Flow control method based on neural network

Abstract

The invention discloses a flow control method based on a neural network, and relates to the technical field of network flow control, and the method comprises the steps: collecting network flow metadata, constructing a standardized feature data set, carrying out the flow data classification and prediction based on a hybrid neural network, generating a differential flow control strategy, and carrying out the strategy optimization and dynamic adjustment; statistical features are extracted by using flow metadata acquired in multiple environments, spatial-temporal feature fusion and attention weighting are carried out in combination with a convolutional neural network and a long-short-term memory network, and network state recognition and flow trend analysis are realized; based on an analysis result, generating a control strategy adaptive to different network environments, and performing strategy optimization and real-time adjustment through reinforcement learning; the problems of accurate flow control and dynamic strategy adjustment in a complex network environment are effectively solved, and the accuracy, the adaptivity and the system stability of flow control are improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network flow control, in particular to a flow control method based on a neural network. BACKGROUND

[0002] With the rapid development of network communication, cloud computing and the Internet of Things industry, in the field of network flow management, the flow control method based on the neural network as the core technology to ensure the efficient operation of the network directly affects the network resource utilization and operation stability in terms of flow classification accuracy, real-time control ability and multi-environment adaptability. With the introduction of machine learning technology, a technical leap from traditional static rule control to dynamic intelligent decision-making is realized. By constructing a basic neural network to process flow data, the flow control method initially meets the basic flow control requirements of the network. However, the existing technology still has many shortcomings. The traditional flow control method based on the neural network is mainly aimed at the dynamic mapping of flow characteristics and control strategies in a single network. It lacks real-time flow trend prediction and control strategy dynamic adjustment mechanism for different network architecture adaptation strategies, and does not consider the nonlinear fluctuation of flow characteristics in complex network environments, resulting in low accuracy of flow classification and control, poor control strategy adaptability and low operation stability when facing multiple architecture network coverage.

[0003] In order to solve the above-mentioned defects, the present application provides a technical solution. SUMMARY

[0004] The purpose of the present application is to solve the problems of low accuracy of flow classification and control, poor control strategy adaptability and low operation stability, and to propose a flow control method based on a neural network.

[0005] The purpose of the present application can be achieved by the following technical solution: The flow control method based on the neural network comprises: S1, standardization feature dataset construction: deploying a data collector in a traditional network, a software-defined network and a cloud-native environment to continuously capture flow metadata containing five-tuple information and flow statistical information; slicing the flow metadata at fixed time intervals to construct a time series window; extracting four types of features including flow size, connection diversity, protocol behavior and advanced statistics for a single window; combining the features into a fixed-dimensional feature vector in a pre-defined order, adding the collection time and network environment type label, and generating a standardized feature dataset; S2, flow data classification and prediction: based on the standardized feature dataset constructed in S1, a hybrid neural network architecture combining convolutional neural network and long short-term memory network is used to realize the classification and prediction of network flow data; S3, differentiated traffic control policy generation: based on the traffic classification and prediction results of S2, combined with the architecture characteristics of different network environments, a dynamically adaptive traffic control policy system is constructed; S4, policy optimization and dynamic adjustment: based on the key feature weights output by the attention mechanism layer, the effectiveness of the issued policy is evaluated in real time; S5, policy execution and effect evaluation: the control policy generated by S4 is issued to the control interface of the corresponding network environment, and the implementation effect is monitored.

[0006] Further, the specific implementation steps of the S2 step include: Construct a hybrid neural network architecture, including: Input layer processing: receive the standardized feature data set, and stack the feature vectors in the time sequence window into a three-dimensional tensor in time order; Time series feature extraction: capture the time dimension correlation of traffic data, based on a bidirectional long short-term memory network, output a hidden state sequence containing forward and backward time series correlation; Spatial feature fusion: extract the spatial correlation between feature dimensions, based on maximum pooling to compress the time dimension to obtain a spatial feature matrix, and combine the flattening process to convert to a spatial feature vector; Attention weighted fusion: concatenate the time series and spatial feature vectors to form a fusion feature matrix, and obtain a similarity score based on parameterized query; obtain attention weights by normalizing with a softmax function, and generate a global feature vector combined with the fusion feature matrix; Output layer processing: use a softmax activation function to output network state classification results including normal, congestion, attack, and abnormal connections; Output traffic key indicators through linear regression analysis, including PPS and BPS peak values, TCP connection establishment success rate, and packet loss rate.

