Identifying and processing method for elephant flow in distributed energy safety data acquisition device

Abstract

The invention discloses a method for identifying and processing elephant flow in a distributed energy safety data acquisition device, and relates to the technical field of data flow transmission. Network flow data are acquired through flow acquisition equipment, and data packet characteristic values in unit time are counted through a sliding window; calculating a data flow coefficient according to the data packet characteristic value to judge and generate a first elephant flow processing signal, constructing a CPU utilization rate prediction model based on a convolutional neural network, substituting the real-time CPU utilization rate into the CPU utilization rate prediction model to output an expected CPU utilization rate, and judging to generate a second elephant flow processing signal. The elephant flow is graded through a grading response mechanism to obtain a grading result, a differential processing strategy is executed according to the grading result, the first-level elephant flow adopts multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, the third-level elephant flow triggers local cache, and a safety early warning signal is generated to execute a safety early warning mechanism.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data stream transmission, in particular to a method for identifying and processing elephant flows in a distributed energy safety data acquisition device. BACKGROUND

[0002] Traffic in the network is usually divided into two types, namely elephant flow and mouse flow. Elephant flow has large number of bytes, large rate and long duration, and has high bandwidth requirement. Mouse flow has small number of bytes, small rate and short duration, and is sensitive to delay. In actual data center network traffic, the number of elephant flows is not large, but they occupy a large amount of traffic, and the number of mouse flows is large, but they only occupy a small amount of traffic.

[0003] The distributed energy safety data acquisition device is a device for data acquisition, monitoring, transmission and processing in a distributed energy system. The distributed energy system includes small and scattered energy devices such as solar energy, wind energy, energy storage and gas power generation, which are usually distributed in different geographical locations. In order to ensure the safe and efficient operation of these distributed energy systems, it is necessary to monitor and transmit data of key parameters and devices in real time through data acquisition devices. The distributed energy safety data acquisition device deployed in the network carries a variety of services, and the distribution of service flow is bursty and uneven, which will increase the delay in the processing process of the device and cannot allocate resources such as bandwidth as needed, resulting in network congestion and reducing network performance.

[0004] In the gateway device, for a large number of data flows, the device will directly process according to the priority of the message. Once the processing capacity is exceeded, random packet loss and delay increase will occur. The data flow is not classified, and when performing message processing and discarding operations, it can only be executed according to the message order, and the robustness of the network and the reliability of the service cannot be guaranteed.

[0005] In view of the above technical defects, the present application provides a solution. SUMMARY

[0006] The purpose of the present application is to obtain a hierarchical result by classifying elephant flows through a hierarchical response mechanism, and to execute a differentiated processing strategy according to the hierarchical result, wherein the first-level elephant flow adopts multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, the third-level elephant flow triggers local cache, and a safety warning signal is generated to execute a safety warning mechanism. The present application has little effect on the processing of normal service traffic in the system, and can achieve the predetermined effect, which ensures the safety of the network and improves the robustness.

[0007] In order to achieve the above purpose, the present application adopts the following technical scheme: a method for identifying and processing elephant flows in a distributed energy safety data acquisition device, comprising the following steps: Step one, get elephant flow identification basis: In the selection of multiple energy nodes in the distributed energy security data acquisition device, set up flow acquisition equipment at the energy node, obtain network flow data through the flow acquisition equipment, analyze the network flow data, and obtain the analyzed network flow data; At the same time, based on Prometheus and Grafana, a monitoring system for CPU in the distributed energy security data acquisition device is constructed, which is used for real-time monitoring and visual display of CPU usage; Step two, identify elephant flow: Get the analyzed network flow data, calculate the data flow coefficient according to the data packet characteristic value through the sliding window statistics in unit time, generate the first elephant flow processing signal when the data flow coefficient exceeds the preset judgment threshold, and trigger the preset hierarchical response mechanism at the same time; Get the historical CPU usage, build a CPU usage prediction model based on convolutional neural network, put the real-time CPU usage into the CPU usage prediction model to output the expected CPU usage, judge the burst packet loss probability according to the preset usage rate judgment threshold, and generate the second elephant flow processing signal, which also triggers the preset hierarchical response mechanism; Step three, process elephant flow: Get the hierarchical result by hierarchical response mechanism, execute the differential processing strategy according to the hierarchical result, wherein the first level elephant flow adopts multi-channel shunt transmission, the second level elephant flow starts dynamic encryption transmission, and the third level elephant flow triggers local cache, and generates a security warning signal to execute a security warning mechanism; Step four, record the key operation nodes in the above process through the block chain storage module, form a traceable audit chain and cache to the database.

