Online behavior early warning method and system based on network packet processing

Abstract

The invention discloses an internet behavior early warning method and system based on network packet processing, and belongs to the field of network security, and the system comprises gateway equipment, a DPI analysis module, a user portrait module and an early warning module. The gateway equipment is used for capturing user data packets in real time on a network driving layer by using an XDP technology, filtering the captured data packets, and selecting the data packets conforming to a set rule; the DPI analysis module is used for deeply analyzing the selected data packets through a DPI technology and carrying out traffic type marking and classified storage on the data packets of each user according to an analysis result; the user portrait module is used for performing user portrait analysis based on the storage data packet of the user and identifying an abnormal behavior; and the early warning module is used for configuring an early warning rule and a notification mode and giving out early warning aiming at the abnormal behavior of the user. According to the invention, high-speed processing of the data packet can be realized, and on the premise of not sacrificing performance, abnormal behaviors of a user can be accurately identified and timely early warning can be given out.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method and system for early warning of internet access behavior based on network packet processing. Background Technology

[0002] With the widespread application of 5G networks, the demand for customized network services is increasing, requiring network infrastructure to have higher data processing capabilities, lower latency, and stronger security. Traditional network architectures are inefficient at handling massive data packets, making it difficult to meet the needs of in-depth data analysis and personalized services in the 5G environment. In addition, existing early warning systems often lack flexibility and personalization, failing to efficiently implement accurate early warnings based on different user behaviors. Furthermore, the poor timeliness of massive data packets results in early warnings not receiving timely and effective feedback. Summary of the Invention

[0003] This invention addresses the shortcomings of existing technologies by providing a method and system for early warning of internet behavior based on network packet processing. It enables high-speed processing of data packets and constructs user behavior profiles without sacrificing performance, thereby accurately identifying abnormal user behavior and issuing timely warnings.

[0004] This invention provides the following technical solution:

[0005] In a first aspect, an internet access behavior early warning system based on network packet processing is provided, comprising: a gateway device and a management platform; the management platform includes: a DPI parsing module, a user profiling module, and an early warning module;

[0006] The gateway device uses XDP technology to capture user data packets in real time at the network driver layer, and filters the captured data packets based on the filtering rules configured on the management platform, selecting data packets that meet the set rules.

[0007] The DPI parsing module uses DPI technology to deeply parse the selected data packets and, based on the parsing results, labels and categorizes each user's data packets by traffic type and stores them accordingly.

[0008] The user profiling module constructs a user network behavior model and performs user profile analysis based on the user's stored data packets to identify abnormal behavior;

[0009] The early warning module configures early warning rules and notification methods based on business needs and risk levels, and issues early warnings for abnormal user behavior.

[0010] Optionally, the step of filtering the captured data packets and selecting those that conform to the set rules specifically involves: installing and configuring the eBPF framework on the server corresponding to the gateway device, preprocessing each data packet using XDP technology, including header checking and source / destination address filtering, allowing data packets that conform to the set rules to pass through the Internet, and directly forwarding or discarding data packets that do not conform to the set rules.

[0011] Optionally, the method to determine whether a data packet conforms to the set rules is as follows: determine whether the domain name of the data packet matches the data in the eBPFmap. If there is a matching item in the eBPFmap corresponding to the domain name of the data packet, then it conforms to the set rules; otherwise, it does not conform to the set rules.

[0012] Optionally, a Trie tree algorithm is used to match the domain name of the data packet with the data in the eBPF map. Specifically, a Trie tree is constructed through the management platform, and the Trie tree node information is loaded into the eBPF map. When a DNS request is resolved, the system starts from the root node of the Trie tree and matches character by character until the corresponding leaf node is found.

[0013] Optionally, the DPI parsing module performs deep parsing of the selected data packets using DPI technology, and classifies and stores the data packets of each user according to the parsing results, specifically as follows:

[0014] DPI technology is used to perform deep analysis on selected data packets to identify application layer protocols, content types, and behavioral data.

[0015] The system detects whether data packets contain known illegal content by matching features from a database, and then marks data packets containing illegal content.

[0016] Data packets that do not violate regulations are categorized, labeled, and stored according to their traffic type.

[0017] Optionally, before classifying and storing data packets based on the DPI parsing results, the data pointing to personal identification information is encrypted, a temporary storage time is set, and original data packets that exceed the temporary storage time are automatically detected and deleted.