[0007] Further, the specific implementation steps of the S2 step also include: Multi-dimensional analysis and cross-dimensional correlation verification of traffic patterns: Through the formula Get the trend intensity coefficient, where is the number of sampling points in the window, , represents the time index of the sampling point in the window, is the feature value of the th sampling point in the window, respectively represent the mean and standard deviation of the time index , and represent the mean and standard deviation of the feature value ; If the trend intensity coefficient is positive, it is determined to be an upward trend, and if it is negative, it is a downward trend; Based on the comparison of the absolute value of the trend intensity coefficient and the preset interval, it is determined as a strong trend, a weak trend or a stable state; On the millisecond time scale, if the trend intensity coefficient of the SYN flag bit frequency is greater than the preset interval and exceeds 3 windows, it is determined as a session establishment intensive period; If the trend intensity coefficient of the FIN flag bit frequency is greater than the preset interval and the standard deviation trend intensity coefficient of the data packet arrival interval exceeds the threshold value, it is determined as an abnormal trend of session concentration interruption; On the minute time scale, if the PPS trend intensity coefficient and the BPS trend intensity coefficient are both greater than the preset interval, and the flow rate fluctuation exceeds 2 times the historical average, it is determined as a burst flow impact; If the trend intensity coefficient of the bandwidth utilization rate is greater than the preset interval and lasts for more than 5 windows, combined with the maximum carrying bandwidth of the physical link of the network environment , the formation probability of the congestion trend is obtained; If the congestion trend probability exceeds the preset threshold value, it is determined as a high probability congestion trend.

[0008] Further, the specific operation steps of the cross-dimension association verification are as follows: When the trend intensity coefficient of the TCP protocol proportion is a positive value and greater than a preset interval (hereinafter referred to as a strong positive value), and the trend intensity coefficient of the source IP and destination IP diversity is a negative value and greater than a preset interval, combined with the local interaction characteristics of the TCP flag bit sequence, it is determined as a potential TCP connection hijacking attack trend; The five-tuple information in the current time window is extracted and matched with the historical attack feature library, and if the matching degree exceeds the preset threshold value, the session tracking mechanism is triggered; When the trend intensity coefficients of the flow entropy value, PPS and BPS are all strong positive values, combined with the cross-dimension association characteristics, it is determined as a dramatic change in the flow coupling mode; Based on the Pearson coefficient, the time series correlation of the abnormal TCP flag bit combination and the number of bytes of the burst flow is obtained, and if the correlation is greater than a preset threshold value, it is determined as a feature combination of a distributed denial of service attack; In the traditional network, when the trend intensity coefficients of the bandwidth utilization rate and the ICMP protocol proportion are both greater than the preset interval, combined with the distribution characteristics of the ICMP message length, the ICMP flooding attack is identified; In the software-defined network, when the trend intensity coefficient of the flow table item update frequency shows an upward trend and the trend intensity coefficient of the source port diversity shows a downward trend, it is determined as a precursor of a flow table overflow attack.

[0009] Further, the specific operation steps of the S3 step are as follows: Based on the network state classification result and the traffic key indicator prediction value output by S2, four general control actions of traffic shaping, session management, protocol intervention and resource scheduling are predefined; For the traditional network environment: policy execution is based on the switch or router configuration interface, and the control action is converted into a specific device command line instruction; When the output layer determines that the congestion state and the congestion trend probability are greater than the preset threshold, a rate limit and priority queue adjustment strategy is generated; When the output layer determines that the attack state and the ICMP flooding attack are identified, a protocol intervention strategy is generated; For the software defined network environment: policy execution is based on the northbound interface of the SDN controller; and the control action is converted into a NETCONF protocol message; When the output layer determines that the abnormal connection state and the flow table overflow attack precursor are identified, a combined session management and resource scheduling strategy is generated: When the trend analysis identifies the session concentration disconnection anomaly, a session termination strategy is generated.

[0010] Further, the specific operation steps of the S4 are as follows: Through the formula The policy suppression coefficient is obtained, wherein, and respectively represent the feature values of the first characteristics before and after policy execution, represents the weight of the first characteristics in the attention mechanism, is the total number of characteristics; If the policy suppression coefficient is greater than the preset threshold, it is determined that the policy is effective, and if the policy suppression coefficient is less than the preset threshold, it is determined that the policy does not achieve the expected effect, triggering the policy optimization process: Based on the near-end policy optimization reinforcement learning algorithm, an optimization framework is constructed with the network state as the state space, the control action as the action space, and the policy suppression coefficient as the reward function, including: Construct a policy evaluation matrix: record the feature vector change amount, attention weight and policy suppression coefficient before and after the historical policy execution; Construct a policy knowledge base: store the effective policy combination and the corresponding policy suppression coefficient under different network states; Policy optimization decision: when the policy suppression coefficient is less than the preset threshold, retrieve the policy with the highest suppression coefficient under the same network state from the policy knowledge base as the reference policy; Dynamic action combination adjustment: when single policy optimization still cannot achieve the expected effect, combine different categories of control actions, and select the optimal combination based on the Q learning algorithm for execution.