[0008] Further, the specific process of analyzing the network flow data is as follows: S101, the flow acquisition equipment is NetFlow, which acquires network flow data according to the preset frequency, and the network flow data includes the source and destination IP address, port number, protocol type, flow size and timestamp of network packet; S102, according to the preset analysis requirement, filter irrelevant network flow data, divide the captured network flow data into flow data packets according to the flow, and a flow is a communication determined by source address, source port, destination address, destination port and protocol in a specific time period; S103, according to the UDP protocol, decode the flow data packet, which specifically includes analyzing IP address, port number and UDP header information, and extracting metadata information from each flow data packet, including source address, target address, protocol, transmission byte number, packet length, timestamp; S104, classifying the flow data packet according to different protocol types to obtain a data packet classification result.

[0009] Further, the specific process of generating the first elephant flow processing signal is as follows: S201, obtaining a data packet characteristic value, the data packet characteristic value including a data packet header characteristic code, a transmission rate V, a payload entropy value Q, and a data volume, wherein the data volume includes an absolute data value A and a relative data value B; S202, the data packet header characteristic code including a protocol type and a key header field, obtaining window data C and a sequence number increment value AD according to a leakage type, and calculating a data flow coefficient Ki according to the following formula: wherein e1, e2, e3, and e4 are preset weight coefficients, is a standard value of the transmission rate, is a standard value of the payload entropy value, is a normal value of the window data, and the data flow coefficient is used to evaluate the duration of the network flow data and the comprehensive performance of the data flow, wherein the greater the data flow coefficient, the longer the duration of the network flow data and the greater the data flow, and vice versa, the smaller the data flow coefficient, the shorter the duration of the network flow data and the smaller the data flow; S203, obtaining a preset judgment threshold, and generating the first elephant flow processing signal when the data flow coefficient is greater than or equal to the judgment threshold.

[0010] Further, the specific process of generating the second elephant flow processing signal is as follows: S301, obtaining historical CPU usage as a training sample, the historical running data including historical user state usage, historical kernel state usage, idle time, waiting time, and process processing time, dividing the generated sample into a training set, a validation set, and a test set in a ratio of 7:2:1, and establishing a CPU usage prediction model based on a convolutional neural network; S302, downloading a weight file and loading it onto a corresponding network for initializing migration network parameters; S303, modifying the last fully connected layer of the network, keeping the input unchanged, setting the output to the expected CPU usage, performing weight initialization on the last layer, using a gradient descent algorithm for learning, and using fixed step attenuation to optimize the training parameters, retraining the entire network, and obtaining the CPU usage prediction model; S304, randomly and repeatedly extracting small batches of samples from the training set for training during the training process, extracting all training samples as a training period, iterating to a certain period to complete the training, and obtaining the CPU usage prediction model; S305, input the CPU usage rate into the CPU usage rate prediction model to obtain an expected CPU usage rate, and if the expected CPU usage rate is greater than or equal to a preset usage rate judgment threshold, a second elephant flow processing signal is generated.

[0011] Further, the hierarchical response mechanism comprises a dynamic threshold adjustment unit, a traffic feature learning unit and a hierarchical decision unit, wherein: The dynamic threshold adjustment unit is used for correcting the feature threshold in real time according to the network load rate; The traffic feature learning unit adopts an improved LSTM neural network model for traffic pattern recognition; The hierarchical decision unit determines the elephant flow grade based on a fuzzy comprehensive evaluation method.

[0012] Further, the security warning mechanism comprises: A threat prediction model is constructed based on a knowledge graph, and flow data of the three-level elephant flow is substituted into the threat prediction model to generate an attack path prediction result; After obtaining the warning signal, the warning signal is transmitted to the control center through a quantum key distribution channel; A trap mode is started to collect attack evidence.