[0018] Optionally, the user profiling module constructs a user network behavior model and performs user profile analysis based on the user's stored data packets to identify abnormal behavior, specifically:

[0019] Preprocess user behavior data;

[0020] The elbow method is used to determine the optimal number of clusters K. The K-means algorithm is applied to classify users. Based on the user characteristics of each cluster, representative behavioral patterns are identified. Combined with domain knowledge, clusters that do not conform to normal behavioral patterns are identified and labeled.

[0021] Optionally, the gateway device is deployed at the UPF sink node of the 5G customized network. After a user signs up for a DNN package on the 5G customized network, the 5G DNN is used for authentication, authorization and billing to obtain the fixed IP address of each signed user, and the mobile Internet traffic of each user is aggregated and sent to the UPF sink node.

[0022] Optionally, user behavior data may be preprocessed, including: using 5GDNN for authentication, authorization, and billing to identify and process duplicate users.

[0023] Secondly, a method for early warning of internet access behavior based on network packet processing is provided, including the following steps:

[0024] XDP technology is used to capture user data packets in real time at the network driver layer, and the captured data packets are filtered based on the configured filtering rules, selecting data packets that meet the set rules.

[0025] The selected data packets are analyzed using DPI technology, and each user's data packets are tagged and categorized based on the analysis results.

[0026] Build user network behavior models and perform user profiling analysis based on user stored data packets to identify abnormal behaviors;

[0027] Configure early warning rules and notification methods based on business needs and risk levels, and issue early warnings for abnormal user behavior.

[0028] Compared with the prior art, the beneficial effects of the present invention are:

[0029] This invention improves data processing efficiency and security in 5G customized network scenarios by combining the high-speed packet processing capabilities of XDP technology with the deep analysis capabilities of DPI technology through streaming or side-by-side methods. Specifically, this application performs ultra-low latency processing on data packets at the Linux kernel level, ensuring processing speeds reach sub-millisecond levels, maintaining high efficiency even at high data throughputs exceeding 10Gbps. The DPI parsing module of this application can identify and classify different types of network traffic (such as video streams, game streams, web browsing, etc.) in real time and tag them. Simultaneously, combined with a URL classification library for VIP scenarios, it achieves multi-dimensional tag management of traffic, thereby accurately identifying and issuing timely warnings for abnormal user behavior without sacrificing performance. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of the overall structure of the Internet access behavior early warning system based on network packet processing of the present invention;

[0031] Figure 2 This is a flowchart of the Internet access behavior early warning method based on network packet processing of the present invention;

[0032] Figure 3 This is a network topology diagram of a specific example given in Embodiment 2 of the present invention. Detailed Implementation

[0033] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be used to limit the scope of protection of the present invention. It should be noted that the term "comprising" and any variations thereof in the specification, claims and the above-mentioned drawings of the present invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or devices.

[0034] Before describing the embodiments of this application, some terms appearing in the following embodiments will be explained.

[0035] XDP (eXpress Data Path): XDP is a technology in the Linux kernel that allows for efficient processing of data packets before they enter the kernel network stack. Located at the network driver level, very close to the hardware, XDP enables extremely low-latency packet processing. It is suitable for scenarios requiring high-performance network data processing, such as firewalls, DDoS protection, and network monitoring.

[0036] DPI (Deep Packet Inspection) is a packet processing technology that not only examines the header information of network packets (such as source IP, destination IP, port number, etc.), but also performs in-depth analysis of the packet payload to identify application layer protocol types, content characteristics, etc. It is commonly used for network security monitoring, traffic management, and compliance checks.

[0037] 5G DNN (Data Network Name): In 5G networks, the DNN is similar to the APN (Access Point Name) in 4G networks, defining the data path and quality of service after a user terminal accesses the network. By subscribing to different DNN packages, users can enjoy different network services and speed levels. It is a key identifier for user access services in the 5G network architecture.

[0038] The 3A system refers to the three key processes of Authentication, Authorization, and Accounting. This is a system used in telecommunications networks to manage user access and service usage. The 3A system ensures that only authorized users can access the network and use services according to their permissions, while also calculating and tracking costs.

[0039] User profiling analysis: By collecting and analyzing user behavior data on the internet (such as browsing habits, purchase history, social interactions, etc.), a virtual model representing the user's characteristics is constructed. This analysis helps businesses and advertisers more accurately understand user needs and personalize content and services recommendations.

[0040] A network packet, also known as a network data packet, is the basic unit of data transmission in network communication. It contains information such as source address, destination address, protocol type, and user data. During network transmission, data is segmented into multiple data packets for transmission.