[0011] Further, the specific operation steps of S5 are as follows: In a traditional network environment, control policies are pushed to core switches or border routers through an out-of-band management network, and policy transmission and execution triggering are completed through an SSH protocol; In a software-defined environment, control policies are converted into flow table modification requests, which are sent to an SDN controller and synchronously updated to the flow tables of all network switches; In a cloud-native environment, policies are injected into virtual switch configuration files and triggered to take effect through a container orchestration platform API interface; A data collector collects traffic metadata after policy execution, generates a standardized dataset based on feature extraction, and obtains new classification results and prediction values based on a hybrid neural network evaluation; if the prediction value deviates from the policy target by more than the tolerance limit, real-time alarms are triggered, and an abnormality analysis report is generated; Meanwhile, the evaluation results are input into a policy evaluation matrix and a knowledge base, and historical policy execution records are updated.

[0012] Compared with the prior art, the present application has the following advantages: The present application captures traffic metadata in traditional networks, software-defined networks and cloud-native environments by deploying multiple environment data collectors, constructs a standardized feature dataset containing time series windows and environment labels, realizes deep fusion of traffic spatio-temporal features by combining a hybrid architecture of convolutional neural networks and bidirectional long short-term memory networks, introduces an attention mechanism to weight key features to enhance the accuracy of anomaly identification and trend analysis, generates differentiated traffic control policies based on the characteristics of different network environment architectures, and dynamically adjusts policy parameters and action combinations through a proximal policy optimization reinforcement learning algorithm, significantly improving the accuracy of network traffic state classification, the multi-environment adaptability of control policies and the stability of system operation, while optimizing the response speed of traffic anomalies and the utilization efficiency of network resources. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to facilitate understanding by those skilled in the art, the present application will be further described below with reference to the accompanying drawings; Figure 1 The method flowchart of the present application. DETAILED DESCRIPTION

[0014] The technical solutions of the present application will be described below in conjunction with embodiments, obviously, the described embodiments are only part of the embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the scope of protection of the present application.

[0015] It should be understood that the terms "comprises" and "comprising," when used in this specification and claims, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0016] It should also be understood that the terms used in the specification of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure. As used in the specification and claims of the present disclosure, the singular forms "a," "an," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should be further understood that the term "and / or" used in the specification and claims of the present disclosure means any combination of one or more of the associated listed items and all possible combinations thereof.

[0017] As shown in Figure 1 The present application is a neural network-based traffic control method, including standardized feature dataset construction, traffic data classification and prediction, differentiated traffic control strategy generation, strategy optimization and dynamic adjustment, and strategy execution and effect evaluation.

[0018] S1, Standardized Feature Dataset Construction: By collecting network traffic data and extracting features from the network traffic data, a standardized feature dataset is generated, and the specific implementation process is as follows: S101, Multi-environment Traffic Data Collection: For the architectural differences of different network environments, unified frequency collection is used for differentiated collection: In a traditional network environment: a copy of the traffic is sent to the data collector through port mirroring or optical splitter on the core switch or border router of the network, wherein: Port mirroring: the traffic of the target service port is copied to the preset monitoring port through device configuration, and the monitoring port is connected with the dedicated data collector through network cable for traffic data collection; the service port includes the aggregation port of the core switch and the export port of the border router; Optical splitter: a passive optical branching device is connected in series in the optical link between the router and the switch, passively copies the optical signal traffic, and transmits to the dedicated data collector supporting optical signal reception to obtain the traffic data; In a software-defined network environment: the SDN controller is configured as a data collection center; the SDN controller collects the flow table statistical data reported by the switches in the whole network through the southbound interface; In a cloud-native environment: a dedicated data collector deployed on a computing node or a dedicated virtual machine obtains traffic data from a virtual switch, including PodIP, service port, and traffic statistical information; S102, flow metadata definition and slicing: The data collector continuously captures flow metadata in different network environments at a preset collection frequency, and the flow metadata includes five-tuple information and flow statistical information; wherein the five-tuple information includes source IP address, destination IP address, source port number, destination port number and transport layer protocol; the flow statistical information includes packet length, message arrival timestamp and TCP flag bit; The flow metadata is sliced based on a fixed time interval, and a time series window is constructed, each window containing 60 sampling points to ensure the continuity of the time sequence characteristics; S103, statistical feature extraction and feature vector construction: Four types of statistical features are extracted for all flow metadata in a single time series window, including: Traffic size features, including bandwidth utilization, packet quantity PPS, byte quantity BPS, traffic rate fluctuation and session number; Connection diversity features, including source IP and destination IP diversity, source port and destination port diversity, continuous duration distribution and continuous state distribution; Protocol behavior features, including TCP protocol, UDP protocol, ICMP protocol and application layer protocol; Advanced statistical features, including time series features, distribution features, correlation features and entropy values; The four types of statistical features are sorted based on a predefined order combination to form a fixed-dimensional feature vector, and a data label is added to generate a standardized feature dataset, and the data label includes collection time and network environment type.