[0013] Further, the blockchain storage module comprises a node collection unit, a feature extraction unit, a trusted execution unit and a data integration unit; The node collection unit is used for setting corresponding data collection nodes at key operation nodes in the above process, the data collection nodes follow a P2P network protocol, support multicast routing and new node identification, ensure efficient data propagation between distributed nodes, and each edge collection node is used for obtaining operation records and sending the operation records to the feature extraction unit; The feature extraction unit is used for obtaining and analyzing operation records, performing high-speed traffic feature extraction, obtaining traffic feature data, maintaining a block chain type data structure in the memory, and persistently storing the traffic feature data into a distributed database; The trusted execution unit is used for a trusted execution environment to ensure the security of the key computing process, and supports SM9 algorithm to realize dynamic key negotiation between nodes; The data integration unit is used for packing traffic feature data that passes verification into blocks according to the arrangement order of time stamps, adding a Merkle root and a previous block hash, verifying the legality of the block through an eplica node, adding the block to the end of the chain, updating the global state to obtain a new block, broadcasting the new block through a P2P network, updating a local ledger after verification by other nodes, and ensuring data final consistency.

[0014] As described above, due to the adoption of the above technical solutions, the present application has the following advantages: The method for identifying and processing elephant flows in the distributed energy security data acquisition device obtains network traffic data through a traffic acquisition device, and uses a sliding window to count the characteristic values ​​of data packets within a unit time, calculates the data flow coefficient according to the characteristic values ​​of the data packets to determine and generate a first elephant flow processing signal, and at the same time constructs a CPU usage prediction model based on a convolutional neural network, substitutes the real-time CPU usage into the CPU usage prediction model to output the expected CPU usage, and then determines to generate a second elephant flow processing signal, and classifies the elephant flows through a hierarchical response mechanism to obtain a classification result, and executes a differentiated processing strategy according to the classification result, wherein the first-level elephant flow adopts multi-channel diversion transmission, the second-level elephant flow starts dynamic encryption transmission, the third-level elephant flow triggers local cache, and generates a security warning signal to execute the security warning mechanism. The present invention has little impact on the processing of normal business traffic in the system and can also achieve the expected effect, which not only ensures the security of the network but also improves the robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic flow chart of the overall method of the present invention is shown. DETAILED DESCRIPTION

[0016] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0017] Example: like Figure 1 As shown, a method for identifying and processing elephant flows in a distributed energy security data acquisition device includes the following steps: Step 1: Obtain the basis for identifying the elephant flow: Select multiple energy nodes in the distributed energy security data acquisition device, set up flow collection equipment at the energy nodes, obtain network flow data through the flow collection equipment, and analyze the network flow data to obtain the analyzed network flow data; The specific process of parsing network traffic data is as follows: S101. The traffic collection device is specifically NetFlow, which collects network traffic data at a preset frequency. The network traffic data includes the source, destination IP address, port number, protocol type, traffic size, and timestamp of the network packet. S102, filtering irrelevant network traffic data according to a preset analysis requirement, dividing the captured network traffic data by flow to obtain flow data packets, one flow being a communication uniquely determined by a source address, a source port, a destination address, a destination port and a protocol within a specific time period; S103, decoding the flow data packets according to the UDP protocol, specifically including analyzing IP addresses, port numbers and UDP header information, and extracting metadata information from each flow data packet, including source addresses, target addresses, protocols, transmission byte numbers, packet lengths and timestamps; S104, classifying the flow data packets according to different protocol types to obtain packet classification results; Meanwhile, a monitoring system for the CPU of the distributed energy security data collection device is constructed based on Prometheus and Grafana, which is used for real-time monitoring and visual display of CPU usage.