[0041] Example 1

[0042] like Figure 1 As shown, an internet access behavior early warning system based on network packet processing includes: a gateway device and a management platform; the management platform includes: a DPI parsing module, a user profiling module and an early warning module.

[0043] I. Gateway device.

[0044] XDP technology is used to capture user data packets in real time at the network driver layer, and the captured data packets are filtered based on the filtering rules configured on the management platform, selecting data packets that meet the set rules.

[0045] The gateway device is deployed at the UPF sink node of the 5G network. After a user signs up for a DNN package on the 5G network, the 5G DNN uses authentication, authorization and billing (i.e., the 3A system) to obtain the fixed IP address of each signed-up user and then aggregates the mobile internet traffic of each user and sends it to the UPF sink node.

[0046] Specifically, in a customized 5G network, data packets generated by user equipment first reach the User Plane Function (UPF) node, which then directs the aggregated traffic to the gateway device. The gateway device utilizes eXpress Data Path (XDP) technology to capture data packets in real-time at the lowest level of the operating system's network stack (i.e., at the network driver layer), eliminating the need for traditional protocol stack processing and significantly reducing processing latency. XDP technology performs rapid preprocessing on each data packet, such as header checks and source / destination address filtering. Data packets that meet specific rules or require further analysis are directed by XDP to the DPI (Data Point Interpretation) module; those that do not meet the criteria are either forwarded directly or discarded.

[0047] The captured data packets are filtered, selecting those that match the set rules. Specifically, the eBPF framework is installed and configured on the server corresponding to the gateway device. XDP technology is used to preprocess each data packet, including header checks and source / destination address filtering. Data packets that match the set rules are allowed to pass through the internet, while those that do not match are either forwarded directly or dropped. The method for determining whether a data packet matches the set rules is: whether the data packet's domain name matches data in the eBPF map. If a match exists in the eBPF map corresponding to the data packet's domain name, then it matches the set rules; otherwise, it does not match the set rules.

[0048] In this embodiment, the Trie tree algorithm is used to match the domain name of the data packet with the data in the eBPF map. Specifically, the management platform constructs the Trie tree and loads the Trie tree node information into the eBPF map. When a DNS request is resolved, the system starts from the root node of the Trie tree and matches character by character until the corresponding leaf node is found.

[0049] This application utilizes XDP technology in the Linux kernel to directly process data packets at the network interface layer. This shifts network packet processing from user space to kernel space, significantly reducing system calls and context switching, and improving packet processing speed. By writing efficient XDP programs, real-time monitoring and blacklist / whitelist filtering of data streams are implemented. The main logic for the blacklist / whitelist filtering function is as follows: the eBPF program captures network packets and parses the DNS requests within them, involving parsing the Ethernet header, IP header, UDP header, and obtaining the DNS load. After parsing, it further searches for the domain name to determine if it matches the data in the eBPF map, and then decides whether to discard or allow the packet.

[0050] The Trie tree algorithm is used to accelerate the domain name matching process. A Trie tree is a tree-like data structure used to store strings, which is suitable for prefix matching scenarios such as domain names. By using the Trie tree algorithm to match the domain name of the data packet with the data in the eBPFmap, a more efficient and scalable domain name blacklist / whitelist filtering function can be achieved.

[0051] The network packet processing method described in this application can process packets before they enter the network stack, reducing packet processing time in the kernel and improving overall system performance. The eBPF program runs in a sandbox environment, preventing potential security issues from affecting the host operating system. Trie trees provide an efficient prefix matching method, making it highly efficient to find specific prefixes among millions of domain names. Trie trees are more space-efficient than hash tables or other data structures, reducing eBPFmap space.

[0052] II. DPI parsing module.

[0053] The selected data packets are analyzed using DPI technology, and each user's data packets are tagged and categorized based on the analysis results.

[0054] Specifically, DPI technology is used to perform deep analysis on selected data packets to identify application layer protocols, content types, and behavioral data.

[0055] The system uses a feature database (such as pornographic keywords and gambling website URLs) to match and detect data packets for known illegal content, and then marks packets containing such content. Illegal content refers to unlawful or harmful content and activities on the internet, such as pornography, gambling, drug trafficking, and fraud. These types of activities are strictly regulated and combated in the online environment to maintain its health and security.

[0056] Data packets that do not violate regulations are categorized, labeled, and stored according to their traffic type. For example, video, audio, and text are categorized, specifically video streams (based on HTTP or RTMP protocols), game streams (such as UDP high-bandwidth, low-latency transmission), and web browsing (HTTP / HTTPS). Further categorization is also possible, such as by app or domain name.