[0019] S2, flow data classification and prediction: based on the standardized feature dataset constructed in S1, a hybrid neural network architecture combining convolutional neural network and long short-term memory network is used to realize the classification and prediction of network flow data, and the specific implementation process is as follows: S201, neural network architecture design: in view of the differences of flow features in traditional network, software defined network and cloud native environment, a hybrid neural network architecture combining convolutional neural network and long short-term memory network is adopted, including input layer, time sequence feature extraction unit, spatial feature fusion unit, attention mechanism layer and output layer, and the functions and parameters of each layer are as follows: Input layer: receiving the fixed bit dimension feature vector generated by S1, stacking the feature vector in the time sequence window into a three-dimensional tensor according to time sequence, and the three-dimensional tensor includes window length, feature dimension and channel number; The time sequence feature extraction unit captures the correlation of the traffic data in the time dimension, including the periodicity of the data packet arrival interval and the trend change of the traffic size; after being processed by a 3-layer bidirectional long short-term memory network, a hidden state sequence containing forward and backward time sequence correlation is output; The spatial feature fusion unit adopts a 2-layer convolutional neural network to extract the spatial correlation between feature dimensions. The first layer uses 32 convolutional kernels with a size of 3 to capture local feature interaction, and the output dimension is 300x32. The second layer uses 64 convolutional kernels with a size of 5 to capture cross-dimensional correlation, and the output dimension is 300x64. After compressing the time dimension based on max-pooling, a spatial feature matrix is obtained, which is converted into a 9600-dimensional spatial feature vector based on flattening processing; The attention mechanism layer assigns weights to the fusion results of the time sequence features and the spatial features, strengthens the influence weight of the key features, and suppresses the interference of noise features; the key features include abnormal TCP flag combination and byte number change of burst traffic; The hidden state sequence output by the time sequence feature extraction unit is compressed into a 128-dimensional time sequence feature vector through global average pooling, and the 9600-dimensional spatial feature vector output by the spatial feature fusion unit is spliced to form a 9728-dimensional fusion feature matrix; Based on the parameterized query and the fusion feature matrix, a similarity score is obtained, which is normalized by softmax to obtain an attention weight. Based on the fusion feature matrix and the attention weight, a weighted sum is performed to obtain a global feature vector; The output layer uses a softmax activation function to output network state classification results and traffic key indicator prediction values. The network classification results include normal, congestion, attack, and abnormal connection; At the same time, the linear regression analysis is used to output the traffic key indicators, including PPS peak value, BPS peak value, average packet length, TCP connection establishment success rate, and packet loss rate; The Min-Max normalization is used to normalize the standardized feature dataset, and the feature values are mapped to the interval; The normalized dataset is divided into a training set and a test set according to a predetermined proportion. The training set is used for mixed neural network parameter iteration, and the test set is used to evaluate the generalization ability of the mixed neural network; S202, traffic trend analysis: based on the hidden state sequence output by the bidirectional long short-term memory network, the spatial feature vector output by the convolutional neural network, and the attention weight, the traffic pattern is analyzed in multiple dimensions. The specific implementation process is as follows: S202.1, trend intensity analysis: The hidden state sequence output by the time sequence feature extraction unit is time-dimensionally disassembled, and through sliding window slicing and time sequence pattern matching, traffic trend features at different time scales are identified, and the trend intensity coefficient is calculated by the formula , wherein, is the number of sampling points in the window, represents the time index of the sampling point in the window, is the feature value of the th sampling point in the window, respectively represent the mean and standard deviation of the time index , and represent the mean and standard deviation of the feature value ; If the trend intensity coefficient is positive, the feature value presents an upward trend over time, and if it is negative, the feature value presents a downward trend over time; When the absolute value of the trend intensity coefficient is greater than the preset interval, it is determined to be a strong trend; when the absolute value of the trend intensity coefficient is in the preset interval, it is determined to be a weak trend; and when the absolute value of the trend intensity coefficient is less than the preset interval, it