[0018] Step two, identify elephant flow: Obtain the parsed network flow data, and calculate the data flow coefficient by sliding window statistics of the data packet characteristic value within a unit time, and generate a first elephant flow processing signal when the data flow coefficient exceeds a preset judgment threshold, and trigger a preset hierarchical response mechanism; The specific process of generating the first elephant flow processing signal is as follows: S201, obtaining data packet characteristic values, including data packet header characteristic codes, transmission rates V, payload entropy values Q and data volumes, wherein the data volumes include absolute data values A and relative data values B; S202, the data packet header characteristic code includes the protocol type and the key header field, and the window data C and the sequence number increment ΔD are obtained according to the leakage type, and the data flow coefficient Ki is calculated according to the following formula: Where e1, e2, e3 and e4 are preset weight coefficients, is the standard value of the transmission rate, is the standard value of the payload entropy value, is the normal value of the window data, and the data flow coefficient is used to evaluate the duration of the network flow data and the comprehensive performance of the data flow, the larger the data flow coefficient, the longer the duration of the network flow data and the larger the data flow, and vice versa, the smaller the data flow coefficient, the shorter the duration of the network flow data and the smaller the data flow; S203, obtaining a preset judgment threshold, and generating a first elephant flow processing signal when the data flow coefficient is greater than or equal to the judgment threshold; The historical CPU usage is acquired, a CPU usage prediction model is constructed based on a convolutional neural network, real-time CPU usage is substituted into the CPU usage prediction model to output expected CPU usage, a burst packet loss probability is determined according to a preset usage judgment threshold, and a second elephant flow processing signal is generated, thus triggering a preset hierarchical response mechanism; The specific process of generating the second elephant flow processing signal is as follows: S301, historical CPU usage is acquired as a training sample, historical running data includes historical user state usage, historical kernel state usage, idle time, waiting time, and process processing time, the generated sample is divided into a training set, a validation set, and a test set in a ratio of 7:2:1, and a CPU usage prediction model is established based on a convolutional neural network; S302, a weight file is downloaded and loaded onto a corresponding network for initializing migration network parameters; S303, the last fully connected layer of the network is modified, the input is kept unchanged, the output is set to expected CPU usage, the last layer is weight initialized, a gradient descent algorithm is used for learning, and fixed step attenuation is adopted to optimize training parameters, the entire network is retrained, and a CPU usage prediction model is obtained; S304, during the training process, small batches of samples are randomly and repeatedly extracted from the training set for training, all training samples are extracted for a training period, and the training is completed after a certain period of iteration, and a CPU usage prediction model is obtained; S305, the CPU usage is input into the CPU usage prediction model to obtain the expected CPU usage, and if the expected CPU usage is greater than or equal to the preset usage judgment threshold, a second elephant flow processing signal is generated; The hierarchical response mechanism includes a dynamic threshold adjustment unit, a traffic feature learning unit, and a hierarchical decision unit, wherein: The dynamic threshold adjustment unit is used to correct the feature threshold in real time according to the network load rate; The traffic feature learning unit uses an improved LSTM neural network model for traffic pattern recognition; The hierarchical decision unit determines the elephant flow grade based on the fuzzy comprehensive evaluation method.

[0019] Step three, processing elephant flow: The hierarchical response mechanism is used to grade the elephant flow to obtain a grading result, and a differential processing strategy is executed according to the grading result, wherein the first-level elephant flow uses multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, and the third-level elephant flow triggers local caching and generates a security warning signal to execute a security warning mechanism; The security warning mechanism includes: A threat prediction model is constructed based on a knowledge graph, and flow data of the three-level elephant flow is substituted into the threat prediction model to generate attack path prediction results. After obtaining the early warning signal, the quantum key distribution channel is used to transmit the early warning signal to the control center. The trap mode is started to collect attack evidence.

[0020] Step four, record the key operation nodes in the above process through the blockchain storage module, form a traceable audit chain and cache to the database; The blockchain storage module includes a node collection unit, a feature extraction unit, a trusted execution unit and a data integration unit. The node collection unit is used to set corresponding data collection nodes based on the key operation nodes in the above process, the data collection nodes follow the P2P network protocol, support multicast routing and new node identification, ensure efficient data propagation between distributed nodes, and each edge collection node is used to obtain operation records and send them to the feature extraction unit. The feature extraction unit is used to obtain and analyze operation records, extract high-speed traffic features, obtain traffic feature data, and maintain a block chain data structure in memory, and persistently store the traffic feature data to a distributed database. The trusted execution unit is used to ensure the security of the key computing process in the trusted execution environment, and supports the SM9 algorithm to realize dynamic key negotiation between nodes. The data integration unit is used to package the traffic feature data that passes the verification into blocks according to the arrangement order of the time stamp, add the Merkle root and the previous block hash, and verify the legality of the block through the eplica node, add the block to the chain tail, update the global state to obtain a new block, broadcast the new block through the P2P network, and update the local ledger after verification by other nodes, to ensure data consistency.