[0057] Before categorizing and storing data, an encryption step is added. For information that can identify individuals (such as IP addresses, MAC addresses, IMEIs, etc.), encryption algorithms based on national cryptographic standards (such as SM4) are used for encryption. Simultaneously, randomly generated keys are used for data encryption. These keys are stored and managed independently through a key management system to ensure that even if the data is illegally accessed, personal information cannot be directly read.

[0058] When categorizing and storing data, a robust storage strategy is implemented, ensuring that all data related to user behavior analysis is temporarily stored for no more than one day to reduce the risk of data leakage. The system has a built-in scheduled task that automatically detects and deletes raw data records older than 24 hours, ensuring compliance with storage time requirements.

[0059] Furthermore, a domestic database was selected, currently compatible with Kingbase and DM. Access control, permission management, and audit logs were implemented at the database level to ensure full traceability of data operations. Key metadata and behavioral patterns were extracted, ready for use in user behavior profiling analysis.

[0060] III. User Profile Module.

[0061] Used to build user network behavior models and perform user profiling analysis based on user stored data packets to identify abnormal behavior.

[0062] The user behavior analysis unit uses stored data and advanced data analysis algorithms to build user behavior models. It analyzes users' network usage habits and preferences to create user behavior profiles, providing a basis for personalized services, network optimization, and security strategy development.

[0063] Specifically, step a: preprocess the user behavior data.

[0064] First, data cleaning is performed to remove noisy or outlier data. Second, the data is normalized using the Z-Score standardization method, which unifies data across different dimensions such as frequency, time, and traffic, transforming the feature values ​​into a standard normal distribution with a mean of 0 and a standard deviation of 1. Compared to other normalization methods, Z-Score standardization is more robust when dealing with data containing outliers, while common min-max normalization is affected by the data range. Z-Score standardization does not change the shape of the data distribution; it simply transforms it into a standard normal distribution with a mean of 0 and a standard deviation of 1. These advantages make it suitable for complex network packet scenarios. The formula is as follows: Where X is the original feature value, μ is the mean of the feature, σ is the standard deviation of the feature, and X' is the standardized feature value.

[0065] Preprocessing also includes using 5GDNN for authentication, authorization, and accounting (3A system) to identify and process duplicate users.

[0066] Step b: Use the elbow method to determine the optimal number of clusters K, apply the K-means algorithm to classify users, and find representative behavioral patterns based on the user characteristics of each cluster. Combine domain knowledge to identify and label clusters that do not conform to normal behavioral patterns.

[0067] The elbow method is used to determine the optimal number of clusters K. Specifically, the total squared error (SSE) is calculated for different K values, the curve of SSE changing with the K value is plotted, and the "elbow" of the curve is found, which is the point where the rate of decrease in SSE slows down significantly. The K value corresponding to this point is the optimal number of clusters.

[0068] The K-means algorithm is applied as follows: First, the k-means++ initialization strategy is used to select initial centroids to improve clustering performance. Second, through iterative optimization, the distance from each sample to each centroid is calculated, and the sample is assigned to the cluster to which the nearest centroid belongs. The centroids of each cluster are recalculated, and this process is repeated until the centroids no longer change significantly or the maximum number of iterations is reached.

[0069] Analyze user characteristics within each cluster to identify representative behavioral patterns. Combine this with domain knowledge to identify user groups that deviate from normal behavioral patterns; these groups require focused attention. For example, if users in a particular cluster visit a large number of suspicious websites or visit sites with unusually high frequency, these users may require further investigation to better understand their behavioral patterns and identify potential risks in a timely manner.

[0070] Based on feature mining analysis using K-means clustering, and combined with the mapping relationship between user IDs and source IPs from the 3A system, user-level online behavior analysis is performed. Through Z-Score normalization, abnormal characteristic behaviors are identified in complex scenarios with multiple dimensions, and user behavior patterns are deeply mined to provide accurate data support for network management and security.

[0071] IV. Early Warning Module.

[0072] Configure early warning rules and notification methods based on business needs and risk levels, and issue early warnings for abnormal user behavior.

[0073] Administrators customize alert rules and response actions based on business needs and risk levels. Appropriate alert methods, such as dashboard push notifications, phone calls, and SMS, are automatically matched according to preset strategies to ensure timely delivery of alert information.

[0074] In some other embodiments, by customizing warning rules, text messages are converted into 5G information, and then warnings are delivered using converged messaging technologies such as 5G messaging, 5G message reading, and 5G new calls, thereby enabling timely and effective feedback on warning actions.