is determined to be a stable state; S202.2, time-scale trend analysis: On the millisecond time scale, the hidden state of the data packet arrival interval and the TCP flag sequence is analyzed with W as the window width and S as the sliding step: Based on the trend intensity coefficient formula, the trend intensity coefficients of the SYN flag occurrence frequency and the FIN flag occurrence frequency in the window are calculated and , if is greater than the preset interval and lasts for more than 3 windows, it is determined to be a session establishment intensive period; if is greater than the preset interval and the trend intensity coefficient of the data packet arrival interval standard deviation is greater than the preset threshold, it is identified as an abnormal trend of concentrated session disconnection; On the minute time scale, the trend of the traffic size feature is analyzed with W as the window width and S as the sliding step: Based on the trend intensity coefficient formula, the trend intensity coefficients of PPS, BPS, and bandwidth utilization rate are calculated , and , if is greater than the preset interval and is greater than the preset interval and appears simultaneously, and the traffic rate fluctuation feature value of the corresponding window exceeds the historical mean value by 2 times, it is determined to be a burst traffic impact; if is greater than the preset interval and lasts for more than 5 windows, in combination with the maximum carrying bandwidth of the physical link of the current network environment, the formation probability of the congestion trend is predicted, and the formula is used a congestion trend probability is calculated, wherein, represents the actual bandwidth utilization rate of the current window, represents the number of consecutive windows greater than a preset interval, represents a threshold of the number of windows of the sustained trend, respectively represent the influence weight factor of the ratio of the actual bandwidth utilization rate to the maximum carrying bandwidth, the ratio of the number of consecutive windows to the window number threshold, and the trend intensity coefficient; When the congestion trend probability is greater than a preset threshold, a high probability of congestion trend is determined, a flow warning control is triggered, and a predicted congestion occurrence time window is output synchronously. S202.3, cross-dimension association verification: Protocol behavior and connection diversity feature association: If the trend intensity coefficient of the TCP protocol proportion in the protocol behavior feature is a strong positive value and greater than a preset interval (hereinafter referred to as a strong positive value), and the trend intensity coefficient of the source IP and destination IP diversity in the connection diversity feature is a strong negative value and greater than a preset interval (hereinafter referred to as a strong negative value), combined with the local interaction feature of the TCP flag sequence extracted by the convolutional neural network, a potential TCP connection hijacking attack trend is determined; extract the five-tuple information in the current window, and perform pattern matching with the historical attack feature library, if the matching degree exceeds a preset threshold, the session tracking mechanism is triggered. Advanced statistics and flow size feature association: If the trend intensity coefficient of the flow entropy value is a strong positive value, and the trend intensity coefficients of PPS and BPS are both strong positive values, combined with the cross-dimension association features in the spatial feature matrix, a dramatic change in the flow coupling mode is determined. Key feature cross-verification based on attention weight: The weight value output by the attention mechanism layer is used as a feature importance indicator, and the top 20% features are analyzed for cross-category association when the abnormal TCP flag combination and the byte number change of the burst flow appear at the same time, and the trend intensity coefficients corresponding to them are both strong positive values. Through the Pearson coefficient, the time series correlation of the abnormal TCP flag combination and the byte number of the burst flow is obtained, if the correlation is greater than a preset threshold, a feature combination of a distributed denial of service attack is determined. For traditional network environment, associate the flow size feature and the protocol behavior feature collected by the port mirror: When the bandwidth utilization rate trend intensity coefficient and the ICMP protocol proportion trend intensity coefficient are both greater than a preset interval, combined with the distribution feature of the ICMP message length in the spatial feature vector, an ICMP flooding attack is identified. In a software-defined network environment, the trend strength coefficient of the flow table item update frequency is associated with the connection diversity feature by collecting the flow table statistics data through the SDN controller. If the flow table item update frequency presents an upward trend and the source port diversity presents a downward trend, it is determined that it is a precursor of a flow table overflow attack. Based on the cross-dimension association analysis result, a multi-feature coordinated traffic mode portrait is generated.

