traffic characteristics. A configuration file orchestrator for generating configuration files for shaping strategies based on the shaping criteria; A control plane is used to generate corresponding shaping proxy components for the services in the service cluster to be shaped, and to send the configuration file to the shaping proxy component, wherein the shaping proxy component includes sending shaping proxy and receiving shaping proxy; At the sending end, the sending shaping proxy is used to shape the sent traffic according to the configuration file and mark the header of the shaped traffic; the receiving shaping proxy is used to receive the response returned by the receiving end. At the receiving end, the receiving shaping proxy is used to determine whether the received traffic is shaped traffic. If so, it reassembles identical packets according to the header identifier of the traffic, executes service processing logic, and generates a response to return to the sending end. Specifically, for virtual requests, a virtual response is generated according to the configuration file, and for real requests, the generated real response is shaped according to the configuration file. Otherwise, the service processing logic is executed and a response is generated to return to the sending end.

Images