[0075] Example 2

[0076] Provide a specific example, such as Figure 3As shown, after a user signs up for a 5G network DNN (Data Network Name) package, their 4G / 5G mobile internet traffic is uniformly aggregated. The system utilizes the 5G DNN's Authentication, Authorization, and Accounting (3A) system to obtain the fixed IP address corresponding to each signed-up user's mobile phone number. This prepares for subsequent secondary 3A to accurately identify individuals through fixed IP addresses and conduct user profiling analysis.

[0077] Based on the architectural requirements of the 5G customized network, a high-performance server supporting XDP network card drivers was selected as the gateway device and deployed in the UPF (User-Defined Provider Interface) node. UPF deployment closer to the user end effectively reduces latency and improves data processing speed. The server configuration was ensured to meet high-speed data processing requirements, such as being equipped with a high-speed network interface card (NIC) supporting bandwidths of 10Gbps or higher.

[0078] By combining hardware and software, and leveraging the XDP driver, network packets can be manipulated directly in kernel mode. The specific implementation steps are as follows: Install and configure the eBPF (Extended Berkeley PacketFilter) framework on the selected server, and enable XDP (eXpress Data Path) technology. The backend management platform transmits the rule policy, i.e., the URL database, to the XDP driver via the MQTT protocol, arranged in a Trie tree structure. The URL database, typically accumulated based on industry experience, comprises 82 categories and over 30 million entries, all domain name rules. It uses a fast domain name matching method to quickly identify risky websites. Through the configuration of the XDP driver, sub-millisecond-level fast processing and preliminary filtering of data packets are achieved, such as filtering network packets that match rules, such as packets from specific domains or designated apps, and forwarding them to the DPI resolution module.

[0079] The DPI parsing module dynamically identifies different traffic types by parsing the packet header and part of the payload, such as video streams (based on HTTP or RTMP protocols), game streams (e.g., UDP high-bandwidth, low-latency transmission), and web browsing (HTTP / HTTPS). Combining the URL / IP address in the packet header, it performs application category matching. It's important to note that a continuously updated protocol and application identification rule base needs to be maintained to ensure that DPI can accurately identify newly emerging application and service types. Based on the DPI parsing results, the data packets are tagged to indicate their traffic category.

[0080] By configuring alerts based on internet behavior policies, the system performs multi-dimensional alert analysis on internet traffic, internet duration, and access frequency. Based on the traffic type tagged by DPI, data is directed to different dedicated storage areas. For example, real-time interactive data is stored in a high-speed cache, while large amounts of non-urgent video streaming data are stored on more cost-effective hard drives.

[0081] User profiling involves establishing a user behavior profiling unit. Through big data analytics, this unit extracts information such as user access patterns, preferences, and active time periods from stored data. The analysis unit may include multiple stages such as data cleaning, feature extraction, and machine learning model training. The analysis results are used to identify abnormal behavior patterns, such as abnormal traffic surges and potential security threats, providing data support for network management and decision-making.

[0082] This embodiment utilizes XDP technology by installing gateway devices at the UPF (User-Defined Flow) nodes in a 5G customized network to achieve sub-millisecond-level data packet processing at data throughputs exceeding 10Gbps. The DPI (Data Processing Module) dynamically identifies and labels different types of traffic, such as video streams, game streams, and web browsing, and then sends this categorized data to a dedicated storage area. A user behavior profiling and analysis unit further uncovers user behavior risks. Network administrators or service providers can configure different early warning rules and notification methods for different scenarios, user groups, or risk levels, achieving personalized and precise early warnings.

[0083] Example 3

[0084] like Figure 2 As shown, a method for early warning of internet access behavior based on network packet processing is provided, including the following steps:

[0085] XDP technology is used to capture user data packets in real time at the network driver layer, and the captured data packets are filtered based on the configured filtering rules, selecting data packets that meet the set rules.

[0086] The selected data packets are analyzed using DPI technology, and each user's data packets are tagged and categorized based on the analysis results.

[0087] Build user network behavior models and perform user profiling analysis based on user stored data packets to identify abnormal behaviors;

[0088] Configure early warning rules and notification methods based on business needs and risk levels, and issue early warnings for abnormal user behavior.

[0089] For more detailed information on the above methods, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0090] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Regarding the methods disclosed in the embodiments, since they correspond to the systems disclosed in the embodiments, the descriptions are relatively simple; relevant details can be found in the method section. Those skilled in the art will clearly understand that the technologies in the embodiments of this invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of this invention, in essence or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or certain parts of the embodiments of this invention.