[0020] S3, differential traffic control strategy generation: based on the traffic analysis and prediction results of S2, combined with the architecture characteristics of different network environments, a dynamically adaptive traffic control strategy system is constructed, and the specific implementation process is as follows: S301, construction of general control action library: based on the network state classification results and traffic key indicator prediction values output by S2, four types of general control actions are predefined, including: Traffic shaping actions: including rate limiting, priority queue adjustment, window size dynamic setting, and burst traffic absorption; Session management actions: including session termination, session rate limiting, session table item aging time adjustment, and black list and white list updating; Protocol intervention actions: including protocol traffic filtering, protocol priority adjustment, TCP flag bit verification enhancement, and ICMP request response strategy; Resource scheduling actions: including link load redistribution, virtual network function elastic scaling, and dynamic adjustment of cache and buffer;

[0021] S302, environment differentiated strategy mapping: For traditional network environment: policy execution is based on the configuration interface of core switch or border router; control action is converted into specific device command line instruction or SNMP configuration change; When the output layer is determined to be in a congestion state and the congestion trend probability is greater than a preset threshold, rate limiting and priority queue adjustment strategies are generated: based on the PPS peak value and BPS peak value in the traffic size feature, the limiting threshold is calculated; based on the application layer protocol distribution in the protocol behavior feature, the differentiated priority is set; through an automatic script, the configuration is issued to the core switch; When the output layer is determined to be in an attack state and identified as an ICMP flooding attack, a protocol intervention strategy is generated: ICMP traffic filtering rules are deployed on the border router, and feature matching is performed based on the source IP address and destination IP address in the five-tuple information, and a black list updating action is linked; For software-defined network environment: policy execution is based on the northbound interface of SDN controller; control action is converted into NETCONF protocol message; When the output layer is determined to be in an abnormal connection state and identified as a precursor of a flow table overflow attack, a combined strategy of session management and resource scheduling is generated: The SDN controller issues incremental flow table entry aging policies to shorten the timeout time of inactive flow table entries; at the same time, based on flow table statistics, the switch flow table storage resource allocation is dynamically adjusted, and flow table discard rules are issued for abnormal source IPs. When trend analysis identifies a session disconnection anomaly, a session termination policy is generated: the SDN controller sends a Flow-Mod message to the relevant switches to terminate the session that matches the anomaly 5-tuple information. For cloud-native environments: policy enforcement is based on container network interfaces or service mesh control planes; control actions are translated into iptables rules, Envoy filter configurations, or custom resource definitions; When the output layer determines that the state is abnormal and identifies a TCP connection hijacking attack trend, a combined strategy of protocol intervention and session management is generated: based on PodIP and service port information, TCP flag verification rules are deployed at the virtual switch level; at the same time, abnormal connections are terminated and session context is recorded through the service mesh sidecar proxy. When traffic trend analysis identifies a sudden traffic surge, a resource scheduling strategy is generated: based on the virtualization infrastructure interface, the relevant Pod instances are elastically scaled up or down, or the queue cache size of the virtual switch is adjusted.

[0022] S4. Strategy Optimization and Dynamic Adjustment: Based on the key feature weights output by the attention mechanism layer, the effectiveness of the issued strategy is evaluated in real time. The specific operation steps are as follows: By continuously monitoring the changes in feature vectors after the strategy is executed, and through the formula The policy suppression coefficient is calculated, where, These represent the values ​​before and after the strategy execution, respectively. The feature values ​​of each feature Indicates the first The weights of each feature in the attention mechanism The total number of features; If the policy suppression coefficient is greater than the preset threshold, the policy is deemed effective; if the policy suppression coefficient is less than the preset threshold, the policy is deemed not to have met expectations, and the policy optimization process is triggered. Based on the near-end policy optimization reinforcement learning algorithm, an optimization framework is constructed with network state as the state space, control actions as the action space, and policy suppression coefficient as the reward function. By combining historical policy databases and real-time network state, the control action parameters are dynamically adjusted or action combinations are switched. The construction process of the optimization framework is as follows: Construct a policy evaluation matrix: record the changes in feature vectors, attention weights, and policy inhibition coefficients before and after the historical policy execution; Build a policy knowledge base: store effective policy combinations and corresponding policy suppression coefficients under different network conditions; Policy optimization decision: when the policy inhibition coefficient is less than the preset threshold, retrieve the policy with the highest inhibition coefficient under the same network state from the policy knowledge base as the baseline policy, fine-tune the action parameters through the policy gradient algorithm, and generate an optimized policy; Dynamic action combination adjustment: when single policy optimization still cannot achieve the expected effect, use integrated policy approach to combine different categories of control actions, evaluate the long-term returns of action combinations based on Q-learning algorithm, and select the optimal combination for execution.

[0023] S5, policy execution and effect evaluation: used to issue the control policy generated by S4 to the control interface of the corresponding network environment and monitor the implementation effect. The specific implementation process is as follows: S501, policy issuance and execution: For traditional network environment, with the help of out-of-band management network, control policy is pushed to the management interface of core switch or border router, and SSH protocol is used to complete policy transmission and execution trigger; In the software-defined network environment, the control policy is converted into a flow table modification request, which is sent to the SDN controller through the southbound interface, and the SDN controller completes the flow table synchronization update of the whole network switch; In the cloud native environment, through the API interface of the container orchestration platform, the control policy is injected into the configuration file of the virtual switch, and the configuration reload is triggered to take effect; S502, policy effect evaluation: Based on the traffic metadata collected by the data collector after the policy is executed, the collected new traffic metadata is input into the feature extraction process to generate a standardized feature dataset after the policy is executed, and a hybrid neural network is used for evaluation to obtain a new classification result and a prediction value; If the prediction value exceeds the deviation tolerance range preset by the policy target, real-time alarm is triggered and an abnormal analysis report is generated. The alarm information is displayed through the visualization interface of the integrated management platform and pushed to the network operation personnel through the message interface. The abnormal analysis report includes abnormal policy ID, trigger timestamp, abnormal prediction index and deviation value, as well as associated network environment type and device information; At the same time, the evaluation results of the policy are input into the policy evaluation matrix and policy knowledge base established by S4 to update the historical policy execution records.