[0021] The application obtains network traffic data through a traffic collection device, and calculates a data flow coefficient according to the data packet characteristic value within a unit time through a sliding window to generate a first elephant flow processing signal, and constructs a CPU usage rate prediction model based on a convolutional neural network, substitutes the real-time CPU usage rate into the CPU usage rate prediction model to output the expected CPU usage rate, and then judges to generate a second elephant flow processing signal, and obtains a hierarchical result through hierarchical response mechanism, and executes a differentiated processing strategy according to the hierarchical result, wherein the first-level elephant flow adopts multi-channel shunt transmission, the second-level elephant flow starts dynamic encryption transmission, and the third-level elephant flow triggers local caching, and generates a security warning signal to execute a security warning mechanism, the application has little influence on the processing of normal business traffic in the system, and can also achieve the predetermined effect, which ensures the security of the network and improves the robustness.

[0022] The setting of the size of the threshold is to facilitate comparison, and the size of the threshold depends on how much sample data and the base number set by the person skilled in the art for each group of sample data; as long as it does not affect the proportional relationship between the parameters and the quantized values.

[0023] The above formulas are dimensionless values, and the formulas are obtained by collecting a large amount of data to simulate the most recent real situation, and the preset parameters in the formula are set by the person skilled in the art according to the actual situation; The above is only a preferred specific embodiment of the present application, but the protection scope of the present application is not limited to this, any person skilled in the art within the technical range disclosed by the present application, according to the technical scheme and the inventive concept of the present application, equivalent replacement or change, should be covered within the protection scope of the present application.

Claims

1. A method for identifying and processing elephant flows in a distributed energy security data acquisition device, characterized in that: The following steps are involved: Step 1: Obtain the basis for identifying the elephant flow: Selecting multiple energy nodes in a distributed energy security data acquisition device, setting flow acquisition equipment at the energy nodes, acquiring network flow data through the flow acquisition equipment, parsing the network flow data, and obtaining parsed network flow data; At the same time, a monitoring system for the CPU in distributed energy security data acquisition devices is built based on Prometheus and Grafana to monitor and visualize CPU usage in real time; Step 2: Identify the elephant flow: Obtain the parsed network flow data, count the data packet feature values ​​within a unit time through a sliding window, calculate the data flow coefficient based on the data packet feature values, and generate a first elephant flow processing signal when the data flow coefficient exceeds a preset judgment threshold, and trigger a preset hierarchical response mechanism at the same time; Obtain historical CPU usage, build a CPU usage prediction model based on a convolutional neural network, substitute the real-time CPU usage into the CPU usage prediction model to output the expected CPU usage, and determine the probability of burst packet loss based on the preset usage judgment threshold to generate a second elephant flow processing signal, which also triggers the preset hierarchical response mechanism. Step 3: Process the elephant flow: The hierarchical response mechanism is used to classify the elephant flow and obtain the classification results. Differentiated processing strategies are implemented based on the classification results. The first-level elephant flow adopts multi-channel diversion transmission, the second-level elephant flow starts dynamic encryption transmission, and the third-level elephant flow triggers local caching and generates security warning signals to implement the security warning mechanism. Step 4: Use the blockchain evidence storage module to record the key operation nodes in the above process, form a traceable audit chain and cache it in the database.

2. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1 is characterized in that: The specific process of parsing the network traffic data is as follows: S101, the traffic collection device is specifically NetFlow, which obtains network traffic data at a preset frequency, the network traffic data including the source, destination IP address, port number, protocol type, traffic size and timestamp of the network packet; S102: filtering irrelevant network traffic data according to preset parsing requirements, dividing the captured network traffic data into flow packets, where a flow is defined as a communication with a unique source address, source port, destination address, destination port, and protocol within a specific time period; S103, according to the UDP protocol, decoding the stream data packets, specifically including parsing the IP address, port number and UDP header information, and extracting metadata information from each stream data packet, including source address, destination address, protocol, number of bytes transmitted, packet length, and timestamp; S104: Classify the flow data packets according to different protocol types to obtain data packet classification results.

3. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1 is characterized in that: The specific process of generating the first elephant flow processing signal is as follows: S201, obtaining data packet characteristic values, wherein the data packet characteristic values ​​include a data packet header characteristic code, a transmission rate V, a payload entropy value Q, and a data volume, wherein the data volume includes an absolute data value A and a relative data value B; S202: The data packet header feature code includes the protocol type and key header fields. Window data C and sequence number increment ΔD are obtained based on the leakage type. The data flow coefficient Ki is calculated based on the following formula: , where e1, e2, e3 and e4 are preset weight coefficients, is the standard value of the transmission rate, is the standard value of payload entropy, It is the normal value of the window data. The data flow coefficient is used to evaluate the comprehensive performance of the duration and data flow of network flow data. The larger the data flow coefficient, the longer the duration of network flow data and the larger the data flow. Conversely, the smaller the data flow coefficient, the shorter the duration of network flow data and the smaller the data flow. S203: Obtain a preset judgment threshold, and generate a first elephant flow processing signal when the data flow coefficient is greater than or equal to the judgment threshold.

4. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1 is characterized in that: The specific process of generating the second elephant flow processing signal is as follows: S301, obtaining historical CPU usage as training samples, wherein the historical operation data includes historical user state usage, historical kernel state usage, idle time, waiting time, and process processing time. The generated samples are divided into a training set, a validation set, and a test set in a ratio of 7:2:1, and a CPU usage prediction model is established based on a convolutional neural network; S302, download the weight file and load it to the corresponding network to initialize the migration network parameters; S303. Modify the last fully connected layer of the network, keep the input unchanged, set the output to the expected CPU usage, initialize the weights of the last layer, use the gradient descent algorithm for learning, and use fixed step size decay to optimize the training parameters. Retrain the entire network to obtain a CPU usage prediction model; S304: During the training process, small batches of samples are randomly extracted from the training set without duplication for training. The extraction of all training samples constitutes one training cycle. The training is completed after a certain number of iterations, and a CPU usage prediction model is obtained. S305: Input the CPU usage into the CPU usage prediction model to obtain an expected CPU usage. If the expected CPU usage is greater than or equal to a preset usage judgment threshold, generate a second elephant flow processing signal.

5. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1 is characterized in that: The hierarchical response mechanism includes a dynamic threshold adjustment unit, a traffic feature learning unit, and a hierarchical decision unit, wherein: The dynamic threshold adjustment unit is used to modify the characteristic threshold in real time according to the network load rate; The traffic feature learning unit uses an improved LSTM neural network model to perform traffic pattern recognition; The grading decision unit determines the elephant flow grade based on the fuzzy comprehensive evaluation method.

6. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1 is characterized in that: The safety early warning mechanism includes: A threat prediction model is built based on the knowledge graph, and the flow data of the three-level elephant flow is substituted into the threat prediction model to generate attack path prediction results; After obtaining the early warning signal, it is transmitted to the control center through the quantum key distribution channel; Initiate deception mode to collect attack evidence.

7. The method for identifying and processing elephant flows in a distributed energy security data acquisition device according to claim 1 is characterized in that: The blockchain evidence storage module includes a node collection unit, a feature extraction unit, a trusted execution unit and a data integration unit; The node collection unit is used to set corresponding data collection nodes based on the key operation nodes in the above process. The data collection nodes follow the P2P network protocol, support multicast routing and new node identification, and ensure efficient data dissemination between distributed nodes. Each edge collection node is used to obtain operation records and send them to the feature extraction unit; The feature extraction unit is used to obtain and analyze operation records, perform high-speed traffic feature extraction, obtain traffic feature data, maintain a block chain data structure in memory, and persistently store the traffic feature data in a distributed database; The trusted execution unit is used in a trusted execution environment to ensure the security of key computing processes, and supports the SM9 algorithm to achieve dynamic key negotiation between nodes; The data integration unit is used to package the verified traffic feature data into blocks in the order of timestamps, add the Merkle root and the hash of the previous block, verify the legitimacy of the block through the eplica node, add the block to the end of the chain, update the global state to obtain a new block, and broadcast the new block through the P2P network. After verification, other nodes update the local ledger to ensure the final consistency of the data.

Images