[0091] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. An internet access behavior early warning system based on network packet processing, characterized in that, include: Gateway devices and management platforms; The management platform includes: a DPI analysis module, a user profiling module, and an early warning module; The gateway device uses XDP technology to capture user data packets in real time at the network driver layer, and filters the captured data packets based on the filtering rules configured on the management platform, selecting data packets that meet the set rules; The DPI parsing module uses DPI technology to deeply parse the selected data packets and, based on the parsing results, labels and categorizes each user's data packets by traffic type and stores them accordingly. The user profiling module constructs a user network behavior model and performs user profile analysis based on the user's stored data packets to identify abnormal behavior; The early warning module configures early warning rules and notification methods based on business needs and risk levels, and issues early warnings for abnormal user behavior.

2. The Internet access behavior early warning system based on network packet processing according to claim 1, characterized in that, The process of filtering captured data packets and selecting those that meet the set rules involves: installing and configuring the eBPF framework on the server corresponding to the gateway device; preprocessing each data packet using XDP technology, including header checking and source / destination address filtering; allowing data packets that meet the set rules to pass through the Internet; and directly forwarding or discarding data packets that do not meet the set rules.

3. The Internet access behavior early warning system based on network packet processing according to claim 2, characterized in that, The method to determine whether a data packet conforms to the set rules is as follows: check whether the domain name of the data packet matches the data in the eBPFmap. If there is a matching item in the eBPFmap corresponding to the domain name of the data packet, then it conforms to the set rules; otherwise, it does not conform to the set rules.

4. The Internet access behavior early warning system based on network packet processing according to claim 3, characterized in that, The Trie tree algorithm is used to match the domain name of the data packet with the data in the eBPF map. Specifically, the Trie tree is constructed through the management platform and the Trie tree node information is loaded into the eBPF map. When a DNS request is resolved, the system starts from the root node of the Trie tree and matches character by character until the corresponding leaf node is found.

5. The Internet access behavior early warning system based on network packet processing according to claim 1, characterized in that, The DPI parsing module uses DPI technology to deeply parse the selected data packets, and classifies and stores the data packets of each user according to the parsing results, specifically as follows: DPI technology is used to perform deep analysis on selected data packets to identify application layer protocols, content types, and behavioral data. The system detects whether data packets contain known illegal content by matching features from a database, and then marks data packets containing illegal content. Data packets that do not violate regulations are categorized, labeled, and stored according to their traffic type.

6. The Internet access behavior early warning system based on network packet processing according to claim 1, characterized in that, Before classifying and storing data packets based on the DPI parsing results, data pointing to personal identification information is encrypted, and a temporary storage time is set. Original data packets that exceed the temporary storage time are automatically detected and deleted.

7. The Internet access behavior early warning system based on network packet processing according to claim 1, characterized in that, The user profiling module constructs a user network behavior model and performs user profile analysis based on the user's stored data packets to identify abnormal behavior, specifically: Preprocess user behavior data; The elbow method is used to determine the optimal number of clusters K. The K-means algorithm is applied to classify users. Based on the user characteristics of each cluster, representative behavioral patterns are identified. Combined with domain knowledge, clusters that do not conform to normal behavioral patterns are identified and labeled.

8. The Internet access behavior early warning system based on network packet processing according to claim 1, characterized in that, The gateway device is deployed at the UPF sink node of the 5G customized network. After a user signs up for a DNN package on the 5G customized network, the gateway device uses 5G DNN authentication, authorization and billing to obtain the fixed IP address of each signed user and then aggregates the mobile internet traffic of each user and sends it to the UPF sink node.

9. The Internet access behavior early warning system based on network packet processing according to claim 7, characterized in that, Preprocessing of user behavior data includes: using 5GDNN for authentication, authorization, and billing to identify and process duplicate users.

10. A method for early warning of internet access behavior based on network packet processing, characterized in that, Includes the following steps: XDP technology is used to capture user data packets in real time at the network driver layer, and the captured data packets are filtered based on the configured filtering rules, selecting data packets that meet the set rules. The selected data packets are analyzed using DPI technology, and each user's data packets are tagged and categorized based on the analysis results. Build user network behavior models and perform user profiling analysis based on user stored data packets to identify abnormal behaviors; Configure early warning rules and notification methods based on business needs and risk levels, and issue early warnings for abnormal user behavior.

Images