[0024] The preferred embodiments of the application disclosed above are only to facilitate the elucidation of the application. The preferred embodiments do not describe all the details of the application and limit the application to the specific embodiments. Obviously, many modifications and variations can be made in light of the teachings above. The description is chosen and described in order to provide the best illustration of the application and its practical application to those skilled in the art and to enable those skilled in the art to best utilize the application. The application is limited only by the claims and their full scope and equivalents.

Claims

1. A method of flow control based on neural networks, characterized in that, Comprise: S1, standardized feature dataset construction: deploy data collectors in traditional networks, software-defined networks, and cloud-native environments to continuously capture traffic metadata containing five-tuple information and traffic statistics; slice the traffic metadata at fixed time intervals to construct time series windows; extract four types of features: traffic size, connection diversity, protocol behavior, and advanced statistics, from individual windows; Combine in a predefined order to form a fixed-dimensional feature vector, add collection time and network environment type labels, and generate a standardized feature dataset; S2, traffic data classification and prediction: based on the standardized feature dataset constructed in S1, a hybrid neural network architecture combining convolutional neural networks and long short-term memory networks is used to realize the classification and prediction of network traffic data; S3, differential traffic control policy generation: based on the traffic classification and prediction results of S2, combined with the architecture characteristics of different network environments, a dynamically adaptive traffic control policy system is constructed; S4, policy optimization and dynamic adjustment: based on the key feature weights output by the attention mechanism layer, the effectiveness of the issued policy is evaluated in real time; S5, policy execution and effect evaluation: the control policy generated in S4 is issued to the control interface of the corresponding network environment, and the implementation effect is monitored.

2. The neural network-based flow control method of claim 1, wherein, The specific implementation steps of the S2 step include: Construct a hybrid neural network architecture, including: Input layer processing: receive the standardized feature dataset, and stack the feature vectors in the time series window into a three-dimensional tensor in time order; Time series feature extraction: capture the time dimension correlation of traffic data, based on bidirectional long short-term memory network, output hidden state sequence containing forward and backward time series correlation; Spatial feature fusion: extract spatial correlation between feature dimensions, compress time dimension based on max pooling to get spatial feature matrix, and convert to spatial feature vector combined with flattening processing; Attention weighted fusion: concatenate the time series and spatial feature vectors to form a fusion feature matrix, and obtain similarity scores based on parameterized queries; get attention weights by softmax function normalization, and generate global feature vector combined with fusion feature matrix; Output layer processing: use softmax activation function to output network state classification results including normal, congestion, attack, and abnormal connection; Output traffic key indicators through linear regression analysis, including PPS and BPS peak value, TCP connection establishment success rate, and packet loss rate.

3. The neural network-based flow control method of claim 1, wherein, The specific implementation steps of the S2 step also include: Multi-dimensional analysis and cross-dimensional correlation verification of traffic patterns: The trend intensity coefficient is obtained by formula wherein, is the number of sampling points in the window, represents the time index of the sampling points in the window, is the feature value of the sampling point in the window, respectively represents the mean and the standard deviation of the time index , and represents the mean and the standard deviation of the feature value . If the trend intensity coefficient is positive, it is determined to be an upward trend, and if it is negative, it is determined to be a downward trend; Based on the comparison of the absolute value of the trend intensity coefficient and the preset interval, it is determined to be a strong trend, a weak trend, or a stable state; If the frequency trend intensity coefficient of the SYN flag bit is greater than 0.5 on the millisecond time scale If the duration is greater than the preset interval and exceeds 3 windows, it is determined as a session establishment intensive period. If the frequency trend strength coefficient of the FIN flag bit If the trend strength coefficient of the data packet arrival interval standard deviation exceeds the preset range and the data packet arrival interval standard deviation exceeds the threshold, it is judged as an abnormal trend of concentrated session disconnection. If the PPS trend intensity coefficient and the BPS trend intensity coefficient are both greater than a preset interval, and the flow rate fluctuation exceeds twice the historical average, the burst flow impact is determined. Bandwidth utilization trend intensity coefficient The maximum carrying bandwidth of the physical link of the network environment is greater than the preset interval and lasts for more than 5 windows The formation probability of the congestion trend is obtained. If the congestion trend probability exceeds the preset threshold, it is determined to be a high probability of congestion trend.

4. The neural network-based flow control method of claim 3, wherein, The specific operation steps of the cross-dimensional correlation verification are as follows: When the trend intensity coefficient of the TCP protocol proportion is a positive value and greater than a preset interval (hereinafter referred to as a strong positive value), and the trend intensity coefficient of the source IP and destination IP diversity is a negative value and greater than a preset interval, and in combination with the local interaction features of the TCP flag sequence, it is determined that there is a potential TCP connection hijacking attack trend; The quintuple information in the current time window is extracted, and is matched with the historical attack feature library. If the matching degree exceeds a preset threshold, the session tracking mechanism is triggered; When the trend intensity coefficients of the traffic entropy value, PPS and BPS are all strong positive values, in combination with the cross-dimension association features, it is determined that the traffic coupling mode changes dramatically; Based on the Pearson coefficient, the time sequence correlation of the abnormal TCP flag combination and the byte number of the burst traffic is obtained. If the correlation is greater than a preset threshold, it is determined that there is a feature combination of a distributed denial of service attack; In a traditional network, when the trend intensity coefficients of the bandwidth utilization rate and the ICMP protocol proportion are both greater than a preset interval, in combination with the distribution features of the ICMP message length, an ICMP flooding attack is identified. In a software defined network, when the trend intensity coefficient of the flow table item update frequency shows an upward trend and the trend intensity coefficient of the source port diversity shows a downward trend, it is determined that there is a precursor of a flow table overflow attack.

5. The neural network-based flow control method of claim 1, wherein, The specific operation steps of the S3 step are as follows: Based on the network state classification result and the traffic key indicator prediction value output by S2, four general control actions of traffic shaping, session management, protocol intervention and resource scheduling are predefined; For a traditional network environment: policy execution is based on the configuration interface of a switch or a router, and the control action is converted into a specific device command line instruction; When the output layer is determined to be in a congestion state and the congestion trend probability is greater than a preset threshold, a rate limit and a priority queue adjustment strategy is generated; When the output layer is determined to be in an attack state and an ICMP flooding attack is identified, a protocol intervention strategy is generated; For a software defined network environment: policy execution is based on the northbound interface of an SDN controller; and the control action is converted into a NETCONF protocol message; When the output layer is determined to be in an abnormal connection state and a precursor of a flow table overflow attack is identified, a combined strategy of session management and resource scheduling is generated: When the trend analysis identifies a session concentration disconnection anomaly, a session termination strategy is generated.

6. The neural network-based flow control method of claim 1, wherein, The specific operation steps of the S4 are as follows: The policy inhibition coefficient is obtained by formula wherein, respectively represent the feature values of the first characteristics before and after the policy execution, represent the weights of the first characteristics in the attention mechanism, is the total number of characteristics. If the policy suppression coefficient is greater than a preset threshold, it is determined that the policy is effective. If the policy suppression coefficient is less than a preset threshold, it is determined that the policy does not meet the expectation, and a policy optimization process is triggered: Based on the near-end policy optimization reinforcement learning algorithm, an optimization framework is constructed, taking the network state as the state space, the control action as the action space and the policy suppression coefficient as the reward function, including: A policy evaluation matrix is constructed: the feature vector change amount, the attention weight and the policy suppression coefficient before and after the historical policy execution are recorded; A policy knowledge base is constructed: the effective policy combination and the corresponding policy suppression coefficient under different network states are stored; Policy optimization decision: when the policy suppression coefficient is less than a preset threshold, the policy with the highest suppression coefficient under the same network state is retrieved from the policy knowledge base as the benchmark policy. Dynamic action combination adjustment: when single policy optimization still cannot achieve the expected effect, combine different categories of control actions, and select the optimal combination based on the Q learning algorithm.

7. The neural network-based flow control method of claim 1, wherein, The specific operation steps of S5 are as follows: In the traditional network environment, the control policy is pushed to the core switch or border router through the out-of-band management network, and the policy transmission and execution trigger are completed through the SSH protocol; In the software-defined environment, the control policy is converted into a flow table modification request and sent to the SDN controller, and the switch flow table of the whole network is updated synchronously; In the cloud-native environment, through the container orchestration platform API interface, the policy is injected into the virtual switch configuration file and triggered to reload and take effect; The data collector collects the traffic metadata after the policy is executed, generates a standardized dataset based on feature extraction, and evaluates the new classification results and prediction values based on a hybrid neural network; If the prediction value deviates from the policy target by more than the tolerance limit, trigger real-time alarms and generate abnormal analysis reports; At the same time, input the evaluation results into the policy evaluation matrix and knowledge base, and update the historical policy execution records.

Images